Search

Managing the allocation of cloud virtual machines at physical resources is a key requirement for the success of clouds. Current implementations of cloud schedulers do not consider the entire cloud infrastructure neither do they consider the overall user and infrastructure properties. This results in major security, privacy, and resilience concerns. In this paper, we propose a novel cloud scheduler which considers both user requirements and infrastructure properties. We focus on assuring users that their virtual resources are hosted using physical resources that match their requirements without getting users involved with understanding the details of the cloud infrastructure. As a proof-of-concept, we present our prototype which is built on OpenStack. The provided prototype implements the proposed cloud scheduler. It also provides an implementation of our previous work on cloud trust management which provides the scheduler with input about the trust status of the cloud infrastructure.

Most organisations have recently converted their physical assets into digital forms. This underlines the needs to have different types of software products to manage such information, and raises security concerns for protecting software products from being illegally used in organisations. This paper proposes a licence management solution that protects software products from being illegally used. The proposed scheme is based on dividing an organisation devices into dynamic domains, each of which is bound to a single software product. Each dynamic domain has a predefined number of devices that can use the dynamic domain-specific software product. This number is specified by the software provider and is stored in the software licence file. In this case a software product can be installed on multiple devices, and a device can possess multiple software products by joining multiple dynamic domains. The proposed mechanism ensures that the number of used copies of software product does not exceed the limit that is agreed with the software provider.

Moving current Clouds’ infrastructure to trustworthy Internet scale critical infrastructure requires supporting the infrastructure with automated management services. Thereby, the infrastructure provides, as described by NIST, “minimal management effort or service provider interaction” [11]. The initial step in this direction requires understanding how experts in the domain manage Clouds’ infrastructure, and how the infrastructural components are interlinked with each other. These are the main contribution in this paper; i.e. proposes a Cloud taxonomy focusing on infrastructure components interaction and management, provides a real life scenario of a critical application architecture using the proposed taxonomy, and then derive the management services using the provided scenario. Public Cloud model supports very limited features in comparison with other models, e.g. community Cloud. In this paper we analyze the management services at community Cloud to identify the ones which require automation to be adopted at public Cloud.

Establishing trustworthy Clouds is the ultimate goal of most current research in Cloud computing. The Cloud dynamism increases the complexity of establishing and assessing Cloud trustworthiness. In this chapter we demonstrate the effects of the Cloud dynamic nature on the trust relationships amongst Cloud entities and between users and the Cloud provider. We then identify the major challenges that would need to be tackled to mitigate the consequences of Cloud dynamics. We conclude with a set of research directions for establishing trust in Clouds. Part of these will be explored in subsequent chapters.

Clouds – einer der neuesten Trends in der Entwicklung von verteilten Systemen entstand auf Grund der Forschung und neuen Entwicklungen in den Bereichen Virtualisierung, Netzwerktechnik, Web Services und Grid Computing. Clouds setzen eine Service-orientierte Architektur voraus und erlauben bedarfsgetriebenen Zugriff auf eine gemeinsame Menge an Ressourcen wie Server, Speicher, Applikationen und Services. Die darunterliegende Architektur basiert auf verschiedenen Tiers wie zum Beispiel Software, Plattform und Infrastruktur, die in der Regel als Cloud Computing Stack bezeichnet werden. Jedes dieser Tiers tragt seinen Teil zum Funktionieren der Cloud bei, sei es durch die Ubertragung von Ressourcen, die Ausfuhrung von Programmen, oder die Speicherung von Daten fur die Benutzer. Clouds sind abstrakt, modular und dynamisch aufgebaut. Die Abstraktion hilft die Komplexitat vor dem Benutzer zu verstecken und hilft dabei die Cloud dem Benutzer als eine einzelne Entitat darzustellen. Aus Sicht der Endbenutzer haben Clouds trotz vieler Vorzuge noch einige Probleme. So sind zum Beispiel weitere Verbesserungen in den Bereichen Verfugbarkeit, Nachvollziehbarkeit, Sicherheit und Vertrauenswurdigkeit notig. Provenance sind Metadaten uber die Herkunft und Geschichte eines Datenobjektes oder Berechnungsergebnis in der Simulationswissenschaft. Diese Metadaten werden verwendet um die Zuverlassigkeit und die Vertrauenswurdigkeit der Daten zu untermauern. Aktuelle Forschungsergebnisse zum Thema Provenance beschaftigen sich hauptsachlich mit der Applikationsschicht Wir sind aber der Ansicht, dass fur Clouds auf Grund ihrer Dynamik und Modularitat ebenfalls Provenance Daten gespeichert werden sollten. Zum Beispiel Provenance Daten fur die Infrastruktur, die Plattform, die Software, den Client und Virtualisierungsumgebungen die fur das Hosten der Applikationen und Ubertragen der Daten zustandig sind. In dieser Arbeit untersuchen welche Anforderungen eine Cloud erfullen muss um die Aufzeichnung von Provenance-Daten zu ermoglichen. Wir unterteilen die Anforderungen anhand der verschiedenen Tiers unter Berucksichtigung der speziellen Cloud-Charakteristiken (wie zum Beispiel Abstraktion, Modularitat, Skalierbarkeit, etc.). Wir schlagen zur Vereinfachung Aufzeichnung von Provenance-Daten ein Framework vor, das die identifizierten Anforderungen erfullt und dabei modular, unabhangig und fur den Benutzer transparent arbeitet. Das Framework sollte zusatzlich zur Aufzeichnung der Provenance Daten auch Moglichkeiten zum Speichern, Abfragen und Visualizern dieser Daten bieten. Mit dem von uns entwickelten Framework und den damit aufgezeichneten Provenance Daten zeigen wir in der Folge den Zusatznutzen der Provenance Daten anhand einer Reihe von Anwendungsszenarios, welche die Wichtigkeit dieser Daten verdeutlichen. Diese Szenarien beinhalten ein breites Spektrum an Anwendungsgebieten, wie zum Beispiel Metadaten (eine Untermenge von Provenance-Daten), Benutzerstatistiken fur verschiedene Benutzer und Cloud-Aktivitaten, sowie die Nachverfolgung von auftretenden Fehlern. Zusatzlich verwenden wir die Cloud Provenance Daten um die Verbindungen und Beziehungen der einzelnen Tiers zueinander zu untersuchen. Unser Framework wurde entwickelt um die speziellen Anforderungen an die Sammlung von Provenance Daten in der Cloud zu berucksichtigen und die Managementmoglichkeiten fur den Benutzer zu verbessern. Des Weiteren konnten wir zeigen, dass die Anforderungen des Frameworks an Speicherkapazitat und Rechenleistung vernachlassigbar sind.

This chapter outlines the main features of two widely discussed Cloud management platforms: Amazon AWS (a commercial Cloud management platform) and OpenStack (an open‐source Cloud management platform). Subsequently, the chapter illustrates using OpenStack with some concepts discussed throughout the book.

One of the key distinguishing features of Clouds based on the NIST definition is automated management of the Cloud environment such that it requires minimal management effort or service provider intervention. The Cloud cannot practically satisfy many of its potential features if it requires excessive human involvement. This chapter presents fundamental concepts about Cloud management platforms. Understanding the Cloud management process helps in realizing Cloud attributes, which are key for the development and enhancement of Cloud computing. The chapter starts by identifying the services that are required to automate the management of the Cloud. It then presents a unified view of the most well‐known Cloud management platforms. The chapter also presents an analysis of an end‐to‐end workflow for managing user requirements in the Cloud. Finally, the chapter identifies and discusses the challenges for managing the Cloud infrastructure, and presents the requirements which could address the challenges.

Provenance is a vital requirement for the success of Clouds, and it is associated with many challenges that are difficult to deal with. In this paper, we explore this area, we identify the problems in current Cloud provenance, we identify the challenges of having trustworthy secure Cloud provenance, and we identify the requirements which could address the identified challenges. We then propose a foundation framework for establishing trust in Cloud provenance. Finally, we draw our research agenda in this direction.

Establishing trust in systems is a difficult problem to tackle. In the Cloud, establishing trust is even more complicated considering its dynamic nature and distributed resources. One of the Cloud's potential feature is providing transparent management of resources at Cloud's infrastructure. This would hide technical complexities from Cloud's customers, which could be provided using middleware services. Establishing trustworthy middleware services would help in moving in the direction of establishing trust in the Cloud. In this paper we mainly focus on identifying the functions for establishing trustworthy middleware services for supporting home healthcare application. Specifically, we focus on the ones that are required to address the security, privacy, and resilience properties of home healthcare application.

Cloud infrastructure is expected to be able to support Internet scale critical applications (e.g. hospital systems and smart grid systems). Critical infrastructure services and organizations alike will not outsource their critical applications to a public Cloud without strong assurances that their requirements will be enforced. Central to this concern is that the user should be provided with evidence of the trustworthiness of the elements of the Cloud. Establishing Cloud's trust model is important but the Cloud's infrastructure complexity and dynamism makes it difficult to address. Establishing trust in the Cloud is one of the key objectives of the EU funded TClouds (Trustworthy Clouds) project. In TClouds we focus on building trust models that provide various levels of transparency in the context of technical complexities and trust establishment. These trust models are not only beneficial to a Cloud's users, but also to Cloud providers, collaborating Clouds-of-Clouds, and external auditors. In this paper we explore this problem, and summarize some of the recent results from the TClouds project in context of trust establishment.

Computational grids require secure information sharing between users and resources. Users and resources are members in collaborating organisations, which form a virtual organisation (VO). The heterogeneous distribution of resource providers and requesters require a mechanism to protect shared information and resources from being misused not only by unauthorised individuals but also from authorised individuals. This paper proposes a novel mechanism for controlling information sharing but protection between members in a VO. Content can be shared between members of a VO subject to the VO policy and content owner organisation policy. In the proposed mechanism a member in a VO, who is authorised to access content, is not capable of transferring unprotected content, or protected content and the means for accessing it accidentally or deliberately to others. The VO project managers and collaborating organisations administrators decide which device can access content. Also, when a resource/user leaves the VO the resource/user will not be capable to access the shared information; thereby preventing uncontrolled content leakage. In the proposed solution, we used trusted computing technology to provide a hardware-based root of trust on user devices. Copyright © 2009 John Wiley & Sons, Ltd.

Information sharing and protection against leakage is a critical problem especially for organisations having sensitive information. Sharing content between individuals in the same organisation extends to exchanging and sharing content between collaborating organisations. In this paper we propose a novel solution for preventing shared information between collaborating organisations from getting leaked to unauthorised users inside the distination organisation or out side it. In addition, once the content is in the hands of authorised users our solution prevents unethical authorised users from leaking such content to other users in the same organisation or third parties.In this paper we provide a mechanism for a source organisation to send content to another collaborating organisation in such a way the sent content is either accessed by a specific group of users performing a specific task or it could be accessed by all devices member in the destination organisation, which should be based on organisation policy and requirements. In the proposed solution we used trusted computing technology to provide a hardware-based root of trust for the master controller and organisation devices.

This paper focuses on the problem of how to allow sharing of copyrighted content between a set of authorised devices and preventing unauthoried copying of content to other devices. Our main objective is to achieve controlled secure distribution of content, taking into account user requirements for sharing of content and rights. We mainly focused on creating a domain managed by a single owner, where all devices joining the domain are bound to the domain owner. The novel contribution in this paper is proposing a mechanism for strongly binding a domain to a single owner, which enables the binding of content licences to the domain owner. Devices can use a domain content only after joining the domain, which requires the physical involvement of the domain owner, i.e. the licence content holder. Other devices in the domain that are authorised to access the domain content cannot re-transfer the means for accessing content to others, which limits illicit content proliferation. Our novel idea is the way in which we use consumer payment cards to authenticate a domain owner before adding/removing a device from the domain. In addition, the proposed scheme helps to protect consumers' privacy; unlike the existing electronic payment system, payment card details are not passed to third parties. Also, domain owner authentication using a payment card is only required for managing domain membership, and is not required for creating, downloading or exchanging content.