BASTION: A Security Enforcement Network Stack for Container Networks
summary
BASTION is a container-side network stack that enforces per-container topology and point-to-point traffic isolation, implementing a network visibility service that blocks ARP-based discovery and a traffic visibility service that forwards inter-container flows directly and verifies packet sources. It deploys at each container network interface and uses Linux features such as XDP and EVPN to inject packets so transit bypasses the host switch, drops injected fakes, prevents lateral sniffing, and raises throughput up to 25.4% (single-host) and 17.7% (cross-host).
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:32The state of Container Security
- 2:39Current Container Networks (1/2) . Conceptual microservice architecture
- 3:44Security Challenges in Container Networks 1
- 7:17Bastion: Security Enforcement Network Stad
- 9:07Manager - Container Collection
- 10:57Security Stack - Network Visibility Service 121
- 13:26Security Stack - Traffic Visibility Service (1/2)
- 15:43Security Evaluation
- 16:49Security: Attack Scenario Verification
- 18:20Security: Passive Packet Monitoring
- 19:13Security: Active Packet Injection
- 20:06Performance: Inter-container Throughputs
- 20:53Performance: Bastion on Various Networks
- 21:17Summary
related talks
02mScalable Infrastructure Access Management
39mBastion DB: enabling secure developer access to databases
06mOpensource Container Security: A Brief Overview
32mCF Networking: All Your Packets are Belong to Us
30mFinding Imposter Among Us: Container Edition
29mContainer Networking in Cloud Foundry
36mCloud Native Superpowers with eBPF
26mContainer Networking: The Play of BPF and Network NS with different...