| NSF Org: |
CNS Division Of Computer and Network Systems |
| Recipient: |
|
| Initial Amendment Date: | July 22, 2014 |
| Latest Amendment Date: | July 22, 2014 |
| Award Number: | 1423481 |
| Award Instrument: | Standard Grant |
| Program Manager: |
Indrajit Ray
CNS Division Of Computer and Network Systems CSE Directorate for Computer and Information Science and Engineering |
| Start Date: | October 1, 2014 |
| End Date: | September 30, 2018 (Estimated) |
| Total Intended Award Amount: | $500,000.00 |
| Total Awarded Amount to Date: | $500,000.00 |
| Funds Obligated to Date: |
|
| History of Investigator: |
|
| Recipient Sponsored Research Office: |
1 UTSA CIR SAN ANTONIO TX US 78249-1644 (210)458-4340 |
| Sponsor Congressional District: |
|
| Primary Place of Performance: |
One UTSA Circle San Antonio TX US 78249-1644 |
| Primary Place of
Performance Congressional District: |
|
| Unique Entity Identifier (UEI): |
|
| Parent UEI: |
|
| NSF Program(s): | Secure &Trustworthy Cyberspace |
| Primary Program Source: |
|
| Program Reference Code(s): |
|
| Program Element Code(s): |
|
| Award Agency Code: | 4900 |
| Fund Agency Code: | 4900 |
| Assistance Listing Number(s): | 47.070 |
ABSTRACT
When an organization moves its hardware resources to a cloud infrastructure as a service (IaaS) provider, it faces 2 major issues: (1) cumbersome abstractions of access control facilities provided by the cloud service provider over its virtual assets (compute, storage, networking, etc.), and (2) multi-tenancy and availability concerns arising due to lack of control of virtual resource placement in the physical infrastructure. This project develops a foundational, formal theory of attribute-based access control (ABAC) and constraints specification, and associated enforcement and implementation as means to address these problems. The ABAC models are designed in such a way so as to provide each customer of the cloud service provider autonomy over access control design and specification, and administrative functions involving the customer's virtual resources and users. The constraints specification framework allows for customers to express resource scheduling preferences to mitigate multi-tenancy and availability issues (e.g. do not co-locate virtual machines tagged as sensitive with those of other customers) which are then algorithmically enforced by the service provider. Rigorous evaluation is performed by augmenting OpenStack, widely-deployed open-source cloud IaaS software, with ABAC and studying its expressiveness, user-friendliness and performance on large-scale physical infrastructure. The expected outcome of this research is to gain consensus in the research and practitioner community that ABAC would be a standard and viable approach for effective access control in the multi-billion dollar cloud IaaS industry.
PUBLICATIONS PRODUCED AS A RESULT OF THIS RESEARCH
Note:
When clicking on a Digital Object Identifier (DOI) number, you will be taken to an external
site maintained by the publisher. Some full text articles may not yet be available without a
charge during the embargo (administrative interval).
Some links on this page may take you to non-federal websites. Their policies may differ from
this site.
PROJECT OUTCOMES REPORT
Disclaimer
This Project Outcomes Report for the General Public is displayed verbatim as submitted by the Principal Investigator (PI) for this award. Any opinions, findings, and conclusions or recommendations expressed in this Report are those of the PI and do not necessarily reflect the views of the National Science Foundation; NSF has not approved or endorsed its content.
When an organization moves its hardware resources to a cloud infrastructure as a service (IaaS) provider, it faces 2 major issues: (1) cumbersome abstractions of access control facilities provided by the cloud service provider over its virtual assets (compute, storage, networking, etc.) and, (2) multi-tenancy and availability concerns arising due to lack of control of virtual resource placement in the physical infrastructure. This project developed a foundational, formal theory of attribute-based access control (ABAC) and constraints specification, and associated enforcement and implementation as means to address these problems. The ABAC models are designed in such a way so as to provide each customer of the cloud service provider autonomy over access control design and specification, and administrative functions involving the customer’s virtual resources and users. The constraints specification framework allows for customers to express resource scheduling preferences to mitigate multi-tenancy and availability issues (e.g. do not co-locate virtual machines tagged as sensitive with those of other customers) which are then algorithmically enforced by the service provider. Rigorous implementation is performed by augmenting OpenStack, widely-deployed open-source cloud IaaS software, with ABAC and studying its expressiveness, user-friendliness and performance on large-scale cloud infrastructure. It is anticipated that the models and respective analysis developed in this project will serve as the foundation, and gain consensus in the research and practitioner community that ABAC would be a standard and viable approach for effective access control in the cloud industry.
Last Modified: 10/04/2018
Modified by: Ram N Krishnan
Please report errors in award information by writing to: awardsearch@nsf.gov.
