  The widespread adoption of cloud computing has resulted in the proliferation
of open source cloud computing frameworks that give more control to enterprises
over their data and networks. Though the benefits of open source software are
widely recognized, there is a growing concern over their security assurance.
Often open source software is a subject of frequent updates. The updates might
introduce or remove a variety of features and hence violate security properties
of the previous releases. Obviously, a manual inspection of security would be
prohibitively slow and inefficient. In this work, we propose an automated
approach that can help developers to assure the security of open source cloud
framework even in the presence of frequent releases. Our methodology consists
of creating a (stateful) wrapper that emulates the usage scenarios with
explicit representation of security and functional requirements as contracts.
We use a model-driven approach to model REST APIs of KeyStone, an identity
service in OpenStack. OpenStack is an open source cloud computing framework
providing IaaS. Our models define structural and behavioral properties of
Keystone together with its security requirements. We detail the implementation
of these models in Django Web Framework and also show how to use the behavioral
interfaces to implement a service monitor for the cloud services. This
mechanism facilitates verification and validation of functional behavior and
security requirement in an automated manner.

Software Engineering