Dimac: Dynamic Integrity Measurement Architecture for Containers with ARM TrustZone
Liantao Song, Yan Ding, Yong Guo, Bao Li, Bin Zhou · 2024
How to implement dynamic trusted measurement for multi-tenant container platforms is an important issue in establishing trust in cloud-native services. Existing TPM-based schemes lack support for scalability, dynamism, and isolation in measurements, making integrity measurement implementation based on trusted execution environment(TEE) an excellent solution to this problem. However, challenges such as identifying the objects and timing for dynamic trustworthy measurement, bridging semantic gaps across domains, and providing multi-tenant privacy protection need to be addressed. This paper focuses on the trust invariants of container processes and proposes capturing page faults to perform cross-domain memory direct measurement on these invariants as early as possible, minimizing the potential for TOC-TOU issues. Based on this, we propose a fine-grained remote attestation method for container task execution flow information while considering privacy protection. We have implemented a prototype system, and experimental results show a performance loss of only about 8%.