Protected Execution in Cloud Environments (PECE)

ABSTRACT:As mission-based applications are deployed in the cloud, they are subject to resource constraints and environmental factors that drive their migration from instance to instance, possibly resulting in deployment on common hardware that may or may not be subverted or be hosting insecure applications.Existing cloud security services such as firewalls, anti-exfiltration services, and malware/virus protection are reactive in nature and do not adequately address adversaries that may have already subverted the cloud infrastructure and may be in a position to exfiltrate data-at-rest or in-transit or reverse engineering applications on virtual machines (VMs) deployed or migrated to that area of the cloud.This project, Application Protected Execution (APEx), is prototyping a suite of security services to address these challenges through multiple layers of defense for cloud infrastructure. These services include the startup and monitoring of secure out-of-band memory areas for each VM, the use of obfuscated IO services that protect data-in-transit, the use of encrypted file systems to protect data-at-rest and services that provide application obfuscation to thwart reverse engineering attempts.The APEx prototype builds on a successful proof-of-concept implementation of APEx services that have been shown to be robust against attacks while experiencing little impact in application performance.BENEFIT:The anticipated benefits of the APEx SaaS solution are that it provides layered defense services that thwart data exfiltration and reverse engineering attempts by adversaries that gain access to the cloud infrastructure. As such it provides robust security against attempts made by external hackers who break into the infrastructure through networks, malicious insiders with physical access to the infrastructure, or other adversaries that may gain access to malware or supply chain-based back doors. The APEx prototype is anticipated to be resilient against over 99.5% over attacks while impacting run-time performance of applications by no more than 10%.Commercially, the APEx will be provided as a Software as a Service solution to available to both consumers of cloud infrastructure and Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) providers. Consumers will be able to buy a downloadable subscription to APEx for use on their VMs. Likewise, our plan is to also work with IaaS and PaaS infrastructure providers to license our software to them for use by their user base when standing up their environments on the cloud. In pursuit of these endeavors, RAM Laboratories has started working with IBM and their SoftLayer cloud solution to assist us in testing, benchmarking, transitioning and eventually distributing APEx for use in their cloud offerings.