Self-adaptive authorisation in OpenStack cloud platform

Carlos Eduardo Da Silva,Nelio Cacho,Rogério De Lemos,Thomás Diniz

doi:10.1186/s13174-018-0090-7

Carlos Eduardo Da Silva, Nelio Cacho + Show 2 more

Open Access

https://doi.org/10.1186/s13174-018-0090-7

Copy DOI

Abstract

Although major advances have been made in protection of cloud platforms against malicious attacks, little has been done regarding the protection of these platforms against insider threats. This paper looks into this challenge by introducing self-adaptation as a mechanism to handle insider threats in cloud platforms, and this will be demonstrated in the context of OpenStack. OpenStack is a popular cloud platform that relies on Keystone, its identity management component, for controlling access to its resources. The use of self-adaptation for handling insider threats has been motivated by the fact that self-adaptation has been shown to be quite effective in dealing with uncertainty in a wide range of applications. Insider threats have become a major cause for concern since legitimate, though malicious, users might have access, in case of theft, to a large amount of information. The key contribution of this paper is the definition of an architectural solution that incorporates self-adaptation into OpenStack Keystone in order to handle insider threats. For that, we have identified and analysed several insider threats scenarios in the context of the OpenStack cloud platform, and have developed a prototype that was used for experimenting and evaluating the impact of these scenarios upon the self-adaptive authorisation system for the cloud platforms.

Highlights

The use of cloud services has gained widespread adoption, and can be found in a wide number of businesses, such as, companies, research centres, universities, etc
We have identified several potential insider threats scenarios, and for dealing with these threats, we have define potential responses from a self-adaptive authorisation infrastructure that is integrated with OpenStack
We conclude this section by presenting the OpenStack cloud platform, identifying its main characteristics related to access control

Summary

Introduction

The use of cloud services has gained widespread adoption, and can be found in a wide number of businesses, such as, companies, research centres, universities, etc. CERT2 [5] defines an internal user as an employee, former employee, contractor or business partner who has access to system data, company information or resources In this way, to characterize an insider threat, this user needs to have intentions to abuse or take advantage negatively of the company’s data, affecting the confidentiality, integrity and availability of their systems [5, 18]. Some insider threats caused by an innocent user may have high potential damage as well, for example: inappropriate Internet use, which opens possibilities to virus and malware infection, exposition of the enterprise influencing in its reputation and future valuation. In this context, our approach considers both intentional and unintentional insiders

Results

Discussion

Conclusion