Systems and methods for hardware-based security for inter-container communication
View Patent ↗In accordance with embodiments of the present disclosure, an information handling system may include a processor subsystem having access to a memory subsystem and a device communicatively coupled to the processor subsystem, the device having an endpoint assigned for access by a container executing on the processor subsystem such that the endpoint appears to the container as a logical hardware adapter. The device may be configured to receive an inter-process communication from the container via the endpoint, the inter-process communication intended for a target container, analyze the inter-process communication to determine if the container has permissions for communicating the inter-process communication to the target container, and communicate the inter-process communication to the target container responsive to determining that the container has permissions for communicating the inter-process communication to the target container.
1. An information handling system, comprising:
a processor subsystem having access to a memory subsystem, wherein the processor subsystem is configured to execute a container as a first process within an operating system kernel and a target container as a second process within the operating system kernel; and
a device communicatively coupled to the processor subsystem, the device having an endpoint assigned for exclusive access by the container executing on the processor subsystem, the device further having a second endpoint assigned for exclusive access by the target container, such that the endpoint appears to the container as a logical hardware adapter, wherein the device is configured to:
receive an inter-process communication from the container via the endpoint, the inter-process communication intended for the target container;
analyze the inter-process communication to determine if the container has permissions for communicating the inter-process communication to the target container; and
communicate the inter-process communication to the target container responsive to determining that the container has permissions for communicating the inter-process communication to the target container.
2. The information handling system of claim 1 , wherein the device comprises a Peripheral Component Interconnect device.
3. The information handling system of claim 1 , the device further configured to:
receive a second inter-process communication from a second device communicatively coupled to a second processor subsystem of a second information handling system, the second device having an other endpoint assigned for access by a source container such that the other endpoint appears to the target container as a logical hardware adapter, and wherein the second device received the second inter-process communication from the source container via the other endpoint;
analyze the second inter-process communication to determine if the second information handling system has permissions for communicating the second inter-process communication to the container; and
communicate the inter-process communication to the container responsive to determining that the second information handling system has permissions for communicating the second inter-process communication to the container.
4. A method, comprising:
receiving, at a device communicatively coupled to a processor subsystem that is executing a container as a first process within an operating system kernel and a target container as a second process within the operating system kernel, an inter-process communication from the container via an endpoint of the device, wherein the endpoint is assigned for exclusive access by the container executing on the processor subsystem; the device further having a second endpoint assigned for exclusive access by the target container, such that the endpoint appears to the container as a logical hardware adapter, and wherein the inter-process communication is intended for the target container;
analyzing the inter-process communication to determine if the container has permissions for communicating the inter-process communication to the target container; and
communicating the inter-process communication to the target container responsive to determining that the container has permissions for communicating the inter-process communication to the target container.
5. The method of claim 4 , wherein the device comprises a Peripheral Component Interconnect device.
6. The method of claim 4 , further comprising:
receiving a second inter-process communication from a second device communicatively coupled to a second processor subsystem of a second information handling system, the second device having an other endpoint assigned for access by a source container such that the other endpoint appears to the target container as a logical hardware adapter, and wherein the second device received the second inter-process communication from the source container via the other endpoint;
analyzing the second inter-process communication to determine if the second information handling system has permissions for communicating the second inter-process communication to the container; and
communicating the inter-process communication to the container responsive to determining that the second information handling system has permissions for communicating the second inter-process communication to the container.
7. An article of manufacture comprising:
a non-transitory computer-readable medium; and
computer-executable instructions carried on the computer-readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
execute a container as a first process within an operating system kernel and a target container as a second process within the operating system kernel;
receive, at a device communicatively coupled to a processor subsystem, an inter-process communication from the container via an endpoint of the device, wherein the endpoint is assigned for exclusive access by the container executing on the processor subsystem, the device further having a second endpoint assigned for exclusive access by the target container, such that the endpoint appears to the container as a logical hardware adapter, and wherein the inter-process communication is intended for the target container;
analyze the inter-process communication to determine if the container has permissions for communicating the inter-process communication to the target container; and
communicate the inter-process communication to the target container responsive to determining that the container has permissions for communicating the inter-process communication to the target container.
8. The article of claim 7 , wherein the device comprises a Peripheral Component Interconnect device.
9. The article of claim 7 , the instructions for further causing the processor to:
receive a second inter-process communication from a second device communicatively coupled to a second processor subsystem of a second information handling system, the second device having an other endpoint assigned for access by a source container such that the other endpoint appears to the target container as a logical hardware adapter, and wherein the second device received the second inter-process communication from the source container via the other endpoint;
analyze the second inter-process communication to determine if the second information handling system has permissions for communicating the second inter-process communication to the container; and
communicate the inter-process communication to the container responsive to determining that the second information handling system has permissions for communicating the second inter-process communication to the container.