Cloud Computing Security

Introduction

Cloud computing simply means ―Internet computing, generally the internet is seen as collection of clouds; thus the word cloud computing can be defined as utilizing the internet to provide technology enabled services to the people and organizations. Cloud computing enables consumers to access resources online through the internet from anywhere at any time without worrying about technical/physical management. Cloud computing is more economical than other computing models; zero maintenance cost is involved since the service provider is dependable for the availability of services and clients are liberated from maintenance and management problems of the resource machines. Due to this trait, cloud computing is also well-known as utility computing, or ‘IT on demand‘.

In cloud environment all the data are outsourced to external provider and they take concern of that data is now a responsibility of the cloud provider and we can access this data on virtual machines or any other device. Since the data center of cloud provider is spread to all over, we can access our data from any corner of the world. Cloud computing is the result of advancement in the presented technologies. At the current world of networking system, Cloud computing is one of the most important and developing idea for both the developers and the users. In the cloud environment, resources are shared among the servers, users and individuals.

Objectives

• The paper attempts to evaluate the main security risks and issues that are currently present within the cloud computing industry
• A solution is presented which attempts to eliminate unique threat.

Findings From the Research

Cloud computing security gives emphasis to the following things:

1. 1. Trust

Trust in a cloud environment depends majorly on the selected deployment model, as governance of data and application is subcontracted and delegated out of the owner’s strict authority. Once positioning on a public cloud control is moved to the infrastructure owner to enforce a sufficient security policy that assures that appropriate security activities are performed to ensure that the risk is condensed. The cloud infrastructure puts forward unique security concerns which need to be well thought-out in detail.

1. 1. Confidentiality and privacy

Confidentiality is concerned with the authorized party having the ability to access the protected data. The increased number of devices and parties involved leads to an increase in the number of points of access delegation of data control to the cloud which inversely leads to an increase in the risk of data compromise as the data becomes accessible to a large number of parties.

Data confidentiality can be breached unintentionally due to data remanence which is the residual representation of data that have been erased. Virtual segregation of the drives and hardware between multiple users lead to the unwilling disclosure of private data.

1. 1. Integrity

Software integrity focuses on protecting the software from unauthorized deletion, theft, fabrication and modification. Cloud computing providers implement a set of APIs or software interfaces that customers use to interact and manage with cloud services. Hardware and network integrity is also an issue that needs to be addressed by the cloud provider.

1. 1. Availability

This is concerned with the system being reachable and usable upon demand by an authorized individual. This includes systems ability to carry on operations even when some authorities misbehave. The system has the ability to continue operations even in the possibility of a security breach. Availability is concerned with software, data but also hardware being available to authorized users upon demand.

Trusted Third Party

This is concerned with establishing necessary trust level and provides ideal solutions to preserve the confidentiality. In cryptography a TTP is associate entity that permits secure interactions between 2 parties who each trust a third party. It provides an end-to-end security services which are based on standards and useful across domains, specialization sectors and geographical areas.

TTPs are connected through certificated paths or chains of trust which provide a web of trust forming the notion of a Public Key Infrastructure. Public Key Infrastructure gives technically sound and legally acceptable means to implement:

• Strong Authentication: The process of identification of parts and the control of authenticity, involves an exchange of information or electronic transactions through an electronic means.
• Authorization: The database and informative systems, authenticated access to resources, according to the user’s permission roles and the rights.
• Data Confidentiality: The protection of information either locally stored or in transmission from unauthorized access.
• Data Integrity: The protection of information either locally stored or in transmission from unauthorized modification.

Public Key Infrastructure or PKI deployed in concert with Single-Sign-On(SSO) theme area unit appropriate for distributed settings like cloud environment wherever users navigate between abundance of cross-organization boundaries.

The TTP’s can be relayed upon for:

• • Low and High level confidentiality

Securing the data moving over the network is highly complicated issue whereas the threat of information modification and interruption is incessantly rising. PKI helps in implementing IPSec or SSL for secure communications. Due to the cloud environments unique characteristics, communications are required to be protecting users and hosts. The paper proposes implementing IPSec for encrypting communications for host-to-host communications and SSL for Client-to-Cloud communications.

• • Server and Client Authentication

A cloud environment requires a certification authority in order to certify the entities that interact with each this includes certifying virtual servers, physical infrastructure servers, networks devices and the environments users. Cloud has become a common operating platform as a result it requires an authentication and authorization process. As the gap between organizations own services and outsourced services become fuzzy adoption of Single-Sign-on solution has become critical.

• • Creation of Security Domains

Introduction of federations and associations leads to efficient trust relationships between entities. In a federation of clouds each single cloud remains independent but can interoperate within the federation through standardized interfaces. It provides a structure and framework which in turn enables authentication and authorization across different organizations.

• • Cryptographic Separation of Data

The protection of private information and susceptible data within the framework is an important factor for the deployment of SaS and Aas models. A combination of asymmetric and symmetric cryptographic can offer the efficiency of symmetric cryptography while maintaining the security of asymmetric cryptography.

Criticisms

• The study does not have any statistical proof to back up its claims.
• The study does not expand upon the ways to counter cyber criminals.
• The explanation of cloud computing is a very generic one. Business problems relating to it need to be looked at in more detail.

Conclusions

Given the risks, it strikes us as inevitable that security will become a significant cloud computing business differentiator. Cloud computing currently offers affordable, large-scale computation for businesses. If the economic case prevails, then we may find that nothing—not even security concerns—will prevent cloud computing from becoming a consumer commodity. Cloud computing have the potential to bring about the Computation Revolution, in which large-scale computations become universally accessible, affordable, and useful. Let’s hope we can add to this outcome “and be reasonably safe”.