Cloud Tenants Research Articles

Dynamic Control Method for Tenants’ Sensitive Information Flow Based on Virtual Boundary Recognition

In the cloud environment, owing to the large-scale sharing of the upper application instance and the underlying virtual machine resources, the tenants' information flow boundary in the shared virtual machine is fuzzy and difficult to identify. In addition, protection of tenant information flow between processes is inadequate, resulting in the leakage of sensitive information of tenants. Therefore, a dynamic control method for tenants' sensitive information flow based on virtual boundary recognition is proposed. By analyzing the behavior and operation log of tenants, the behavior feature vectors of tenants are constructed, and an automatic recognition algorithm of tenant virtual boundary based on the dynamic spiking neural network is designed. This algorithm can realize dynamic identification of the tenant virtual security boundary when the application service demand changes dynamically. Further, combined with the concept of centralized and decentralized information flow control, a dynamic control method of sensitive information flow is established. The security label is formally defined by using the lattice structure, and the control rules of tenants' information flow and the rules of tenant label encryption-declassification are designed. Thus, the independent, dynamic and secure control of tenants' information flow inside and outside the tenant virtual boundary. Finally, the detailed design of a dynamic security control application system for cloud tenants' sensitive information flow is provided. Experiments confirm that the proposed algorithm can identify the security boundary of tenants more accurately and efficiently than the traditional spiking neural network classification methods. Further, the security and effectiveness of the method is verified by the intransitive noninterference theory and the experiment of information flow control.

Energy-efficient Scheduling of Cloud Data Center Servers

Data center is a cost-effective infrastructure to store large data volumes and host large-scale service applications. Providers of cloud computing services are deploying data centers worldwide quickly. With lots of servers and switches. These data centers consume substantial quantities of energy, which contributes to high operating costs. Optimizing server and network energy consumption in information centers can therefore decrease operating costs. In a data center, power utilization is chiefly because of servers, network devices, and cooling systems, an effective energy-saving strategy is to consolidate computing and communication into fewer servers and network devices and then power off as many unneeded servers and network devices as possible. A new method of reducing the energy utilization of computer systems and networks in data centers while meeting the requirements of the cloud tenants for quality of service (QoS) is proposed here in this paper.

Secured Storage of Big Data in Cloud

Big Data refers to large volume of data and necessitates the usage of cloud for storage and processing. Cloud tenants data is not only stored in the cloud, but it is also shared among multiple users. The data stored in cloud must be well protected as it is prone to malicious attacks and hardware failures. Also, user’s data on cloud contain sensitive information that must be protected and highly restricted from unauthorized access. Cloud deployment models such as public cloud, private cloud, and hybrid cloud can be used for storing data of cloud tenants. This paper proposes a secured storage approach for protecting data in cloud by partitioning big dataset into blocks containing user’s sensitive data, insensitive data, and public data. Sensitive data is moved to private cloud and is well protected using proxy re encryption. Insensitive data is stored in public cloud and some data blocks are randomly encrypted. Also, the storage index information of insensitive data blocks on cloud is encrypted and shared among authorized users. Public data is also moved to public cloud and to protect it the storage path information is only encrypted and shared. The proposed approach shows better results with reduced computation overhead and improved security.

An identity-based cryptographic scheme for cloud storage applications

The use of remote storage systems is gaining an expanding interest, namely the cloud storage-based services. In fact, one of the factors that led to the popularity of cloud computing is the availability of storage resources provided at a reduced cost. However, when outsourcing the data to a third party, security issues become critical concerns, especially confidentiality, integrity, authentication, anonymity and resiliency. Based on this challenge, this work provides a new approach to ensure authentication in cloud storage applications. ID-Based Cryptosystems (IBC) have many advantages over certificate-based systems, such as simplification of key management. This paper proposes an original ID-based authentication approach in which the cloud tenant is assigned the IBC-Private Key Generator (PKG) function. Consequently, it can issue public elements for its users, and can keep confidential resulting IBC secrets. Moreover, in our scheme, the public key infrastructure is still in usage to establish trust relationships between the PKGs.

A Novel Cloud-Based Temperature Monitoring Service to Datacenter Environment

As temperature-efficient of cloud datacenters becomes one of many challenges faces the engineers in today’s business environment, virtualized monitoring the resources over these datacenters is the cloud provider’s interest in a way the providers can control their temperature remotely anywhere around the world. Techniques proposed by existing works are focused on executing many cloud modules on less cloud-server which cannot be practical because massive volume of cloud modules will be scheduled by cloud tenants. This motivated us to present a novel solution and propose a real-time temperature aware for cloud network datacenters. The proposed paradigm is constructed based on defining dual thresholds per datacenter to control the level of temperature. Moreover, we have set the upper threshold to 25 degree and the lower one to 15 degree. Surpassing these values alerts network administrator through cloud-based software service to operate the cooling unit(s). The microcontrollers that have been incorporated are both Arduino and GSM Shield. The simulation results showed that our heuristic had the ability to control the temperature per datacenter approximately 63%.

STRATFram: A framework for describing and evaluating elasticity strategies for service-based business processes in the cloud

In the recent years, growing attention has been paid to the concept of Cloud Computing as a new computing paradigm for executing and handling operations/processes in an efficient and cost-effective way. Cloud Computing’s elasticity and its flexibility in service delivery have been the most important features behind this attention which encourage companies to migrate their operation/processes to the cloud to ensure the required QoS while using resources and reduce their expenses. Elasticity management has been considered as a pivotal issue among IT community that works on finding the right tradeoffs between QoS levels and operational costs by developing novel methods and mechanisms. However, controlling process elasticity and defining non-trivial elasticity strategies are challenging issues. Also, despite the growing attention paid to the cloud and its elasticity property in particular, there is still a lack of solutions that support the evaluation of elasticity strategies used to ensure the elasticity of processes at service-level. In this paper, we present a framework for describing and evaluating elasticity strategies for Service-based Business Processes (SBP), called StratFram. It is composed of a set of domain-specific languages designed to generalize the use of the framework and to facilitate the description of evaluation elements that are needed to evaluate elasticity strategies before using them in real cloud environment. Using StratFram, SBP holders are allowed to define: (i) an elasticity model with specific elasticity capabilities on which they want to define and evaluate their elasticity strategies, (ii) a SBP model for which the elasticity strategies will be defined and evaluated, (iii) a set of elasticity strategies based on the elasticity capabilities of the defined elasticity model and for the provided SBP model, and (iv) a simulation configuration which identifies simulation properties/elements. The evaluation of elasticity strategies consists in providing a set of plots that allows the analysis and the comparison of strategies. Our contributions and developments provide Cloud tenants with facilities to choose elasticity strategies that fit to their business processes and usage behaviors.

A Cost Model for IaaS Clouds Based on Virtual Machine Energy Consumption

Cloud Computing has revolutionized the software, platform and infrastructure provisioning. Infrastructure-as-a-Service (IaaS) providers offer on-demand and configurable Virtual Machine (VMs) to tenants of cloud computing services. A key consolidation force that widespread IaaS deployment is the use of pay-as-you-go and pay-as-you-use cost models. In these models, a service price can be composed of two dimensions: the individual consumption, and a proportional value charged for service maintenance. A common practice for public providers is to dilute both capital and operational costs on predefined pricing sheets. In this context, we propose PSVE (Proportional-Shared Virtual Energy), a cost model for IaaS providers based on CPU energy consumption. Aligned with traditional commodity prices, PSVE is composed of two key elements: an individualized cost accounted from CPU usage of VMs (e.g., processing and networking), and a shared cost from common hypervisor management operations, proportionally distributed among VMs.

User-Level Runtime Security Auditing for the Cloud

In this chapter, we present an efficient user-level runtime security auditing framework in a multi-domain cloud environment. The multi-tenancy and ever-changing nature of clouds usually implies significant design and operational complexity, which may prepare the floor for misconfigurations and vulnerabilities leading to violations of security properties. Runtime security auditing may increase cloud tenants’ trust in the service providers by providing assurance on the compliance with security properties mainly derived from the applicable laws, regulations, policies, and standards. Evidently, the Cloud Security Alliance has recently introduced the Security, Trust and Assurance Registry (STAR) for security assurance in clouds, which defines three levels of certifications (self-auditing, third-party auditing, and continuous, near real-time verification of security compliance).

Multi-Keyword Ranked Search in Cloud Storage using Homomorphic Indexing

In the cloud environment, the main issue is outsourcing of the information to the cloud service provider and outsider. Consider this, the cloud tenant store data in an encrypted form to achieve data security and privacy. The data owner needs the secure information sharing from the cloud and without leak of access pattern to the eavesdroppers. XOR homomorphic encryption searchable algorithm along with ranking is proposed to provide the security over the network. In addition our scheme provides secure Multi-keyword ranked search over encrypted data. Efficient ranked search algorithm returns the relevant document based on the results for the given multiple keywords. The experimental results prove that the system is efficient.

Security as a Service for Public Cloud Tenants(SaaS)

Cloud computing is a novel paradigm that is known for its elasticity and diversity in terms of the services provided to the end users. Although these services offer many benefits such as availability, cost-reduction, flexible payment plans, security, and efficiency, there are still several security concerns that are considered major obstacles preventing tenants from transferring their resources to the cloud. The security provided by the cloud service providers is still inadequate for the tenants security requirements because providers use standard security mechanisms regardless of the tenants requirements. Thus, cloud tenants cannot rely on the security provided by the cloud providers. Although, traditional intrusion detection systems have been proposed and developed by different entities including researchers, academicians, and practitioners as a solution that cloud providers can offer to their tenants to cope with security issues in the cloud, the requirements of the tenants in terms of security are not considered. It is very important, however, to consider the differences in the tenants security requirements to provide better security services. In this research, we concentrate on providing a security service that allows cloud tenants to monitor and protect their virtual environments by deploying a security mechanism that is capable of meeting their needs. The main contribution of this work is providing an efficient, flexible, and low-cost security as a service model - based on Intrusion Detection Systems (IDS) - that takes the tenants security requirements into consideration.

Certification-Based Cloud Adaptation

Performance and dependability levels of cloud-based computations are difficult to guarantee by-design due to segregation of visibility and control between applications, data owners, and cloud providers. Lack of predictability increases users’ uncertainty about the service levels they will actually achieve. Cloud tenants compete for shared resources/services at all layers of the cloud stack, and pose heterogeneous and conflicting non-functional requirements over them. These requirements have implications for platform and infrastructure layers, which have to be configured to satisfy inter-tenants requirements. We argue that adaptation techniques can play a crucial role in providing a reliable cloud, supporting definite behavior of applications and stable quality of service. Existing adaptation techniques however are unsuitable for cloud use, since they mostly focus on single tenancy, performance requirements, and are based on unverifiable evidence, which is collected in an untrusted way. In this paper, we propose a multi-tenant, general-purpose adaptation technique for the cloud, based on evidence collected by means of a trustworthy certification process. We depart from traditional heavy and comprehensive certification processes, such as ISO/IEC 27017, and consider a flexible and lightweight certification process for the cloud. It is based on authentic evidence and provides accountable validation on the compliance of a cloud-based system. Our approach adapts the cloud at all layers to maintain stable non-functional properties in certificates over time, by continuously verifying certificate validity. We assess the performance and quality of our adaptation approach in a wide range of settings.

Cloud versus On-Premise Computing

When investigating new choices for enterprise solutions, decision-makers need to increasingly weigh the merits of Cloud offerings. Accessibility, performance and security are key requirements along with vendor reputation and user community. The race to acquire customers and expand market share is prompting vendors to offer attractive introductory pricing to capture Cloud tenants. To keep in mind long term TCO and business outcomes, it’s essential to conduct due diligence to minimize risks or surprises. Knowing the business, technology and contractual drivers will inform the decisions on the future of Cloud at your organization. Decisions to embrace the Cloud will always require complete analysis of the options and business metrics. After performing a full needs analysis and understanding the variables, a reliable and cost-effective result is better selected and managed. This paper outlines fundamentals to understand the implications for deciding on Cloud versus On-Premise Computing going forward.

Fault-tolerance analyzer: A middle layer for pre-provision testing in OpenStack

OpenStack is arguably the most popular open-source cloud orchestration software available today. Its user-base spans from large corporations and large scale service providers to SMEs. OpenStack manages infrastructure resources e.g. compute, storage and networking. While customers get a fully functional cloud, an incumbent fault-tolerance analysis and suggestion system is absent from this otherwise robust cloud management system. In this work, we demonstrate a system for automated fault-tolerance (FT) analysis of network applications hosted on OpenStack. Faults are modeled by random server and/or service shutdowns. Aim of the FT Analyzer is to equip cloud tenants with information to determine optimum configuration for their applications before firing up the service. FT Analyzer helps tenants maintain maximum up-time for services and data and preemptively tests the virtual network based applications for any issues that can have a negative impact on performance in post deployment scenario.

LTSS: Load-Adaptive Traffic Steering and Forwarding for Security Services in Multi-Tenant Cloud Datacenters

Currently, different kinds of security devices are deployed in the cloud datacenter environment and tenants may choose their desired security services such as firewall and IDS (intrusion detection system). At the same time, tenants in cloud computing datacenters are dynamic and have different requirements. Therefore, security device deployment in cloud datacenters is very complex and may lead to inefficient resource utilization. In this paper, we study this problem in a software-defined network (SDN) based multi-tenant cloud datacenter environment. We propose a load-adaptive traffic steering and packet forwarding scheme called LTSS to solve the problem. Our scheme combines SDN controller with TagOper plug-in to determine the traffic paths with the minimum load for tenants and allows tenants to get their desired security services in SDN-based datacenter networks. We also build a prototype system for LTSS to verify its functionality and evaluate performance of our design.

A Load Balancing and Multi-Tenancy Oriented Data Center Virtualization Framework

Virtualization is an essential step before a bare-metal data center being ready for commercial usage, because it bridges the foreground interface for cloud tenants and the background resource management on underlying infrastructures. A concept at the heart of the foreground is multi-tenancy, which deals with logical isolation of shared virtual computing, storage, and network resources and provides adaptive capability for heterogeneous demands from various tenants. A crucial problem in the background is load balancing, which affects multiple issues including cost, flexibility and availability. In this work, we propose a virtualization framework that consider these two problems simultaneously. Our framework takes advantage of the flourishing application of distributed virtual switch (DVS), and leverages the blooming adoption of OpenFlow protocols. First, the framework accommodates heterogeneous network communication patterns by supporting arbitrary traffic matrices among virtual machines (VMs) in virtual private clouds (VPCs). The only constraint on the network flows is that the bandwidth of a server’s network interface. Second, our framework achieves load balancing using an elaborately designed link establishment algorithm. The algorithm takes the configurations of the bare-metal data center and the dynamic network environment as inputs, and adaptively applies a globally bounded oversubscription on every link. Our framework concentrates on the fat-tree architecture, which is widely used in today’s data centers.

Camflow: Managed Data-Sharing for Cloud Services

A model of cloud services is emerging whereby a few trusted providers manage the underlying hardware and communications whereas many companies build on this infrastructure to offer higher level, cloud-hosted PaaS services and/or SaaS applications. From the start, strong isolation between cloud tenants was seen to be of paramount importance, provided first by virtual machines (VM) and later by containers, which share the operating system (OS) kernel. Increasingly it is the case that applications also require facilities to effect isolation and protection of data managed by those applications. They also require flexible data sharing with other applications, often across the traditional cloud-isolation boundaries; for example, when government provides many related services for its citizens on a common platform. Similar considerations apply to the end-users of applications. But in particular, the incorporation of cloud services within `Internet of Things' architectures is driving the requirements for both protection and cross-application data sharing. These concerns relate to the management of data. Traditional access control is application and principal/role specific, applied at policy enforcement points, after which there is no subsequent control over where data flows; a crucial issue once data has left its owner's control by cloud-hosted applications and within cloud-services. Information Flow Control (IFC), in addition, offers system-wide, end-to-end, flow control based on the properties of the data. We discuss the potential of cloud-deployed IFC for enforcing owners' dataflow policy with regard to protection and sharing, as well as safeguarding against malicious or buggy software. In addition, the audit log associated with IFC provides transparency, giving configurable system-wide visibility over data flows. [...]

A Fairness-Aware Pricing Methodology for Revenue Enhancement in Service Cloud Infrastructure

Infrastructure-as-a-service (IaaS) cloud providers sell their resources as different types of virtual machines (VMs) called instances. Any resource is limited in capacity, so is the resource in cloud. Pricing models can be used as a tool for cloud providers not only to cover their costs and realize a profit but also to encourage cloud tenants to use cloud resources efficiently and achieve high utilization. In this paper, we propose a new pricing methodology that encourages cloud tenants, whose requested VMs can be allocated easily and fairly, to use more cloud service by offering them lower prices, while discouraging cloud tenants, whose requested VMs are difficult to allocate, from using cloud service by charging them higher prices, while enhancing the revenue that a cloud provider receives. We perform a case study with a multiresource allocation fairness algorithm, i.e., the dominant resource sharing algorithm. Then, we further conduct case studies with two ways of price calculation: the total unit price redistribution and total revenue redistribution. Evaluation results show that the proposed pricing model with total unit price redistribution and total revenue redistribution can increase the overall revenue of cloud providers by up to 11.60% and 11.18%, respectively.

Research and Implementing of Software Defined Border Protection in Hybrid Cloud

Hybrid cloud is composed of enterprise private cloud and public cloud tenant network. It has effectively reduced construction cost, improved enterprise IT construction efficiency and expansibility of private cloud, and brought security risk such as fuzzy boundary at the same time. This thesis studies the common access control means used in current hybrid cloud and has proposed a unified strategy control mechanism to address hybrid cloud. By applying software-defined network and network function virtualization, the mechanism has succeeded in multi-granularity of flow in east-west direction and in north-south direction of virtual network, realized internally unified access strategy, and improved the efficiency and flexibility of access control.

Evaluating High Availability-aware Deployments Using Stochastic Petri Net Model and Cloud Scoring Selection Tool

Different challenges are facing the adoption of cloud-based applications, including high availability (HA), energy, and other performance demands. Therefore, an integrated solution that addresses these issues is critical for cloud services. Cloud providers promise the HA of their infrastructure while cloud tenants are encouraged to deploy their applications across multiple availability zones. Moreover, the environmental and cost impacts of running applications in the cloud are integral parts of incorporated responsibility where the cloud providers and tenants intend to reduce. Hence, an analytical stochastic model is needed for the tenants and providers to quantify the expected availability offered by an application deployment. If multiple deployment options can satisfy the HA requirement, the question remains, how can we choose the deployment that satisfies the other providers and tenants requirements? Therefore, this paper proposes a cloud scoring system and integrates it with a Stochastic Petri Net model. While the Petri Net model evaluates the availability of cloud applications deployments, the scoring system selects the optimal HA-aware deployment in terms of energy, operational expenditure, and other norms. We illustrate our approach with a use case that shows how we can use the various deployment options to satisfy both the cloud tenant and provider needs.

On Fair Attribution of Costs Under Peak-Based Pricing to Cloud Tenants

The costs incurred by cloud providers towards operating their data centers are often determined in large part by their peak demands. The pricing schemes currently used by cloud providers to recoup these costs from their tenants, however, do not distinguish tenants based on their contributions to the cloud’s overall peak demand. Using the concrete example of peak-based pricing as employed by many electric utility companies, we show that this “gap” may lead to unfair attribution of costs to the tenants. Simple enhancements of existing cloud pricing (e.g., analogous to the coincident peak pricing (CPP) used by some electric utilities) do not adequately address these shortcomings and suffer from short-term unfairness and undesirable oscillatory price-vs.-demand relationships offered to tenants. To overcome these shortcomings, we define an alternative pricing scheme to more fairly distribute a cloud’s costs among its tenants. We demonstrate the efficacy of our scheme under price-sensitive tenant demand response using a combination of (i) extensive empirical evaluation with recent workloads from commercial data centers operated by IBM and (ii) analytical [modeling] through non-cooperative game theory for a special case of tenant demand model.