Enforcing end-to-end application security in the cloud (Big Ideas Paper)

Jean Bacon*, David Evans, David M. Eyers, Matteo Migliavacca, Peter Pietzuch, Brian Shand

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

18 Citations (Scopus)


Security engineering must be integrated with all stages of application specification and development to be effective. Doing this properly is increasingly critical as organisations rush to offload their software services to cloud providers. Service-level agreements (SLAs) with these providers currently focus on performance-oriented parameters, which runs the risk of exacerbating an impedance mismatch with the security middleware. Not only do we want cloud providers to isolate each of their clients from others, we also want to have means to isolate components and users within each client's application. We propose a principled approach to designing and deploying end-to-end secure, distributed software by means of thorough, relentless tagging of the security meaning of data, analogous to what is already done for data types. The aim is to guarantee that-above a small trusted code base-data cannot be leaked by buggy or malicious software components. This is crucial for cloud infrastructures, in which the stored data and hosted services all have different owners whose interests are not aligned (and may even be in competition). We have developed data tagging schemes and enforcement techniques that can help form the aforementioned trusted code base. Our big idea-cloud-hosted services that have end-to-end information flow control-preempts worries about security and privacy violations retarding the evolution of large-scale cloud computing.

Original languageEnglish
Title of host publicationMiddleware 2010 - ACM/IFIP/USENIX 11th International Middleware Conference, Proceedings
Number of pages20
Publication statusPublished - 2010
Externally publishedYes
EventACM/IFIP/USENIX 11th International Middleware Conference, Middleware 2010 - Bangalore, India
Duration: 29 Nov 20103 Dec 2010

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume6452 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


ConferenceACM/IFIP/USENIX 11th International Middleware Conference, Middleware 2010


  • Application-level virtualisation
  • Cloud computing
  • Information flow control
  • Policy
  • Publish/subscribe


Dive into the research topics of 'Enforcing end-to-end application security in the cloud (Big Ideas Paper)'. Together they form a unique fingerprint.

Cite this