A Survey on Security Issues in Cloud Services

Transcription

1 A Survey on Security Issues in Cloud Services Ms. Menaka.C 1,R.S Ponmagal 2 1 Reasearch Scholar, Bharathiyar University,Department of Computer Science St. Claret College,Jalahalli, Bangalore, Karnataka 2 Professor, Department of Computer Science & Engineering, Dr.M.G.R.Educational & Research Institute University,Chennai, Tamilnadu menu_mca_03@yahoo.co.in, rsponmagal@gmail.com Abstract:-The day to day developments in the information technology enables people to lead a comfortable life. Cloud computing is one of the latest developments in the IT industry also known as ondemand computing. Cloud offers scalability, reliability, high performance and relatively low cost feasible solution. It is the application provided in the form of service over the Internet and system hardware in the data centers that gives these services. Having many advantages for IT organizations cloud has some issues that must be considered during its deployment. The main concern is security, privacy and trust. Data that was once housed under the security domain of the service user has been placed under the protection of the service provider. Users will lose control over the protection of their data. No longer had the data kept under owner. It is argued that hiding of data is not enough when seeking to protect data. The control of how one's data is used and the trust afforded to service providers is important. This paper, attempts to combine the various security threats and to demonstrate how cloud and virtualization vulnerabilities affect the different cloud service models. Community Cloud is the one which is shared by two or more organizations. A Hybrid Cloud is the one that contains two or more private, public or community clouds. Although cloud has many pros, the most cons are security, privacy and trust. Although cloud has many pros, the most cons are security, privacy and trust. The overall framework of cloud computing is shown in (fig.1). This paper includes the discussion about cloud service models and threats with their types. Keywords Cloud, Reliability, Service, Security, Trust, Virtualization. I. Introduction In the present day scenario Cloud computing is seen as a trend with almost all the organizations trying to make on entry into it. The main pros of cloud computing are cost saving, high availability and easy scalability. It provides an application in the form of service over the internet and system hardware in the data centres that gives these services. A Public Cloud is the one which is available for use by the general public. A Private Cloud is the one which is owned by a specific entity and normally used only by that entity or one of its customers. A Fig.1 Overall framework of cloud computing II.Cloud Service Models The cloud service model can be explained by (fig.2 & fig.3) Page No: 43

2 Menaka.C,Ponmagal. R.S The Iaas provide a data centre called Virtual data centre within the cloud. Within Iaas developers can install their own operating system, database management software, and support software. Both the hardware and software can be managed by the developers. Amazon EC2 is a well-known Iaas solution provider. D. Identification as a Service (IDaaS) Fig.2 Cloud Service Models Over past few years, companies have begun to emerge to provide identity (or identification) as a service, or cloud based ID management. A. Software as a Service (SaaS) The SaaS model provides a cloudbased foundation for software on demand. It is web-delivered content that users access through web browser. Simplicity of Integration, cost and scalability are the advantages of SaaS solutions. The security is the major disadvantage of SaaS solutions. Wellknown SaaS solution providers are salesforce.com, Google Apps, Turbo Tax, and QuickBooks. B. Platform as a service (PaaS) The PaaS provides a platform to the customers for their applications to run. It provides a hardware technology, like one or more servers, Operating systems, database solutions, developer tools, and network support, for developers to run their own solutions. It gives a platform called Application Programming Interface (API), therefore customers can run their own applications without administration skills. Well-known PaaS solution providers include Windows Azure and Google App Engine. C. Infrastructure as a Service(Iaas) Fig.3 Cloud Service Models III. Cloud-Based Data Storage The advantages of data storage in the cloud are scalability, pay for use, reliability, ease of access and ease of use. At the same time it should also be ensured that the performance, security threats and data orphans are avoided in the cloud. IV. Virtualization Virtualization means creation of virtual machine. This concept is not new, it is similar to multiprogramming- virtual memory, CPU sharing. More than 30 years ago, IBM had a virtual operating system that allowed a mainframe Page No: 44

3 computer to run many copies of the one or different operating systems. Common forms in virtualization are Server Virtualization, Desktop Virtualization, Virtual Networks and Virtual Storage. A. The Necessity of Virtualization in Cloud It increases utilization of devices. It decreases power consumption. It simplifies operating systems and application administration. It is easy for software provisioning and patches releases. Scalability of device and storage. It increases user access to key resources. It increases flexibility. overwriting the previous file space with a series of values. C..DDoS Attacks A Distributed Denial-of-Sevice Attack (DDoS) is a site hacker attack. The goal of DDoS is to consume system resources so that such resources cannot be used by the site s users. This attack uses multiple computers distributed across the internet to attack a target site. This will be shown in (fig.4) V. Security Issues in Cloud There are number of security issues for cloud computing as it includes many technologies like: A. Virtualization Although Virtualization is one of the main components of a cloud, virtual machines are dynamic in nature so that it is difficult to maintain security consistency. It is easy to generate vulnerabilities and configuration errors. The main issue in virtual machine is to keep maintaining the security state for a given time. B. Data Storage Wiping When a cloud-based data storage provider shares the storage device across multiple customers, it is possible for a customer to access another customer s previously deleted confidential document. To prevent such misuse of data access, many cloud-based data storage facilities will wipe a file s contents upon deletion. Data wiping is used when a cloud-based storage device overwrites (wipes) a file s contents when a file is deleted. It involves by D. Packet Sniffing Fig. 4 DDoS Attack Over the internet and cloud, applications communication is by exchange of data packets. A hacker can write code called packet sniffers which allow them to view, and in some cases change, a packet s contents. The best defence against a packet sniffing attack is to use secure (encrypted) connections. This is explained in (fig.5). Fig. 5 Packet Sniffing E. Man-in-the-Middle Attack A man-in-the-middle attack can be defined as a form of eavesdropping in Page No: 45

4 Menaka.C,Ponmagal. R.S which the attacker is able to read, insert and modify messages between the users in the remote system, without either party becoming aware that the link between them has been compromised. MITM attack is also known as monkey-in-themiddle attack or fire brigade attack. The best solution is to establish a secure (encrypted) connection with the remote server. F. Monitoring Device Screens. Few years ago, when employees access confidential data within their office, the physical data were protected from prying office. However cloud extends the delivery of such data to users at any place, at any time, and to any device. The best defence against screen monitoring is user training. G. Malicious Employees In cloud, companies move sensitive data away from own employees. However, the data are accessible to a staff of IT personnel that the company may not know. The cloud based solution providers are intensifying their recruitment and hiring process to overcome these concerns. H. Hypervisor Attack When a server is virtualized in the cloud, each server operating system runs on top of special virtualization software called the hypervisor. In the terms of hackers, the process of taking over the hypervisor is called hyper jacking attack. The best defence against this attack is by assigning state value like cyclic redundancy check (CRC) to the hypervisor. I. Guest-Hopping Attack The operating systems that execute in a virtualized server are called guest operating systems. A guest-hopping attack takes place when a hacker tries to attack one guest operating system from another. J. SQL-Injection Attack This attack occurs when a malicious user inserts one or more SQL queries within one or more of the fields. The developers prompt users to be aware of and test for such injections while they enter the data within forms. VI. Conclusion The past few years cloud computing has grown from being a promising business idea to one of the fastest growing parts of IT. There are various issues that need to be dealt with respect to security and privacy in a cloud computing. In other hand they are also risk of attacks like powerful DDoS. Cloud service provider should protect themselves from this type of attacks. In this paper various security issues in cloud computing and suitable solutions at the primary level are discussed. It is proposed to delve deep into any one threat in the cloud and model appropriate solution, which improves the performance in the cloud environment. Page No: 46

5 K.K. Ramkrishnan, Jacobus Van der Merwe, The Case for Enterprise-Ready Virtual Private Clouds, HotCloud'09 Proceedings of the 2009 conference on Hot topics in cloud computing, San Diego, CA, USA, ers/wood.pdf ACKNOWLEDGMENT This work was supported by my research guide Ms.R.S.Ponmagal and is contributed of our own work. I thank her for our development in research work. REFERENCES [1] Peter Mell, Timothy Grance, The NIST Definition of Cloud Computing, Jan, [2] L. Wang, Gregor Laszewski, Marcel Kunze, Jie Tao, Cloud Computing: A Perspective Study, New Generation Computing- Advances of Distributed Information Processing, pp , vol. 28, no. 2, 2008.DOI: /s [3] Harold C. Lin, Shivnath Babu, Jeffrey S. Chase, Sujay S. Parekh, Automated Control in Cloud Computing: Opportunities and Challenges, Proc. of the 1 st Workshop on Automated control for data centres and clouds, New York, NY, USA, pp , 2009, ISBN: [4] R. Maggiani, Communication Consultant, Solari Communication, Cloud Computing is Changing How we Communicate, 2009 IEEE International Professional Conference, IPCC, pp. 1-4, Waikiki, HI, USA, July 19-22, ISBN: [5] B.P. Rimal, Choi Eunmi, I. Lumb, A Taxonomy andsurvey of Cloud Computing Systems, Intl. Joint Conference on INC, IMS and IDC, 2009, pp , Seoul, Aug, 2009.DOI: /NCM [10] S. Bhardwaj, L. Jain, and S. Jain, Cloud computing:a study of infrastructure as a service (IAAS),International Journal of engineering and informationtechnology, 2(1):60 63, [11] Seny Kamara, Kristin Lauter, Cryptographic cloud storage, Lecture Notes in Computer Science, Financial Cryptography and Data Security, pp , vol. 6054, DOI: / _13 [12] R. L. Grossman, The Case for Cloud Computing, ITProfessional, vol. 11(2), pp , Mar-April, 2009, ISSN: , INSPEC Accession Number: , DOI: /MITP [13] Shuai Zhang, Shufen Zhang, Xuebin Chen, Xiuzhen Huo, Cloud Computing Research and Development Trend, Intl. Conference on Future Networks, pp , China, DOI: /ICFN [14] Lizhe Wang, Jie Tao, Kunze M., Castellanos A.C., Kramer D., Karl W., Scientific Cloud Computing: Early Definition and Experience, 10th IEEE Int. Conference on High Performance Computing and Communications, pp , Dalian, China, Sep. 2008, ISBN: [15] Hoang T. Dinh, Chonho Lee, Dusit Niyato, Ping Wang, A Survey of Mobile Cloud Computing: Architecture, Applications and Approaches, Wireless Communications and Mobile Computing, Wiley Journals, Oct 11, DOI: /wcm.1203 ***** IJCI 2K ***** [6] Gaoyun Chen, Jun Lu and Jian Huang, Zexu Wu, SaaAS - The Mobile Agent based Service for Cloud Computing in Internet Environment, Sixth International Conference on Natural Computation, ICNC 2010, pp , IEEE, Yantai, Shandong, China, ISBN: [7] Meiko Jensen, Jorg Schwenk, Nils Gruschka, Luigi o Iacon, On technical Security Issues in Cloud Computing, Proc. of IEEE International Conference on Cloud Computing (CLOUD-II, 2009), pp , India, [8] Sangeeta Sen, Rituparna Chaki, Handling Write Lock Assignment in Cloud Computing Environment, Communications in Computer and Information Science, vol. 245, issue. 7, pp , DOI: / _27 [9] Timothy Wood, Prashant Shenoy, Alexandre Gerber, Page No: 47