Abstract:

With the development of cloud service technology, more and more applications are migrated to the cloud in the form of containers, and the security monitoring of containers has become a research hotspot. Containers have the advantages of being lightweight, fast to deploy, and easy to transplant. However, their weak isolation makes them face many security problems: container escape attacks, container image poisoning, kernel vulnerability exploitation, etc. In response to these attack threats, this article used eBPF system monitoring technology, combined with BMC root of trust, image static analysis, general policy engine, and runtime proof, to propose a container runtime security monitoring solution. The monitoring program implemented based on eBPF in the solution can identify and monitor container behavior events such as processes, capabilities, files, and networks. The solution designed a fine-grained container security policy, combined the container system call whitelist obtained by static analysis of container images, detected abnormal container behavior, and protected container security from multiple dimensions. The solution also designed and implemented a runtime attestation protocol based on the BMC root of trust. The TPM integrated in the BMC is used as the root of trust, and its attestation can effectively ensure the integrity and authenticity of the alarm log based on eBPF monitoring events. It has been proven that the monitoring server can monitor the security status of various types of containers over a long period of time and take corresponding countermeasures for abnormal security events.

Key words: container security, eBPF, runtime monitoring, BMC root of trust, remote attestation