Developing. and Securing. the Cloud. Bhavani Thuraisingham CRC. Press. Taylor & Francis Group. Taylor & Francis Croup, an Informs business

Transcription

1 Developing and Securing the Cloud Bhavani CRC Press Taylor & Francis Group Boca Raton London New York CRC Press is an imprint of the Taylor & Francis Croup, an Informs business AN AUERBACH BOOK

2 Preface Acknowledgments Author xxvii xxxiii xxxv 1 Introduction About This Book Supporting Technologies From Mainframe to the Cloud Security Technologies Data, Information, and Knowledge Management Secure Services Technologies Secure Services Technologies Secure Semantic Services Specialized Secure Services Cloud Computing Concepts Experimental Cloud Computing Systems Secure Cloud Computing Experimental Secure Cloud Computing Systems Experimental Cloud Computing for Security Applications Toward Trustworthy Clouds Building an Infrastructure, Education Program, and a Research Program for a Secure Cloud Organization of This Book Next Steps 16 Reference 19 PART I SUPPORTING TECHNOLOGIES 2 From Mainframe to the Cloud Overview Early Computing Systems 23 vii

3 viii Contents 2.3 Distributed Computing World Wide Web Cloud Computing Summary and Directions 26 References 27 3 Trustworthy Systems Overview Secure Systems Overview Access Control and Other Security Concepts Types of Secure Systems Secure Operating Systems Secure Database Systems Secure Networks Emerging Impact Trends 35 of the Web Steps to Building Secure Systems Dependable Systems Overview Trust Management Digital Rights Management Privacy Integrity, Data Quality, and High Assurance Security Threats and Solutions Building Secure Systems from Untrusted Components Summary and Directions 46 References 47 4 Data, Information, and Knowledge Management Overview Data Management Data Management Data Model Functions Data Distribution Web Data Management Complex Data Management Multimedia Data Systems Geospatial Data Management Information Management Data Warehousing and Data Mining Information Retrieval Search Engines 57

4 ix 4.4 Knowledge Management Activity Management E-Business and E-Commerce Collaboration and Workflow Information Integration Information Sharing Social Networking Supply Chain Management Summary and Directions 67 References 67 Conclusion to Part 1 69 PART II SECURE SERVICES TECHNOLOGIES 5 Service-Oriented Computing and Security Overview Service-Oriented Computing Services Paradigm SOAs and Web Services SOA and Design SOA and Web Services WS Model Composition ofws WS Protocols Rest Service-Oriented Analysis and Design IBM Service-Oriented Analysis and Design Service-Oriented Modeling Framework UML for Services Secure Service-Oriented Computing Secure Services Paradigm Secure SOA and WS WS-Security WS-*Security Secure SOAD Secure SOMA Secure SOMF Secure UML for Services Access Control for WS Security Assertions Markup Language extensible Access Control Markup Language Digital Identity Management OpenID 105

5 x Contents Shibboleth Liberty Alliance Security Models for WS Delegation Model Information Flow Model Multilevel Secure WS Summary and Directions 112 References Semantic Web Services and Security Overview Semantic Web Layered Technology Stack extensible Markup Language XML Statement and Elements 120 ' XML Attributes XML DTDs XMLSchemas XML Namespaces XML Federations/Distribution XML-QL, XQuery, XPath, XSLT Resource Description Framework RDF Basics RDF Container Model RDF Specification RDFSchemas RDF Axiomatic Semantics RDF Inferencing RDF Query SPARQL Protocol and RDF Query Language Ontologies Web Rules and SWRL Web Rules Semantic Web Rules Language Semantic Web Services Secure Semantic Web Services Security for the Semantic Web XML Security RDF Security Security and Ontologies Secure Query and Rules Processing Privacy and Trust for the Semantic Web Secure Semantic Web and WS 137

6 xi 6.4 Summary and Directions 138 References Specialized Web Services and Security Overview Specialized Web Services Overview Web Services for Data Management Web Services for Complex Data Management Web Services for Information Management Web Services for Knowledge Management Web Services for Activity Management E-Business Collaboration and Workflow Information Integration Other Activities Domain Web Services Defense Healthcare and Life Sciences Finance Telecommunication Emerging Web Services Secure Specialized X as a Service Data as a Service Software as a Service Other X as a Service 155 Web Services Overview Web Services for Secure Data Management Web Services for Secure Complex Data Management Secure Geospatial Data Management Secure Multimedia Data Management Web Services for Secure Information Management Web Services for Secure Knowledge Management Secure Web Services for Activity Management Secure E-Commerce Secure Supply Chain Management Secure Workflow and Collaboration Secure Domain Web Services Defense Healthcare and Lifecycles Finance Other Domains 171

7 xii Contents Emerging Secure Web Services Security for X as a Service Security for Amazon Web Services Secure Web Services for Cloud and Grid Summary and Directions 173 References 174 Conclusion to Part II 177 PART HI CLOUD COMPUTING CONCEPTS 8 Cloud Computing Concepts Overview Preliminaries in Cloud Computing Cloud Deployment Models Service Models Virtualization Cloud Storage and Data Management Summary and Directions 187 References Cloud Computing Functions Overview Cloud Computing Framework Cloud OSs and Hypervisors Cloud Networks Cloud Data and Storage Management Cloud Applications Cloud Policy Management, Back-Up, and Recovery Summary and Directions 196 References Cloud Data Management Overview Relational Data Model Architectural Issues DBMS Functions Overview Query Processing Transaction Management Storage Management Metadata Management Database Integrity Fault Tolerance 212

8 xiii 10.5 Data Mining Other Aspects Summary and Directions 215 References Specialized Clouds, Services, and Applications Overview Specialized Clouds Mobile Clouds Multimedia Clouds Cloud Applications Summary and Directions 221 References Cloud Service Providers, Products, and Frameworks Overview Cloud Service Providers, Products, and Frameworks Cloud Service Providers Windows Azure Google App Engine Cloud Products Oracle Enterprise Manager IBM Smart Cloud Hypervisor Products Cloud Frameworks Hadoop, MapReduce Framework Storm HIVE Summary and Directions 233 References 234 Conclusion to Part III 235 PART IV EXPERIMENTAL CLOUD COMPUTING SYSTEMS 13 Experimental Cloud Query Processing System Overview Our Approach Related Work Architecture Data Generation and Storage File Organization Predicate Split Split Using Explicit-Type Information of Object 247

9 xiv Contents Split Using Implicit-Type Information of Object MapReduce Framework Overview Input Files Selection Cost Estimation for Query Processing Ideal Model Heuristic Model Query Plan Generation Computational Complexity of Bestplan Relaxed Bestplan Problem and Approximate Solution Breaking Ties by Summary Statistics MapReduce Join Execution Results Data Sets, Frameworks, and Experimental Setup Data Sets Baseline Frameworks Experimental Setup Evaluation Summary and Directions 265 References Social on Networking the Cloud Overview Foundational Technologies for SNODSOC and SNODSOC SNOD Location Extraction Entity/Concept Extraction and Integration Linguistic Extensions Extralinguistic Extensions Entity Integration Ontology Construction :2.5 Cloud Query Processing Design Preprocessing Query Execution and Optimization 275 of SNODSOC Overview of the Modules SNODSOC and Trend Analysis Novel Class Detection Storing the Cluster Summary Information Content-Driven Location Extraction Motivation 281

10 xv Challenges: Proposed Approach Using Gazetteer and Natural Language Processing Categorization Ontology Construction Toward SNODSOC Benefits of SNOD Cloud-Based Social Network Analysis Stream Processing Twitter Storm for SNODSOC Related Work Summary and Directions 294 References Experimental Semantic Web-Based Cloud Computing Systems Overview Jena-HBase: A Distributed, Scalable, and Efficient RDF Triple Store StormRider: Harnessing "Storm" for Social Networks Ontology-Driven Query Expansion Using Map/Reduce Framework BET Calculation Using MapReduce Distributed Computing Shortest Path Calculation Using Iterative MapReduce Algorithm Betweenness and Centrality Measures Using Map/Reduce Computation SSMs Using Map/Reduce Algorithm Summary and Directions 307 References 308 Conclusion to Part IV 311 PART V SECURE CLOUD COMPUTING CONCEPTS 16 Secure Cloud Computing Concepts Overview Secure Cloud Computing and Governance Security Architecture Identity Management and Access Control Cloud Identity Administration Cloud Storage and Data Security Privacy, Compliance, and Forensics for the Cloud 323

11 xvi Contents Privacy Regulations and Compliance Cloud Forensics Cryptogaphic Solutions Network Security Business Continuity Planning Operations Management Physical Security Summary and Directions 328 References Secure Cloud Computing Functions Overview Secure Cloud Computing Framework Secure Cloud OSs and Hypervisors Secure-Cloud Networks Secure Cloud Storage Management Secure Cloud Data Management Cloud Security and Integrity Management Secure Cloud Applications Summary and Directions 337 References Secure Cloud Data Management Overview Secure Data Management Access Control Inference Problem Secure Distributed/Heterogeneous Data Management Secure Object Data Systems Data Warehousing, Data Mining, Security, and Privacy Secure Information Management Secure Knowledge Management Impact of the Cloud Discretionary Security Inference Problem Secure Distributed and Heterogeneous Data Management Secure Object Systems Data Warehousing, Data Mining, Security, and Privacy 348

12 xvii Secure Information Management Secure Knowledge Management Summary and Directions 349 References Secure Cloud Computing Guidelines Overview The Guidelines Summary and Directions 356 References Security as a Service Overview Data Mining Services for Cyber Security Applications Overview Cyber Terrorism, Insider Threats, and External Attacks Malicious Intrusions Credit Card Fraud and Identity Theft Attacks on Critical Infrastructures Data Mining Services for Cyber Security Current Research on Security as a Service Other Services for Cyber Security Applications Summary and Directions 367 References Secure Cloud Computing Products Overview Overview of the Products Summary and Directions 373 References 373 Conclusion to Part V 375 PART VI EXPERIMENTAL SECURE CLOUD COMPUTING SYSTEMS 22 Secure Cloud Query Processing with Relational Data Overview Related Work System Architecture The Web Application Layer The ZQL Parser Layer The XACML Policy Layer 384

13 xviii Contents XACML Policy Builder XACML Policy Evaluator The Basic Query Rewriting Layer The Hive Layer HDFS Layer Implementation Details and Results Implementation Setup Experimental Implementation Datasets 386 Results Summary and Directions 388 References Secure Cloud Query Processing with Semantic Web Data Overview Background Related Work Hadoop and MapReduce Access Control Model AT Assignment Final Output of Agent's an ATs Security Level Defaults Conflicts System Architecture Overview of the Architecture Data Generation and Storage Example Data Policy Enforcement Query Rewriting Embedded Enforcement Postprocessing Enforcement Experimental Setup and Results Summary and Directions 404 References Secure Cloud-Based Information Integration Overview Integrating Blackbook with Amazon S Experiments Summary and Directions 414 References 415 Conclusion to Part VI 417

14 xix PART VII EXPERIMENTAL CLOUD SYSTEMS FOR SECURITY APPLICATIONS 25 Cloud-Based Malware Detection for Evolving Data Streams Overview Malware Detection Malware Detection as a Data Stream Classification Problem Cloud Computing for Malware Detection Our Contributions Related Work Design and Implementation of the System Ensemble Construction and Updating Error Reduction Analysis Empirical Error Reduction and Time Complexity Hadoop/MapReduce Framework Malicious Code Detection Overview Nondistributed Feature Extraction and Selection Distributed Feature Extraction and Selection Experiments Data Sets Synthetic Dataset Botnet Dataset Malware Dataset Baseline Methods Hadoop Distributed System Setup Discussion Summary and Directions 439 References Cloud-Based Data Mining for Insider Threat Detection Overview Challenges, Related Work, and Our Approach Data Mining for Insider Threat Detection Our Solution Architecture Feature Extraction and Compact Representation Subspace Clustering RDF Repository Architecture Datastorage File Organization Predicate Split 451

15 Predicate Object Split Answering Queries Using Hadoop MapReduce Data Mining Applications Comprehensive Framework Summary and Directions 455 References 455 Cloud-Centric Assured Information Sharing Overview System Design Design of CAISS Enhanced Policy Engine Enhanced SPARQL Query Processor Integration Framework Design of CAISS ' Limitations of CAISS Design of CAISS Centralized CAISS Decentralized CAISS Hybrid CAISS-H Naming Conventions Vertically Partitioned Layout Hybrid Layout Distributed Processing of SPARQL Framework Integration Policy Specification and Enforcement Formal Policy Analysis Implementation Approach Related Work Our Related Research Secure Data Storage and Retrieval in the Cloud Secure SPARQL Query Processing on the Cloud RDF Policy Engine AIS Prototypes Formal Policy Analysis Overall Related Research Secure Data Storage and Retrieval in the Cloud SPARQL Query Processor RDF-Based Policy Engine Hadoop Storage Architecture 483

16 xxi Distributed Reasoning Access Control and Policy Ontology- Modeling Commercial Developments RDF Processing Engines Semantic Web-Based Security Policy Engines Cloud Summary and Directions 485 References Design and Implementation of a Semantic Cloud-Based Assured Information Sharing System Overview Architecture Overview Framework Configuration Modules in our Architecture User Interface Layer Policy Engines Data Layer Features of our Policy Engine Framework Policy Reciprocity Conditional Policies Policy Symmetry Develop and Scale Policies Justification of Resources Policy Specification and Enforcement Summary and Directions 503 References 503 Conclusion to Part VII 505 PART VIII TOWARD A TRUSTWORTHY CLOUD 29 Trust Management and the Cloud Overview Trust Management Trust Management and Negotiation Trust and Risk Management Reputation-Based Systems Trust and Cloud Services Trust Management as a Cloud Service Trust Management for Cloud Services 516

17 xxii Contents 29.4 Summary and Directions 517 References Privacy and Cloud Services Overview Privacy Management Privacy Issues Privacy Problem through Inference Platform for Privacy Preferences Privacy Preserving Cloud Mining Privacy Management and the Cloud Cloud Services for Privacy Management Privacy for Cloud Services and Semantic Cloud Services Summary and Directions 527 References Integrity Management, Data Provenance, and Cloud Services Overview Integrity, Data Quality, and Provenance Aspects of Integrity Inferencing, Data Quality, and Data Provenance Integrity Management and Cloud Services Cloud Services for Integrity Management Integrity for the Cloud and Semantic Cloud Services Summary and Directions 536 References 537 Conclusion to Part VIII 539 PART IX BUILDING AN INFRASTRUCTURE, AN EDUCATION INITIATIVE, AND A RESEARCH PROGRAM FOR A SECURE CLOUD 32 An Infrastructure for a Secure Cloud Overview Description of the Research Infrastructure Background The Need for Our Infrastructure Hadoop for Cloud Computing Inadequacies of Hadoop Infrastructure Development Hardware Component of the Infrastructure Cluster Part of the Hardware Component 548

18 xxiii Secure Coprocessor Part of the Hardware Component Software Component of the Infrastructure Component Part to Store, Query, and Mine Semantic Web Data Integrating SUN XACML Implementation into HDFS with IRMs Component Part for Strong Authentication Data Component of the Infrastructure Integrating the Cloud with Existing Infrastructures Sample Projects Utilizing the Cloud Infrastructure Education and Performance Education Enhancement Performance Summary and Directions 559 References 559 An Education Program for a Secure Cloud Overview IA Education at UTD Overview of UTD CS Course Offerings in IA Our Educational Programs in IA Equipment and Facilities for IA Education and Research Assured Cloud Computing Education Program Organization of the Capacity-Building Activities Curriculum Development Activities Capstone Course Component Insertion into Existing Courses Course Programming Projects Fine-Grained Access Control for Secure Storage Flexible Authentication Secure Virtual Machine Management Secure Co-Processor for Cloud Scalable Techniques for Malicious Code Detection Instructional Cloud Computing Facility Evaluation Plan Summary and Directions 578 References 579

19 xxiv Contents 34 A Research Initiative for a Secure Cloud Overview Research Contributions Overview Secure Cloud Data and Information Management Data Intensive Secure Query Processing in the Cloud Secure Data Processing in Hybrid Cloud a Secure Information Integration in the Cloud Secure Social Networking in the Cloud Cloud-Based Security Applications Cloud-Based Malware Detection for Evolving Data Streams Cloud-Based Insider Threat Detection 587 Cloud-Based Assured Information Sharing Security Models for the Cloud A Fine-Grained Model for Information Flow Control in Service Cloud CloudMask: Fine-Grained Attribute-Based Access Control Delegated Access Control in the Storage as a Service Model Attribute-Based Group Key Management Scheme Privacy-Preserving Access Control in the Cloud Toward Building Secure Social Networks in the Cloud Secure Social Networking Trustworthiness of Data Text Mining and Analysis Summary and Directions 594 References Summary and Directions About This Chapter Summary of This Book Directions for Cloud Computing and Secure Cloud Computing Secure Services Cloud Computing Secure Cloud Computing Our Goals on Securing the Cloud Where Do We Go from Here? 602

20 xxv Conclusion to Part IX 605 Appendix A: Data Management Systems Developments and Trends 607 Appendix B: Data Mining Techniques 623 Appendix C: Access Control in Database Systems 643 Appendix D: Assured Information Sharing Life Cycle 661 Index 667