Data and computation integrity and security are major concerns for users of cloud computing facilities.  Many production-level clouds optimistically assume that all cloud nodes are equally trustworthy when dispatching jobs; jobs are dispatched based on node load, not reputation.  This increases their vulnerability to attack, since compromising even one node suffices to corrupt the integrity of many distributed computations. This paper presents and evaluates Hatman: the first full-scale, data-centric, reputation-based trust management system for Hadoop clouds.  Hatman dynamically assesses node integrity by comparing job replica outputs for consistency.  This yields agreement feedback for a trust manager based on EigenTrust.  Low overhead and high scalability is achieved by formulating both consistency-checking and trust management as secure cloud computations; thus, the cloud's distributed computing power is leveraged to strengthen its security.  Experiments demonstrate that with feedback from only 100 jobs, Hatman attains over 90% accuracy when 25% of the Hadoop cloud is malicious.

/pdf/hatman-intra-cloud-trust-management-for-hadoop-2cruwb58hx.pdf

Hatman: Intra-cloud Trust Management for Hadoop

This paper proposes a social network approach to the provisioning and management of cloud computing services termed Opportunistic Cloud Computing Services (OCCS), for enterprises; and presents the research issues that need to be addressed for its implementation We hypothesise that OCCS will facilitate the adoption process of cloud computing services by enterprises OCCS deals with the concept of enterprises taking advantage of cloud computing services to meet their business needs without having to pay or paying a minimal fee for the services The OCCS network will be modelled and implemented as a social network of enterprises collaborating strategically for the provisioning and consumption of cloud computing services without entering into any business agreements We conclude that it is possible to configure current cloud service technologies and management tools for OCCS but there is a need for new approaches that view enterprises as both service providers and consumers to facilitate the easy implementation of OCCS networks Keywords-cloud service brokerage; social networking; and opportunistic cloud computing services

/pdf/a-social-network-approach-to-provisioning-and-management-of-2u2c1n73zs.pdf

A Social Network Approach to Provisioning and Management of Cloud Computing Services for Enterprises

Software-as-a-service (SaaS) cloud systems enable application service providers to deliver their applications via massive cloud computing infrastructures. However, due to their sharing nature, SaaS clouds are vulnerable to malicious attacks. In this paper, we present IntTest, a scalable and effective service integrity attestation framework for SaaS clouds. IntTest provides a novel integrated attestation graph analysis scheme that can provide stronger attacker pinpointing power than previous schemes. Moreover, IntTest can automatically enhance result quality by replacing bad results produced by malicious attackers with good results produced by benign service providers. We have implemented a prototype of the IntTest system and tested it on a production cloud computing infrastructure using IBM System S stream processing applications. Our experimental results show that IntTest can achieve higher attacker pinpointing accuracy than existing approaches. IntTest does not require any special hardware or secure kernel support and imposes little performance impact to the application, which makes it practical for large-scale cloud systems.

Scalable Distributed Service Integrity Attestation for Software-as-a-Service Clouds

Cloud computing is a technology that uses the internet and central remote servers to maintain data and applications. Cloud computing allows consumers and businesses to use applications without installation and access their personal files at any computer with internet access. As it is publicly available the security mechanisms are of highly concern. In this paper, we have given a survey of the different security and application aspects of cloud computing such as confidentiality, integrity, transparency, availability, accountability, assurance.

A Survey on Cloud Computing Security

The confidentiality and integrity are the most important issues in cloud storage system. We address the privacy issue of decentralized cloud storage system using threshold cryptography. Once the user uploads his data and deletes the local copy, he might lost the full control of the data. The major challenges of designing this cloud storage system are to provide a better privacy guarantee and ensure the integrity of data at untrusted servers in distributed cloud storage system. To achieve this goal, we propose a threshold encryption scheme and integrate it with a secure decentralized erasure code to form a secure cloud storage system, where the user generates a secret parameter participated in system encryption and decryption of plaintext blocks in the combine process. So our systems can prevent cloud storage servers from modifying data by providing remote data check and meets the requirements of data robustness, confidentiality and integrity.

A secure remote data integrity checking cloud storage system from threshold encryption

Cloud systems provide a cost-effective service hosting infrastructure for application service providers (ASPs). However, cloud systems are often shared by multiple tenants from different security domains, which makes them vulnerable to various malicious attacks. Moreover, cloud systems often host long-running applications such as massive data processing, which provides more opportunities for attackers to exploit the system vulnerability and perform strategic attacks. In this paper, we present AdapTest, a novel adaptive data-driven runtime service integrity attestation framework for multi-tenant cloud systems. AdapTest can significantly reduce attestation overhead and shorten detection delay by adaptively selecting attested nodes based on dynamically derived trust scores. Our scheme treats attested services as black-boxes and does not impose any special hardware or software requirements on the cloud system or ASPs. We have implemented AdapTest on top of the IBM System S stream processing system and tested it within a virtualized computing cluster. Our experimental results show that AdapTest can reduce attestation overhead by up to 60% and shorten the detection delay by up to 40% compared to previous approaches.

/pdf/adaptive-data-driven-service-integrity-attestation-for-multi-135it28zc6.pdf

Nidhi Shah

Papers

Adaptive data-driven service integrity attestation for multi-tenant cloud systems