CSR: Medium: Security and Isolation in the Era of Microservices

几年前，诸如新闻、电子商务或银行网站之类的应用程序运行在拥有它们的组织部署的计算机上。今天，随着“云计算”的出现，这些应用程序转而在由第三方运营的远程服务器群中运行。由于计算机由许多应用程序共享，因此确保云中的一个应用程序（例如新闻网站）不会危及在同一组计算机上运行的另一个应用程序（例如银行网站）的机密性或完整性至关重要。该项目的目标是开发确保云应用程序得到适当保护而不牺牲其性能和增长/收缩能力的系统。这一目标将通过开发两个核心构建块来实现，以在隔离性和性能/敏捷性之间实现最佳权衡。第一个是变量隔离，我们自动确定应用程序组件所需的最小权限和最佳隔离技术，并在最需要（最少）的地方部署最高（最弱）的隔离。第二种是隔离感知复制，其中租户有选择地在更高隔离的沙箱中复制其计算和存储。最后，该项目将为基于微服务的应用程序的正确分布式执行开发新的编程模型。这项研究如果成功，将提高基于云的应用程序的性能和安全状况。该项目的研究成果，包括实验工具和数据集，将以开源方式发布，使研究和工业界的其他人可以直接在此基础上进行构建。该项目将导致开发专注于微服务、lambda式计算和隔离的新课程和训练营。课程/新兵训练营的材料将向公众提供。该项目旨在将研究纳入针对妇女、代表性不足的少数民族、非传统学生和高中生的推广工作中。该项目及其研究成果将在https://bitbucket.org/uw-madison-networking-research/isolation上发布。该网站将包括研究出版物、软件、数据集、演示文稿和教程。该场地将在整个项目期间以及项目完成后的2-3年内保持最新状态。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Years ago, applications such as news, e-commerce, or banking websites ran on computers deployed at organizations owning them. Today, with the advent of "cloud computing", such applications instead run in a far-away server farm operated by third-parties. Because the computers are shared by many applications, it is crucial to ensure that one application in the cloud, such as a news website, does not compromise the confidentiality or integrity of another application (e.g., a banking website) running on the same set of computers. The goal of this project is to develop systems that ensure cloud applications are suitably protected without sacrificing their performance and ability to grow/shrink. This goal will be realized by developing two core building blocks to achieve optimal trade-offs between isolation and performance/agility. The first is variable isolation, where we automatically determine the least privilege and best isolation techniques needed for components of an application, and deploy the highest (weakest) isolation where needed most (least). The second is isolation-aware replication, where tenants selectively replicate their compute and storage within higher-isolation sandboxes. Finally, the project will develop new programming models for correct distributed execution of microservices-based applications.The research, if successful, will improve both the performance and the security posture of cloud-based applications. Research outcomes of the project, including the experimental harnesses and datasets, will be released open-source, enabling others in research and industry to directly build on them. The project will lead to the development of new courses and boot camps that focus on microservices, lambda-style computation, and isolation. The course/boot camp material will be made publicly available. The project aims to integrate the research into outreach efforts aimed at women, under-represented minorities, non-traditional students, and high school students.The project and its research artifacts will be hosted at https://bitbucket.org/uw-madison-networking-research/isolation. This site will include research publications, software, datasets, presentations, and tutorials. This site will be kept up to date for the entire duration of the project and for 2-3 years immediately following the project's culmination.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.