University of Colorado at Colorado Springs
Engineering & Applied Science Department
Cloud Computing &
Security Issues
Prepared by:
Hamoud Al-Shammari
July 25, 2011
CS6910
Professor Chow
First Part
What is Cloud Computing?
 Layers of Cloud Computing.
 Technical Security Issues in Cloud Computing.

Second Part
What are the problems?
 Opportunities for Advancement.
 The Idea of PVI model.

7/25/2011
Alshammari/Cloud Security
2
What is Cloud Computing?


It is a new paradigm for the provision of computing services.
Shifting the location of these services to the network causes
reducing the costs of hardware and software resources.
7/25/2011
Alshammari/Cloud Security
3
Models of Cloud Computing
1- Software as a Service.
2- Platform as a Service.
3- Infrastructure as a Service.
7/25/2011
Alshammari/Cloud Security
4
Models of Cloud Computing
1- Software as a Service:
•Provides users to use the
applications online.
•Ex: www.zoho.com
Mail, Writer, Projects … etc.
7/25/2011
Alshammari/Cloud Security
5
Models of Cloud Computing
2- Platform as a Service:
•To
control the hosting
environments to specific
needs.
•Ex: Google App Engine to
deploy and dynamically scale
Python and Java based web
applications.
7/25/2011
Alshammari/Cloud Security
6
Models of Cloud Computing
3- Infrastructure as a Service (IaaS):
•Provides
basic infrastructure components such as
CPU, memory and storage.
•Ex: Amazon’s Elastic Compute Cloud (EC2).
7/25/2011
Alshammari/Cloud Security
7
7/25/2011
Alshammari/Cloud Security
8
Two main technologies are used to
access these three Cloud services
1- Web-Services:
•Provide
access to (IaaS)
2- Web-Browsers:
•Provide
access to (SaaS)
* Both provide the access to (PaaS)
7/25/2011
Alshammari/Cloud Security
9
Why we use Cloud Computing?

To reduce the costs: (Pay – As – You – Go)
1- To reduce hardware costs (IaaS).
2- To reduce software license costs (SaaS), (PaaS).

To support the Scalable Systems:
- To NOT worry about increasing of users and requests.
7/25/2011
Alshammari/Cloud Security
10
Some Technical Security
Issues in Cloud Computing

Cloud Security issues focus on:
1- Confidentiality.
2- Integrity.
3- Authentication.

Two places that must be secure in Cloud which are:
1- Web-Services (WS).
2- Web-Browser (WB).
7/25/2011
Alshammari/Cloud Security
11
1- Web-Service Security

WS-Security: it is a mechanism for web service
working in message level.

How to provide Confidentiality, Integrity, and
Authentication for messages?
1- By using XML signature:
For XML fragments to be digitally signed to ensure
integrity and authentication.
2- By using XML Encryption:
For XML fragments to be encrypted to ensure data
confidentiality.
7/25/2011
Alshammari/Cloud Security
12
2- Web-Browser Security

Also works with:
1- XML Signature.
2- XML Encryption.

Modern Web-Browser are using AJAX techniques
(Asynchronous Java Scripts and XML) to develop
platform independent I/O tools.

New names for that techniques (Web Applications,
Web 2.0, or SaaS).
7/25/2011
Alshammari/Cloud Security
13
3- Transport Layer Security (TLS)
OR Secure Sockets Layer (SSL)
1- Record Layer:
Encrypts/Decrypts TCP data stream.
2- TLS Handshake:
Used to authenticate the server and the client.
SSL
became the most important cryptographic
protocol worldwide, because it is implemented in
every web browser.
7/25/2011
Alshammari/Cloud Security
14
4- Cloud Malware Injection Attack

Attacker adds his own system to the Cloud system.

To Solve the PROBLEM:
 Store a hash value in the cloud and compare any
new service or request with the hash value.
 WHAT
if the attacker can create a valid hash
value !!!
7/25/2011
Alshammari/Cloud Security
15
5- Flooding Attacks



Attacker sends a huge amount of nonsense
requests to a certain service which make the
problem by having the data traffic of different time
zones operated by the same server.
That cause, the servers will NOT serve the other
requests from another users.
To Solve The PROBLEM:
 Cloud Computing enables a dynamic adaptation
of hardware requirements to the actual workload
occurring by using Virtual Machines (VM).
7/25/2011
Alshammari/Cloud Security
16
Second Part
“What are the problems?”
7/25/2011
Alshammari/Cloud Security
17
What is the problem with Web-Services?

XML Signature Element Wrapping:
 SOAP messages are generally transmitted through HTTP
protocol with an XML format.


Attacker is able to manipulate a SOAP messages by copying
the target element and inserting another value and moving
the original element to somewhere on the SOAP message.
To Solve The Problem:
 Using a combination of WS-Security with XML signature to
sign particular element and digital certificated such as X.509.

Create a list of elements that is used in the system, and reject
any other messages.
7/25/2011
Alshammari/Cloud Security
18
What is the problem with Web-Browser?

The web-Browsers are not able to apply WS-Security
concepts (XML signature and XML encryption).
BECAUSE:
1- Data can only be encrypted through (TLS)
which is Transport Layer Security.
2- XML signatures are only used within the (TLS)
handshake.
7/25/2011
Alshammari/Cloud Security
19
What is the problem with TSL/SSL?

The TSL/SSL technique is point-to-point.

Messages will be Encrypted and Decrypted many
times in the process.
 possibility of breaking the security between the
browser and the clouds.

Then, attacker can get the DECRYPTED message
and change it !
7/25/2011
Alshammari/Cloud Security
20
Opportunities for Advancement
1- For the problems in Web-Browsers / SSL
Create
new web browsers that apply WS-Security
concepts.
The
WS-Security works in message level, so it
appears to be more suitable than SSL/TLS.
Then,
these web browsers are able to use XML
Encryption in order to provide end-to-end
encryption in SOAP messages.
7/25/2011
Alshammari/Cloud Security
21
Opportunities for Advancement
2- Private Virtual Infrastructure (PVI)
Usually,
cloud computing place an organization’s data
in the control of a third party.
PVI
model is designed to separate the duties between the
users and the providers:
1- The PVI datacenter is under control of the
information owner.
2- The cloud fabric is under control of the service provider.
7/25/2011
Alshammari/Cloud Security
22
Opportunities for Advancement
Private Virtual Infrastructure (PVI)
Client
CANNOT manipulate the security settings of the fabric.
Client
CAN remove, destroy, or lock down their data at any time.
The
Service Level Agreement (SLA) between the user and the
provider determines the responsibilities of all parties.
In
this model Client needs to:
1- Vision into the security settings and configuration of the fabric.
2- Communicate to VPI through virtual private network and all
links should be encrypted with tunnels like SSL.
7/25/2011
Alshammari/Cloud Security
23
Opportunities for Advancement
Private Virtual Infrastructure (PVI)
Trusted
Computing:

Providers are required to use trusted computing technologies, so
organizations can verify their security posture in the cloud and control
their information.

The key component here is Trusted Platform Model (TPM) which is
a cryptographic component that stores cryptographic keys.

Cryptographic keys can be used to attest the operating state of the
platform.

Platform Configuration Registers (PCRs) are places where
cryptographic keys are stored in.
7/25/2011
Alshammari/Cloud Security
24
Opportunities for Advancement
Private Virtual Infrastructure (PVI)
Trusted
Computing:

PROBLEM with TPM: it only works for non-virtualized environment.

Virtual TPM (VTPM): is implemented by providing software
instances of TPMs for each virtual machine.

The developers here developed an architecture that secures each
VM by coupling a VTPM in its own sub domain called Locator Bot
(LoBot).

LoBot allows each VM to be verifiable by its owner and provide
secure provisioning and migration of the VM within the cloud as well.
7/25/2011
Alshammari/Cloud Security
25
Opportunities for Advancement
Private Virtual Infrastructure (PVI)
Five
Tenets of Cloud Computing:
1- Trusted Cloud Platform: the provider needs to provide security services
which protect and monitor the fabric.
2- PVI Factory:
- The most sensitive component of PVI.
- It is the root authority for:
- Provisioning.
- VTPM key generation.
- Certificate generation & management.
- Should be under full control of the information owner.
- It serves as the controller and policy decision point for the PVI.
7/25/2011
Alshammari/Cloud Security
26
Opportunities for Advancement
Private Virtual Infrastructure (PVI)
3- Measurement and Secure Provisioning:
-Providers
must allow clients transparent insight into their infrastructures.
-LoBot
can perform the fabric pre-measurement which allows PVI to share
the responsibility of security management.
-LoBot
is a VM architecture and secure transfer protocol based on VTPM.
4- Secure Shutdown and Data Destruction:
-This
process is required to ensure all sensitive data is removed before new
processes are allowed to run on it.
-The
PROBLEM: the VM do not provide that, so the authors recommended
to enclose that on future VM monitors or through LoBot.
7/25/2011
Alshammari/Cloud Security
27
Opportunities for Advancement
Private Virtual Infrastructure (PVI)
5- Monitoring and Auditing:
-LoBot
provide continuous monitoring of the cloud environment.
-Clients
provide the auditing process.
-But
with that number of users and amount of information the legal using of
the information will be decreased.
-The
authors recommend the sharing of auditing responsibilities between
the service providers and clients.
Bot (LoBot) is the authors’ architecture and protocol for secure
provisioning and secure migration of virtual machines within an IaaS cloud.
LoBot provides many other security features for PVI such as environmental
monitoring, tamper detection and secure shutdown.
-Locator
7/25/2011
Alshammari/Cloud Security
28
Conclusion
Two main technical security points:
1. WS-Security Mechanism:
XML Signature.

XML Encryption.
With developing new browsers this mechanism might be applied.

2.


Private Virtual Infrastructure (PVI) Model:

Duties between provider and client.

Locator Bot (LoBot).
Because users are part of the solution, this model will face many
problems to be applied well.
7/25/2011
Alshammari/Cloud Security
29
References
1.
Cloud Computing: Security Risk. La’Quata Sumter, Department of
Computer and Information Sciences. Florida A&M University.
1.
Infrastructure As A Service Security: Challenges and Solutions.
Wesam Dawoud, Ibrahim Takouna, Christoph Meinel, Hasso Platter
Institute. Postdam, Germany.
2.
On Technical Security Issues in Cloud Computing. M. Jensen, J.
Schwenk. Horst Gortz Institute for IT Security, Ruhr University Bochum,
Germany.
3.
Private Virtual Infrastructure for Cloud Computing. F. John Krautheim.
University of Maryland.
4.
Security Issues In Cloud Computing and Countermeasures. D. Jamil, H.
Zaki. University of Engineering and Technology. Karachi, Pakistan.
7/25/2011
Alshammari/Cloud Security
30
Cloud Computing &
Security Issues
Thank you