Security Isolation Strategy Mechanism for Lightweight Virtualization Environment

¹ Beijing Jiaotong University, School of Computer and Information Technology, 100044, Beijing
² China Transport Telecommunications & Information Center, 100011, Beijing
³ China Railway Corporation Transport Bureau Information Sector, 100844, Beijing

^a Corresponding author: 14120354@bjtu.edu.cn

Abstract

For cloud service providers, lightweight virtualization is a more economical way of virtualization. While the user is worried about the safety of applications and data of the container, due to the container sharing the underlying interface and the kernel, therefore the security and trusted degree of lightweight virtualization container isolation mechanism is critical for the promotion of lightweight virtualization service. Because the user cannot directly participate in the process of the construction and management of container isolation mechanism, it is difficult for them to establish confidence in the security and trusted degree of container isolation mechanism. Based on the research and analysis of system credible and virtualization isolation mechanism, this paper puts forward a set of lightweight virtualization security isolation strategy mechanism, divides lightweight virtualization container storage address space into several parts, puts forward the definition of lightweight virtualization security isolation, gives the formal description and proof of container security isolation strategy, and combines with related technology to verify the feasibility of lightweight virtualization security isolation strategy mechanism. The mechanism has important guiding significance for cloud services providers to deploy container security isolation.