Cloud application marketplaces of modern cloud infrastructures offer a new software deployment model, integrated with the cloud environment in its configuration and policies. However, similar to traditional software distribution which has been suffering from software piracy and reverse engineering, cloud marketplaces face the same challenges that can deter the success of the evolving ecosystem of cloud software. We present a novel system named CAFE for cloud infrastructures where sensitive software logic can be executed with high secrecy protected from any piracy or reverse engineering attempts in a virtual machine even when its operating system kernel is compromised. The key mechanism is the end-to-end framework for the execution of applications, which consists of the secure encryption and distribution of confidential application binary files, and the runtime techniques to load, decrypt, and protect the program logic by isolating them from tenant virtual machines based on hypervisor-level techniques. We evaluate applications in several software categories which are commonly offered in cloud marketplaces showing that strong confidential execution can be provided with only marginal changes (around 100-220 lines of code) and minimal performance overhead. The results demonstrate the effectiveness and practicality of CAFE in cloud marketplaces.

Authentication as a Service (AaaS) provides on-demand delivery of multi-factor authentication (MFA). However, current AaaS has left out of consideration the trustworthiness of user inputs at client evices and the risk of privacy exposure at the AaaS providers. To solve these concerns, we present TAaaS, Trustworthy Authentication as a Service, which offers a trusted path-based MFA service to the service provider in the cloud. TAaaS leverages the hypervisor-based trusted path to ensure the trustworthiness of user inputs, and addresses privacy concerns in the cloud by storing only the irreversible user account information. We implement two end-to-end prototypes and evaluate our work to show its feasibility and security.

Intel Software Guard Extensions (SGX) can address the information disclosure in cloud computing. However, the existing virtual machine managers do not provide the efficient management operations of the SGX-enabled virtual machines (VMs) like live migration. In this paper, we identify challenges and propose a novel approach and its implementation model to migrate the SGX-enabled VMs. As future work, we will design the protocol and new instructions for live migration of the SGX-enabled VMs, and implement them on top of OpenSGX, an open source SGX emulator.

Cloud application marketplaces of modern cloud infrastructures offer a new software deployment model, integrated with the cloud environment in its configuration and policies. However, similar to traditional software distribution which has been suffering from software piracy and reverse engineering, cloud marketplaces face the same challenges that can deter the success of the evolving ecosystem of cloud software. We present a novel system named CAFE for cloud infrastructures where sensitive software logic can be executed with high secrecy protected from any piracy or reverse engineering attempts in a virtual machine even when its operating system kernel is compromised. The key mechanism is the end-to-end framework for the execution of applications, which consists of the secure encryption and distribution of confidential application binary files, and the runtime techniques to load, decrypt, and protect the program logic by isolating them from tenant virtual machines based on hypervisor-level techniques. We evaluate applications in several software categories which are commonly offered in cloud marketplaces showing that strong confidential execution can be provided with only marginal changes (around 100-220 lines of code) and minimal performance overhead.

This work addresses the data balancing problem of the existing neural network based speaker verification methods, and proposes new method using modular neural network. In this method, each expert network is trained with the balanced number of genuine speaker data and imposter speaker data. In our experiments, we obtained high performance results for the unknown imposter speakers. High performance and the modular nature of the proposed method enables building a large scalable speaker verification system.