408 research outputs found
Trusted Computing and Secure Virtualization in Cloud Computing
Large-scale deployment and use of cloud computing in industry
is accompanied and in the same time hampered by concerns regarding protection of
data handled by cloud computing providers. One of the consequences of moving
data processing and storage off company premises is that organizations have
less control over their infrastructure. As a result, cloud service (CS) clients
must trust that the CS provider is able to protect their data and
infrastructure from both external and internal attacks. Currently however, such
trust can only rely on organizational processes declared by the CS
provider and can not be remotely verified and validated by an external party.
Enabling the CS client to verify the integrity of the host where the
virtual machine instance will run, as well as to ensure that the virtual
machine image has not been tampered with, are some steps towards building
trust in the CS provider. Having the tools to perform such
verifications prior to the launch of the VM instance allows the CS
clients to decide in runtime whether certain data should be stored- or calculations
should be made on the VM instance offered by the CS provider.
This thesis combines three components -- trusted computing, virtualization technology
and cloud computing platforms -- to address issues of trust and
security in public cloud computing environments. Of the three components,
virtualization technology has had the longest evolution and is a cornerstone
for the realization of cloud computing. Trusted computing is a recent
industry initiative that aims to implement the root of trust in a hardware
component, the trusted platform module. The initiative has been formalized
in a set of specifications and is currently at version 1.2. Cloud computing
platforms pool virtualized computing, storage and network resources in
order to serve a large number of customers customers that use a multi-tenant
multiplexing model to offer on-demand self-service over broad network.
Open source cloud computing platforms are, similar to trusted computing, a
fairly recent technology in active development.
The issue of trust in public cloud environments is addressed
by examining the state of the art within cloud computing security and
subsequently addressing the issues of establishing trust in the launch of a
generic virtual machine in a public cloud environment. As a result, the thesis
proposes a trusted launch protocol that allows CS clients
to verify and ensure the integrity of the VM instance at launch time, as
well as the integrity of the host where the VM instance is launched. The protocol
relies on the use of Trusted Platform Module (TPM) for key generation and data protection.
The TPM also plays an essential part in the integrity attestation of the
VM instance host. Along with a theoretical, platform-agnostic protocol,
the thesis also describes a detailed implementation design of the protocol
using the OpenStack cloud computing platform.
In order the verify the implementability of the proposed protocol, a prototype
implementation has built using a distributed deployment of OpenStack.
While the protocol covers only the trusted launch procedure using generic
virtual machine images, it presents a step aimed to contribute towards
the creation of a secure and trusted public cloud computing environment
Security Strategies to Prevent Data Breaches in Infrastructure as a Service Cloud Computing
Due to the ever-growing threat of security breaches that information technology (IT) organizations continually face, protecting customer information stored within the cloud is critical to ensuring data integrity. Research shows that new categories of data breaches constantly emerge; thus, security strategies that build trust in consumers and improve system performance are a must. The purpose of this qualitative multiple case study was to explore and analyze the strategies used by database administrators (DBAs) to secure data in a private infrastructure as a service (IaaS) cloud computing. The participants comprised of 6 DBAs from 2 IT companies in Baltimore, Maryland, with experience and knowledge of security strategies to secure data in private IaaS cloud computing. The disruptive innovation theory was the conceptual framework for this study. Data were collected using semistructured interviews and a review of 7 organizational documents. A thematic analysis was used to analyze the data. Four key themes emerged: importance of well-defined security measures in cloud computing, measures to address security controls in cloud computing, limitations of existing security controls in cloud computing, and future and potential security measures solutions in cloud computing. The findings may benefit DBAs and IT organizations by providing strategies to prevent future data breaches. Well-defined security strategies may protect an individualâs data, which in turn may promote individual well-being and build strong communities
Infrastructure as a service: exploring network access control challenges
Cloud Computing Infrastructure as a Service (IaaS) is a great model for outsourcing IT infrastructure. It is built to offer fascinating features to support business development, such as elasticity, multi-tenancy, configurability and dynamicity.
However, IaaS faces security challenges on account of its flexible nature. For this article, we studied the IaaS characteristics and investigated their related security challenges. We then elaborated these security challenges by exploring the security threats on live virtual machine migration as it is one of the main IaaS operations. We found that proper access control techniques and models are a critical element in enhancing IaaS and mitigating the identified security threats. Therefore, we investigated and contrasted the implemented and the proposed firewall architectures in IaaS as a firewall is a basic security appliance that enforces access control.
We also explored and contrasted the proposed access control models in the IaaS. It was found that the traditional firewalls and access control models were not sufficient for IaaS. Therefore, there is a need to develop a proper access control model and
enforcement techniques to mitigate IaaS security threats. Based on the security research trend and the results obtained in this articles exploration, we endorse an IaaS access control system built on a computational intelligent approach
Recommended from our members
A survey on security issues and solutions at different layers of Cloud computing
Cloud computing offers scalable on-demand services to consumers with greater flexibility and lesser infrastructure investment. Since Cloud services are delivered using classical network protocols and formats over the Internet, implicit vulnerabilities existing in these protocols as well as threats introduced by newer architectures raise many security and privacy concerns. In this paper, we survey the factors affecting Cloud computing adoption, vulnerabilities and attacks, and identify relevant solution directives to strengthen security and privacy in the Cloud environment
MSL Framework: (Minimum Service Level Framework) for Cloud Providers and Users
Cloud Computing ensures parallel computing and emerged as an efficient technology to meet the
challenges of rapid growth of data that we experienced in this internet age. Cloud computing is
an emerging technology that offers subscription based services, and provide different models
such as IaaS, PaaS and SaaS to cater the needs of different users groups. The technology has
enormous benefits but there are serious concerns and challenges related to lack of uniform
standards or nonexistence of minimum benchmark for level of services across the industry to
provide an effective, uniform and reliable service to the cloud users.
As the cloud computing is gaining popularity organizations and users are having problems to adopt the service due to lack of minimum service level framework which can act as a benchmark in the selection of the cloud provider and provide quality of services according to the users expectations. The situation becomes more critical due to distributed nature of the service...info:eu-repo/semantics/publishedVersio
Security in Cloud Computing: Evaluation and Integration
Au cours de la derniĂšre dĂ©cennie, le paradigme du Cloud Computing a rĂ©volutionnĂ© la maniĂšre dont nous percevons les services de la Technologie de lâInformation (TI). Celui-ci nous a donnĂ© lâopportunitĂ© de rĂ©pondre Ă la demande constamment croissante liĂ©e aux besoins informatiques
des usagers en introduisant la notion dâexternalisation des services et des donnĂ©es. Les consommateurs du Cloud ont gĂ©nĂ©ralement accĂšs, sur demande, Ă un large Ă©ventail bien
rĂ©parti dâinfrastructures de TI offrant une plĂ©thore de services. Ils sont Ă mĂȘme de configurer dynamiquement les ressources du Cloud en fonction des exigences de leurs applications, sans toutefois devenir partie intĂ©grante de lâinfrastructure du Cloud. Cela leur permet dâatteindre
un degrĂ© optimal dâutilisation des ressources tout en rĂ©duisant leurs coĂ»ts dâinvestissement en TI. Toutefois, la migration des services au Cloud intensifie malgrĂ© elle les menaces existantes Ă la sĂ©curitĂ© des TI et en crĂ©e de nouvelles qui sont intrinsĂšques Ă lâarchitecture du Cloud
Computing. Câest pourquoi il existe un rĂ©el besoin dâĂ©valuation des risques liĂ©s Ă la sĂ©curitĂ© du Cloud durant le procĂ©dĂ© de la sĂ©lection et du dĂ©ploiement des services. Au cours des derniĂšres annĂ©es, lâimpact dâune efficace gestion de la satisfaction des besoins en sĂ©curitĂ© des
services a Ă©tĂ© pris avec un sĂ©rieux croissant de la part des fournisseurs et des consommateurs. Toutefois, lâintĂ©gration rĂ©ussie de lâĂ©lĂ©ment de sĂ©curitĂ© dans les opĂ©rations de la gestion des ressources du Cloud ne requiert pas seulement une recherche mĂ©thodique, mais aussi une modĂ©lisation mĂ©ticuleuse des exigences du Cloud en termes de sĂ©curitĂ©.
Câest en considĂ©rant ces facteurs que nous adressons dans cette thĂšse les dĂ©fis liĂ©s Ă lâĂ©valuation de la sĂ©curitĂ© et Ă son intĂ©gration dans les environnements indĂ©pendants et interconnectĂ©s du Cloud Computing. Dâune part, nous sommes motivĂ©s Ă offrir aux consommateurs du Cloud un ensemble de mĂ©thodes qui leur permettront dâoptimiser la sĂ©curitĂ© de leurs services et, dâautre part, nous offrons aux fournisseurs un Ă©ventail de stratĂ©gies qui leur permettront de mieux sĂ©curiser leurs services dâhĂ©bergements du Cloud. LâoriginalitĂ© de cette thĂšse porte sur deux aspects : 1) la description innovatrice des exigences des applications du Cloud relativement Ă la sĂ©curitĂ© ; et 2) la conception de modĂšles mathĂ©matiques rigoureux qui intĂšgrent le facteur de sĂ©curitĂ© dans les problĂšmes traditionnels du dĂ©ploiement des applications, dâapprovisionnement des ressources et de la gestion de la charge de travail au coeur des infrastructures
actuelles du Cloud Computing. Le travail au sein de cette thÚse est réalisé en trois phases.----------ABSTRACT: Over the past decade, the Cloud Computing paradigm has revolutionized the way we envision IT services. It has provided an opportunity to respond to the ever increasing computing needs of the users by introducing the notion of service and data outsourcing. Cloud consumers usually
have online and on-demand access to a large and distributed IT infrastructure providing a plethora of services. They can dynamically configure and scale the Cloud resources according to the requirements of their applications without becoming part of the Cloud infrastructure, which allows them to reduce their IT investment cost and achieve optimal resource utilization. However, the migration of services to the Cloud increases the vulnerability to existing IT security threats and creates new ones that are intrinsic to the Cloud Computing architecture, thus the need for a thorough assessment of Cloud security risks during the process of service selection and deployment. Recently, the impact of effective management of service security satisfaction has been taken with greater seriousness by the Cloud Service Providers (CSP) and stakeholders. Nevertheless, the successful integration of the security element into the Cloud resource management operations does not only require methodical research, but also necessitates the meticulous modeling of the Cloud security requirements.
To this end, we address throughout this thesis the challenges to security evaluation and integration in independent and interconnected Cloud Computing environments. We are interested in providing the Cloud consumers with a set of methods that allow them to optimize the security of their services and the CSPs with a set of strategies that enable them to provide security-aware Cloud-based service hosting. The originality of this thesis lies within two aspects: 1) the innovative description of the Cloud applicationsâ security requirements, which paved the way for an effective quantification and evaluation of the security of Cloud infrastructures; and 2) the design of rigorous mathematical models that integrate the security factor into the traditional problems of application deployment, resource provisioning, and workload management within current Cloud Computing infrastructures. The work in this thesis is carried out in three phases
Recent trends in applying TPM to cloud computing
Trusted platform modules (TPM) have become important safeâguards against
variety of softwareâbased attacks. By providing a limited set of
cryptographic services through a wellâdefined interface, separated from
the software itself, TPM can serve as a root of trust and as a building
block for higherâlevel security measures. This article surveys the
literature for applications of TPM in the cloudâcomputing environment,
with publication dates comprised between 2013 and 2018. It identifies
the current trends and objectives of this technology in the cloud, and
the type of threats that it mitigates. Toward the end, the main research
gaps are pinpointed and discussed. Since integrity measurement is one
of the main usages of TPM, special attention is paid to the assessment
of run time phases and software layers it is applied to.</p
Providing User Security Guarantees in Public Infrastructure Clouds
The infrastructure cloud (IaaS) service model offers improved resource flexibility and availability, where tenants - insulated from the minutiae of hardware maintenance - rent computing resources to deploy and operate complex systems. Large-scale services running on IaaS platforms demonstrate the viability of this model; nevertheless, many organizations operating on sensitive data avoid migrating operations to IaaS platforms due to security concerns. In this paper, we describe a framework for data and operation security in IaaS, consisting of protocols for a trusted launch of virtual machines and domain-based storage protection. We continue with an extensive theoretical analysis with proofs about protocol resistance against attacks in the defined threat model. The protocols allow trust to be established by remotely attesting host platform configuration prior to launching guest virtual machines and ensure confidentiality of data in remote storage, with encryption keys maintained outside of the IaaS domain. Presented experimental results demonstrate the validity and efficiency of the proposed protocols. The framework prototype was implemented on a test bed operating a public electronic health record system, showing that the proposed protocols can be integrated into existing cloud environments
- âŠ