A survey on security issues and solutions at different layers of Cloud computing
---
paper_title: Are clouds ready for large distributed applications?

paper_content:

Cloud computing carries the promise of providing powerful new models and abstractions that could transform the way IT services are delivered today. In order to establish the readiness of clouds to deliver meaningful enterprise-class IT services, we identify three key issues that ought to be addressed as first priority from the perspective of potential cloud users: how to deploy large-scale distributed services, how to deliver high availability services, and how to perform problem resolution on the cloud. We analyze multiple sources of publicly available data to establish cloud user expectations and compare against the current state of cloud offerings, with a focus on contrasting the different requirements from two classes of users -- the individual and the enterprise. Through this process, our initial findings indicate that while clouds are ready to support usage scenarios for individual users, there are still rich areas of future research to be explored to enable clouds to support large distributed applications such as those found in enterprise.
---
paper_title: Cloud Security Issues

paper_content:

In past three decades, the world of computation has changed from centralized (client-server not web-based) to distributed systems and now we are getting back to the virtual centralization (Cloud Computing). Location of data and processes makes the difference in the realm of computation. On one hand, an individual has full control on data and processes in his/her computer. On the other hand, we have the cloud computing wherein, the service and data maintenance is provided by some vendor which leaves the client/customer unaware of where the processes are running or where the data is stored. So, logically speaking, the client has no control over it. The cloud computing uses the internet as the communication media. When we look at the security of data in the cloud computing, the vendor has to provide some assurance in service level agreements (SLA) to convince the customer on security issues. Organizations use cloud computing as a service infrastructure, critically like to examine the security and confidentiality issues for their business critical insensitive applications. Yet, guaranteeing the security of corporate data in the "cloud" is difficult, if not impossible, as they provide different services like Software as a service (SaaS), Platform as a service (PaaS), and Infrastructure as a service (IaaS). Each service has their own security issues. So the SLA has to describe different levels of security and their complexity based on the services to make the customer understand the security policies that are being implemented. There has to be a standardized way to prepare the SLA irrespective to the providers. This can help some of the enterprises to look forward in using the cloud services. In this paper, we put forward some security issues that have to be included in SLA.
---
paper_title: Why cloud computing will never be free

paper_content:

The competition among cloud providers may drive prices downward, but at what cost?
---
paper_title: A survey on security issues in service delivery models of cloud computing

paper_content:

Cloud computing is a way to increase the capacity or add capabilities dynamically without investing in new infrastructure, training new personnel, or licensing new software. It extends Information Technology's (IT) existing capabilities. In the last few years, cloud computing has grown from being a promising business concept to one of the fast growing segments of the IT industry. But as more and more information on individuals and companies are placed in the cloud, concerns are beginning to grow about just how safe an environment it is. Despite of all the hype surrounding the cloud, enterprise customers are still reluctant to deploy their business in the cloud. Security is one of the major issues which reduces the growth of cloud computing and complications with data privacy and data protection continue to plague the market. The advent of an advanced model should not negotiate with the required functionalities and capabilities present in the current model. A new model targeting at improving features of an existing model must not risk or threaten other important features of the current model. The architecture of cloud poses such a threat to the security of the existing technologies when deployed in a cloud environment. Cloud service users need to be vigilant in understanding the risks of data breaches in this new environment. In this paper, a survey of the different security risks that pose a threat to the cloud is presented. This paper is a survey more specific to the different security issues that has emanated due to the nature of the service delivery models of a cloud computing system.
---
paper_title: SubVirt: implementing malware with virtual machines

paper_content:

Attackers and defenders of computer systems both strive to gain complete control over the system. To maximize their control, both attackers and defenders have migrated to low-level, operating system code. In this paper, we assume the perspective of the attacker, who is trying to run malicious software and avoid detection. By assuming this perspective, we hope to help defenders understand and defend against the threat posed by a new class of rootkits. We evaluate a new type of malicious software that gains qualitatively more control over a system. This new type of malware, which we call a virtual-machine based rootkit (VMBR), installs a virtual-machine monitor underneath an existing operating system and hoists the original operating system into a virtual machine. Virtual-machine based rootkits are hard to detect and remove because their state cannot be accessed by software running in the target system. Further, VMBRs support general-purpose malicious services by allowing such services to run in a separate operating system that is protected from the target system. We evaluate this new threat by implementing two proof-of-concept VMBRs. We use our proof-of-concept VMBRs to subvert Windows XP and Linux target systems, and we implement four example malicious services using the VMBR platform. Last, we use what we learn from our proof-of-concept VMBRs to explore ways to defend against this new threat. We discuss possible ways to detect and prevent VMBRs, and we implement a defense strategy suitable for protecting systems against this threat.
---
paper_title: DKSM: Subverting Virtual Machine Introspection for Fun and Profit

paper_content:

Virtual machine (VM) introspection is a powerful technique for determining the specific aspects of guest VM execution from outside the VM. Unfortunately, existing introspection solutions share a common questionable assumption. This assumption is embodied in the expectation that original kernel data structures are respected by the untrusted guest and thus can be directly used to bridge the well-known semantic gap. In this paper, we assume the perspective of the attacker, and exploit this questionable assumption to subvert VM introspection. In particular, we present an attack called DKSM (Direct Kernel Structure Manipulation), and show that it can effectively foil existing VM introspection solutions into providing false information. By assuming this perspective, we hope to better understand the challenges and opportunities for the development of future reliable VM introspection solutions that are not vulnerable to the proposed attack.
---
paper_title: All your clouds are belong to us: security analysis of cloud management interfaces

paper_content:

Cloud Computing resources are handled through control interfaces. It is through these interfaces that the new machine images can be added, existing ones can be modified, and instances can be started or ceased. Effectively, a successful attack on a Cloud control interface grants the attacker a complete power over the victim's account, with all the stored data included. In this paper, we provide a security analysis pertaining to the control interfaces of a large Public Cloud (Amazon) and a widely used Private Cloud software (Eucalyptus). Our research results are alarming: in regards to the Amazon EC2 and S3 services, the control interfaces could be compromised via the novel signature wrapping and advanced XSS techniques. Similarly, the Eucalyptus control interfaces were vulnerable to classical signature wrapping attacks, and had nearly no protection against XSS. As a follow up to those discoveries, we additionally describe the countermeasures against these attacks, as well as introduce a novel "black box" analysis methodology for public Cloud interfaces.
---
paper_title: How to break XML encryption

paper_content:

XML Encryption was standardized by W3C in 2002, and is implemented in XML frameworks of major commercial and open-source organizations like Apache, redhat, IBM, and Microsoft. It is employed in a large number of major web-based applications, ranging from business communications, e-commerce, and financial services over healthcare applications to governmental and military infrastructures. In this work we describe a practical attack on XML Encryption, which allows to decrypt a ciphertext by sending related ciphertexts to a Web Service and evaluating the server response. We show that an adversary can decrypt a ciphertext by performing only 14 requests per plaintext byte on average. This poses a serious and truly practical security threat on all currently used implementations of XML Encryption. In a sense the attack can be seen as a generalization of padding oracle attacks (Vaudenay, Eurocrypt 2002). It exploits a subtle correlation between the block cipher mode of operation, the character encoding of encrypted text, and the response behaviour of a Web Service if an XML message cannot be parsed correctly.
---
paper_title: On Technical Security Issues in Cloud Computing

paper_content:

The Cloud Computing concept offers dynamically scalable resources provisioned as a service over the Internet. Economic benefits are the main driver for the Cloud, since it promises the reduction of capital expenditure (CapEx) and operational expenditure (OpEx). In order for this to become reality, however, there are still some challenges to be solved. Amongst these are security and trust issues, since the user's data has to be released to the Cloud and thus leaves the protection-sphere of the data owner. Most of the discussions on this topics are mainly driven by arguments related to organizational means. This paper focuses on technical security issues arising from the usage of Cloud services and especially by the underlying technologies used to build these cross-domain Internet-connected collaborations.
---
paper_title: Towards an Approach of Semantic Access Control for Cloud Computing

paper_content:

With the development of cloud computing, the mutual understandability among distributed Access Control Policies (ACPs) has become an important issue in the security field of cloud computing. Semantic Web technology provides the solution to semantic interoperability of heterogeneous applications. In this paper, we analysis existing access control methods and present a new Semantic Access Control Policy Language (SACPL) for describing ACPs in cloud computing environment. Access Control Oriented Ontology System (ACOOS) is designed as the semantic basis of SACPL. Ontology-based SACPL language can effectively solve the interoperability issue of distributed ACPs. This study enriches the research that the semantic web technology is applied in the field of security, and provides a new way of thinking of access control in cloud computing.
---
paper_title: CloudProtect: Managing Data Privacy in Cloud Applications

paper_content:

This paper describes the CloudProtect middleware that empowers users to encrypt sensitive data stored within various cloud applications. However, most web applications require data in plaintext for implementing the various functionalities and in general, do not support encrypted data management. Therefore, CloudProtect strives to carry out the data transformations (encryption/decryption) in a manner that is transparent to the application, i.e., preserves all functionalities of the application, including those that require data to be in plaintext. Additionally, CloudProtect allows users flexibility in trading off performance for security in order to let them optimally balance their privacy needs and usage-experience.
---
paper_title: Towards secure dataflow processing in open distributed systems

paper_content:

Open distributed systems such as service oriented architecture and cloud computing have emerged as promising platforms to deliver software as a service to users. However, for many security sensitive applications such as critical data processing, trust management poses significant challenges for migrating those critical applications into open distributed systems. In this paper, we present the design and implementation of a new secure dataflow processing system that aims at providing trustworthy continuous data processing in multi-party open distributed systems. We identify a set of major security attacks that can compromise the integrity of dataflow processing and provide effective protection mechanisms to counter those attacks. We have implemented a prototype of the secure dataflow processing framework and tested it on the PlanetLab testbed. Our experimental results show that our protection schemes are effective and impose low performance impact for dataflow processing in large-scale open distributed systems.
---
paper_title: Integrating grid with intrusion detection

paper_content:

In recent years, distributed denial-of-service (DDoS) and denial-of-service (DoS) are the most dreadful network threats. Single-node IDS often suffers from losing its detection effectiveness and capability when processing enormous network traffic. To solve the drawbacks, we propose grid-based IDS, called grid intrusion detection system (GIDS), which uses grid computing resources to detect intrusion packets. For balancing detection load, score subtraction approach (SSA) and score addition approach (SAA) are deployed. Furthermore, to effectively detect intrusions, a two-phase packet detection process is proposed. The first phase detects logical and momentary attacks. Chronic attacks are detected in the second phase. Experiments are also performed and the results show that GIDS is truly an outstanding system in detecting attacks.
---
paper_title: Securing cloud from ddos attacks using intrusion detection system in virtual machine

paper_content:

Cloud Computing is the newly emerged technology of Distributed Computing System. Cloud Computing user concentrate on API security & provide services to its consumers in multitenant environment into three layers namely, Software as a service, Platform as a service and Infrastructure as a service, with the help of web services. It provides service facilities to its consumers on demand . These service provided can easily invites attacker to attack by Saas ,Paas, Iaas. Since the resources are gathered at one place in data centers in cloud computing, the DDOS attacks such as HTTP & XML in this environment is dangerous & provides harmful effects and also all consumer will be affected at the same time. These attacks can be resolved & detected by a proposed methodology, “Securing cloud from DDOS attacks using intrusion detection system in virtual machine”.In this methodology, this problem can be overcome by using proposed system. The different kinds of vulnerabilities are detected in proposed system. The SOAP request makes the communication between the client and the service provider. Through the Service Oriented Traceback Architecture the SOAP request is send to the cloud. In this architecture service oriented trace back mark is present which contain proxy within it. The proxy that marks the incoming packets with source message identification to identify the real client. Then the SOAP message is travelled via XDetector. The XDetectors used to monitors and filters the DDoS attacks such as HTTP and XML DDoS attack. Finally the filtered real clinet message is transferred to the cloud service provider and the corresponding services is given to the client in secured manner .
---
paper_title: A Cooperative Intrusion Detection System Framework for Cloud Computing Networks

paper_content:

Cloud computing provides a framework for supporting end users easily attaching powerful services and applications through Internet. To provide secure and reliable services in cloud computing environment is an important issue. One of the security issues is how to reduce the impact of denial-of-service (DoS) attack or distributed denial-of-service (DDoS) in this environment. To counter these kinds of attacks, a framework of cooperative intrusion detection system (IDS) is proposed. The proposed system could reduce the impact of these kinds of attacks. To provide such ability, IDSs in the cloud computing regions exchange their alerts with each other. In the system, each of IDSs has a cooperative agent used to compute and determine whether to accept the alerts sent from other IDSs or not. By this way, IDSs could avoid the same type of attack happening. The implementation results indicate that the proposed system could resist DoS attack. Moreover, by comparison, the proposed cooperative IDS system only increases little computation effort compared with pure Snort based IDS but prevents the system from single point of failure attack.
---
paper_title: Economic Denial of Sustainability (EDoS) in Cloud Services using HTTP and XML based DDoS Attacks

paper_content:

“Cloud Computing”, a new wave in the Internet revolution, transforms the kind of services provided over the Internet. The Cloud Services can be viewed from two perspectives, one as Cloud Service Provider and the other as Cloud Service Consumer. Assurance of security in the Cloud Service is a major challenge for the Providers, as it’s the biggest concern for the Consumers to opt for the service, which in turn decides the prospects of the business in Cloud Service. The Security can be administered in the Cloud at various levels and for several types of attacks. The threats and the attacks on the Cloud service can be common prevailing attacks in the internet or can be cloud specific. This paper deals about the threats and the counter measures of the prevailing DDoS attacks on the Cloud Environment as well as the Cloud Specific Vulnerabilities to these attacks. In specific, HTTP and XMLbased DDoS attacks on the cloud service are experimented under proposed security framework for EDoS Protection. A Cloud Service was hosted on Amazon EC2. The Service was targeted by HTTP, XML DDoS attacks from several nodes, which lead to the scaling of the service by consuming more Amazon EC2 resources, which in turn lead to Economic Denial of Sustainability to the Cloud Service under attack. Thus this paper explores the transformation of traditional Distributed denial-of-service (DDoS) attack into cloud specific Economic Denial of Sustainability (EDoS) attack.
---
paper_title: A survey of intrusion detection techniques in Cloud

paper_content:

In this paper, we survey different intrusions affecting availability, confidentiality and integrity of Cloud resources and services. Proposals incorporating Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) in Cloud are examined. We recommend IDS/IPS positioning in Cloud environment to achieve desired security in the next generation networks.
---
paper_title: Enhancing data privacy and integrity in the cloud

paper_content:

Cloud computing is a new computing paradigm in which dynamically scalable resources are provided as a service over the Internet. One central concern in cloud computing is the privacy and integrity of data processed at the cloud. In this paper, we propose blind processing service using trusted computing mechanisms to provide improved privacy and integrity to potential users. Utilizing blind communication and execution services, a user exchanges his/her sensitive information with a cloud system via isolated processes whose execution environment and data is shielded from the rest of the system after ensuring the system has correct hardware, trusted computing base, correct credentials, and trustworthy state.
---
paper_title: Fog Computing: Mitigating Insider Data Theft Attacks in the Cloud

paper_content:

Cloud computing promises to significantly change the way we use computers and access and store our personal and business information. With these new computing and communications paradigms arise new data security challenges. Existing data protection mechanisms such as encryption have failed in preventing data theft attacks, especially those perpetrated by an insider to the cloud provider. We propose a different approach for securing data in the cloud using offensive decoy technology. We monitor data access in the cloud and detect abnormal data access patterns. When unauthorized access is suspected and then verified using challenge questions, we launch a disinformation attack by returning large amounts of decoy information to the attacker. This protects against the misuse of the user's real data. Experiments conducted in a local file setting provide evidence that this approach may provide unprecedented levels of user data security in a Cloud environment.
---
paper_title: Enabling Data Hiding for Resource Sharing in Cloud Computing Environments Based on DNA Sequences

paper_content:

The main target of this paper is to propose an algorithm to implement data hiding in DNA sequences to increase the confidentiality and complexity by using software point of view in cloud computing environments. By utilizing some interesting features of DNA sequences, the implementation of a data hiding is applied in cloud. The algorithm which has been proposed here is based on binary coding and complementary pair rules. Therefore, DNA reference sequence is chosen and a secret data M is hidden into it as well. As result of applying some steps, M´´´ is come out to upload to cloud environments. The process of identifying and extracting the original data M, hidden in DNA reference sequence begins once clients decide to use data. Furthermore, security issues are demonstrated to inspect the complexity of the algorithm.
---
paper_title: Data protection models for service provisioning in the cloud

paper_content:

Cloud computing enables highly scalable services to be easily consumed over the Internet on an as-needed basis. While cloud computing is expanding rapidly and used by many individuals and organizations internationally, data protection issues in the cloud have not been carefully addressed at current stage. In the cloud, users' data is usually processed remotely in unknown machines that users do not own or operate. Hence, users' fear of confidential data (particularly financial and health data) leakage and loss of privacy in the cloud becomes a significant barrier to the wide adoption of cloud services. To allay users' concerns of their data privacy, in this paper, we propose a novel data protection framework which addresses challenges during the life cycle of a cloud service. The framework consists of three key components: policy ranking, policy integration and policy enforcement. For each component, we present various models and analyze their properties. Our goal is to provide a new vision toward addressing the issues of the data protection in the cloud rather than detailed techniques of each component. To this extent, the paper includes a discussion of a set of general guidelines for evaluating systems designed based on such a framework.
---
paper_title: A client-based privacy manager for cloud computing

paper_content:

A significant barrier to the adoption of cloud services is that users fear data leakage and loss of privacy if their sensitive data is processed in the cloud. In this paper, we describe a client-based privacy manager that helps reduce this risk, and that provides additional privacy-related benefits. We assess its usage within a variety of cloud computing scenarios. We have built a proof-of-concept demo that shows how privacy may be protected via reducing the amount of sensitive information sent to the cloud.
---
paper_title: Managing security of virtual machine images in a cloud environment

paper_content:

Cloud computing is revolutionizing how information technology resources and services are used and managed but the revolution comes with new security problems. Among these is the problem of securely managing the virtual-machine images that encapsulate each application of the cloud. These images must have high integrity because the initial state of every virtual machine in the cloud is determined by some image. However, as some of the enefits of the cloud depend on users employing images built by third parties, users must also be able to share images safely. This paper explains the new risks that face administrators and users (both image publishers and image retrievers) of a cloud's image repository. To address those risks, we propose an image management system that controls access to images, tracks the provenance of images, and provides users and administrators with efficient image filters and scanners that detect and repair security violations. Filters and scanners achieve efficiency by exploiting redundancy among images; an early implementation of the system shows that this approach scales better than a naive approach that treats each image independently.
---
paper_title: Transparent security for cloud

paper_content:

Large distributed systems such as clouds are increasingly becoming targets of attacks. Virtualization can be leveraged to increase the security of such systems by protecting the integrity of guest components. This paper discusses the integrity protection problem in the clouds and sketches a novel architecture, Transparent Cloud Protection System (TCPS) for increased security of cloud resources. TCPS can be tailored to different cloud flavors to monitor the integrity of guests and infrastructure components while remaining transparent to virtual machines.
---
paper_title: DSP RE-Encryption: A Flexible Mechanism for Access Control Enforcement Management in DaaS

paper_content:

With the popular use of service-oriented technologies, Database as a Service(DaaS) as a new paradigm is becoming a more practical and useful model for those enterprises who can't afford the expensive DBMS products. However access control management by the database service provider ($DSP$) in the DaaS context is challenging because the $DSP$ may be untrusted for the delegated data contents. In thispaper, we first present an approach to implement the flexible accesscontrol enforcement management by applying a $DSP$ re-encryption mechanism. Our approach not only can implement the selective accesscontrol of the encrypted data by the $DSP$, but also can relieve the users from the complex key derivation procedure. The underlying idea of our approach is that the $DSP$ uses different re-encryption keys for users of the system to implement flexible access control enforcement management under the $DSP$ re-encryption mechanism. We demonstrate the usefulness and security property of our flexible access control enforcement management, finally we analyze and resolve the possible attacks and information disclosure.
---
paper_title: Managing security of virtual machine images in a cloud environment

paper_content:

Cloud computing is revolutionizing how information technology resources and services are used and managed but the revolution comes with new security problems. Among these is the problem of securely managing the virtual-machine images that encapsulate each application of the cloud. These images must have high integrity because the initial state of every virtual machine in the cloud is determined by some image. However, as some of the enefits of the cloud depend on users employing images built by third parties, users must also be able to share images safely. This paper explains the new risks that face administrators and users (both image publishers and image retrievers) of a cloud's image repository. To address those risks, we propose an image management system that controls access to images, tracks the provenance of images, and provides users and administrators with efficient image filters and scanners that detect and repair security violations. Filters and scanners achieve efficiency by exploiting redundancy among images; an early implementation of the system shows that this approach scales better than a naive approach that treats each image independently.
---
paper_title: ID management among clouds

paper_content:

In the following years, the desktop-based applications will be changed to cloud computing gradually. Since all users' profile and context data will be stored on the service supplier side based on their ID. ID is becoming a security bottleneck: attackers can trace all other information via user ID. Increasingly, a simple service may be involved in a chain of service clouds; each cloud is able to access data in its cloud without the control of any technology. With ID and password cross utilization in clear text, leakage of ID profile and password in one cloud may propagate to the whole cloud chain. Without proper protection, the success of cloud computing will be threatened by ID privacy leakage. In this paper, privacy preserved ID profile utilizing protocol (PPID) is proposed to prevent this privacy flaw. PPID together with its extension ID anonymity protocol (IDA) separate ID and services. With these two protocols, threaten from crash of whole cloud chain caused by ID privacy leakage is minimized.
---
paper_title: State of security readiness

paper_content:

Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction. With this pay-as-you-go model of computing, cloud solutions are seen as having the potential to both dramatically reduce costs and increase the rapidity of development of applications.
---
paper_title: The privacy-aware access control system using attribute-and role-based access control in private cloud

paper_content:

Cloud is a relatively new concept and so it is unsurprising that the information assurance, data protection, network security and privacy concerns have yet to be fully addressed. The cloud allows users to avoid upfront hardware and software investments, gain flexibility, collaborate with others, and take advantage of the sophisticated services. However, security is a huge issue for cloud users especially access control, user profile management and accessing services offered by the private cloud environment. A privacy enhancement system on Academic-based private cloud system using Eucalyptus open source cloud infrastructure has been proposed in this paper. This system provides the cloud users to improve the privacy and security of the private personal data. Two approaches (Role-based Access Control and Attribute-based Access Control model) are combined as a new approach (ARBAC). This means that they are applied to improve the privacy which supports both mandatory and discretionary access control needs on the target private cloud system.
---
paper_title: Dynamic Accumulator Based Discretionary Access Control for Outsourced Storage with Unlinkable Access

paper_content:

In this paper we are interested in privacy preserving discretionary access control (DAC) for outsourced storage such as increasingly popular cloud storage services. Our main goal is to enable clients, who outsource data items, to delegate permissions (read, write, delete) to other clients such that clients are able to unlinkably and anonymously perform operations on outsourced data items when holding adequate permission. In contrast to recent approaches based on oblivious RAM, oblivious transfer combined with anonymous credentials or attribute based encryption, we propose a solution based on dynamic accumulators. In doing so, our approach naturally reflects the concept of access control lists (ACLs), which are a popular means to implement DAC.
---
paper_title: Privacy enhanced access control for outsourced data sharing

paper_content:

Traditional access control models often assume that the entity enforcing access control policies is also the owner of data and resources. This assumption no longer holds when data is outsourced to a third-party storage provider, such as the cloud. Existing access control solutions mainly focus on preserving confidentiality of stored data from unauthorized access and the storage provider. However, in this setting, access control policies as well as users’ access patterns also become privacy sensitive information that should be protected from the cloud. We propose a two-level access control scheme that combines coarse-grained access control enforced at the cloud, which provides acceptable communication overhead and at the same time limits the information that the cloud learns from his partial view of the access rules and the access patterns, and fine-grained cryptographic access control enforced at the user’s side, which provides the desired expressiveness of the access control policies. Our solution handles both read and write access control.
---
paper_title: Strengthen Cloud Computing Security with Federal Identity Management Using Hierarchical Identity-Based Cryptography

paper_content:

More and more companies begin to provide different kinds of cloud computing services for Internet users at the same time these services also bring some security problems. Currently the majority of cloud computing systems provide digital identity for users to access their services, this will bring some inconvenience for a hybrid cloud that includes multiple private clouds and/or public clouds. Today most cloud computing system use asymmetric and traditional public key cryptography to provide data security and mutual authentication. Identity-based cryptography has some attraction characteristics that seem to fit well the requirements of cloud computing. In this paper, by adopting federated identity management together with hierarchical identity-based cryptography (HIBC), not only the key distribution but also the mutual authentication can be simplified in the cloud.
---
paper_title: Protection of Identity Information in Cloud Computing without Trusted Third Party

paper_content:

Cloud computing allows the use of Internet-based services to support business processes and rental of IT-services on a utility-like basis. It offers a concentration of resources but also poses risks for data privacy. A single breach can cause significant loss. The heterogeneity of “users” represents a danger of multiple, collaborative threats. In cloud computing, entities may have multiple accounts associated with a single or multiple service providers (SPs). Sharing sensitive identity information (that is, Personally Identifiable information or PII) along with associated attributes of the same entity across services can lead to mapping of the identities to the entity, tantamount to privacy loss. Identity management (IDM) is one of the core components in cloud privacy and security and can help alleviate some of the problems associated with cloud computing. Available solutions use trusted third party (TTP) in identifying entities to SPs. The solution providers do not recommend the usage of their solutions on untrusted hosts. We propose an approach for IDM, which is independent of TTP and has the ability to use identity data on untrusted hosts. The approach is based on the use of predicates over encrypted data and multi-party computing for negotiating a use of a cloud service. It uses active bundle—which is a middleware agent that includes PII data, privacy policies, a virtual machine that enforces the policies, and has a set of protection mechanisms to protect itself. An active bundle interacts on behalf of a user to authenticate to cloud services using user’s privacy policies.
---
paper_title: Permission Management System: Permission as a Service in Cloud Computing

paper_content:

One of the challenging problems cloud computing is facing today is the security of data in the cloud. Since the physical location of user data in the cloud is unknown and the data are often distributed across multiple cloud services, a user controllable and privacy preserving access control mechanism is necessary for the success of cloud computing in general and for the protection of user data in specific. In this paper, we discuss a novel approach to controlling access to user data in the cloud; the concept is called Permission as a Service (PaaS). Specifically, PaaS separates access control from other services to provide a separate service in the cloud. This allows users to set permissions for all data in a single location. In PaaS, user data are encrypted to maintain confidentiality and permissions are managed via decryption keys. As a proof-of-concept, we discuss the design and implementation of our prototype leveraging attribute based encryption (ABE).
---
paper_title: Security and Cloud Computing: InterCloud Identity Management Infrastructure

paper_content:

Cloud Computing is becoming one of the most important topics in the IT world. Several challenges are being raised from the adoption of this computational paradigm including security, privacy, and federation. This paper aims to introduce new concepts in cloud computing and security, focusing on heterogeneous and federated scenarios. We present a reference architecture able to address the Identity Management (IdM) problem in the InterCloud context and show how it can be successfully applied to manage the authentication needed among clouds for the federation establishment.
---
paper_title: Transparent security for cloud

paper_content:

Large distributed systems such as clouds are increasingly becoming targets of attacks. Virtualization can be leveraged to increase the security of such systems by protecting the integrity of guest components. This paper discusses the integrity protection problem in the clouds and sketches a novel architecture, Transparent Cloud Protection System (TCPS) for increased security of cloud resources. TCPS can be tailored to different cloud flavors to monitor the integrity of guests and infrastructure components while remaining transparent to virtual machines.
---
paper_title: Ensuring data storage security in Cloud Computing

paper_content:

Cloud Computing has been envisioned as the next-generation architecture of IT Enterprise. In contrast to traditional solutions, where the IT services are under proper physical, logical and personnel controls, Cloud Computing moves the application software and databases to the large data centers, where the management of the data and services may not be fully trustworthy. This unique attribute, however, poses many new security challenges which have not been well understood. In this article, we focus on cloud data storage security, which has always been an important aspect of quality of service. To ensure the correctness of users' data in the cloud, we propose an effective and flexible distributed scheme with two salient features, opposing to its predecessors. By utilizing the homomorphic token with distributed verification of erasure-coded data, our scheme achieves the integration of storage correctness insurance and data error localization, i.e., the identification of misbehaving server(s). Unlike most prior works, the new scheme further supports secure and efficient dynamic operations on data blocks, including: data update, delete and append. Extensive security and performance analysis shows that the proposed scheme is highly efficient and resilient against Byzantine failure, malicious data modification attack, and even server colluding attacks.
---
paper_title: Monitoring Insiders Activities in Cloud Computing Using Rule Based Learning

paper_content:

One of the essential but formidable tasks in cloud computing is to detect malicious attacks and their types. A cloud provider's constraints or inability in monitoring its employees, and lack of transparency, may make the detection process even harder. We found these insiders' activities form similar pattern in the monitoring systems as some other cyber attacks because these also uses huge computer resources. In this paper we first provide a brief overview on the importance of monitoring insiders' activities through a literature survey on cloud computing security. Then, we observe some of the real life insiders' activities that can be detected from the performance data in a hyper visor and its guest operating systems. Rule based learning is successfully used for identification of these activities in this research. We further observe that some of these insiders' activities can on occasions turn into a malicious insider's attack, and thus, need constant monitoring in the cloud environment.
---
paper_title: A Taxonomy and Survey of Cloud Computing Systems

paper_content:

The computational world is becoming very large and complex. Cloud Computing has emerged as a popular computing model to support processing large volumetric data using clusters of commodity computers. According to J.Dean and S. Ghemawat [1], Google currently processes over 20 terabytes of raw web data. It's some fascinating, large-scale processing of data that makes your head spin and appreciate the years of distributed computing fine-tuning applied to today's large problems. The evolution of cloud computing can handle such massive data as per on demand service. Nowadays the computational world is opting for pay-for-use models and Hype and discussion aside, there remains no concrete definition of cloud computing. In this paper, we first develop a comprehensive taxonomy for describing cloud computing architecture. Then we use this taxonomy to survey several existing cloud computing services developed by various projects world-wide such as Google, force.com, Amazon. We use the taxonomy and survey results not only to identify similarities and differences of the architectural approaches of cloud computing, but also to identify areas requiring further research.
---
paper_title: Secure data access in cloud computing

paper_content:

Data security and access control is one of the most challenging ongoing research work in cloud computing, because of users outsourcing their sensitive data to cloud providers. Existing solutions that use pure cryptographic techniques to mitigate these security and access control problems suffer from heavy computational overhead on the data owner as well as the cloud service provider for key distribution and management. This paper addresses this challenging open problem using capability based access control technique that ensures only valid users will access the outsourced data. This work also proposes a modified Diffie-Hellman key exchange protocol between cloud service provider and the user for secretly sharing a symmetric key for secure data access that alleviates the problem of key distribution and management at cloud service provider. The simulation run and analysis shows that the proposed approach is highly efficient and secure under existing security models.
---
paper_title: Secure and efficient access to outsourced data

paper_content:

Providing secure and efficient access to large scale outsourced data is an important component of cloud computing. In this paper, we propose a mechanism to solve this problem in owner-write-users-read applications. We propose to encrypt every data block with a different key so that flexible cryptography-based access control can be achieved. Through the adoption of key derivation methods, the owner needs to maintain only a few secrets. Analysis shows that the key derivation procedure using hash functions will introduce very limited computation overhead. We propose to use over-encryption and/or lazy revocation to prevent revoked users from getting access to updated data blocks. We design mechanisms to handle both updates to outsourced data and changes in user access rights. We investigate the overhead and safety of the proposed approach, and study mechanisms to improve data access efficiency.
---
paper_title: Ciphertext-Policy Attribute-Based Encryption

paper_content:

In several distributed systems a user should only be able to access data if a user posses a certain set of credentials or attributes. Currently, the only method for enforcing such policies is to employ a trusted server to store the data and mediate access control. However, if any server storing the data is compromised, then the confidentiality of the data will be compromised. In this paper we present a system for realizing complex access control on encrypted data that we call ciphertext-policy attribute-based encryption. By using our techniques encrypted data can be kept confidential even if the storage server is untrusted; moreover, our methods are secure against collusion attacks. Previous attribute-based encryption systems used attributes to describe the encrypted data and built policies into user's keys; while in our system attributes are used to describe a user's credentials, and a party encrypting data determines a policy for who can decrypt. Thus, our methods are conceptually closer to traditional access control methods such as role-based access control (RBAC). In addition, we provide an implementation of our system and give performance measurements.
---

Title: A Survey on Security Issues and Solutions at Different Layers of Cloud Computing

Section 1: Introduction
Description 1: Overview of Cloud computing and its adoption reasons.

Section 2: Need for Security and Privacy in Cloud Computing
Description 2: Discuss the importance and challenges of security and privacy in Cloud computing.

Section 3: Vulnerabilities, Threats, and Attacks to Cloud Computing
Description 3: Examine existing vulnerabilities, threats, and attacks in Cloud environments.

Section 4: Security Issues at Different Layers in Cloud
Description 4: Detail security concerns categorized by different layers of the Cloud infrastructure.

Section 5: Application Level Security Issues
Description 5: Discuss security measures and challenges at the application layer.

Section 6: Network Level Security Issues
Description 6: Explore the security issues at the network level and possible protection techniques.

Section 7: Data Storage Level Security Issues
Description 7: Elaborate on data security concerns, including data-at-rest, data-in-transit, and data recovery.

Section 8: Virtualization Level Security Issues
Description 8: Consider security issues related to virtualization and hypervisor vulnerabilities.

Section 9: Authentication and Access Control Level Security Issues
Description 9: Discuss identity management, authentication, and access control mechanisms.

Section 10: Trust Level Security Issues
Description 10: Address trust management issues and reliability of Cloud services.

Section 11: Security Issues Related to Auditing, Regulatory Compliance, and Laws
Description 11: Examine compliance and auditing challenges and associated risks.

Section 12: Future Research Directions
Description 12: Identify upcoming Cloud models and areas requiring further research for security improvements.

Section 13: Conclusions
Description 13: Summarize the findings and suggest future research opportunities on Cloud security.