Cloud Trends & Security Challenges

Transcription

1 .org Cloud Trends & Security Challenges Chunming Rong Chair (CloudCom) Director (CIPSI) Professor (UiS)

2 Computing in Clouds What How Go!

3 Anywhere, Anytime 3

4 Hype Cycle for Emerging Technologies, 2010 Source: Gartner (August 2010) 4

5 Using it already 5

6 Virtualized Computing Resource International standards IEEE Mobile BWA IEEE BWA IEEE802.16a WMAN IEEE WLAN WAN BAN MAN LAN 3G ETSI HiperAccess ETSI HiperMAN ETSI HiperLAN ERP LAN Ethernet IEEE Bluetooth PAN Opr Workstation ETSI HiperPAN Backbone Network Backbone Fibre Radiolink Satellite Ethernet LAN Ethernet LAN MAN MAN WiMax PAN Wireless sensornetwork Floater 6

7 Scalable Computing Resource 7

8 8

9 Origin of the term Cloud Computing Comes from the early days of the Internet where we drew the network as a cloud we didn t care where the messages went the cloud hid it from us Kevin Marks, Google v cloud 1.0 networking: TCP/IP abstracuon v cloud 2.0 documents: WWW data abstracuon v The emerging cloud 3.0 abstracts infrastructure complexiues of servers, applicauons, data, and heterogeneous playorms ( muck as Amazon s CEO Jeff Bezos calls it) 9

10 Connected Cloud 10

11 Definition by NIST (v16) Cloud compuung is a model for enabling convenient, on- demand network access to a shared pool of configurable compuung resources (e.g., networks, servers, storage, applicauons, and services) that can be rapidly provisioned and released with minimal management effort or service provider interacuon. 11

12 The NIST Cloud Definition Framework Hybrid Clouds Deployment Models Private Cloud Community Cloud Public Cloud Service Models Sodware as a Service (SaaS) PlaYorm as a Service (PaaS) Infrastructure as a Service (IaaS) EssenUal CharacterisUcs On Demand Self- Service Broad Network Access Rapid ElasUcity Resource Pooling Measured Service Common CharacterisUcs Massive Scale Homogeneity VirtualizaUon Low Cost Sodware Resilient CompuUng Geographic DistribuUon Service OrientaUon Advanced Security 12

13 Alternative Descriptions Massive, abstracted (virtualized) infrastructure Components decided for you Dynamic provisioning, scaling, locauon Resource on- demand Pay per use No long- term commitments OS, applicauon architecture independent No hardware or sodware to install 13

14 14

15 15

16 Cloud Computing Services Cloud CompuNng Services Enterprise Cloud Private Cloud Web Hosting Cloud Consumer Large Scale Cloud Cloud Computing Management Services Virtualized Resources Management Self-service Portal Workload Management VM template Templates Provisioning Administration Workflows Monitoring SLA, Billing, Metering, Capacity Planning Virtualized Physical Servers Physical Servers 16

17 Cloud: Evolution of Hosting Source Forrester 17

18 18

19 Infrastructure as a Service (IaaS) 19

20 Platform as a Service (PaaS) 20

21 21

22 22

23 Software as a Service (SaaS) 23

24 Data as a Service 24

25 Cloud causes a Radical Shift in IT Virtual ApplicaUon Virtual Middleware Virtual Servers InformaUon Services ApplicaUon as a Service PlaYorm as a Service Infrastructure as a Service Business Services Cloud Enabler Mngt. & Security 25

26 Cloud vs Grid Cloud = Grid + ElasUcity? dynamically created services in grid E.g. WSRF: Web Services Resource Framework Data Intensive compuung Focus on data amount, not speed Easy to use and to develop applicauon By common users (no expert requirement) 26

27 Openness Shareability and Freedom Open sodware Open services Open data 27

28 Developments in Information Technology ü ü ü ü Moore s law doubling of compunng and storing capacity every 18 months 1.2 billion users on Internet increase of 30 millions per month SemanNc Web Web Services Ontologies The new IT waves AutomaNon Data everywhere (wireless) Cyber communines Cloud compunng CompuNng and storing capacity

29 Oceans of Data, Skinny Pipes 1 Terabyte Easy to store Hard to move Disks! MB / s! Time! Seagate Barracuda! 115! 2.3 hours! Seagate Cheetah! 125! 2.2 hours! Networks! MB / s! Time! Home Internet! < 0.625! > 18.5 days! Gigabit Ethernet! < 125! > 2.2 hours! 29

30 Map-Reduce Programming Paradigm US Patent 7,650,331: "System and method for efficient large- scale data processing. FuncUonal- style code automaucally parallelized and scheduled in a distributed system. Map/Reduce" Map" Reduce" Map" Reduce" Map" Reduce" Map" Reduce" 30

31 Open- source Java MapReduce for reliable, scalable, distributed compuung. Moving ComputaNon is Cheaper than Moving Data Subprojects: Hadoop Common: The common uuliues that support the other Hadoop subprojects. Avro: A data serializauon system that provides dynamic integrauon with scripung languages. Chukwa: A data collecuon system for managing large distributed systems. HBase: A scalable, distributed database that supports structured data storage for large tables. HDFS: A distributed file system that provides high throughput access to applicauon data. Hive: A data warehouse infrastructure that provides data summarizauon and ad hoc querying. MapReduce: framework for distributed processing of large data sets on compute clusters. Pig: A high- level data- flow language and execuuon framework for parallel computauon. ZooKeeper: A high- performance coordinauon service for distributed applicauons. 31

32 32

33 33

34 34

35 35

36 36

37 Desiderata for Data Intensive Systems Focus on Data Terabytes, not tera- FLOPS Problem- Centric Programming PlaYorm- independent expression of data parallelism InteracUve Access From simple queries to massive computauons Robust Fault Tolerance Component failures are handled as rouune events Contrast to exis1ng High Performance Compu1ng (HPC) systems 37

38 System Comparison: Data ConvenUonal High Performance CompuUng Data Intensive CompuUng System System Data stored in separate repository No support for collecuon or management Brought into system for computauon Time consuming Limits interacuvity System collects and maintains data Shared, acuve data set ComputaUon collocated with storage Faster access 38

39 System Comparison: Programming Models ConvenUonal High Performance CompuUng Data Intensive CompuUng ApplicaUon Programs ApplicaUon Programs Sodware Packages Machine- Dependent Programming Model Machine- Independent Programming Model RunUme System Hardware Hardware Programs described at very low level Specify detailed control of processing & communicauons Rely on small number of sodware packages Wriuen by specialists Limits classes of problems & soluuon methods ApplicaUon programs wriuen in terms of high- level operauons on data RunUme system controls scheduling, load balancing, 39

40 Wikipedia Page Views Monitoring 40

41 trendingtopics.org 41

42 42

43 43

44 44

45 45

46 User Centric Cloud Resource available in the Cloud Without (dependent on / concern about) a physical server to a physical locauon Service follows you & your devices Accessible anywhere Sharing with others maps messages news calendar VoIP contacts mulumedia storage 46

47 Requirements by Today s Users Accessibility Access from anywhere and from muluple devices Shareability Make sharing as easy as creaung and saving Freedom Users don t want their data held hostage Simplicity Easy- to- learn, easy- to- use Security Trust that data will not be lost or seen by unwanted parues 47

48 Sharing Data among Clouds 48

49 New Security Issues (Oden) unknown resource locauon MulU- tenancy: protect against other users Virtual Machine image security Maliciously modified images (or apps) Over- allocauon of dynamic resources IntenUonal scheduling DoS auack (with stolen account) UnintenUonal runaway jobs 49

50 Questions from Users Where is my informauon? Who controls it? How to proof my data ownership? Who has access? Who is it being shared with? How to protect my privacy? How is being used? Who is looking out for my interests? How to assure the informauon is authenuc? 50

51 Legal Issues Applicable Law and competent jurisdicuon Data leakage protecnon Data Privacy DirecUve 95/46/EC on protecuon of individuals w.r.t. processing and free movement of personal data InformaUon authenucity Intellectual property Law enforcement local authority access to data and info Liability of the stakeholders SubcontracUng Interoperability Free- movement vs. vendor lock- in 51

52 Transfer of data outside the EEA? DirecUve prohibits transfers of personal data to countries which do not ensure an adequate level of protecuon; unless: Data Subject s Consent Not convenient Safe Harbor Principles Only to US Model Contracts Binding Corporate Rules Only Point to Point transfer Within same Co. enuues (Ref. Ar1cles 25-26) 52

53 SDOs IEEE Cloud CompuUng Standard Study Group (IEEE CCSSG) InternaUonal Standard OrganizaUon (ISO) Cloud Security Alliance (CSA) Open Grid Forum (OGF) InternaUonal TelecommunicaUons Union (ITU) ITU Cloud CompuUng Focus group Distributed Management Task Force (DMTF) Storage Networking Industry AssociaUon (SNIA) Open Cloud ConsorUum (OCC) OrganizaUon for the Advancement of Structured InformaUon Standards (OASIS) Internet Engineering Task Force (IETF) European TelecommunicaUons Standards InsUtute (ETSI) Object Management Group (OMG) 53

54 Cross-SDOs Cloud Standards Standards are needed across different Standard- Developing OrganizaUons (SDOs) in order to achieve interoperability among clouds Network architecture Data format Metering and billing Quality of Services (QoS) Provisioning Security, Privacy, IdenUty 54

55 Possible Cloud Standards Federated security across clouds Federated cloud storage Cloud Data Leakage PrevenUon (DLP) Data Interoperability across clouds Cloud monitoring and management standards Cloud development and deployment standards ApplicaUon portability across different IaaSs 55

56 59

57 Cloud Storage Pros. Extreme capacity of storage On- demand service provision ElasUcity of Scale Pay per use Ubiquitous availability Reliability 60

58 Cloud Storage Cons. (current issues) Users have no control over Cloud services, cloud playorms, cloud infrastructure The Trust Issue Storing data on a cloud is like keeping your money in a stranger s pocket How do you prevent illegal sharing Server malicious access 61

59 Data Leakage Prevention (DLP) Data Display Data Storage Data in Transit 62

60 Data Storage with untrusted Provider 63

61 64

62 A Cloud DLP Solution A A A B Publisher Cloud Storage C B B C C 65

63 Q&A 66

64 68