While containerization has emerged as a lightweight approach to package, deploy, and run legacy applications in a resource-efficient manner, the shared kernel-resource model used by containers introduces critical security concerns. Specifically, the abuse of system calls by a compromised container can trigger the security vulnerabilities of a host kernel. Unfortunately, even though existing solutions provide powerful protection mechanisms against such issues, how to define the capabilities of containers is still up to operators. In this work, we thus introduce TCLP, a dynamic analysis system that helps operators configure the least capabilities of containers to protect not only themselves but also a host. TCLP monitors the system calls triggered by containers in run time and finds the least capabilities required to run the containers based on the collected system calls. Finally, operators configure the minimal capabilities discovered by TCLP for their containers, reducing the risk of kernel vulnerabilities.

While cloud computing platform becomes popular and works as a platform for network function virtualization (NFV), the security of the cloud also becomes an important subject. However, although there are many works about security mechanisms, there has not been much research into what problems can occur when these conventional mechanisms are applied to the cloud system. Thus, we have given more attention to the robustness of communications resided in the cloud, not security mechanism itself, and found that security threats could arise from communication between cloud services and identification process. To cope with this problem, we propose three approaches: integrative identification system in a single cloud service, action-based token authorization, and partially encrypted communication between the identification system and cloud services. By implementing these approaches to open-source cloud computing platform, Openstack, we show that our approaches are feasible.