容器时代的敏捷网络访问控制
Agile Network Access Control in the Container Age
摘要：
Linux容器，例如Docker管理的容器，是打包和部署复杂应用程序的一种越来越流行的方式。然而，分布式微服务部署的网络访问控制的基本安全原语通常被忽略或留给网络运营团队。低级网络访问控制列表不能适当地强制执行高级应用程序特定的安全要求。除了粗粒度的虚拟网络分离，Docker既不支持应用程序开发人员指定，也不支持网络运营商在容器之间实施细粒度的网络访问控制。在一个虚构的故事中，我们跟随DevOp工程师Alice了解Web应用程序的生命周期。从最初的设计和软件工程，通过网络操作和自动化，我们显示的任务预期的爱丽丝，并提出工具支持，以帮助。作为一名全栈DevOp，Alice参与了高层设计决策以及底层网络故障排除。重点是网络访问控制，我们展示了在今天的政策管理的缺点，并勾勒出一个工具支持的解决方案。我们调查了相关的学术工作，并表明，许多现有的工具无法桥接不同层次的抽象全栈工程师正在操作。我们的工具集正式验证使用Isabell/HOL，并作为开源。
英文摘要：
Linux Containers, such as those managed by Docker, are an increasingly popular way to package and deploy complex applications. However, the fundamental security primitive of network access control for a distributed microservice deployment is often ignored or left to the network operations team. High-level application-specific security requirements are not appropriately enforced by low-level network access control lists. Apart from coarse-grained separation of virtual networks, Docker neither supports the application developer to specify nor the network operators to enforce fine-grained network access control between containers. In a fictional story, we follow DevOp engineer Alice through the lifecycle of a web application. From the initial design and software engineering through network operations and automation, we show the task expected of Alice and propose tool-support to help. As a full-stack DevOp, Alice is involved in high-level design decisions as well as low-level network troubleshooting. Focusing on network access control, we demonstrate shortcomings in today's policy management and sketch a tool-supported solution. We survey related academic work and show that many existing tools fail to bridge between the different levels of abstractions a full-stack engineer is operating on. Our toolset is formally verified using Isabell/HOL and is available as Open Source.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
