Red Hat smitten by secure enclaves 'cos some sysadmins are evil

Red Hat Summit Red Hat has revealed a plan to to work with CPU-makers so that its wares can take advantage of in-silicon security features such as secure enclaves.

The company today told attendees at its 2018 Summit in San Francisco that it will work with major silicon shops, including Arm, Intel, and AMD, to move operations such as handling security keys into secured enclaves that are inaccessible to the operating system.

In those cases, Red Hat says, only the applications themselves would be cleared to access the information in the enclave, meaning an intruder who had compromised a server or VM (such as via a malware infection or side channel attack) would be isolated from the sensitive data.

The use of secure enclaves to isolate data is growing in popularity, as software vendors find ways to employ isolation to tamper-proof applications and services from side-channel attacks.

Red Hat wants to take things further by encrypting whole virtual machines and has already chatted to AMD about how to help do so to mitigate hypervisor-layer attacks. AMD's Epyc can decrypt and encrypt RAM on the fly as in enters and leaves the processor.

Nasty

Mike Bursell, Red Hat's chief security architect said malicious actors targeting the VM from within the hypervisor is a particularly nasty risk.

"The reason it is nasty is because allowing that is how hypervisors work, hypervisors can map the memory of VMs, they can write, read, and there is very little you can do about that," Bursell said,

"That is fine if you trust all of your sys admins, it is fine if you trust everyone who works at AWS, Google, Microsoft or whatever, it is fine if you never have sensitive data. But if you do, if you are running any of that on a system and you don't have 100 per cent certainty and trust in the sysadmin, you can't be certain they are not looking into those things and changing them as well."

Red Hat also has big plans for one of its former partners that is now a subsidiary: CoreOS.

The RHEL roadmap has added tighter integration with the CoreOS container management tools and the company said CoreOS Container Linux will be released into the public domain and subsequent versions under the new brand "Red Hat CoreOS".

The CoreOS Linux build will also be pitched as the solution for managing Kubernetes containers, eventually replacing the existing RHEL Atomic Host. ®