Ecosystem thrust

One motivating scenario is to enable secure sharing of data and code for cooperative analytics, in which analytics software is offered as a service for computing with datasets or algorithms that are considered confidential by their owners. A goal is to enable jointly trusted computations that combine confidential datasets from multiple owners, and produce a privacy-preserving output. Safe data sharing can help to unlock the potential of “big data” in areas where data privacy is paramount, e.g., healthcare. We are developing cloud-based technologies to place such collaborations on more secure foundations.

A mutually trusted cloud provider can enhance security by mediating these kinds of cross-tenant interactions. One obvious way to approach these goals is to extend cloud authorization models to allow richer policy control over data sharing and other interactions among tenants. A more ambitious direction is to establish new cloud-based trust services that enable clients to derive trust in a tenant service without prior knowledge or trust in the identity of its owner. In our approach the cloud provider serves as a root of trust by certifying facts about the tenant security properties or code identity. Other tenants may specify trust policies to evaluate against these assertions. For example, a data owner may trust a third-party service to access a sensitive dataset if the cloud provider attests that the service is contained—it is restricted in how it can communicate or release information.

We are developing an extended IaaS-layer framework for managing contained execution, in which a group of tenant instances (VMs) have their network connectivity restricted according to a declared policy as a defense against information leakage. One system prototype, called CQSTR (say “sequester”), implements a new cloud container abstraction as a set of extensions to the OpenStack IaaS platform.

Building trust in tenant services

CQSTR is just one example of a cloud provider service that makes trusted statements about security properties of a tenant’s configuration, and allows other client software to check these properties for compliance with a security policy. Other useful security properties available to the cloud platform include a tenant’s firewall posture, whether its software is patched adequately, whether it runs defensive (e.g., anti-virus) software, whether it encrypts its stored data, whether its password system is protected by Pythia, attestations of software identity, network security services, and so forth. They might also reflect continuous auditing or monitoring checks or incident history. Clients may use this information to make informed decisions about whether a service is trustworthy, rather than relying merely on its reputation, as is common today.

Our research seeks to provide a general and practical foundation to manage trust in cloud ecosystems based on authenticated assertions and policies, building on a wealth of prior work in authorization logics. Our approach addresses a number of potential concerns. First, the policy language should be expressive, efficient, easy to use, and extensible to a growing vocabulary of security properties. Second, the approach should protect the secrecy of sensitive data, including security configurations and the policies themselves.

Increasingly, commercial cloud operators offer higher- level platform abstractions (PaaS) for tenants, e.g., Google’s AppEngine and AWS Elastic MapReduce. PaaS systems simplify cloud programming with more powerful models that enhance customer productivity and add value to cloud services. PaaS systems are also offered by tenants to other tenants (e.g., Heroku, CloudFoundry).

Flexibility to offer layered platforms is fundamental to an open cloud ecosystem. We are exploring how to enable deployment of third-party PaaS services that inherit trust from the underlying IaaS cloud system via attesta- tion, auditing, and mediated access to security credentials for IaaS-layer services. The PaaS service, in turn, may leverage its higher-level programming model to enforce language-based safety checks or interpose higher-level monitoring or containment. In addition, we believe that PaaS platforms are promising targets for trustworthy computing via software attestation and code-based access control. Our premise is that higher-level PaaS programs are more practical to verify and attest than binary executables because they are compact: they build on powerful languages and a library of standard primitives whose implementations may be trusted.