Assignment # 1 (Cloud Computing Security)

Transcription

1 Assignment # 1 (Cloud Computing Security) Group Members: Abdullah Abid Zeeshan Qaiser M. Umar Hayat

2 Table of Contents Windows Azure Introduction... 4 Windows Azure Services Compute... 4 a) Virtual Machines... 4 b) Websites... 5 c) Cloud Services Data Management... 5 a) SQL Database... 5 b) Storage Blobs... 5 c) Storage Tables... 5 d) Import/Export... 5 e) File Service Networking... 5 a) Virtual Network... 5 b) Traffic Manager... 5 c) ExpressRoute Developer and IT Services... 6 a) Visual Studio Online... 6 b) Azure SDK... 6 c) Automation... 6 d) API Management Identity and Access... 6 a) Active Directory... 6 b) Multi-factor authentication Mobile... 7 a) Mobile Services... 7 b) Notification Hubs Backup... 7 a) Site Recovery... 7 b) Backup Messaging and Integration... 7 a) Storage Queues & Service Bus Queues... 7

3 b) Service Bus relay... 7 c) Service Bus... 7 d) Biz Talk Hybrid Connections &Biz Talk Services Compute Assistance... 7 a) Scheduler Performance... 8 a) Cache... 8 b) Content Delivery Network (CDN) Big Compute and Big Data... 8 a) HDInsight (Hadoop)... 8 b) High Performance Computing (Big Compute) Media... 8 a) Media Services Commerce... 9 a) Store and Marketplace... 9 Windows Azure Management Portal Overview Creating Virtual machine Accessing Virtual machine Using Remove Desktop Protocol (RDP) Using Secure Shell (SSH) References... 19

4 Windows Azure Introduction Windows Azure is a cloud computing platform developed by Microsoft. It enables the developers to develop their applications, deploy and then manage their hosted applications in a Microsoft datacenters. Azure provides Infrastructure as a Service (Iaas) and Platform as a Service (PaaS). It helps in managing high level components which includes Operating Systems, middleware s and runtimes. Azure uses the concept of virtualization. Applications which are deployed on Azure runs on a single or multiple virtual machines. The behavior of deployed applications is exactly the same as they are on some computer. These can share some physical resources which includes network I/O, disk space, CPU with some other virtual machines. Benefit of virtualization of physical hardware includes portability and scalability. Windows Azure Services There are multiple categories in which services that can be divided 1. Compute Cloud platform helps in executing applications. This includes a) Virtual Machines It allows controlling own virtual machine. It also allows running own operating system on this virtual machine. Azure provide a number for Operating system for new VM. New virtual machine for different Windows and Linux flavor can be created from Azure s management portal. It also allow to create VM with pre-installed software.

5 b) Websites It offers variety of frameworks and web applications templates helping in building huge scale web applications. It also offers the management of web application, application tests and application evaluation. c) Cloud Services It provides Platform as a Service (PAAS) which helps in creating scalable applications. It provides more flexibility than websites. 2. Data Management Different data types are required for different type of applications,and azure provides several ways to store and manage data and in every case 3 copies of data are saved in sync across all storages. a) SQL Database For relational storage, Azure provides the feature of SQL database but this SQL database differs from typical SQL database. It is not just a DBMS in the cloud it s a PaaS service. b) Storage Blobs These are storages for unstructured binary data, a single blob can be as large as 1TB it can be linked with virtual machines and other compute applications in Azure c) Storage Tables It s an example of NoSQL approach called a key value store. It let applications store properties by providing unique key for that group d) Import/Export In this case of large data movement a person can send a SATA hard drive to Microsoft and there Microsoft copy all data in blobs and send back the hard drive. e) File Service Azure is giving the service to save and share files using cloud facility like this facility is available in our organizations Network 3. Networking There are many datacenters on which azure is being running worldwide. We can select multiple datacenters to run applications or to store data. We can connect to data centers using the services listed below. a) Virtual Network To have a feeling of having remote VM on Azure cloud in your own data center is by having getting VPN services for communication between VM on cloud and organizations Data center b) Traffic Manager Using this service if any organization have a service running on azure cloud on different data centers or even organization own datacenter that have internet access users can be managed according to traffic on a particular data center

6 c) ExpressRoute In this case azure and organization data center have a dedicated connection that does not uses the public internet 4. Developer and IT Services It provides huge amount of tools which helps the developers in creating and maintaining the applications in cloud. These includes a) Visual Studio Online It offers number of services which helps developers to develop applications in Microsoft Azure. Working on cloud doesn t means that we don t need software at local machine but it requires visual studio to be installed at user machine. It provides additional tools which are helpful to the developer. b) Azure SDK Microsoft is provides SDK s including.net, Java, PHP, Node.js, Ruby and Python. Azure SDK provides basic support to any language like C++ to create Azure applications. c) Automation Azure Automation helps in creating, managing, monitoring and deploying resources in Azure environment. Azure automation runs Runbook. Runbook executes without the user interaction. PowerShell allows script s state to be saved at checkpoints and if failure occurs, it restart the last checkpoint automatically rather than restarting it from the beginning. This helps the scripts to handle every possible error. d) API Management Azure API management helps organizations in making and publishing API to third party developers, employees and partners. It provides services like caching, transformation, analytic aggregation and access control. 5. Identity and Access Azure provides identity services to check and track identity and also integrates with identity stores which may already being used. a) Active Directory As active directory stores information about the users so helps them to log- in and supplies a token which is presented to applications which helps them to prove their identity. Azure active directory do the same. It also allows provide synchronization functionality with windows Server Active Directory running in the local network but face a small constraint that the formats used by Azure Active Directory and Windows Server Active Directory are not identical. b) Multi-factor authentication Multifactor authentication helps to ensure that the user itself would be giving an access to accounts. For this a user is required to verify their identity using text message, phone call with a combination of password. Azure active directory only provides authentication method for user logins. One can use multifactor authentication with azure active directory with custom applications using multifactor authentication SDK.

7 6. Mobile Azure helps in mobile application development as it stores the data in cloud. It authenticates users and sends notification without writing a huge code. a) Mobile Services Azure Mobile service allows provisioning and data stored in databases. Developer can use additional data storage options like MongoDB and blob. Mobile services provide support for notifications. It also provide authentication services as it authenticate users through Microsoft and other identity providers like Google, Facebook. b) Notification Hubs Azure notification hubs are designed to work and compatible with any backend. It is optimized to broadcast huge amount of notifications consuming small time almost within minutes. It can target single or million users with one API call. 7. Backup Each organization need to back up their data for the usage in the worst scenarios when organization may have lost their data in any incident a) Site Recovery Azure also gives the service of making secondary site as a backup of any service or a website on the cloud so that there is no need to do expense and managing the secondary site b) Backup Microsoft azure provide the service of backing up data of Windows server running in any data center of an organization. It is kept encrypted for security purposes. 8. Messaging and Integration There is always a need when different apps need a communication or interaction. Azure provides a few different ways to solve the problem a) Storage Queues&Service Bus Queues In the azure provides the Queues for different apps to save data on the queue so that other app may use that data later b) Service Bus relay This service allows two applications on 2 different sides of the firewall to communicate through azure relay service c) Service Bus This azure service allows applications to post messages while other application are allowed to receive that messages after meeting a specific criteria d) Biz Talk Hybrid Connections &Biz Talk Services This service provides the ability to transforms XML messages formats 9. Compute Assistance Assistance for the programs that are running on the cloud

8 a) Scheduler Some applications that are deployed on cloud are not needed to run regularly 24/7 but only in specific time frames that can be scheduled using azure services 10. Performance For the services which need heavy computing on data, the access time of data is very important for them. The other scenario is that if an application is access a data from secondary storage, for example some mapping tables etc. For such scenario data should be closer to the computing application. Azure provide different services for these kind of scenario, which are following: a) Cache Along with the other data management services (SQL database, Tables, blobs etc.) Azure provide the caching services as well. Application can store the data in cache for fast retrieval instead of persisting the data in the storage. b) Content Delivery Network (CDN) If a data will be accessed around the world, then it s better to geo-replicate the data. CDN is different than the backup services which are managed by IaaS. CDN provide the functionality to store the mirrors for a blob (a stored data) in the multiple datacenters around the world so the on request, data can be transferred to user faster. 11. Big Compute and Big Data Due to the availability of a large computational resource on cloud,cloud infrastructure is used for the high performance computing. To facilitate such job, Azure provide following services: a) HDInsight (Hadoop) Hadoop is an open source project for distributed file system. For computation where you need a large size data (that might not be even handle properly by a relational data base), Distributed file system are used in such scenarios. Microsoft Azure provide Apache Hadoop with the name HDInsight. It store the data in form of clusters and distributes the data on multiple VMs that are being used for MapReduce job (MapReduce are specialized program for distributed computing on BigData). b) High Performance Computing (Big Compute) The purpose of the Big Compute is to execute a specific code on multiple machines at once. In cloud environment we run multiple VM machine, schedule the work on different machines and distribute the required resource among them. Azure provide the VM machine with wide variety of configurations (CPU cores, storage, and memory) to meet the requirements of Big Compute. It also provide the configurations to take advantage of low-latency network and remote direct memory access (RDMA) for parallel computing applications. 12. Media A large portion of the internet traffic are the Media contents (Audio/Video contents). Different business deliver such content to client around the word. To facilitate such customer Azure provide following service:

9 a) Media Services A number of functions are performed on media content which include creation for multi-resolution videos generation, encoding, ads embedding while streaming the videos to customer, and distribution of the media content around the world. Azure provide the service to avail all of the above functionalities. 13. Commerce a) Store and Marketplace Market is a place where you can buy different cloud based services. From Azure Marketplace you can buy two kind of service. Applications Data Application: These are the Software as a Service (SaaS) application developed on Windows Azure and available for ready to use. It is same as Google Play and IOS store, where they provided a single trusted source to buy and sell products. Data: Different companies provide dataset using Marketplace. Wide variety of datasets are available. Commercial dataset include statistical survey, financial data, demographics data and geographical datasets. User can search and use the dataset using this service.

10 Windows Azure Management Portal Overview Windows Azure is a Microsoft cloud operating system. Which provide different services. User can utilized and manage these services through a web portal ( Graphical division: Services Title Bar Task Bar

11 Creating Virtual machine From left of the task bar, click on New Button Figure 1 A new pane will be visible in the bottom of the page. There are two option to create a new VM o Quick Create o From Gallery In this session we will be creating VM with Quick Create option. Figure 2

12 Click on, following form will be visible Figure 3 Fill in the DNS Name field ( this will should be a unique name ), Image ( which is the operating system and version ), Size ( where you can choose computing power and memory ), User Name, Password and Region Figure 4 After filling all field click on

13 On click the create button, Creation status can be seen by click Notification button from the task bar. Figure 5 Wait until the status of the VM changes from Starting (Provisioning) to Running Figure 6 When the VM status will change to Running, New option will be visible in the task bar Figure 7 If you click name of the VM instance, Get started page will be visible

14 Figure 8

15 Accessing Virtual machine In the following section we will describe how the virtual machine running on the cloud can be access from a remote location. Mostly commonly used method is Remote Desktop on for Windows operation system and for Linux base operation system Secure Shell (SSH) is used. Although both can be use,only limitation is the operation system in the virtual machine support that protocol. For windows supports RDP by default while on Linux default protocol for remote access is SSH (although user can install the RDP services on Linux box and access through RDP client later). Azure portal provide this access as End Points. User can create any number of end points from the portal. Using Remove Desktop Protocol (RDP) Open windows Remote Desktop client Enter the host name and port Enter the user name Figure 9 Press connect button

16 Provide the credential and press ok On successful authentication and RDP session establishment, following screen will be visible in RDP client Figure 10

17 Using Secure Shell (SSH) Download any SSH client. We used PuTTy that can be download from the following link Launch the PuTTY application 1 2 Figure 11 Get the End Point IP address of the VM Paste in it in the Host Name (or IP address) Press Ok Button Provide credential in the following screen Figure 12

18 Your SSH session will be started Figure 13 You can use terminal command in the SSH client Figure 14

19 References 1. Microsoft Azure, 2. Azure Management portal, 3. Azure preview portal, 4. Introducing Microsoft Azure,