Securing INSPIREd geodata cloud services with CLARUS. INSPIRE conference 2016 (Barcelona)

Transcription

1 Securing INSPIREd geo cloud services with CLARUS INSPIRE conference 2016 (Barcelona)

2 Increase flexibility on demand elasticity ubiquitous access Reduce costs shared resources pay as you use metering Reduce risks higher availability Why cloud computing? Securing INSPIREd geo cloud services with CLARUS 2

3 The main barriers to cloud adoption Geo providers are often reluctant to move to the cloud Data security Loss of control Data location Securing INSPIREd geo cloud services with CLARUS 3

4 Solutions? Private Cloud Cloud Access Security Broker a type of cloud computing that delivers similar advantages to public cloud but implemented within the corporate infrastructure on premises or cloud hosted software that acts as a control point to support threat protection and security for cloud services Securing INSPIREd geo cloud services with CLARUS 4

5 AKKA Research roadmap demonstrate the feasibility of employing a cloud based infrastructure to provide seamless access to geospatial public sector information private cloud cloud security CLOUDS CLARUS European Commission H2020 programme Securing INSPIREd geo cloud services with CLARUS 5

6 INSPIRE in the cloud security issues some geospatial are sensitive for public security matters for commercial reasons their exploitation in the cloud raises security issues the mission of European geosurvey organisations includes the management of sensitive environmental (e.g. drinking water collection points) beside the legal obligations to share public to a large audience Securing INSPIREd geo cloud services with CLARUS 6

7 The CLARUS solution in the context of honest but curious cloud service providers (CSP) Securing INSPIREd geo cloud services with CLARUS 7

8 The «honest but curious» threat model Secure the transport Secure communication HTTPS SFTP SSH Secure the access Access control Authentication Authorization Trust the service provider? Securing INSPIREd geo cloud services with CLARUS 8

9 The «honest but curious» threat model Secure the transport Secure the access Trust the service provider HONEST but CURIOUS Securing INSPIREd geo cloud services with CLARUS 9

10 Cloud Service Provider UNTRUSTED ZONE set TRUSTED ZONE Securing INSPIREd geo cloud services with CLARUS 10

11 Cloud Service Provider 2 set 4 transformed search obfuscated results 5 UNTRUSTED ZONE Proxy 1 set 3 search query clear results 6 TRUSTED ZONE Securing INSPIREd geo cloud services with CLARUS 11

12 Application cases considered Securing INSPIREd geo cloud services with CLARUS 12

13 Data operations clear Proxy protected anonym. coarsening splitting searchable homomorphic Securing INSPIREd geo cloud services with CLARUS 13

14 Encryption techniques clear Proxy protected anonym. coarsening splitting searchable homomorphic Securing INSPIREd geo cloud services with CLARUS 14

15 Privacy preserving techniques clear Proxy protected anonym. coarsening splitting searchable homomorphic Securing INSPIREd geo cloud services with CLARUS 15

16 Data anonymisation clear Proxy protected anonym. coarsening splitting searchable homomorphic Sensitive are made indistiguishable in order to avoid reidentification and confidential disclosure Securing INSPIREd geo cloud services with CLARUS 16

17 Data coarsening clear Proxy protected anonym. coarsening splitting searchable homomorphic Data are generalized in order to lower their level of details and thus avoid disclosure Securing INSPIREd geo cloud services with CLARUS 17

18 Data splitting clear Proxy protected anonym. coarsening splitting searchable homomorphic Data are fragmented into different cloud providers so that individual pieces do not cause disclosure Securing INSPIREd geo cloud services with CLARUS 18

19 Data coarsening 19

20 Data anonymization 20

21 Data splitting 21

22 What about? Securing INSPIREd geo cloud services with CLARUS 22

23 The challenges of Full is advised (Partial reveals search patterns to the CSP that can be used to derive information about the protected ). but. How to fully encrypt without breaking functionality? For vector sets stored in a spatial DB, it is not possible Securing INSPIREd geo cloud services with CLARUS 23

24 Combining techniques clear Proxy protected USE CASE Kriging computation (geoprocessing) Outsourced coordinates (x,y) are split (latitude/longitude) in different clouds anonym. coarsening splitting searchable homomorphic Measurements (z) are encrypted and outsourced to one cloud Kriging computation on protected is possible Securing INSPIREd geo cloud services with CLARUS 24

25 Searchable for geo referenced clear Proxy protected anonym. coarsening splitting searchable homomorphic RESEARCH PAPER Securing INSPIREd geo cloud services with CLARUS 25

26 Homomorphic for secure geoprocessing clear Proxy protected anonym. coarsening splitting searchable homomorphic RESEARCH PAPER Securing INSPIREd geo cloud services with CLARUS 26

27 under the magnifying glass clear Proxy protected PGSQL ANON. ENCRYP S3 STREAMING COARS. S.E. WFS WFST WPS SPLIT. H.E. + PLUGINS BUFFERING SECURITY POLICY protocol parsing request /response processing sensitive identification protection Securing INSPIREd geo cloud services with CLARUS 27

28 Geospatial sets for CLARUS contain geographical coordinates contain scientific attributes (measurements) require a certain level of security (confidential) conforming to standards (OGC, ISO) relating to one of the INSPIRE thematic groups held by public authorities or third-parties Securing INSPIREd geo cloud services with CLARUS 28

29 INSPIRE use cases for CLARUS storage geo publication geo processing geo collaboration any groundwater boreholes geology (kriging) energy supply networks Securing INSPIREd geo cloud services with CLARUS 29

30 INSPIRE use cases for CLARUS storage geo publication geo processing geo collaboration S3 PGSQL WFS WPS WFS T Securing INSPIREd geo cloud services with CLARUS 30

31 Other (possible) applications Health geostatistics privacy preserving statistics and geography Location privacy privacy preserving location based services (LBS) for smart cities, smart phones, connected cars Satellite imagery protect high resolution products Securing INSPIREd geo cloud services with CLARUS 31

32 THANK YOU Thierry Chevallier (AKKA Technologies) CLARUS has received funding from the European Union's Horizon 2020 programme DG CONNECT Software & Services, Cloud. Contract No