System and method for encryption of ephemeral storage
Disclosed are systems and methods for encryption of an ephemeral layer of one or more containers. An exemplary method comprises detecting a container starting execution in an operating system, generating a temporary encryption key and storing the temporary encryption key in memory of a kernel of the operating system, creating an encrypted area as the ephemeral layer in a storage device, the encrypted area accessible only by the container, providing to the container access to the encrypted area, and responsive to stopping execution of the container, destroying the temporary encryption key.
1. A method for encryption of an ephemeral layer of one or more containers comprising:
detecting a container starting execution in an operating system;
generating a temporary encryption key, wherein generating the temporary encryption key comprises: performing a snapshot on a base root file system of the container;
performing incremental snapshots of changes to the file system of the container:
encrypting an ephemeral layer of the container using the temporary encryption key; and
attaching the ephemeral layer to the base root file system of the container;
storing the temporary encryption key in memory of a kernel of the operating system;
creating an encrypted area as the ephemeral layer in a storage device, wherein the encrypted area is an empty subdirectory of the ephemeral layer of the container, and container has read-write access to the encrypted area, and the encrypted area accessible only by the container;
providing to the container access to the encrypted area; and
responsive to stopping execution of the container, destroying the temporary encryption key.
2. The method of claim 1 , further comprising:
upon a request from one container of the plurality of containers to access the encrypted area, determining whether the one container has access to the temporary encryption key; and
responsive to determining that the one container has access, allowing the one container to access the encrypted area, otherwise returning an error.
3. The method of claim 1 , further comprising: when the operational request is a read request, decrypting data in the encrypted area after access is allowed; and when the operational request is a write request, encrypting the data in the encrypted area after access is allowed.
4. The method of claim 1 , wherein the temporary encryption key is stored in the kernel memory, not written to a physical disk and is inaccessible by processes in the user space of the container.
5. The method of claim 1 , further comprising:
providing the container with an identifier for the temporary encryption key.
6. The method of claim 1 , further comprising:
securing the temporary encryption key using a key management that stores all generated keys; and
providing the generated keys to trusted parties.
7. The method of claim 1 , further comprising: writing the temporary encryption key to a location in local storage; encrypting the location with a slow encryption algorithm with a generated key; and protecting the generated key.
8. The method of claim 1 , further comprising:
destroying the container; and
destroying the encrypted area.
9. The method of claim 1 , further comprising:
attaching the encrypted area as snapshot changes storage for the container root file system.
10. A system for encryption of an ephemeral layer of one or more containers comprising:
a memory; and a processor configured to:
detect a container starting execution in an operating system;
generate a temporary encryption key, wherein generating the temporary encryption key comprises:
performing a snapshot on a base root file system of the container;
performing incremental snapshots of changes to the file system of the container:
encrypting an ephemeral layer of the container using the temporary encryption key; and
attaching the ephemeral layer to the base root file system of the container;
store the temporary encryption key in memory of a kernel of the operating system;
create an encrypted area as the ephemeral layer in a storage device, wherein the encrypted area is an empty subdirectory of the ephemeral layer of the container, and container has read-write access to the encrypted area, and the encrypted area accessible only by the container;
provide to the container access to the encrypted area; and
responsive to stopping execution of the container, destroy the temporary encryption key.
11. The system of claim 10 , upon a request from one container of the plurality of containers to access the encrypted area, the processor further being configured to:
determine whether the one container has access to the temporary encryption key; and
responsive to determining that the one container has access, allow the one container to access the encrypted area, otherwise return an error.
12. The system of claim 10 , the processor further being configured to: when the operational request is a read request, decrypt data in the encrypted area after access is allowed; and when the operational request is a write request, encrypt the data in the encrypted area after access is allowed.
13. A non-transitory computer readable medium storing thereon computer readable instructions for encryption of an ephemeral layer of one or more containers, including instructions for:
detecting a container starting execution in an operating system;
generating a temporary encryption key, wherein generating the temporary encryption key comprises:
performing a snapshot on a base root file system of the container;
performing incremental snapshots of changes to the file system of the container:
encrypting an ephemeral layer of the container using the temporary encryption key; and
attaching the ephemeral layer to the base root file system of the container;
storing the temporary encryption key in memory of a kernel of the operating system;
creating an encrypted area as the ephemeral layer in a storage device, wherein the encrypted area is an empty subdirectory of the ephemeral layer of the container, and container has read-write access to the encrypted area, and, the encrypted area accessible only by the container;
providing to the container access to the encrypted area; and
responsive to stopping execution of the container, destroying the temporary encryption key.
14. The non-transitory computer readable medium of claim 13 , the instructions further comprising instructions for:
upon a request from one container of the plurality of containers to access the encrypted area, determining whether the one container has access to the temporary encryption key; and
responsive to determining that the one container has access, allowing the one container to access the encrypted area, otherwise returning an error.