Container Instrumentation and Enforcement System for Runtime Security of Kubernetes Platform with eBPF
DC Field | Value | Language |
---|---|---|
dc.contributor.author | Gwak, Songi | - |
dc.contributor.author | Doan, Thien-Phuc | - |
dc.contributor.author | Jung, Souhwan | - |
dc.date.accessioned | 2023-09-04T05:40:06Z | - |
dc.date.available | 2023-09-04T05:40:06Z | - |
dc.date.issued | 2023-06 | - |
dc.identifier.issn | 1079-8587 | - |
dc.identifier.issn | 2326-005X | - |
dc.identifier.uri | https://scholarworks.bwise.kr/ssu/handle/2018.sw.ssu/44221 | - |
dc.description.abstract | Containerization is a fundamental component of modern cloudnative infrastructure, and Kubernetes is a prominent platform of container orchestration systems. However, containerization raises significant security concerns due to the nature of sharing a kernel among multiple containers, which can lead to container breakout or privilege escalation. Kubernetes cannot avoid it as well. While various tools, such as container image scanning and configuration checking, can mitigate container workload vulnerabilities, these are not foolproof and cannot guarantee perfect isolation or prevent every active threat in runtime. As such, a policy enforcement solution is required to tackle the problem, and existing solutions based on LSM (Linux Security Module) frameworks may not be adequate for some situations. To address this, we propose an enforcement system based on BPF-LSM, which leverages eBPF (extended Berkeley Packet Filter) technology to provide fine-grained control and dynamic adoption of security policies. In this paper, we compare different LSM implementations to highlight the challenges of current enforcement solutions before detailing the design of our eBPF-based Kubernetes Runtime Instrumentation and Enforcement System (KRSIE). Finally, we evaluate the effectiveness of our system using a real-world scenario, as measuring the performance of a policy enforcement system is a complex task. Our results show that KRSIE can successfully control containers' behaviors using LSM hooks at container runtime, offering improved container security for cloudnative infrastructure. | - |
dc.format.extent | 14 | - |
dc.language | 영어 | - |
dc.language.iso | ENG | - |
dc.publisher | TECH SCIENCE PRESS | - |
dc.title | Container Instrumentation and Enforcement System for Runtime Security of Kubernetes Platform with eBPF | - |
dc.type | Article | - |
dc.identifier.doi | 10.32604/iasc.2023.039565 | - |
dc.identifier.bibliographicCitation | INTELLIGENT AUTOMATION AND SOFT COMPUTING, v.37, no.2, pp 1773 - 1786 | - |
dc.identifier.wosid | 001032466700031 | - |
dc.identifier.scopusid | 2-s2.0-85178966273 | - |
dc.citation.endPage | 1786 | - |
dc.citation.number | 2 | - |
dc.citation.startPage | 1773 | - |
dc.citation.title | INTELLIGENT AUTOMATION AND SOFT COMPUTING | - |
dc.citation.volume | 37 | - |
dc.identifier.url | https://www.techscience.com/iasc/v37n2/53245 | - |
dc.publisher.location | 미국 | - |
dc.type.docType | Article | - |
dc.description.isOpenAccess | Y | - |
dc.subject.keywordAuthor | Container | - |
dc.subject.keywordAuthor | kubernetes | - |
dc.subject.keywordAuthor | runtime security | - |
dc.subject.keywordAuthor | eBPF | - |
dc.subject.keywordAuthor | enforcement | - |
dc.relation.journalResearchArea | Automation & Control Systems | - |
dc.relation.journalResearchArea | Computer Science | - |
dc.relation.journalWebOfScienceCategory | Automation & Control Systems | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Artificial Intelligence | - |
dc.description.journalRegisteredClass | scie | - |
dc.description.journalRegisteredClass | scopus | - |
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.
Soongsil University Library 369 Sangdo-Ro, Dongjak-Gu, Seoul, Korea (06978)02-820-0733
COPYRIGHT ⓒ SOONGSIL UNIVERSITY, ALL RIGHTS RESERVED.
Certain data included herein are derived from the © Web of Science of Clarivate Analytics. All rights reserved.
You may not copy or re-distribute this material in whole or in part without the prior written consent of Clarivate Analytics.