Towards Efficient End-to-End Encryption for Container Checkpointing Systems

R Stoyanov, A Reber, D Ueno, M Clapiński… - Proceedings of the 15th …, 2024 - dl.acm.org
R Stoyanov, A Reber, D Ueno, M Clapiński, A Vagin, R Bruno
Proceedings of the 15th ACM SIGOPS Asia-Pacific Workshop on Systems, 2024dl.acm.org
Container checkpointing has emerged as a new paradigm for task migration, preemptive
scheduling and elastic scaling of microservices. However, as soon as a snapshot that
contains raw memory is exposed through the network or shared storage, sensitive data such
as keys and passwords may become compromised. Existing solutions rely on encryption to
protect data included in snapshots but by doing so prevent important performance
optimizations such as memory de-duplication and incremental checkpointing. To address …
Container checkpointing has emerged as a new paradigm for task migration, preemptive scheduling and elastic scaling of microservices. However, as soon as a snapshot that contains raw memory is exposed through the network or shared storage, sensitive data such as keys and passwords may become compromised. Existing solutions rely on encryption to protect data included in snapshots but by doing so prevent important performance optimizations such as memory de-duplication and incremental checkpointing. To address these challenges, we design and implement CRIUsec, an efficient end-to-end encryption scheme for container checkpointing systems built on the open-source CRIU (Checkpoint/Restore In Userspace). Our preliminary evaluation shows that CRIUsec integrates seamlessly with popular container platforms (Docker, Podman, Kubernetes), and compared to existing solutions, achieves an average of 1.57× speedup for memory-intensive workloads, and can be up to 100× faster for compute-intensive workloads.
ACM Digital Library
Showing the best result for this search. See all results