Hardware-based reliable and secure container network

A security system which secures network communication between containers, the security system comprising:

• a host system including a manager module, a first secure container, a second secure container and a host network container that directly uses a host network namespace of the host system;
• and
• a Network Interface Chip (NIC) including a secure bridge,
• wherein the manager module is configured to install, in the first secure container of the host system, a Hyperion Secure Interface (HSI) for communication with the secure bridge included in the NIC change a source address of a transmission packet to a specific token based on a map of the HSI, and deliver the transmission packet to the secure bridge through the HSI;
• and
• wherein the secure bridge is configured to determine whether the specific token of the transmission packet is valid, change the specific token to the source address and deliver the transmission packet to a target container when the specific token is valid,
• wherein the target container is the second secure container included in the host system, and
• wherein the secure bridge is configured to provide physically isolated communication channels to the first secure container and the second secure container to prevent communication between the secure bridge and each of the first secure container and the second secure container from being exposed to the host network namespace.

A terminal which secures network communication between containers, the terminal comprising:

• a communication module;
• a memory;
• and
• a processor which functionally controls the communication module and the memory,
• wherein the processor is configured to:
• install, a first secure container in a host system, a Hyperion Secure Interface (HSI) for communication with a secure bridge included in a Network Interface Chip (NIC) through a manager module,
• change a source address of a transmission packet to a specific token on the basis of based on a map of the HSI through the manager module,
• deliver the transmission packet to the secure bridge through the HSI,
• determine whether the specific token of the transmission packet is valid, and
• change the specific token to the source address and deliver the transmission packet to a target container when the specific token is valid,
• wherein the target container is a second secure container included in the host system,
• wherein the host system includes a host network container that directly uses a host network namespace of the host system, and
• wherein the secure bridge is configured to provide physically isolated communication channels to the first secure container and the second secure container to prevent communication between the secure bridge and each of the first secure container and the second secure container from being exposed to the host network namespace.