CLOUD COMPUTING -BCS601

Module-4: CLOUD SECURITY

11.1 SECURITY, THE TOP CONCERN FOR CLOUD USERS

Some organizations mistakenly believe that by moving to the cloud, they are free from all security worries,
assuming cloud service providers (CSPs) have everything under control. However, this belief is not entirely
accurate. Shifting computing to the cloud introduces a new set of security and privacy challenges. Often, cloud
users rely on service level agreements (SLAs), which unfortunately do not offer strong legal protection. Users
who once operated within secure corporate networks now must place their trust in external providers. This
transition from full control over data and systems to dependence on third-party management can be difficult,
especially when sensitive information is involved. Surveys repeatedly confirm that security remains the
number one concern for most cloud users.

The primary worry is unauthorized access to confidential information or outright data theft. Since data is
usually stored for long periods but processed for shorter durations, it's more vulnerable in storage than during
computation. Users must therefore pay special attention to both storage security and protecting data as it moves
across the network. Another significant threat is the potential for insider attacks, as cloud users typically have
no visibility into the CSP’s hiring or employee screening practices.

Additionally, users have limited control over the entire lifecycle of their data in the cloud. Once data is deleted,
it’s hard to know if it’s truly gone. Backups may still contain copies of that data, especially since CSPs often
perform backups without informing the user. During these operations, data might be lost, accidentally deleted,
or exposed to attackers. Users are also troubled by the lack of standardization across cloud platforms.
Questions such as what happens during service outages, how to switch providers, and the legal implications
of moving data remain unresolved. Performing audits in the cloud is particularly complex, and creating a
complete audit trail is still impractical.

Looking ahead, future technologies such as autonomic computing may complicate matters further. These
systems can self-optimize and self-heal, making it even harder to trace actions, identify causes of failures, or
detect how an attack occurred. Users are unsure how such automated systems will comply with privacy and
legal standards. One of the core issues is multi-tenancy—where many users share the same cloud
infrastructure. While this improves efficiency and reduces cost, it also increases security risks. In the case of
SaaS, for instance, if one server is breached, personal data from many users could be exposed. Users also
worry about the unclear legal jurisdiction for cloud data, especially when CSPs operate globally. It's not always
obvious whether the laws of the user’s country, the country where the data is stored, or those of any country
the data.

Dept. of CS&E, MITE, Moodabidri pg. 1

CLOUD COMPUTING -BCS601

11.2 CLOUD SECURITY RISKS

Some people think it’s very easy to start using cloud services, sometimes too easy, without fully following
ethical rules or understanding the security risks. However, cloud services can be misused to launch large
cyberattacks on other systems. The first important question is: how can cloud resources be protected from
such misuse? Another important question is: what are the real security risks cloud users face?

According to one study , there are three broad categories of cloud security risks: traditional security threats,
availability threats, and third-party control risks.

Traditional security threats are issues that already exist on the internet, but they become bigger problems in
the cloud because of the massive size of cloud resources and the huge number of users involved. Also, it’s
harder to tell who is responsible when things go wrong—whether it’s the user or the cloud provider.

The first set of threats starts at the user’s side. Users must protect their computers and networks when they
connect to the cloud. This is harder because not everything is under the user's firewall.

Another risk is about authentication and authorization. It's not enough to protect a single user. Organizations
need to give different access permissions to different employees, depending on their roles. It’s also hard to
make company security rules match the cloud provider’s systems.

Cloud service providers have already faced attacks such as:

• Distributed Denial of Service (DDoS): stopping users from accessing cloud services.
• Phishing: tricking users into giving up personal data like names and credit card numbers.
• SQL Injection: inserting malicious commands into websites to steal or change database contents.
• Cross-Site Scripting (XSS): injecting harmful scripts into websites to bypass security.

In the cloud, finding out who attacked is harder because servers run multiple virtual machines (VMs) and
many apps at once. Also, the high rate of operations makes it easy for traces of attacks to be wiped out.

Another big risk is availability. Power failures, system crashes, or natural disasters can shut down cloud
services for long periods. If a company relies heavily on cloud data, it could be seriously affected. Clouds can
also show strange behaviors because they are complex systems. Moreover, users can't always be sure that a
cloud app gives the correct results.

Third-party control is another major concern. Sometimes, cloud providers hire third-party companies to
handle some resources. If these companies are not trustworthy, customer data could be at risk. Sometimes,
even hardware problems like bad storage devices have caused data loss.

Dept. of CS&E, MITE, Moodabidri pg. 2

CLOUD COMPUTING -BCS601

Storing important or sensitive data on the cloud is risky because cloud providers might access user data.
However, legally, users are the ones responsible if their data is lost or stolen. For example, Amazon Web
Services (AWS) says in its agreement that it is not responsible for any kind of data loss or damage.

It’s also very hard for users to prove if a cloud provider actually deleted their data. Because cloud systems are
not very transparent, auditing becomes very difficult. In the U.S., government agencies must follow strict audit
rules like FIPS and FISMA.

The 2010 Cloud Security Alliance (CSA) Report

The CSA report [123] identified seven top threats in cloud computing:

1. Abuse of cloud services (like using cloud systems to send spam or launch attacks),

2. Insecure APIs,

3. Malicious insiders (bad employees inside cloud companies),

4. Shared technology risks (problems from sharing resources with others),

5. Account hijacking (stealing user accounts),

6. Data loss or leakage,

7. Unknown risk profiles (not knowing what dangers exist).

IaaS can be affected by all these threats.

PaaS can be affected by most, except shared technology.
SaaS can be affected by most, except abuse and shared technology.
Detailed Explanation of Threats:

• Abuse of the cloud: using cloud resources to do illegal activities, like DDoS attacks.

• Shared technology risks: multiple users sharing the same physical systems (hypervisors and VMs) can lead

to security gaps.

• Insecure APIs: unsafe tools used for authentication and app control.

• Malicious insiders: cloud companies don't always reveal their employee hiring policies, so insiders might
misuse access.

• Data loss and leakage: if cloud backups fail, important data could be permanently lost.

• Account hijacking: attackers stealing login information is a major risk.

Dept. of CS&E, MITE, Moodabidri pg. 3

CLOUD COMPUTING -BCS601

• Unknown risks: users sometimes don't know about hidden dangers when using cloud services.

The 2011 CSA Report

The 2011 CSA report “Security Guidance for Critical Areas of Focus in Cloud Computing V3.0” gave a full
analysis of these risks and advice for reducing them.

One study classified cloud attacks into three main areas: user, service, and cloud infrastructure, and
identified six types of attacks (see Figure 11.1).

• Users can be attacked from both services and the cloud (e.g., through SSL certificate spoofing, browser cache

attacks, or phishing).

• Services can be attacked by the cloud infrastructure (e.g., buffer overflow, SQL injection, privilege
escalation).

• Cloud infrastructure can be attacked by users (e.g., overloading resources) or by services requesting
excessive resources.

Top Twelve Cloud Security Threats (CSA 2016 Report)

The CSA 2016 report [414] expanded the list of major threats to cloud security:

1. Data breaches – losing sensitive financial, health, or trade secret information. Use encryption and
multi-factor authentication.

2. Compromised credentials and broken authentication – weak passwords and bad key management
cause attacks.

3. Hacked APIs – unsafe APIs can expose services and data.

Dept. of CS&E, MITE, Moodabidri pg. 4

CLOUD COMPUTING -BCS601

4. Exploited system vulnerabilities – bugs in systems can be used by attackers.

5. Account hijacking – stolen accounts must be traced and monitored carefully.

6. Malicious insiders – insiders misuse access; duties should be separated and activities monitored.

Other six threats are:

• Advanced Persistent Threats (APTs) – long-term, targeted attacks.

• Permanent data loss – when cloud backups and storage both fail.

• Inadequate diligence – poor planning and security design.

• Cloud service abuse – misuse of cloud systems for harmful activities.

• Denial of Service (DoS) attacks – crashing cloud services with too much traffic.

• Shared technology vulnerabilities – flaws in shared systems like VMs.

An update to the Cloud Controls Matrix shows how these risks affect different cloud models and designs.

Reports over several years also found threats like hardware failure, natural disasters, cloud malware, poor
infrastructure planning, payment system intrusions, cyber-espionage, insider misuse, web app attacks, and
physical theft or loss.

11.3 PRIVACY AND PRIVACY IMPACT ASSESSMENT

Privacy refers to the right of individuals or organizations to protect their personal or proprietary information
from being disclosed without consent. It is considered a basic human right in many nations, as seen in the
Universal Declaration of Human Rights. While the U.S. Constitution does not explicitly grant the right to
privacy, it is reflected in the Bill of Rights, protecting aspects like personal information, home privacy, and
protection from self-incrimination. In the digital age, privacy concerns have increased, particularly due to
threats like identity theft and data misuse.

The European Union (EU) has strict privacy laws, including the "right to be forgotten," which allows
individuals to remove personal data from the internet. Privacy laws vary by country, with some requiring the
disclosure of personal information that may be considered private elsewhere. Cloud computing adds new
privacy challenges because data is often stored on remote servers owned by Cloud Service Providers (CSPs),
sometimes unencrypted. Users lose control over their data, which may be used for unauthorized purposes like
targeted advertising.

Dept. of CS&E, MITE, Moodabidri pg. 5

CLOUD COMPUTING -BCS601

In response to these concerns, privacy laws require websites to notify users about their data practices, offer
choices regarding data usage, provide access to personal data for correction, and ensure data security. Privacy
Impact Assessment (PIA) is a tool used to assess privacy risks in information systems. Though there are no
global standards for PIAs, tools have been developed to help organizations identify privacy issues and ensure
compliance with privacy regulations. The PIA process involves evaluating risks, assessing legal implications,
and ensuring that privacy is integrated into new systems from the start.

There is the need for legislation addressing the multiple aspects of privacy in the digital age. A document
elaborated by the Federal Trading Commission for the US Congress states: “Consumer-oriented commercial
web sites that collect personal identifying information from or about consumers online would be required to
comply with the four widely accepted fair information practices:

1. Notice – web sites should be required to provide consumers clear and conspicuous notice of their
information practices, including what information they collect, how they collect it (e.g., directly or through
non-obvious means such as cookies), how they use it, how they provide Choice, Access, and Security to
consumers, whether they disclose the information collected to other entities, and whether other entities are
collecting information through the site.

2. Choice – web sites should be required to offer consumers choices as to how their personal identifying
information is used beyond the use for which the information was provided, e.g., to consummate a transaction.
Such choices would encompass both internal secondary uses (such as marketing back to consumers) and
external secondary uses, such as disclosing data to other entities.

3. Access – web sites would be required to offer consumers reasonable access to the information a web site
has collected about them, including a reasonable opportunity to review information and to correct inaccuracies
or delete information.

4. Security – web sites would be required to take reasonable steps to protect the security of the information
they collect from consumers. The Commission recognizes that the implementation of these practices may vary
with the nature of the information collected and the uses to which it is put, as well as with technological
developments. For this reason, the Commission recommends that any legislation be phrased in general terms
and be technologically neutral. Thus, the definitions of fair information practices set forth in the statute should
be broad enough to provide flexibility to the implementing agency in promulgating its rules or regulations.”

Dept. of CS&E, MITE, Moodabidri pg. 6

CLOUD COMPUTING -BCS601

Figure 11.1: Surfaces of attacks in a cloud computing environment.

11.5 CLOUD DATA ENCRYPTION

The government, large corporations, and individual users ponder if it is safe to store sensitive information on
a public cloud. Encryption is the obvious solution to protect outsourced data, and cloud service providers have
been compelled to offer encryption services. For example, Amazon offers AWS Key Management Service
(KMS) to create and control the encryption keys used by clients to encrypt their data. KMS is integrated with
other AWS services including EBS, S3, RDS, Redshift, Elastic Transcoder, and WorkMail. AWS also offers
Encryption SDK for developers.

The seminal RSA paper and the survey of existing public-key cryptosystems in are notable publications in the
vast literature dedicated to cryptosystems. Several new research results in cryptography are important to data
security in cloud computing. In 1999, Pascal Paillier proposed a trapdoor mechanism based on composite
residuosity classes, i.e., factoring a hard-to-factor number:

n=p×q

where pp and qq are two large prime numbers [388]. This solution exploits the homomorphic properties of
composite residuosity classes to design distributed cryptographic protocols. A major breakthrough is the
algorithms for Fully Homomorphic Encryption (FHE) proposed by Craig Gentry in his seminal 2009
dissertation at Stanford University.

Homomorphic Encryption:
Sensitive data is safe while in storage, if it is encrypted with strong encryption. However, encrypted data must
be decrypted for processing, and this opens a window of vulnerability. Thus, a critical question examined is

Dept. of CS&E, MITE, Moodabidri pg. 7

CLOUD COMPUTING -BCS601

whether it is feasible to operate on encrypted data. Homomorphic encryption, a long-time dream of security
experts, reflects the concept of homomorphism, a structure-preserving map:
f:A→A′

between two algebraic structures of the same type.

When f(⋅) is a one-to-one mapping, its inverse f−1:A′→A to A exists. Then:

a=f−1(a′), b=f−1(b′), c=f−1(c′)

where c=a□b b in domain A, and the operation in the target domain A′ is:

c′=a′◊b′

If ff is a homomorphism, then:

f(a)◊f(b)=f(a□b)

Thus, we can perform operations directly on encrypted data and decrypt the result later to obtain the correct
answer. The window of vulnerability created when data is decrypted for processing disappears.

General computations with encrypted data are theoretically feasible using FHE algorithms. Unfortunately,
homomorphic encryption is not practical yet — it increases processing time by many orders of magnitude
compared with processing plaintext data. A recent FHE implementation requires about six minutes per batch;
improvements have dropped simple operation times to almost one second. Users send a variety of queries to
large databases stored on clouds. Such queries often involve logic and arithmetic functions, raising the
question: is it feasible and practical to search encrypted databases? Applying standard encryption techniques
can cause significant performance degradation. For instance, if an entire column of a NoSQL database table
contains encrypted sensitive information, a query with a comparison operator requires a full table scan,
because existing encryption methods do not preserve order. Thus, database indices like B-trees become
unusable.

Dept. of CS&E, MITE, Moodabidri pg. 8

CLOUD COMPUTING -BCS601

Order-Preserving Encryption (OPE):

OPE maps a range of numerical values into a much larger and sparse range of values, preserving order:

x1 < x2 ⇒ f(x1) < f(x2)

where f:{1,…,M}→{1,…,N} with N≫M.

The mapping can be modelled by a Negative Hypergeometric Distribution (NHG), describing the
probability distribution for selecting black balls among white ones without replacement.

To encrypt plaintext x, the OPE algorithm performs a binary search:

• If m<M/2 , it assigns Encrypt(K,M/4),

• Else, it assigns Encrypt(K,3M/4), and so on, until Encrypt(K,x) is determined.

Each ciphertext assignment is based on the output of the NHG sampling algorithm. It can be proved by strong
induction that the scheme induces a random order-preserving function from plaintext to ciphertext space.

To allow efficient range queries on encrypted data, it is sufficient to have an order-preserving hash function
family HH. The OPE encryption can then be structured as:

Ciphertext=Encrypt(KEncrypt,x)∥H(KH,x)

where KEncrypt is a standard encryption key and KH is the key for the order-preserving hash function H.

Searchable Symmetric Encryption (SSE):

Searching encrypted databases is a major topic of interest . Typical search types include single-keyword, multi-
keyword, fuzzy-keyword, ranked, authorized, and verifiable search. SSE is used when an encrypted database
EE is outsourced to the cloud. It hides information about the database and queries. The client stores only the
cryptographic key. To search:

1. The client encrypts the query,

2. Sends it to the server,

3. Receives an encrypted result,

4. Decrypts it using the stored key.

The information leakage is limited to query patterns only, not data contents.

An SSE protocol supporting conjunctive and general Boolean queries was proposed in, scaling to large
databases including free-text searches with moderate leakage. It supports range, substring, wildcard, and

Dept. of CS&E, MITE, Moodabidri pg. 9

CLOUD COMPUTING -BCS601

phrase queries. Finally, even on private clouds, insider threats remain. An insider accessing log files may infer
database "hot spots," selectively copy data, and misuse it. To minimize insider risks, protection rings must
be enforced, restricting staff access to limited areas of the database.

11.6 SECURITY OF DATABASE SERVICES

Cloud users often delegate control of their data to the database services supported by virtually all CSPs and
are concerned with security aspects of DBaaS. The model used to evaluate DBaaS security includes several
groups of entities: data owners, users of data, CSPs, and third-party agents or Third-Party Auditors
(TPAs).Data owners and DBaaS users fear compromised integrity and confidentiality, as well as data
unavailability. Insufficient authorization, authentication, and accounting mechanisms, inconsistent use of
encryption keys and techniques, alteration or deletion of records without maintaining backup, and operational
failures are the major causes of data loss in DBaaS.

Some data integrity and privacy issues are due to the absence of authentication, authorization, and accounting
controls, or poor key management for encryption and decryption. Confidentiality means that only authorized
users should have access to the data. Unencrypted data is vulnerable to bugs, errors, and attacks from external
entities affecting data confidentiality. Insider attacks are another concern for DBaaS users and data owners.
Superusers have unlimited privileges, and misuse of superuser privileges poses a considerable threat to
confidential data such as medical records, sensitive business data, proprietary product data, and so on.
Malicious external attackers use spoofing, sniffing, man-in-the-middle attacks, side channelling, and illegal
transactions to launch DoS attacks. Another concern is illegal recovery of data from storage devices, a side
effect of multi-tenancy. CSPs often carry out sanitation operations after deleting data from physical devices,
but sophisticated attackers can still recover information from storage devices unless a thorough scrubbing
operation is carried out. Data is also vulnerable during transfer from the data owner to the DBaaS through
public networks. Encryption before data transmission can reduce the risks posed to the data in transit to the
cloud.
Data provenance, the process of establishing the origin of data and its movement between databases, uses
metadata to determine the data accuracy, but the security assessments are time sensitive. Moreover, analyzing
large provenance metadata graphs is computationally expensive. Cloud users are not aware of the physical
location of their data. This lack of transparency allows cloud service providers to optimize the use of resources
but in case of security breaches, it is next to impossible for users to identify compromised resources. DBaaS
users do not have fine-grained control of the remote execution environment and cannot inspect the execution
traces to detect the occurrence of illegal operations.
To increase availability, performance, and to enhance reliability, cloud database services replicate data.
Ensuring consistency among the replicas is challenging. Another critical function of DBaaS is to carry out

Dept. of CS&E, MITE, Moodabidri pg. 10

CLOUD COMPUTING -BCS601

timely backups of all sensitive and confidential data to facilitate quick recovery in case of disasters. Auditing
and monitoring are important functions of a DBaaS but generate their own security risks when delegated to
TPAs. Conventional methods for auditing and monitoring demand detailed knowledge of the network
infrastructure and physical devices. Data privacy laws can be violated as consumers are unaware of where the
data is stored. Privacy laws in Europe and South America prohibit storing data outside the country of origin.

11.7 OPERATING SYSTEM SECURITY

An operating system allows multiple applications to share the hardware resources of a physical system subject
to a set of policies. A critical function of an OS is to protect applications against a wide range of malicious
attacks such as unauthorized access to privileged information, tampering with executable code, and spoofing.
Such attacks can target even single-user systems such as personal computers, tablets, or smartphones. Data
brought into the system may contain malicious code; this could be the case of a Java applet, or of data imported
by a browser from a malicious website. The mandatory security of an OS is considered to be: “any security
policy where the definition of the policy logic and the assignment of security attributes is tightly controlled
by a system security policy administrator.” Access control, authentication usage, and cryptographic usage
policies are all elements of the mandatory OS security.
Access control policies specify how OS controls access to different system objects, authentication usage
defines the authentication mechanisms used by the OS to authenticate a principal, and cryptographic usage
policies specify the cryptographic mechanisms used to protect the data. A necessary but not sufficient
condition for security is that the subsystems tasked to perform security-related functions are tamper-proof and
cannot be bypassed. An OS should confine an application to a unique security domain.
Applications with special privileges performing security-related functions are called trusted applications. Such
applications should only be allowed the lowest level of privileges required to perform their functions. For
example, type enforcement is a mandatory security mechanism that can be used to restrict a trusted application
to the lowest level of privileges.
Enforcing mandatory security through mechanisms left at user’s discretion can lead to a breach of security,
sometimes due to malicious intent, in other cases due to carelessness, or to lack of understanding.
Discretionary mechanisms place the burden of security on individual users. Moreover, an application may
change a carefully defined discretionary policy without the consent of the user, while a mandatory policy can
only be changed by a system administrator. Unfortunately, commercial operating systems do not support multi-
layered security. They only distinguish between a completely privileged security domain and a completely
unprivileged one. Some operating systems, e.g., Windows NT, allow a program to inherit all the privileges of
the program invoking it, regardless of the level of trust in that program.

Dept. of CS&E, MITE, Moodabidri pg. 11

CLOUD COMPUTING -BCS601

The existence of trusted paths, mechanisms supporting user interactions with trusted software, is critical for
system security. When such mechanisms do not exist, malicious software can impersonate trusted software.
Some systems allow servers to authenticate their clients and provide trusted paths for a few functions, such as
login authentication and password changing. A solution to the trusted path problem is to decompose a complex
mechanism into several components with well-defined roles.

For example, the access control mechanism for the application space could consist of enforcer and decider
components. To access a protected object, the enforcer will gather the required information about the agent
attempting the access, will pass this information to the decider together with the information about the object
and the elements of the policy decision; finally, it will carry out the actions requested by the decider.
A trusted path mechanism is required to prevent malicious software invoked by an authorized application from
tampering with the attributes of the object and/or with the policy rules. A trusted path is also required to prevent
an impostor from impersonating the decider agent. A similar solution is proposed for the cryptography usage,
which should be decomposed into an analysis of the invocation mechanisms and an analysis of the
cryptographic mechanism. Another question is how an OS can protect itself and applications running under it
from malicious mobile code attempting to gain access to data and other resources and compromise system
confidentiality and/or integrity. Java Security Manager uses the type-safety attributes of Java to prevent
unauthorized actions of an application running in a “sandbox.” Yet, the Java Virtual Machine (JVM) accepts
byte code in violation of language semantics; moreover, it cannot protect itself from tampering from other
applications.
Even if these security problems could be eliminated, the security relies on the ability of the file system to
preserve the integrity of the Java class code. Requiring digitally signed applets and accepting them only from
trusted sources could fail due to the all-or-nothing security model. A solution to securing mobile
communications could be to confine a browser to a distinct security domain. Specialized closed-box platforms
such as the ones on some cellular phones, game consoles, and Automatic Teller Machines (ATMs) could have
embedded cryptographic keys that allow themselves to reveal their identity to remote systems and authenticate
the software running on them. Such facilities are not available to open-box platforms, the traditional hardware
designed for commodity operating systems.
A highly secure operating system is necessary but not sufficient. Application-specific security is also
necessary. Sometimes, security implemented above the operating system is better, e.g., electronic commerce
requires a digital signature on each transaction.
Operating systems provide only weak mechanisms for applications to authenticate one another and do not
have a trusted path between users and applications. These shortcomings add to the challenges of providing
security in a distributed computing environment. For example, a financial application cannot determine if a

Dept. of CS&E, MITE, Moodabidri pg. 12

CLOUD COMPUTING -BCS601

request comes from an authorized user or from a malicious program; in turn, a human user cannot distinguish
a response from a malicious program impersonating the service from the response provided by the service.

11.8 VIRTUAL MACHINE SECURITY

Virtual security services are typically provided by the hypervisor, as shown in Figure 11.3A, while another
alternative is to have a dedicated VM providing security services, as seen in Figure 11.3B. A secure Trusted
Computing Base (TCB) is a necessary condition for security in a VM environment. If the TCB is
compromised, the security of the entire system is affected.

Figure 11.3
(A) Virtual security services provided by the hypervisor/Virtual Machine Monitor
(B) A dedicated security VM

The analysis of Xen and vBlades shows that VM technology provides stricter isolation between VMs than the
isolation of processes in traditional operating systems. A hypervisor controls privileged operations and can
enforce memory isolation, disk access, and network access. Hypervisors are less complex and better structured
than traditional OSs, so they are in a better position to respond to security attacks.

However, a hypervisor only sees raw data about the state of a guest OS, while security services typically
operate at a higher logical level (e.g., at the file level rather than the disk block level). A guest OS runs on
simulated hardware, and the hypervisor has access to the state of all VMs running on the same hardware. The
hypervisor can save, restore, clone, and encrypt the state of a guest VM. Replication can enhance reliability
and security, while cloning could help recognize malicious applications by testing them in a cloned system
and observing their behavior.

Dept. of CS&E, MITE, Moodabidri pg. 13

CLOUD COMPUTING -BCS601

Another approach could involve moving the guest VM's files to a dedicated security VM, which would protect
it from attacks. This is possible because inter-VM communication is faster than communication between
physical machines. Sophisticated attackers may fingerprint VMs to avoid VM honeypots designed for studying
attack methods. They can also attempt to access VM-logging files and recover sensitive data, which must be
carefully protected to prevent unauthorized access to cryptographic keys and other sensitive information.

While virtualization offers better security, it comes at a price, including:

1. Higher hardware costs: Virtual systems require more resources such as CPU cycles, memory, disk,
and network bandwidth.

2. Development costs: Developing hypervisors and modifying host operating systems (in the case of
paravirtualization).

3. Overhead: The hypervisor's involvement in privileged operations introduces overhead.

VM-based intrusion detection systems, such as Livewire and Siren, utilize the three capabilities of a VM:
intrusion detection, isolation, inspection, and interposition. Resource isolation, inspection (where the
hypervisor can review the state of guest VMs), and interposition (where the hypervisor can trap and emulate
privileged instructions) are key features. VM-based intrusion prevention systems like SVFS, NetTop, and
IntroVirt, as well as the Terra trust computing platform, are also discussed. Terra partitions resources among
VMs using a trusted hypervisor.

NIST security group categorizes threats into hypervisor-based and VM-based threats. Some of the
hypervisor-based threats include:

1. Starvation of resources and denial of service for some VMs

Causes:

o Badly configured resource limits for some VMs.

o A rogue VM bypassing resource limits set by the hypervisor.

2. VM side-channel attacks
Causes:

o Lack of proper isolation of inter-VM traffic due to misconfigured virtual networks.

o Insufficient packet inspection devices to handle high-speed traffic (e.g., video traffic).

o Use of insecure VM images, such as a guest OS without the latest patches.

Dept. of CS&E, MITE, Moodabidri pg. 14

CLOUD COMPUTING -BCS601

3. Buffer overflow attacks.

VM-based threats include:

1. Deployment of rogue or insecure VMs

Causes:

o Unauthorized users creating insecure instances or performing unauthorized administrative actions on

existing VMs.

o Improper configuration of access controls on VM administrative tasks like creating, launching, suspending,
or re-activating instances.

2. Presence of insecure or tampered VM images

Causes:

o Lack of access control to the VM image repository.

o Lack of mechanisms to verify the integrity of the images (e.g., not digitally signing images).

11.10 Security Risks Posed by Shared Images

The security risks that arise when cloud users share virtual machine images (VMIs), especially in the
Infrastructure as a Service (IaaS) cloud model. One common practice in cloud services like AWS is using pre-
built Amazon Machine Images (AMIs) for quick setup of virtual machines. These AMIs can be shared publicly,
which raises concerns about potential security risks.

1. Creating an AMI:
• An AMI can be created from a running system, another AMI, or a virtual machine image.
• This image is bundled (i.e., compressed and encrypted) before it’s uploaded to cloud storage (S3).
2. Risks from Shared AMIs:
• Shared AMIs might contain sensitive data like private keys, credentials, or passwords if the image
creator fails to remove them.
• Some shared images may include backdoors, allowing malicious creators to access any instance
launched from the AMI.
3. Findings from AMI Audits:
• A study found that many AMIs (especially Linux ones) had critical vulnerabilities. For example, 22%
of Linux AMIs contained credentials that allowed attackers to remotely access the system.

Dept. of CS&E, MITE, Moodabidri pg. 15

CLOUD COMPUTING -BCS601

• AMIs can have backdoors through SSH keys or passwords that the original creator did not remove.
For instance, a malicious creator could leave their SSH key, enabling them to access any system
launched from the AMI.
• Unsolicited connections: Some shared AMIs could send privileged information, like login events, to
outside agents.
• Malware: Some AMIs contained malware such as Trojans or spyware that could harm the system.
4. Other Risks:
• Sensitive files might not be properly deleted in shared AMIs, and attackers can recover these files
using tools.
• API keys, IP addresses, and other sensitive data might be exposed in these shared AMIs.
• Some AMIs were found with old and vulnerable software versions, increasing the risk of exploits.
5. Mitigation:
• Users need to be aware of the risks when using shared AMIs. It's important to scrub (erase) sensitive
data and avoid using outdated or insecure images.
• Tools like shred or wipe can be used to securely delete sensitive information from an image.

11.11 SECURITY RISKS POSED BY A MANAGEMENT OS

We often hear that virtualization enhances security because a VM monitor or hypervisor is considerably
smaller than an operating system. A hypervisor supports a stronger isolation between the VMs running under
it than the isolation between processes supported by a traditional operating system. Yet the hypervisor must
rely on a management OS to create VMs and transfer data in and out from a guest VM to storage devices and
network interfaces.

A small hypervisor can be carefully analyzed, thus one could conclude that the security risks in a virtual
environment are diminished. We must be cautious with such sweeping statements. Indeed, the Trusted
Computer Base (TCB) of a cloud computing environment includes not only the hypervisor but also the
management OS. The management OS supports administrative tools, live migration, device drivers, and
device emulators.

For example, the TCB of an environment based on Xen includes not only the hardware and the hypervisor,
but also the management operating system running in Dom0, see Figure 11.4. System vulnerabilities can be
introduced by both software components, Xen and the management operating system. An analysis of Xen
vulnerabilities reports that 21 of the 23 attacks were against service components of the control VM ; 11 attacks

Dept. of CS&E, MITE, Moodabidri pg. 16

CLOUD COMPUTING -BCS601

were attributed to problems in the guest OS caused by buffer overflow and 8 were denial of service attacks.
Buffer overflow allows execution of arbitrary code in the privileged mode.

Dom0 manages the building of all user domains (DomU), a process consisting of several steps:

1. Allocate memory in the Dom0 address space and load the kernel of the guest OS from secondary
storage.

2. Allocate memory for the new VM and use foreign mapping to load the kernel to the new VM. The
foreign mapping mechanism of Xen is used by Dom0 to map arbitrary memory frames of a VM into its page
tables.

3. Set up the initial page tables for the new VM.

4. Release the foreign mapping on the new VM memory, set up the virtual CPU registers, and launch the
new VM.

Security Risks from a Malicious Dom0

A malicious Dom0 can play several nasty tricks at the time when it creates a DomU :

• Denial-of-Service: Refuse to carry out the steps necessary to start the new VM.

• Kernel Modification: Modify the kernel of the guest OS to allow a third party to monitor and control
applications running under the new VM.

• Integrity Attacks: Undermine the integrity of the new VM by setting the wrong page tables and/or setting
wrong virtual CPU registers.

• Memory Access: Refuse to release the foreign mapping and access the memory while the new VM is
running.

Run-Time Interaction Between Dom0 and DomU

Recall that Dom0 exposes a set of abstract devices to the guest operating systems using split drivers; the
frontend of such a driver is in the DomU, and its backend is in Dom0. The two communicate via a ring in
shared memory.

In the original implementation of Xen, a service running in a DomU sends data to or receives data from a
client located outside the cloud using a network interface in Dom0. It transfers the data to I/O devices using a
device driver in Dom0. Note that later implementations of Xen offer the pass-through option. Therefore, we
need to ensure that run-time communication through Dom0 is encrypted.

Dept. of CS&E, MITE, Moodabidri pg. 17

CLOUD COMPUTING -BCS601

Yet, Transport Layer Security (TLS) does not guarantee that Dom0 cannot extract cryptographic keys from
the memory of the OS and applications running in DomU. A significant security weakness of Dom0 is that the
entire state of the system is maintained by XenStore. A malicious VM can deny access to this critical element
of the system to other VMs, and it can also gain access to the memory of a DomU. This brings us to additional
requirements for confidentiality and integrity imposed on Dom0.

Securing Communication Between Dom0 and DomU

Dom0 should be prohibited from using foreign mapping for sharing memory with a DomU unless the DomU
initiates the procedure in response to a hypercall from Dom0. When this happens, Dom0 should be provided
with an encrypted copy of the memory pages and of the virtual CPU registers. The entire process should be
closely monitored by the hypervisor which, after the access, should check the integrity of the affected DomU.

Ensuring Secure Virtualization

A virtualization architecture that guarantees confidentiality, integrity, and availability for the TCB of a Xen-
based system is presented. A secure environment when Dom0 cannot be trusted can only be ensured if the
guest application is able to store, communicate, and process data safely. The guest software should have access
to a secure secondary storage on a remote storage server and to the network interfaces when communicating
with the user. A secure run-time system is also needed.

To implement a secure run-time system, we must intercept and control the hypercalls used for communication
between a Dom0 that cannot be trusted and a DomU we want to protect. Hypercalls issued by Dom0 that do
not read from or write to the memory of a DomU or to its virtual registers should be allowed. Other hypercalls
should be restricted either completely or during a specific time window. For example, hypercalls used by
Dom0 for debugging or for the control of the IOMMU should be prohibited. The Input/Output Memory
Management Unit (IOMMU) connects the main memory with a DMA-capable I/O bus; it maps device-visible
virtual addresses to physical memory addresses and provides memory protection from misbehaving devices.

We cannot restrict some of the hypercalls issued by Dom0, even though they can be harmful to the security of
DomU. For example, foreign mapping and access to the virtual registers are needed to save and restore the
state of DomU. We should check the integrity of DomU after the execution of such security-critical hypercalls.

Dept. of CS&E, MITE, Moodabidri pg. 18

CLOUD COMPUTING -BCS601

New hypercalls are necessary to protect:

1. The privacy and integrity of the virtual CPU of a VM. When Dom0 wants to save the state of the VM the
hyper call should be intercepted, and the contents of the virtual CPU registers should be encrypted. The virtual
CPU context should be decrypted and then an integrity check should be carried out when DomU is restored.

2. The privacy and integrity of the VM virtual memory. The page table update hyper call should be intercepted
and the page should be encrypted so that Dome handles only encrypted pages of the VM. The hypervisor
should calculate a hash of all the memory pages before they are saved by Dom0 to guarantee the integrity of
the system. An address translation is necessary because a restored DomU may be allocated a different memory
region.

3. The freshness of the virtual CPU and the memory of the VM. The solution is to add to the hash a version
number.

11.12 XOAR – BREAKING THE MONOLITHIC DESIGN OF THE TCB

Xoar is a modified version of Xen designed to improve system security by applying a microkernel design and
breaking away from the monolithic design of the Trusted Computing Base (TCB). This design approach helps
reduce the attack surface by modularizing the system and limiting each component’s privileges to only what
is necessary. Xoar’s security model assumes a trusted system administrator and aims to protect against threats
from guest VMs, which might attempt to compromise the confidentiality or integrity of other VMs. Xoar
focuses on minimizing the system’s permanent footprint, controlling privilege escalation, and ensuring that

Dept. of CS&E, MITE, Moodabidri pg. 19

CLOUD COMPUTING -BCS601

any component sharing is explicit and logged. Although the modularity introduces some overhead, the goal is
to ensure that critical security functions are isolated and auditable.

The Xoar system categorizes its components into four types: permanent, self-destructing, restarted on
request, and restarted on a timer. Permanent components, like XenStore-State, maintain the system’s state.
Self-destructing components help with booting but are discarded after the process. Components that are
restarted upon request, such as XenStore-Logic and Toolstack, handle VM management and operations.
Components restarted on a timer, like BlkBack and NetBack, manage the physical storage and network drivers.

A key feature of Xoar is its secure auditing mechanism, which logs actions such as VM creation, deletion, or
restart in a secure, append-only database. To ensure that the system remains in a known good state, Xoar uses
snapshots instead of rebooting, which reduces the overhead and startup time. These snapshots preserve the
state of the system before interactions with other services or VMs, providing a secure and efficient way to
maintain system integrity.

Figure 11.5
Xoar’s component types and their interactions, where the Builder and XenStore components are shared across
guest VMs, and certain components like QEMU handle device emulation.

Dept. of CS&E, MITE, Moodabidri pg. 20

CLOUD COMPUTING -BCS601

Figure 11.6
Component sharing between guest VMs in Xoar, showing that only the XenStore components are shared,
while other components like BlkBack, NetBack, and Toolstack are kept private for each VM.

11.13 A TRUSTED HYPERVISOR

A trusted hypervisor is designed to provide a secure environment for both traditional operating systems and
applications requiring high levels of security, such as financial and electronic voting systems. It enables the
creation of a software stack tailored to specific needs, providing minimal OS functionality for high-security
applications while offering a full OS for less critical applications. The hypervisor operates at the highest
privilege level, ensuring airtight isolation even from the platform owner.

One of the key features of a trusted hypervisor is its ability to support trusted paths for user-application
interaction, cryptographic attestation for application identity verification, and secure access controls for device
drivers. Device drivers, particularly for high-end hardware like wireless cards and video cards, are a major
source of security risks, as they are often large, poorly written, and may pose security threats. Therefore, the
trusted hypervisor limits the access of device drivers to sensitive information and applies hardware protection
mechanisms to prevent attacks via malicious I/O devices.

11.14 MOBILE DEVICES AND CLOUD SECURITY

Mobile devices play a significant role in the cloud ecosystem by utilizing cloud services for data storage and
computation. However, mobile devices face unique security challenges due to their constant connectivity to
untrusted networks and frequent use of third-party applications. The main security concerns for mobile devices
include data confidentiality, integrity, and availability, as well as the risk of non-repudiation issues. These

Dept. of CS&E, MITE, Moodabidri pg. 21

CLOUD COMPUTING -BCS601

devices are vulnerable to threats like mobile malware, unauthorized access, and electronic eavesdropping,
which can also affect the connected cloud infrastructure.

To mitigate these risks, several precautions should be taken, such as using encryption for storage and
communication, isolating applications through sandboxing, and performing device integrity checks.
Additionally, mobile devices must be protected from theft or loss by implementing proper access control
mechanisms, including lock screens and encryption. Mobile Device Management (MDM) and Mobile
Application Management (MAM) services are essential for managing security policies, enforcing compliance,
and monitoring mobile devices' security status.

4.6 CLOUD SECURITY AND TRUST MANAGEMENT

Lack of trust between service providers and cloud users has hindered the universal acceptance of cloud
computing as an on-demand service. In the past, trust models have been developed primarily to protect e-
commerce and online shopping platforms such as eBay and Amazon. However, for web and cloud services,
trust and security become even more demanding. This is because completely leaving user applications to cloud
providers has faced strong resistance from most PC and server users. Cloud platforms raise concerns for some
users regarding privacy protection, security assurance, and copyright protection. Trust is a social issue, not
just a technical one. However, the social problem can be addressed with technical solutions.

It is widely accepted that technology can enhance trust, justice, reputation, credit, and assurance in Internet
applications. As a virtual environment, the cloud introduces new security threats that are more challenging to
contain than traditional client-server configurations. To address these trust issues, a new data-protection model
is presented in this section. In many cases, existing trust models for P2P networks and grid systems can be
extended to protect clouds and data centers.

4.6.1 Cloud Security Defense Strategies

A healthy cloud ecosystem is crucial to protect users from abuses, violence, hacking, viruses, rumors,
pornography, spam, and violations of privacy and copyright. The security requirements for three cloud service
models— IaaS, PaaS, and SaaS— are discussed in this section. These security models are based on various
SLAs between providers and users.

[Link] Basic Cloud Security

Three essential cloud security enforcements are expected:

1. Facility Security: Data centers need to ensure on-site security year-round. This can include biometric
readers, CCTV (close-circuit TV), motion detection, and man traps.

Dept. of CS&E, MITE, Moodabidri pg. 22

CLOUD COMPUTING -BCS601

2. Network Security: This requires fault-tolerant external firewalls, intrusion detection systems (IDSes),
and third-party vulnerability assessments.

3. Platform Security: This demands SSL encryption, data decryption, strict password policies, and
system trust certification.

Figure 4.31 illustrates the mapping of cloud models where specific security measures are implemented at
various levels.

• Servers in the cloud can be physical machines or virtual machines (VMs).

• User interfaces are applied to request services, and provisioning tools carve out the systems from the cloud
to fulfill the request.

•A security-aware cloud architecture mandates the enforcement of security protocols to protect against
malware-based attacks like network worms, viruses, and DDoS attacks that exploit system vulnerabilities.

Dept. of CS&E, MITE, Moodabidri pg. 23

CLOUD COMPUTING -BCS601

• These attacks compromise system functionality or provide unauthorized access to critical information.

Security defenses are necessary to protect all cluster servers and data centers. Key areas that require protection
include:

• Protection of servers from malicious software attacks like worms, viruses, and malware.

• Protection of hypervisors or VM monitors from software-based attacks and vulnerabilities.

• Protection of VMs and monitors from service disruptions and DoS attacks.

• Protection of data and information from theft, corruption, and natural disasters.

• Providing authenticated and authorized access to critical data and services.

[Link] Security Challenges in VMs

Traditional network attacks such as buffer overflows, DoS attacks, spyware, malware, rootkits, Trojan horses,
and worms are common. In a cloud environment, new attacks may arise from hypervisor malware, guest
hopping, hijacking, or VM rootkits. Another form of attack is the man-in-the-middle attack during VM
migrations. Passive attacks typically steal sensitive data, while active attacks manipulate kernel data
structures, causing significant damage to cloud servers.

To combat these threats, an IDS can be a Network IDS (NIDS) or Host-based IDS (HIDS). Other defense
technologies include:

• Program Shepherding: Applied to control and verify code execution.

• Security Compliance: Tools like VMware’s vSafe and vShield.

• Intel vPro Technology: Provides additional security compliance.

• Hardened OS Environment: Ensures more robust security by isolating execution environments.

[Link] Cloud Defense Methods

Virtualization enhances cloud security, but it also introduces additional risks. For example, VMs, which are
software representations of physical hardware, are isolated for better security. This isolation prevents attacks
in one VM from affecting others. VM failures are contained and do not propagate to other VMs.

Table 4.9 lists eight protection schemes to secure public clouds and data centers:

Dept. of CS&E, MITE, Moodabidri pg. 24

CLOUD COMPUTING -BCS601

Protection Schemes Brief Description and Deployment Suggestions

Secure Data Centers and Buildings Ensure hazard-free locations and enforce building
safety (e.g., earthquake-proof structures, camera
surveillance).

Use Redundant Utilities at Multiple Deploy multiple power and network connections, data
Sites consistency, and data watermarking.

Trust Delegation and Negotiation Cross certificates for trust delegation and resolution of
policy conflicts.

Worm Containment and DDoS Internet worm containment and defense against DDoS
Defense attacks.

Reputation System for Data Centers Build a hierarchy of reputation systems to manage trust
across data centers.

Fine-Grained File Access Control Enhance security with access control at the file or
object level.

Copyright Protection and Piracy Implement anti-piracy measures like peer collusion
Prevention prevention and alteration detection.

Privacy Protection Use double authentication, biometric identification,

and data watermarking.

[Link] Defence with Virtualization

Virtualization decouples the VM from physical hardware, enabling it to be treated as software. This decoupling
allows VMs to be saved, cloned, encrypted, moved, or restored easily. VMs also enhance High Availability
(HA) and facilitate faster disaster recovery.

Live migration of VMs has been suggested for building distributed intrusion detection systems (DIDSes).
Multiple IDS VMs can be deployed at various sites within the cloud infrastructure, supporting real-time
security monitoring. Trust negotiation, especially at the SLA level, is critical to resolving security policy
conflicts.

Dept. of CS&E, MITE, Moodabidri pg. 25

CLOUD COMPUTING -BCS601

[Link] Privacy and Copyright Protection

A secure cloud platform requires several features to safeguard privacy and protect against copyright violations:

• Dynamic web services supporting secure web technologies.

• Established trust between users and providers through SLAs and reputation systems.

• Effective identity and data-access management.

• Single sign-on and single sign-off mechanisms to streamline security enforcement.

• Auditing and copyright compliance through proactive enforcement.

For example, Amazon EC2 employs HMEC and X.509 certificates for securing resources, while Google’s
platform applies in-house software to protect data.

Example 4.7 Cloud Security Safeguarded by Gateway and Firewalls

Figure 4.32 shows a security defense system for a typical private cloud environment. The gateway is secured
to protect access to commercial clouds that are open to the public. The firewall provides an external shield,
ensuring that user data remains secure and protected from unauthorized access.

4.6.2 Distributed Intrusion/Anomaly Detection

Data security is the weakest link in all cloud models. New cloud security standards are needed to apply
common API tools to cope with the data lock-in problem and address network attacks or abuses. The IaaS
model, represented by Amazon, is most sensitive to external attacks. Role-based interface tools help alleviate
the complexity of the provisioning system. For example, IBM’s Blue Cloud provisions through a role-based

Dept. of CS&E, MITE, Moodabidri pg. 26

CLOUD COMPUTING -BCS601

web portal. A SaaS bureau may order secretarial services from a common cloud platform. Many IT companies
are now offering cloud services without guaranteed security.

Security threats may target VMs, guest OSes, and software running on top of the cloud. Intrusion Detection
Systems (IDS) attempt to stop these attacks before they take effect. Both signature matching and anomaly
detection can be implemented on VMs dedicated to building IDSes. Signature-matching IDS technology is
more mature but requires frequent updates of the signature databases. Network anomaly detection reveals
abnormal traffic patterns, such as unauthorized episodes of TCP connection sequences, against normal traffic
patterns. Distributed IDSes are needed to combat both types of intrusions.

[Link] Distributed Defense against DDoS Flooding Attacks

A Distributed Denial of Service (DDoS) defense system must be designed to cover multiple network domains
spanned by a given cloud platform. These network domains cover the edge networks where cloud resources
are connected. DDoS attacks come with widespread worms, and the flooding traffic is large enough to crash
the victim server by buffer overflow, disk exhaustion, or connection saturation.

Figure 4.33(a) shows a flooding attack pattern, where the hidden attacker launched the attack from many
zombies toward a victim server at the bottom router R0.

Dept. of CS&E, MITE, Moodabidri pg. 27

CLOUD COMPUTING -BCS601

The flooding traffic flows in a tree pattern shown in Figure 4.33(b). Successive attack-transit routers along the
tree reveal the abnormal surge in traffic. This DDoS defense system is based on change-point detection by all
routers. Based on the anomaly pattern detected in covered network domains, the scheme detects a DDoS attack
before the victim is overwhelmed. The detection scheme is suitable for protecting cloud core networks.
Provider-level cooperation eliminates the need for intervention by edge networks.

Example 4.8 Man-in-the-Middle Attacks

Figure 4.34 shows VM migration from host machine VMM A to host machine VMM B via a security-
vulnerable network. In a man-in-the-middle attack, the attacker can view the VM contents being migrated,
steal sensitive data, or even modify the VM-specific contents, including the OS and application states. An
attacker posing this threat can launch an active attack to insert a VM-based rootkit into the migrating VM,
which can subvert the entire operation of the migration process without the knowledge of the guest OS and
embedded applications.

4.6.3 Data and Software Protection Techniques

In this section, we introduce a data coloring technique to preserve data integrity and user privacy. We will also
discuss a watermarking scheme to protect software files from being widely distributed in a cloud environment.

[Link] Data Integrity and Privacy Protection

Users desire a software environment that provides many useful tools to build cloud applications over large
datasets. In addition to application software for MapReduce, BigTable, EC2, 3S, Hadoop, AWS, GAE, and
WebSphere, users need some security and privacy protection software for using the cloud. Such software
should offer the following features:

• Special APIs for authenticating users and sending emails using commercial accounts.

• Fine-grained access control to protect data integrity and deter intruders or hackers.

Dept. of CS&E, MITE, Moodabidri pg. 28

CLOUD COMPUTING -BCS601

• Shared datasets protected from malicious alteration, deletion, or copyright violation.

• Ability to secure the ISP or cloud service provider from invading users' privacy.

• Personal firewalls at user ends to keep shared datasets from Java, JavaScript, and ActiveX applets.

• A privacy policy consistent with the cloud service provider’s policy to protect against identity theft, spyware,

and web bugs.

• VPN channels between resource sites to secure the transmission of critical data objects.

[Link] Data Coloring and Cloud Watermarking

With shared files and datasets, privacy, security, and copyright information could be compromised in a cloud
computing environment. Users desire to work in a trusted software environment that provides useful tools to
build cloud applications over protected datasets. In the past, watermarking was mainly used for digital
copyright management. As shown in Figure 4.35, the system generates special colors for each data object.
Data coloring means labeling each data object with a unique color. Differently colored data objects are thus
distinguishable.

The user identification is also colored to be matched with the data colors. This color matching process can be
applied to implement different trust management events. Cloud storage provides a process for the generation,
embedding, and extraction of watermarks in colored objects. Interested readers may refer to the articles by
Hwang and Li for details on the data coloring and matching process. In general, data protection was
traditionally done by encryption or decryption, which is computationally expensive. The data coloring
technique requires a minimal number of calculations to color or decolor the data objects. Cryptography and
watermarking or coloring can be used jointly in a cloud environment.

Dept. of CS&E, MITE, Moodabidri pg. 29

CLOUD COMPUTING -BCS601

Figure 4.35: Data coloring with cloud watermarking for trust management at various security clearance levels
in data centers. (Courtesy of Hwang and Li)

[Link] Data Lock-in Problem and Proactive Solutions

Cloud computing moves both the computation and the data to the server clusters maintained by cloud service
providers. Once the data is moved into the cloud, users cannot easily extract their data and programs from
cloud servers to run on another platform. This leads to a data lock-in problem. This has hindered the use of
cloud computing. Data lock-in is attributed to two causes: lack of interoperability, whereby each cloud vendor
has its proprietary API that limits users to extract data once submitted; and lack of application compatibility,
in that most computing clouds expect users to write new applications from scratch, when they switch cloud
platforms.
One possible solution to data lock-in is the use of standardized cloud APIs. This requires building standardized
virtual platforms that adhere to OVF, a platform-independent, efficient, extensible, and open format for VMs.
This will enable efficient, secure software distribution, facilitating the mobility of VMs. Using OVF one can
move data from one application to another. This will enhance QoS, and thus enable cross-cloud applications,
allowing workload migration among data centers to user-specific storage. By deploying applications, users
can access and intermix applications across different cloud services.

4.6.4 Reputation-Guided Protection of Data Centers

Trust is a personal opinion, which is very subjective and often biased. Trust can be transitive but not
necessarily symmetric between two parties. Reputation is a public opinion, which is more objective and often
relies on a large opinion aggregation process to evaluate. Reputation may change or decay over time. Recent
reputation should be given more preference than past reputation. In this section, we review the reputation
systems for protecting data centers or cloud user communities.

[Link] Reputation System Design Options

Figure 4.36 provides an overview of reputation system design options. Public opinion on the character or
standing (such as honest behavior or reliability) of an entity could be the reputation of a person, an agent, a
product, or a service. It represents a collective evaluation by a group of people/agents and resource owners.
Many reputation systems have been proposed in the past mainly for P2P, multiagent, or e-commerce systems.
To address reputation systems for cloud services, a systematic approach is based on the design criteria and
administration of the reputation systems. Figure 4.36 shows a two-tier classification of existing reputation
systems that have been proposed in recent years.

Dept. of CS&E, MITE, Moodabidri pg. 30

CLOUD COMPUTING -BCS601

Most of them were designed for P2P or social networks. These reputation systems can be converted for
protecting cloud computing applications. In general, the reputation systems are classified as centralized or
distributed depending on how they are implemented. In a centralized system, a single central authority is
responsible for managing the reputation system, while the distributed model involves multiple control centers
working collectively. Reputation-based trust management and techniques for securing P2P and social
networks could be merged to defend data centers and cloud platforms against attacks from the open network.

A centralized reputation system is easier to implement but demands more powerful and reliable server
resources; a distributed reputation system is much more complex to build. Distributed systems are more
scalable and reliable in terms of handling failures. At the second tier, reputation systems are further classified
by the scope of reputation evaluation. User-oriented reputation systems focus on individual users or agents.
Most P2P reputation systems belong to this category. In data centers, reputation is modeled for the resource
site as a whole. This reputation applies to products or services offered by the cloud. Commercial reputation
systems have been built by eBay, Google, and Amazon in connection with the services they provide. These
are centralized reputation systems.
Distributed reputation systems are mostly developed by academic research communities. Aberer and
Despotovic have proposed a model to manage trust in P2P systems. The Eigentrust reputation system was
developed at Stanford University using a trust matrix approach. The PeerTrust system was developed at
Georgia Institute of Technology for supporting e-commerce applications. The PowerTrust system was
developed at the University of Southern California based on Power law characteristics of Internet traffic for
P2P applications. Vu, et al. proposed a QoS-based ranking system for P2P transactions.

Dept. of CS&E, MITE, Moodabidri pg. 31

CLOUD COMPUTING -BCS601

[Link] Reputation Systems for Clouds

Redesigning the reputation systems for protecting data centers offers new opportunities for expanded
applications beyond P2P networks. Data consistency is checked across multiple databases. Copyright
protection secures wide-area content distributions. To separate user data from specific SaaS programs,
providers take the most responsibility in maintaining data integrity and consistency. Users can switch among
different services using their own data. Only the users have the keys to access the requested data.
The data objects must be uniquely named to ensure global consistency. To ensure data consistency,
unauthorized updates of data objects by other cloud users are prohibited. The reputation system can be
implemented with a trust overlay network. A hierarchy of P2P reputation systems is suggested to protect cloud
resources at the site level and data objects at the file level. This demands both coarse-grained and fine-grained
access control of shared resources. These reputation systems keep track of security breaches at all levels.
The reputation system must be designed to benefit both cloud users and data centers. Data objects used in
cloud computing reside in multiple data centers over a SAN. In the past, most reputation systems were
designed for P2P social networking or online shopping services. These reputation systems can be converted
to protect cloud platform resources or user applications in the cloud. A centralized reputation system is easier
to implement but demands more powerful and reliable server resources. Distributed reputation systems are
more scalable and reliable in terms of handling failures.
The five security mechanisms presented earlier can be greatly assisted by using a reputation system
specifically designed for data centers.
However, it is possible to add social tools such as reputation systems to support safe cloning of VMs. Snapshot
control is based on the defined RPO. Users demand new security mechanisms to protect the cloud. For
example, one can apply secured information logging, migrate over secured virtual LANs, and apply ECC-
based encryption for secure migration. Sandboxes provide a safe execution platform for running programs.
Further, sandboxes can provide a tightly controlled set of resources for guest operating systems, which allows
a security test bed to test the application code from third-party vendors.

[Link] Trust Overlay Networks

Reputation represents a collective evaluation by users and resource owners. Many reputation systems have
been proposed in the past for P2P, multiagent, or e-commerce systems. To support trusted cloud services,
Hwang and Li have suggested building a trust overlay network to model trust relationships among data-center
modules. This trust overlay could be structured with a distributed hash table (DHT) to achieve fast aggregation
of global reputations from a large number of local reputation scores. Here, the designer needs to have two
layers for fast reputation aggregation, updating, and dissemination to all users. Figure 4.37 shows construction
of the two layers of the trust overlay network.

Dept. of CS&E, MITE, Moodabidri pg. 32

CLOUD COMPUTING -BCS601

At the bottom layer is the trust overlay for distributed trust negotiation and reputation aggregation over
multiple resource sites. This layer handles user/server authentication, access authorization, trust delegation,
and data integrity control. At the top layer is an overlay for fast virus/worm signature generation and
dissemination and for piracy detection. This overlay facilitates worm containment and IDSes against viruses,
worms, and DDoS attacks. The content poisoning technique is reputation-based. This protection scheme can
stop copyright violations in a cloud environment over multiple data centers.
The reputation system enables trusted interactions between cloud users and data-center owners. Privacy is
enforced by matching colored user identifications with the colored data objects. The use of content poisoning
was suggested to protect copyright of digital content . The security-aware cloud architecture is specially
tailored to protect virtualized cloud infrastructure. The trust of provided cloud platforms comes from not only
SLAs, but also from effective enforcement of security policies and deployment of countermeasures to defend
against network attacks. By varying security control standards, one can cope with the dynamic variation of
cloud operating conditions. The design is aimed at a trusted cloud environment to ensure high-quality services,
including security.

Dept. of CS&E, MITE, Moodabidri pg. 33

CLOUD COMPUTING -BCS601

The cloud security trend is to apply virtualization support for security enforcement in data centers. Both
reputation systems and data watermarking mechanisms can protect data-center access at the coarse-grained
level and to limit data access at the fine-grained file level. In the long run, a new Security as a Service is
desired. This “SaaS” is crucial to the universal acceptance of web-scale cloud computing in personal, business,
community, and government applications. Internet clouds are certainly in line with IT globalization and
efficient computer outsourcing. However, interoperability among different clouds relies on a common
operational standard by building a healthy cloud ecosystem.

Dept. of CS&E, MITE, Moodabidri pg. 34