Enforcing End-to-End Application Security in the Cloud

Abstract

Security engineering must be integrated with all stages of application specification and development to be effective. Doing this properly is increasingly critical as organisations rush to offload their software services to cloud providers. Service-level agreements (SLAs) with these providers currently focus on performance-oriented parameters, which runs the risk of exacerbating an impedance mismatch with the security middleware. Not only do we want cloud providers to isolate each of their clients from others, we also want to have means to isolate components and users within each client's application. We propose a principled approach to designing and deploying end-toend secure, distributed software by means of thorough, relentless tagging of the security meaning of data, analogous to what is already done for data types. The aim is to guarantee that-above a small trusted code base-data cannot be leaked by buggy or malicious software components. This is crucial for cloud infrastructures, in which the stored data and hosted services all have different owners whose interests are not aligned (and may even be in competition). We have developed data tagging schemes and enforcement techniques that can help form the aforementioned trusted code base. Our big idea-cloud-hosted services that have end-to-end information flow control-preempts worries about security and privacy violations retarding the evolution of large-scale cloud computing.

A Secured Hybrid Cloud Architecture for mHealth Care

“…Role Based Access Control (RBAC) is a scheme that restricts unauthorized users to access a system. It offers a satisfactory level of safety & security for authorized mHealth users who accessing EHR system resources & medical records through a set of rules & policies put into effect for patients, doctors or any other personnel in the form of login & password [26]. In [27] Yu-Yi Chen et al proposed an EHR sharing and integration system in healthcare clouds and analyze the arising security and privacy issues in access and management of EHRs.…”

Amusa

“…Next to access control, policies have been applied for a large variety of goals in the domain of middleware. Amongst others, Bacon et al [4] employ policies for information flow control in multidomain applications, Wun and Jacobson [25] for managing content-based publish/subscribe middleware and Kumar et al [15] for describing self-management behavior. The common denominator of all this work is that policies are used to separate semantics from enforcement and describe the semantics declaratively.…”

A Novel Approach for Handling Security in Cloud Computing Services

“…Secure operation requires that applications [14] and services be capable of supporting a variety of security functionality, such as authentication, authorization, credential conversion, auditing, and delegation. Interaction between services requires having a range of security requirements and mechanisms.…”