by Erkuden Rios (Tecnalia), Massimiliano Rak (Second University of Naples) and Samuel Olaiya Afolaranmi (Tampere University of Technology)
MUSA (MUlti-cloud Secure Applications) is an EU H2020 funded research project which is aimed at ensuring security in multi-cloud environments. The main goal of MUSA is to support the lifecycle of applications with strict security requirements over heterogenous cloud resources. MUSA will result in a security framework that includes security-by-design mechanisms as well as runtime security monitoring and enforcement to mitigate security incidents.
Multi-cloud applications rely on the adoption of cloud services of different capability types (i.e. infrastructure, platform or software as a service) from different Cloud Service Providers (CSPs). Multi-cloud follows the concept of distributed computing in which the components are dispersed but communicate in an integrated manner to achieve the desired goal. This model offers the opportunity to select the best CSPs that satisfy both application and component level requirements. However, the distributed model makes security management even more complex as the need arises to tackle it at different levels: individual components, component-to-component communication and overall application. This calls for approaching security in a holistic manner. MUSA aims to address this need by providing the MUSA framework which considers security throughout the multi-cloud application lifecycle (i.e design, deployment and runtime) relying on security-by-design and integrated security assurance to allow application self-protection at runtime.
Figure 1: MUSA framework.
MUSA framework
The MUSA framework offers methods and tools to support the integration of the security within the multi-cloud application lifecycle phases, as follows:
- Design phase: the MUSA IDE, which helps in both specifying the end user security requirements and integrating such requirements in the application design. The IDE includes two main tools; the SLA Generator for the creation of the needed Security Service Level Agreements (SLAs) (see details below) and the Modeller which allows the creation of the architecture model of the application, i.e. the specification of the multi-cloud application requirements with respect to component interfaces, cloud deployment needs, etc. The MUSA IDE will allow embedding security agents in the application components for self-protection, i.e. they will enable the activation of security monitors and controls at runtime without modifying the programming model.
- Deployment phase: MUSA offers a Decision Support tool and a Distributed Deployment tool, helping in the choice of the CSPs to use (according to not only their functional but also security features) and in the deployment of the multi-cloud application, respectively.
- Execution phase: The MUSA Security Assurance Platform (provided in form of a SaaS) supports the monitoring, notification and enforcement of correction actions to grant the security features in the Security SLA. The MUSA monitoring supports the collection of operation and security metrics of both the components of the application and the cloud resources provisioned. The approach relies on the use of standard APIs (when they are used by the CSPs), cloud interoperability frameworks such as jclouds, or measures provided by MUSA security embedded libraries.
SLA-driven Security
In order to consider the security features of the overall multi-cloud application, MUSA framework adopts the concept of Security SLA (i.e. contract between customer and provider that states the security terms granted to each other). The MUSA framework proposes a tool, SLA generator, which can be used to identify the Security SLA that each application component must grant.
The SLA Generation relies on a simplified risk analysis process that enable developers to identify major threats to the components and, according to them, build up the Security SLA decribing countermeasures in terms of security controls (according to standards like NIST SP-800-53 [1] or to frame- works like CSA Cloud Control Matrix [2]) as well as offering Service Level Objectives, expressed with respect to measurable security metrics that demonstrate the correct application of the offered security controls. The MUSA framework enriches the process with the decision support tools to evaluate the services offered by real CSPs and to outline the feasibility of the Security SLA, suggesting development improvements in order to satisfy the security requirements. The final result of this process will be a multi-cloud application enriched with a set of Security SLAs granted to application components and application customers. The MUSA security assurance platform will provide application components monitoring and apply corrective actions needed to respect the agreed SLA.
Application validation and conclusion
In order to demonstrate the MUSA framework feasibility and effectiveness, two case studies are being implemented:
- NetLine/Sched flight scheduling application by Luthansa Systems Germany. MUSA will support data integrity, confidentiality, localization and access control in this multi-cloud application which is used nowadays by 55 airlines around the world.
- Smart mobility services by Tampere University of Technology Finland. This open data based multi-cloud application optimizes urban travel experience in Tampere city. MUSA will facilitate the design and deployment of the needed privacy and protection for citizen’s mobility data.
The initial validation of MUSA is planned for the end of this year and will serve to improve the framework tools and their integration towards fully fulfilling custormers’ requirements.
The MUSA Project started in January 2015 and will run untill December 2017. It receives funding from the EU’s H2020 Research and Innovation programme under grant agreement No 644429. The project is coordinated by Fundación TECNALIA Research & Innovation (Spain). The MUSA cosortium consists of academia and industry partners from six countries: Spain, Finland, Italy, England, France and Germany.
Link:
http://musa-project.eu/
References:
[1] NIST Special Publication 800-53 Revision 4. Available at: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf
[2] The CSA Cloud Control Matrix v3.0.1 , Available at: https://cloudsecurityalliance.org/download/cloud-controls-matrix-v3-0-1/
Please contact:
Erkuden Rios, Tecnalia (Project Coordinator)
