The heterogeneity of cloud computing platforms hinders the proper exploitation of cloud technologies since it prevents interoperability, promotes vendor lock-in and makes it very difficult to exploit the well-engineered security mechanisms made available by cloud providers. In this paper, we introduce a technique to help developers to specify and enforce access control policies in cloud applications. The main idea is twofold. First, use a high-level specification language with a formal semantics that allows to answer access requests abstracting from an access control mechanism available in a particular cloud platform. Second, exploit an automated translation mechanism to compute (equivalent) policies that can be enforced in two of the most widely used cloud platforms: AWS and Openstack.We illustrate the technique on a running example and report our experience with a prototype implementation.
Assisted authoring, analysis and enforcement of access control policies in the cloud / Morelli, U.; Ranise, S.. - 502:(2017), pp. 296-309. (Intervento presentato al convegno 32nd International Conference on ICT Systems Security and Privacy Protection, IFIP SEC 2017 tenutosi a ita nel 2017) [10.1007/978-3-319-58469-0_20].
Assisted authoring, analysis and enforcement of access control policies in the cloud
Ranise S.
2017-01-01
Abstract
The heterogeneity of cloud computing platforms hinders the proper exploitation of cloud technologies since it prevents interoperability, promotes vendor lock-in and makes it very difficult to exploit the well-engineered security mechanisms made available by cloud providers. In this paper, we introduce a technique to help developers to specify and enforce access control policies in cloud applications. The main idea is twofold. First, use a high-level specification language with a formal semantics that allows to answer access requests abstracting from an access control mechanism available in a particular cloud platform. Second, exploit an automated translation mechanism to compute (equivalent) policies that can be enforced in two of the most widely used cloud platforms: AWS and Openstack.We illustrate the technique on a running example and report our experience with a prototype implementation.I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione