Integrity verification mechanism for protection against container migration attacks
One example method includes receiving, at a target, a migrated container, the container being migrated by a source, retrieving, by the target, a first container hash from an immutable distributed ledger, the first container hash being created at the source by hashing the container, and the first container hash being written by the source to the immutable distributed ledger, hashing, at the target, the container to create a second container hash, writing, by the target, the second container hash to the immutable distributed ledger, and determining, by the target, whether the first container hash and the second container hash match, and a failure of the first container hash to match the second container hash indicates that in-flight tampering of the container has occurred while the container was migrating from the source to the target.
1 . A method, comprising:
receiving, at a target, a migrated container, the container being migrated by a source;
retrieving, by the target, a first container hash from an immutable distributed ledger, the first container hash being created at the source by hashing the container, and the first container hash being written by the source to the immutable distributed ledger;
hashing, at the target, the received container to create a second container hash;
writing, by the target, the second container hash to the immutable distributed ledger; and
determining, by the target, whether the first container hash and the second container hash match,
wherein a failure of the first container hash to match the second container hash indicates that in-flight tampering of the container has occurred while the container was migrating from the source to the target, and
wherein, when the first container hash is determined to match the second container hash, the received container is permitted to resume operation at the target and, when the received container is subsequently verified by an external storage site, the received container is permitted to access container data, which is externally stored at the external storage site.
2 . The method as recited in claim 1 , wherein the immutable distributed ledger comprises a blockchain, and the first container hash and the second container hash comprise respective blocks of the blockchain.
3 . The method as recited in claim 1 , wherein when the first container hash is determined to match the second container hash, the received container is permitted to start running at the target.
4 . The method as recited in claim 1 , wherein both the first container hash and the second container hash are non-reversible.
5 . The method as recited in claim 1 , wherein the immutable distributed ledger is configured to enforce access control to the received container, and one or more other containers, on a per-container basis.
6 . The method as recited in claim 1 , wherein the immutable distributed ledger enables an authorized entity, needing access to another container, to independently verify whether or not the another container has been tampered with while the another container was in-flight to that authorized entity.
7 . The method as recited in claim 1 , wherein the received container is exported as a compressed file prior to creation of the first container hash.
8 . The method as recited in claim 1 , wherein when the first container hash and the second container hash do not match each other, the received container is discarded, and the source is informed of the failure.
9 . The method as recited in claim 1 , wherein retrieving the first container hash comprises retrieving an ID of the received container and an ID of a component, of the source, that created the first container hash.
10 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
receiving, at a target, a migrated container, the container being migrated by a source;
retrieving, by the target, a first container hash from an immutable distributed ledger, the first container hash being created at the source by hashing the container, and the first container hash being written by the source to the immutable distributed ledger;
hashing, at the target, the received container to create a second container hash;
writing, by the target, the second container hash to the immutable distributed ledger; and
determining, by the target, whether the first container hash and the second container hash match,
wherein a failure of the first container hash to match the second container hash indicates that in-flight tampering of the container has occurred while the container was migrating from the source to the target, and
wherein, when the first container hash is determined to match the second container hash, the received container is permitted to resume operation at the target and, when the received container is subsequently verified by an external storage site, the received container is permitted to access container data, which is externally stored at the external storage site.
11 . The non-transitory storage medium as recited in claim 10 , wherein the immutable distributed ledger comprises a blockchain, and the first container hash and the second container hash comprise respective blocks of the blockchain.
12 . The non-transitory storage medium as recited in claim 10 , wherein when the first container hash is determined to match the second container hash, the received container is permitted to start running at the target.
13 . The non-transitory storage medium as recited in claim 10 , wherein both the first container hash and the second container hash are non-reversible.
14 . The non-transitory storage medium as recited in claim 10 , wherein the immutable distributed ledger is configured to enforce access control to the received container, and one or more other containers, on a per-container basis.
15 . The non-transitory storage medium as recited in claim 10 , wherein the immutable distributed ledger enables an authorized entity, needing access to another container, to independently verify whether or not the another container has been tampered with while the another container was in-flight to that authorized entity.
16 . The non-transitory storage medium as recited in claim 10 , wherein the received container is exported as a compressed file prior to creation of the first container hash.
17 . The non-transitory storage medium as recited in claim 10 , wherein when the first container hash and the second container hash do not match each other, the received container is discarded, and the source is informed of the failure.
18 . The non-transitory storage medium as recited in claim 10 , wherein retrieving the first container hash comprises retrieving an ID of the received container and an ID of a component, of the source, that created the first container hash.