Packaging applications in Containers, dynamically managed using a cluster orchestrator, is the de-facto approach for deployment of cloud-native applications. When Containers run inside Virtual Machines (VMs) to protect infrastructural assets, Network Policies at the Container layer and Security Groups at the VM layer provide complementary firewall mechanisms that strengthen defenses against lateral movement of attackers. However, least-privilege network policies at the Container layer may not always be consistent with statically defined, over-permissive Security Groups at the VM layer. This is especially a problem with low-latency configuration of Container networking solutions that requires every opened Container protocol, port and traffic direction also to be opened at the VM layer. In any post-exploitation scenario where attackers escape from within an already compromised or infected Container, such over-permissive Security Groups do not prevent the attacker from spreading across VMs to find powerful tokens for accessing the cluster orchestrator. In this paper, we introduce GrassHopper, a fast and dynamic cross-layer enforcement approach for Network Policies, which automatically generates Security Group configurations from dynamically verified Network Policies and Container scheduling decisions. Given the low-latency context, the design of GrassHopper must ensure that dynamically generated Security Group rules come in a timely manner to effect before the newly scheduled Containers become ready to serve traffic. We evaluate the performance of GrassHopper on a Kubernetes cluster running on OpenStack at the network and application level. In comparison to a Security Group management approach that is not scheduling-aware, our findings show that for low-latency applications GrassHopper can reduce the network attack surface between VMs at a ratio of 78-to-99%, while causing no network performance overhead at the application level with respect to latency and throughput.

Packaging applications in containers and managing them dynamically using a cluster orchestrator is the de-facto approach for deployment of cloud-native applications. When containers run inside virtual machines (VMs) to protect infrastructural assets, network policies (NPs) at the container layer and security groups (SGs) at the VM layer provide complementary firewall mechanisms that strengthen defenses against lateral movement of attackers. However, least-privilege NPs at the container layer may not always be consistent with statically defined, over-permissive SGs at the VM layer. This is especially a problem with low-latency configuration of container networking solutions that requires every opened container protocol, port and traffic direction also to be opened at the VM layer. In any post-exploitation scenario where attackers escape from within an already compromised or infected container, such over-permissive SGs do not prevent the attacker from spreading across VMs to find powerful tokens for accessing the cluster orchestrator. In this paper, we introduce GrassHopper (GH), a fast and dynamic cross-layer enforcement approach for NPs, which automatically generates SG configurations from dynamically verified NPs. Given the low-latency context, the design of GH must ensure that dynamically generated SG rules are applied fast before the newly scheduled containers become ready to serve traffic. We evaluate GH on a Kubernetes cluster running on OpenStack. For a wide range of relevant low-latency applications and cluster setups, GH can reduce the network attack surface between VMs at a ratio of 75-to-99% while causing no application level performance overhead with respect to latency, throughput, and CPU utilization.

Container orchestration systems, such as Docker Swarm, Kubernetes and Mesos, provide automated support for deployment and management of distributed applications as sets of containers. While these systems were initially designed for running load-balanced stateless services, they have also been used for running database clusters because of improved resilience attributes such as fast auto-recovery of failed database nodes, and location transparency at the level of TCP/IP connections between database instances. In this paper we evaluate the performance overhead of Docker Swarm and Kubernetes for deploying and managing NoSQL database clusters, with MongoDB as database case study. As the baseline for comparison, we use an OpenStack IaaS cloud that also allows attaining these improved resilience attributes although in a less automated manner.

SUMMARY In a cross‐organizational context, software services are provided and consumed by different organizations. Ensuring that the non‐functional requirements of all the involved organizations are satisfied is hard to achieve in such a distributed and heterogeneous environment: the implementation of features, for example, security, is scattered across the services of multiple organizations. In this paper, we present a coordination architecture for flexible and policy‐driven composition of cross‐organizational features in distributed service systems. The underlying approach of this architecture is to specify the features and their composition at a higher level that abstracts the internal implementation mechanisms of the organizations involved. By means of feature composition policies, the organizations specify at a fine‐grained level which features are required and when they have to apply. Driven by these policies, our coordination middleware dynamically integrates the appropriate features throughout the cross‐organizational service composition in a consistent and efficient way. We have validated our architecture in a proof of concept showing limited performance overhead. Copyright © 2011 John Wiley & Sons, Ltd.

While the use of cloud computing is on the rise, many obstacles to its adoption remain. One of the weaknesses of current cloud offerings is the difficulty of developing highly customizable applications while retaining the increased scalability and lower cost offered by the multi-tenant nature of cloud applications. In this paper we describe a Software Product Line Engineering (SPLE) approach to the modelling and deployment of customizable Software as a Service (SaaS) applications. Afterwards we define a formal feature placement problem to manage these applications, and compare several heuristic approaches to solve the problem. The scalability and performance of the algorithms is investigated in detail. Our experiments show that the heuristics scale and perform well for systems with a reasonable load.

In recent years, there has been a growing interest in cloud technologies. Using current cloud solutions, it is however difficult to create customizable multi-tenant applications, especially if the application must support varying Quality of Service (QoS) guarantees. Software Product Line Engineering (SPLE) and feature modeling techniques are commonly used to address these issues in non-cloud applications, but these techniques cannot be ported directly to a cloud context, as the common approaches are geared towards customization of on-premise deployed applications, and do not support multi-tenancy. In this paper, we propose an architecture for the development and management of customizable Software as a Service (SaaS) applications, built using SPLE techniques. In our approach, each application is a composition of services, where individual services correspond to specific application functionalities, referred to as features. A feature-based methodology is described to abstract and convert the application information required at different stages of the application life-cycle: development, customization and deployment. We specifically focus on how development feature models can be adapted ensuring a one-to-one correspondence between features and services exists, ensuring the composition of services yields an application containing the corresponding features. These runtime features can then be managed using feature placement techniques. The proposed approach enables developers to define significantly less features, while limiting the amount of automatically generated features in the application runtime stage. Conversion times between models are shown to be in the order of milliseconds, while execution times of management algorithms are shown to improve by 5 to 17% depending on the application case.

Most work on adaptive workflows offers insufficient flexibility to enforce complex policies regarding dynamic, evolvable and robust workflows. In addition, many proposed approaches require customized workflow engines. This paper presents a portable framework for realistic enforcement of dynamic adaptation policies in business processes. The framework is based on the Model-View-Controller (MVC) pattern, commonly used for adding dynamism to web pages. To enhance reusability, our approach supports separation of adaptation logic from the functional workflow and modularization of workflow tasks in reusable aspects. The main idea is to design a workflow process as a template, where tasks can be specified on an abstract level. Concrete implementations of the tasks, modeled as aspects, are then selected from a library according to a policy-based adaptation logic. This logic is implemented using a general purpose language that offers an extensible and flexible solution to enforce any type of policy. We evaluate by means of a case study on workflow confidentiality to what extent an approach using standards-based technologies allows application-specific adaptation of running workflow instances.

Mapping problem-space features into solution-space features is a fundamental configuration problem in software product line engineering. A configuration problem is defined as generating the most optimal combination of software features given a requirements specification and given a set of configuration rules. Current approaches however provide little support for expressing complex configuration rules between problem and solution space that support incomplete requirements specifications. In this paper, we propose an approach to model complex configuration rules based on a generalization of the concept of problem-solution feature interactions. These are interactions between solution-space features that only arise in specific problem contexts. The use of an existing tool to support our approach is also discussed: we use the DLV answer set solver to express a particular configuration problem as a logic program whose answer set corresponds to the optimal combinations of solution-space features. We motivate and illustrate our approach with a case study in the field of managing dynamic adaptations in distributed software, where the goal is to generate an optimal protocol for accommodating a given adaptation.

This paper discusses client-specific customization of systems that implement an on-line Internet service in the presence of simultaneous client-specific views. The problem is that each client must be able to customize the running system for use in its own context, without impacting the service behavior that is delivered to other clients. To solve this, we propose to customize the system on a per client request basis, where the system itself consists of a stable core and several extensions that are injected into the core as needed. However, this approach brings on its own several consistency management problems that must be dealt with in order to make the approach viable. We give an overview of these problems and present a management architecture that deals with these problems.

Support for dynamic and client-specific customization is required in many application areas. We present a (distributed) application as consisting of a minimal functional core, implemented as a component based system, and an unbound set of potential extensions that can be selectively integrated within this core functionality. An extension to this core may be a new service due to new requirements of end users. Another important category of extensions we consider are non-functional services such as authentication, which typically introduce interaction refinements at the application level. In accordance with the separation of concerns principle, each extension is implemented as a layer of mixin-like wrappers. Each wrapper incrementally adds behavior and state to a core component instance from the outside, without modifying the component's implementation. The novelty of this work is that the composition logic, responsible for integrating extensions into the core system, is externalized from the code of clients, core system and extensions. Clients (end users, system integrators) can customize this composition logic on a per collaboration basis by 'attaching' high-level interpretable extension identifiers to their interactions with the core system.