Security Service Level Agreement Research Articles

Keeping Verticals’ Sovereignty During Application Migration in Continuum

Competing service providers in the cloud environment ensure services are delivered under the promised security requirements. It is crucial for mobile services where user’s movement results in the service’s migration between edge servers or clouds in the Continuum. Maintaining service sovereignty before, during, and after the migration is a real challenge, especially when the service provider has committed to ensuring its quality following the Service Level Agreement. In this paper, we present the main challenges mobile service providers face in a cloud environment to guarantee the required level of security and digital sovereignty as described in the Security Service Level Agreement, with emphasis on challenges resulting from the service migration between the old and new locations. We present the security and sovereignty context intended for migration and the steps of the migration algorithm. We also analyze three specific service migration cases for three vertical industries with different service quality requirements.

Challenges for Continuous, Provable Security Service Level Agreement Management in Computing Continuum

Challenges for Continuous, Provable Security Service Level Agreement Management in Computing Continuum

Blockchain-Based Network Slice Broker to Facilitate Factory-As-a-Service

The novel concept of factory-as-a-service (FaaS) allows the agility of adapting the manufacturing process by identifying the industry’s supply chain and user requirements. To cater to FaaS, flexibility in networking and cloud services is a must. 5G network slice broker (NSB) is a third-party mediator that caters to networking resource demand from clients to the service providers. Thus, this article introduces a secure blockchain-based NSB to facilitate FaaS. The proposed secure NSB (SNSB) provides secure, cognitive, and distributed network services for resource allocation and security service level agreement (SSLA) formation with coordination of slice managers and SSLA managers. In SNSB, we introduce a federated slice selection algorithm with Stackelberg game model and reinforcement learning algorithm to compute the real time and the optimal unit price and demand level. We provide an extensive implementation and performance evaluation of SNSB using the slice manager and a custom SSLA manager.

Security Context Migration in MEC: Challenges and Use Cases

Modern and future services require ultra-reliable mobile connections with high bandwidth parameters and proper security protection. It is possible to ensure such conditions by provisioning services in the Multi-Access Edge Computing system integrated with fifth-generation mobile networks. However, the main challenge in the mentioned architecture is providing a secure service migration with all related data and security requirements to another edge computing host area when the user changes its physical location. This article aims to present the state of research on the migration of the security context between service instances in Edge/MEC servers, specify steps of the migration procedure, and identify new security challenges inspired by use cases of 5G vertical industries. For this purpose, the analysis of the security context’s structure and basic concept of the Security Service Level Agreement was performed and presented in the document. Next, a further investigation of the security context was conducted, including requirements for its reliable migration between edge serves instances. The study mainly focused on crucial migration challenges and possible solutions to resolve them. Finally, the authors presented how the proposed solution can be used to protect 5G vertical industries services based on several mobile use cases.

Management and enforcement of secured E2E network slices across transport domains

Due to the fact that the current variability of services is brought by the current networks and the new possibilities that will appear thanks to the near-future networks, Network Slicing has become one of the key elements to allow the co-existence of multiple computing and transportservices with different requirements (i.e., performance, security, isolation) over the same infrastructure in multi-tenant and multi-domain (i.e., edge, transport, core) scenarios. The use of this and other technologies allow to have only one generic infrastructure (e.g., an optical transport domain) despite the services differences, instead of needing specific resources (e.g., on single optical fiber) for each type of service. Multiple works have been published about Network Slicing, Network Function Virtualization and Software Defined Networks using multiple computing and transport domains but, based on our literature research, there is one important aspect with a low amount of attention: the security management around network slices and their enforcement. It is essential to ensure that the expected Quality of Security (QoSec) is accomplished based on the correct deployment and posterior monitoring of the security metrics defined in the agreed Security Service Level Agreement (SSLA) between the service requester and the provider.This article aims to present an architecture designed to manage and control the life-cycle of secured End-to-End (E2E) network slices involving multiple domains based on the SSLA requirements. The security management architecture is described with its components together with the deployment and monitoring processes and the data objects used. Finally, an experimental validation is described using the use case of a DoS attack scenario and its resolution.

Security and Privacy Service Level Agreement composition for Internet of Things systems on top of standard controls

The growing markets of Cloud services and IoT platforms have dramatically raised system flexibility and deployment options. However, increasing complexity and dependency on third-party providers make it difficult to assess the security and privacy levels that distributed systems can offer to their users. In the last years, machine-readable Service Level Agreements (SLAs) have been studied as an optimal method for copying with security and privacy policies. Still, the computation of the SLAs of applications distributed in diverse infrastructures remains a challenging task. This paper presents a methodology to compose security SLAs (SecSLAs) and privacy SLAs (PLAs) of Cloud-based IoT applications on top of standard controls. The composition considers individual components’ SLAs and the control delegation relationships between the components with respect to different types of controls (common, system-specific or hybrid controls). Furthermore, we propose a technique to calculate the Service Level Objectives (SLO) of the controls declared in the composite SLA based on the SLOs granted by individual components. Finally, the paper presents the validation of the methodology carried out to create the SecSLAs and PLAs of a real multiCloud-based IoT application in the eHealth domain.

Proof of outsourced encryption: cross verification of security service level agreement

With the popularity of cloud and edge computing, user data is often stored at third party service providers. Restricted by the available resources, end users may need to outsource the data encryption operations. However, the security service level agreement (SSLA) are usually hard to verify since it is fairly hard for end users to learn the data status at the service providers. In this paper, we investigate the proof of outsourced encryption problem. We first define the expected properties of the proof of encryption (PoE) mechanisms. Depending on the negotiated encryption algorithm in SSLA, we design two verification mechanisms so that end users can query encryption results at service providers to verify the enforcement of SSLA even when they are not aware of the keys. We formally analyze the protocols with BAN logic. Simulation and experiments show that our approaches can detect a dishonest service provider with high probability.

Calculating the trust of providers through the construction weighted Sec-SLA

Information systems are often exposed to various types of threats, which can cause different types of damage and lead to significant financial losses. Security issues can range from small losses to a destruction of the whole information system. The effects of various threats vary considerably: some affect the confidentiality or integrity of data, while others affect the availability of a system. Organizations are now struggling to understand what the threats to their information assets are, and how to fight them, which remains a challenge. We can consider than one of the key requirements to consolidate cloud computing as a robust and reliable solution is security. Organizations that seek to embrace the cloud as a solution should be aware that this technology inherits all the security vulnerabilities from traditional solutions. These are aligned with the complexity and heterogeneity of configurations related to the architecture, privacy and compliance of cloud computing. Uniform management practices should be applied between providers in relation to the security control policies agreed with their clients - defined by the Security Service Level Agreement (Sec-SLA). Because of this, we present a standardization of responsibilities, taking into account the security perimeter of the cloud, and the main mitigation and resolution measures for the types of attacks enumerated by a vulnerability base, to be included in Sec-SLAs. This enables us to measure and classify the provider’s reliability regarding the services offered. Thus, the cloud is expected to improve its control and security and get efficient response to incidents. We propose a calculation model to determine the reliability of a provider based on the solution measures and mitigation of security incidents offered in its service catalog, as well as the development of an abstract method to support consumers in the definition of weights to be attributed to the architecture, privacy and compliance used in the calculation of trust. From the vulnerabilities found, impacts and mitigation measures in the subcategories of Architecture, Privacy and Compliance of the suggested providers, considering the weights given by the consumers, allowed us to validate the abstract model of the proposed confidence calculation. This allows us to classify the providers according to the confidence presented to the consumer in a context of the security vulnerabilities and policies adopted.

Towards Security-based Formation of Cloud Federations: A Game Theoretical Approach

Cloud federations allow Cloud Service Providers (CSPs) to deliver more efficient service performance by interconnecting their Cloud environments and sharing their resources. However, the security of the federated service could be compromised if the resources are shared with relatively insecure CSPs, and violations of the Security Service Level Agreement (Security-SLA) might occur. In this paper, we propose a Cloud federation formation model that considers the security level of CSPs. We start by applying the Goal-Question-Metric (GQM) method to develop a set of parameters that quantitatively describes the Security-SLA in the Cloud, and use it to evaluate the security levels of the CSPs and formed federations with respect to a defined Security-SLA baseline, while taking into account CSPs’ customers’ security satisfaction. Then, we model the Cloud federation formation process as a hedonic coalitional game with a preference relation that is based on the security level and reputation of CSPs. We propose a federation formation algorithm that enables CSPs to join a federation while minimizing their loss in security, and refrain from forming relatively insecure federations. Experimental results show that our model helps maintaining higher levels of security in the formed federations and reducing the rate and severity of Security-SLA violations.

An iterative mathematical decision model for cloud migration: A cost and security risk approach

SummaryThis paper presents an iterative mathematical decision model for organizations to evaluate whether to invest in establishing information technology (IT) infrastructure on‐premises or outsourcing IT services on a multicloud environment. This is because a single cloud cannot cover all types of users’ functional/nonfunctional requirements, in addition to several drawbacks such as resource limitation, vendor lock‐in, and prone to failure. On the other hand, multicloud brings several merits such as vendor lock‐in avoidance, system fault tolerance, cost reduction, and better quality of service. The biggest challenge is in selecting an optimal web service composition in the ever increasing multicloud market in which each provider has its own pricing schemes and delivers variation in the service security level. In this regard, we embed a module in the cloud broker to log service downtime and different attacks to measure the security risk. If security tenets, namely, security service level agreement, such as availability, integrity, and confidentiality for mission‐critical applications, are targeted by cybersecurity attacks, it causes disruption in business continuity, leading to financial losses or even business failure. To address this issue, our decision model extends the cost model by using the cost present value concept and the risk model by using the advanced mean failure cost concept, which are derived from the embedded module to quantify cloud competencies. Then, the cloud economic problem is transformed into a bioptimization problem, which minimizes cost and security risks simultaneously. To deal with the combinatorial problem, we extended a genetic algorithm to find a Pareto set of optimal solutions. To reach a concrete result and to illustrate the effectiveness of the decision model, we conducted different scenarios and a small‐to‐medium business IT development for a 5‐year investment as a case study. The result of different implementation shows that multicloud is a promising and reliable solution against IT on‐premises deployment.

Automatically Enforcing Security SLAs in the Cloud

Dealing with the provisioning of cloud services granted by Security SLAs is a very challenging research topic. At the state of the art, the main related issues involve: (i) representing security features so that they are understandable by both customers and providers and measurable (by means of verifiable security-related Service Level Objectives (SLOs)), (ii) automating the provisioning of security mechanisms able to grant desired security features (by means of a security-driven resource allocation process), and (iii) continuously monitoring the services in order to verify the fulfillment of specified Security SLOs (by means of cloud security monitoring solutions). We propose to face the Security SLA life cycle management with a framework able to enrich cloud applications with security features. In this paper we (i) present a novel Security SLA model and (ii) illustrate a security-driven planning process that can be adopted to determine the (optimum) deployment of security-related software components. Such process takes into account both specific implementation constraints of the security components to be deployed and customers security requirements, and enables the automatic provisioning and configuration of all needed resources. In order to demonstrate the applicability of the approach, we present and discuss a practical application of the model on a real case study.

State of the art and challenges of security SLA for cloud computing

There are users and organizations that resist adopting cloud computing solutions, due to concerns about the security and privacy of their data. A Service Level Agreement (SLA) can be used to address these concerns, increasing trust in the purchased services through the clear description of the guarantees offered by the provider to the subscribers. For this purpose, the authors performed a literature systematic mapping to enumerate existing solutions and open issues in security SLAs in cloud computing. This review is presented in this paper as well as an analysis of the state of art. This paper also presents a classification of the selected papers and a discussion about management of security SLAs in clouds.

SLA-based Secure Cloud Application Development

The perception of lack of control over resources deployed in the cloud may represent one of the critical factors for an organization to decide to cloudify or not its own services. The flat security features offered by commercial cloud providers to every customer, from simple practitioners to managers of huge amounts of sensitive data and services, is an additional problem. In recent years, the concept of Security Service Level Agreements (Security SLAs) is assuming a key role for the secure provisioning of cloud resources and services. This paper illustrates how to develop cloud applications that deliver services covered by Security SLAs by means of the services and tools provided by the SPECS framework, developed in the context of the SPECS (Secure Provisioning of Cloud Services based on SLA Management) European Project. The whole (SPECS) application life cycle is dealt with, in order to give a comprehensive view of the different parties involved and of the processes needed to offer security guarantees on top of cloud services. The discussed development process is exemplified by means of a real-world case study consisting in a cloud application offering a secure web container service.

Introduction to the Special Issue on New Approaches for Infrastructure Services

The special issue is dedicated to the current research and innovation challenges encountered at infrastructure-as-a-service level generated by the desire to improve the user experiences and the efficient use of the available resources. The current trends are including the integration of special devices from high performance computing ones to mobile devices, the design of decentralised service-oriented systems, the improvement of the virtualization technologies, the overcome of portability and interoperability issues, or the automation the organisation and management of the back-end resources. Cloud-based applications from the fields of Internet-of-Things and Big Data are expected to challenge the new services. The first paper, entitled SLA-based Secure Cloud Application Development, reports an implementation of the concept of security service level agreements (Security SLAs) and presents a framework that allows application developers to intervine in the secure provisioning of cloud resources and services. The second paper, with the title Impact of Single Parameter Changes on Ceph Cloud Storage Performance, shows how a change of a global parameter of Ceph distributed file system can effect the performance for a range of access patterns when tested with an OpenStack cloud system. The third paper, entitled Multi-objective middleware for distributed VMI repositories in federated Cloud environment, explains the design of easy-to-use interface capable of receiving unmodified and functionally complete virtual machine images from its users, as well as of a system that transparently distribute them to a specific Cloud infrastructure in a federation achieving an improved quality of service. The fourth paper, with the title Architecture of a Scalable Platform for Monitoring Multiple Big Data Frameworks is dedicated to a new, distributed, scalable software platform able to collect, store, query and process monitoring data obtained from multiple Big Data frameworks. The fifth paper, entitled Exposing HPC services in the Cloud: the CloudLightning Approach, refers to a novel a self-organizing and self-managing cloud service delivery system with capabilities to deliver dynamic and tailored services offered by coalitions of heterogeneous cloud resources.

A novel approach to manage cloud security SLA incidents

Cloud computing is increasingly playing an important role in the service provisioning domain given the economic and technological benefits it offers. The popularity of cloud services is increasing but so are their customers’ concerns about security assurance and transparency of the Cloud Service Providers (CSPs). This is especially relevant in the case of critical services that are progressively moving to the cloud. Examples include the integrated European air traffic control system or public administrations through the governmental clouds. Recent efforts aim to specify security in cloud by using security service level agreements (secSLAs). However, the paucity of approaches to actually control the fulfillment of secSLAs and to react in case of security breaches, often results in distrust in cloud services. In this paper, we present a solution to monitor and enforce the fulfillment of secSLAs. Our framework is able to (a) detect occurrences that lead to unfulfillment of commitments, and (b) also provide mitigation to the harmful events that may or do compromise the validity of secSLAs.

Security-by-design in Clouds: A Security-SLA Driven Methodology to Build Secure Cloud Applications

This paper presents a security-by-design methodology for the development of cloud applications, which relies on Security SLAs as a means to express their security requirements. The process followed to build such Security SLAs entails the application of a risk analysis procedure aimed at identifying the main vulnerabilities affecting a cloud application and allows to determine the countermeasures to consider at design time in order to thwart the main existing threats.The paper illustrates a proof-of-concept application that founds on standard risk assessment tools and adopts state-of-art Security Control Frameworks and a novel Security SLA model for the security requirements representation.

A broker‐based cooperative security‐SLA evaluation methodology for personal cloud computing

AbstractAn underlying cloud computing feature, outsourcing of resources, makes the service‐level agreement (SLA) a critical factor for quality of service (QoS), and many researchers have addressed the question of how an SLA can be evaluated. Lately, security SLAs have also received much attention to guarantee security in a user perspective and provide optimal and efficient security service in the security paradigm shifting by cloud computing, such as security as a service. The quantitative measurement of security metrics is a considerably difficult problem and might be considered one of the multi‐dimensional aspects of security threats. To address these issues, we provide a novel cooperative security‐SLA evaluation model for the personal cloud service environment including a multi‐dimensional approach to analyze security threats depending on services type as well as a cooperative model to reach a general consensus of priorities, that is, indicators depending on services type and security metrics based on cloud brokers. Copyright © 2014 John Wiley & Sons, Ltd.

Security-SLA and Signature Scheme for Cloud Network

Cloud Computing is used for management of resources applications and information as services over the cloud. The resources used in Cloud are usually distributed as services. Cloud resources are majorly delivered to the customers in terms of services and the security here is implemented through the infrastructure security metrics via a Service Level Agreement (SLA). SLA is a legal framework between the provider and the user. In this paper we provide a comprehensive model that concentrates more on security issues. Here we try to generate security SLA which is different from traditional security as it deals with the service levels related to cloud security as in our work and see how it deals with the metrics related to security. We will also verify the security metrics through the Security SLA (SSLA).In this paper a signature based scheme based on Canonical Form Prime Factorization is also proposed. General Terms Security Metrics, Service Level Agreement, Cloud Security Framework, Signature Based Security Scheme.

The security service rating design for IT convergence services

There has been damage to users due to security problems such as personal information leaks and spam etc. by IT convergence in various information communication industries. Since where the responsibility for this damage lies, compensation systems and damage estimation criteria have not been prepared yet, its compensation is solved by civil litigation between service providers and users. In addition, for security services provided, the standardized clauses of a contract with consumers are provider-oriented articles to be disadvantageous to service users, and detailed compensation criteria have not been prepared in reality. Therefore, it is time to need to prepare a damage compensation system and an estimation criterion for protecting users against technical and legal troubles that could arise when providing security services. In order to solve these problems, this paper developed a damage compensation index for sustainable security service. In detail, by analyzing damage compensation criteria and cases for general information communication services, a damage compensation index on security services was developed for a goal of VoIP services. It could offer voluntary improvement of service quality for service providers, and simplicity of damage compensation for users. Additionally, it could socially give benefits of increasing the number of companies to apply the security SLA and mitigating legal disputes.

Applying security policies and service level agreement to IaaS service model to enhance security and transition

Over a decade ago, cloud computing became an important topic for small, medium and large businesses alike. The new concept promises scalability, security, cost reduction, portability and availability. While addressing the cloud concepts over the past several years, there have been intensive discussions about the importance of the different cloud computing service model. Moreover, there were lots of discussions about the risks in migrating to cloud computing. Therefore, this paper reviews the concept of cloud computing, security policies and concentrates on Infrastructure as a Service (IaaS) model. Also, the paper examines the risks encountered by implementing the Infrastructure as a Service (IaaS) model in organizations. Furthermore, the paper’s aim is to discuss the role of security policies, service level agreement (SLA) and compliance for enhancing the security of the IaaS service model by presenting several applicable policies.