Cloud computing refers to leveraging remote computing and data storageresources managed by a service provider (the "cloud operator") that istypically distinct from the customer leveraging those resources overthe Internet (the "cloud tenant").  Because clouds enable tenants topay for services based on use and so free tenants from building andmanaging their own datacenters, cloud computing has increasinglybecome a cornerstone of enterprise computing deployments over the pastdecade.

The premise of this project was that the shift to cloud computingoffers an opportunity to usher in a much-needed era of improvedinformation security.  Our research vision deviated from the prevalentcloud research agendas of the time, which focused on helping tenantsto both understand and then preempt new vulnerabilities that arise inmoving to a cloud that is oblivious to its tenants’ plights at bestand openly hostile to them at worst.  Instead we sought to exploit theopportunities inherent in leveraging cloud providers as trustedpartners to improve tenant security. In taking this perspective, weshowed that tenant security, like performance, cost, and scalability,can benefit from the key trends underlying the shift to cloudcomputing, such as the aggregation of services into cloud providersand the resultant economies of scale.

Concretely, we pursued research in three areas to support this vision,namely leveraging trust in cloud providers to help tenants managetheir client populations, their outsourced infrastructure, and theirdependencies on other tenants.  

- CLIENT POPULATIONS: A substantial fraction of the effort of runningan application service is consumed by addressing the risks posed byuntrusted clients.  These risks include client account takeovers,denial-of-service attacks, and exploit attempts on the server itself.We developed numerous technologies that leverage the cloud’s massiveresources, elastic scaling capabilities, and centralization to helptenant services defend against these risks.  For example, we developeda cloud-resident framework by which tenant sites can coordinate toensure that no end user is permitted to reuse the same or similarpasswords across these websites.  In doing so, this framework couldlargely break the culture of password reuse on the web today, which isthe dominant cause of account takeovers.  Moreover, this frameworkdoes not require disclosing a user's password at one website, or eventhe existence of her account at that website, to other sites.

- OUTSOURCED INFRASTRUCTURE: Numerous organizations outsource portionsof their own IT infrastructure to clouds, even if only to serveintra-organization purposes while achieving the cost savingsassociated with cloud computing.  We developed a number of mechanismsby which cloud operators could assist tenants in managing the securityof their outsourced infrastructure.  For example, we developed asystem called DynIRIS to leverage the cloud to detect subtle dataexfiltration from enterprises.  DynIRIS predicts attack pathways andthen instruments suspicious hosts with deep inspection (e.g., trackingreads from sensitive files into memory) as needed to detect dataexfiltration.  To mitigate performance impact of deep instrumentation,DynIRIS leverages other infrastructure developed within the project todynamically migrate hosts on which deep instrumentation is required tomore powerful servers.

- DEPENDENCIES ON OTHER TENANTS: We showed that new cloud services canhelp to mediate secure interactions among tenants, and further enabletenants to offer secure foundational services and application servicesto one another, even without a priori trust between them.  Forexample, we designed a fully extensible, general layered attestationarchitecture called Latte for the multi-tenant cloud.  Clients canverify that cloud services deployed in Latte are running code builtfrom specified source repositories. We implemented Latte in Kubernetes, Docker and Spark to demonstrate how Latte can be used to improve crosstenant trust with attestation, such as to allow restricted use ofprivate data.

In addition to the technologies outlined above, the project ran a Cloud Security Horizons Summit in years 1, 3, and 5.  This summitbrought the research team together with industry stakeholders,specifically representatives from among cloud operators, software andhardware companies providing cloud-computing infrastructure, and majorcloud tenants.  The meetings exposed these stakeholders to theproject's research outcomes, gathered feedback from these stakeholderson the team's future research plans, and informed the research team ofongoing security challenges faced by cloud operators and tenants.

Another component of this project was a curriculum developmentworkshop that the researchers organized in years 2-5.  Each workshophosted instructors from approximately a dozen non-R1 post-secondaryinstitutions in the US at UNC-Chapel Hill for 2.5 days.  The purposeof the workshop was to help these instructors incorporate coverage ofcloud security topics in their existing course offerings, and includedcreation of lecture materials, presentations on cloud testbeds forconducting course projects, discussion of course project ideas, and anorganized tour of a cloud-computing facility at IBM or NetApp.

Last Modified: 01/06/2020
Modified by: Michael M Swift