2024年6月，国科大密码学院王跃武研究员指导学生，在IEEE Transactions on Information Forensics and Security（TIFS）期刊发表了题为“Condo: Enhancing Container Isolation through Kernel Permission Data Protection”的研究论文。论文中提出了一种通过内核数据保护来增强容器隔离性的方案，该研究工作得到国家重点研发计划（2022YFB3103301）的支持。
Abstract：Container technology is widely adopted due to its features such as light weight and ease of rapid deployment. However, as an OS-level virtualization mechanism, container isolation relies on the kernel’s security mechanisms an the kernel permission data (usually non-control flow data) used by these mechanisms. None of the existing mitigation schemes for non-control flow data attacks provide an effective and practical solution to container security since they either trigger too much overhead, have limited effectiveness over attacks launched in specific ways, or can only be used to protect some specific kernel data. In addition, none of them accurately identify the kernel data associated with container isolation. In this paper, we provide a solution called Condo that enhances container isolation by protecting the associated kernel permission data. We first present a generidc non-control flow kernel data protection mechanism that protects different types of kernel data uniformly with low overhead and is not limited by attack methods or data types. We then demystify the models of various kernel access control mechanisms in the container environment, and identify the subject and object permission data that are critical to container isolation. Finally, we provide a solution named Condo to enhance container isolation, which is completely transparent to the existing container ecosystem, including containerized applications and container management/orchestration tools such as Docker. Experimental results show that Condo can effectively reduce the compromises of container isolation due to memory corruption attacks with an acceptable overhead.
论文信息：Shouyin Xu , Yuewu Wang, Lingguang Lei , Kun Sun, Jiwu Jing, Siyuan Ma, Jie Wang and Heqing Huang: "Condo: Enhancing Container Isolation through Kernel Permission Data Protection," in IEEE Transactions on Information Forensics and Security, doi: 10.1109/TIFS.2024.3411915.（CCF-A）
