High Assurance Container Architecture (HACA) for Secure Multi-Domain Applications

Containers and container orchestration technology are becoming more popular due to the performance benefits, portability, and the ability to leverage them in many different environments/architectures. However, security remains the barrier to widespread adoption in operational environments. Ensuring a secured containerization software approach within deployed systems can pose several unique challenges.  Most of today’s containerization technologies do not employ a “secure-by-default” approach which can leave data flow from containers, as well as the container images themselves, susceptible to exposure.  To harden these systems utilizing containers, separation and isolation of critical vs non-critical data must be addressed and proper introspection and attestation must be implemented.  Utilizing the formally proven seL4 hypervisor along with virtual machines with containerization technology can mitigate such risks.  The high-assurance seL4 microkernel provides a backbone of guaranteed isolation of components while facilitating a framework that can support proper introspection, attestation, and isolated authorized data flow.  The DornerWorks solution incorporates the use of the seL4 microkernel, virtual machines, isolated software components, and existing cybersecurity hardware to create an environment that can provide isolation guarantees for software containerization deployments.