Protected Execution in Cloud Environments (PECE)

ABSTRACT: As the Air Force migrates their mission-based applications to the cloud, those applications are subject to attacks against the cloud instances on which they reside. Applications are subject to resource constraints and environmental factors that cause applications to migrate from instance to instance, or to simultaneously be deployed with other, potentially insecure applications, on common hardware that may or may not be subverted. To address these risks, we propose the development of Application Protected Execution (APEx), a mechanism that ensures protected execution of software in the cloud. APEx provides lightweight, effective, and scalable measures of rendering information useless to an outside observer when it has been ex-filtrated by malicious hardware or software; while at the same time preserving communication over the network by authorized applications on the appliance. APEx provides an"obfuscation interface"between system resources and mission applications that obfuscates data in RAM and in the file-system for the cloud instance for each protected application. This process is performed on a per-application basis. APEx also provides each such application with an exclusive"unscrambled"view of its own data. It does the same for all applications in a pre-specified group in accordance with predetermined group policy and/or access controls. BENEFIT: This effort develops an Application Protected Execution environment for users of cloud computing platforms. For each cloud instance, APEx thwarts the exfiltration of data for applications residing on subverted infrastructure at public data centers using hardware of uncertain origins by obfuscating the application and its data. In this particular case, RAM Laboratories will work with providers of Infrastructure as a Service (IaaS) and especially Platform as a Service (PaaS) cloud solutions to provide APEx as a subscription plug-in that protects critical applications of their customers. APEx can work in concert with existing group policies and access controls being used for the applications deployed on the cloud. The technology is especially useful in protecting critical applications in public and hybrid clouds. An IDC study has shown that the PaaS market within the cloud is $4B in 2013, with expected annual growth through 2017 of 29.7%, resulting in a market of nearly $15B through 2017.