An official website of the United States government
With close to native performance, Linux containers are becoming the de facto platform for cloud computing. While various solutions have been proposed to secure applications and containers in the cloud environment by leveraging Intel SGX, most cloud operators do not yet offer SGX as a service. This is likely due to a number of security, scalability, and usability concerns coming from both cloud providers and users. Cloud operators worry about the security guarantees of unofficial SDKs, limited support for remote attestation within containers, limited physical memory for the Enclave Page Cache (EPC) making it difficult to support hundreds of enclaves, and potential DoS attacks against EPC by malicious users. Meanwhile, end users need to worry about careful program partitioning to reduce the TCB and adapting legacy applications to use SGX. We note that most of these concerns are the result of an incomplete infrastructure, from the OS to the application layer. We address these concerns with lxcsgx, which allows SGX applications to run inside containers while also: enabling SGX remote attestation for containerized applications, enforcing EPC memory usage control on a per-container basis, providing a general software TPM using SGX to augment legacy applications, and supporting partitioning with a GCC plugin. We then retrofit Nginx/OpenSSL and Memcached using the software TPM and SGX partitioning to defend against known and potential attacks. Thanks to the small EPC footprint of each enclave, we are able to run up to 100 containerized Memcached instances without EPC swapping. Our evaluation shows the overhead introduced by lxcsgx is less than 6.9% for simple SGX applications, 9.5% for Nginx/OpenSSL, and 20.9% for containerized Memcached.
more »
« less
Reducing the Carbon Footprint of EdTech with Repurposed Devices
Education technology (EdTech) is an important tool for streamlining and improving course administration and teaching. Many modern EdTech tools rely on cloud services to host containerized applications. While this is convenient, it is also costly in terms of both dollars and carbon emissions. We propose the alternative approach of hosting containerized EdTech applications on local clusters of upcycled Android devices. We perform an evaluation of the Google Pixel Fold for handling educational workloads. Our findings suggest that such repurposed device could effectively bridge the gap between mobile and traditional computing platforms in education, open new avenues for accessible educational computing environments.
more »
« less
- Award ID(s):
- 2233894
- PAR ID:
- 10553914
- Publisher / Repository:
- IEEE
- Date Published:
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
Joseph Paris, Jackie Milhans (Ed.)The Cyber Human Ecosystem for Engaged Security Education (CHEESEHub) is an open web platform that hosts communitycontributed containerized demonstrations of cybersecurity concepts. In order to maximize flexibility, scalability, and utilization, CHEESEHub is currently hosted in a Kubernetes cluster on the Jetstream academic cloud. In this short paper, we describe the security model of CHEESEHub and specifically the various Kubernetes security features that have been leveraged to secure CHEESEHub. This ensures that the various cybersecurity exploits hosted in the containers cannot be misused, and that potential malicious users of the platform are cordoned off from impacting not just other legitimate users, but also the underlying hosting cloud. More generally, we hope that this article will provide useful information to the research computing community on a less discussed aspect of cloud deployment: the various security features of Kubernetes and their application in practice.more » « less
-
Welcome to the 4 th Workshop on Education for High Performance Computing (EduHiPC 2022). The EduHiPC 2022 workshop, held in conjunction with the IEEE International Conference on High Performance Computing Data & Analytics (HiPC 2022), is devoted to the development and assessment of educational and curricular innovations and resources for undergraduate and graduate education in Parallel and Distributed Computing (PDC) and High Performance Computing (HPC). EduHiPC brings together individuals from academia, industry, and other educational and research institutes to explore new ideas, challenges, and experiences related to PDC pedagogy and curricula. The workshop is designed in coordination with the IEEE TCPP curriculum initiative on parallel and distributed computing ( hitps://tcpp.cs.gsu .edu/curriculum/) for undergraduates majoring in computer science and computer engineering. It is supported by C-DAC, India and the US National Science Foundation (NSF) supported Center for Parallel and Distributed Computing Curriculum Development and Educational Resources (CDER). Details for attending the workshop are available on the HiPC webpage (HiPC). The effect of pandemic on academic and research community seems now to be globally receding as was evident from the enthusiastic in-person participation of conference delegates. Please visit the EduHiPC-22 webpage for the complete online proceedings, including copies of papers and presentation slides: EduHiPC 2022 | NSF/IEEE-TCPP Curriculum Initiative.more » « less
-
Serverless computing services are offered by major cloud service providers such as Google Cloud Platform, Amazon Web Services, and Microsoft Azure. The primary purpose of the services is to offer efficiency and scalability in modern software development and IT operations while reducing overall costs and operational complexity. However, prospective customers often question which serverless service will best meet their organizational and business needs. This study analyzed the features, usability, and performance of three serverless cloud computing platforms: Google Cloud’s Cloud Run, Amazon Web Service’s App Runner, and Microsoft Azure’s Container Apps. The analysis was conducted with a containerized mobile application designed to track real-time bus locations for San Antonio public buses on specific routes and provide estimated arrival times for selected bus stops. The study evaluated various system-related features, including service configuration, pricing, and memory and CPU capacity, along with performance metrics such as container latency, distance matrix API response time, and CPU utilization for each service. The results of the analysis revealed that Google’s Cloud Run demonstrated better performance and usability than AWS’s App Runner and Microsoft Azure’s Container Apps. Cloud Run exhibited lower latency and faster response time for distance matrix queries. These findings provide valuable insights for selecting an appropriate serverless cloud service for similar containerized web applications.more » « less
-
Computing education is important for K-12 learners, but not all learners resonate with common educational practices. Culturally responsive computing initiatives center and empower learners from diverse and historically excluded backgrounds. Recently, a number of educational programs have been developed and curated for an online experience. In this paper, we describe an online synchronous culturally responsive computing (CRC) camp for middle school girls (ages 11-14 years old) and report on challenges and successes from running the camp curriculum four times over the course of a year. We also describe core iterative changes we made between our runs. We then discuss lessons learned related to building rapport and connection among learners, centering learners of different backgrounds in an online synchronous environment, and facilitating reflection on power and identity aimed at positioning learners as techno-social change agents. Lastly, we offer recommendations for running online CRC experiences.more » « less
