...

1. Management Server generates a unique pre-shared key (PSK) and shares it with the SSVM agent. 
2. New API request "getUploadParams" encoded the usual Cloudstack API way using api keys. Request parameters include format, hypervisor, md5 sum etc.
3. Management Server response to (b) returns post url to upload the file, encrypted payload to send to the url while uploading the file and a SHA1 signature generated using PSK and params json.  
4. User should upload the file over https POST request to the url obtained in (c). The signature and payload returned in (c) should be passed as is.
5. The Apache web server on the SSVM matches the url, decrypts and passes on to the SSVM java agent as plain HTTP. The SSVM agent checks the signature against the decrypted payload using the key PSK and SHA1. Once the payload is verified, it writes to the NFS storage to the location encoded in the URL. 
6. Once the upload completes, the MD5 checksum is compared (if available from step c).

API changes

A new API getUploadParams to enable users to upload volume/template from a local or network file share. The API response has a POST URL to which the volume/template needs to be uploaded. This is available to regular and admin users of Cloudstack. The request and response parameters are described below (all required parameters are in bold font)

...