Separation of Powers in the Cloud
Where Applications and Users Become Peers
David H. Lorenz
Open University & Technion
Boaz Rosenan
University of Haifa
We Trust Our Web Applications
With:
- Personal information
- Private communications
- Credit card details
Do they Deserve Our Trust?
Giants Being Giants...
-
A fair privacy policy
-
Non-intentional privacy leaks
A Simple Idea
Instead of trusting applications with our data...
We simply do not give applications access to it!
Traditionally...
Application Service Provider
Application
Users
User Data
Separation of Powers
Cloud Service Provider
Platform as a Service (PaaS)
Users
User Data
Application Provider
Application
Applications and Users Become Peers
Contribution
- Conceptual
- Apps can work w/o access to user data
- Technical
-
Concrete languages
- Basic ClouldLog
- Secure CloudLog
-
Concrete languages
Basic CloudLog
The Challenge:
How can an application work without access to user data?
Deductive Databases
- Databases based on logic programming
-
Express knowledge as
axioms
- Facts
- Rules
-
Decoupling
- Application logic expressed as rules
- User data expressed as facts
Basic CloudLog
- A query language for deductive databases
- "NoDatalog"
- Supports compound terms
- Explicit bottom-up evaluation
Bottom-Up Evaluation
+
=
or
How Apps Can Work
Cloud Service Provider
CloudLog Database
Users
Facts
Application Provider
Rules
CloudLog Database
Secure CloudLog
The Challenge:
How can access control be applied without trusting the application?
Statements
The Problem with Axioms
- Axioms are taken to be true
- Axioms are known to all
Axioms vs. Statements
This is a statement,
not an axiom!
It is going to rain on Wednesday
It is going to rain on Wednesday,
said the weatherman
This is an axiom.
The weatherman told the viewers it was going to rain on Wednesday
Converting Statements to Axioms
-
An axiom is created by attaching two sets to a statement
- A reader set , specifying who can read this statement
- A writer set , attributing the statement on a speaker
Adding and Removing Statements
- Any user can add any statement, as long as she attribute it to herself
\in
- A user can remove a statement if she is a member of its writer set
Querying Facts
A user will see a fact in query results if:
\in
\supseteq
Trusted
How Queries Work
Cloud Service Provider
Users
Facts
Application Provider
Rules
Bottom-Up Evaluation
+
=
or
?
?
Statement Propagation (1)
\cap
\cup
Unchecked Rule
Statement Propagation (2)
\cap
Checked Rule
Power to the People
- Users own their data
- They decide who reads it
- They can remove it or modify it at will
Two Questions
- What makes the cloud service provider any more trustworthy than the application provider?
- Why should application providers give up control over user data and switch over?
A Single Answer
Do one Thing and Do it Well.
Douglas McIlroy
Things They Do Well...
- Application Providers
- Make money
- Spread information
- Cloud Service Providers
- Availability
- Confidentiality
- Integrity
}
CloudLog
In the Paper...
-
A description of CloudLog
- Syntax and semantics
- A Twitter-like example
- More details on practicality
Related Work
- Recent work in Deductive Databases:
- [Cali12], [Bu12], [Abiteboul05], [Alvaro10]
- Access Control languages:
- Binder [DeTreville02]
- SecPAL [Moritz10]
- DKAL [Gurevich08]
Conclusion
Application Service Provider
Application
Users
User Data
If you want to keep doing this...
Separation of Powers
Cloud Service Provider
Platform as a Service (PaaS)
Users
User Data
Application Provider
Application
This is possible!
Separation of Powers in the Cloud
Where Applications and Users Become Peers
Thank You!
separation of powers 2
By Boaz Rosenan
