CLOUD COMPUTING – CSE3343

Module 4
Application Development in Cloud
 Contents
• Cloud Security Mechanisms
• The Zero Trust Security Model
• Identity Management
• Privileged Access Management
• AI Technologies And Their Effect On Security
• Protecting Remote Access
• Privacy In A Cloud Environment
• Application Development In Cloud Computing
• Recent trends in Cloud Computing
• Fog Computing
• Dew Computing
• Case Studies
• Recent Advancements
Cloud Security Mechanisms

 Encryption
 Hashing

 Digital Signature

 Public Key Infrastructure (PKI)

 Identity and Access Management (IAM)

 Single Sign-On (SSO)

 Encryption
⚫ The encryption mechanism is a digital coding system
dedicated to preserving the confidentiality and
integrity of data.

⚫ Encryption technology commonly relies on a

standardized algorithm called a cipher to transform
original plaintext data into encrypted data, referred
to as ciphertext.

⚫ The encryption mechanism can help counter the

traffic eavesdropping, malicious intermediary,
insufficient authorization, and overlapping trust
 Figure
10.1
4

⚫ Figure 10.1 - A malicious intermediary is unable to retrieve

data from an encrypted message. The retrieval attempt may
furthermore be revealed to the cloud service consumer.
(Note the use of the lock symbol to indicate that a security
mechanism has been applied to the message contents.)
 Encryption
5

⚫ Two common forms of encryption known as

symmetric encryption and asymmetric
encryption:
 Symmetric encryption
Symmetric encryption uses the same key for both
⯍
encryption and decryption, both of which are
performed by authorized parties that one shared
key.
⯍ It provides data confidentiality but no non-repudiation
(in a
party of more than 2 people).
 Asymmetric encryption
⯍ Asymmetric encryption relies on the use of two
different keys, namely a private key and a
 Encryption
6
⚫ Message that were encrypted with a private key
can be correctly decrypted by any party with the
corresponding public key
⚫ This method of encryption does not offer any
confidentiality protection.
 Private key encryption therefore offers integrity
protection in addition to authenticity and non-
repudiation.
⚫ A message that was encrypted with a public key
can only be decrypted by the rightful private key
owner, which provides confidentiality protection.
 Any party that has the public key can generate the
ciphertext, meaning this method provides neither
message integrity nor authenticity protection due to
the communal mature of the public key.
 Figure
10.2
7

⚫ The encryption
mechanism is
added to the
communication
channel between
outside users and
Innovartus‘ User
Registration
Portal. This
safeguards
message
confidentiality via
the use of HTTPS
(using SSL/TLS).
⚫ TLS is a successor
to
SSL.
 Hashing
8

⚫ The hashing mechanism is used when a

one-way, non-reversible form of data
protection is required.
⚫ Hashing technology can be used to derive a
hashing code or message digest from a
message, which is often of a fixed length
and smaller than the original message.
⚫ A common application of hashing is the
storage of passwords.
⚫ In addition to protect stored data, the cloud
threats that can be mitigated by hashing
including malicious intermediary and
insufficient authorization.
 Figure
10.3
9

⚫ Figure 10.3 - A hashing function is applied to protect the

integrity of a message that is intercepted and altered by a
malicious service agent, before it is forwarded. The
firewall can be configured to determine that the message
has been altered, thereby enabling it to reject the message
Figure
10.5
1
3

⚫ Figure 10.5 - Cloud Service Consumer B sends a message

that was digitally signed but was altered by trusted
attacker Cloud Service Consumer A. Virtual Server B is
configured to verify digital signatures before processing
incoming messages even if they are within its trust
boundary. The message is revealed as illegitimate due to
its invalid digital signature, and is therefore rejected by
Virtual Server B.
10.4 Public Key Infrastructure (PKI)
(1/2)
1
5
⚫ The public key infrastructure (PKI)
mechanism, which exists as a system of
protocols, data formats, rules, and practices
that enables large-scale systems to securely
use public key cryptography.
⚫ PKIs rely on the use of digital certificates,
which are digitally signed data structures
that bind public keys to certificate owner
identities.
⚫ Digital certificates are usually digitally
signed by a third-party certificate
authority (CA), such as VeriSign and
Figure
10.7
1
6

⚫ Figure 10.7 -
The common
steps
involved
during the
generation of
certificates
by a
certificate
authority
(CA).
10.4 Public Key Infrastructure (PKI)
(2/2)
1
7
⚫ The PKI is a dependable method for
implementing asymmetric encryption,
managing cloud consumer and cloud
provider identity information.
⚫ The PKI mechanism is primarily used to
counter the insufficient authorization threat.
10.5 Identity and Access Management
(IAM 1/2)
1
8
⚫ The identity and access management (IAM)
mechanism encompasses the components and
policies necessary to control and track user
identities and access privileges for IT
resources, environments, and systems.
⚫ IAM mechanisms exist as systems comprised
of four main components:
 Authentication
 Authorization
 User Management
 Credential Management
10.5 Identity and Access Management (IAM
2/2)
1
9
⚫ As opposed to PKI, the IAM mechanism’s
scope of implementation is distinct because
its structure encompasses access controls
and policies in addition to assigning specific
levels of user privileges.
⚫ The IAM mechanism is primarily used to
counter the insufficient authorization, denial
of service, and overlapping trust boundaries
threats, PKI is primarily used to counter the
inefficient authorization threat.
 10.6 Single Sign-On (SSO)
(1/2)
2
0
⚫ Propagating the authentication and
authorization for a cloud service consumer
across multiple cloud services is inevitable
and challenging.
⚫ The single sign-on (SSO) mechanism enables
one cloud service consumer to be
authenticated by a security broker, which
establishes a security context that is
persisted while the cloud service consumer
accesses other cloud services or resources, so
that the cloud service consumer need not to
re-authenticate itself with every subsequent
 10.6 Single Sign-On (SSO)
(2/2)
2
1
⚫ The SSO mechanism essentially enables
mutually independent cloud services and
IT resources to generate and circulate
runtime authentication and authorization
credentials.
⚫ SSO does not direct counter any of the cloud
security threats. It primarily enhances the
usability of cloud- based environments for
access and management of resources and
solutions.
Figure
10.9
2
2
⚫ A cloud service
consumer provides
the security broker
with login
credentials (1).
⚫ The security broker
responds with an
authentication
token (message
with small lock
symbol) upon
successful
authentication,
which contains
cloud service
consumer identity
information (2) that
is used to
automatically
authenticate the
cloud service
 Figure 10.10 (ATN’s
Example)
2
3

⚫ Figure 10.10 - The credentials received by the security

broker are propagated to ready-made environments
across two different clouds. The security broker is
responsible for selecting the appropriate security
 Zero Trust Security Model
• Consider perimeterless security (sometimes called borderless security)
• How can a tenant know which individuals should be allowed to access and manage services?
• The answer lies in a zero trust security model
• The idea is straightforward:
• Assign each user a set of privileges for each possible service.
• Instead of merely allowing a user to login once and then have access to all services,
• Validate each request separately.
• Whenever a user attempts to access a service, use the identity of the user (identity of the user’s device) to
decide whether to grant or deny the request.
 Cont…
• Moving to a zero trust model can be difficult because it requires choosing a balance between security and
convenience
• As an example, consider a web page that an employee can use to find another employee’s email address.
• suppose the lookup mechanism involves two services
• one that allows a user to enter an employee’s name and returns the employee’s ID
• and another that takes an employee ID as input and returns the employee’s email address.
• A naive implementation of zero trust security
• checks the user’s authorization at each step.
• First, the web page asks the user to enter login and password credentials.
• The web page then invokes the name lookup microservice, which also prompts the user to reenter the same credentials.
• Once the name lookup succeeds
• the web page invokes the email lookup service, which prompts the user for credentials
 Identity Management (IdM)
• To avoid having separate authentication for each service
• The identity management system uses a Single Sign On (SSO)
• user has the same login and password credentials for all services.
• The system stores information about each individual, including their login, password, and access rights
• All services use the identity management system to ascertain whether a given individual can access the
service

An Identity Management system, which stores information about users’ identities and their access rights,
• uses a single login for all services,
• authenticates users
• ensures only authorized users access each service, and
• allows a user to enter credentials once for each task.
 Privileged Access Management (PAM)
• Controlling access for IT staff forms a special case of Identity Management
• They need permissions to install, configure, and operate systems
• IT staff members have the administrative or superuser level of privilege

• A Privileged Access Management (PAM) system handles identity management for privileged accounts
• One significant feature of PAM systems arises from their emphasis on limited privilege:
• instead of a master password that grants administrative privilege on any system
• staff member only has privilege on the systems the staff member administers.
• In addition to checking credentials and limiting access,
• PAM systems log all accesses
• providing a detailed record of which individual accessed a system at a given time
• The systems also record failed login attempts, providing a way to track attackers
AI Technologies and their Effect on Security
• Artificial Intelligence (AI) technologies influence security in both positive and negative ways
• Attackers can use AI techniques to bypass safeguards and gain unauthorized access to data or systems
• On the other hand, AI techniques can be used to strengthen safeguards.

• AI technology was used to fool an employee rather than to target the company’s IT systems from the outside.
• The approach is known as a deep fake
• An AI program that used machine learning (ML) was first fed recordings of the voice of a company executive
• so the program could learn the executive’s voice and speech patterns.
• Once the learning phase was complete, the program imitated the voice while pronouncing text from a script
• The attacker left voice mail for an employee, apparently from the company executive, asking the employee to transfer confidential
data to an external site.
 Protecting Remote Access
• Keep all communication confidential
• all data must be encrypted
• Use Virtual Private Network (VPN)
• Protect and isolate business data
• Remote access introduces an additional danger: an employee may lose a device that contains confidential business data.
• employees accidentally left their laptop or cell phone in a taxi cab, airplane, or other public location
• To protect it from accidental loss, all business data stored on a user’s device must be encrypted.
• Enforce workflow security
• As an employee performs a task, data may move from the cloud to the employee’s device and back
• define a security policy for each workload, and keep the policies enforced at each step as the data moves
• That is, the security policy for data is bound to the data itself
• Industry uses the term workflow security to characterize the approach
 Privacy in a Cloud Environment
• Security systems enforce protections to guarantee the
• confidentiality,
• Integrity, and
• availability of data.

• the term privacy to refer to keeping sensitive information about an individual safe from public dissemination
• It may seem that privacy can be achieved merely by keeping each individual’s data confidential.
• privacy can be more subtle because it may be possible to deduce information about an individual from
statistics
• even if the actual data for the individual remains confidential
• Privacy protection cannot focus only on the data at hand
• Because the Internet contains so much information about individuals, it may be possible to identify individuals by combining data and
statistics from many sources.
 PROGRAMMING MODEL
MAPREDUCE

• MapReduce is a programming framework that allows us

to perform distributed and parallel processing on large
data sets in a distributed environment.
• Advantages:
1. Parallel Processing
2. Data Locality
MapReduce consists of two distinct tasks

Map - Mapping the Data

Reduce – Reducing the Data
Working
• The first is the map job, where a block of data is read and processed to produce key-value pairs as
intermediate outputs.

• The output of a Mapper or map job (key-value pairs) is input to the Reducer.

• The reducer receives the key-value pair from multiple map jobs.

• Then, the reducer aggregates those intermediate data tuples (intermediate key-value pair) into a
smaller set of tuples or key-value pairs which is the final output.
A Word Count Example of
MapReduce
 SOFTWARE DEVELOPMENT
IN CLOUD
• Cloud Analyst
• AWS
• Saturn Cloud
[Link]
2013/01/running-and-using-cloud-
[Link]
Saturn Cloud
Introduction to Docker
 Do I worry about Can I transport quickly
how goods interact and smoothly
(e.g. coffee beans (e.g. from boat to train
next to spices) to truck)
Cargo Transport Pre-1960
transporting/storing
Multiplicity of Goods methods for
Multipilicity of
 Docker is a shipping container system for code

Do services and apps

Static website User DB Queue Analytics DB
Multiplicity of Stacks

Web frontend

appropriately?
interact
An engine that enables any
payload to be encapsulated
as a lightweight, portable,
self-sufficient container…

…that can be manipulated using

smoothly and quickly

standard operations and run
Multiplicity of

environments

consistently on virtually any

hardware

Can I migrate
hardware platform

Developme QA server Customer Data Public Cloud Production Contributor’s

nt VM Center Cluster laptop
Why Developers Care
• Build once…(finally) run anywhere*
• A clean, safe, hygienic and portable runtime environment for your app.
• No worries about missing dependencies, packages and other pain points during subsequent
deployments.
• Run each app in its own isolated container, so you can run various versions of libraries and other
dependencies for each app without worrying
• Automate testing, integration, packaging…anything you can script
• Reduce/eliminate concerns about compatibility on different platforms, either your own or your
customers.
• Cheap, zero-penalty containers to deploy services? A VM without the overhead of a VM? Instant
replay and reset of image snapshots? That’s the power of Docker

* With the 0.7 release, we support any x86 server running a modern Linux kernel (3.2+ generally. 2.6.32+ for RHEL 6.5+, Fedora, &
related)
 Containers vs. VMs
App App App
B
Containers are isolated,
A A’
but share OS and, where
Bins/
Bins/
Libs Libs
Bins/
Libs
appropriate, bins/libraries
VM …result is significantly faster deployment,
Guest Guest much less overhead, easier migration,
OS OS faster restart
Guest Guest Guest
OS OS OS

App B’

App B’
App B’
App A’
App A

App B

Docker
Container
Hypervisor (Type 2) Bins/Libs Bins/Libs

Host OS Host OS
Server Server
 Recent Trends in Cloud Computing
• Hybrid and Multi-Cloud Solutions
• AI and Machine Learning Integration
• Serverless Computing
• Edge Computing Expansion

•Cloud computing is evolving with hybrid and multi-cloud solutions, enabling flexibility across platforms.
•AI and machine learning are embedded into cloud services for enhanced analytics and automation.
•Serverless computing and edge computing are transforming deployment and reducing latency.
Introduction to Fog Computing
• Definition: Extends cloud capabilities to the network edge for low-
latency processing.
• Use Cases: IoT, real-time analytics, and latency-sensitive applications.
• Benefits: Reduces latency by processing data closer to the source.

•Fog computing processes data closer to devices rather than in centralized cloud servers.
•It's ideal for applications requiring low-latency, like IoT and real-time analytics.
•Fog enhances efficiency by reducing data sent to the cloud, which helps save bandwidth.
Dew Computing
• Definition: Decentralized computing that enables offline operation
with cloud synchronization.
• Use Cases: Remote areas, emergency situations, limited connectivity.
• Benefits: Offers data access and processing in low or no connectivity
settings.

•Dew computing enables local data processing with periodic cloud synchronization.
•It is useful in remote areas with limited connectivity, allowing offline operations.
•Dew computing decentralizes data management while ensuring cloud reliability when connected.
Comparative Analysis: Cloud, Fog,
and Dew Computing
• Cloud Computing: Centralized, scalable, high latency.
• Fog Computing: Decentralized, low-latency, suitable for IoT.
• Dew Computing: Local processing, works offline with periodic cloud
sync.
Case Studies in Cloud and Edge
Innovations
• Amazon Web Services (AWS): Hybrid and edge computing.
• Microsoft Azure IoT: Integration of IoT and edge.
• Google Cloud’s AI: AI-driven cloud services for analytics and
automation.

•AWS offers hybrid solutions that blend on-premises and cloud resources for flexibility.
•Azure IoT integrates IoT and edge solutions, supporting real-time data processing at the edge.
•Google Cloud’s AI services enable businesses to leverage cloud-powered analytics and automation.
 Recent Advancements in Cloud
Computing
• Quantum Computing Integration: IBM and Google Cloud.
• Blockchain and Cloud: Enhancing security and transparency.
• 5G and Cloud Synergy: Real-time data processing advancements.

•Quantum computing capabilities are being explored by IBM and Google within cloud ecosystems.
•Blockchain integration enhances security, creating more transparent and traceable systems.
•5G connectivity enables faster and real-time data processing, particularly beneficial for edge applications.
Future Directions
• Predicted Trends: Multi-cloud, autonomous cloud, sustainable
initiatives.
• Challenges: Data privacy, latency, regulatory compliance.

•The focus is on multi-cloud, sustainable initiatives, and AI-driven autonomous cloud management.
•Key challenges include data privacy, latency management, and regulatory compliance.
•Future cloud innovations aim to drive efficiency, expand reach, and enhance security.
Conclusion and Q&A
• Summary: Reviewed trends, technologies, and future directions in
cloud computing.
•QUERIES?