Cloud Native
Security Talks RSS

KubeCon Europe 2019

Kubernetes + Encrypted Memory = Security * Privacy

Harshal Patil & Pradipta Banerjee, IBM

Abstract

The Memory Encryption on hardware is coming soon. From Intel’s TME/MKTME[1] to IBM’s Ultravisor[2], hardware manufacturers are aiming to make sure ‘what’s written by the process stays within the process’. Once the hardware is out, it will change the way we perceive the security and privacy in the cloud. In this talk, we will discuss briefly on the upcoming memory encryption technologies and how we modified kata container runtime to handle kubernetes’ Ephemeral Volumes (aka, EmptyDir volumes) to keep your data and application protected from the container image registry (encrypted at rest) to runtime (protected by memory encryption). For the demonstration, we run a container image with the encrypted TensorFlow model using kubernetes such that even the root user on the worker node won’t be able to read the model parameters. [1] https://goo.gl/Xt3MJf [2] https://goo.gl/X2A5yx

More from KubeCon Europe 2019

Open in the index →
  1. Using eBPF to Bring Kubernetes-Aware Security to the Linux KernelDan Wendlandt, Isovalent 2019-05-21
  2. Portable, Universal Single Sign-On for Your ClustersMiguel Martinez, Bitnami 2019-05-21
  3. Fine-Grained Permissions in Kubernetes: What’s Missing, and How to Fix ThatVallery Lancey, Lyft & Seth McCombs, Triller 2019-05-21
  4. Envoy SDS: Fortifying Istio SecurityYonggang Liu & Quanjie Lin, Google 2019-05-21
  5. Zero Trust Service Mesh with Calico, SPIRE, and EnvoyShaun Crampton, Tigera & Evan Gilman, Scytale 2019-05-22
  6. Smarter Kubernetes Access Control: A Simpler Approach to AuthRob Scott, ReactiveOps 2019-05-22
  7. Inside the CNCF Project Security ReviewsJustin Cormack, Docker 2019-05-22
  8. Crafty Requests: Deep Dive Into Kubernetes CVE-2018-1002105Ian Coldwater, Heroku 2019-05-22
  9. Container Forensics: What to Do When Your Cluster is a ClusterMaya Kaczorowski & Ann Wallace, Google 2019-05-22
  10. Caller ID in KubernetesMichael Danese, Google 2019-05-22
  11. Uber x Security: Why and How We Built Our Workload Identity PlatformTyler Julian, Uber & Daniel Feldman, Scytale 2019-05-23
  12. Securing Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman, Scytale, Inc. 2019-05-23
  13. Securing Kubernetes with Trusted Platform Module (TPM)Alex Tcherniakhovski & Andrew Lytvynov, Google 2019-05-23
  14. Secrets Store CSI Driver-Bring Your Own Enterprise Secrets Store to K8sRita Zhang, Microsoft & Anubhav Mishra, HashiCorp 2019-05-23
  15. Protecting the Data LakeAsh Narkar, Styra, Inc 2019-05-23
  16. DIY Pen-Testing for Your Kubernetes ClusterLiz Rice, Aqua Security 2019-05-23