Sticky Policy Based Open Source Security APIs for the Cloud

The Internet and telephone are successful because they use open protocols and open interfaces, allowing users to communicate, innovate and share at will. We propose to facilitate this process in cloud computing, by developing a set of open security services, protocols and interfaces (APIs) that will allow cloud resource owners to be able to specify their policies for fine grained access control to their cloud resources, and have these enforced everywhere at all times, regardless of the subsequent location or data processing that has ensued. The ability to securely share data with anyone, anywhere, at any time, will facilitate spontaneous collaborations and ensure confidence in collaborative working. This will be achieved by using "sticky policies", delegation of authority, federated access and attribute based access controls. Sticky policies are policies which are cryptographically linked or "stuck" to the data and meta-data they control, so that access to the data is only granted if the policy is honoured. In order to cater for Internet scale cloud usage, federated access and attribute based access controls are needed. Federated access allows users to identify themselves to a cloud service using their existing credentials, without having to first obtain new ones from the cloud service itself. Attribute based access controls allows access to be specified based on a user's identity attributes rather than simply an identifier, which is typically used today. In order to achieve Internet scale in identifying users and data resources, an ontology is needed that will classify both the data and the users who wish to access it. The authorities who issue identity attributes will also need to be classified. The characteristics of any particular set of data will be held in meta-data that describes or identifies the data, and conforms to the ontology. The meta-data itself will be stuck to the data in a similar way to the sticky policy.

When data is merged or fused with other data, or is split, filtered or reduced, then its meta-data will need to change accordingly, in order to describe the new data. Similarly the sticky policy that controls access to the new data will need to be derived from the original sticky policy(ies). This project will develop a new algebra and algorithms for deriving the new sticky policy from the old, using the ontology and meta-data as a guide. (Note that this project will not be performing the actual data merging or splitting, but simply assumes that trustworthy services are available to do this.)

The protocols and APIs specified in this project will be standardised through an organisation already well versed in cloud APIs, such as the Open Grid Forum or OASIS.

In order to ensure the widest take up of the services and APIs specified in this project, pilot implementations will be developed in Python and distributed as part of the OpenStack suite of software. OpenStack is a community project involving over 135 organisations, ranging from multi-nationals such as HP, Cisco and Intel, to specialist SMEs such as Cloudscaling. This project proposes to harness the energies of the OpenStack community by acting in a leading role to facilitate others in contributing to the development effort.

Because this research is developing open source application independent security services and APIs for the cloud, then literally anyone who wishes to use the cloud for the secure transfer, storage and processing of data will benefit from this research. The impact can therefore be huge, both in the spread of cloud users who can benefit, and in the number of beneficiaries.

In our previous project, My Private Cloud, we already successfully demonstrated federated access to, and fine grained delegation of access rights from a cloud resource owner to his cloud resources stored in a Eucalyptus S3 service. This application independent implementation does not restrict the type of resources that can be uploaded to the cloud (as files), nor the types of users who can be granted access to them. So the beneficiaries are anyone who wants to store his data in the cloud, and securely share it with others. In the same way, this new project will be data agnostic and thus applicable to a very wide range of user communities who wish to apply sticky policies to their data sets, and have their policies continually enforced regardless of the subsequent processing and transfer of their data around the cloud. By implementing all the APIs in OpenStack, we maximise the potential user base and corresponding impact.

Typical beneficiaries include anyone who has large data sets that will be processed and transferred around a cloud (or clouds) and wants to have confidence that their access control policies will continue to be enforced. Medical data (EHR) immediately springs to mind as a major beneficiary of this research, since moving medical data to public or private clouds should significantly reduce the cost of data ownership to the NHS. But a major worry is that the privacy of patients might be seriously compromised if their data is mistakenly or maliciously released to unauthorised users. Ensuring the cloud system supports and enforces sticky policies, which prevent unauthorised access to medical data, is one way of overcoming this hurdle.

Academics and researchers who wish to store, process and restrictively share their research data in the cloud will similarly benefit. The MoD which processes huge amounts of logistics information, especially in times of conflict, will also benefit from the secure sharing of this data both between divisions and with their allies. But supermarkets and other retail outlets can similarly benefit from the secure storage and processing of their data. Security services that record large amounts of personal data about suspects, their locations, movements, contacts etc. will similarly benefit from being able to share this data securely and confidentially between others in the security services who have a need to know. These are just a few of the many examples that can used to illustrate the benefits of sticky policy based open source security APIs for the cloud.