Search

Managing the allocation of cloud virtual machines at physical resources is a key requirement for the success of clouds. Current implementations of cloud schedulers do not consider the entire cloud infrastructure neither do they consider the overall user and infrastructure properties. This results in major security, privacy, and resilience concerns. In this paper, we propose a novel cloud scheduler which considers both user requirements and infrastructure properties. We focus on assuring users that their virtual resources are hosted using physical resources that match their requirements without getting users involved with understanding the details of the cloud infrastructure. As a proof-of-concept, we present our prototype which is built on OpenStack. The provided prototype implements the proposed cloud scheduler. It also provides an implementation of our previous work on cloud trust management which provides the scheduler with input about the trust status of the cloud infrastructure.

Most organisations have recently converted their physical assets into digital forms. This underlines the needs to have different types of software products to manage such information, and raises security concerns for protecting software products from being illegally used in organisations. This paper proposes a licence management solution that protects software products from being illegally used. The proposed scheme is based on dividing an organisation devices into dynamic domains, each of which is bound to a single software product. Each dynamic domain has a predefined number of devices that can use the dynamic domain-specific software product. This number is specified by the software provider and is stored in the software licence file. In this case a software product can be installed on multiple devices, and a device can possess multiple software products by joining multiple dynamic domains. The proposed mechanism ensures that the number of used copies of software product does not exceed the limit that is agreed with the software provider.

Moving current Clouds’ infrastructure to trustworthy Internet scale critical infrastructure requires supporting the infrastructure with automated management services. Thereby, the infrastructure provides, as described by NIST, “minimal management effort or service provider interaction” [11]. The initial step in this direction requires understanding how experts in the domain manage Clouds’ infrastructure, and how the infrastructural components are interlinked with each other. These are the main contribution in this paper; i.e. proposes a Cloud taxonomy focusing on infrastructure components interaction and management, provides a real life scenario of a critical application architecture using the proposed taxonomy, and then derive the management services using the provided scenario. Public Cloud model supports very limited features in comparison with other models, e.g. community Cloud. In this paper we analyze the management services at community Cloud to identify the ones which require automation to be adopted at public Cloud.

Cloud infrastructure is expected to be able to support Internet scale critical applications (e.g. hospital systems and smart grid systems). Critical infrastructure services and organizations alike will not outsource their critical applications to a public Cloud without strong assurances that their requirements will be enforced. Central to this concern is that the user should be provided with evidence of the trustworthiness of the elements of the Cloud without getting involved into infrastructure details. In addition, users should be able to control their outsourced data at public Clouds. Establishing Cloud's trust model is important but the Cloud's infrastructure complexity and dynamism makes it difficult to address. This paper focuses on an important angle in this direction. We start by identifying the related challenges for establishing trust in the Cloud, and then propose a foundation framework which can help in addressing the identified challenges. Our focus is on IaaS Cloud type and on organizations as Cloud users.

Establishing trustworthy Clouds is the ultimate goal of most current research in Cloud computing. The Cloud dynamism increases the complexity of establishing and assessing Cloud trustworthiness. In this chapter we demonstrate the effects of the Cloud dynamic nature on the trust relationships amongst Cloud entities and between users and the Cloud provider. We then identify the major challenges that would need to be tackled to mitigate the consequences of Cloud dynamics. We conclude with a set of research directions for establishing trust in Clouds. Part of these will be explored in subsequent chapters.

Clouds – einer der neuesten Trends in der Entwicklung von verteilten Systemen entstand auf Grund der Forschung und neuen Entwicklungen in den Bereichen Virtualisierung, Netzwerktechnik, Web Services und Grid Computing. Clouds setzen eine Service-orientierte Architektur voraus und erlauben bedarfsgetriebenen Zugriff auf eine gemeinsame Menge an Ressourcen wie Server, Speicher, Applikationen und Services. Die darunterliegende Architektur basiert auf verschiedenen Tiers wie zum Beispiel Software, Plattform und Infrastruktur, die in der Regel als Cloud Computing Stack bezeichnet werden. Jedes dieser Tiers tragt seinen Teil zum Funktionieren der Cloud bei, sei es durch die Ubertragung von Ressourcen, die Ausfuhrung von Programmen, oder die Speicherung von Daten fur die Benutzer. Clouds sind abstrakt, modular und dynamisch aufgebaut. Die Abstraktion hilft die Komplexitat vor dem Benutzer zu verstecken und hilft dabei die Cloud dem Benutzer als eine einzelne Entitat darzustellen. Aus Sicht der Endbenutzer haben Clouds trotz vieler Vorzuge noch einige Probleme. So sind zum Beispiel weitere Verbesserungen in den Bereichen Verfugbarkeit, Nachvollziehbarkeit, Sicherheit und Vertrauenswurdigkeit notig. Provenance sind Metadaten uber die Herkunft und Geschichte eines Datenobjektes oder Berechnungsergebnis in der Simulationswissenschaft. Diese Metadaten werden verwendet um die Zuverlassigkeit und die Vertrauenswurdigkeit der Daten zu untermauern. Aktuelle Forschungsergebnisse zum Thema Provenance beschaftigen sich hauptsachlich mit der Applikationsschicht Wir sind aber der Ansicht, dass fur Clouds auf Grund ihrer Dynamik und Modularitat ebenfalls Provenance Daten gespeichert werden sollten. Zum Beispiel Provenance Daten fur die Infrastruktur, die Plattform, die Software, den Client und Virtualisierungsumgebungen die fur das Hosten der Applikationen und Ubertragen der Daten zustandig sind. In dieser Arbeit untersuchen welche Anforderungen eine Cloud erfullen muss um die Aufzeichnung von Provenance-Daten zu ermoglichen. Wir unterteilen die Anforderungen anhand der verschiedenen Tiers unter Berucksichtigung der speziellen Cloud-Charakteristiken (wie zum Beispiel Abstraktion, Modularitat, Skalierbarkeit, etc.). Wir schlagen zur Vereinfachung Aufzeichnung von Provenance-Daten ein Framework vor, das die identifizierten Anforderungen erfullt und dabei modular, unabhangig und fur den Benutzer transparent arbeitet. Das Framework sollte zusatzlich zur Aufzeichnung der Provenance Daten auch Moglichkeiten zum Speichern, Abfragen und Visualizern dieser Daten bieten. Mit dem von uns entwickelten Framework und den damit aufgezeichneten Provenance Daten zeigen wir in der Folge den Zusatznutzen der Provenance Daten anhand einer Reihe von Anwendungsszenarios, welche die Wichtigkeit dieser Daten verdeutlichen. Diese Szenarien beinhalten ein breites Spektrum an Anwendungsgebieten, wie zum Beispiel Metadaten (eine Untermenge von Provenance-Daten), Benutzerstatistiken fur verschiedene Benutzer und Cloud-Aktivitaten, sowie die Nachverfolgung von auftretenden Fehlern. Zusatzlich verwenden wir die Cloud Provenance Daten um die Verbindungen und Beziehungen der einzelnen Tiers zueinander zu untersuchen. Unser Framework wurde entwickelt um die speziellen Anforderungen an die Sammlung von Provenance Daten in der Cloud zu berucksichtigen und die Managementmoglichkeiten fur den Benutzer zu verbessern. Des Weiteren konnten wir zeigen, dass die Anforderungen des Frameworks an Speicherkapazitat und Rechenleistung vernachlassigbar sind.

One of the key distinguishing features of Clouds based on the NIST definition is automated management of the Cloud environment such that it requires minimal management effort or service provider intervention. The Cloud cannot practically satisfy many of its potential features if it requires excessive human involvement. This chapter presents fundamental concepts about Cloud management platforms. Understanding the Cloud management process helps in realizing Cloud attributes, which are key for the development and enhancement of Cloud computing. The chapter starts by identifying the services that are required to automate the management of the Cloud. It then presents a unified view of the most well‐known Cloud management platforms. The chapter also presents an analysis of an end‐to‐end workflow for managing user requirements in the Cloud. Finally, the chapter identifies and discusses the challenges for managing the Cloud infrastructure, and presents the requirements which could address the challenges.

Provenance is a vital requirement for the success of Clouds, and it is associated with many challenges that are difficult to deal with. In this paper, we explore this area, we identify the problems in current Cloud provenance, we identify the challenges of having trustworthy secure Cloud provenance, and we identify the requirements which could address the identified challenges. We then propose a foundation framework for establishing trust in Cloud provenance. Finally, we draw our research agenda in this direction.

Establishing trust between remote entities is an important subject which has been widely discussed in academia and industry. The most commonly known solution attempting to address this problem, which has been adopted by industry, is the one proposed as part of TCG specifications (known as remote attestation). Establishing remote attestation in Clouds is critical for its success. However, remote attestation as proposed by TCG is impractical in Cloud due to Clouds' complexity and dynamism. This paper clarifies this important subject, and proposes novel methods which help in providing remote attestation in the context of Clouds environment.

Clouds are composed of enormous resources and are associated with attractive properties, e.g. scalability and resilience. Such properties are the result of Clouds dynamic nature. Cloud dynamism is desirable property for different reasons such as resilience, resource consolidation, and maintenance windows. However, such dynamism exposes many security and management concerns for Cloud providers as well as for Cloud users. For example how can Cloud providers assure users that: (a.) dependent applications running on different VMs (Virtual Machines) are hosted within physical proximity (performance reasons); (b.) mutually exclusive VMs are not hosted at the same physical server (e.g. availability and security reasons); and (c.) when migrating VMs the new allocated physical servers satisfy users application requirements and security and privacy criteria. In this paper we explore this important problem. We then propose a framework, which at this foundation stage focuses on providing secure environment for the management of Clouds' virtual layer. It also helps in establishing trust in Cloud's operational management. We also propose our planned implementation layout using Open Stack.

Establishing trust in systems is a difficult problem to tackle. In the Cloud, establishing trust is even more complicated considering its dynamic nature and distributed resources. One of the Cloud's potential feature is providing transparent management of resources at Cloud's infrastructure. This would hide technical complexities from Cloud's customers, which could be provided using middleware services. Establishing trustworthy middleware services would help in moving in the direction of establishing trust in the Cloud. In this paper we mainly focus on identifying the functions for establishing trustworthy middleware services for supporting home healthcare application. Specifically, we focus on the ones that are required to address the security, privacy, and resilience properties of home healthcare application.

Cloud computing is a new concept using old technologies that has emerged from industry to academia. This result in some confusion about Cloud potential capabilities by overestimating some features and underestimating the challenges, which we attempt to clarify in this paper. We present an overview of Cloud critical infrastructure focusing on what is known as IaaS (Infrastructure as a Service) Cloud type. We then discuss security challenges and requirements, which would hopefully contribute in moving current Cloud untrusted infrastructure to a trustworthy Internet-scale Cloud critical infrastructure. We are mainly focusing on: (a.) Cloud resource management for virtual infrastructure, (b.) security threats from Cloud insiders, (c.) Cloud user-centric security model, and (d.) Cloud infrastructure self-managed services. We have just start working on these areas as part of EU funded TCloud project.

Cloud infrastructure is expected to support Internet scale critical applications (e.g. hospital systems and smart grid systems). Critical infrastructure and even organizations will not outsource their critical resources on public Cloud without strong assurance about the trustworthiness of the Cloud Infrastructure. In this paper we focus on an important angle in this direction, which is about providing assurance to Cloud users about the trustworthiness of service delivery in a Cloud's environment (it is also known as operational trust). Specifically, we focus on analyzing the most important Clouds' properties, which enable different interested parties to assess the operational trust of a Cloud provider for delivering services. The assessment of operational trust enables Cloud users, auditors, collaborating Cloud providers, and others to compare multiple Cloud providers and decide on the best value for money. It also enables Cloud providers to understand what could be done to improve the level of services.

Cloud infrastructure is composed of enormous resources, which need to be securely and reliably coordinated and managed to provide end-to-end trusted services in the Cloud. Such coordination and management could be supported using a set of middleware. A middleware should provide a set of trustworthy automated management services. Such services would help in moving current untrusted Cloud to a trustworthy Clouds’ Internet scale critical infrastructure. The main contribution in this paper is identifying Cloud middleware types focusing on application layer management services and their interdependencies. To the best of our knowledge our paper is the first to identify middleware services and their interdependencies. We demonstrate services interdependencies and interactions using a multi-tier application architecture in Cloud computing context. Finally, we discuss the advantages of middleware services for establishing trust in the Cloud and provide our research agenda in this direction.

Cloud infrastructure is expected to be able to support Internet scale critical applications (e.g. hospital systems and smart grid systems). Critical infrastructure services and organizations alike will not outsource their critical applications to a public Cloud without strong assurances that their requirements will be enforced. Central to this concern is that the user should be provided with evidence of the trustworthiness of the elements of the Cloud. Establishing Cloud's trust model is important but the Cloud's infrastructure complexity and dynamism makes it difficult to address. Establishing trust in the Cloud is one of the key objectives of the EU funded TClouds (Trustworthy Clouds) project. In TClouds we focus on building trust models that provide various levels of transparency in the context of technical complexities and trust establishment. These trust models are not only beneficial to a Cloud's users, but also to Cloud providers, collaborating Clouds-of-Clouds, and external auditors. In this paper we explore this problem, and summarize some of the recent results from the TClouds project in context of trust establishment.

Digital Rights Management (DRM), unlike access control techniques, associates content with a rights object specifying content usage rules. The rights object is always bound with content and enforced wherever content is transferred and used. Such a rights object, in many cases, contains dynamic rights, which change with usage and time, e.g. play period, print count, and expire after a specific period. Most existing DRM techniques do not address the replay attack problem for dynamic rights. This problem has the greatest impact when the DRM mechanisms get integrated with authorised domains. In this paper we mainly focus on the replay attack for dynamic rights when it is transferred between member devices in an authorised domain, and when it is restored from an old backup enabling the reuse of an expired license. We also propose a novel mechanism for controlling and managing the consumption of dynamic rights between member devices in a domain. This is to provide a controlled environment for a user to transfer dynamic rights back and forth between domain devices in order to use content on any device member in the domain at a chosen time.

Information sharing and protection against leakage is a critical problem especially for organisations having sensitive information. Sharing content between individuals in the same organisation extends to exchanging and sharing content between collaborating organisations. In this paper we propose a novel solution for preventing shared information between collaborating organisations from getting leaked to unauthorised users inside the distination organisation or out side it. In addition, once the content is in the hands of authorised users our solution prevents unethical authorised users from leaking such content to other users in the same organisation or third parties.In this paper we provide a mechanism for a source organisation to send content to another collaborating organisation in such a way the sent content is either accessed by a specific group of users performing a specific task or it could be accessed by all devices member in the destination organisation, which should be based on organisation policy and requirements. In the proposed solution we used trusted computing technology to provide a hardware-based root of trust for the master controller and organisation devices.

This paper focuses on the problem of how to allow sharing of copyrighted content between a set of authorised devices and preventing unauthoried copying of content to other devices. Our main objective is to achieve controlled secure distribution of content, taking into account user requirements for sharing of content and rights. We mainly focused on creating a domain managed by a single owner, where all devices joining the domain are bound to the domain owner. The novel contribution in this paper is proposing a mechanism for strongly binding a domain to a single owner, which enables the binding of content licences to the domain owner. Devices can use a domain content only after joining the domain, which requires the physical involvement of the domain owner, i.e. the licence content holder. Other devices in the domain that are authorised to access the domain content cannot re-transfer the means for accessing content to others, which limits illicit content proliferation. Our novel idea is the way in which we use consumer payment cards to authenticate a domain owner before adding/removing a device from the domain. In addition, the proposed scheme helps to protect consumers' privacy; unlike the existing electronic payment system, payment card details are not passed to third parties. Also, domain owner authentication using a payment card is only required for managing domain membership, and is not required for creating, downloading or exchanging content.

Dishonest employees, who have privileges to obtain corporate critical information and access internal resources, cause the problem of internal leakage. Employees, who have such privileges and know from where to obtain corporate sensitive information, are far more dangerous than outsiders. This paper proposes a mechanism for protecting information inside organisations against unauthorised disclosure by internal adversaries. It mainly focusses on sharing and simultaneously guarding information assets from one another. This paper proposes a novel solution for binding sensitive content to organisation devices, thereby preventing uncontrolled content leakage to other devices. In the proposed solution we used trusted computing technology to provide a hardware-based root of trust on client side.

This paper proposes a novel mechanism for protecting sensitive information inside big organisations against unauthorised disclosure by insider or outsider adversaries. Protecting sensitive content from being disclosed to unauthorised parties is a major concern for big enterprises, such as government agencies, banks, clinics and corporations. This paper mainly focuses on preventing insider information leakage whilst allowing authorised users to have privileged access on sensitive information from inside or outside an organisational premises. In this paper we use location-based services to bind devices to an organisational predefined geographical locations, helping to ensure that each organisation owns and manages its own devices (where its sensitive content can 'only' be accessed).

This paper focuses on the problem of preventing the illegal copying of digital content whilst allowing content mobility within a single user domain. This paper proposes a novel solution for binding a domain to a single owner. Domain owners are authenticated using two-factor authentication, which involves "something the domain owner has", i.e. a Master Control device that controls and manages consumers domains, and binds devices joining a domain to itself, and "something the domain owner is or knows", i.e. a biometric or password/PIN authentication mechanism that is implemented by the Master Control device. These measures establish a one-to-many relationship between the Master Control device and domain devices, and a one-to-one relationship between domain owners and their Master Control Devices, ensuring that a single consumer owns each domain. This stops illicit content proliferation. Finally, the pros and cons of two possible approaches to user authentication, i.e. the use of a password/PIN and biometric authentication mechanisms, and possible countermeasures to the identified vulnerabilities are discussed.

This paper focuses on creating a secure domain consisting of all devices owned by a single owner. This domain allows secure content sharing between devices in each domain and prevents the illegal copying of content to devices outside the domain. This paper proposes a novel solution for binding a domain to a single owner, ensuring that only a single consumer owns and manages each domain. This enables binding of domain licences to a domain owner, thereby limiting illicit content proliferation.Our novel idea involves the use of location based services, ensuring that devices, when joining a consumer domain, are located in physical proximity to the domain registered addresses. This restricts domain membership to devices in predefined geographical locations, helping to ensure that a single consumer owns and manages each domain. In addition, the proposed scheme helps to protect consumer privacy; location-based service is only required for managing domain membership, and it is not required for creating, downloading or exchanging content; in addition, the proposed scheme uses the Geographic location/privacy protocol (Geopriv), which enables domain owners to control the precision or resolution of location data, and when, in which location, and by whom their location can be retrieved.

This paper focuses on the problem of preventing illegal copying of digital assets without jeopardising the right of legitimate licence holders to transfer content between their own devices, which make up a domain. Our novel idea involves the use of a domain-specific mobile phone and the mobile phone network operator to authenticate the domain owner before devices can join a domain. This binds devices in a domain to a single owner, that, in turn, enables the binding of domain licences to the domain owner. In addition, the way in which we control domain membership, and the use of the domain-specific mobile phone that enables a domain owner to add devices wherever he/she is physically present, ensures that devices joining the domain are in physical proximity to the mobile phone, preventing illicit content proliferation.