Providing User Security Guarantees in Public Infrastructure Clouds

Abstract

obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.The WestminsterResearch online digital archive at the University of Westminster aims to make the research output of the University available to a wider audience. Copyright and Moral Rights remain with the authors and/or copyright owners.Whilst further distribution of specific materials from within this archive is forbidden, you may freely distribute the URL of WestminsterResearch: ((http://westminsterresearch.wmin.ac.uk/).In case of abuse or copyright appearing without permission e-mail repository@westminster.ac.uk Abstract-The infrastructure cloud (IaaS) service model offers improved resource flexibility and availability, where tenants -insulated from the minutiae of hardware maintenance -rent computing resources to deploy and operate complex systems. Large-scale services running on IaaS platforms demonstrate the viability of this model; nevertheless, many organizations operating on sensitive data avoid migrating operations to IaaS platforms due to security concerns. In this paper, we describe a framework for data and operation security in IaaS, consisting of protocols for a trusted launch of virtual machines and domain-based storage protection. We continue with an extensive theoretical analysis with proofs about protocol resistance against attacks in the defined threat model. The protocols allow trust to be established by remotely attesting host platform configuration prior to launching guest virtual machines and ensure confidentiality of data in remote storage, with encryption keys maintained outside of the IaaS domain. Presented experimental results demonstrate the validity and efficiency of the proposed protocols. The framework prototype was implemented on a test bed operating a public electronic health record system, showing that the proposed protocols can be integrated into existing cloud environments.

MemTri

“…This upgrade will allow MemTri to effectively locate evidence in the context of any specified criminal investigation, thus making it practical for use in a real-life environment. In addition to that, we plan to integrate our tool in a trusted cloud environment such as the one presented in [20,21,32,33] and allow users from different geographical locations to enhance the dictionary based on their experience. Finally, adding a weight on each of the existing words has the potential to improve the effectiveness of our tool since it will be easier for a digital investigator to identify real criminal activities and categorize them by their importance.…”

PaaSword: A Holistic Data Privacy and Security by Design Framework for Cloud Services

“…The data distribution and encryption algorithms are also important aspects towards trusted cloud services [35] and applications. In [15], C. Gentry presented the first fully homomorphic encryption scheme that enables semantically secure outsourcing to the cloud.…”

HealthShare: Using Attribute-Based Encryption for Secure Data Sharing between Multiple Clouds

“…In [4] authors presented DBSP -a framework for data and operation security in Infrastructure-as-a-Service (IaaS) clouds, consisting of protocols for a trusted launch of virtual machines and domain-based storage protection. Its security guarantees are supported by an extensive theoretical analysis with proofs about protocol resistance against attacks in the defined threat model.…”

“…A summary of the notation introduced so far is presented in Table I. V. THREAT MODEL Our threat model is similar with the one described in [4], which is based on the Dolev-Yao adversarial model [14] and further assumes that privileged access rights can used by a remote adversary ADV to leak confidential information. ADV , e.g.…”