EAGER: Holistic Security for Cloud Computing: Architecture for Modular System and Network Design

也许广泛采用公共云的最大障碍是对安全性的担忧。 对复杂的现代信息系统的所有安全方面进行推理是非常困难的。安全性在云中尤其成问题，客户必须信任他们不理解或控制的不透明的复杂服务，这些服务与许多其他客户共享。然而，在当今的公共云中，人们的假设是云服务提供商可以完全信任，以提供针对任何威胁的安全系统。 公开底层服务的安全属性的架构将使研究人员社区能够在安全云服务的实现方面进行创新。 它还将为客户提供对他们使用的服务的安全性的可见性和控制。随着大规模公共云基础设施得到更广泛的采用，对云安全的信心将带来变革性的社会效益。该项目为云服务定义了一个模块化的安全架构，其中不同服务的提供商各自暴露其服务的安全属性，消费者可以构造一个与其应用程序需求相匹配的组合服务，的服务. 研究人员扩展了现有的云基础设施以支持此架构，并在此架构的上下文中探索安全的模块化网络和操作系统技术。

Perhaps the greatest single impediment to the broad adoption of public clouds is concerns about security. Reasoning about all the security aspects of complex modern information systems is enormously difficult. Security is especially problematic in the cloud, where a customer must place their trust in opaque complicated services that they do not understand or control and that are shared with many other customers. Yet, in today's public clouds, the assumption is that providers of cloud services can be fully trusted to provide systems secure against any threat. An architecture that exposes the security properties of the underlying services will enable a community of researchers to innovate in the implementation of secure cloud services. It will also provide customers visibility and control of the security in the services they use. Confidence in the security of the cloud will enable transformational societal benefits as the massive public cloud infrastructure becomes more broadly adopted.This project defines a modular security architecture for cloud services where providers of different services each expose the security properties of their service, and the consumer can construct a compositional service that matches their application requirements and then reason about the security of the compositional service. The investigators extend existing cloud infrastructures to support this architecture, and explore secure modular networking and operating system technologies in the context of this architecture.