State of The Art and Hot Aspects in Cloud Data Storage Security

Along with the evolution of cloud computing and cloud storage towards matu- rity, researchers have analyzed an increasing range of cloud computing security aspects, data security being an important topic in this area. In this paper, we examine the state of the art in cloud storage security through an overview of selected peer reviewed publications. We address the question of defining cloud storage security and its different aspects, as well as enumerate the main vec- tors of attack on cloud storage. The reviewed papers present techniques for key management and controlled disclosure of encrypted data in cloud storage, while novel ideas regarding secure operations on encrypted data and methods for pro- tection of data in fully virtualized environments provide a glimpse of the toolbox available for securing cloud storage. Finally, new challenges such as emergent government regulation call for solutions to problems that did not receive enough attention in earlier stages of cloud computing, such as for example geographical location of data. The methods presented in the papers selected for this review represent only a small fraction of the wide research effort within cloud storage security. Nevertheless, they serve as an indication of the diversity of problems that are being addressed

Privacy in cloud computing

Tese de mestrado em Segurança Informática, apresentada à Universidade de Lisboa, através da Faculdade de Ciências, 2010O paradigma cloud computing está progressivamente a integrar-se nas tecnologias de informação e é também visto por muitos como a próxima grande viragem na indústria da computação. A sua integração significa grandes alterações no modo como olhamos para a segurança dos dados de empresas que decidem confiar informação confidencial aos fornecedores de serviços cloud. Esta alteração implica um nível muito elevado de confiança no fornecedor do serviço. Ao mudar para a cloud, uma empresa relega para o fornecedor do serviço controlo sobre os seus dados, porque estes vão executar em hardware que é propriedade do fornecedor e sobre o qual a empresa não tem qualquer controlo. Este facto irá pesar muito na decisão, de mudar para a cloud, de empresas que tratam informação delicada (p.ex., informação médica ou financeira). Neste trabalho propomos demonstrar de que forma um administrador malicioso, com acesso ao hardware do fornecedor, consegue violar a privacidade dos dados que o utilizador da cloud confiou ao prestador desses serviços. Definimos como objectivo uma análise detalhada de estratégias de ataque que poderão ajudar um administrador malicioso a quebrar a privacidade de clientes da cloud, bem como a eficácia demonstrada contra esses mesmos ataques por mecanismos de protecção já propostos para a cloud. Pretendemos que este trabalho seja capaz de alertar a comunidade científica para a gravidade dos problemas de segurança que actualmente existem na cloud e, que ao mesmo tempo, sirva como motivação para uma acção célere desta, de forma a encontrar soluções para esses problemas.The paradigm of cloud computing is progressively integrating itself in the Information Technology industry and it is also seen by many experts as the next big shift in this industry. This integration implies considerable alterations in the security schemes used to ensure that the privacy of confidential information, companies entrust to the cloud provider, is kept. It also means that the level of trust in the cloud provider must be considerably high. When moving to the cloud, a company relinquishes control over its data to the cloud provider. This happens because, when operating in the cloud, the data is going to execute on top of the hardware owned by the cloud provider and, in this scenario, the client has no control over that hardware. Companies that deal with sensitive data (e.g., medical or financial records) have to weigh the importance of this problem when considering moving their data to the cloud. In this work, we provide a demonstration of how a malicious administrator, with access to the hardware of the cloud provider, is capable of violating the privacy of the data entrusted to the cloud provider by his clients. Our objective is to offer a detailed analysis of attack strategies that can be used by a malicious administrator to break the privacy of cloud clients, as well as the level of efficacy demonstrated by some protection mechanism that have already been proposed for the cloud. We also hope that this work is capable of capturing the attention of the research community to the security problems existent in the cloud and, that at the same time, it works as a motivation factor for a prompt action in order to find solutions for these problems

Personal Data Management Systems: The security and functionality standpoint

International audienceRiding the wave of smart disclosure initiatives and new privacy-protection regulations, the Personal Cloud paradigm is emerging through a myriad of solutions offered to users to let them gather and manage their whole digital life. On the bright side, this opens the way to novel value-added services when crossing multiple sources of data of a given person or crossing the data of multiple people. Yet this paradigm shift towards user empowerment raises fundamental questions with regards to the appropriateness of the functionalities and the data management and protection techniques which are offered by existing solutions to laymen users. These questions must be answered in order to limit the risk of seeing such solutions adopted only by a handful of users and thus leaving the Personal Cloud paradigm to become no more than one of the latest missed attempts to achieve a better regulation of the management of personal data. To this end, we review, compare and analyze personal cloud alternatives in terms of the functionalities they provide and the threat models they target. From this analysis, we derive a general set of functionality and security requirements that any Personal Data Management System (PDMS) should consider. We then identify the challenges of implementing such a PDMS and propose a preliminary design for an extensive and secure PDMS reference architecture satisfying the considered requirements. Finally, we discuss several important research challenges remaining to be addressed to achieve a mature PDMS ecosystem

TruSDN: Bootstrapping Trust in Cloud Network Infrastructure

Software-Defined Networking (SDN) is a novel architectural model for cloud network infrastructure, improving resource utilization, scalability and administration. SDN deployments increasingly rely on virtual switches executing on commodity operating systems with large code bases, which are prime targets for adversaries attacking the network infrastructure. We describe and implement TruSDN, a framework for bootstrapping trust in SDN infrastructure using Intel Software Guard Extensions (SGX), allowing to securely deploy SDN components and protect communication between network endpoints. We introduce ephemeral flow-specific pre-shared keys and propose a novel defence against cuckoo attacks on SGX enclaves. TruSDN is secure under a powerful adversary model, with a minor performance overhead