CLOUD MANAGEMENT AND SECURITY

Transcription

1 CLOUD MANAGEMENT AND SECURITY Imad M. Abbadi University of Oxford, UK Wiley

2 Contents About the Author Preface Acknowledgments Acronyms xi xiii xix xxi 1 Introduction Overview Cloud Definition Cloud Evolution Cloud Services Cloud Deployment Types Main Challenges of Clouds Summary Exercises 10 References 10 Part One CLOUD MANAGEMENT 2 Cloud Structure Introduction Infrastructure Components Storage Components Physical Servers Network Components Cloud Layers Vertical Slices Horizontal Slices Horizontal vs. Vertical Slices Illustrative Example Cloud Relations Intra-layer Relations Across-layer Relations 23

3 vi Contents 2.5 Cloud Dynamics Data Types Summary Exercises 27 References 27 3 Fundamentals of Cloud Management Introduction Clouds Management Services Application Deployment Scenario Identifying Cloud Management Services Virtual Control Center Prerequisite Input Data for Management Services Management of User Requirements Requirement Management Workflow Challenges and Requirements Categories and Delegation of User Requirements Illustrative Example Summary Exercises 45 References 45 4 Cloud Properties Introduction Adaptability Property Resilience Property Scalability Property Availability Property Reliability Property Security and Privacy Property Business Model Summary Exercises 54 References 55 5 Automated Management Services Introduction Virtual Layer Self-managed Services Adaptability as a Virtual Service System Architect as a Virtual Service Resilience as a Virtual Service Scalability as a Virtual Service Availability as a Virtual Service Reliability as a Virtual Service Virtual Services Interdependency 63

4 Contents vii 5.4 Application Layer Self-managed Services Adaptability as an Application Service Resilience as an Application Service Scalability as an Application Service Availability as an Application Service Reliability as an Application Service Application Services Interdependency Security and Privacy by Design Multi-tier Application Deployment in the Cloud Application Architecture Managed Services Interaction Main Challenges and Requirements Challenges Requirements Summary Exercises 78 References 78 Part Two CLOUD SECURITY FUNDAMENTALS 6 Background Topics 6.2 Trusted Computing 83 Flow Introduction Trusted Platform Module TCG Main Components The TP Main Functions Challenges in TCG Specifications Summary 91 References 91 7 Challenges for Establishing Trust in Clouds Introduction Effects of Cloud Dynamism on Trust Relationships Load Balancing Horizontal Scaling Vertical Scaling Redundancy Clustering Challenges Summary Exercises 99 References 99 8 Establishing Trust in Clouds Introduction 101

5 viii Contents 8.2 Organization Requirements Framework Requirements Device Properties Framework Architecture Dynamic Domain Concept Proposed Architecture Required Software Agents Server Agent Functions Client Agent Functions ServerAgent Initialization Client Agent Initialization Framework Workflow Management Domain and Collaborating Management Domain Establishment Organization Home Domain Establishment Adding Devices to a Domain Outsourced Domain and Collaborating Outsourced Domain Establishment Discussion and Analysis Benefits of Using Trusted Computing Benefits of the Framework Architecture Content Protection Summary Exercises 118 References Clouds Chains of Trust Introduction Software Agents Revision Roots of and Chains of Trust Definition Roots of Trust Chains of Trust Intra-layer Chains of Trust A Resource Chain of Trust Compositional Chains of Trust Physical Layer DCoTand CDCoT Virtual Layer DCoTand CDCoT Application Layer DCoT and CDCoT Trust Across Layers Summary Exercises 135 References Provenance in Clouds Introduction Log and Provenance 138

6 Contents ix Problem Description and Objectives Organization of the Chapter Motivating Scenarios Log Records Management and Requirements Database Design Security Requirements Other Requirements and Device Properties Framework Domain Architecture Framework Software Agents Cloud Server Agent LaaS Server Agent LaaS Client Agent VMAgent Cloud Client Agent Framework Workflow Cloud ServerAgent Initialization LaaS ServerAgent Initialization LCA and CCA Initialization LaaS Domain Establishment Adding Devices to an LaaSD Establishing Trust between Server Agents MD Establishment and Management Secure Log Storage Threat Analysis Discussion and Future Directions Establishing Trust &2 Log Retention Achievement of Objectives Summary Exercises 164 References Insiders Introduction Insiders Definition Background Definition Rules ofidentifying Insiders Conceptual Models Organizational View Assets and Clients Infrastructure Model Procedure for Identifying Potential and Malicious Insiders Summary Exercises 175 References 175

7 X Contents Part Three PRACTICAL EXAMPLES 12 Real-Life Examples OpenStack What is OpenStack? Openstack Structure Security in OpenStack OpenStack Configuration Files Amazon Web Services Component Architecture Nova-api Nova-database Nova-scheduler Prototype TrustAttestation via the DC-C Trust Management by the DC-S Summary References Case Study Scenario Home Healthcare Architecture in the Cloud Insiders Analysis for Home Healthcare Model Instance Identifying Potential Insiders and Insiders Insider Threat Analysis Cloud Threats 207 References 212 Index 213