Xrac: Execution and Access Control for Restricted Application Containers on Managed Hosts
Total Page：16
File Type：pdf, Size：1020Kb
xRAC: Execution and Access Control for Restricted Application Containers on Managed Hosts Frederik Hauser, Mark Schmidt, and Michael Menth Chair of Communication Networks, University of Tuebingen, Tuebingen, Germany Email: {frederik.hauser,mark-thomas.schmidt,menth}@uni-tuebingen.de Abstract—We propose xRAC to permit users to run spe- or Internet access. That means, appropriate network control cial applications on managed hosts and to grant them access elements, e.g., firewalls or SDN controllers, may be informed to protected network resources. We use restricted application about authorized RACs and their needs. The authorized traffic containers (RACs) for that purpose. A RAC is a virtualization container with only a selected set of applications. Authentication can be identified by the RAC’s IPv6 address. We call this verifies the RAC user’s identity and the integrity of the RAC concept xRAC as it controls execution and access for RACs. image. If the user is permitted to use the RAC on a managed We mention a few use cases that may benefit from xRAC. host, launching the RAC is authorized and access to protected RACs may allow users to execute only up-to-date RAC network resources may be given, e.g., to internal networks, images. Execution of a RAC may be allowed only to special servers, or the Internet. xRAC simplifies traffic control as the traffic of a RAC has a unique IPv6 address so that it can users or user groups, e.g., to enforce license restrictions. be easily identified in the network. The architecture of xRAC Only selected users in a high-security area may get access to reuses standard technologies, protocols, and infrastructure. Those the Internet through a RAC-based browser which is isolated are the Docker virtualization platform and 802.1X including from the remaining infrastructure. Only selected users may be EAP-over-UDP and RADIUS. Thus, xRAC improves network able to execute administration software with access to servers security without modifying core parts of applications, hosts, and infrastructure. In this paper, we review the technological providing confidential material. RACs may be used for appli- background of xRAC, explain its architecture, discuss selected cations with increased quality of service (QoS) requirements, use cases, and investigate on the performance. To demonstrate e.g., voice-over-IP, video conferences, or games. Their traffic the feasibility of xRAC, we implement it based on standard may be preferentially treated by network elements. components with only a few modifications. Finally, we validate To facilitate deployment of xRAC, we reuse and adapt xRAC through experiments. standard technologies, protocols, and infrastructure. We lever- I. INTRODUCTION age the Docker platform to create and deploy containerized applications. When the container management daemon (CMD) In this paper we consider the problem of permitting users to is requested to launch a RAC, it first issues an AA request run special applications on managed hosts and to grant them and launches the RAC only after successful AA. We adopt access to protected network resources. This is an important 802.1X for AA purposes and adapt its components 802.1X challenge in practice as applications communicate with multi- supplicant (802.1X S), 802.1X authenticator (802.1X A), and ple peers and have multiple, possibly a priori unknown flows 802.1X authentication server (802.1X AS). The CMD inter- characterized by 5-tuples. Moreover, common packet filters faces with an 802.1X container supplicant (802.1X CS) on such as firewalls or deep packet inspectors lack knowledge of the host, the 802.1X CS with a 802.1X container authenticator allowed flows, and identifying traffic from specific applications (802.1X CA), and the 802.1X CA with an 802.1X authentica- becomes more difficult with traffic encryption using TLS. tion server (802.1X AS). The 802.1X AS holds RAC-specific We address this challenge by running applications in con- AA data, performs authentication, and returns authorization arXiv:1907.03544v1 [cs.NI] 8 Jul 2019 tainers as so-called restricted application containers (RACs) data to the 802.1X CA. The 802.1X CA interfaces with on managed hosts. RACs provide selected sets of applications network control elements and configures access to network including their dependencies and configuration. The managed resources depending on authorization data. It also forwards host gives users only limited freedom, e.g., they can download the authorization data to the 802.1X CS. EAP-over-UDP and and launch RACs. We propose authentication and authoriza- RADIUS are utilized for communication. To demonstrate the tion (AA) for RACs so that their execution is restricted to feasibility of xRAC, we provide a prototype based on existing authorized users. That means, the user identity, the integrity 802.1X components, implement the 802.1X CS as plugin for of the RAC’s image, and the permission of the user to execute the Docker authorization framework and the 802.1X CA as the RAC are verified before a RAC is launched. We suggest to part of an SDN controller. We use a RADIUS server for extend this authorization also to protected network resources 802.1X AS and extend its data structures to store AA data required by the RAC, e.g., to internal networks, servers, for users and RAC. We use this prototype to experimentally validate xRAC in a testbed. This work was supported by the bwNET100G+ project which is funded by the Ministry of Science, Research and the Arts Baden-Württemberg (MWK). The rest of the paper is structured as follows. In Section II, The authors alone are responsible for the content of this paper. we review technical background and related work on container virtualization. In Section III, we review technical background REST interface. The Docker client can be located on the host and related work on 802.1X and AA for applications. In running the Docker CMD or on a remote host. The Docker Section IV, we present the architecture of xRAC in detail. command line interface (CLI) is an example for user control Section V discusses use cases along benefits and limitations of through CLI calls. The Docker CMD may connect to Docker xRAC. Section VI describes the prototypical implementation registries that allow users to upload (push) or download (pull) of xRAC which is used for its experimental validation in Sec- container images. Those registries are either private or publicly tion VII. In Section VIII, we briefly investigate on performance available. Docker Hub [5] with more than 100.000 container considerations of xRAC. Section IX concludes this work. images is an example for the latter. Common operations are build (1), pull (2), and run (3). With build, users may create II. CONTAINER VIRTUALIZATION:TECHNICAL individual container images. With pull, users may download BACKGROUND AND RELATED WORK container images from a repository to become part of the set We first introduce the concept of container virtualization, of local images. With run, container images from the set of describe advantages and give an overview of Docker as a local images can be executed on the host system. widespread implementation. Then, we review container secu- rity platforms and containers for GUI applications. Client Host Registry (1) build A. Overview (2) pull Docker CMD Container (3) run image Containers implement virtualization on the operating system … (OS) level. They provide virtualized OS environments that are Container Container isolated with regard to hardware resources and security. They image share the OS kernel and may include binaries and libraries that are required to run one or several enclosed applications. Running containers Local images In xRAC, we enclose only one special application with its Fig. 1: The Docker architecture consists of the Docker client, the Docker dependencies and configuration in a container. Containers run CMD, and the Docker registry [6]. on top of a container runtime and are managed by a container management daemon (CMD) that creates, starts and suspends Docker uses several functions of the OS kernel [7]–[10] to containers. Examples for container platforms are Docker [1], provide isolation and resource emulation. It supports storage Kubernetes [2], BSD jails [3], and Solaris containers [4]. drivers, e.g., AuFS [11], OverlayFS [12], and ZFS [13], to enable file system stacking. The container format and runtime B. Advantages environment of Docker were adopted by the Open Container Virtualization facilitates efficient and flexible usage of hard- Initiative [14] as open industry standard. ware resources, improves security through isolation, and pro- D. Container Security Platforms vides fault-safety and scalability through simple migration pro- cesses. Containers in particular have the following additional Container security platforms extend the CMD by security advantages. Due to the shared OS, containers require less CPU, functions. Twistlock [15], [16] and the Aqua Container Secu- memory, and hard disk resources. Container images are much rity Platform [17] provide a runtime engine based on machine smaller than virtual machines, which simplifies distribution learning mechanisms to permanently monitor containers for among many recipients. Containers simplify application de- detecting fraudulent behavior and special network firewalls ployment. Instead of providing support for complex combina- to filter container traffic. The Sysdig Secure [18] platform tions of applications, dependencies, and user configurations, allows the formulation of service-aware policies, i.e., policies administrators just deploy containers that are tested prior to that are based on applications, containers, hosts, or network release. Containers have no bootup times, which makes them activities. The platform provides alerts and actions based on especially suitable for short-lived applications. policy violations, an event history, and incident captures. The Atomicorp Secure Docker Kernel [19] is a hardened Linux C. Docker Container Virtualization Platform kernel that provides security-related features such as break- Docker [1] is one of the most popular container platforms out protection, memory corruption protection, or prevention today.