  Federated clouds raise a variety of challenges for managing identity,
resource access, naming, connectivity, and object access control. This paper
shows how to address these challenges in a comprehensive and uniform way using
a data-centric approach. The foundation of our approach is a trust logic in
which participants issue authenticated statements about principals, objects,
attributes, and relationships in a logic language, with reasoning based on
declarative policy rules. We show how to use the logic to implement a trust
infrastructure for cloud federation that extends the model of NSF GENI, a
federated IaaS testbed. It captures shared identity management, GENI authority
services, cross-site interconnection using L2 circuits, and a naming and access
control system similar to AWS Identity and Access Management (IAM), but
extended to a federated system without central control.
