Secure Cloud Computing: KEVIN JACKSON

Transcription

1 Secure Cloud Computing: An Architecture t Ontology Approach KEVIN JACKSON

2 Forces Driving Cloud Computing The New IT Era rev date 4/15/2009 slide 2

3 Cloud Computing Value rev date 4/15/2009 slide 3

4 Cloud Computing Challenge rev date 4/15/2009 slide 4

5 Unified Ontology of Cloud Computing ( Cloud Application (SaaS) Cloud Software Environment (PaaS) Cloud Software Infrastructure Computational Storage Communications Resources (IaaS) (DaaS) (CaaS) Software Kernal Firmware / Hardware (HaaS) Lamia Youseff University of California, Santa Barbara Maria Butrico, Dilma Da Silva IBM T.J. Watson Research Center

6 Tactical Employment Issues Internet t connectivity it assumed SOA platform Security management Application service discovery and management Workflow orchestration Access management

7 Ontology Modifications for Tactical Cloud Computing Access Cloud Management Application (SaaS) Cloud Cloud Application Application (SaaS) Workflow Workflow Orchestration (SaaS) Orchestration Policy Engine Cloud Security Software API Environment Security API Services Cloud / Services Software (PaaS) Discovery Services / Services Discovery Environment Service Management (PaaS) Service Management Cloud Software Cloud Infrastructure Software Environment Cloud Software Cloud Infrastructure Software (PaaS) Environment Cloud Software Infrastructure (PaaS) Storage Communications Cloud Network Software Security Infrastructure t Storage (DaaS) Communications (CaaS) Network (DaaS) Connectivity (CaaS) Computational Network Storage Security Computational Storage Communications Resources Computational (IaaS) Resources (IaaS) Communications Computational Resources (IaaS) Storage (DaaS) (CaaS) Software Kernal Communications (CaaS) (IaaS) (DaaS) Software Kernal Software Software Kernal Kernal ) Firmware Hardware (HaaS) Firmware / Hardware (HaaS)

8 Tactical Cloud Computing Ontology Computational Resources (IaaS) Access Management Cloud Application (SaaS) Workflow Orchestration Policy Engine Security API Services / Services Discovery Service Management Cloud Software Environment (PaaS) Cloud Software Infrastructure Network Connectivity Storage (DaaS) Software Kernal Firmware / Hardware (HaaS) Communications (CaaS)

9 Ontology Modification Federated SOA Global l Governance Dynamic Tasking Access Management Cloud Application i (SaaS) S) Workflow Orchestration Policy Engine Security API Services / Services Discovery Service Management Cloud Software Environment (PaaS) Access Management Cloud Application i (SaaS) S) Workflow Orchestration Policy Engine Security API Services / Services Discovery Service Management Cloud Software Environment (PaaS) Cloud Software Infrastructure Cloud Software Infrastructure Network Connectivity Network Connectivity Computational Resources (IaaS) Storage (DaaS) Communications (CaaS) Computational Resources (IaaS) Storage (DaaS) Communications (CaaS) Software Kernal Software Kernal Firmware / Hardware (HaaS) Firmware / Hardware (HaaS)

10 Secure Cloud Computing An Approach Access Management Out of Band authentication Access Management Cloud Application (SaaS) Security API y g Use of services Binding of service Services / Services Discovery COI driven Service Management management No VPN Data aain Motion o security Computational Resources VM management Data-centric security model Storage Data at Rest security COI driven access Computational Resources (IaaS) Workflow Orchestration Policy Engine Security API Cloud dsoftware Environment (PaaS) Cloud Software Infrastructure Network Connectivity Storage (DaaS) Software Kernal Firmware / Hardware (HaaS) Communications (CaaS)

11 SecureParser Document -mail E Database Video Map Imagery Cryptographically splits data Creates physically separate fault tolerant Shares CDIP & COI Framework AES Encryption Random Bit Split M of N Fault Tolerance Share Authentication High-efficiency cryptographic module: Provably-secure Computational Secret Sharing Cryptographic Data Splitting Data Integrity Protection Modules can be change out, e.g. AES could be changed with a TYPE I encryption as requirement called for Physically Separate Shares Written to Storage Data at Rest Written to Networks Data in Motion Created at any IO Point in the system User Definable Number of Shares Fault Tolerance Key Management

12 Independent Testing and Evaluation 2005 CWID: AFCA assessment & AF C2 Battle Lab demo as demonstrating the potential to be labeled as an MLS/PL-4 System 2005 DISA: Technical Information Panel (TIP) found to have merit for further evaluation and consideration for use as an information assurance technology potential to fundamentally alter the way storing and securing of data is approached SOCOM: National Center for the Study of Counter-terrorism and Cybercrime IV&V completed successfully for SOCOM MLS Pilot Project 2006 EUCOM Combined Endeavor: Joint Interoperability Test Center (JITC) value of the SecureParser was obvious. This capability not only offers increased security of data, but reduces costs by eliminating the need for redundant resources Selected by DISA as a demonstration solution for CWID 08 - June 08 Selected by NSA for HAP Trade Study as a Crypto Service and for DAR

13 Mission Network Centric Operations Industry Consortium Our mission is to facilitate global realization of the benefit inherent in Network Centric Operations. To that end, we seek to enable continuously increasing levels of interoperability across the spectrum of joint, interagency, intergovernmental, and multinational industrial and commercial operations. We will execute this mission in good faith as a global organization with membership open to all enterprises in quest of applying the vast potential of network centric technology to the operational challenges faced by our nations and their citizens. Past successes Network Centric Analysis Tool (NCAT) NCOIC Interoperability Framework (NIF) Future Develop operational art in support of netcentric operations Support operational art advances through collaboration (Government, Industry, Non-profits, Interest Groups) Provide value to members Use of NCOIC developed process provided differentiator in recent European procurement for a member company NCOIC Patterns addressing interoperability concerns of member government agencies

14 Cloud Computing Operational Art Embrace collaboration OSD tactical Cloud Computing TIGR Government Cloud Computing Cloud Interoperability bl Forum Use Operational and Capability pattern process to develop Cloud Computing Technical Patterns Identify key netcentric operations interoperability requirements and preferences within identified technical patterns Iterate with NCOIC stakeholder companies and government organizations Use Capability and Operational patterns to validate operational impact of reduced cloud interoperability Leverage analysis to drive cloud interoperability recommendations and best practices

15 Thank You! com