Resource Allocation for Security Services in Mobile Cloud Computing

IEEE INFOCOM 211 Workshop on M2MCN-211 Resource Allocation for Security Services in Mobile Cloud Computing Hongbin Liang 12 Dijiang Huang 3 LinX.Cai 2 Xuemin (Sherman) Shen 2 Daiyuan Peng 1 1 School of Information Science and Technology Southest Jiaotong University {dypeng}@sjtu.edu.cn 2 Department of Electrical and Computer Engineering University of Waterloo {hbliang lcai xshen}@bbcr.uaterloo.ca 3 School of Computing Informatics and Decision Systems Engineering Arizona State University {dijiang}@asu.edu Abstract Mobile cloud is a machine-to-machine service model here a mobile device can use the cloud for searching data mining and multimedia processing. To protect the processed data security services i.e. encryption decryption authentications etc. are performed in the cloud. In general e can classify cloud security services in to categories: Critical Security (CS) service and Normal Security (NS) service. CS service provides strong security protection such as using longer key size strict security access policies isolations for protecting data and so on. The CS service usually occupies more cloud computing resources hoever it generates more reards to the cloud provider since the CS service users need to pay more for using the CS service. With the increase of the number of CS and NS service users it is important to allocate the cloud resource to maximize the system reards ith the considerations of the cloud resource consumption and incomes generated from cloud users. To address this issue e propose a Security Service Admission Model (SSAM) based on Semi-Markov Decision Process to model the system reard for the cloud provider. We first define system states by a tuple represented by the numbers of cloud users and their associated security service categories and current event type (i.e. arrival or departure). We then derive the system steady-state probability and service request blocking probability by using the proposed SSAM. Numerical results sho that the obtained theoretic probabilities are consistent ith our simulation results. system vulnerability [3]. To provide enhanced security services e need to separate the resources (i.e. VIs) allocated for different security processes oned by different users. In other ords each of CS and NS service subscribers ill be allocated a unique VI or unique VIs hen he/she requests the cloud resources. I. INTRODUCTION Fig. 1. Reference Model of Mobile Cloud Computing. Mobile cloud computing relies on a machine-to-machine computing model in hich mobile devices outsource their computing tasks to the cloud [1]. In this ork our research focuses on the resource allocation for security services of mobile cloud (such as authentication digital signature audition etc.) to mobile devices. Fig. 1 shos the basic structure of mobile cloud service provisioning. In specific hen a mobile device requests a security service to the cloud the system admission control model consults the system resource management model about the availability of system resource i.e. Virtual Images (VIs) in our folloing discussion. Each VI manages a portion of cloud system resources (CPU storage etc.). If there are available VIs and the request is accepted then a VI or several VIs ill be allocated to that security service by the system resource management model. In this paper e consider that there are to types of security services as shon in Fig. 1: (i) Critical Security (CS) service and (ii) Normal Security (NS) service. In [2] the authors had pointed out that in order to provide cloud security service it is necessary to provide resource isolation among different cloud users. This is especially critical for security services since sharing resources (e.g. memory) enable attackers to explore the To construct an efficient resource allocation model for mobile cloud security services e present an admission control mechanism based on the total cloud system reard hich takes into account both the cloud income and the cost of the resource occupation. Thus the system reard is computed in the system resource management model based on the folloing factors: (i) the arriving and departing rates of CS and NS services (ii) the numbers of running CS and NS services in the system (iii) the available total system resource (measured by the numbers of VIs) (iv) the reard for CS or NS service. In general the CS service involves more complex security implementations such as stronger authentication and encryption algorithms longer key size more strict security access policies and so on. As a result the CS service usually consumes more cloud resources such as CPU time to compute the complex cryptography algorithms and occupies more hard drive spaces (i.e. strict resource isolation requires that no storage sharing is alloed). Usually users need to pay more for CS services hich means higher reard to the mobile cloud service provider. To satisfy the security service requirements of end users i.e. either CS service or NS service the mobile cloud needs to consider ho to admit mobile users service requests to obtain the maximal 978-1-4244-992-5/11/$26. 211 IEEE 191

system reard ith the limited cloud resource. To address the above presented admission issue for security service requests e propose a Security Service Admission Model (SSAM) based on Semi-Markov Decision Process (SMDP) [4] to leverage the maximal system reards ith the system resource constraints. The contributions of our solutions are to-fold: We apply the Semi-Markov Decision Process to analyze the system reard of different security services and derive the optimal resource allocation policy in the mobile cloud computing. We propose SSAM to derive the cloud service blocking probability and achieve the maximum system gain of the mobile cloud by considering both system expenses and incomes (i.e. considering the system reard). The remainder of this paper is organized as follos. The related ork is presented in Section II. In Section III e present our system models. The Semi-Markov Decision Process model (SMDP) for mobile cloud computing is developed in Section IV. Based on the SMDP model e derive the blocking probability in Section V. The system performance is evaluated in Section VI folloing by concluding remarks and future ork in Section VII. II. RELATED WORK Recent research has been focused on Cloud computing for mobile devices [5] hich enables running applications beteen resource-constrained devices and Internet-based Clouds. The problem of ensuring the integrity of data storage in Cloud Computing is studied in [6] and [7]. In [8] an economic cloud computing model is presented to decide ho to manage the computing tasks ith a given configuration of the cloud system. A game theory-based resource allocation model to allocate the cloud resources according to users QoS requirements is proposed in [9]. Although resource management in ireless netorks has been extensively studied in [1] [11] and [12] existing mobile cloud solutions are limited and are solely focused on the enhancement of the individual mobile device s capability. In addition much of the previous orks for cloud security focused on the security to enhance security of Clouds themselves such as infrastructure security [13] based on TCG/TPM secure outsourcing [14] and Cloud eb security [15] etc. To the best of our knoledge none of them addressed ho to construct a system reard model for resources allocation by considering prioritized cloud security services. III. SYSTEM DESCRIPTION To improve security for cloud computing to basic security services are provided namely NS and CS services. NS service only uses basic security approaches such as authentication to validate the users and it usually involves lo-complexity computing and access control tasks. CS service provides more security services such as confidentiality digital signature access control audition anti-virus scanning etc. To simplify the notations e denote NS and CS services as l and h respectively. In our model the cloud resources are divided into K portions and each portion represents a VI. In the cloud mobile users can choose the desired security services l or h hich occupies α l VIs and α h VIs ( < α l + α h < K) respectively. With the limitation of cloud resources (i.e. VIs) it is critical to allocate the resources to maximize the system reard i.e. leverage the cloud service incomes and system running expenses. In other ords the cloud should decide hether to accept or reject a security service request (l or h) based on the currently available cloud resources and the arrival rate of potential future security service requests. The arrival rates of security services l and h follo the Poisson distribution ith mean rates l and h respectively. The cloud resource occupation time follos the exponential distribution ith mean 1/ and 1/μ h respectively. In the folloing e present the system states the actions and the reard model for the presented mobile cloud computing system. A. System States An arrival request of security service l or h can be considered as an incoming event and a departure of a service l or h can be considered as a leaving event. Thus in the system model e define three service events: 1) The cloud receives a request of security service l from a user denoted by e l ; 2) The cloud receives a request of security service h from a user denoted by e h ; and 3) The transaction of a security service completes and associated VIs are released denoted by e f. The number of security service l and security service h beingservedinthe cloud are denoted as N l and N h respectively. Therefore the system state can be expressed as: S = {s s = ŝ e } here ŝ = e {e l e h e f }and α l N l +α h N h K. B. Actions In system state ŝ upon receiving a service request (e.g. e l or e h ) to actions can be selected by the mobile cloud: accept and reject hich are denoted by a bsel /e h =1and a bsel /e h = respectively. When a departure occurs the cloud releases the cloud resources and there is no action in this case. Thus e define a bsef =. Accordingly the action set is A = {a bse a bse { 1}}. C. Reard Model Thesystemnetreardcanbeevaluatedbasedontheservice incomes and the running expenses: x(s a) τ(s a)y(s a) (1) here x(s a) is the net lump sum incomes for the cloud hen action a is chosen at the current state s y(s a) is the service holding cost rate hen the cloud is in state s and action a is selected and τ(s a) is the expected service time from the current state s to the next state hen decision a is selected. x(s a) is computed as: x(s a) = a bse = R l a bsel =1 R h a bseh =1 (2) 192

Fig. 2. State transition Diagram. here R l and R h are an income of the cloud hen an l and an h security service request is accepted respectively. The service holding cost rate y(s a) is proportional to the occupied cloud resources hich is given by α l N l + α h N h a bse = y(s a) = α l (N l +1)+α h N h a bsel =1 (3) α l N l + α h (N h +1) a bseh =1. IV. SMDP BASED MOBILE COMPUTING MODEL A general SMDP model consists of six elements [4]: 1) system states; 2) action sets; 3) the events; 4) decision epochs; 5) transition probabilities and 6) reards. A decision epoch is the time instant hen any of the events takes place e.g. a request of service l or h arrives or a security service is finished and the allocated resources of VIs are released. The time duration beteen to decision epoches follos an exponential distribution. Denote τ(s a) as the expected time duration beteen to decision epoches given the current state s and action a. Thus e have [γ + a bsel ] 1 e = e l τ(s a) = [γ + a bseh μ h ] 1 e = e h (4) γ 1 e = e f here γ = l + h + N l + N h μ h. The state transition in a Markov decision model is shon in Fig. 2. Denote q(j s a) as the state transition probability from state s to j hen action a is chosen. For a state s = ŝ e here ŝ = e {e l e h e f } and action a = the next state can be j 1 = e l j 2 = e h j 3 = N l 1N h e f (N 1 1 ) and j 4 = 1e f (N h 1). q(j s a) can be obtained as l τ(s a) j = j 1 q(j s a) = h τ(s a) j = j 2 (5) N l μ l τ(s a) j = j 3 N h μ h τ(s a) j = j 4 Note that α l N l + α h N h K. For the current state s = ŝ e l and the action a =1the next state can be j 5 = N l +1N h e l j 6 = N l +1N h e h j 7 = e f andj 8 = N l +1N h 1e f (N h 1). Thus q(j s a) can be obtained as: q(j s a) = l τ(s a) j = j 5 h τ(s a) j = j 6 (6) (N l +1) τ(s a) j = j 7 N h μ h τ(s a) j = j 8 Similarly for state s = ŝ e h and action a =1 the next state can be j 9 = +1e l j 1 = +1e h j 11 = N l 1N h +1e f (N l 1) and j 12 = e f. Thus q(j s a) can be obtained as q(j s a) = l τ(s a) j = j 9 h τ(s a) j = j 1 (7) N l τ(s a) j = j 11 (N h +1)μ h τ(s a) j = j 12 Applying the discounted reard model [4] the expected discounted reard during τ(n a) satisfies: { τ 1 } z(s a) = x(s a) y(s a)ebs a e αt dt { [1 e = x(s a) y(s a)ebs a ατ 1 } ] α y(s a)τ(s a) = x(s a) 1+ατ(s a) (8) 193

here x(s a) and y(s a) are defined in (2) and (3). The maximum long term discounted reard is given by ν(s) =max a A z(s a)+ q(j s a)ν(j) j S here = (1 + ατ(s a)) 1. Let be a finite constant = l + h +K max( μ h ) < and = /(+α). The optimality equation of ν(s) can be obtained after uniformization ν(s) =max a à z(s a)+ q(j s a) ν(j) j S here z(s a) z(s a) 1+ατ(sa) (α+)τ(sa) and q(j s a) = (9) (1) { 1 [1 q(s sa)] τ (sa) j = s q(j sa) τ(sa) j s. (11) V. BLOCKING PROBABILITY The blocking probability is an important QoS metric for a mobile cloud system. In this section e derive the blocking probability using the proposed SMDP-based SSAM. The expected total discounted reard ν(s) at state s S is dependent on l h μ h and K as shon in (1). Our objective is to find a decision rule that maximizes the total reard at each state ν(s) s. In specific hen a security service request arrives the system resource management model checks ν(s) of the current state under different actions i.e. a = or a =1 and select an action ith a higher reard. We derive the steady state probability denoted as π Nl N h e for state e in SSAM as shon in Fig. 2. We use states (j 1.. j 12 ) defined in Section IV to simplify the notation. Similarly let j 13 = 1e h (N h 1) j 14 = N l 1N h e l (N l 1). The stead state probability of π Nl N h e can be derived as follos π j1 = + j1 j2 N l =N h = β μ +a j1 j1 j7 + j1 j2 N l =N h > β μ +a j1 j1 j7 + a j 13 j13 + j1 j2 N l > N h = β μ +a j1 j1 j7 + a j 14 j14 + j1 β μ +a j1 j1 j7 +a j13 j13 + a j 14 j14 j2 N l > N h > (12) π j2 = h β μ h h β μ h h β μ h h + j2 N l =N h = j7 + j2 N l =N h > j7 + a j13 π h j13 + j2 N l > N h = j7 + a j14 π h j14 + j2 j7 β μ +a j2 π h j2 N l > N h > +a j13 π h j13 + a j14 π h j14 (13) here β = N l + N h μ h + l + h α l N l + α h N h K. As the total probability equals to 1 ehave π Nl N h e =1. (14) Solving Eq. (12-14) the steady-state probability π Nl N h e can be iteratively obtained. The blocking probability P blocking defined as the ratio of the number of rejected requests and the total number of service requests is thus given by P blocking = P P ((1 a j1 )π j1 +(1 a j2)π j2 ) P P (π j1 +π j2 ) for α l N l + α h N h K (15) here a j1 a j2 A are the actions adopted at states e l and e h respectively. VI. PERFORMANCE EVALUATION In this section e evaluate the performance of the proposed SSAM using a simulator ritten in matlab. We set up a cloud system ith the total number of VIs from 2 to 15. The request arrival rates of services l and h are 5 and 2 per unit time respectively and the average service holding time of each connection is = μ h = 6 unit times if not otherise specified. A service h occupies to VIs hile l occupies one VI hen it is accepted. Accordingly an income of.3 for l and.6 for h are added to the cloud system. We set the discount factor α =.1 to assure the convergence of the reard computation. Fig. 3. Blocking Probability (l).5.45.4.35.3.25.2.15.1.5 l =5 h =2 simu l =5 h =2 anal l =5 h =5 simu l =5 h =5 anal 2 4 6 8 1 12 14 16 Blocking probability of service l under various arrival rates. The blocking probabilities of services l and h under various arrival rates of service requests are shon in Fig. 3 and Fig. 4 respectively. A loer blocking probability is achieved hen more netork resources e.g. VIs are available. Because service h requires to times cloud resources than service l 194

Fig. 4. Blocking Probability (h) 1.9.8.7.6.5.4.3.2.1 l =5 h =2 simu l =5 h =2 anal l =5 h =5 simu l =5 h =5 anal 2 4 6 8 1 12 14 16 Blocking probability of service h under various arrival rates. h is more likely to be rejected especially hen the cloud resource is limited e.g. only to VIs in the cloud. Therefore the blocking probability of service h is larger than that of service l accordingly. We further increase the arrival rate of service h from 2 to 5 per unit time. It can be seen that the blocking probability increases ith the traffic arrival rates for agiventhenetorkresource. Fig. 5. times. Fig. 6. times. Blocking Probability (l).7.6.5.4.3.2.1 =6 μ h =6 simu =6 μ h =6 anal =4 μ h =4 simu =4 μ h =4 anal 2 4 6 8 1 12 14 16 Blocking probability of service l under various service occupation Blocking Probability (h) 1.9.8.7.6.5.4.3.2.1 =6 μ h =6 simu =6 μ h =6 anal =4 μ h =4 simu =4 μ h =4 anal 2 4 6 8 1 12 14 16 Blocking probability of service h under various service occupation The blocking probabilities of different services under various service departure rates are shon in Fig. 5 and Fig. 6. With a larger service holding time the system cost of each mobile user increases hich results in a degraded system reard. Therefore a ne request is more likely to be rejected. The blocking probability decreases ith the service occupation time for both services l and h. VII. CONCLUSION In this paper e have proposed a SSAM based on SMDP considering both the maximal system reard and system service expenses. The system reard is derived through SSAM by taking into considerations of the CS/NS service reards and their cloud system expenses. We derive the blocking probabilities of SSAM and conduct extensive simulations to validate our analysis. In the future e ill investigate the optimal system resources (i.e. the number of VIs) to obtain the maximal system reards under the given blocking probability. In addition e ill incorporate more system metrics into the constructions of the reard function such as different application tasks as ell. ACKNOWLEDGMENT Hongbin Liang s research is supported by the China Scholarship Council and Dijiang Huang s research is sponsored by ONR YIP aard. REFERENCES [1] D. Huang X. Zhang M. Kang and J. Luo Mobicloud: A secure mobile cloud frameork for pervasive mobile computing and communication in Proceedings of 5th IEEE International Symposium on Service-Oriented System Engineering 21. [2] H. Raj R. Nathuji A. Singh and P. England Resource management for isolation enhanced cloud services in Proceedings of ACM orkshop on Cloud computing security 29 pp. 77 84. [3] T. Ristenpart E. Tromer H. Shacham and S. Savage Hey You Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds in ACM Conference on Computer and Communications Security 29. [4] M. Puterman Markov decision processes: Discrete stochastic dynamic programming. John Wiley & Sons Inc. Ne York NY USA 25. [5] X. H. Li H. Zhang and Y. F. Zhang Deploying Mobile Computation in Cloud Service in Proceedings of the First International Conference for Cloud Computing (CloudCom) 29 p. 31. [6] Q. Wang C. Wang J. Li K. Ren and W. Lou Enabling public verifiability and data dynamics for storage security in cloud computing in European Symposium on Research in Computer Security (ESORICS) 29 Saint Malo France Sep 29. [7] C. Wang K. Ren W. Lou and J. Li Toards Publicly Auditably Secure Data Storage Services IEEE Netork Magazine vol. 24 no. 4 pp. 19 24 July/August 21. [8] H. Liang D. Huang and D. Peng On Economic Mobile Cloud Computing Model in Proceedings of the International Workshop on Mobile Computing and Clouds (MobiCloud in conjunction ith MobiCASE) 21. [9] G. Wei A. V. Vasilakos Y. Zheng and N. Xiong A game-theoretic method of fair resource allocation for cloud computing services The Journal of Supercomputing vol. 54 no. 2 pp. 252 269 29. [1] L. X. Cai L. Cai X. Shen and J. W. Mark Resource management and QoS provisioning for IPTV over mmwave-based WPANs ith directional antenna ACM Mobile Netorks and Applications (MONET) vol. 14 no. 2 pp. 21 219 29. [11] H. T. Cheng and W. Zhuang Novel packet-level resource allocation ith effective QoS provisioning for ireless mesh netorks IEEE Transactions on Wireless Communications vol. 8 no. 2 pp. 694 7 Feb 29. [12] L. X. Cai X. Shen and J. W. Mark Efficient MAC Protocol for Ultraideband Netorks IEEE Communications Magazine vol. 47 no. 6 pp. 179 185 29. [13] N. Santos K. Gummadi and R. Rodrigues Toards trusted cloud computing in Proceedings of USENIX HotCloud 29. [14] R. Cho P. Golle M. Jakobsson E. Shi J. Staddon R. Masuoka and J. Molina Controlling data in the cloud: outsourcing computation ithout outsourcing control in Proceedings of the 29 ACM orkshop on Cloud computing security 29 pp. 85 9. [15] J. Sobey T. Whalen R. Biddle P. V. Oorschot and A. Patrick Broser Interfaces and Extended Validation SSL Certificates: An Empirical Study in Proceedings of the 29 ACM orkshop on Cloud computing security 29. 195