At present, a growing number of web applications especially cloud computing systems employ representational state transfer (REST) API as the interface to expose their services for simplicity and clarity. For security purposes, service providers prefer to control the access to the provided interface based on the principle of least privilege. However, how to divide the administrative privileges remains a difficulty in practice. In this work, we simplify the privilege partitioning problem into a classification problem of RESTful functions, so the permission to call a category of functions can be granted to a specific administrator. We propose a RESTful API classification approach called RestSep based on genetic algorithm. A classification is represented as a 2-dimensional matrix, which is used as the chromosome. Customized operators of selection, mutation and crossover are designed. The fitness function is designed to balance parameters such as number of categories, test case coverage, function overlapping, etc. Experiments on popular clouds like OpenStack and Kubernetes indicate RestSep can generate a self-explanatory classification result, which can serve as a guideline for privilege partitioning. The overhead of test generation is at most 13.1% and the overhead of genetic algorithm is at most 183.29s, which are acceptable for practical use.

Security enhancements to the emerging IaaS (Infrastructure as a Service) cloud computing systems have become the focus of much research, but little of this targets the underlying infrastructure. Trusted cloud systems are proposed to integrate trusted computing infrastructure with cloud systems. With remote attestations, cloud customers are able to determine the genuine behaviors of their applications' hosts; and therefore they establish trust to the cloud. However, the current trusted clouds have difficulties in effectively attesting to the cloud service dependency for customers' applications, due to the cloud's complexity, heterogeneity and dynamism. In this paper, we present RepCloud, a decentralized cloud trust management framework, inspired by the reputation systems from the research in peer-to-peer systems. With RepCloud, cloud customers are able to determine the properties of the exact nodes that may affect the genuine functionalities of their applications, without obtaining much internal information of the cloud. Experiments showed that besides achieving fine-grained cloud service dependency attestation, RepCloud incurred lower trust management overhead than the existing trusted cloud systems.

The access control mechanisms of existing cloud systems, mainly OpenStack, fail to provide two key factors: i) centralized access mediation and ii) flexible policy customization. This situation prevents cloud administrators and end customers from enhancing their security. Furthermore, a variety of clouds have implemented their access control systems and policies in separated ways. This might confuse the customers whose businesses are built on multiple clouds, as they have to take efforts to accommodate their policies for different platforms. The OpenStack Security Modules (OSM) project has developed a least-invasive access control framework for OpenStack to enable different access control models to be implemented as loadable modules. This framework can be a good replacement of the existing permission checks in OpenStack and other platforms. We also propose an integration mechanism for multiple policies to form a single decision. This paper presents the design and implementation of OSM, including a new service called patron and an attachment module called access endpoint middleware (AEM). Experiments on the tempest benchmark indicate that OSM has improved the flexibility and security of policy management without affecting other services. Meantime, the average performance overhead remains as low as 7.3%, which is acceptable for practical use.

The cloud computing ecosystem is in urgent need of effective and practical trust establishment schemes. Cloud customers currently lack approaches to effectively verify the genuine behaviours of cloud services. They can only blindly believe that the Cloud Service Providers (CSPs) are honest enough to not tamper with their data, while many others have avoided using the cloud entirely. Trust establishment schemes, such as cloud auditing and cloud attestation systems, lack controls and transparency over their trust building processes, which only blur the effectiveness of the proclaimed trustworthiness. We argue that these problems ultimately result from the CSPs' autocratic governance over all the activities inside the cloud. In this paper, we present a Separation-of-Powers (SoP) model by referencing the similar concepts from the discipline of the political philosophy. We define three independent roles to separate the powers of definition, enforcement, and inspection from the CSPs. These roles form the collaborative-restrictive relationship to facilitate trustworthy cloud services and achieve the balance-of-powers. We believe a model of this kind will open new opportunities for achieving trustworthy and open cloud ecosystem governance.

Recently an increasing number of web applications especially cloud computing systems utilize representational state transfer (REST) API to deploy their services for simplicity and clarity. Users can employ the same interface to invoke various applications from the Internet. For security purposes, service providers would control the access to the provided interface through policy enforcement. Yet the access control of REST interfaces lacks a uniform standard regarding the policy language and corresponding enforcement implementation, which brings two limitations: i) Users have to deal with totally different types of policies to accommodate certain systems. ii) Service providers have to design their own platform-specific authorization policy language and the related enforcement mechanisms. In this paper, we propose a REST Policy Language (RestPL) to express the authorization policies especially for REST APIs. RestPL is ensured to be request-oriented, based on our definition of the standard request form. This indicates that a RestPL policy can be automatically generated from an actual request, which helps mitigate a user's pressure during policy designing. Furthermore, we also provide a reference implementation for the enforcement code of RestPL based on regular expressions and deploy it on OpenStack Liberty to demonstrate its feasibility. The experimental results indicate the enforcement overhead of RestPL can be reduced to 80.6% compared with the original policy. In addition, we show that an end-user can also benefit from RestPL for reducing the learning effort by at least 41.6%.

Managing the allocation of cloud virtual machines at physical resources is a key requirement for the success of clouds. Current implementations of cloud schedulers do not consider the entire cloud infrastructure neither do they consider the overall user and infrastructure properties. This results in major security, privacy, and resilience concerns. In this paper, we propose a novel cloud scheduler which considers both user requirements and infrastructure properties. We focus on assuring users that their virtual resources are hosted using physical resources that match their requirements without getting users involved with understanding the details of the cloud infrastructure. As a proof-of-concept, we present our prototype which is built on OpenStack. The provided prototype implements the proposed cloud scheduler. It also provides an implementation of our previous work on cloud trust management which provides the scheduler with input about the trust status of the cloud infrastructure.

MapReduce systems deployed over an open infrastructure such as a cloud have attracted much attention, due to the significant reductions in the costs entailed in satisfying both the computation and storage demands. However, in these systems, the integrity of MapReduce applications is subject to significant threats. Recent research mainly focuses on replication-based integrity verification schemes. However, inevitable critical deficiencies restrict its usage. In this paper, we propose a Trusted MapReduce (TMR) framework to integrate MapReduce systems with the TCG Trusted Computing infrastructure. TMR effectively uses remote attestations to achieve efficient and deterministic integrity verification. We propose a split and parallel attestation schema to reduce latency and eliminate scalability limitations when employing the Trusted Computing mechanisms. We implemented TMR on the Hadoop MapReduce system. Experiments showed that a high strength integrity assurance has been achieved, and the overheads can easily be managed to less than 1% for an industry-strength implementation.

Cloud Computing provides an optimal infrastructure to utilise and share both computational and data resources whilst allowing a pay-per-use model, useful to cost-effectively manage hardware investment or to maximise its utilisation. Cloud Computing also offers transitory access to scalable amounts of computational resources, something that is particularly important due to the time and financial constraints of many user communities. The growing number of communities that are adopting large public cloud resources such as Amazon Web Services [1] or Microsoft Azure [2] proves the success and hence usefulness of the Cloud Computing paradigm. Nonetheless, the typical use cases for public clouds involve non-business critical applications, particularly where issues around security of utilization of applications or deposited data within shared public services are binding requisites. In this paper, a use case is presented illustrating how the integration of Trusted Computing technologies into an available cloud infrastructure -- Eucalyptus -- allows the security-critical energy industry to exploit the flexibility and potential economical benefits of the Cloud Computing paradigm for their business-critical applications.

Most existing attestation schemes deal with binaries and typically require an exhaustive list of known-good measurements beforehand in order to perform verification. However, many programs nowadays are custom-built: the end user is allowed to tailor, compile and build the source code into various versions, or even build everything from scratch. As a result, it is very difficult, if not impossible, for existing schemes to attest the custom-built software with theoretically unlimited number of valid binaries available. This paper introduce SCOBA, a new Source COde Based Attestation framework, to specifically deal with the attestation on custom software. Instead of trying to obtain a know-good measurement list, SCOBA focuses on the source code and provides a trusted building process to attest the resulting binaries based on the source files and building configuration. SCOBA introduces a trusted verifier to certify the binary code of custom-build program according to its source code and building configuration. For custom-built software based on open-source distributions, we implemented a fully automatic trusted building system prototype for SCOBA based on GCC and TPM. As a case study, we also applied SCOBA to Gentoo and its Portage, which is a source code based package management system. Experimental results show that remote attestation, one of the key TCG features, can be made practically available to the free software community.