The MEERKATS Cloud Security Architecture

• Main Authors: Keromytis, A. D., Geambasu, R., Sethumadhavan, S., Stolfo, S. J., Junfeng Yang, Benameur, A., Dacier, M., Elder, M., Kienzle, D., Stavrou, A.
• Format: Conference Proceeding
• Language: English
• Subjects: Cloud computing; cloud security; Computer architecture; Cryptography; deception; decoys; Distributed databases; Monitoring; resource management
• ISSN: 1545-0678; 2332-5666
• DOI: 10.1109/ICDCSW.2012.42

MEERKATS is a novel architecture for cloud environments that elevates continuous system evolution and change as first-rate design principles. Our goal is to enable an environment for cloud services that constantly changes along several dimensions, toward creating an unpredictable target for an adversary. This unpredictability will both impede the adversary's ability to achieve an initial system compromise and, if a compromise occurs, to detect, disrupt, and/or otherwise impede his ability to exploit this success. Thus, we envision an environment where cloud services and data are constantly in flux, using adaptive (both proactive and reactive) protection mechanisms and distributed monitoring at various levels of abstraction. A key element of MEERKATS is the focus on both the software and the data in the cloud, not just protecting but leveraging both to improve mission resilience. MEERKATS seeks to effectively exploit "economies of scale" (in resources available) to provide higher flexibility and effectiveness in the deployment and use of protection mechanisms as and where needed, focusing on current and anticipated application and mission needs instead of an inefficient, "blanket" approach to protecting "everything the same way, all the time". We outline our vision for MEERKATS and describe our approach toward prototyping it.