EAGER: Holistic Security for Cloud Computing: Architecture for Modular System and Network Design

也许，广泛采用公共云的最大障碍是对安全的担忧。对复杂的现代信息系统的所有安全方面进行推理是极其困难的。云中的安全问题尤其严重，因为客户必须信任他们无法理解或控制的、与许多其他客户共享的不透明的复杂服务。然而，在今天的公共云中，人们的假设是，可以完全信任云服务提供商提供安全的系统，使其免受任何威胁。公开底层服务安全属性的架构将使研究人员社区能够在实施安全云服务方面进行创新。它还将为客户提供对其使用的服务的安全性的可见性和控制。随着大规模的公共云基础设施得到更广泛的采用，对云安全的信心将带来转型的社会效益。该项目定义了云服务的模块化安全体系结构，其中不同服务的提供商各自公开其服务的安全属性，消费者可以构建符合其应用需求的组合服务，然后对组合服务的安全性进行推理。调查人员扩展现有的云基础设施以支持此架构，并在此架构的背景下探索安全的模块化网络和操作系统技术。

Perhaps the greatest single impediment to the broad adoption of public clouds is concerns about security. Reasoning about all the security aspects of complex modern information systems is enormously difficult. Security is especially problematic in the cloud, where a customer must place their trust in opaque complicated services that they do not understand or control and that are shared with many other customers. Yet, in today's public clouds, the assumption is that providers of cloud services can be fully trusted to provide systems secure against any threat. An architecture that exposes the security properties of the underlying services will enable a community of researchers to innovate in the implementation of secure cloud services. It will also provide customers visibility and control of the security in the services they use. Confidence in the security of the cloud will enable transformational societal benefits as the massive public cloud infrastructure becomes more broadly adopted.This project defines a modular security architecture for cloud services where providers of different services each expose the security properties of their service, and the consumer can construct a compositional service that matches their application requirements and then reason about the security of the compositional service. The investigators extend existing cloud infrastructures to support this architecture, and explore secure modular networking and operating system technologies in the context of this architecture.