Brokered Cloud Storage Access Mechanism compiled src7cse@gmail.

com 25-Sep-2025 Pg 1 of 9

Brokered Cloud Storage Access Mechanism in Cloud Computing

Understanding Security of Cloud

Security Boundaries
A particular service model defines the boundary between the
responsibilities of service provider and customer. Cloud
Security Alliance (CSA) stack model defines the boundaries
between each service model and shows how different
functional units relate to each other. The following diagram
shows the CSA stack model:

[Link]

Brokered Cloud Storage Access Mechanism * This document is prepared partially from LLM models Pg 1 of 9
Brokered Cloud Storage Access Mechanism compiled src7cse@[Link] 25-Sep-2025 Pg 2 of 9

Key Points to CSA Model

​ IaaS is the most basic level of service with PaaS and SaaS next two above
levels of services.
​ Moving upwards, each of the service inherits capabilities and security
concerns of the model beneath.
​ IaaS provides the infrastructure, PaaS provides platform development
environment, and SaaS provides operating environment.
​ IaaS has the least level of integrated functionalities and integrated security
while SaaS has the most.
​ This model describes the security boundaries at which cloud service
provider's responsibilities end and the customer's responsibilities begin.
​ Any security mechanism below the security boundary must be built into the
system and should be maintained by the customer.

Although each service model has security mechanism, the security needs also
depend upon where these services are located, in private, public, hybrid or
community cloud.

Working Of Brokered Cloud Storage Access System

When the client issues request to access data:
​ The client data request goes to the external service interface of
proxy.
​ The proxy forwards the request to the broker.
​ The broker requests the data from cloud storage system.
​ The cloud storage system returns the data to the broker.
​ The broker returns the data to proxy.
​ Finally the proxy sends the data to the client.
All of the above steps are shown in the following diagram:

Brokered Cloud Storage Access Mechanism * This document is prepared partially from LLM models Pg 2 of 9
Brokered Cloud Storage Access Mechanism compiled src7cse@[Link] 25-Sep-2025 Pg 3 of 9

[Link]

In cloud computing, the brokered cloud storage access mechanism acts as an

intermediary layer between users (clients) and cloud service providers (such as AWS,
Azure, or Google Cloud). This mechanism enables a secure, managed, and efficient
method for accessing cloud storage services, ensuring seamless interaction with different
cloud environments.
The core functionality of a brokered access mechanism is to simplify the complexity
involved in managing multiple cloud storage systems, enhance security through access
control, and improve efficiency by optimizing the way data is stored, retrieved, and
managed.
Key Components of Brokered Cloud Storage Access
1. Broker (Intermediary)
○ The broker serves as an interface between users and cloud storage
providers.
○ It abstracts the complexities of different cloud service APIs, providing a
unified interface for users.

Brokered Cloud Storage Access Mechanism * This document is prepared partially from LLM models Pg 3 of 9
Brokered Cloud Storage Access Mechanism compiled src7cse@[Link] 25-Sep-2025 Pg 4 of 9

○ It handles authentication, authorization, and communication with cloud

storage services.
2. Authentication and Authorization
○ The broker ensures secure access by authenticating users using credentials
or other identity verification methods like OAuth.
○ It also manages authorization by checking if the user has permission to
access specific data or services.
○ Role-based access control (RBAC) is often used to regulate access
permissions.
3. Unified API
○ Instead of dealing with different APIs for each cloud service, users interact
with the broker’s unified API.
○ This allows for easier integration into applications, as the broker handles
the details of interacting with multiple cloud storage services.
4. Data Encryption and Security
○ The broker often handles data encryption (both at rest and in transit) to
ensure the security of data stored in the cloud.
○ It may also implement additional security measures like auditing, logging,
and monitoring.
5. Cost Optimization
○ A broker can monitor and optimize storage costs by analyzing the data
usage patterns, moving less frequently accessed data to lower-cost storage
tiers, or even switching between cloud providers.
Benefits of Brokered Cloud Storage Access
● Simplified Multi-cloud Management: Users can access storage across different
cloud providers without needing to understand the individual APIs or nuances of
each service.
● Improved Security: By centralizing access control and encryption at the broker
level, the mechanism enhances the security of cloud storage access.
● Cost Efficiency: The broker can help optimize storage costs by intelligently
managing data across various cloud tiers and providers.
● Scalability: It allows easy scaling across multiple cloud providers, without being
locked into one vendor.
Use Cases of Brokered Cloud Storage Access
1. Enterprise Data Management

Brokered Cloud Storage Access Mechanism * This document is prepared partially from LLM models Pg 4 of 9
Brokered Cloud Storage Access Mechanism compiled src7cse@[Link] 25-Sep-2025 Pg 5 of 9

○ Large enterprises often use multiple cloud providers for redundancy and
data backup. A brokered access mechanism simplifies managing these
disparate systems.
2. Data Compliance and Security
○ Industries such as finance and healthcare can use brokered access to enforce
stringent security and compliance requirements across multiple cloud
platforms.
3. Disaster Recovery and Backup
○ The broker can distribute data across several cloud providers, enhancing
data redundancy and ensuring that recovery is possible even if one provider
goes offline.
4. Hybrid Cloud Environments
○ Companies using a mix of private and public clouds can use brokers to
bridge the gap and create a seamless hybrid cloud experience.

Brokered Cloud Storage Access Mechanism * This document is prepared partially from LLM models Pg 5 of 9
 Brokered Cloud Storage Access Mechanism compiled src7cse@[Link] 25-Sep-2025 Pg 6 of 9

Comparison with Direct Cloud Storage Access

Feature Direct Access to Cloud Storage Brokered Cloud Storage Access
Mechanism

Complexity Users must manage multiple APIs and Simplifies access by providing a
authentication systems. unified API and authentication.

Security Security management is cloud Centralized security, encryption,

provider-specific. and access control.

Cost Efficiency Users need to manually manage Brokers can automate cost
cost-optimizing strategies. optimization across providers.

Flexibility Limited to a single provider or Allows seamless integration with

manual integration across multiple multiple cloud providers.
providers.

Scalability Scaling across multiple providers can Facilitates easy scaling across
be challenging. different cloud environments.

Vendor Lock-In More risk of being locked into a single Reduces lock-in by facilitating
cloud provider multi-cloud use

Brokered Cloud Storage Access in Practice

1. Amazon Cloud Storage Gateway provides an example of a brokered cloud access
mechanism where on-premises applications can access cloud storage seamlessly
without needing to directly interact with AWS services. It also integrates with
multiple cloud storage tiers and ensures secure data transmission.
2. Microsoft Azure Storage Access provides another example of using a unified API
through Azure’s services to broker access across various storage tiers like blob,
file, and table storage.

Brokered Cloud Storage Access Mechanism * This document is prepared partially from LLM models Pg 6 of 9
Brokered Cloud Storage Access Mechanism compiled src7cse@[Link] 25-Sep-2025 Pg 7 of 9

3. OpenStack Swift and Ceph are open-source cloud storage projects that can be
accessed via brokered mechanisms to manage object and block storage with a
focus on scalability and security.
Brokered Cloud Storage Access Mechanism in Cloud Computing
In cloud computing, a brokered cloud storage access mechanism is a system that mediates
between users and multiple cloud storage providers. It simplifies the process of accessing,
managing, and securing data across different cloud platforms by abstracting the
complexities of interacting with individual cloud providers. By doing this, it provides a
more unified, efficient, and secure approach to cloud storage access.
Key Functions of a Brokered Cloud Storage Access Mechanism
1. Unified Access:
○ A broker offers a unified API that abstracts the underlying complexities of
different cloud storage providers like AWS S3, Google Cloud Storage, or
Azure Blob Storage.
○ Users interact with a single interface rather than dealing with multiple cloud
storage APIs, allowing easier integration and interaction.
2. Authentication and Authorization:
○ The broker manages authentication and authorization processes, often using
systems like OAuth or API keys.
○ It can enforce role-based access control (RBAC), ensuring that only
authorized users can access specific data.
3. Data Encryption and Security:
○ Data is encrypted both at rest and in transit, with the broker often managing
the encryption keys.
○ The broker can enforce security policies and provide additional features
like monitoring, logging, and auditing to ensure compliance with security
standards.
4. Cross-Cloud Compatibility:
○ The broker facilitates access to multiple cloud providers, making it easier
for businesses to use a multi-cloud strategy.
○ It allows users to store and retrieve data from various cloud environments
seamlessly, without needing to worry about the specifics of each provider’s
storage system.
5. Performance Optimization:
○ The broker may optimize data storage by distributing it across different
cloud environments based on cost, performance, or latency requirements.

Brokered Cloud Storage Access Mechanism * This document is prepared partially from LLM models Pg 7 of 9
Brokered Cloud Storage Access Mechanism compiled src7cse@[Link] 25-Sep-2025 Pg 8 of 9

○ It can also implement caching mechanisms and ensure that data is retrieved
from the fastest or most cost-efficient storage.
6. Cost Efficiency:
○ By monitoring data access patterns, the broker can move infrequently
accessed data to lower-cost storage tiers or to different cloud providers that
offer better pricing.
○ It helps users avoid cloud vendor lock-in by distributing storage across
multiple providers.
Benefits of a Brokered Cloud Storage Mechanism
● Simplified Multi-Cloud Management: Users can manage data stored across
different cloud platforms through a single interface.
● Enhanced Security: Centralized management of authentication, encryption, and
access control improves data security.
● Cost Optimization: Brokers can automate the process of moving data between
different storage tiers and providers to optimize costs.
● Scalability: The broker can dynamically scale across different cloud providers to
accommodate growing data needs without manual intervention.
Use Cases of Brokered Cloud Storage Access
1. Hybrid Cloud Environments:
○ In hybrid cloud setups (a combination of private and public clouds), a
broker ensures seamless access to data across different environments,
enabling companies to store sensitive data on private clouds while using
public clouds for other applications.
2. Enterprise Data Management:
○ Large organizations with vast amounts of data often use multiple cloud
providers. A broker simplifies the management of data across these
different platforms.
3. Data Compliance and Governance:
○ For businesses operating in highly regulated industries (like healthcare or
finance), brokers help enforce compliance with data security and
governance policies by centralizing control and audit functions.

Brokered Cloud Storage Access Mechanism * This document is prepared partially from LLM models Pg 8 of 9
Brokered Cloud Storage Access Mechanism compiled src7cse@[Link] 25-Sep-2025 Pg 9 of 9

Comparison with Similar Mechanisms

1. API Gateways:
○ API Gateways provide similar functionality but for general API
management (not just storage). They centralize API requests,
authentication, and routing.
○ A brokered storage mechanism is focused specifically on cloud storage
access.
2. Cloud Management Platforms (CMPs):
○ CMPs help manage cloud resources, including storage, across multiple
cloud providers. However, they provide a broader range of cloud
management functions (e.g., compute, networking) compared to the
specialized storage focus of a brokered mechanism.
Popular Brokered Cloud Storage Examples
1. Cloud Storage Gateway (Amazon S3 Gateway):
○ Provides a way for on-premises applications to seamlessly use cloud
storage. It acts as an intermediary between the application and Amazon S3,
handling tasks like encryption, caching, and network optimization.
○ AWS Storage Gateway
2. Microsoft Azure Storage Access:
○ Azure offers various storage access options with unified APIs, simplifying
interactions with different storage types (Blob, File, Table storage).
○ Azure Storage Overview
3. Cloud Storage Management Services:
○ Providers like NetApp Cloud Volumes or OpenStack Swift help facilitate
brokered cloud access, especially in hybrid cloud environments.
○ OpenStack Swift
Conclusion
A brokered cloud storage access mechanism plays a crucial role in modern multi-cloud
and hybrid cloud environments. It simplifies interactions between users and cloud service
providers, enhances security, and optimizes cost and performance. As businesses
increasingly adopt multi-cloud strategies, brokered cloud storage access is becoming a
vital component of cloud architecture.

Brokered Cloud Storage Access Mechanism * This document is prepared partially from LLM models Pg 9 of 9
How to deal with storage location and tenancy compiled src7cse@[Link] 25-Sept-2025 Pg 2 of 7

[Link]
Here's a concise overview of dealing with storage location and tenancy for securing
data in cloud computing, along with an example case:

Storage location and multi-tenancy are crucial aspects of data security in cloud
computing. Cloud providers often store data across multiple geographic locations for
redundancy and performance. However, this can raise compliance and privacy
concerns. To address this:

1. Data residency: Ensure data is stored in locations that comply with relevant
regulations.
2. Data sovereignty: Be aware of laws governing data access in different
jurisdictions.
3. Encryption: Use strong encryption for data at rest and in transit.
4. Access controls: Implement robust identity and access management.
5. Tenant isolation: Ensure proper logical separation between different tenants'
data.

Example case: A multinational financial services company needs to store customer data
in the cloud while complying with various regional regulations. They work with a cloud
provider that offers:

● Region-specific data centers

● Strong encryption
● Virtual private cloud options
● Compliance certifications (e.g., ISO 27001, SOC 2)

How to deal with storage… This document is prepared partially from LLM models Pg 2 of 7
 uteyde j guol
svices have dutind
eleud rao fo touch
) A anagement

SiagDSevia Deluitim Selting

pdal
Otal templa can v
lolk ie ou
Ortobe
l
seiusdalel as dod

set up
( e sterage lfini
tnplate fer servi
pature o [Link]
Tuis
wsers Manggnent)
cuatome relan
Ineraein(sLA
2) Tentabout managing leul agreml
Steglis sLA(semiu at
up
eting dieno ndentano tues4
and enureo
ve guarantes tc

Exale'c qnd guor wthd

repne
Servius
Sehag sypport
cubtomer
 Runtima, manogununt
onlio orindinidu
lvojwa bringng seio
Erding
iajane t ia cient ho |ongr
Aleting

AxAmple Seria company

up tr Sterace
sigrs
As Jiertan inatay
CYeats

can ac

Staga4Senia Optzation
Snvolus tunng servie,
inca wser
performao Bal
perermana
twears n
fedl batk
exampll The company, te
spedo ore o irereas
1hg

Main the ce
fainerisue as
Operotion
Stoge 5 monierng hen conducig
>]nvdws adagasig
thy appeor
ond
maintaunene. Aopota nomed
iena ne andore b
Oonaured that fheir wAae Corre cty
 (scuss
cloud storaqg seriie -pr
ie d u e reciue autnatd
ver Customar

inveice

nolongrineedothe serie
ed & y
wnen iien °complet
pronder
’
tne sevia olievt
taak
renaid
eientts data
cantactual
e h t
agremet one
staglmale
and ay

(dantity Managnen
jahdod that aye
Pidertity verHcahm oe

Open(D 2r0 urU

A pratocol ro Ringla
A accoum hat
single hentcate
(ie

fologin
CAe fo enen
 to,
Ye enteing Crdetal
how tt worS

presuted to sevie tu
acers to
ckA oth openD provider
The seve

Asertin Morkup ag
hat exdhangesauthentiat
4nasstandord
uTn [Link]
povbr

oboto
ASA ML to SOrvice
acces muttple
one and

e>0Auth acce totu

Stendrd hat provdo
open
S0eareleras to acon LAer in
")Alows
accers toens
nolp q
 Ckarpy. Servido tho s0cil mwdlo apip
veqest im acue to mail açron
wseo Acth bns natad
cvedenial
toten trom idaty
senvie re qusta
proiar eogorary acs
giues soeria
akk totthout
spee

Data fortalblity Project Creaty

An induoty g
Shanderdo ferdta'
injeroperolelity erviuo to
rags oloud be movel
eEeou to
’Wse i p t lloas da Opiatiy
b/ platfmsand

jeatne ute importi

Gnable rom one
Exarplacontacto whout mana
anotor
ernterrg data
re
 Dncptionin coud ctorg
data loy meklng
Lereryptm s2cureo
to anaudhoigeser
protects tae data han it ts siored (dota at veat)
and frthe, cloud

seaitve fo
enareanat Omauthomd
neryptn
npYVata/ secUvO hrom
ven
data
nab to
accer hackg eun

eoe)
Pegal
tunt in cloudforg

aea jn ctoud
pVatE
behueo
sore enyidtion
Sale and
apS data acceA
cloud Advantages d clouo Storag
ad ata
roliakaity
aahene,
Ram

Example otta Seyeale

accourt
cveate upo 5
)
uing dyerent
 creating [Link] sa
naLsre suNty oy -fo

Teduca acesd
is uke ong
is neesoato
nd read data.
wth cere
managad
aidbereg
should iereal,
bayenchcala
lccyde
y Delined uy
in becured rage
acen
-basd
wth ou EnuYe. y
led Backup.
Autom
Preuat
aye beCheacidbutal
d

cuofent
and allsws
wndle puysota mare
martnoce

teLel6t9-3 doiged for shored

Set rales might
clo4d t
ceises dta n - both sterase
a how to SCUYe,
Covers
 Anditng
Lo;aing Racordirg
eros
toys to manttyr
A

curity breacha
ndutrty Se ytau
kalps to
’illegal acthvit adendttng

’ln clbud compurg

haure

sogice provider
iterent Cloud
ing rmats

ronty cloud Srehuans

Hutitehdnt nature g (ocotn:
multple
acovoss
ahd stoed
Compiand amd
Jetion
Raplei System muat be
data and
ourity Piay
olicat housseoritg
forse
mavnagea tor cing thest rgulaton
cheuta Ore uaually reapmaible tor coplhane
oing od prouider
un hen Sevtcea
 Dncptionin coud ctorg
data loy meklng
Lereryptm s2cureo
to anaudhoigeser
protects tae data han it ts siored (dota at veat)
and frthe, cloud

seaitve fo
enareanat Omauthomd
neryptn
npYVata/ secUvO hrom
ven
data
nab to
accer hackg eun

eoe)
Pegal
tunt in cloudforg

aea jn ctoud
pVatE
behueo
sore enyidtion
Sale and
apS data acceA
cloud Advantages d clouo Storag
ad ata
roliakaity
aahene,
Ram

Example otta Seyeale

accourt
cveate upo 5
)
uing dyerent
 creating [Link] sa
naLsre suNty oy -fo

Teduca acesd
is uke ong
is neesoato
nd read data.
wth cere
managad
aidbereg
should iereal,
bayenchcala
lccyde
y Delined uy
in becured rage
acen
-basd
wth ou EnuYe. y
led Backup.
Autom
Preuat
aye beCheacidbutal
d

cuofent
and allsws
wndle puysota mare
martnoce

teLel6t9-3 doiged for shored

Set rales might
clo4d t
ceises dta n - both sterase
a how to SCUYe,
Covers
 Anditng
Lo;aing Racordirg
eros
toys to manttyr
A

curity breacha
ndutrty Se ytau
kalps to
’illegal acthvit adendttng

’ln clbud compurg

haure

sogice provider
iterent Cloud
ing rmats

ronty cloud Srehuans

Hutitehdnt nature g (ocotn:
multple
acovoss
ahd stoed
Compiand amd
Jetion
Raplei System muat be
data and
ourity Piay
olicat housseoritg
forse
mavnagea tor cing thest rgulaton
cheuta Ore uaually reapmaible tor coplhane
oing od prouider
un hen Sevtcea
 (scuss
cloud storaqg seriie -pr
ie d u e reciue autnatd
ver Customar

inveice

nolongrineedothe serie
ed & y
wnen iien °complet
pronder
’
tne sevia olievt
taak
renaid
eientts data
cantactual
e h t
agremet one
staglmale
and ay

(dantity Managnen
jahdod that aye
Pidertity verHcahm oe

Open(D 2r0 urU

A pratocol ro Ringla
A accoum hat
single hentcate
(ie

fologin
CAe fo enen
 to,
Ye enteing Crdetal
how tt worS

presuted to sevie tu
acers to
ckA oth openD provider
The seve

Asertin Morkup ag
hat exdhangesauthentiat
4nasstandord
uTn [Link]
povbr

oboto
ASA ML to SOrvice
acces muttple
one and

e>0Auth acce totu

Stendrd hat provdo
open
S0eareleras to acon LAer in
")Alows
accers toens
nolp q
 Ckarpy. Servido tho s0cil mwdlo apip
veqest im acue to mail açron
wseo Acth bns natad
cvedenial
toten trom idaty
senvie re qusta
proiar eogorary acs
giues soeria
akk totthout
spee

Data fortalblity Project Creaty

An induoty g
Shanderdo ferdta'
injeroperolelity erviuo to
rags oloud be movel
eEeou to
’Wse i p t lloas da Opiatiy
b/ platfmsand

jeatne ute importi

Gnable rom one
Exarplacontacto whout mana
anotor
ernterrg data
re
 The DataPortability Project (http:/[Link]) is an m
that promotes data interoperability between applications, and the group's work
Of he emerging standards mentioned in thie coction, The group's Web site 1s 5n

FIGURE 12.6
The home page of the DataPortabiliy Project, an industry working group that promoles op

Remix.
Guo DataPortability Connect. Control. Share.
Project

Follow
Get Informed Particlpt
About Implement eDralortabry oed
Subsoce to our
mlormaoon chamei t
UnAs ro a tne resoTEet
Ma erer chekes abuut Dan upen ss roors
Oeree ef the ea sotar. Cheoe g a n
uann ohe ntards nerd ra mplenent dara gazation paeered by
partatiy techncNagies in
dma a ne people be ou
ranizatsorn Ivched Dur soTr
Haor Camparton Cho
fueiness Care Lst of Qpes IOns
ionk or ne Loge
stry ef the Prjea

er Task forces Tecdtdar

waraies
oP Frsendty tLA
ontht eoorts
Pemate Datafortty
ohcAay Entorse C
Ceege Cae daf

Ugt af Actan Gravus Lpo Usape Cuide

LAHrd DgaNratot

SRSS O DPML nioelemats RDF Sapml VxMPP

Highlights

wee hai

[Link]
How to deal with storage location and tenancy compiled src7cse@[Link] 25-Sept-2025 Pg 1 of 7

How to deal with storage location and tenancy for securing data in Cloud
Computing?
(This document is prepared partially from LLM models)

[Link]

How to deal with storage… This document is prepared partially from LLM models Pg 1 of 7
How to deal with storage location and tenancy compiled src7cse@[Link] 25-Sept-2025 Pg 2 of 7

[Link]
Here's a concise overview of dealing with storage location and tenancy for securing
data in cloud computing, along with an example case:

Storage location and multi-tenancy are crucial aspects of data security in cloud
computing. Cloud providers often store data across multiple geographic locations for
redundancy and performance. However, this can raise compliance and privacy
concerns. To address this:

1. Data residency: Ensure data is stored in locations that comply with relevant
regulations.
2. Data sovereignty: Be aware of laws governing data access in different
jurisdictions.
3. Encryption: Use strong encryption for data at rest and in transit.
4. Access controls: Implement robust identity and access management.
5. Tenant isolation: Ensure proper logical separation between different tenants'
data.

Example case: A multinational financial services company needs to store customer data
in the cloud while complying with various regional regulations. They work with a cloud
provider that offers:

● Region-specific data centers

● Strong encryption
● Virtual private cloud options
● Compliance certifications (e.g., ISO 27001, SOC 2)

How to deal with storage… This document is prepared partially from LLM models Pg 2 of 7
How to deal with storage location and tenancy compiled src7cse@[Link] 25-Sept-2025 Pg 3 of 7

The company implements a hybrid cloud solution, keeping sensitive data on-premises
and using the cloud for less sensitive workloads. They use data classification and
tagging to ensure data is stored in appropriate locations and apply encryption and
access controls consistently across their infrastructure.

[Link]

When migrating data to the cloud, ensuring its security is paramount. Two crucial factors
to consider are storage location and tenancy.

Storage location refers to the geographical region where your data is stored. This can
influence factors like data latency, regulatory compliance, and potential risks. For
instance, if your business operates primarily in Europe, storing data in a European data
center ensures compliance with GDPR regulations. However, storing data in a region
with a different legal framework might expose it to potential risks.

Tenancy refers to the level of isolation between your data and other tenants on the
same cloud platform. In a multi-tenant environment, multiple organizations share the
same infrastructure. 1 While this can be cost-effective, it raises concerns about data
isolation. 2 Cloud providers typically employ various techniques like logical isolation,
encryption, and access controls to mitigate these risks. 3 In contrast, a single-tenant
environment provides dedicated resources for your data, offering a higher level of
security but at a potentially higher cost.

How to deal with storage… This document is prepared partially from LLM models Pg 3 of 7
How to deal with storage location and tenancy compiled src7cse@[Link] 25-Sept-2025 Pg 4 of 7

Example: A healthcare organization might choose to store patient data in a data center located within the country to
comply with local healthcare regulations. To mitigate risks associated with multi-tenancy, they could opt for a private
cloud or a dedicated server within a public cloud.

Security in cloud computing is a major concern. Data in cloud should be stored

in encrypted form. To restrict client from accessing the shared data directly,
proxy and brokerage services should be employed.

Security Planning
Before deploying a particular resource to cloud, one should need to analyze
several aspects of the resource such as:

​ Select resource that needs to move to the cloud and analyze its sensitivity
to risk.
​ Consider cloud service models such as IaaS, PaaS, and SaaS. These
models require customer to be responsible for security at different levels
of service.
​ Consider the cloud type to be used such as public, private, community
or hybrid.
​ Understand the cloud service provider's system about data storage and its
transfer into and out of the cloud.

The risk in cloud deployment mainly depends upon the service models and cloud
types.

How to deal with storage… This document is prepared partially from LLM models Pg 4 of 7
How to deal with storage location and tenancy compiled src7cse@[Link] 25-Sept-2025 Pg 5 of 7

Understanding Security of Cloud

Security Boundaries

A particular service model defines the boundary between the responsibilities of

service provider and customer. Cloud Security Alliance (CSA) stack model
defines the boundaries between each service model and shows how different
functional units relate to each other. The following diagram shows the CSA
stack model:

[Link]

Key Points to CSA Model

​ IaaS is the most basic level of service with PaaS and SaaS next two above
levels of services.
​ Moving upwards, each of the service inherits capabilities and security
concerns of the model beneath.
​ IaaS provides the infrastructure, PaaS provides platform development
environment, and SaaS provides operating environment.

How to deal with storage… This document is prepared partially from LLM models Pg 5 of 7
How to deal with storage location and tenancy compiled src7cse@[Link] 25-Sept-2025 Pg 6 of 7

​ IaaS has the least level of integrated functionalities and integrated

security while SaaS has the most.
​ This model describes the security boundaries at which cloud service
provider's responsibilities end and the customer's responsibilities begin.
​ Any security mechanism below the security boundary must be built into
the system and should be maintained by the customer.

Although each service model has security mechanism, the security needs also
depend upon where these services are located, in private, public, hybrid or
community cloud.

Understanding Data Security

Since all the data is transferred using Internet, data security is of major concern
in the cloud. Here are key mechanisms for protecting data.

​ Access Control
​ Auditing
​ Authentication
​ Authorization

All of the service models should incorporate security mechanism operating in all
above-mentioned areas.

Isolated Access to Data

Since data stored in cloud can be accessed from anywhere, we must have a
mechanism to isolate data and protect it from client’s direct access.

Brokered Cloud Storage Access is an approach for isolating storage in the

cloud. In this approach, two services are created:

​ A broker with full access to storage but no access to client.

​ A proxy with no access to storage but access to both client and broker.

How to deal with storage… This document is prepared partially from LLM models Pg 6 of 7
How to deal with storage location and tenancy compiled src7cse@[Link] 25-Sept-2025 Pg 7 of 7

Working Of Brokered Cloud Storage Access System

When the client issues request to access data:

​ The client data request goes to the external service interface of proxy.
​ The proxy forwards the request to the broker.
​ The broker requests the data from cloud storage system.
​ The cloud storage system returns the data to the broker.
​ The broker returns the data to proxy.
​ Finally the proxy sends the data to the client.

All of the above steps are shown in the following diagram:

[Link]

Encryption
Encryption helps to protect data from being compromised. It protects data that
is being transferred as well as data stored in the cloud. Although encryption
helps to protect data from any unauthorized access, it does not prevent data
loss.

How to deal with storage… This document is prepared partially from LLM models Pg 7 of 7