# Secure Partitioning of Cloud Applications, with Cost Look-Ahead
## 3 Preliminaries
### Problem Formulation  
We define a _partitioning_ as the structuring of the software components of an application in non-empty parts called _domains_. Intuitively, a partitioning domain represents an isolated environment where data can flow (inbound or outbound) only by explicit communication channels. Inside every domain, data can potentially be shared. Domains must satisfy the following two properties: \begin{table}
\begin{tabular}{c c c} \hline \hline
**Asset** & \multicolumn{2}{c}{Data confidentiality} \\ \hline
**TCBs** & \multicolumn{2}{c}{Application operator, TEE/SK} \\ \hline
**Threat** & Cloud Provider & External Attacker \\ \hline
**Attack Vectors** & Superuser Privileges & Software Vulnerabilities, \\  & & Covert Channels \\ \hline
**Countermeasures** & TEE, SK & Eligible Partitioning \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Threat model. _data consistency_, meaning that the software components of the same domain manage data with the same secrecy level, and
* _reliability_, meaning that the components of the same domain have the same trust from the operator to manage their data. A partitioning is _safe_ if and only if each of its domains is data-consistent and reliable. An application is _safely partitionable_ if it does not leak sensitive data from software components to untrusted hardware components. When an application is non-safely partitionable, exploiting the SK isolation is not enough to protect the data confidentiality of the application. Our approach detects this situation and suggests how to improve the software reliability or the data-secrecy level to make the application safely partitionable. Overall, the problem addressed by this work can be stated as follows:  
\"Given a multi-component application consisting of a set \(S\) of software components, find _safe partitionings_ of \(S\) (if any) in order to deploy the application A to an SK technology while minimising the considered costs and protecting A from data leaks.\" While tackling this problem, two main challenges are addressed. On one hand, the data confidentiality of applications must be considered during the deployment phase. On the other, the performance of applications should not be degraded by the supporting hardware technology that enforces security. We tackle the partitioning problem by employing information-flow security techniques [48]: (_i_) to understand whether the software components leak sensitive data outside the SK and (_ii_) to partition the application in order to avoid data leaks between components hosted on the same SK domain. Moreover, to meet the security requirements it is enough to find a partitioning that isolates unreliable software components of the application in different domains, but doing so blindly can lead to unexpected performance and deployment costs. SKs bring overheads that can heavily impact the application performance [34], e.g., switching domains during the execution has a cost in terms of time that is influenced by sanitising the used resources before re-using them and by the domain-scheduling algorithm of the SK. Moreover, changing software domains after deployment requires working on the explicit communication channels that become intra-domain from extra-domain and vice versa. All of these call for partitionings that allow application operators to reduce those kinds of costs. We consider two different cost parameters to determine safe partitioning:  
* _the number of domains_ used by the safe partitioning in order to reduce the SK overhead, and
* the expected migration cost of switching from one partitioning to another following new evidence about the software components in our application (e.g., disclosure of a new bug or defect bringing a vulnerability). We also consider the combination of the above costs to support application operators in determining the best trade-off in terms of SK overhead and potential migration cost. We propose two declarative methodologies and open-source prototypes:  
1.