Towards Multi-Tenancy Security Capabilities for Applications in Cloud Platforms
Abstract
Multi-tenancy, where multiple customers or tenants share the same underlying infrastructure, is a defining characteristic of cloud computing technology. It is also a major security concern since software stacks in multi-tenant clouds are large and complex, and hence prone to compromise. Multi-tenancy remains to be a thorny, yet an unavoidable issue for enterprises moving to cloud. This project seeks to investigate and address multi-tenancy concerns that arise in infrastructure and platform as a service clouds (referred to IaaS and PaaS respectively). In an IaaS cloud, a cloud service provider (CSP) offers virtualized hardware resources as a service to its tenants. In PaaS (a value-added IaaS), a CSP offers encapsulated application infrastructure with cloud characteristics as a service to its tenants. As the level of abstraction of resources increases from IaaS to PaaS, so does the depth and extent of multi-tenancy. This projects seeks to make significant strides toward understanding and developing platform capabilities that can empower a tenant to control the depth and extent of multi-tenancy that is acceptable to them. Providing such precise control on, and visibility into how the underlying resources are shared can help tenants to quantify their risk in cloud in a fine-grained manner. The project consists of 4 major components. First, it develops a theory of attribute-based security constraints specification framework that is informed by cloud as the application technology domain. We seek to develop formal models and language capabilities that can express fine-grained constraints using linear-time temporal logic. Second, it investigates issues that arise in enforcing such constraints in practice, in large-scale and complex distributed systems such as cloud. “Faithful” and “approximate” enforcement strategies are explored by precisely characterizing them as enforcement-level security properties. Third, a comprehensive implementation of the constraints specification and enforcement framework is performed on OpenStack (IaaS) and OpenShift (PaaS) in a medium-scale cloud infrastructure. Finally, the fourth component conducts rigorous evaluation of the project across many dimensions including expressiveness, performance, resource utilization, usability, and practical adoption. In integrating research and education, in addition to activities relating to curriculum development and outreach, entrepreneurial activity involving multi-disciplinary teams of engineering and business students, and venture capitalists, and cyber security competitions are planned.
Document Details
- Document Type
- DoD Grant Award
- Publication Date
- Feb 11, 2016
- Source ID
- W911NF1510518
Entities
People
- Ram Krishnan
Organizations
- Army Contracting Command
- United States Department of Defense
- University of Texas at San Antonio