Kubernetes + Encrypted Memory = Security * Privacy – Harshal Patil & Pradipta Banerjee, IBM

31

Kubernetes + Encrypted Memory = Security * Privacy – Harshal Patil & Pradipta Banerjee, IBM

The Memory Encryption on hardware is coming soon. From Intel’s TME/MKTME[1] to IBM’s Ultravisor[2], hardware manufacturers are aiming to make sure ‘what’s written by the process stays within the process’. Once the hardware is out, it will change the way we perceive the security and privacy in the cloud. In this talk, we will discuss briefly on the upcoming memory encryption technologies and how we modified kata container runtime to handle kubernetes’ Ephemeral Volumes (aka, EmptyDir volumes) to keep your data and application protected from the container image registry (encrypted at rest) to runtime (protected by memory encryption). For the demonstration, we run a container image with the encrypted TensorFlow model using kubernetes such that even the root user on the worker node won’t be able to read the model parameters. [1] goo.gl/Xt3MJf [2] goo.gl/X2A5yx

sched.co/MPdQ

Join us for KubeCon + CloudNativeCon in Shanghai June 24 – 26 and San Diego November 18 – 21! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
Join us for KubeCon + CloudNativeCon in San Diego November 18 – 21. Learn more at bit.ly/2XTN3ho. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.