Academia.eduAcademia.edu

Outline

Title
Abstract
Introduction
Related Work
Conclusions and Future Works
References

SLA-Oriented Security Provisioning for Cloud Computing

Profile image of Massimiliano RakMassimiliano Rak

2013, Communications in Computer and Information Science

https://doi.org/10.1007/978-3-319-04519-1_15
visibility

…

description

16 pages

link

1 file

Abstract

Cloud Computing represents both a technology for using distributed computing infrastructures in a more efficient way, and a business model for renting computing services and resources. It is an opportunity for customers to reduce costs and increase efficiency. Moreover, it gives to small and medium enterprises the possibility of using services and technologies that were prerogative of large ones, by paying only for the used resources and avoiding unnecessary investment. The possibility of dynamically acquire and use resources and services on the base of a payby-use model, implies an incredible flexibility in terms of management, which is otherwise often hard to address. In this paper, we propose an approach to to build up SLA-oriented Cloud applications, which enable a Cloud provider to offer service customized on the customer security needing. In particular, by using a Cloud-oriented API derived from the mOSAIC project, the developer can implement security features that can be offered by the Cloud provider within their Service Level Agreement. In particular, we focus on providing an intrusion tolerance service to grant an application service availability even when the host system is under attack.

Related papers

CSLAM: A framework for cloud service level agreement management based on WSLA
Hassan haghighi

6th International Symposium on Telecommunications (IST), 2012

aYkvj"kortguukxg"rtqitguu"qh"enqwf"eqorwvkpi"cpf" kvu"kphnwgpeg"qp"ocp{"curgevu"qh"wvknkv{"eqorwvkpi."ocp{"qh" eqorcpkgu"cpf"gpvgtrtkugu"ctg"vgpfkpi"vq"vjku"pgy"rtqfwev" qh" kphqtocvkqp" vgejpqnqi{=" uqog" qh" vjgug" eqorcpkgu" ctg" kpvgtguvgf" kp" eqpuwokpi" enqwf" ugtxkegu" cpf" qvjgtu" vgpf" vq" rtqxkfg" enqwf" ugtxkegu0" Vjg" oquv" eqooqp" vjkpi" hqt" vjgug" vyq" oclqt" encuugu" qh" wugtu" ku" ugtxkeg" ngxgn" citggogpvu" *UNCu+" yjkej" ctg" ugv" dgvyggp" vjgo0" Ocp{" htcogyqtmu" jcxg"dggp"kpvtqfwegf"hqt"UNC"ocpcigogpv"kp"ygd"ugtxkeg" ngxgn." dwv" vjgtg" ctg" hgy" crrnkecdng" htcogyqtmu" vjcv" ctg" urgekhke" hqt" enqwf" eqorwvkpi" ugtxkegu0" Kp" vjku" rcrgt." yg" rtqrqug" c" htcogyqtm" hqt" UNC" ocpcigogpv" kp" enqwf" eqorwvkpi" cpf" gurgekcnn{" kpvgt/enqwf" gpxktqpogpvu0" Vjku" htcogyqtm"ku"dcugf"qp"YUNC"yjkej"ku"kpvtqfwegf"d{"KDO." dwv" yg" jcxg" ejcpigf" kv" vq" hkv" kpvq" enqwf" eqorwvkpi" gpxktqpogpvu0"Vjku"htcogyqtm"ku"kp"hcev"c"eqorqpgpv"qh"vjg" enqwf" eqorwvkpi" htcogyqtm" yjkej" yg" jcxg" kpvtqfwegf" kp" qwt" rtgxkqwu" yqtm0" Kp" vjku" rcrgt" yg" ctg" pqv" iqkpi" vq" rtqxkfg"c"nkuv"qh"enqwf"ugtxkeg"UNC"rctcogvgtu="kpuvgcf."yg" rtqrqug" c" htcogyqtm" vq" ocpcig" enqwf" ugtxkeg" UNCu" cpf" ogvtkeu0

View PDFchevron_right
Security SLA Based Monitoring in Clouds
maryline laurent

2017 IEEE International Conference on Edge Computing (EDGE), 2017

Nowadays, Cloud providers revise the terms of their Service Level Agreements (SLAs) to include security provisions due to their criticality for their customers. In order to speed up their adoption by service providers and consumers and to make them more actionable, security SLAs monitoring should be described in a machine-processable, agile and extensible way. Several tools for SLA management are available on the market but most deal with performance metrics and do not refer to security properties. There are other tools for monitoring cloud security, in a non-SLA way. However, they are not associated with SLA management systems. We propose an extension to an SLA language (i.e., rSLA) to enable the description of security requirements in an SLA document. We also extend the rSLA framework by a security methodology that makes use of known tools and that enables continuously checking that the security requirements are respected during runtime according to the SLA document.

View PDFchevron_right
An Integrated Approach for Specifying and Enforcing SLAs for Cloud Services
Jean-Louis Pazat

2012

Cloud computing has evolved from the provisioning of virtual machines to the provisioning of complex services, delivered to customers under the terms of Service-Level Agreements (SLAs). SLAs specify the Quality of Service (QoS) that should be provided to customers as well as the billing model. A main concern for cloud service providers is to maintain the agreed SLA terms in order to avoid losses and penalties. Maintaining the SLA in turn requires translating the QoS to configurations of low-level mechanisms, able to enforce the agreed terms. Current systems provide no integrated support for SLA specification, translation, and enforcement. In this paper, we propose an approach for specifying and enforcing SLAs for cloud service providers. The approach covers the creation of SLA templates under a billing model, the design of performance and faulttolerance QoS assurance mechanisms as well as the translation of QoS to appropriate configurations of those mechanisms. We demonstrate the feasibility of our approach by using the Qu4DS framework for PaaS cloud providers. Moreover, we evaluate the impact of failures on the provider profit. The experiments were carried out on the Grid5000 testbed and demonstrate the effectiveness of ensuring fault tolerance in different scenarios.

View PDFchevron_right
Service level agreement in cloud computing
Ali Younes

Cloud Workshops at OOPSLA, 2009

Cloud computing that provides cheap and pay-as-you-go computing resources is rapidly gaining momentum as an alternative to traditional IT Infrastructure. As more and more consumers delegate their tasks to cloud providers, Service Level Agreements(SLA) between consumers and providers emerge as a key aspect. Due to the dynamic nature of the cloud, continuous monitoring on Quality of Service (QoS) attributes is necessary to enforce SLAs. Also numerous other factors such as trust (on the cloud provider) come into consideration, particularly for enterprise customers that may outsource its critical data. This complex nature of the cloud landscape warrants a sophisticated means of managing SLAs. This paper proposes a mechanism for managing SLAs in a cloud computing environment using the Web Service Level Agreement(WSLA) framework, developed for SLA monitoring and SLA enforcement in a Service Oriented Architecture (SOA). We use the third party support feature of WSLA to delegate monitoring and enforcement tasks to other entities in order to solve the trust issues. We also present a real world use case to validate our proposal.

View PDFchevron_right
SLA guarantees for cloud services
Jonathan Lejeune

Future Generation Computer Systems, 2016

Quality-of-service and SLA guarantees are among the major challenges of cloud-based services. In this paper we first present a new cloud model called SLAaaS-SLA aware Service. SLAaaS considers QoS levels and SLA as first class citizens of cloud-based services. This model is orthogonal to other SaaS, PaaS, and IaaS cloud models, and may apply to any of them. More specifically we make three contributions: (i) we provide a novel domain specific language that allows to describe QoS-oriented SLA associated with cloud services; (ii) we present a general control-theoretic approach for managing cloud service SLA; (iii) we apply the proposed language and control approach to guarantee SLA in various case studies, ranging from cloud-based MapReduce service, to locking service, and higher-level e-commerce service; these case studies successfully illustrate SLA management with different QoS aspects of cloud services such as performance, dependability, financial and energetic costs.

View PDFchevron_right
CSLA: a Language for Improving Cloud SLA Management
Yousri KOUKI

2012

Cloud computing is a paradigm for enabling remote, on-demand access to a set of configurable computing resources as a service. The pay-per-use model enables service providers to offer their services to customers in different Quality-of-Service (QoS) levels. Service Level Agreement (SLA) is a negotiated agreement between a service provider and a customer where QoS parameters specify the quality level of service that the service provider have to guarantee. However, due to the dynamic nature of the Cloud and its instability, some SLA violations can occurred and the service providers can be charged for penalties. In this paper, we aim at addressing the Cloud instability to better control SLA management (in particular SLA violations) and indirectly the Cloud elasticity. We propose CSLA, a new SLA language directly integrating some features dealing with QoS uncertainty and Cloud fluctuation. In our evaluation, we present a novel profit model for service provider and new algorithms (for admission control and scheduling) to meet SLA requirements (e.g. prevent SLA violations) while tackling scalability and dynamic issues.

View PDFchevron_right
Security as a Service for Public Cloud Tenants(SaaS)
Hanifa Boucheneb

Procedia Computer Science, 2018

Cloud computing is a novel paradigm that is known for its elasticity and diversity in terms of the services provided to the end users. Although these services offer many benefits such as availability, cost-reduction, flexible payment plans, security, and efficiency, there are still several security concerns that are considered major obstacles preventing tenants from transferring their resources to the cloud. The security provided by the cloud service providers is still inadequate for the tenants security requirements because providers use standard security mechanisms regardless of the tenants requirements. Thus, cloud tenants cannot rely on the security provided by the cloud providers. Although, traditional intrusion detection systems have been proposed and developed by different entities including researchers, academicians, and practitioners as a solution that cloud providers can offer to their tenants to cope with security issues in the cloud, the requirements of the tenants in terms of security are not considered. It is very important, however, to consider the differences in the tenants security requirements to provide better security services. In this research, we concentrate on providing a security service that allows cloud tenants to monitor and protect their virtual environments by deploying a security mechanism that is capable of meeting their needs. The main contribution of this work is providing an efficient, flexible, and low-cost security as a service model-based on Intrusion Detection Systems (IDS)-that takes the tenants security requirements into consideration.

View PDFchevron_right
Developing Secure Cloud Applications
Massimiliano Rak

Scalable Computing: Practice and Experience, 2014

Today the main limit to Cloud adoption is related to the perception of a security loss the users have. Indeed, the existing solutions to provide security are mainly focused on Cloud service provider prospective in order to securely integrate frameworks and Infrastructures as a Services in a Cloud datacenter. Customer could not monitor and evaluate the security mechanisms enforced by service provider. Service Level Agreements mainly focus on performance related terms and no guarantees are given for security mechanisms. Customers are interested in tools to verify and monitor the implemented security requirements. On the other hand, developers need tools to deploy Cloud applications offering measurable security grants to end users. In this paper, we propose an approach to implement security mechanisms as components in the application design process. We modeled security interactions according to the specific threat, the specific security requirements and user/application capabilities trying to improve security. It enables a Service Provider to offer security guarantees to customers. The approach has been designed to fit with different Cloud platforms, but to demonstrate its applicability, we will present a case study on the mOSAIC Platform.

View PDFchevron_right
Scalable and Flexible SLA Management Approach for Cloud
arif umar

Mehran University Research Journal of Engineering and Technology

Cloud Computing is a cutting edge technology in market now a days. In Cloud Computing environment the customer should pay bills to use computing resources. Resource allocation is a primary task in a cloud environment. Significance of resources allocation and availability increase many fold because income of the cloud depends on how efficiently it provides the rented services to the clients. SLA (Service Level Agreement) is signed between the cloud Services Provider and the Cloud Services Consumer to maintain stipulated QoS (Quality of Service). It is noted that SLAs are violated due to several reasons. These may include system malfunctions and change in workload conditions. Elastic and adaptive approaches are required to prevent SLA violations. We propose an application level monitoring novel scheme to prevent SLA violations. It is based on elastic and scalable characteristics. It is easy to deploy and use. It focuses on application level monitoring.

View PDFchevron_right
A Security Policy for Cloud Providers The Software-as-a-Service Model
Dimitra Georgiou

─Cloud Computing is a new computing paradigm originating and combining characteristics from grid computing, distributed computing, parallel computing, virtualization and other computer technologies. Trust and security in Cloud Computing are more complex than in traditional IT systems. Conventional security policies designed for other technologies do not map well to the cloud environment, which, on top of that, may exhibit additional security requirements. In an attempt to assist cloud providers to secure their environment, and specifically for the Software-as-a-Service Model (SaaS), this paper starts with the presentation of the already reported threats. Because of these security threats, there are specific requirements that we claim must be clearly addressed in the Security Policy for the Cloud Environment. Our work focuses on the required structure and contents of such a security policy. In this respect, this paper proposes a model to describe the relationship between threats, measures, and security policies applicable to the SaaS model. It is worth stressing that in the SaaS service model, the client depends on the provider for the proper security measures.

View PDFchevron_right

References (23)

  1. C. B. Westphall and F. R. Lamin. SLA Perspective in Security Management for Cloud Computing. n Proc. of the Int. Conf. on Networking and Services, 2010, pp. 212-217.
  2. F. Cheng and C. Meinel. Intrusion Detection in the Cloud. In Proc. of the IEEE Int. Conf. on Dependable, Autonomic and Secure Computing, Dec. 2009, pp. 729-734.
  3. mOSAIC: Open Source API and platform for multiple Clouds, 2010, available at: http://www.mosaic-cloud.eu.
  4. Massimiliano Rak, Salvatore Venticinque, Rocco Aversa, Beniamino Di Martino. User Centric Service Level Management in mOSAIC Application. In Proc. of the Europar 2011 Workshop, 2011, pp. 106-115. IEEE CS Press.
  5. P. Kouznetsov, A. Haeberlen, and P. Druschel. The case for Byzantine fault detec- tion. In Proc. of the 2nd Workshop on Hot Topics in System Dependability, 2006, pp. 5-10.
  6. N. F. Neves, P. Sousa, and P. Verissimo. Proactive resilience through architectural hybridization. In Proc. of the ACM Symp. on AppliedComputing (SAC'06), 2006, pp. 686-690.
  7. R. Mista, D. Bakken C., Dyreron A. Franz and M. Medidi. Mrfusion: A pro- grammable data fusion middleware subsystem with a tunable statistical profiling service. In Proc. of the Int. Conference on Dependable Systems and Network (DSN- 2002), 2002, pp. 273-278.
  8. M. Ficco and M. Rak. Intrusion tolerance of stealth DoS attacks to web services. In Proc. of the Int. Conf. on Information Security and Privacy, Springer-Verlag LNCS, vol. 376, 2012. Pp. 579-584.
  9. L. Coppolino, S. D'Antonio, M. Esposito, and L. Romano. Exploiting diversity and correlation to improve the performance of intrusion detection systems. In Proc. of the Int. Conf. on Network and Service Security, 2009. pp. 24-26.
  10. M. Ficco and L. Romano. A generic intrusion detection and diagnoser system based on complex event processing. In Proc. of the 1st International Conference on Data Compression, Communication, and Processing (CCP 2011), 2011, pp. 285-292.
  11. D. Heimbigner., J. Knight, and A. Wolf. The willow architecture: Comprehensive survivability for large-scale distributed applications. In Proc. of the Intrusion Tol- erant System Workshop, 2002, pp. 71-78.
  12. Squid: an open source fully-featured HTTP/1.0 proxy, 2012, available at: http://www.squid-cache.org.
  13. Ganglia, a scalable distributed monitoring system for high-performance computing systems, 2012, available at: http://ganglia.sourceforge.net.
  14. M. Ficco and M. Rak. Intrusion tolerant approach for denial of service attacks to web services. In Proc. of the 1st Int. Conf. on Data Compression, Communications and Processing (CCP 2011), 2011, pp. 285-292. IEEE CS Press.
  15. TPC Benchmark W (TPC-W), a transactional web benchmark, 2012, available at: http://www.tpc.org/tpcw/.
  16. M. Ficco and M. Rak. Intrusion tolerance in cloud applications: The mOSAIC approach. In Proc. of the 6th International Conference on Complex, Intelligent, and Software Intensive Systems, CISIS 2012, 2012, pp. 170-176.
  17. M. Rak, L. Liccardo, and R. Aversa. A SLA-based Interface for Security Manage- ment in Cloud and GRID Integrations. In Proc. of the 7th International Conference on Information Assurance and Security (IAS), 2011, IEEE Press.
  18. G. Karjoth, B. Pfitzmann, M. Schunter, and M. Waidner. Service-oriented Assur- ance, Comprehensive Security by Explicit Assurances. In Quality of Protection, vol 23, 2006, Springer, p. 13-24.
  19. M. Smith, M. Schmidt, N. Fallenbeck, C. Schridde, and B. Freisleben. Optimising Security Configurations with Service Level Agreements. In Proc. of the 7th Int. Conf.on Optimization: Techniques and Applications (ICOTA 2007), 2007, pp. 367- 381, IEEE Press.
  20. I. Brandic, D. Music, S. Dustdar, S. Venugopal, and R. Buyya. Advanced QoS methods for Grid workflows based on meta-negotiations and SLA-mappings. In Proc. of the 3th Workshop on Workflows in Support of LargeScale Science, 2008.
  21. M. Ficco, M. Rak, and B. Di Martino. An intrusion detection framework for sup- porting SLA assessment in cloud computing. In Proc. of the 4th Int. Conf. on Computational Aspects of Social Networks (CASoN), Nov. 2012, pp. 244-249. IEEE CS Press.
  22. F. Palmieri, U. Fiore, and A. Castiglione. Automatic security assessment for next generation wireless mobile networks. In Mobile Information Systems, vol. 7, no. 3, 2011, pp. 217-239. IOS Press.
  23. M. Ficco, S. Venticinque, and B. Di Martino. mOSAIC-Based intrusion detection framework for cloud computing. Springer-Verlag LNCS, vol. 7566, 2012, pp. 628-644.

Related papers

EMPOWERING CLOUD SECURITY THROUGH SLA
Dana Al-Tehmazi

Cloud computing is a cumulative collection of technologies. It shares on-demand computing resources that are positioned and disposed efficiently. In spite of several benefits, numerous challenges are there such as Data security, Performance, Data Locking, Access control, Bandwidth costs, Internet Dependency, Data confidentiality, Auditability, Application and Availability. SLA (Service Level Agreement) plays a vital role in cloud computing. Each service associates with a specific SLA. This is collaboration between service providers and consumer. Therefore, SLA has to define the level of security and their intricacy established on the services to make the consumer realize about the implementation of security policies. The proposed research paper tries to evaluate the challenges in enforcing security for cloud computing services and describe the necessity of a regularization of SLA.

View PDFchevron_right
Towards Automated and Optimized Security Orchestration in Cloud SLA
Dr. Rakesh Kumar Yadav, Durgansh Sharma

International Journal on Recent and Innovation Trends in Computing and Communication

In cloud computing, providers pool their resources and make them available to customers. Next-generation computer scientists are flocking to the cutting-edge field of cloud computing for their research and exploration of uncharted territory. There are still several barriers that cloud service providers must overcome in order to provide cloud services in accordance with service level agreements. Each cloud service provider aspires to achieve maximum performance as per Service Level Agreements (SLAs), and this is especially true when it comes to the delivery of services. A cloud service level agreement (SLA) guarantees that cloud service providers will satisfy the needs of large businesses and offer their clients with a specified list of services. The authors offer a web service level agreement–inspired approach for cloud service agreements. We adopt patterns and antipatterns to symbolize the best and worst practices of OCCI (Open Cloud Computing Interface Standard), REST (Representat...

View PDFchevron_right
An Integrated Model for Secure on Demand Resource Provisioning Based on Service Level Agreement (Sla) in Cloud Computing
Taghi Javdani Gandomani

Cloud computing, as new paradigm of new century, provides various advantages and benefits for the organizations and individuals. Among them resource provisioning is a big advantage that supports cloud providers cloud resources with their users. Providing a secure way for resource provisioning is a critical issue, so that any neglect of it causes a lot of concerns for both providers and users. Service Level Agreement (SLA) defines the level of access to the resources providing in cloud environment. The main aim of this study is providing a model to integrate the common security policies and mechanisms with SLA. It proposed a security infrastructure for on-demand service provisioning.

View PDFchevron_right
Security as a Service Using an SLA-Based Approach via SPECS
Dana Petcu

2013 IEEE 5th International Conference on Cloud Computing Technology and Science, 2013

The cloud offers attractive options to migrate corporate applications, without any implication for the corporate security manager to manage or to secure physical resources. While this ease of migration is appealing, several security issues arise: can the validity of corporate legal compliance regulations still be ensured for remote data storage? How is it possible to assess the Cloud Service Provider (CSP) ability to meet corporate security requirements? Can one monitor and enforce the agreed cloud security levels? Unfortunately, no comprehensive solutions exist for these issues. In this context, we introduce a new approach, named SPECS. It aims to offer mechanisms to specify cloud security requirements and to assess the security features offered by CSPs, and to integrate the desired security services (e.g., credential and access management) into cloud services with a Security-as-a-Service approach. Furthermore, SPECS intends to provide systematic approaches to negotiate, to monitor and to enforce the security parameters specified in Service Level Agreements (SLA), to develop and to deploy security services that are cloud SLA-aware and are implemented as an opensource Platform-as-a-Service (PaaS). This paper introduces the main concepts of SPECS.

View PDFchevron_right
Security Infrastructure for On-demand Provisioned Cloud Infrastructure Services
Chunming Rong

2011 IEEE Third International Conference on Cloud Computing Technology and Science, 2011

Providing consistent security services in on-demand provisioned Cloud infrastructure services is of primary importance due to multi-tenant and potentially multi-provider nature of Clouds Infrastructure as a Service (IaaS) environment. Cloud security infrastructure should address two aspects of the IaaS operation and dynamic security services provisioning: (1) provide security infrastructure for secure Cloud IaaS operation; (2) provisioning dynamic security services, including creation and management of the dynamic security associations, as a part of the provisioned composite services or virtual infrastructures. The first task is a traditional task in security engineering, while dynamic provisioning of managed security services in virtualised environment remains a problem and requires additional research. In this paper we discuss both aspects of the Cloud Security and provide suggestions about required security mechanisms for secure data management in dynamically provisioned Cloud infrastructures. The paper refers to the architectural framework for on-demand infrastructure services provisioning, being developed by authors, that provides a basis for defining the proposed Cloud Security Infrastructure. The proposed SLA management solution is based on the WS-Agreement and allows dynamic SLA management during the whole provisioned services lifecycle. The paper discusses conceptual issues, basic requirements and practical suggestions for dynamically provisioned access control infrastructure (DACI). The paper proposes the security mechanisms that are required for consistent DACI operation, in particular security tokens used for access control, policy enforcement and authorisation session context exchange between provisioned infrastructure services and Cloud provider services. The suggested implementation is based on the GAAA Toolkit Java library developed by authors that is extended with the proposed Common Security Services Interface (CSSI) and additional mechanisms for binding sessions and security context between provisioned services and virtualised platform.

View PDFchevron_right
580 California St., Suite 400
San Francisco, CA, 94104
© 2025 Academia. All rights reserved