CloudCAP: Capability-based Isolation for Cloud Native Applications

云原生应用程序的编程和部署模型已经从虚拟机（vm）转向基于容器的微服务，现在又转向无服务器的功能即服务（FaaS）应用程序，但云原生应用程序的安全问题仍然存在。租户必须信任大型云堆栈中定制的、不透明的软件安全机制；云提供商必须使用重量级机制保护自己免受不受信任的租户代码的侵害。因此，一个关键的开放式研究挑战是如何设计适当的隔离机制，用于划分云原生应用程序，并将它们与其他复杂的、不可信的云软件堆栈隔离开来。我们相信，由Arm CHERI硬件提供的基于硬件的功能，可以作为轻量级但有原则的隔离抽象的构建块，并可用于划分包括云本地应用程序在内的整个云堆栈。通过利用硬件功能实现隔离，可以为非特权用户空间代码提供关于隔离和不受信任云堆栈其余部分影响的强有力保证。CloudCAP项目将在系统和编程语言的交叉领域进行研究。它的总体目标是为基于功能的硬件研究和设计新的抽象和机制，以支持灵活、轻量级和可扩展的划分，作为未来云堆栈和云原生应用程序的一部分。该项目将产生基于能力的云隔间，这是一种新的抽象，可以表达关于数据和计算的机密性和完整性的策略，无论是在云堆栈和云原生应用程序的组件内部还是跨组件。CloudCAP的一个基本贡献将是，通过CHERI的功能硬件支持，使云隔间变得实用成为可能：它们将有效地实现，并与现有的云堆栈和编程语言运行时兼容。

Programming and deployment models for cloud native applications have shifted from virtual machines (VMs), to container-based microservices, and now serverless function-as-service (FaaS) applications, yet security concerns for cloud native applications remain. Tenants must trust bespoke and opaque software security mechanisms in large cloud stacks; cloud providers must protect themselves from untrusted tenant code with heavy-weight mechanisms. A key open research challenge is therefore how to design appropriate isolation mechanisms that can be used to compartmentalise cloud native applications and also shield them from the rest of a complex, untrusted cloud software stack.We believe that hardware-based capabilities, as offered by Arm CHERI hardware, can act as a building block for lightweight yet principled isolation abstractions, and can be used to compartmentalise the full cloud stack including cloud native applications. By leveraging hardware capabilities for isolation, it becomes possible to give unprivileged userspace code strong guarantees about isolation and the impact by the rest of the untrusted cloud stack. The CloudCAP project will conduct research at the intersection of systems and programming languages. Its overall goal is to investigate and devise new abstractions and mechanisms for capability-based hardware to support flexible, lightweight and scalable compartmentalisation as part of future cloud stacks and cloud native applications. The project will result in capability-based cloud compartments, a new abstraction that can express policies about the confidentiality and integrity of data and computation, both within, and across, the components of a cloud stack and cloud native applications. A fundamental contribution of CloudCAP will be that, through CHERI's capability hardware support, it will become possible to make cloud compartments practical: they will be implementable efficiently and be compatible with existing cloud stacks and programming language runtimes.