Iso-UniK: lightweight multi-process unikernel through memory protection keys

• 来源期刊: 网络空间安全科学与技术（英文版）
• 关键词: Unikernel Multi-process Intel MPK Isolation
• 年，卷（期）: 2020,（1）
• 页码范围: 14-27
• 页数: 14页
• 语种: 中文

摘要

Unikernel,specializing a minimalistic libOS with an application,is an attractive design for cloud computing.However,the Achilles' heel of unikernel is the lack of multi-process support,which makes it less flexible and applicable.Many applications rely on the process abstraction to isolate different components.For example,Apache with the multi-processing module isolates a request handler in a process to guarantee security.Prior art tackles the problem by simulating multi-process with multiple unikernels,which is incompatible with existing cloud providers and also introduces high overhead.This paper proposes Iso-UniK,a new unikernel design enabling multi-task applications with the support of both functionality and isolation.Iso-UniK leverages a recent hardware feature,named Intel Memory Protection Key (Intel MPK),to provide lightweight and efficient isolation for multi-process in unikernel.Our design has three benefits compared with previous approaches.First,Iso-UniK does not need hypervisor support and is thus compatible with existing cloud computing platforms;second,Iso-UniK promises fast system calls with only 45 cycles;last,a process can be isolated with a flexible configuration.We have implemented a prototype based on OSv,a unikernel system supporting unmodified applications.Iso-UniK can achieve fast fork operation with only 66μs for multi-process applications.Our evaluation shows that the isolation and multi-process support in Iso-UniK will not damage the applications' performance.