Multi-tenant Cloud Environment Research Articles

Smart Ontology Framework for Multi-Tenant Cloud Architecture

The exponential growth of data complexity in an era marked by the rapid expansion of the computer environment has led to an increase in the demand for scalable and effective systems. The crucial stage of data management, which acts as a vital conduit for accelerating the processing of enormous amounts of data, is at the centre of this paradigm. Scientific workflows must be coordinated in order to orchestrate the management of large datasets within this complex ecosystem. These workflows differ from generic workflows in that they involve a complex interplay of scheduling, algorithms, data flow, processes, operational protocols, and a focused attention on data-intensive systems. Software as a Service's (SaaS) distinctive feature of multi-tenancy is inextricably related to the growth of the industry. In this complex fabric, the investigation of scientific processes reveals a mutually beneficial relationship with the multi-tenant cloud orchestration environment, revealing a realm that goes beyond simple control and data propagation. It opens a fresh path for system development and makes service delivery's previously hidden facets visible. This study pioneers an exploration into a thorough framework for scientific operations within the context of multi-tenant cloud orchestration. Semantics-based workflows, which leverage semantics to help users manage the complexities of data orchestration, form the basis of this paradigm. In addition, policy-based processes provide another level of intricacy, giving users a flexible way to manoeuvre the complex environment of multi-tenancy, orchestration, and service identification. The study focuses on the fundamentals of orchestrating scientific workflows in a multi-tenant cloud environment, where the creative, scalable, and effective composition results from the harmonious integration of data and semantics under the guidance of rules.

Blockchain Merkle-Tree Ethereum Approach in Enterprise Multitenant Cloud燛nvironment

This research paper puts emphasis on using cloud computing with Blockchain (BC) to improve the security and privacy in a cloud. The security of data is not guaranteed as there is always a risk of leakage of users’ data. Blockchain can be used in a multi-tenant cloud environment (MTCE) to improve the security of data, as it is a decentralized approach. Data is saved in unaltered form. Also, Blockchain is not owned by a single organization. The encryption process can be done using a Homomorphic encryption (HE) algorithm along with hashing technique, hereby allowing computations on encrypted data without the need for decryption. This research paper is composed of four objectives: Analysis of cloud security using Blockchain technology; Exceptional scenario of Blockchain architecture in an enterprise-level MTCE; Implementation of cipher-text policy attribute-based encryption (CP-ABE) algorithm; Implementation of Merkle tree using Ethereum (MTuE) in a Multi-tenant system. Out of these four objectives, the main focus is on the implementation of CP-ABE algorithm. CP-ABE parameters are proposed for different levels of tenants. The levels include inner tenant, outer tenant, Inner-Outer-Tenant, Inner-Outer-External-Tenant, Outer-Inner-Tenant, External-Outer-Inner-Tenant and the parameters such as token, private key, public key, access tree, message, attribute set, node-level, cipher-text, salting which will help in providing better security using CP-ABE algorithm in a multi-tenant environment (MTE) where tenants can be provided with different levels of security and achieved 92 percentage of authenticity and access-control of the data.

A Reliable Client Detection System during Load Balancing for Multi-tenant Cloud Environment

A Reliable Client Detection System during Load Balancing for Multi-tenant Cloud Environment

Multi-Tenant Cloud Environment and its Authorization

Multi-Tenant Cloud Environment and its Authorization

A Survey of Malware Risk Detection Techniques in Cloud

This article aims to contribute in securing information technology (IT) systems and processes for information security by utilizing malware risk detection for decision-making processes to mitigate cyber-attacks. It has potential to be a real threat to the businesses and industrial applications. The risk management is an essential component where it can present a new information security model for supporting decision making. The current ideologies such as the anti-virus, malware and firewalls detection and protection are proving to be ineffective as they were not specifically designed for multi-tenant cloud environments. Therefore, this article presents a survey of malware risk detection techniques in cloud. The survey was conducted on publications from Scopus from the last 5 years. The findings indicate the current malware detection techniques are not enough to effectively detect and protect the cloud environments.

SA2-MCD: Secured Architecture for Allocation of Virtual Machine in Multitenant Cloud Databases

Cloud computing is one of the most demanding technology in today's era. At one side, where cloud computing is offering unlimited amount of IT resources to provide exceptional performance in computing but on the other side, it is facing the security issues majorly with public cloud for multitenant cloud environment. Due to the security issues with public cloud, most of the government and private organizations are not moving their private and sensitive data over the public cloud and compromising with the limited IT resources available to them and limited performance from available resources. A solution to secure private space over the public cloud will resolve the aforesaid issues. This paper presents SA 2 - MCD : Secured Architecture for Allocation of Virtual Machine in Multitenant Cloud Databases. This proposed architecture is used for public cloud which provides the private space over multitenant public cloud environment. Moreover, SA 2 - MCD is used for efficient distribution of transactions in distributed databases over the public cloud to offer the secured and remarkable performance. It is useful for both software and hardware level security. Random encryption selection method ( RESM ) for software level security and N_port zoning, F_port zoning, logical unit number ( LUN ) masking, node_port_ID virtualization ( NPIV ), raw device mapping ( RDM ) have been used for hardware level security in SA 2 - MCD architecture. The proposed architecture has been evaluated mathematically and simulated through CloudSim 3.0.3 tool. The experimental results reveal that the proposed architecture SA 2 - MCD gives the better performance as compared to the existing architectures such as T-MMORRS, MGA , DPRA and PRP .

TamForen: A tamper‐proof cloud forensic framework

AbstractCloud forensics has become increasingly critical in cloud computing security in recent years. A fundamental problem in cloud forensics is how to safely and effectively obtain, preserve, and analyze evidence. With massive cloud forensic systems and tools having been proposed over the years, we identify one challenge that is not adequately addressed in the current literature. The problem is “credibility of cloud evidence”; this is where the evidence collected in the cloud is unreliable due to its multitenancy and the multiple participants in the forensic process. In this paper, we develop a new Cloud Forensics Tamper‐Proof Framework (TamForen) for cloud forensics, which can be used in an untrusted and multitenancy cloud environment. This framework relies on the cloud forensics system independent of the daily cloud activities and is implemented based on the Multilayer Compressed Counting Bloom Filter. Unlike existing cloud forensics methods that depend on the support and trust of cloud service providers, TamForen takes into account the untrustworthiness of participants in the forensics process and conducts tamper‐proof protection of data in a decentralized way without violating users' privacy. We simulate a cloud forensics environment to evaluate TamForen, and the results show that TamForen is feasible.

Doris: An Adaptive Soft Real-Time Scheduler in Virtualized Environments

With the development of cloud computing and virtualization technologies, more and more soft real-time applications, such as Voice over Internet Protocol (VoIP) server and cloud gaming, are running in virtualized data centers. Though previous studies optimize CPU schedulers of hypervisors to support these applications in virtualized environments, there are some important challenges in designing an efficient CPU scheduler which is suitable for real-world clouds. On one hand, hypervisors do not know whether an application in a virtual machine (VM) has real-time requirements, so manually setting the scheduling parameters is a common case for CPU schedulers, which probably increases users’ burden, lacks flexibility, and causes misconfigurations. On the other hand, it has been reported that most of existing CPU schedulers designed for soft real-time applications have an obvious propensity to such applications which prevents them from being applied in practical multi-tenant cloud environments. In this paper, we design and implement an adaptive soft real-time scheduler based on Xen, named Doris , to address these challenges. It identifies the VMs running soft real-time applications (RT-VMs) and infers their scheduling parameters according to the communication behaviors of VMs adaptively. Then, it promotes the priorities of VCPUs of the RT-VMs temporarily according to I/O events and the inferred scheduling parameters of RT-VMs to support soft real-time applications adaptively while minimizing the impacts on non-real-time applications. Finally, considering the importance of privileged entities (such as Domain0 in Xen) in I/O processing, Doris sets their types and scheduling parameters dynamically, which enables the adaptive scheduling of them to guarantee the performance of soft real-time applications. Our evaluation shows Doris can support soft real-time applications adaptively and efficiently, and only introduces very slight overhead.

Leakier Wires

In complex FPGA designs, implementations of algorithms and protocols from third-party sources are common. However, the monolithic nature of FPGAs means that all sub-circuits share common on-chip infrastructure, such as routing resources. This presents an attack vector for all FPGAs that contain designs from multiple vendors, especially for FPGAs used in multi-tenant cloud environments, or integrated into multi-core processors. In this article, we show that “long” routing wires present a new source of information leakage on FPGAs, by influencing the delay of adjacent long wires. We show that the effect is measurable for both static and dynamic signals and that it can be detected using small on-board circuits. We characterize the channel in detail and show that it is measurable even when multiple competing circuits (including multiple long-wire transmitters) are present and can be replicated on different generations and families of Xilinx devices (Virtex 5, Virtex 6, Artix 7, and Spartan 7). We exploit the leakage to create a covert channel with 6kbps of bandwidth and 99.9% accuracy, and a side channel, which can recover signals kept constant for only 1.3sμs, with an accuracy of more than 98.4%. Finally, we propose countermeasures to reduce the impact of this leakage. 1

English

English

Optimal allocation of cloud multi-tenant platform infrastructure resources

Infrastructure resources optimisation is a significant challenge in multi-tenant cloud environment. A system and associated algorithm and processes to enable a multi-tenant platform operator or administrator to make more optimal decisions with regards to the allocation of platform infrastructure resources (such as computational capabilities, data storage, etc.) among one or more tenants or accounts are provided. In particular, we construct a data 'signature' for a set of identified users, accounts, or tenants, where the signature contains data regarding the user, account, or tenant's 'consumption' of platform infrastructure resources. Later tenants 'signatures' are being used to accomplish cloud infrastructure resources optimisation in multi-tenant environment. An innovative algorithm for cloud infrastructure resources optimisation in multi-tenant environment is introduced in current paper.

C-ABAC: An ABAC based Model for Collaboration in Multi-tenant Environment

Collaborative systems allow a group of users to collaborate through distributed platforms in order to perform a common task. Collaborators usually use cloud-based solutions to outsource their data and to benefit from the cloud capabilities. Ensuring access control in a cloud-based collaborative session is an important problem that should be addressed, especially in a multi-tenant configuration. In this paper, we present C-ABAC, a Collaboration Attributes Based Access Control model that ensures access control in multi-tenant cloud environments. C-ABAC supports the workflow concept, preserves the tenants autonomy in defining their local policies and preserves the confidentiality of the object attributes. The implementation of C-ABAC in the SwiftStack environment demonstrates the feasibility of the suggested model.

Multi-Factor Synthesis Decision-Making for Trust-Based Access Control on Cloud

Providing a creditable basis for access control decision-making is not an easy task for the resource pooling, dynamic, and multi-tenant cloud environment. The trust notation can provide this creditable basis, based on multiple factors that can accurately compute the user’s trust for the granting access entity. In this paper, the formal trust model has been introduced, which presents a novel method to provide the basis for granting access. It is based on three factors and their semantic relations, which investigate important measures for the cloud environment. Also, a new Trust-Based Access Control (TB-AC) model has been proposed. The proposed model supports dynamically changing the user’s assigned permissions based on its trust level. In addition, TB-AC ensures secure resource sharing among potential untrusted tenants. TB-AC has been deployed on a separated VM in our private cloud environment, which is built using OpenStack. The experimental results indicated that TB-AC can evaluate access requests within reasonable and acceptable processing times, which is based on the final trust level calculation and the communication between TB-AC and some of the intended OpenStack services. By considering very rough conditions and huge traffic overhead, the final trust level can be calculated in an average time of 200[Formula: see text]ms. Furthermore, the communication overhead between TB-AC and each of Keystone, Nova, and Neutron is very light. Finally, TB-AC has been tested under different scenarios and is provable, usable and scalable.

Energy efficiency comparison of hypervisors

Current cloud data centers are fully virtualized for service consolidation and power/energy reduction. Although virtualization could reduce the real-time power consumption and overall energy consumption, the energy characteristics of hypervisors hosting different workloads have not been well profiled or understood thus far. In this study, we investigate the power and energy characteristics of four mainstream hypervisors and a container engine, namely VMware ESXi, Microsoft Hyper-V, KVM, XenServer, and Docker, on six different platforms (three mainstream 2U rack servers, one emerging ARM64 server, one desktop server, and one laptop) with power measurements made over prolonged periods. We use computation-intensive, memory-intensive, and mixed Web server-database workloads to explore the power and energy characteristics of different hypervisors in order to emulate realistic multi-tenant cloud environments. The results of extensive experiments conducted with four workload levels (very light, light, fair, and very heavy) indicate that the hypervisors exhibit different power and energy characteristics. Our findings are as follows. (1) Hypervisors exhibit different power and energy consumptions on the same hardware running the same workload. (2) Although mainstream hypervisors have different energy efficiencies aligned with different workload types and workload levels, no single hypervisor outperforms the other hypervisors on all platforms in terms of power or energy consumption. (3) Although container virtualization is considered as lightweight virtualization in terms of implementation and maintenance, it is essentially not more power-efficient than conventional virtualization technology. (4) Although the ARM64 server has low power consumption, it completes computation tasks with a long execution time and, sometimes, high energy consumption. Further, ARM64 servers have medium energy consumption per database operation for mixed workloads. The results presented in this paper can provide system designers and data center operators with useful insights for power-aware workload placement and virtual machine scheduling.

AdaptScale: An adaptive data scaling controller for improving the multiple performance requirements in Clouds

Data scaling issue has become a bottleneck in multi-tenancy cloud environment. Fluctuated workloads bring challenges to current automatic data scaling strategies on meeting variable user performance requirements in a shared storage system. To this end, this paper develops an adaptive data scaling controller to meet multiple performance requirements in Clouds. The controller consists of three components: (1) a performance model, which determines whether the nodes are over-loaded; (2) a workload monitor and a predictor, which are responsible for collecting workload information and estimating the fluctuating trends, respectively; (3) a data scaling strategy generator, which enables the data scaling solution for over-loaded or under-loaded nodes. The numerical results show that the developed controller achieves the goal of automatic data scaling, which not only satisfies diversified performance requirements, but also reduces the execution time of MOVE operations with regards to system performance.

Detecting TCP SYN Flood Attack in the Cloud

In this paper, an approach to protecting virtual machines (VMs) against TCP SYN flood attack in a cloud environment is proposed. An open source cloud platform Eucalyptus is deployed and experimentation is carried out on this setup. We investigate attacks emanating from one VM to another in a multi-tenancy cloud environment. Various scenarios of the attack are executed on a webserver VM. To detect such attacks from a cloud provider’s perspective, a security mechanism involving a packet sniffer, feature extraction process, a classifier and an alerting component is proposed and implemented. We experiment with k-nearest neighbor and artificial neural network for classification of the attack. The dataset obtained from the attacks on the webserver VM is passed through the classifiers. The artificial neural network produced a F1 score of 1 with the test cases implying a 100% detection accuracy of the malicious attack traffic from legitimate traffic. The proposed security mechanism shows promising results in detecting TCP SYN flood attack behaviors in the cloud.

Minerva: Proactive Disk Scheduling for QoS in Multitier, Multitenant Cloud Environments

In recent years, Internet-connected devices have become ubiquitous, leading to increased demand for computing and storage resources. The cloud has emerged as a cost-effective and scalable solution to infrastructure requirements, making it possible to consolidate several disparate computing resources into a single physical machine. However, while the availability of multicore CPUs, high-capacity memory modules, and virtualization technologies has increased the density of converged infrastructure, disk I/O has remained a substantial performance bottleneck, especially when dealing with high-capacity mechanical disks. Here, the authors investigate how proactive disk scheduling, backed by predictive models and client-side coordination, can influence the overall throughput and responsiveness of a cluster in data-intensive computing environments. They evaluate their framework with a representative MapReduce job on a 1,200-virtual-machine cluster, demonstrating a 21 percent improvement in completion time under heavy disk contention.

A 4D-Role Based Access Control Model for Multitenancy Cloud Platform

Since more and more applications and services have been transferred from servers in the B/S architecture to cloud, user access control has become a significant part in a multitenancy cloud platform. Role based access control model makes users participate in an enterprise system as particular identities. However, in a multitenancy cloud environment, it has a high probability that the information of tenants has been leaked by using existing role based access control (RBAC) model. Moreover, management problems may emerge in the multitenancy platform with the increment of the number of tenants. In this paper, a novel concept of 4D-role is presented. With a detailed definition on the concept of 4D-role, a 4D-role based multitenancy model is proposed for running various applications and services in the multitenancy cloud platform. A theoretical analysis indicates that the model has the characters of tenant isolation, role hierarchy, and administration independence. The three characters are also verified by experimental evaluation. Moreover, the evaluation results indicate that the model has a good performance in using cloud resources when large-scale users are operating in the cloud platform simultaneously.

Kraken

It is well-known that without strict network bandwidth guarantees, application performance in multi-tenant cloud environments is unpredictable. While recently proposed systems support explicit bandwidth reservation mechanisms, they require the resource schedules to be announced ahead of time . We argue that this is not practical in today's cloud environments, where application demands are inherently unpredictable, e.g., due to stragglers. We in this paper present KRAKEN, a system that allows tenants to dynamically request and update minimum resource guarantees for both network bandwidth and compute resources at runtime . Unlike previous work, Kraken does not require prior knowledge about the resource needs of the tenants' applications but allows tenants to modify their reservation at runtime. Kraken achieves this through an online resource reservation scheme , and by optimally embedding and reconfiguring virtual networks.

PriDyn: Enabling Differentiated I/O Services in Cloud Using Dynamic Priorities

Virtualization is one of the key enabling technologies for Cloud computing. Although it facilitates improved utilization of resources, virtualization can lead to performance degradation due to the sharing of physical resources like CPU, memory, network interfaces, disk controllers, etc. Multi-tenancy can cause highly unpredictable performance for concurrent I/O applications running inside virtual machines that share local disk storage in Cloud. Disk I/O requests in a typical Cloud setup may have varied requirements in terms of latency and throughput as they arise from a range of heterogeneous applications having diverse performance goals. This necessitates providing differential performance services to different I/O applications. In this paper, we present PriDyn, a novel scheduling framework which is designed to consider I/O performance metrics of applications such as acceptable latency and convert them to an appropriate priority value for disk access based on the current system state. This framework aims to provide differentiatedI/O service to various applications and ensures predictable performance for critical applications in multi-tenant Cloud environment. We demonstrate through experimental validations on real world I/O traces that this framework achieves appreciable enhancements in I/O performance, indicating that this approach is a promising step towards enabling QoS guarantees on Cloud storage.