SE-CNC - A Brazilian Experimental Cloud Storage Service

Transcription

1 SE-CNC - A Brazilian Experimental Cloud Storage Service Roberto ARAUJO 1, Carlos Eduardo DA SILVA 2, Thomás DINIZ 2, Tainá MEDEIROS 2, André MARINS 3, Michael STANTON 3 1 Federal University of Pará UFPA INF, Augusto Corrêia Street, Guamá, ZIP , Belém, Brazil Tel: , rsa@ufpa.br 2 Federal University of Rio Grande do Norte UFRN INF, Senador Salgado Filho Av, Lagoa Nova, ZIP , Natal, Brazil Tel: , kaduardo@imd.ufrn.br, thomasfdsdiniz, tainajmedeiros@gmail.com 3 Brazilian National Education and Research Network, RNP, 116 Lauro Muller st, room 1103, ZIP , Rio de Janeiro, Brazil Tel: , Fax: , amarins, michael}@rnp.br Abstract Cloud-based storage services are increasingly common tools in the everyday life of teachers and researchers. Thus, the Cloud business model is a trend for those who are looking for scalability, availability, flexibility and fewer maintenance issues. The increasing demand for collaborative work has driven these users to commercial cloud solutions, such as Dropbox, Google drive or OneDrive, as the means to save and share presentations, lecture notes or research documents. Although those solutions offer many benefits for their users, they have a number of disadvantages, for example, commercial clouds store data on their own servers, which are subject to local rules and government laws, which are often not the same rules and laws to which their users are subject. Another disadvantage is related to the terms of use/privacy policy. In this context, we present CNC Cloud, Cloud Computing for Science, a project sponsored by the Brazilian NREN RNP (Rede Nacional de Ensino e Pesquisa), which aims to offer a cloud storage service for researchers and lecturers at Brazilian education and research institutions. Keywords: Owncloud, Security, Cloud Computing. 1. Introduction Historically, the evolution of information technology has been characterized by innovation and the creation of new paradigms. This behavior has repeated itself with the appearance of cloud computing, a distributed computing model where shared computational resources (e.g., hardware, development platforms, and applications) are virtualized and offered as services, supported by a number of data centers all over the Internet (Armbrust et al. 2010, Foster et al. 2008, Vaquero et al. 2009). This movement has raised a lot of interest in different communities. Nowadays, there are a number of commercial cloud service providers (e.g., Amazon, Google, Microsoft), which have been adopted by users with different profiles (home users, scientific and private communities) for saving and sharing different types of documents, such as presentations, lecture notes, and research documents. Page 1 ISSN Proceedings and report of the 7th UbuntuNet Alliance annual conference, 2014,

2 Although those solutions offer many benefits for their users, they present a number of disadvantages. In general, commercial clouds store data on their own servers. Those servers, and the data stored on them, are subject to local rules and government laws, usually different from those to which their users are subject. Another disadvantage is related to the terms of use/privacy policy. Cloud services can, and usually do, update their terms of use in accordance with their business interests, rendering the user defenseless with respect to the ownership of their data. Thus, although there is a search for reliable and internationally recognized standards, there is still no clarity and consensus regarding the rights and obligations between the parties involved in a model of Cloud Computing. In particular, data stored in commercial clouds can be vulnerable to unauthorized and undesired monitoring and manipulation by the service provider or even third parties. In this context, RNP has been funding the CNC Cloud Project, an R&D Project which is part of RNP s Working Group (WG) Programme since The main objective is to offer a cloud storage service, which does not depend on foreign service providers and is based on open source technologies, to Brazilian education and research institutions. This service also focuses on data privacy, aiming at providing secure data storage. The CNC Cloud project has built an infrastructure with a backend based on the OpenStack software and a frontend whose user access interface is based on Owncloud. Currently, the project is in an experimental phase in which it will deliver a pre-production cloud storage service environment, with servers hosted at different Brazilian Federal Universities and some Points of Presence (PoPs) of RNP s national backbone network. This paper is organized as follows: Section 2 presents concepts of cloud computing and identity Federation. In Section 3, we describe the development of the experimental service, based on the CNC Cloud project, and how its architecture works. In Section 4 the results of the tests that have been performed with CNC Cloud will be presented. Finally, Section 5 presents the conclusions and some future work. 2. Background 2.1 Cloud Computing Cloud computing is a relatively new business model in the computing world. According to NIST definition, cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications and services). NIST also defines three service models for cloud computing: Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS). SaaS is the model that provides to the user applications running on cloud infrastructure. PaaS provides to the user a cloud environment to deploy its own applications using programming languages, libraries and services supported by the cloud. IaaS aims to provide fundamental computing resources such as processing, storage, networks to the user. In this case, the user does not control underlying cloud infrastructure, he controls over deployed operations. Currently, many users have signed up to some type of cloud service, such as storage services (e.g., Dropbox 1 ), and virtual machine services (e.g., Amazon 2 ). Moreover, the use of cloud services has gained widespread adoption beyond that of a single user, and can now be perceived in a number of environments, such as companies, research centres, universities, and Page 2 ISSN Proceedings and report of the 7th UbuntuNet Alliance annual conference, 2014,

3 so on. Thus, the increasing use of cloud computing services has required a new architecture and design solutions to support those demands Openstack is a toolbox to build cloud infrastructures, one of which is the Object Storage (Swift). Swift allows the creation of storage clouds. Thus, Swift is composed by modules that perform specific services for the cloud and has a distributed deployment approach, with storage servers and proxy servers. Keystone is an OpenStack project that aims to provide a service for Identity management. OpenStack projects the use of keystone to authenticate users wishing to access cloud services. In our infrastructure Keystone is deployed on proxy nodes. The native Keystone authentication process is based on the use of tokens as credentials. After successful authentication, the user receives a token to enable access to cloud services. 2.2 Identity Federation Cloud services are normally made available to a large number of users from different domains (such as schools and colleges), that need to be authenticated before gaining access. This authentication is usually carried out by well-known mechanisms and the cloud can be responsible for all authentication management, including the storage of user access information. However, as the number of users increases, the authentication process becomes more complex, and so the cloud services are starting to find other alternatives, in order to facilitate it. A federated identity management system consists mainly of service and identity providers. These providers establish a trust relationship for exchange of user information, in order to allow access to the resources (Chadwick 2009; Wangham et al. 2010). A service provider (SP) offers resources to a user, who is authenticated through an identity provider (IdP). Besides performing user authentication, the IdP is also responsible for issuing attribute assertions to the authenticated user. An attribute corresponds to a characteristic or property of a user, whereas an attribute assertion is an affirmation made by the IdP, through a message signed digitally, saying that a user possesses a particular attribute. By utilizing the attributes that belong to the user, an SP will then, based on its own access control policies, make decisions about the resources and operations requested by a user. There are many technologies that can help the development of identity federated management systems, such as SAML and OpenID Connect4. RNP s Identity Federation name CAFe utilizes SAML (Security Assertion Markup Language) (OASIS 2008). It defines standard messages and protocols for safe sending and receiving users identity information. Besides, SAML also sets a group of roles that can be performed by an entity in the SAML infrastructure, as well as the metadata that describes these entities (Wangham et al. 2010). 3. CNC Cloud 2.3 Infrastructure Overview Aiming to provide a safe, reliable and scalable data storage service in the cloud, the CNC Cloud project carried out an extensive study of tools for building a cloud. The experimental service considers the community cloud model implementation and the IaaS model, where the end user accesses the cloud through a web client and acquires access to stored files. All operations are performed using load balancers that ensure the high availability and scalability of the cloud. Figure 1 shows an overview of the architecture. Page 3 ISSN Proceedings and report of the 7th UbuntuNet Alliance annual conference, 2014,

4 Figure 1: Overview of the architecture 2.4 CNC Cloud Architecture CNC Cloud components can be deployed in different servers and provide the named services: proxy, object, container and account. The proxy server receives user requests and forwards them to the cloud storage services. Currently the CNC experimental phase uses three proxy servers. Each one of these services is deployed on a different server. One of the servers is located at the Federal University of Pará (UFPA), the second at the Federal University of Santa Catarina (UFSC), and the third at the Federal University of Minas Gerais (UFMG). Figure 2 shows the disposition of these servers. It is important to note that, in order to meet a larger number of user requests, more proxy servers can be added to the architecture in the future. These 3 proxy servers utilize load balancing performed through round-robin DNS. The communication between the proxy servers and the users uses the HTTPS protocol. However, in order to provide the storage service to users, the cloud requires some form of authentication. For this, it was decided to include the cloud service in RNP s Identity Federation for research and development projects, named CAFe Expresso. This federation authenticates the user to access the cloud resources. The account, container and object services take care of the data storage. The object service handles object storage, the container service handles the list of objects inside the containers, and the account service handles the list of containers. In the cloud, all three services can be deployed on a single server known as the Storage Node. The experimental phase of CNC Cloud Project has a total of 15 (fifteen) servers (nodes) of storage, that can be seen in Figure 2 of this section. Each storage server provides these three services: Object, Container and Account. These servers make up the storage cloud and are responsible for storing user data. A ring concept determines where the data are stored in the cloud, through mapping. A ring can be created exclusively for each service. That means that the container service can have its own ring, as can the object and account services. Each one of these three rings is present on each of the 15 storage servers. Because of Swift's flexibility property, new servers can be added to the cloud, in order to increase the available storage. Each new server added will contain the three rings. The ring also requires the definition of the number of replicas that will be used to store data. With data replication, if a server is unavailable, another can provide the requested data. Page 4 ISSN Proceedings and report of the 7th UbuntuNet Alliance annual conference, 2014,

5 As illustrated in Figure 2, clients access the cloud using HTTPS. After that, the load balancer will transfer the users requests to an appropriate proxy. The proxy first authenticates the user and then verifies if the request can be fulfilled. If the user has the proper authentication, the proxy communicates with the storage servers to carry out the requests. 4. Validation of the design Figure 2: Architecture of the experimental phase of CNC Currently, there are 10 institutions participating in the experimental phase of the CNC Cloud Project, distributed all over Brazil: the Federal University of Juiz de Fora (UFJF), the Federal University of Santa Maria (UFSM),, the Federal University of Bahia (UFBA),, the Federal University of Cariri (UFCA), the Federal University of Paraná (UFPR), the University Telehealth Community Network (RUTE), the Point of Presence of the RNP network in the states of Pará (PoP-PA) and Santa Catarina (PoP-SC) and the Coordination of Improvement of Higher Education and Personnel of the Federal government (CAPES). Several activities have been carried out by each of these participants, following a methodology that proposed a series of use cases distributed over a 9 month test schedule. Each institution reports test results to the CNC project team on a monthly basis. At the beginning of these tests, the CNC project team guided the first contact of the Institutions users with the CNC Cloud. Test cases were defined to exercise the following activities: Federated authentication Page 5 ISSN Proceedings and report of the 7th UbuntuNet Alliance annual conference, 2014,

6 Object and Directory List Directory creation Object upload Object deletion Web Client usability using the principal browsers Each test was carried out by around 20 users, who did not report any errors at this stage. Then, the CNC project team defined three test cases related to object sharing: Object sharing Directory sharing Temporary link sharing A total of 9 users performed these test cases. They did not report any errors during this second test stage. In addition, three tests related to Encrypted data storage were proposed: Data Storage and encryption Data decryption Sharing an encrypted file 11 users executed these test cases. All the cryptography tests showed errors due the crypto application. This application was blocked by security rules in some browsers. A final set of 3 test cases were defined related to document editing, as follows: Document creation Editing of shared documents Document upload for editing in the cloud We observed that 5 users reported errors in the execution of the tests related to document editing. In general, performance was the main issue reported, as well as the necessity to reopen documents to conclude editing. Others tests have been applied and will be reported by the CNC project team by the end of Once the tests are concluded, we expect good results for the performance and usability of the CNC Cloud. We obtained a 76% overall success rate in carrying out the tests. 5. Conclusion Data storage clouds are tools that are becoming more and more common in the daily lives of teachers and researchers. These users utilize the cloud to store and share data, such as class notes and scientific research results. The CNC Cloud project is being developed as a secure data storage service in the cloud, with a backend based on Openstack Swift, with its entire governance managed by RNP. For this purpose, the CNC Cloud infrastructure has its servers all over RNP s backbone distributed around Brazil with full ownership of those servers. CNC s frontend based on Owncloud seems to have been a good project decision, since the adoption of this technology clearly adds value to the CNC Cloud by its potential to offer a wide variety of (commercial like) functions to web, desktop and mobile clients. The CNC experimental service has demonstrated that it is possible to build up a community cloud with open-source technologies that allows a local control (independent of foreign Page 6 ISSN Proceedings and report of the 7th UbuntuNet Alliance annual conference, 2014,

7 companies) over the main cloud assets, which are the users files. In the near future, RNP will be able to model a new service based on the CNC Cloud project results... References Armbrust, M. et al. (2009). Above the clouds: A Berkeley view of Cloud Computing Technical report. Reliable Adaptive Distributed Systems Laboratory. Berkeley, CA: University of California. Chadwick, D. W. (2009). Federated identity management. Foundations of Security Analysis and Design V, Berlin: Springer pp Foster, I., Zhao, Y., Raicu, I., Lu, S. (2008). Cloud computing and grid computing 360- degree compared. In: Grid Computing Environments Workshop, GCE 08 IEEE. pp Juve, G., Deelman, E., Vahi, K., Mehta, G., et al (2009). Scientific Workflow Applications on Amazon EC2.Workshop on Cloud-based Services and Applications in conjunction with 5th IEEE International Conference on e-science (e-science 2009), Oxford, UK. Khan, R.H., Ylitalo, J., Ahmed, A.S., (2011). OpenID Authentication As A Service in Openstack. 7th International Conference on Information Assurance and Security (IAS, Dezembro de 2011), pp Mahjoub, M., Mdhaffar A., et al (2011). A comparative study of the current Cloud Computing technologies and offers First International Symposium on Network Cloud Computing and Applications. IEEE. p. 131 a 134. OASIS (2005g). Security Assertion Markup Language (SAML) 2.0 Technical Overview.OASIS. Vaquero, L. M., Rodero-Merino, L., Caceres, J., and Lindner, M. (2009) A Break in the Clouds: Towards a Cloud Definition. ACM SIGCOMM Computer Communication Review, 39(1) pp Wangham, M. S., Mello, E. R., Boger, D. S., Guerios, M., & Fraga, J. S.(2010). Gerenciamento de Identidades Federadas. Minicursos do Simposio Brasileiro em Segurança da Informação e de Sistemas Computacionais, pp Biographies Roberto Araujo is the coordinator of SE-CNC. He is a professor at Universidade Federal do Pará (Brazil). He holds a Ph.D. in informatics from Theoretical Computer Science group at TU-Darmstadt (Germany) and a Master's degree in computer science from Universidade Federal de Santa Catarina (Brazil). Computer security is his main research area. His topics of interest include secure voting, secure protocols, cryptography and cloud security. Carlos Eduardo da Silva has received a PhD in Computer Science from the University of Kent at Canterbury (2011). He is an Assistant Professor at the Metropole Digital Institute of the Federal University of Rio Grande do Norte (IMD/UFRN) in Brazil. His main research Page 7 ISSN Proceedings and report of the 7th UbuntuNet Alliance annual conference, 2014,

8 interests are software engineering for self-adaptive software systems; cloud computing, security and identity management. Thomas Filipe is Bachelor in Computer Science from State University of Rio Grande do Norte and Science and Technology with emphasis in Web Development from Federal university of Rio Grande do Norte (UFRN). He s working on his master s degree in the Department of Informatics and Applied Mathematics (DIMAp), Center of Exact and Earth Sciences, UFRN. His main research topics are related to Cloud Computing systems and Access Control with focuses on Identity Federated Management. Tainá Medeiros studied at the University Center of João Pessoa (Brazil) where she graduated in Computer Science. She is a specialist in Information Security at Faculdade Idez (Brazil) and Master in Computer Science at Federal University of Rio Grande do Norte (Brazil). She s working at the Mauricio de Nassau College as a professor and works as a project manager of SE- CNC. Her main research interests are Software Engineering, Information Security, Artificial Intelligence and Digital Games. André Marins is a Research and Development Project Manager and leads RNP s Working Group Programme. Graduated in Computer Engineering at Pontifícia Universidade Católica do Rio de Janeiro PUC-Rio (1996), with MBA in Executive Management at IBMEC Business School (2001). Received his MSc. in Computer Science from PUC-Rio in Leaded high performance teams as IT Manager at Cadê (internet catalog acquired by Yahoo) ( ). Acted as Operation and IT Manager, Business Development Manager and IT Director at Starmedia ( ). As an IT Consultant at Vogal also managed document management projects ( ). Contributed as an IT researcher at TecGraf, PUC-Rio (2007). Michael Stanton is Director of Research and Development at RNP. After a PhD in mathematics at Cambridge University in 1971, he has taught at several universities in Brazil, since 1994 as professor of computer networking at the Universidade Federal Fluminense (UFF) in Niterói, Rio de Janeiro state. Between 1986 and 2003, he helped to kick-start research and education networking in Brazil, including the setting-up and running of both a regional network in Rio de Janeiro state (Rede-Rio) and RNP. He returned to RNP in 2001, with responsibility for R&D and RNP involvement in new networking and large-scale collaboration projects. Page 8 ISSN Proceedings and report of the 7th UbuntuNet Alliance annual conference, 2014,