Trusted platform-as-a-service: a foundation for trustworthy cloud-hosted applications

ABSTRACT

The applications we use are increasingly packaged as network services running in the cloud under the control of a service provider. Users of these services have no basis to determine if these services are trustworthy, beyond the assurances of the service provider. Our work addresses the problem of how to build support for trustworthy services in the cloud, within the context of a larger trust management framework.

This paper shows how users can gain insights and trust into service applications by leveraging trust in a neutral third party: a cloud provider that hosts application services on an infrastructure and platform that it controls. A trusted cloud provider may act as a root of trust to attest cloud-hosted services to their clients---a trusted platform cloud. We have prototyped this approach in a trusted platform-as-a-service cloud provider supporting a Python/Django web framework. The cloud provider seals instances of service applications and attests their Python source code to external users. Once launched and attested, service instances run with an independent identity and are isolated from tampering by the cloud customer, except through well-defined operator interfaces that are part of the service definition.

References

1. S. Berger, R. Cáceres, K. A. Goldman, R. Perez, R. Sailer, and L. van Doorn. vTPM: virtualizing the trusted platform module. In Proceedings of the 15th USENIX Security Symposium - Volume 15, Aug. 2006.
2. J. Chase, L. Grit, D. Irwin, V. Marupadi, P. Shivam, and A. Yumerefendi. Beyond Virtual Data Centers: Toward an Open Resource Control Architecture. In Selected Papers from the International Conference on the Virtual Computing Initiative (ACM Digital Library), May 2007.
3. P. England, B. Lampson, J. Manferdelli, and B. Willman. A trusted open platform. Computer, 36(7):55 -- 62, July 2003.
4. T. Garfinkel, B. Pfaff, J. Chow, M. Rosenblum, and D. Boneh. Terra: a virtual machine-based platform for trusted computing. In Proceedings of the Nineteenth ACM Symposium on Operating Systems Principles, SOSP '03, pages 193--206, 2003.
5. D. Irwin, J. S. Chase, L. Grit, A. Yumerefendi, D. Becker, and K. G. Yocum. Sharing Networked Resources with Brokered Leases. In Proceedings of the USENIX Technical Conference, June 2006.
6. B. Lampson. Accountability and freedom. In Cambridge Computer Seminar, Cambridge, UK, October 2005.
7. N. Li, J. C. Mitchell, and W. H. Winsborough. Design of a role-based trust-management framework. In Proceedings of the 2002 IEEE Symposium on Security and Privacy, pages 114--130, May 2002.
8. J. M. McCune, B. J. Parno, A. Perrig, M. K. Reiter, and H. Isozaki. Flicker: an execution infrastructure for TCB minimization. In Proceedings of the 3rd ACM SIGOPS/EuroSys European Conference on Computer Systems 2008, Eurosys '08, pages 315--328, New York, NY, USA, 2008. ACM.
9. M. Ryan, T. Faber, J. Wroclawski, and S. Schwab. Attribute-based access control. http://abac.deterlab.net/, 2011. {Online; accessed 22-July-2011}.
10. R. Sailer, X. Zhang, T. Jaeger, and L. van Doorn. Design and implementation of a TCG-based integrity measurement architecture. In Proceedings of the 13th conference on USENIX Security Symposium - Volume 13, SSYM'04, pages 16--16, Berkeley, CA, USA, 2004. USENIX Association.
11. N. Santos, K. P. Gummadi, and R. Rodrigues. Towards trusted cloud computing. In Proceedings of the Workshop on Hot Topics in Cloud Computing, HotCloud'09. USENIX Association, 2009.
12. F. B. Schneider, K. Walsh, and E. G. Sirer. Nexus authorization logic (NAL): Design rationale and applications. ACM Trans. Inf. Syst. Secur., 14:8:1--8:28, June 2011.
13. E. Shi, A. Perrig, and L. V. Doorn. BIND: A fine-grained attestation service for secure distributed systems. In In IEEE Symposium On Security and Privacy, pages 154--168, 2005.
14. K. Thompson. Reflections on trusting trust. Commun. ACM, 27:761--763, August 1984.
15. D. Williams, P. Reynolds, K. Walsh, E. G. Sirer, and F. B. Schneider. Device driver safety through a reference validation mechanism. In Proceedings of the 8th USENIX conference on Operating systems design and implementation, OSDI'08, pages 241--254, Berkeley, CA, USA, 2008. USENIX Association.

Index Terms

• Security and privacy

  • Systems security

    • Operating systems security