Cloud Security 2014 AASNET

  • View

  • Download

Embed Size (px)



State-of-the-art Survey on Cloud Computing Security Challenges, Practices and Solutions

Farrukh ShahzadKing Fahd University of Petroleum and Minerals, Dhahran, KSA

September 2014

The 6th International Symposium on Applications of Ad hoc and Sensor Networks(AASNET14)

1OutlineIntroductionCloud Computing ModelsSecurity in the CloudCloud Storage SecurityCase Study: Amazons AWS SecurityImplementation/Demo of SAFEConclusion22IntroductionCloud Computing: Highly scalable, technology-enabled services easily consumed over the Internet on an as-needed basis.Big Players: Amazon, Google, Microsoft, Yahoo, Sun, Salesforce.Different implementation depends on type of Services: SAAS ,PAAS, IAAS, etc. User data is processed and/or stored remotely in machines owned and operated by someone else.Pros : Convenience, efficiencyCons : Users fear of confidential data leakage and loss of privacy in the cloud.Three main challenges in adapting Cloud Services:How to identify a cloud provider that meet users privacy requirements?How to establish a common privacy policy between the user and the provider?Is the users data is actually handled as agreed by the parties?33Cloud Overview4

4Cloud computing model

5Essential CharacteristicsService ModelsDeployment Models5Cloud Computing CharacteristicsResource PoolingBroad Network AccessRapid ElasticityMeasured ServiceOn-demand Self-service

66Cloud Service Models7

7Cloud Deployment ModelsPublic Cloud (Amazon AWS)Private CloudHybrid CloudCommunity Cloud

88Cloud Security Risk factors Outsourcing Extensibility and Shared ResponsibilityVirtualizationMulti-tenancyService Level AgreementHeterogeneity

99Cloud Security MatrixApplication & Interface SecurityAudit Assurance & ComplianceBusiness Continuity Management & Operational ResilienceChange Control & Configuration ManagementData Security & Information Life-cycle ManagementData-center SecurityEncryption & Key ManagementGovernance and Risk ManagementHuman ResourcesIdentity & Access ManagementInfrastructure & Virtualization SecurityInteroperability & PortabilityMobile SecuritySecurity Incident Management, E-Discovery & CloudForensicsSupply Chain Management, Transparency and AccountabilityThreat and Vulnerability Management1010Security As A ServiceIdentity Services and Access Management Services Data Loss Prevention (DLP) Web Security Email Security Security Assessments Intrusion Management, Detection, and Prevention(IDS/IPS) Security Information and Event Management (SIEM) Encryption Business Continuity and Disaster Recovery Network Security1111Some Cloud Security IssuesThe eDDoS (economic Distributed Denial of Service)Economic Denial of Sustainability (EDoS)Cloud Storage Security and Privacy1212eDDoSDistributed Denial of Service (DDoS) attacks target web sites, hosted applications or network infrastructures by absorbing all available bandwidth and disrupting access for legitimate customers and partners. The eDDoS (economic Distributed Denial of Service) in cloud is due to the DDoS attack, where the service to the legitimate user is never restricted. This leads to Economic Denial of Sustainability (EDoS) as user will be billed for this undesired resources.1313Cloud StorageCloud Storage ModelNew business solution for remote backup outsourcing Reduces data management costsAPIs, web based user interfaces, and cloud storage gateways.Cloud Storage Providers for individualsiCloudDropboxGoogle DriveAmazon S31414Cloud StorageAdvantages of Cloud StorageFault toleranceImmediate accessStreamingProblemsAccess controlAssured deletion?Multiple copies for fault tolerance1515Security GoalsThreat Model: Active files: Oscar should not be able to access the file.Deleted files: if the files are actually deleted by the provider if requested.Avoid unauthorized accesspolicy-based access controlUnrecoverable deleted filespolicy based assured deletion1616CASE STUDY: AMAZON WEB SERVICESCompute (Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic MapReduce (Amazon EMR), Auto Scaling, Elastic Load Balancing)Networking (Amazon Virtual Private Cloud (Amazon VPC), Amazon Route 53, AWS Direct Connect)Storage (Amazon S3, Amazon Glacier, Amazon Elastic Block Storage (EBS), AWS Storage Gateway, AWS Import/Export)Content Delivery - Amazon CloudFrontDatabase (Amazon Relational Database Service (Amazon RDS), Amazon DynamoDB, Amazon ElastiCache, Amazon Redshift)Deployment & Management (AWS Identity and Access Management (IAM), Amazon CloudWatch, AWS Elastic Beanstalk, AWS CloudFormation, AWS Data Pipeline, AWS OpsWorks)Application Services (Amazon Simple Queue Service (Amazon SQS), Amazon Simple Notification Service (Amazon SNS), Amazon Simple Workflow Service (Amazon SWF), Amazon Simple Email Service (Amazon SES), Amazon CloudSearch, Amazon Elastic Transcoder)1717AWS general Security MeasuresCertifications and accreditationsPhysical securitySecure servicesData privacy1818AWS Infrastructure Security(Shared responsibility)AWS Compliance Program (SOC 1/SSAE 16/ISAE 3402 (formerly SAS 70 Type II), HIPAA)Physical and Environmental Security Fire detection, Power, temperature Control, Storage Device DecommissioningBusiness Continuity Management (Availability, Incident Reporting, Communication)Network SecuritySecure Network ArchitectureFaultTolerant DesignNetwork Monitoring and Protection (protection against, DDoS, MITM, IP Spoofing, Port scanning)AWS Access (Account Review and Audit, background checks, Password policy)Secure Design Principles Change Management AWS Account Security Features AWS Identity and Access Management (AWS IAM) Key Management and Rotation Temporary Security Credentials AWS MultiFactor Authentication (AWS MFA)1919AWS Security best PracticesProtect your data in transitProtect your stored dataProtect your cloud account (AWS) credentialsManage multiple users with IAMSecure your Applications2020ConclusionThe revolution of cloud computing has provided opportunities for research in all aspects of cloud computing. Research in the secure cloud storage is compounded by the fact that users data may be kept at several locations for either redundancy/fault tolerance or because the service is provided through a chain of service providers. We explored the security measures adopted by the largest cloud service provider (Amazon web services or AWS) including their infrastructure security and security best practices followed by AWS.2121AcknowledgementThe support provided by the department of Information and Computer Science and Deanship of Scientific Research at King Fahd University of Petroleum and Minerals (KFUPM).2222References23

23SAFE(Demo) Summary The Secure Access controlled File Encryption (SAFE) system is an overlay which works seamlessly over the existing cloud storage services without any changes on the cloud side. Furthermore, the implementation only requires basic data access API functions like put (upload) and get (download). In SAFE, a file is encrypted with a data key by the owner of the file, using the SAFE client. The data key is further encrypted with a secret key which is in turn is encrypted with a control key, based on the access control policy selected by the owner, with the help of a separate key server. The encrypted keys are stored as a separate metadata file, along with the encrypted data file. The purpose of SAFE is to achieve policy-based access control and assured deletion. 2424SAFE Overview25SAFE client: This is an interface application between clients or users storage system and the cloud storage. It communicates with Key server securely (SSL protocol) to request appropriate cryptographic operations. The application performs all required upload, download, encryption and decryption functions. Key Server: This is a multi-threaded server application which provides all needed backend services to SAFE clients. It utilizes SSL socket to communicates with SAFE clients securely. It provides storage for users, policies and corresponding public/private key pair.

25Policy ManagementThe owner of the file needs to select proper policy for the file which needs to be uploaded to the cloud. There are two types of policies: 1) Individual. Each user of the SAFE system is assigned a unique individual policy at the time he/she register with the Key server. 2) Group Policy. Separate policies can be added for a group of users. For example, a department in a company can have a group policy so that the employees of that department can share files on the cloud, if the owner of the file, uploads the file with the group policy assigned to that department. Similarly, there could be group policy for a team project so all members can share files related to the project.

2626Cryptographic KeysSAFE uses three types of cryptographic keys to protect the data files stored on the cloud. 1) Data key. A data key is a random secret that is generated by a SAFE client. It is used for encrypting or decrypting data files via symmetric (AES) key encryption. 2) Secret key. Similar to the data key, a secret key is generated by a SAFE client. It is used for encrypting or decrypting the data key via symmetric (AES) key encryption. 3) Policy key. This key is associated with a particular policy. It is represented by a public-private key pair, which is maintained by the key server. It is used to encrypt/decrypt the secret key of the file via RSA. To ensure file deletion (inaccessibility), the corresponding policy can be revoked. 2727Upload Operation of SAFE28The file upload function is shown below. The client first requests the public key Ppub of policy P from the key server. Then the client generates two random keys K and S and perform the encryption eS(K), ePpub(S) and eK(F). Finally, the client sends eK(F) i.e. the encrypted file and P, eS(K) , ePpub(S) (as metadata) to the cloud. The client should discard K and S. There will be