Proceedings of the 2021 on Cloud Computing Security Workshop最新文献

Proceedings of the 2021 on Cloud Computing Security Workshop 2021云计算安全研讨会论文集

Proceedings of the 2021 on Cloud Computing Security Workshop Pub Date : 2021-11-15 DOI: 10.1145/3474123

引用次数: 0

Secure Featurization and Applications to Secure Phishing Detection 安全特性及其在安全网络钓鱼检测中的应用

Proceedings of the 2021 on Cloud Computing Security Workshop Pub Date : 2021-11-15 DOI: 10.1145/3474123.3486759

Akash Shah, Nishanth Chandran, Mesfin Dema, Divya Gupta, A. Gururajan, Huang Yu

引用次数: 3

Live Migration of Operating System Containers in Encrypted Virtual Machines 加密虚拟机中操作系统容器的热迁移

Proceedings of the 2021 on Cloud Computing Security Workshop Pub Date : 2021-11-15 DOI: 10.1145/3474123.3486761

Joana Pecholt, Monika Huber, Sascha Wessel

{"title":"Live Migration of Operating System Containers in Encrypted Virtual Machines","authors":"Joana Pecholt, Monika Huber, Sascha Wessel","doi":"10.1145/3474123.3486761","DOIUrl":"https://doi.org/10.1145/3474123.3486761","url":null,"abstract":"With the widespread use of Docker and Kubernetes, OS-level virtualization has become a key technology to deploy and run software. At the same time, data centers and cloud providers offer shared computing resources on demand. The use of these resources usually leads to a larger trusted computing base and less control over the data. We present a confidential computing concept for the migration of operating system containers in secure encrypted virtual machines so that these are protected from the operator and administrator. In our approach, processes inside of the containers remain intact, i.e., they keep their state and do not have to be restarted. Network services inside of the containers remain unchanged and reachable. This is typically called live migration. Integrity and confidentiality of the data inside of the containers is enforced during migration as well as on the destination platform, namely in transit, in use and at rest. The authenticity and integrity of the destination platform is verified using remote attestation before any data is transferred. While our core concept is not specific to a particular hardware, we present two different approaches corresponding to the first generation of AMD SEV as well as SEV-SNP. Our proof of concept implementation is based on the first generation of SEV.","PeriodicalId":109533,"journal":{"name":"Proceedings of the 2021 on Cloud Computing Security Workshop","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122617622","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Programmable Security in the Age of Software-Defined Infrastructure 软件定义基础设施时代的可编程安全性

Proceedings of the 2021 on Cloud Computing Security Workshop Pub Date : 2021-11-15 DOI: 10.1145/3474123.3486765

G. Gu

引用次数: 0

Security in a Cloud Bazaar 云集市中的安全性

Proceedings of the 2021 on Cloud Computing Security Workshop Pub Date : 2021-11-15 DOI: 10.1145/3474123.3486791

O. Krieger

{"title":"Security in a Cloud Bazaar","authors":"O. Krieger","doi":"10.1145/3474123.3486791","DOIUrl":"https://doi.org/10.1145/3474123.3486791","url":null,"abstract":"While cloud computing is transforming society, today's public clouds are black boxes, implemented and operated by a single provider that makes all business and technology decisions. In 2013 we launched the Mass Open Cloud (MOC) with the vision of creating a production cloud that would enable innovation by a broad industry and research community. This open cloud has become a laboratory for cloud research and innovation, resulting in hundreds of publications, contributions to open source software, and collaborations between researchers, open source developers, and production operations staff. Recently we launched the Open Research Cloud Initiative (ORCI) to provide a framework to coordinate the bazaar of interrelated projects and initiatives that have evolved since 2013, including the Red Hat Collaboratory@BU, Open Cloud Testbed (OCT), New England Research Cloud (NERC), Northeast Storage Exchange (NESE), Operate First, and OpenInfra Labs. With its launch, the MOC inspired and enabled research in cloud security. For example, the Modular Approach to Cloud Security (MACS) SaTC NSF frontier project, launched in 2014, brought together cryptographers, operating system, database and computer architecture researchers from BU, MIT, UConn and NEU. This security research resulted in new open-source software and products that are today enabling new services in the ORCI bazaar. This talk will discuss the ORCI cloud bazaar, some of the security research and projects it inspired, and some exciting new collaborations happening now to make the cloud both open and secure.","PeriodicalId":109533,"journal":{"name":"Proceedings of the 2021 on Cloud Computing Security Workshop","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133229342","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

m-Stability: Threshold Security Meets Transferable Utility m-稳定性:阈值安全性满足可转移效用

Proceedings of the 2021 on Cloud Computing Security Workshop Pub Date : 2021-11-15 DOI: 10.1145/3474123.3486758

O. Biçer, B. Yildiz, Alptekin Küpçü

{"title":"m-Stability: Threshold Security Meets Transferable Utility","authors":"O. Biçer, B. Yildiz, Alptekin Küpçü","doi":"10.1145/3474123.3486758","DOIUrl":"https://doi.org/10.1145/3474123.3486758","url":null,"abstract":"Use of game theory and mechanism design in cloud security is a well-studied topic. When applicable, it has the advantages of being efficient and simple compared to cryptography alone. Most analyses consider two-party settings, or multi-party settings where coalitions are not allowed. However, many cloud security problems that we face are in the multi-party setting and the involved parties can almost freely collaborate with each other. To formalize the study of disincentivizing coalitions from deviating strategies, a well-known definition named k-resiliency has been proposed by Abraham et al. (ACM PODC '06). Since its proposal, k-resiliency and related definitions are used extensively for mechanism design. However, in this work we observe the shortcoming of k-resiliency. That is, although this definition is secure, it is too strict to use for many cases and rule out secure mechanisms as insecure. To overcome this issue, we propose a new definition named ℓ-repellence against the presence of a single coalition to replace k-resiliency. Our definition incorporates transferable utility in game theory as it is realistic in many distributed and multi-party computing settings. We also propose m-stability definition against the presence of multiple coalitions, which is inspired by threshold security in cryptography. We then show the advantages of our novel definitions on three mechanisms, none of which were previously analyzed against coalitions: incentivized cloud computation, forwarding data packages in ad hoc networks, and connectivity in ad hoc networks. Regarding the former, our concepts improve the proposal by Küpçü (IEEE TDSC '17), by ensuring a coalition-proof mechanism.","PeriodicalId":109533,"journal":{"name":"Proceedings of the 2021 on Cloud Computing Security Workshop","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123379313","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

ACCO: Algebraic Computation with Comparison ACCO:代数计算与比较

Proceedings of the 2021 on Cloud Computing Security Workshop Pub Date : 2021-11-15 DOI: 10.1145/3474123.3486757

Xiaoqin Duan, Vipul Goyal, Hanjun Li, R. Ostrovsky, Antigoni Polychroniadou, Yifan Song

引用次数: 1

ROSEN: RObust and SElective Non-repudiation (for TLS) 稳健和选择性不可抵赖性(TLS)

Proceedings of the 2021 on Cloud Computing Security Workshop Pub Date : 2021-11-15 DOI: 10.1145/3474123.3486763

Srdjan Capkun, Ercan Ozturk, Gene Tsudik, Karl Wüst

引用次数: 9

Privacy-enhanced OptiSwap Privacy-enhanced OptiSwap

Proceedings of the 2021 on Cloud Computing Security Workshop Pub Date : 2021-11-15 DOI: 10.1145/3474123.3486756

S. Avizheh, Preston Haffey, R. Safavi-Naini

{"title":"Privacy-enhanced OptiSwap","authors":"S. Avizheh, Preston Haffey, R. Safavi-Naini","doi":"10.1145/3474123.3486756","DOIUrl":"https://doi.org/10.1145/3474123.3486756","url":null,"abstract":"Fair Exchange is a fundamental problem in the exchange of digital items with direct application to electronic commerce. In a fair exchange protocol, two parties want to exchange their corresponding items such that either both receive the other's item, or neither of them receives anything. It has been shown that fair exchange without a trusted third party (TTP) is not possible. Optimistic fair exchange protocols limit the role of TTP to the case that one of the parties misbehaves. OptiSwap (Eckey et al., 2020) is a fair exchange protocol for the exchange of confidential digital items with digital coins. OptiSwap uses a smart contract as the TTP and allows the buyer to use an interactive dispute resolution protocol with the seller (mediated through smart contract) to generate a proof of misbehaviour for a misbehaving seller. We show that OptiSwap's dispute resolution protocol leaks information about the item to the smart contract (public) which can completely reveal the item to the public, and this provides an opportunity for a malicious buyer to pose a credible threat to the fairness guarantee of the system. We propose and design privacy-enhanced OptiSwap that prevents the leakage of information and guarantees security and fairness of the exchange without significantly affecting the efficiency of the protocol. We prove security of the new protocol in an extension of the universal composability for non-monolithic adversaries, and implement and evaluate its efficiency against the original OptiSwap. We discuss our results and suggest directions for future research.","PeriodicalId":109533,"journal":{"name":"Proceedings of the 2021 on Cloud Computing Security Workshop","volume":"478 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133398413","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Data Sovereignty in the Cloud - Wishful Thinking or Reality? 云中的数据主权——一厢情愿还是现实?

Proceedings of the 2021 on Cloud Computing Security Workshop Pub Date : 2021-11-15 DOI: 10.1145/3474123.3486792

Christian Banse

{"title":"Data Sovereignty in the Cloud - Wishful Thinking or Reality?","authors":"Christian Banse","doi":"10.1145/3474123.3486792","DOIUrl":"https://doi.org/10.1145/3474123.3486792","url":null,"abstract":"The idea of data sovereignty has been at the core of various research activities over the last years, especially in Europe. The topic gained additional traction through various regulations and initiatives such as the EU General Data Protection Regulation (GDPR), the European Cybersecurity Certification Scheme for Cloud Services (EUCS) and lastly, Gaia-X. While asserting digital control over your data is relatively easy in a closed ecosystem, such as your own on-premises or a community data space, it is infinitely more challenging in a public open ecosystem, such as the Cloud. On one hand, recent advantages in the field of confidential computing, such as the introduction of secure enclaves and encrypted virtual machine memory are promising new ways to enforce data sovereignty even in Cloud infrastructures. On the other hand, the mere existence of these techniques does not ensure an overall secure system, demonstrated by various flaws found in confidential computing techniques themselves, such as AMD SEV. So, the question remains if data sovereignty in the cloud is already reality or still wishful thinking? Keeping the requirements from initiatives such as Gaia-X and the EUCS in mind, this talk will explore what it means to achieve data sovereignty and security in the Cloud. It is important to understand, that it is not only necessary to implement appropriate security measures, but also (continuously) demonstrate the effectiveness of them. Therefore, this talk will show an overview of different technical means to leverage confidential computing for data sovereignty in the Cloud, especially using remote attestation and integrity verification. Furthermore, it will explore techniques to demonstrate the effectiveness of these measures with regards to regulation compliance. One such example is the MEDINA framework, which aims to continuously verify the requirements of EUCS and Gaia-X, both on the infrastructure as well as the application level in cloud systems.","PeriodicalId":109533,"journal":{"name":"Proceedings of the 2021 on Cloud Computing Security Workshop","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130440906","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1