CSR: Medium: Security and Isolation in the Era of Microservices

几年前，新闻、电子商务或银行网站等应用程序运行在拥有这些应用程序的组织部署的计算机上。如今，随着云计算的到来，这些应用程序转而运行在由第三方运营的遥远的服务器群中。由于计算机由许多应用程序共享，因此确保云中的一个应用程序(例如新闻网站)不会危及在同一组计算机上运行的另一个应用程序(例如银行网站)的机密性或完整性是至关重要的。该项目的目标是开发能够确保云应用程序得到适当保护的系统，而不会牺牲它们的性能和扩展/收缩能力。这一目标将通过开发两个核心构建块来实现，以实现隔离和性能/敏捷性之间的最佳平衡。第一种是变量隔离，我们自动确定应用程序组件所需的最低权限和最佳隔离技术，并在最需要(最少)的地方部署最高(最弱)的隔离。第二种是隔离感知复制，租户有选择地在隔离程度更高的沙箱中复制他们的计算和存储。最后，该项目将为基于微服务的应用的正确分布式执行开发新的编程模型。如果研究成功，将提高基于云的应用的性能和安全态势。该项目的研究成果，包括实验线束和数据集，将开放源代码发布，使研究和行业中的其他人能够直接建立在这些成果的基础上。该项目将导致开发专注于微服务、lambda式计算和隔离的新课程和新兵训练营。课程/新兵训练营材料将公之于众。该项目旨在将这项研究整合到针对女性、代表性不足的少数民族、非传统学生和高中生的外联工作中。该项目及其研究成果将在https://bitbucket.org/uw-madison-networking-research/isolation.托管该网站将包括研究出版物、软件、数据集、演示文稿和教程。该网站将在整个项目期间和项目结束后的2-3年内保持最新。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Years ago, applications such as news, e-commerce, or banking websites ran on computers deployed at organizations owning them. Today, with the advent of "cloud computing", such applications instead run in a far-away server farm operated by third-parties. Because the computers are shared by many applications, it is crucial to ensure that one application in the cloud, such as a news website, does not compromise the confidentiality or integrity of another application (e.g., a banking website) running on the same set of computers. The goal of this project is to develop systems that ensure cloud applications are suitably protected without sacrificing their performance and ability to grow/shrink. This goal will be realized by developing two core building blocks to achieve optimal trade-offs between isolation and performance/agility. The first is variable isolation, where we automatically determine the least privilege and best isolation techniques needed for components of an application, and deploy the highest (weakest) isolation where needed most (least). The second is isolation-aware replication, where tenants selectively replicate their compute and storage within higher-isolation sandboxes. Finally, the project will develop new programming models for correct distributed execution of microservices-based applications.The research, if successful, will improve both the performance and the security posture of cloud-based applications. Research outcomes of the project, including the experimental harnesses and datasets, will be released open-source, enabling others in research and industry to directly build on them. The project will lead to the development of new courses and boot camps that focus on microservices, lambda-style computation, and isolation. The course/boot camp material will be made publicly available. The project aims to integrate the research into outreach efforts aimed at women, under-represented minorities, non-traditional students, and high school students.The project and its research artifacts will be hosted at https://bitbucket.org/uw-madison-networking-research/isolation. This site will include research publications, software, datasets, presentations, and tutorials. This site will be kept up to date for the entire duration of the project and for 2-3 years immediately following the project's culmination.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.