Protecting Sensitive Data in Container Checkpoints
summary
Extends CRIU to encrypt checkpoint images end-to-end by generating a symmetric token, saving it as a CRIU-image crypto file with the cluster public key, and using that token to encrypt proto, raw and page images so data is never written plaintext; memory pages use XTS per-page encryption to allow in-place AES hardware acceleration (≈5× speedup) and selective page decryption; integrated without changing container runtimes; tests run encrypted and unencrypted and show in-place encryption faster than post-dump encryption, though XTS needs added integrity.
AI-written summary · about
chapters (14)
- 0:00Introduction to research
- 1:06Problem with current encryption
- 2:34CRE checkpoint encryption design
- 4:47Protecting protocol images
- 7:15Encrypting raw images
- 8:22Memory page encryption approach
- 10:10Key management in checkpointing
- 12:26Live demo of encryption
- 14:34Workload types and performance
- 16:32Evaluation against OpenSSL
- 17:15Conclusion and future work
- 17:59Q&A on file system snapshots
- 20:49Q&A on memory page protection
- 22:15Q&A on encryption use cases
related talks
32mEnd-to-End Encryption for Container Checkpointing in Kubernetes
13mEnabling Secure Container Checkpointing for Distributed Model Training
33mFreeze,Investigate,Recover: Unlocking Forensic Container Checkpoint...
32mProtecting Sensitive Code with Encrypted Container Images on...
30mTrust No One: Secure Storage With Confidential Containers
32mProtecting Sensitive Code with Encrypted Container Images on...
31mDigital Forensics with Container Checkpointing
29mConfidential Containers: The Next Era of Cloud Data Security