OVERVIEW OF CLOUD COMPUTING WITH SECURITY ISSUES, CHALLENGES & COUNTERMEASURES

Transcription

1 OVERVIEW OF CLOUD COMPUTING WITH SECURITY ISSUES, CHALLENGES & COUNTERMEASURES Aaditya Jain 1, Chanderpratap Singh Hada 2, Dr. Bala Buksh 3 1 M.Tech Scholar, Department of Computer Science & Engg., R. N. Modi Engineering College, Rajasthan Technical University, Kota, Rajasthan, (India) 2 Department of Computer Science & Engg., R. N. Modi Engineering College, Rajasthan Technical University, Kota, Rajasthan, (India) 3 Professor, Department of Computer Science & Engg., R. N. Modi Engineering College, Rajasthan Technical University, Kota, Rajasthan, (India) ABSTRACT Cloud computing is the delivery of computing as a service rather than a product, whereby IT resources, software, shared resources, and information are provided to computers as well as other devices on demand, like the electricity grid. Cloud computing is also an Internet based computing where a large pool of systems are connected in private or public networks, and provide dynamically scalable infrastructure for application data as well as file storage. Security of Cloud computing is an evolving sub-domain of network security, computer security and information security. In spite of its vitality, it exhibits many security flaws such as loss of important data, data leakage and something related to cloning, resource pooling etc. Security of Cloud Computing is emerging area for study and this paper presents an overview and characteristics of cloud computing. Also include the several security and privacy issues with challenges and includes solution of security issues of cloud computing. The aim of this paper is to show important aspect of security, privacy concerned challenges which the authors and researchers are facing in the security of cloud computing. Keywords Cloud Computing, Security Issues, Cloud Services, Challenges And Security Solutions. I. INTRODUCTION Internet has been a driving force towards the various technologies that have been developed. Arguably, one of the most discussed among all of these is Cloud Computing. Cloud computing is seen as a trend in the present day scenario with almost all the organizations trying to make an entry into it. The cloud is emerging as the latest way to approach alternative delivery models for IT capabilities. It is a way of delivering IT enabled services in the form of 601 P a g e

2 software, infrastructure and more. This research examines the definition of cloud computing and how it will evolve. Cloud computing can be defined as A computing Cloud is a set of network enabled services, providing scalable, QoS guaranteed, normally personalized, inexpensive computing platforms on demand, which could be accessed in a simple and pervasive way [1]. In simple words, Cloud computing is the combination of a technology, platform that provides hosting and storage service on the Internet. Aim behind the cloud computing is to provide scalable and inexpensive on demand computing infrastructures with good quality of service levels. Cloud Computing is the implementation of engineering principals to obtain high quality applications through Internet. Main goal of the cloud computing is to provide scalable and inexpensive on-demand computing infrastructures with good quality of service levels [2]. Cloud computing provides the internet based, highly scalable distributed computing systems in which computational resources are offered 'as a service'. The most widely used definition of the cloud computing model is introduced by NIST [3] as a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. The advantages of using cloud computing are: i) reduced hardware and maintenance cost, ii) accessibility around the globe, and iii) flexibility and the highly automated process wherein the customer need not worry about software up-gradation which tends to be a daily matter [4]. II. OVERVIEW OF CLOUD COMPUTING The cloud is a term that refers to the web and cloud formation is used to represent the Internet in computer network diagrams as well [5]. The reason of Likened the Internet to the cloud is that the Internet as a cloud hides its technical details from the user's view and it creates a layer of abstraction between the user and technical details. For example, what is provided by a software service provider of cloud computing is online business applications that are provided to users through a web browser or other software. Applications and data are stored on servers and are available to users on demand. Details remain hidden from the user's view and the user needs no expertise or control over the used cloud infrastructure technology. Generally, consumers of cloud computing are not owner of cloud physical infrastructure but they rent it from a third party to avoid the cost of capital. They consume the resources as a service and pay only the cost of the resources used. 602 P a g e

3 Fig. 1 Classification of cloud system [5] Cloud computing can be divided into two sections, the user and the cloud. In most scenarios, the user is connected to the cloud via the internet. It is also possible for an organization to have a private cloud in which a user is connected via a intranet. However, both scenarios are identical other than the use of a private and public network or cloud [6]. The user sends requests to the cloud and the cloud provides the service. Cloud computing products, also called cloud service delivery models, as in Fig. 2, which are often roughly classified into a hierarchy of -as a service terms, presented here in order of increasing specialization: Infrastructure-as-a-service (IaaS): where cloud providers deliver computation resources, storage and network as an internet-based services. This service model is based on the virtualization technology. Amazon EC2 is the most IaaS provider. Platform-as-a-service (PaaS): where cloud providers deliver platforms, tools and other business services that enable customers to develop, deploy, and manage their own applications, without installing any of these platforms or support tools on their local be hosted on top of IaaS model or on top of the cloud infrastructures directly. Google Apps and Microsoft Windows Azure are the most known. Software-as-a-service (SaaS): where applications hosted on the cloud infrastructure as internet based service for end users, applications on the customers computers be hosted on top of PaaS, IaaS or directly hosted on cloud infrastructure. SalesForce CRM is an example of the provider. Each service delivery model has different possible implementations, as in Fig 2, which complicates development of standard security model for each service delivery model. 603 P a g e

4 Fig. 2 Cloud service delivery models Irrespective of the above mentioned service models, cloud services can be deployed in four ways depending upon the customer s requirements: Public Cloud: A cloud infrastructure is provided to many customers and is managed by a third party [7]. Multiple enterprises can work on the infrastructure provided, at the same time. Users can dynamically provision resources through the internet from an off-site service provider. Wastage of resources is checked as the user pays for whatever they use. Private Cloud: Cloud infrastructure, made available only to a specific customer and managed either by the organization itself or third party service provider. This uses the concept of virtualization of machines, and is a proprietary network [7]. Community Cloud: Infrastructure shared by several organizations for a shared cause and may be managed by them or a third party service provider. Hybrid Cloud: A composition of two or more cloud deployment models, linked in a way that data transfer takes place between them without affecting each other [8]. III. CHARACTERISTICS OF CLOUD COMPUTING The main characteristics of cloud computing [9] include on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service and multi tenacity [10], [11]. On demand self-service characteristics 604 P a g e

5 means that customers or usually organizations can request as well as manage their own computing resources. Broad network access provides services to be offered over the Internet. Resource pooling characteristics means that customers draw from a pool of computing resources, usually in remote data centers. Services can be scaled larger and smaller; as well as use of a service is measured and also customers are billed accordingly. Cloud computing resource usage can be measured and controlled providing transparency for both the consumer and provider of the utilized service [12]. Multi-tenancy and elasticity are two key characteristics of the cloud model. Multi-Tenancy enables sharing the same service instance among different tenants [13]. Elasticity enables scaling up and down resources allocated to a service based on the current service demands. Both characteristics focus on improving resource utilization, cost and service availability. Some benefits of cloud computing are pointed by authors of [12], [14], [15]. Flexibility, dynamic scalability, competitiveness, location and device independence. Achieve economies of scale, helps in disaster recovery. Automatic software updates, increased collaboration minimize licensing new software. Reduce spending on technology infrastructure, having streamline processes with reduced cost. Projects monitor more effectively, business continuity, and increased storage. Minimized capital expenditure, having high computing power. Optimized server utilization, Shortened development life cycle. IV. SECURITY ISSUES OF CLOUD COMPUTING Cloud Computing leverages many existing technologies such as web services, web browsers, and virtualization, which contributes to the evolution of cloud environments. Therefore, any vulnerability associated to these technologies also affects the cloud, and it can even have a significant impact. Rapid cloud adoption has however, introduced unique and complex security considerations for users. Now organizations must consider how adopting a cloud-computing model will affect their risk profile related to data security, privacy and availability. The vendor for Cloud must make sure that customer does not face any problem like loss of data, data theft or more. Here we discussed, major issues with cloud computing that are faced by various authors in their research [14], [16]-[20]. 4.1 Data Loss If the vendor closes due to financial problems there will be a loss of data for the customers, so it is a serious problem in Cloud computing, as well as customers won t be access those data s because data is no more available for the customer as the vendor shut down. 4.2 Data Location Location of any data nothing is transparent even the customer don t know where his own data s are located. Vendor does not reveal where all the data s are stored and data s won t even be in the same country of customer, it might be located anywhere in the world. 605 P a g e

6 4.3 Data Theft Many cloud Vendors instead of acquiring a server tries to lease a server from another service providers because they are cost affective. The customer doesn t know any things, so there is a possibility that the sensitive data can be stolen from external server by a malicious user. 4.4 Data Integrity Data is store on a cloud, then anyone from any location can access those data s from the cloud and also Cloud does not differentiate between a sensitive data from a common data so enabling anyone to access those sensitive data s, Thus it is a lack of data integrity. 4.5 Privacy Issues Most of the servers are external, so vendor should make sure who is accessing the data as well as who is maintaining the server so enabling the vendor to protect the customer s information. 4.6 Security on User Level Vendor has provided a very good security layer for the customer, and customer should make sure that because of its own action, there shouldn t be any loss of data for other users who are using the same Cloud. 4.7 Security on Vendor Level A Cloud is good if when there is a very good security provided by the vendor to the customers. Server is much secured from all the external threats, this all things vendor should make sure. 4.8 Infected Application Vendor should have the full access to the server for monitoring as well as maintenance, so preventing any malicious user from uploading any infected application onto Cloud which will severely affect the customer. V. CHALLENGES IN CLOUD COMMUNICATION SECURITY The communication process results in transmission of either data/information or applications between the customer and the cloud. Moreover, there exists communication within cloud between VMs. This communication generates cloud specific challenges because of cloud specific characteristics and technologies. 5.1 Shared Communication Infrastructure Resource pooling not only results in sharing of computational and storage resources but also sanctions the sharing of network infrastructure components. The sharing of network components provides attacker the window of cross tenant attack [18], [20]. The vulnerability stems from the resource pooling characteristic of the cloud computing and affects the IaaS service model of the cloud. Due to the fact that it is hard to distinguish between a legal vulnerability scan of network and attacker activity, usually such scans are not allowed by the service providers. Similarly, the IPbased segregation of network portions are not applied as network resources are dynamically provisioned and released and cannot be associated to particular set of users. The users on the cloud are usually granted with the super-user access for the purpose of managing their VMs. The access capability empowers the malicious user to 606 P a g e

7 acquire system IP or MAC addresses and make malicious use of IaaS network interfaces. The malicious user with super-user access to the real network components may launch attacks, such as, sniffing and spoofing over the real network. 5.2 Virtual Network In cloud computing systems, the communication takes place not only on real networks but virtualized networks also play an important role in communication. Virtual network is a logical network built over a physical network. The virtual networks are responsible for communication between VMs. The software-based network components, such as bridges, routers, and software-based network configurations, support the networking of VMs over the same host. The virtualized networks are able to generate the following security challenges in the cloud environment. Security and protection mechanisms over the physical network are not able to monitor the traffic over virtualized network. This becomes a serious challenge as malicious activities of the VMs go beyond the monitoring of security tools. Intrusion detection and prevention mechanisms usually depend on the traffic patterns and activities to judge the anomalies and detect the possibility of the attack. Virtualized network poses a hindrance to the goal of such preventive measures [21]. The virtualized network is shared among multiple VMs that causes the possibility of certain attacks, such as, Denial of Service (DoS), spoofing and sniffing of virtual network. The traffic rates can be monitored for malicious purposes. The cryptographic keys become vulnerable to leakage, in case of malicious sniffing and spoofing of virtual network [17]. The data in transit belonging to users can suffer from costly breaches. 5.3 Security Misconfigurations Security configurations of the cloud network infrastructure are of significant importance in providing secure cloud services to the user [16], [22]. Misconfigurations can radically compromise the security of customers, applications, and the whole system. Customers outsource their applications and data to the cloud with the trust that their assets are secure within the cloud environment. A small misconfiguration can breach the security of the system. The configurations need to be well in place not only at the time of cloud infrastructure development, deployment, and operations but subsequent changes in the cloud network should also keep the configuration consistent with the security policies. One of the most common misconfiguration occur when administrators select such a configuration tool that they are familiar with but not necessarily covers all the security requirements. The migration of VMs, data, and applications across multiple physical nodes, changes in traffic patterns, and topology can generate the requirement of varied security policies. In such a scenario, the configuration of the cloud should dynamically be managed to ensure the security of the cloud. Likewise, any weakness in session configurations and protocol configurations can be exploited for session hijacking and to gain user sensitive data. VI. SOLUTIONS FOR SECURITY ISSUES OF CLOUD COMPUTING Small and large Businesses are realizing the benefits that come with cloud computing technology [24]. The scalability which allows you to easily shrink your operation, agility that enables you to make quick changes, cost- 607 P a g e

8 effectiveness so can save you money, cloud seems such as a no-brainer [28], [56]. When increased cloud adoption rates come increased cloud computing security issues also. Here we discussed about some solution of security issues in cloud computing: 6.1 Vulnerability Shielding When waterhole attacks occurs, and then solution is Vulnerability shielding [18] that update and patches all software regularly to limit possible access points. The water hole attack contains 3-step process, first, the attacker does some reconnaissance and research on its target, in which they find, trusted websites often visited by employees of the target company. Then, attackers insert an exploit into the trusted sites, and finally, when your employees visit the trusted site, the exploit takes advantage of their system vulnerabilities. 6.2 Find Right Cloud Provider Another solution of security issues in cloud computing is find right cloud provider (well established, experience, standards and regulation), because different vendors have different cloud data management [42]. 6.3 Data Storage Regulation The architecture of cloud environment is key and you must understand concept of the respective data storage regulations in the countries you operate in. You must look for cloud security solutions which are compliant with regulations such as HIPAA, PCI DSS, and EU data protection laws and EU s very restrictive regulations, accept that this is a very good solution [18]. 6.4 Facility for Recovery The Cloud vendors should be responsible for recovery the date. If any data is lost due to certain issues, they can be recovered as well as continuity of data can be managed [42]. 6.5 Enterprise Infrastructure Amazon Web Service s has their own security center explains that so cloud provider has secured the underlying infrastructure and you, also the client, must secure anything you put on the infrastructure [18]. Enterprise must have infrastructure which give you facilitates for installation as well as configuration of hardware components like firewalls, routers, servers, proxy servers, and software etc. [42], [48]. 6.6 Use Split Key Encryption Techniques You should use split-key encryption technologies [18] to ensure that only you control your sensitive data and also your cloud provider shares responsibility for the infrastructure, therefore you are still responsible for your apps and data [42]. At least not in a readable form you also Use a cloud encryption solution to show that your data never left home. 608 P a g e

9 6.7 Access Control Access control [4], [47] is a key concern, and Cloud requires also a user centric access control where user request to any service provider is bundled with the user identity as well as entitlement information. User identity [4] will have identifiers which identity and define the user. This approach leaves the user with the ultimate control of their digital identities and implies that the system maintains a context of information for every user. 6.8 ID Management and Authentication When access monitoring is to implement of Key Management for both cloud service provider and client and Key must be known for both entities as well as will be remotely monitored [4]. When clients access the cloud computing services, it must be first authenticated, not only using username and password but a digital ID s also [4]. Find solutions which require no hardware that is the best fit for cloud environments. In short, a solution should give all the benefits as well as up in minutes too, so, make sure you limit your vulnerabilities, do not let anyone have access to your own encryption keys, comply with all required laws as well as regulations, use encryption technology to make your life easier, and understand that you share responsibility for liability. VII. CONCLUSION Cloud computing is a promising and emerging technology for the next generation of IT applications. Although cloud computing has many advantages, there are still many actual problems that need to be solved. The revenue estimation implies that cloud computing is a promising industry. But from another perspective, existing vulnerabilities in the cloud model will increase the threats from hackers. According to service delivery models, deployment models and essential features of the cloud computing, data security and privacy protection issues are the primary problems that need to be solved as soon as possible. The challenges in privacy protection are sharing data while protecting personal information. The typical systems that require privacy protection are e-commerce systems that store credit cards and health care systems with health data. The ability to control what information to reveal and who can access that information over the Internet has become a growing concern. This research paper analyzed what exactly cloud computing security related issues are, and discussed some solutions to overcome them. Authorization and access control mechanisms will need to achieve a unified, reusable and scalable access control model and meet the need of fine grained access authorization. REFERENCES [1] L. Wang, G. Laszewski, M. Kunze and J. Tao, Cloud computing: a perspective study, J New Generation Computing, pp 1-11, [2] Harjit Singh Lamba and Gurdev Singh, Cloud Computing-Future Framework for e-management of NGO's, IJoAT, ISSN , Vol 2, No 3, July P a g e

10 [3] Peter Mell, and Tim Grance, "The NIST Definition of Cloud Computing,"2009, media /faq-files/clouddef- v15.pdf, Accessed April [4] R. Maggiani, Communication Consultant, Solari Communication, Cloud Computing is Changing How we Communicate, 2009 IEEE International Professional Conference, IPCC, pp. 1-4, Waikiki, HI, USA, July 19-22, ISBN: [5] Gupta P. cloudsim & cloud setup [OnLine], Access in January [6] Ertaul, L. and Singhal, S. Security Challenges in Cloud Computing, California State University, East Bay, [7] R. L Grossman, The Case for Cloud Computing, IT Professional, vol. 11(2), pp , ISSN: , [8] Rohit Bhadauria et. al. paper on A Survey on Security Issues in Cloud Computing, International Journal of Computer Application, Vol 15, Issue 2, [9] Wayne Jansen, Timothy Grance, Guidelines on Security and Privacy in Public Cloud Computing, Draft Special Publication , Computer Security Division, Information Technology Laboratory, National Institute of Standards and Technology, Gaithersburg, MD , [10] Christopher Olive, Cloud Computing Characteristics Are Key, White Paper, [11] Peter Mell, Timothy Grance, The NIST Definition of Cloud Computing, Recommendations of the National Institute of Standards and Technology, Special Publication , [12] Viswa prakash babu, Banda Sreenivas, Thota Praveen Kumar, R.Jawahar Lal, Cracking Bluetooth security Int. Journal of Applied Sciences and Engineering Research, Vol. 3, No. 2, ISSN , [13] Robert Gellman, Privacy in the Clouds: Risks to Privacy and Confidentiality from Cloud Computing, February 23, [14] Dr. David Turahi, Security and Privacy: Can we trust the cloud?, East African Information Conference 13-14thAugust, 2013, Kampala, Uganda. [15] Anthony Bisong and Syed (Shawon) M. Rahman An Overview of The Security Concerns In Enterprise Cloud Computing ; International Journal of Network Security & Its Applications (IJNSA), Vol.3, No.1, DOI: /ijnsa , [16] Nir Kshetri, Associate Professor, The University of North Carolina-Greensboro, Usa Privacy And Security Issues In Cloud Computing, PTC 11 Proceedings [17] Abhinay B.Angadi, Akshata B.Angadi, Karuna C.Gull, Security Issues with Possible Solutions in Cloud Computing-A Survey, International Journal of Advanced Research in Computer Engineering & Technology (IJARCET), Volume 2, Issue 2, ISSN: , February P a g e

11 [18] N. Gonzalez, C. Miers, F. Redgolo, M. Simplcio, T. Carvalho, M. Nslund, M. Pourzandi, A quantitative analysis of current security concerns and solutions for cloud computing, Cloud Computing conference, USA, 1 (1) (2012) [19] Vahid Ashktorab, Seyed Reza Taghizadeh, Security Threats and Countermeasures in Cloud Computing, International Journal of Application or Innovation in Engineering & Management (IJAIEM), Volume 1, Issue 2, ISSN , October [20] Rabi Prasad Padhy, Manas Ranjan Patra, Suresh Chandra Satapathy; Cloud Computing: Security Issues and Research Challenges, IRACST - International Journal of Computer Science and Information Technology & Security (IJCSITS), Vol. 1, No. 2,,ISSN: , December [21] D. AB. Fernandes, L. FB. Soares, J.V. Gomes, M.M. Freire, P. RM Inácio, Security issues in cloud environments: a survey, Int. J. Inform. Sec. 13 (2) , August [22] K. Hashizume, D.G. Rosado, E. Fernndez-Medina, E.B. Fernandez, An analysis of security issues for cloud computing, J. Internet Services Appl. 4 (1)-1 13, [23] W.A. Jansen, Cloud hooks: Security and privacy issues in cloud computing, in: 44th Hawaii International Conference on System Sciences (HICSS), 2011, pp [24] Allan A. Friedman and Darrell M. West Privacy and Security in Cloud Computing, 1026_cloud_computing_friedman_west.pdf. [25] Issa M. Khalil, Abdallah Khreishah and Muhammad Azeem; Cloud Computing Security: A Survey ; Computers 2014, 3, 1-35; doi: /computers ; ISSN X. [26] Anitha Y, Security Issues in Cloud Computing - A Review, International Journal of Thesis Projects and Dissertations (IJTPD), Vol. 1, Issue 1, PP: (1-6), Month: October-December 2013, Research Publish Journals. [27] Pradeep Kumar Tiwari, Dr. Bharat Mishra, Cloud Computing Security Issues, Challenges and Solution, International Journal of Emerging Technology and Advanced Engineering, ISSN , Volume 2, Issue 8, August P a g e