IFCaaS: Information Flow Control as a Service for Cloud Security

Elsayed, Marwa; Zulkernine, Mohammad

doi:10.1109/ares.2016.27

Cited by 11 publications

(6 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Some approaches use information-flow security to address problems that are complementary to our techniques, for example, checking the correct labelling of software or monitoring inputs and storage accesses by the applications. Elsayed and Zulkernine [38] propose a framework to deliver Information-Flow-Control-as-a-Service (IFCaaS) in order to protect the confidentiality and integrity of the information flow in a Software-as-a-Service application. The framework works as a trusted party that creates a call graph of an application from the source code and applies information-flow security based on dependence graphs to detect violations of the non-interference policy.…”

Section: Information-flow Securitymentioning

confidence: 99%

Secure Partitioning of Cloud Applications, with Cost Look-Ahead

et al. 2023

View full text Add to dashboard Cite

The security of Cloud applications is a major concern for application developers and operators. Protecting users’ data confidentiality requires methods to avoid leakage from vulnerable software and unreliable Cloud providers. Recently, trusted execution environments (TEEs) emerged in Cloud settings to isolate applications from the privileged access of Cloud providers. Such hardware-based technologies exploit separation kernels, which aim at safely isolating the software components of applications. In this article, we propose a methodology to determine safe partitionings of Cloud applications to be deployed on TEEs. Through a probabilistic cost model, we enable application operators to select the best trade-off partitioning in terms of future re-partitioning costs and the number of domains. To the best of our knowledge, no previous proposal exists addressing such a problem. We exploit information-flow security techniques to protect the data confidentiality of applications by relying on declarative methods to model applications and their data flow. The proposed solution is assessed by executing a proof-of-concept implementation that shows the relationship among the future partitioning costs, number of domains and execution times.

show abstract

Section: Information-flow Securitymentioning

confidence: 99%

Secure Partitioning of Cloud Applications, with Cost Look-Ahead

et al. 2023

View full text Add to dashboard Cite

show abstract

“…The authors of [12] proposed a twolayer information flow control model for the cloud environment, designed and implemented a prototype system, that can provide cloud tenants with information flow tracking and control as a service, and proposed a protection mechanism for common system attacks such as stack overflow and buffer overflow. To overcome the loss of control of sensitive data manipulated by applications in the SaaS cloud environment and the lack of security enforcement measures, the authors of [13] proposed an information flow as a service (IFCaaS) framework, which uses information flow control as a security verification method for SaaS layer applications. In [14], by analyzing the behavior of entities and linking them with trust levels and security classes, security attributes were dynamically formulated, thereby enhancing information flow control to ensure the security attributes of tenants and organizations.…”

Section: Related Work a Access Control And Information Flow Controlmentioning

confidence: 99%

Tenant-Led Ciphertext Information Flow Control for Cloud Virtual Machines

Zhang

Yang

et al. 2021

IEEE Access

View full text Add to dashboard Cite

When users upload their private data to the cloud, they lose control of the data stored in the cloud server. If the cloud system cannot provide an effective security mechanism to protect the data, the consequent data leakage issue will hinder the development of cloud computing. Conventional access control and encryption technologies cannot effectively control the propagation of tenant private data in the system. The mandatory one-way information flow control model is limited by the complexity of the cloud environment, and it is difficult to effectively protect private data stored in the cloud. To solve the above problems, this article proposes a tenant-led ciphertext information flow control method for cloud virtual machines. Through the design of a decentralized information flow control security policy, a secret-domain key management scheme, and a multi-ID-based threshold encryption scheme, the information flow control strategies of taint infection, secret-level reduction, and ability propagation are realized in a ciphertext form, which can effectively prevent malicious users inside and outside the system from illegally reading private data. The feasibility of this method is verified by a security proof and an experiment.INDEX TERMS Cloud computing, information flow control, information flow encryption, data protection.

show abstract

“…The result publisher component refines and reports the analysis results to the cloud provider and tenant. Based on the results, it decides if a security certificate should be granted to the candidate application, which is sent to both the cloud provider and tenant [38] (Fig. 2).…”

Section: F Service Level -Cloud Implementationmentioning

confidence: 99%

Information Flow Control for Serverless Systems

Chawla¹

2021

IJACSA

View full text Add to dashboard Cite

Security for Serverless Systems is looked at from two perspectives, the server-level security managed by the infrastructure company and the Application level Security managed by the tenants.The Trusted computing base for cloud systems is enormous as it encompasses all the functions running on a system. Authentication for systems is mostly done using ACL. Most Serverless Systems share data and thus, ACL isn't sufficient. IFC using appropriate label design can enforce continuously throughout the application. IFC can be used to increase confidence between functions with other functions and cloud provider and also mitigate security vulnerabilities making the system safer. A survey of the present IFC implementations for Serverless Systems is presented and system designs which are relevant to Serverless Systems and could be added to Serverless Systems Architecture and, an idea of an IFC model that could be effectively applied in a decentralised model like serverless systems.

show abstract

IFCaaS: Information Flow Control as a Service for Cloud Security

Cited by 11 publications

References 12 publications

Secure Partitioning of Cloud Applications, with Cost Look-Ahead

Secure Partitioning of Cloud Applications, with Cost Look-Ahead

Tenant-Led Ciphertext Information Flow Control for Cloud Virtual Machines

Information Flow Control for Serverless Systems

Contact Info

Product

Resources

About