CloudCAP: Capability-based Isolation for Cloud Native Applications

云原生应用程序的编程和部署模型已经从虚拟机（VM）转移到基于容器的微服务，现在是无服务器功能即服务（FaaS）应用程序，但云原生应用程序的安全问题仍然存在。租户必须信任大型云堆栈中的定制和不透明的软件安全机制;云提供商必须使用重量级机制保护自己免受不受信任的租户代码的影响。因此，开放研究的一个关键挑战是如何设计适当的隔离机制，可用于划分云原生应用程序，并将它们与复杂、不可信的云软件堆栈的其余部分隔离开来。我们相信，Arm CHERI硬件提供的基于硬件的功能可以作为轻量级但有原则的隔离抽象的构建块，并且可以用于划分包括云原生应用的完整云堆栈。通过利用硬件功能进行隔离，可以为非特权用户空间代码提供关于隔离和其余不受信任云堆栈影响的强有力保证。CloudCAP项目将在系统和编程语言的交叉点进行研究。其总体目标是研究和设计基于能力的硬件的新抽象和机制，以支持灵活，轻量级和可扩展的划分，作为未来云堆栈和云原生应用程序的一部分。该项目将产生基于能力的云隔间，这是一种新的抽象，可以表达有关数据和计算的机密性和完整性的策略，无论是在云堆栈和云原生应用程序的组件内部还是跨组件。CloudCAP的一个基本贡献是，通过CHERI的能力硬件支持，将有可能使云隔间变得实用：它们将可以有效地实现，并与现有的云堆栈和编程语言运行时兼容。

Programming and deployment models for cloud native applications have shifted from virtual machines (VMs), to container-based microservices, and now serverless function-as-service (FaaS) applications, yet security concerns for cloud native applications remain. Tenants must trust bespoke and opaque software security mechanisms in large cloud stacks; cloud providers must protect themselves from untrusted tenant code with heavy-weight mechanisms. A key open research challenge is therefore how to design appropriate isolation mechanisms that can be used to compartmentalise cloud native applications and also shield them from the rest of a complex, untrusted cloud software stack.We believe that hardware-based capabilities, as offered by Arm CHERI hardware, can act as a building block for lightweight yet principled isolation abstractions, and can be used to compartmentalise the full cloud stack including cloud native applications. By leveraging hardware capabilities for isolation, it becomes possible to give unprivileged userspace code strong guarantees about isolation and the impact by the rest of the untrusted cloud stack. The CloudCAP project will conduct research at the intersection of systems and programming languages. Its overall goal is to investigate and devise new abstractions and mechanisms for capability-based hardware to support flexible, lightweight and scalable compartmentalisation as part of future cloud stacks and cloud native applications. The project will result in capability-based cloud compartments, a new abstraction that can express policies about the confidentiality and integrity of data and computation, both within, and across, the components of a cloud stack and cloud native applications. A fundamental contribution of CloudCAP will be that, through CHERI's capability hardware support, it will become possible to make cloud compartments practical: they will be implementable efficiently and be compatible with existing cloud stacks and programming language runtimes.