Cloud computing provides scalable network services and makes network management more flexible by combining Software-Defined Networking (SDN). Through the northbound interface (e.g., REST API) offered by the SDN controller, users can easily deploy diversified applications to access the network resources. However, exploiting the openness of the northbound interface, malicious applications abuse APIs to launch hostile attacks, which poses serious threats to the network. In this paper, we propose SEAPP, a secure application management framework based on REST API access control. Our main idea is to granularly manage application permissions and encrypt REST API calls to defend against malicious attacks. SEAPP includes two components: 1) permissions detection engine identifies the facticity of application permissions by analyzing permission manifests and byte codes and further identifies the legality of permissions with constructed sensitive API list; 2) registration authorization engine executes encrypted registration between applications and controller by virtue of NTRU algorithm and authorizes applications to call the requested REST APIs based on their risk levels after securely authenticating them. Besides, SEAPP is a lightweight logic architecture between application plane and control plane and supports quick deployment and reconfiguration in runtime. Both theoretical analysis and evaluation results show the security and effectiveness of SEAPP. Besides, SEAPP introduces negligible CPU and memory overheads.

云计算通过结合软件定义网络（SDN）提供可扩展的网络服务，并使网络管理更加灵活。通过SDN控制器提供的北向接口（例如REST API），用户可以轻松部署多种应用程序以访问网络资源。但是，利用北向接口的开放性，恶意应用程序滥用API发起恶意攻击，这对网络构成了严重威胁。在本文中，我们提出了SEAPP，这是一个基于REST API访问控制的安全应用程序管理框架。我们的主要思想是精细地管理应用程序权限并加密REST API调用，以防御恶意攻击。SEAPP包含两个组件：1）权限检测引擎通过分析权限清单和字节码来识别应用程序权限的真实性，并通过构造敏感的API列表进一步标识权限的合法性；2）注册授权引擎利用NTRU算法在应用程序和控制器之间执行加密注册，并在安全认证它们之后根据其风险级别授权应用程序调用所请求的REST API。此外，SEAPP是应用程序平面和控制平面之间的轻量级逻辑体系结构，并支持在运行时快速部署和重新配置。理论分析和评估结果均表明SEAPP的安全性和有效性。此外，SEAPP的CPU和内存开销可忽略不计。