ABSTRACT
Much like its meteorological counterpart, Cloud Computing is an amorphous agglomeration of entities. It is amorphous in that the exact layout of the servers, the load balancers and their functions are neither known nor fixed. Its an agglomerate in that multiple service providers and vendors often coordinate to form a multitenant system using virtualization. This complex environment offers great potential to providers and adopters, but also introduces great challenges in managing, combining and providing a variety of highly heterogeneous services. In particular, users interaction with these providers is often cumbersome, as the details of a cloud system are often abstracted away and unclear to most adopters. Further, cloud computing does not offer strong security guarantees, or traceability of data, and its indeterminate nature makes accountability of providers and users operations difficult[1] . This nebulous nature and the lack of security assurances of Cloud services together form the foremost barriers to its adoption.
The ambiguous nature of Cloud services also makes choosing the best service challenging. First of all, users may not be aware of all the service providers available to them. Secondly, the users may not be aware of the comprehensive list of options offered by the various service providers even if they know a particular provider. In the scenario where the users know which service option they are looking for, they may not be aware of all the providers supporting the option leading to uninformed choices. Thirdly, users may not be aware of the relationships among service providers, in case the users’ requests would be satisfied by a set of providers, and not a single entity. These relationships between the service providers can cause resources, such as storage space, to be overextended. As a result, the process of collecting and analyzing the information required to make a good decision involves a lot of time-consuming computations for consumers. The time-consuming computations involve identifying all the service providers and the relationships between them before making a final choice. As these arduous computations are repeated by multiple consumers who have similar requirements, it is also computationally wasteful. Protecting the data once the service provider is chosen is also major challenge not only because of the changeable relationships between the service providers, but also due to the potentially untrustworthy components of a single service provider. A major feature of the Cloud services is that users’ data is usually processed remotely in unknown machines that the users do not own or operate. While enjoying the convenience of remote storage and processing brought by the Cloud services, users’ fears of losing control of their own data, particularly financial and health data or any Personally Identifying Information (PII), can become a significant barrier to the wide-spread adoption of Cloud services [2] .
In this dissertation, we aim to address some of the most significant barriers to the adoption of Cloud services. We propose a novel brokerage-based architecture called GABE – a Cloud brokeraGe system for service selection, AccountaBility and, policy Enforcement. GABE fulfills two major needs of cloud users: helping them understand the Cloud services best suited for them; and providing security assurances on their data. As the core part of the brokerage system, we design a unique indexing technique for managing the information of a large number of Cloud service Providers. Multiple alternatives to the indexing are studied to address specific needs in service selection. We then develop efficient service selection algorithms that rank potential service providers and aggregate them if necessary.
GABE also helps users protect their data by providing a policy driven node selection methodology for map reduce architectures. GABE seamlessly integrates node selection control to the MapReduce framework for increased data security. It leverages data preprocessing techniques and distributed node verification protocols to achieve strong policy enforcement.We further augment GABE by equipping it with accountability features. In order to support accountability, we propose a novel highly decentralized information accountability framework to keep track of the actual usage of the users’ data in the Cloud. In particular, we propose an object-centered approach that enables enclosing our logging mechanism together with users’ data and policies. We leverage object oriented programming techniques to create a dynamic and traveling object, and to ensure that any access to users’ data will trigger authentication and automated logging local to the JARs. We take a policy-driven approach that strongly couples data and content protection policies (CPPs). This approach constitutes an effective and practical solution for content protection for a number of reasons. First of all, both the CPPs and the protection mechanism travel with the content, which is stored in its original form. Secondly, users do not need to rely on any dedicated management system to specify and apply the CPPs. Thirdly, to strengthen users’ control, we also provide distributed auditing mechanisms.We provide extensive experimental studies on real cloud computing testbeds that demonstrate the efficiency and effectiveness of the proposed policy driven node selection, auditing, and service selection approaches with real and synthetic Cloud data.
Chapter 1
INTRODUCTION
1.1 BACKGROUND, MOTIVATION AND SOLUTION
Cloud Computing is being heralded as the penultimate solution to the problems of uncertain traffic spikes, computing overloads, and potentially expensive investments in hardware for data processing, and backups. It can potentially transform the IT industry, making software and infrastructure both even more attractive as services, by reshaping the way hardware is designed and purchased. However, the understanding of the term remains as unclear as its origins itself. Hence we turn to the National Institute of Standards and Technology (NIST) for a definition. The NIST characterizes Cloud computing as “a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction” [1] .Cloud computing, also referred to as “Cloud” in what follows, presents a new way to supplement the current consumption and delivery model for IT services based on the Internet, by providing for dynamically scalable and often virtualized resources over the Internet.
The concept of the Cloud includes a number of implementations, based on the services they provide, from application service provisioning to grid and utility computing. The most sophisticated implementation of the Cloud is referred to as Software as a Service (SaaS) [2, 3, 4] , where the Cloud hosts an application for the user[1] . Yet another implementation of Cloud is Platform as a Service (PaaS) [5, 6] , where the Cloud provides a platform for the user allowing the user to exploit specifications such as the underlying infrastructure and the operating system. A third, even more basic implementation where the Cloud provides only the basic infrastructure on which the user can host everything including their own operating system is referred to as Infrastructure as a Service (IaaS) [7, 8] . With the proliferation of Cloud computing, MapReduce has now become a popular means to process Big Data in the cloud [9, 10, 11] . The MapReduce computing paradigm is an architectural and programming model for efficiently processing massive amounts of raw unstructured data. It provides a seamless distribution of computing tasks among nodes in the cloud, in a way which is transparent to the programmers. Its current design allows users’ data to flow between nodes in the cloud, be they part of a public or a private cloud. Regardless of the specific architecture, the overarching concept of this computing model is that customers’ data (which can come from individuals, organizations or enterprises) is processed remotely in unknown machines that users do not own or operate. The machines and the services may further be provided by subcontractors to the Cloud. Therefore, there are three major players in the Cloud: the users and organizations who own the data, the Cloud service providers (CSPs) who provide Cloud services to the users, and the subcontractors who provide storage or other services to the CSPs.
The NIST specifications detail five characteristics of Cloud services: 1) They should be on-demand services that the user can procure himself. 2) They should be available on a broad network of devices including remote laptops and mobile phones. 3) They should result in pooling of resources where the resources are assigned dynamically. 4) They should be elastic in that the assigned resources can be rapidly released, and 5) They should provide for some metering capability which allows for measuring the service provided [1] .
These characteristics of Cloud services make them highly attractive to businesses of various sizes, ranging from small to large businesses. An attestation to their popularity can be found in the fact that as of date, there are a number of notable commercial and individual Cloud computing services, including Amazon, Google, Microsoft, Yahoo and Salesforce [12] . Also, top database subcontractors, like Oracle, are adding Cloud support to their databases. This new and exciting paradigm has also generated significant interest in the academic world [7, 8, 2, 3, 5, 13] , resulting in extensive research. This research has had a great effect on the operations, architecture and security of notable commercial and individual Cloud computing services like those mentioned above [6, 13, 4] .
Cloud computing services allow the users and organizations to take advantage of virtually unlimited computing power and storage power. All this storage and computing power is available to organizations and users without them having to make an investment in the requisite hardware. Therefore they are of great value to the users.
1.1.1 MOTIVATION
The ubiquitous nature of Cloud services is confirmed by the statistics from market research which suggest an ever-growing usage of Cloud computing services by organizations and individual users alike. Merrill Lynch puts the Cloud computing industry to be at $160 billion by the year 2013 [14] . In a 2010 survey conducted by Mimecast, a supplier of Cloud-based email management solutions, 72% of the respondents agreed that Cloud services have improved the end-user experience. Gartner predicts that 60% of the server workload will be virtualized by 2014 [15] . While this kind of virtualization has multiple benefits including reduced costs in terms of hardware and the cost of cooling and running servers 24/7, the uptake of Cloud computing services will be immensely affected if the major concerns regarding it are not allayed. In fact a recent LinkedIn survey puts Cloud computing as the top security concern for 54% of its respondents [14] .
Experts state that Cloud computing can actually improve the security of organizations [16] not only due to a focus on standard practices, but also due to the resilience and reliability of a Cloud in general. For instance, the distributed nature of the Cloud makes it more resilient against attacks like DDoS, which exploit a single point of failure for non-distributed system [17] . Not only can part of the infrastructure which is under attack be cordoned, but the back-ups on the other systems in the Cloud reduce the probability of data loss [16, 7, 8] . However, they also concede that Cloud computing calls for a different model of security. This is due to several reasons. The processing and handling of the data on these servers is often provided by third party subcontractors. Details of the services provided are abstracted from the users who no longer need to be experts of technology infrastructure. This abstraction while being the key strength of Cloud services, also forms the main point of contention for the users. Most of the data stored on the Cloud platforms is quiet sensitive, considering that it could consist of Personally Identifiable Information (PII), which does not lend itself well to such abstraction. With sensitive PII, users would like to know how their data is handled, and by whom it is handled. This is especially the case when the organization owning the data is some health-related organization such as a hospital or an insurance company, or when it is a financial company [16, 18] . The threat of PII from financial organizations is especially relevant given that Deutsche Bank and financial services firm JPMorgan Chase are two of the major players in a group founded for regulating Cloud computing practices [19] . Further, when individual users are signing up for Cloud services, they are often required to divulge PII such as name, email address and credit card information. For instance, both Windows Azure and Amazon EC2 require credit card information even when the user is signing up for a trial [20, 21] . Besides, even if the data stored itself is not very sensitive, the usage of remotely stored data can reveal a lot of sensitive information about the owner, such as their daily schedule, their preferences, their location and thereby their travel patterns. Admittedly, the information revealed by the data usage patterns may be more privacy-sensitive to individuals than to large organizations with many people, as it might be hard to pinpoint the single user of the organization of whom the usage patterns are indicative. However, the massive amounts of data stored by the organizations can provide a goldmine of data about its customers, making the privacy concerns about its users critical.
The privacy, confidentiality and integrity of this sensitive data is especially called into question given that the users, the CSPs, and the subcontractors often have conflicting goals. While subcontractors and CSPs view client data as a tradeable asset that can be used for creating targeted advertising, marketing and even service oriented tools, clients are often concerned about data privacy. In fact there are significant statistics from both market research and academic research that point to a major lack of security as one of the chief concerns of clients regarding data and applications in the Cloud [16, 18, 7, 13] . Statistics from a study conducted by the Poneman Institute and sponsored by Dome9 [18] revealed that 67% of the respondents claim that their organization is left vulnerable to hackers due to lax port and firewall security for Cloud computing. 27% of respondents rated their organization’s overall Cloud server security management as fair while 25% rate it as poor, bringing the total percentage of votes indicating a mediocre or worse Cloud server security management to 52%. Further, 54% of the respondents stated their IT staff had no knowledge about the potential risks of open firewall ports in their Cloud environments.
An extra dimension of privacy concerns is added to MapReduce when it is deployed on a Cloud. Initial constructions of MapReduce only ran in a single trusted data center. However Cloud based MapReduce may use some nodes in the public clouds that cannot be fully trusted [22, 23] . In a MapReduce Cloud, as data flows freely to public servers that are not within the data owners’ control, MapReduce does not offer guarantees on the nodes managing (possibly sensitive) user data. On public or even hybrid clouds, a user submitting a job knows very little about the nodes doing the computation, such as whether they are private or public, their location, and their security configuration. Also, it is difficult to request for a specific data processing setup that would provide some guarantees on the quality of the nodes processing users’ input. For example, in the classic word count example, a user may request thatwords from sensitive input files except stop words (like “the”, “is”, “are”) be processed by nodes capable of file level access control located in the U.S. domain. This request cannot currently be satisfied without relying on a combination of cryptographic protocols and manual configuration of the workers to ignore certain words.
With the exception of private clouds, the user cannot regain control by offloading these controls to the MapReduce Master node. The Master node, which is the node coordinating the MapReduce computation, is only aware of the methods called by the workers. In case of Azure, the Master is aware of the methods called by the worker (e.g. the context method), and the properties of the method (e.g. JobParameters, MapperType ), but not of their implementation (it does not know how the MapperType is implemented) [10] . In case of Amazon’s Elastic MapReduce (EMR), the Master may or may not have the insight into the mapper and reducer classes and methods, depending on how the particular application is created [9] . That is, it is possible to create applications where the workers’ classes are either totally visible or totally abstract to the Master. For instance, in the Cisco Nexus 1000V InterCloud [24] , not only are the virtual machines’ environment heterogeneous, but the actual physical hosts are also geographically distributed, and offer different degrees of trust and security. In this case, the master node does not have a complete control over any of the more secure nodes, unless the master node is a part of the trusted network, in which case, it loses control over the non-secure nodes. Another cloud computing platform where a single instance of a database can be federated over globally distributed cloud computing environments, with no robust trust guarantees, is the TransLattice Elastic Database 3.0 [25] . The trans lattice platform is the the world’s first geographically distributed database, making it very similar to a Cloud Service, if not a Cloud service itself. While it provides data governance, and granular data location control, it does not provide any guarantees on the node’s security or processing capabilites. The Google MapReduce design is similar, in that the classes of the workers are abstracted from the Master. The Master is mainly concerned with sharding, and performance tracking [11] .
Also, though methods such as homomorphic encryption [26, 27] or outsourced private computation [28] can protect the data by processing them in the encrypted domain, such approaches are typically computationally expensive and hence are only feasible for selected applications [29] . An alternative approach is to ensure that sensitive data are never stored and processed in the public cloud. Under this approach, the input data are divided into pieces that are classified as either sensitive or non-sensitive, and mechanisms are then in place to prevent leakage of sensitive information to the public cloud during execution. The challenge then is how to ensure that public cloud resources can be used efficiently in a cost effective manner, and how to control that the assignment on public nodes is compliant with the users’ requests.
Therefore, to make the data usable, and to take advantage of the computing power, and portability offered by Cloud computing services it is essential to have some sort of broker who will enable the user to interact with the CSPs. This service can be provided by a Cloud brokerage system. The importance of such a service is stressed by Gartner [30, 31] , that defined different types of Cloud brokerage, including arbitrage, aggregation and intermediation. Similarly, other recent work has acknowledged the increasingly important role of Cloud brokers, [32, 33] and their multiple responsibilities, which range from service composition to monitoring. Even Dell has recently claimed an interest in Cloud services brokering, and has been working in partnership with VMWare to push out the same. One of the best established brokers is CloudSwitch. Established in 2008 with service for only Amazon EC2, it has the ability to provide federated services on demand and make the cloud a secure and seamless extension of the enterprise data center by working as the middleman [34] . RightScale is another cloud broker that offers a cloud management platform that enables organizations to deploy and manage applications across multiple clouds [35] . However, these brokers go no further than allowing users to manage applications. They do not provide security assurances or auditing, nor do they deal with the complexity of mode selection in MapReduce Clouds.
1.1.2 PROPOSED SOLUTION
GABE aims to bridge these gaps. GABE not only aims to empower users with service selection but also provide them with tools for node selection, security and accountability. GABE will empower users to select the CSPs appropriate to their specific needs by providing them with a ranked list of CSPs by taking into consideration not only their queries but also hidden relationships between the CSPs themselves in form of shared subcontractors. GABE will address the lack of controls in MapReduce node selection by means of a policy-based node selection framework. This framework is designed for node selection in any distributed system, but GABE employs it specifically in the context of MapReduce. Accordingly, the broker’s MapReduce module is referred to as PARiNgS: Policy driven mApReduce Node Selection. It is a MapReduce extension to allow policy enforcement on the nodes. The core idea underlying PARiNgS is to enable the enforcement of security requirements specified by users on the processing of their data by MapReduce functions. These security requirements may express conditions, for example, on the nodes’ functional capabilities, their locations and their cryptographic capabilities. Requirements are defined in terms of simple policy rules against the nodes that process the users’ sensitive data. To support an efficient and effective policy driven node selection mechanism, we focus on attribute-based access control policies, wherein the attributes specify the properties against which some conditions are specified.
The enforcement of the security requirements is elegantly interleaved with the scheduling process of the tasks, performed by the Master nodes, and with other intermediate steps of the task execution. Enforcement primarily deals with verifying the properties of workers, before allowing them to access the data they will be processing. Note that, extracting, and, most importantly, verifying properties of workers (e.g. location, supported cryptographic, and file level access control) is in fact non-trivial in cloud computing infrastructure, given the possibly high-level of virtualization and the lack of a centralized authority that can verify such properties in an efficient fashion. The Master, for example, although in charge of partitioning and completing other tasks, typically has only selected information about the nodes, and much of such information is not verified. To this end, we provide a collaborative verification protocol, that allows remote verification of workers’ properties given a policy in a collaborative, yet secure fashion with limited overhead. To minimize the risk of collusion, the workers’ verification is dynamic, and involves different set of workers at each time, selected according a probabilistic algorithm. Our framework also includes a tainting module, that taints any sensitive input data before it is processed by the mappers, and at other intermediate steps of the computation, as needed. The tainting module addresses the problem of data tracking, that arises when the application transforms the input at intermediate computation steps, so that the intermediate results are not of the same type as the original input, thus challenging the the policy applicability during these steps.
To improve the security of the users’ data, GABE will also function as a distributed policy enforcement mechanism. Specifically, our approach binds the users’ policies with the data, so that both the policies and the data travel together in a distributed environment. We achieve this strong coupling of policies and data by leveraging object oriented programming techniques. Using encapsulation techniques also allows us to bind a distributed policy enforcement mechanism to the traveling data, which works in tandem with the accountability framework to provide a strong security mechanism for the user. GABE will provide accountability information to the users, showing the usage of the users’ data by the CSPs, and by other subcontractors. A key feature of GABE is that while it is designed and deployed for Cloud computing, it can be deployed on any distributed computing environment, specifically email systems, with minor modifications.
1.2 CONTRIBUTIONS OF THIS DISSERTATION
The first contribution of this dissertation is the design and development of a Cloud brokerage system. Analogous to a stock broker, a Cloud broker is essentially an intermediary between the user and the service providers, who helps the user with the task of choosing services tailored to his need. Not only is the Cloud brokerage system is responsible for matching up a user with a suitable service provider, it is also responsible for enabling the transactions between parties that potentially do not know each other. To achieve these two goals, the Cloud brokerage in its very basic form attempts to obtain the privacy and usage policies of all the players involved in a data transaction, and carries out policy matching to enable the data transaction, while providing the parties involved with some proof of each other’s reliability. However, a simplistic policy matching does not enable the best possible use of the users’ data – both the data uploaded by users, and the usage data and any other PII obtained by the CSP when the user signs up for the service. For instance, some user requests can only be fulfilled by multiple CSPs. Providing a brokerage system that identifies multiple CSPs to satisfy a single request poses several security challenges. The process of selection itself can reveal the privacy preferences of the users to the other two parties, as the heightened privacy for a particular data item can be considered indicative of its sensitive nature. Further, when multiple CSPs are involved, there is a chance that they connive to derive sensitive information about the user, including the user’s usage patterns and privacy preferences. Hence, the process of CSP selection is a challenging job. In this dissertation, we explore the major issues in CSP selection as the first challenge faced by a Cloud brokerage system. Accordingly in this dissertation we design a service selection algorithm that empowers clients to select the CSP or CSPs most suitable to their needs. The algorithm selects and ranks CSPs based on the client’s needs which are stated in a query, and aggregates the CSPs if necessary.
Once the CSPs are selected, it is quite possible that the users have had no previous transaction history with the CSPs in question. Therefore the reliability of the CSPs is uncertain from the users’ perspective. This is turn calls the reliability of subcontractors into question as they are the ones often providing crucial services to the CSPs. Further, users have a lack of trust in allowing the service providers to share the data with their subcontractors because once the data is given out by the service providers to the subcontractors, the users no longer have any control on this data. For example, users need to be able to ensure that their data is handled according to the service level agreements made at the time they sign on for services in the Cloud. Furthermore, the users need to be able to enforce any access policies that have been agreed upon. Hence the data brokerage service also seeks to provide aspects of policy enforcement and accountability. The importance of some form of accountability is underscored by fact that the 42% of the respondents of the Poneman study fear they wouldn’t know if their data or applications on their Cloud were actually compromised or if a data breach occurred involving an open port on a Cloud server [18] .
Precisely, the second contribution of this dissertation is an accountability framework. Accountability focuses on keeping the data usage transparent and trackable. In this dissertation, we explore the aspects of reliability and accountability as the second challenge faced by a Cloud brokerage system. The Cloud brokerage service proposes to provide end-to-end accountability by combining the aspects of authentication and access control. Conventional access control approaches developed for closed domains such as databases and operating systems, or approaches using a centralized server in distributed environments are not suitable due to the following features characterizing Cloud environments. First, data handling can be outsourced directly by the CSP to other entities in the Cloud and these entities can also delegate the tasks to others, and so on. Second, entities are allowed to join and leave the Cloud in a flexible manner. As a result, data handling in the Cloud goes through a complex and dynamic hierarchical service chain which does not exist in conventional environments. This need is best met by a dynamic, distributed accountability system which is based on the notion of information accountability [36] . Unlike privacy protection technologies which are built on the hide-it-or-lose-it perspective, information accountability focuses on keeping the data usage transparent and trackable. Accordingly, GABE incorporates aspects of information accountability to provide the users a sense of reliability of the Cloud.
The distributed access control and information accountability framework proposed in this dissertation is suitable for being deployed on the Clouds. Our proposed Cloud Information Availability (CIA) framework provides end-to-end accountability in a highly distributed fashion. One of the main innovative features of this framework lies in its ability of maintaining lightweight and powerful accountability that combines aspects of access control, usage control and authentication. Through it, data owners can track not only whether or not the service level agreements are being honored, but also enforce access and usage control rules as needed.
The final contribution of this dissertation is the development of the PARiNgS framework as a part of GABE for policy driven node selection in Cloud service. PARiNgS is studied specifically in the context of MapReduce in this dissertation, but it can be applied as is for node selection in any distributed computing environment. It seamlessly integrates node selection with the scheduling process of the tasks, performed by the Master nodes, and with other intermediate steps of the task execution. The policy enforcement is achieved using a combination of data tainting, pre-processing, and requirement checking. With regards to MapReduce the key contributions of this dissertation are as follows:
- We propose the very first work to seamlessly integrate policy-driven node selection in a MapReduce framework.
- We develop a synoptic yet eloquent policy language for users to express their policies.
- We propose data pre-processing methods based on a tainting strategy. Our tainting strategy ensures that the policy is applied to the sensitive data as it gets processed at various nodes.
- We deploy PARiNgS on top of an actual MapReduce implementation and demonstrate the scalability of our framework in terms of the additional time taken for processing.
1.3 LAYOUT OF THIS DISSERTATION
The rest of the Dissertation is organized as follows. Section 2 reviews the background and related work. Section 3 presents a brief overview of the workflow of the entire framework. Section 4 discusses in detail the process of Cloud Service Selection. Section 5 discusses the details of the PARiNgS framework for MapReduce. Section 6 discusses in detail the information accountability framework. Section 7 presents the experiments conducted for the Cloud brokerage system. Section 8 contains the concluding remarks and possible directions for future work. Appendix A presents a application scenario for the CIA architecture beyond the Clouds.
[1] In this dissertation we use client and user interchangeably
GABE: A CLOUD BROKERAGE SYSTEM FOR SERVICE SELECTION, ACCOUNTABILITY AND ENFORCEMENT