BCSE408L

Cloud Computing
Module 1 Lecture 4

NIST Cloud Computing

Architecture

08/13/2025 1
 Why NIST Cloud Computing Architecture?
To illustrate and understand the various cloud services in the context of
an overall cloud computing conceptual model
To provide a technical reference to cloud consumers so as to
understand, discuss, categorize and compare cloud services; and
To facilitate the analysis of candidate standards for
security, interoperability, and portability and reference implementations.

08/13/2025 2
NIST Cloud Computing
Architecture

08/13/2025 Figure : The Conceptual 3

Reference Model
 NIST Cloud Computing Architecture
It defines five major actors:
1. cloud consumer,
2. cloud provider,
3. cloud carrier,
4. cloud auditor and
5. cloud broker.

Each actor is an entity that participates in a process and performs tasks in

cloud computing.

08/13/2025 4
Actors in Cloud
Computing

08/13/2025 5
Interactions between the Actors in Cloud
Computing

08/13/2025 6
 Example Usage Scenario 1

 Cloud consumer may request service from a cloud broker instead of contacting a
cloud provider directly.
The cloud broker may create a new service by combining multiple services or
by enhancing an existing service.

08/13/2025 7
 Example Usage Scenario 2

 Cloud carriers provide the connectivity and transport of cloud services from cloud providers
to cloud consumers.
2 SLA’s
 A cloud provider arranges service level agreements (SLAs) with a cloud carrier and may
request dedicated and encrypted connections to ensure the cloud services are consumed at a
consistent level
08/13/2025 8
 Example Usage Scenario 3

 For a cloud service, a cloud auditor conducts independent assessments of the

operation and security of the cloud service implementation.
 The audit may involve interactions with both the Cloud Consumer and the
Cloud
Provider.
08/13/2025 9
Cloud Consumer

Figure: Example Services available to a

Cloud Consumer
08/13/2025 10
 Cloud Consumer
The cloud consumer is the principal stakeholder for the cloud
computing service.
 A cloud consumer browses the service catalog from a cloud
provider, requests the appropriate service, sets up service contracts with
the cloud provider, and uses the service.
 The cloud consumer may be billed for the service provisioned, and needs
to arrange payments accordingly.

08/13/2025 11
 Cloud Consumer
Why SLA?
1. To specify the technical performance requirements fulfilled by a
cloud provider.
2. It includes the quality of service, security, remedies for
performance failures.
3. It includes the set of promises explicitly not made to consumers,
i.e. limitations, and obligations.

•A cloud consumer can freely choose a cloud provider with better pricing
• Cloud provider’s pricing policy and SLAs are non-negotiable

08/13/2025 12
 Cloud Consumer
SaaS applications in the cloud are made accessible via a network to the
SaaS consumers.
The consumers of SaaS can be organizations that provide their members
with access to software applications, end users, or software application
administrators who configure applications for end users.
SaaS consumers can be billed based on the number of end users, the time
of use, the network bandwidth consumed, the amount of data stored or
duration of stored data.

08/13/2025 13
 Cloud Consumer
Cloud consumers of PaaS can employ the tools and execution resources to
develop, test, deploy and manage the applications hosted in a cloud
PaaS consumers can be application developers, application testers,
application deployers, and application administrators who configure and
monitor application performance on a platform.
PaaS consumers can be billed according to, processing, database storage,
network resources consumed by the PaaS application, and the duration of the
platform usage.

08/13/2025 14
 Cloud Consumer
 Consumers of IaaS have access to virtual computers, network-accessible
storage, network infrastructure components, and other fundamental
computing resources on which they can deploy and run arbitrary software.
The consumers of IaaS can be system developers, system administrators
and IT managers who are interested in creating, installing, managing and
monitoring services for IT infrastructure operations.
IaaS consumers are billed according to the duration of the resources
consumed, such as CPU hours used by virtual computers, volume and
duration of data stored, network bandwidth consumed, number of IP
addresses used for certain intervals.

08/13/2025 15
 Cloud Provider
A cloud provider is a person or an organization, responsible for making a
service available to consumers.

A Cloud Provider acquires and manages the computing infrastructure required

for providing the services, runs the cloud software that provides the services,
and makes arrangement to deliver the cloud services to the Cloud Consumers
through network access.

08/13/2025 16
 Cloud Provider
For Software as a Service, the cloud provider deploys, configures, maintains
and updates the operation of the software applications on a cloud
infrastructure

The provider of SaaS assumes most of the responsibilities in managing and

controlling the applications and the infrastructure, while the cloud consumers
have limited administrative control of the applications.

08/13/2025 17
Cloud Provider

 For PaaS, the Cloud Provider manages the computing infrastructure

for the platform and runs the cloud software that provides the
components of the platform.
 The PaaS Cloud Provider supports the development, deployment
and management process of the PaaS Cloud Consumer by providing
tools such as integrated development environments (IDEs),
development version of cloud software, software development
kits (SDKs), deployment and management tools.
 The PaaS Cloud Consumer has control over the applications but has
no or limited access to the infrastructure.
08/13/2025 18

Cloud Provider
For IaaS, the Cloud Provider acquires the physical computing
resources underlying the service, including the servers, networks, storage
and hosting infrastructure.
 The Cloud Provider runs the cloud software necessary to makes
computing resources available to the IaaS Cloud Consumer through a set of
service interfaces and computing resource abstractions, such as virtual machines
and virtual network interfaces.
 The IaaS Cloud Consumer uses these computing resources for their
fundamental computing needs.
 IaaS Cloud Consumer has more control over the more software components in
an application stack, including the OS and network.
 IaaS Cloud Provider has control over the physical hardware and cloud
software that makes the provisioning of these infrastructure services possible
08/13/2025 19
Cloud Provider Activities

08/13/2025 20
Cloud Auditor
A cloud auditor is a party that can perform an independent examination of cloud
services
 Audits are performed to verify conformance to standards through review of
objective evidence.
A cloud auditor can evaluate the services provided by a cloud provider in
terms of security controls, privacy impact, performance, etc.
•Example:
•For security auditing, a cloud auditor can make an assessment of the security
controls in the information system to determine the extent to which the
controls are implemented correctly, operating as intended, and producing the
desired outcome with respect to the security requirements for the system.

08/13/2025 21
Cloud Broker
 The integration of cloud services can be too complex for cloud consumers to manage.
 A cloud broker is an entity that manages the use, performance and delivery of
cloud services and negotiates relationships between cloud providers and cloud consumers.
A cloud broker can provide three services:
1. Service Intermediation - managing access to cloud services, identity
management,
performance reporting, enhanced security, etc.
2. Service Aggregation - combines and integrates multiple services into one or more new
services. Ensures the secure data movement.
3. Service arbitrage - means a broker has the flexibility to choose services from multiple
agencies.

08/13/2025 22
 Cloud Carrier
A cloud carrier acts as an intermediary that provides connectivity
and transport of cloud services between cloud consumers and cloud
providers.
 Cloud carriers provide access to consumers through
network, telecommunication and other access devices.
 Forexample, cloud consumers can obtain cloud services through
network access devices, such as computers, laptops, mobile
phones, and mobile Internet devices.
 Cloud provider will set up SLAs with a cloud carrier to provide
services consistent with the level of SLAs offered to cloud
consumers
08/13/2025 23
Scope of Control between Provider and Consumer

08/13/2025 24
 Scope of Control between Provider and Consumer
 The Cloud Provider and Cloud Consumer share the control of resources in a
cloud system
 Different service models affect an organization's control over
the computational resources
 This analysis of delineation of controls over the application stack
helps understand the responsibilities of parties involved in managing the
cloud application.

• Theapplication layer includes software applications targeted at end users

or programs. The applications are used by SaaS consumers,
or installed/managed/ maintained by PaaS consumers, IaaS
consumers, and SaaS providers.
08/13/2025 25
 Scope of Control between Provider and Consumer
• The middleware layer provides software building blocks (e.g., libraries,
database, and Java virtual machine) for developing application software
in the cloud.
• Themiddleware is used by PaaS consumers, installed/managed/maintained
by IaaS consumers or PaaS providers, and hidden from SaaS consumers.

• The OS layer includes operating system and drivers, and is hidden from
SaaS consumers and PaaS consumers. An IaaS cloud allows one or
multiple guest OS‟s to run virtualized on a single physical host.
• TheIaaS consumers should assume full responsibility for the guest OS‟s,
while the IaaS provider controls the host OS.
08/13/2025 26
 Cloud Computing Reference Architecture: Architectural
1. Components
Service Deployment
1. public cloud

Figure: Public
Cloud
08/13/2025 27
 Cloud Computing Reference Architecture: Architectural
1. Components
Service Deployment
1.2 Private
cloud

Figure: On-site Figure: Out-sourced

Private Cloud
08/13/2025 Private Cloud 28
 Cloud Computing Reference Architecture: Architectural
1. Components
Service Deployment
1.3 Community cloud

Figure: On-site
08/13/2025 Community Cloud 29
 Cloud Computing Reference Architecture: Architectural
1. Components
Service Deployment
1.3 Community cloud

Figure: Outsourced
08/13/2025 Community Cloud 30
 Cloud Computing Reference Architecture: Architectural
1. Components
Service Deployment
1.3 Hybrid cloud

Figure: Hybrid
08/13/2025 Cloud 31
Cloud Computing Reference Architecture: Architectural
Components
2. Service Orchestration
Service Orchestration refers to the composition of system components to
support the Cloud Providers activities in arrangement, coordination and
management of computing resources in order to provide cloud services to
Cloud Consumers.
A three-layered model is used to represent the grouping of three types of
system components.

08/13/2025 32
Cloud Computing Reference
Architecture: Architectural
Components
2. Service Orchestration

Service Layer
The service layer is where Cloud Providers define interfaces
for Cloud Consumers to access the computing services.
Access interfaces of each of the three service models are
provided in this layer.
The optional dependency relationships among SaaS, PaaS,
and IaaS components are represented.
For example, SaaS applications can be built on top of PaaS
components and PaaS components can be built on top of
IaaS components.
08/13/2025 33
Cloud Computing Reference
Architecture: Architectural
Components
2. Service Orchestration

Resource abstraction and Control Layer

This layer contains the system components that cloud
providers use to provide and manage access to the physical
computing resources through software abstraction.
Example components: hypervisor, VM, virtual data
storage, etc.
The resource abstraction needs to ensure efficiency,
security, and reliable usage of the underlying physical
resources.

08/13/2025 34
Cloud Computing Reference
Architecture: Architectural
Components
2. Service Orchestration

Resource abstraction and Control Layer

The control aspect of this layer refers to the software
components that are responsible for resource allocation,
access control, and usage monitoring.

To enable resource pooling, dynamic allocation, and

measured service

08/13/2025 35
Cloud Computing Reference
Architecture: Architectural
Components
2. Service Orchestration

Physical Resource Layer

It includes all the physical computing resources CPU and
memory, storage devices, network components, and facility
resources such as heating, ventilation and air conditioning
(HVAC), power, communications, etc.

The upper layer components are dependent on adjacent

lower layer to function

08/13/2025 36
 Cloud Computing Reference
Architecture: Architectural
3. Components
Cloud Service Management
Cloud Service Management includes all of the service-related functions that
are necessary for the management and operation of those services required by
or proposed to cloud consumers.

08/13/2025 37
 Cloud Computing Reference
Architecture: Architectural
3. Cloud Service Management
Components

08/13/2025 38
Cloud Computing Reference Architecture:
Architectural Components
3. Cloud Service Management
Business Support entails the set of business-related services dealing with clients
and supporting processes.
1. Customer management: Manage customer accounts, open/close/
terminate
accounts, manage user profiles, manage customer relationships by providing points-
of-contact and resolving customer issues and problems, etc.
[Link] management: Manage service contracts,
setup/negotiate/close/terminate contract, etc.
3. Inventory Management: Set up and manage service catalogs, etc.
[Link] and Billing: Manage customer billing
information, send billing statements, process received payments, track invoices,
etc.
5. Reporting and Auditing: Monitor user operations, generate reports, etc.
[Link]
08/13/2025 and Rating: Evaluate cloud servicesand
39
Cloud Computing Reference Architecture:
Architectural Components
3. Cloud Service Management
Provisioning and Configuration
• Rapid provisioning: Automatically deploying cloud
systems based on the requested
service/resources/capabilities.
• Resource changing: Adjusting configuration/resource assignment for
repairs, upgrades and joining new nodes into the cloud.
• Monitoring and Reporting: Discovering and monitoring
virtual resources, monitoring cloud operations and events and
generating performance reports.
• Metering:Providing a metering capability at some level of abstraction
appropriate to the type of service (e.g., storage, processing,
bandwidth, and active user accounts).
08/13/2025 40
 Cloud Computing Reference
Architecture: Architectural
3. Components
Cloud Service Management

Portability and Interoperability

It promises cost savings in technology infrastructure and faster software
upgrades.

However, it has adaptability and security concern. How can it be

handled?
Data portability is the ability of cloud consumers to copy data objects
into or out of a cloud or to use a disk for bulk data transfer.
08/13/2025 41
Service interoperability is the ability of cloud consumers to use their
 Cloud Computing Reference
Architecture: Architectural
3. Cloud Service Management
Components
Portability and Interoperability
System portability allows the migration of a fully-stopped virtual
machine instance or a machine image from one provider to another
provider, or migrate applications and services and their contents from
one service provider to another.

Different cloud service models may have different requirements.

For example:
• IaaS requires the ability to migrate the data and run the applications on
a new cloud
08/13/2025 42
• For SaaS, it is essential to perform data extractions and backups in a
Cloud Computing Reference Architecture:
Architectural Components

4. Security

Its need spans across all layers of the reference model, ranging from physical
security to application security.

Cloud-based systems need to address security requirements such as

authentication, authorization, availability, confidentiality, identity
management, integrity, audit, security monitoring, incident response, and
security policy management.
08/13/2025 43
 Cloud Computing Reference
Architecture: Architectural
4. Security
Components
Cloud Service Model Perspectives

It is important to consider the impact of cloud service models and their different issues in
security design and implementation.
They expose different entry points into cloud systems, which in turn also create different
attacking surfaces for adversaries.
For example: SaaS provides cloud offerings through Internet and Web browser, so Web
browser security is a challenge. Similarly, hypervisor security for IaaS.

08/13/2025 44
 Cloud Computing Reference
Architecture: Architectural
4. Security
Components
Implications of cloud service models

 Public cloud needs more security due to exclusivity of tenants

 An on-site private cloud may or may not need additional boundary controllers at
the cloud boundary.
 An out-sourced private cloud tends to require the establishment of such
perimeter protection at the boundary of the cloud

08/13/2025 45
Cloud Computing Reference
Architecture: Architectural
Components
•4. Security

•Shared Security Responsibilities

•Security is a shared responsibility for both consumer and provider.
•Security controls, i.e., measures used to provide protections, need to be
analyzed to determine which party is in a better position to implement.
•This analysis needs to include considerations from a service model perspective,
where different service models imply different degrees of control between Cloud
Providers and Cloud Consumers.
08/13/2025 46
Cloud Computing Reference Architecture: Architectural
Components
5. Protection

Cloud providers should protect the assured, proper, and consistent collection,
processing, communication, use and disposition of personal information (PI)
and personally identifiable information (PII) in the cloud.

PII is the information that can be used to distinguish or trace an individual‟s

identity, such as their name, social security number, biometric records, etc.

Cloud providers should ensure the privacy of the collected personally

identifiable
08/13/2025
information. 47
08/13/2025 48
Referenc
es
[Link]://[Link]/nistpubs/Legacy/SP/
nistspecialpublication500- [Link]
2. [Link]

08/13/2025 49