Assured Cloud Computing
Description
This book offers readers a comprehensive suite of solutions for resolving many of the key challenges to achieving high levels of assurance in cloud computing. The distillation of critical research findings generated by the Assured Cloud Computing Center of Excellence (ACC-UCoE) of the University of Illinois, Urbana-Champaign, it provides unique insights into the current and future shape of robust, dependable, and secure cloud-based computing and data cyberinfrastructures.
A survivable and distributed cloud-computing-based infrastructure can enable the configuration of any dynamic systems-of-systems that contain both trusted and partially trusted resources and services sourced from multiple organizations. To assure mission-critical computations and workflows that rely on such systems-of-systems it is necessary to ensure that a given configuration does not violate any security or reliability requirements. Furthermore, it is necessary to model the trustworthiness of a workflow or computation fulfillment to a high level of assurance. In presenting the substance of the work done by the ACC-UCoE, this book provides a vision for assured cloud computing illustrating how individual research contributions relate to each other and to the big picture of assured cloud computing. In addition, the book:
* Explores dominant themes in cloud-based systems, including design correctness, support for big data and analytics, monitoring and detection, network considerations, and performance
* Synthesizes heavily cited earlier work on topics such as DARE, trust mechanisms, and elastic graphs, as well as newer research findings on topics, including R-Storm, and RAMP transactions
* Addresses assured cloud computing concerns such as game theory, stream processing, storage, algorithms, workflow, scheduling, access control, formal analysis of safety, and streaming
Bringing together the freshest thinking and applications in one of today's most important topics, Assured Cloud Computing is a must-read for researchers and professionals in the fields of computer science and engineering, especially those working within industrial, military, and governmental contexts. It is also a valuable reference for advanced students of computer science.
More details
Other editions
Additional editions
Persons
ROY H. CAMPBELL, PHD, is Associate Dean for Information Technology in the College of Engineering, and Sohaib and Sara Abbasi Professor of Computer Science, at the University of Illinois at Urbana-Champaign. He was formerly Director of the Assured Cloud Computing- University Center of Excellence at the University of Illinois.
CHARLES A. KAMHOUA, PHD, is a researcher at the U.S. Army Research Laboratory's Network Security Branch. He managed the U.S. Air Force's Assured Cloud Computing-University Center of Excellence at the University of Illinois at Urbana-Champaign.
KEVIN A. KWIAT, PHD, following over 34 years as Principal Computer Engineer with the U.S. Air Force Research Laboratory, is now leading Haloed Sun TEK, LLC, in Sarasota, Florida and has joined forces with the Commercial Applications for Early Stage Advanced Research (CAESAR) Group.
Content
Preface xiii
Editors' Biographies xvii
List of Contributors xix
1 Introduction 1 Roy H. Campbell
1.1 Introduction 1
1.1.1 Mission-Critical Cloud Solutions for the Military 2
1.2 Overview of the Book 3
2 Survivability: Design, Formal Modeling, and Validation of Cloud Storage Systems Using Maude 10 Rakesh Bobba, Jon Grov, Indranil Gupta, Si Liu, José Meseguer,Peter Csaba Ölveczky, and Stephen Skeirik
2.1 Introduction 10
2.1.1 State of the Art 11
2.1.2 Vision: Formal Methods for Cloud Storage Systems 12
2.1.3 The Rewriting Logic Framework 13
2.1.4 Summary: Using Formal Methods on Cloud Storage Systems 15
2.2 Apache Cassandra 17
2.3 Formalizing, Analyzing, and Extending Google's Megastore 23
2.3.1 Specifying Megastore 23
2.3.2 Analyzing Megastore 25
2.3.2.1 Megastore-CGC 29
2.4 RAMP Transaction Systems 30
2.5 Group Key Management via ZooKeeper 31
2.5.1 ZooKeeper Background 32
2.5.2 System Design 33
2.5.3 Maude Model 34
2.5.4 Analysis and Discussion 35
2.6 How Amazon Web Services Uses Formal Methods 37
2.6.1 Use of Formal Methods 37
2.6.2 Outcomes and Experiences 38
2.6.3 Limitations 39
2.7 Related Work 40
2.8 Concluding Remarks 42
2.8.1 The Future 43
3 Risks and Benefits: Game-Theoretical Analysis and Algorithm for Virtual Machine Security Management in the Cloud 49 Luke Kwiat, Charles A. Kamhoua, Kevin A. Kwiat, and Jian Tang
3.1 Introduction 49
3.2 Vision: Using Cloud Technology in Missions 51
3.3 State of the Art 54
3.4 System Model 57
3.5 Game Model 59
3.6 Game Analysis 61
3.7 Model Extension and Discussion 67
3.8 Numerical Results and Analysis 71
3.8.1 Changes in User 2's Payoff with Respect to L2 71
3.8.2 Changes in User 2's Payoff with Respect to e 72
3.8.3 Changes in User 2's Payoff with Respect to p 73
3.8.4 Changes in User 2's Payoff with Respect to qI 74
3.8.5 Model Extension to n = 10 Users 75
3.9 The Future 78
4 Detection and Security: Achieving Resiliency by Dynamic and Passive System Monitoring and Smart Access Control 81 Zbigniew Kalbarczyk
4.1 Introduction 82
4.2 Vision: Using Cloud Technology in Missions 83
4.3 State of the Art 84
4.4 Dynamic VM Monitoring Using Hypervisor Probes 85
4.4.1 Design 86
4.4.2 Prototype Implementation 88
4.4.3 Example Detectors 90
4.4.3.1 Emergency Exploit Detector 90
4.4.3.2 Application Heartbeat Detector 91
4.4.4 Performance 93
4.4.4.1 Microbenchmarks 93
4.4.4.2 Detector Performance 94
4.4.5 Summary 95
4.5 Hypervisor Introspection: A Technique for Evading Passive Virtual Machine Monitoring 96
4.5.1 Hypervisor Introspection 97
4.5.1.1 VMI Monitor 97
4.5.1.2 VM Suspend Side-Channel 97
4.5.1.3 Limitations of Hypervisor Introspection 98
4.5.2 Evading VMI with Hypervisor Introspection 98
4.5.2.1 Insider Attack Model and Assumptions 98
4.5.2.2 Large File Transfer 99
4.5.3 Defenses against Hypervisor Introspection 101
4.5.3.1 Introducing Noise to VM Clocks 101
4.5.3.2 Scheduler-Based Defenses 101
4.5.3.3 Randomized Monitoring Interval 102
4.5.4 Summary 103
4.6 Identifying Compromised Users in Shared Computing Infrastructures 103
4.6.1 Target System and Security Data 104
4.6.1.1 Data and Alerts 105
4.6.1.2 Automating the Analysis of Alerts 106
4.6.2 Overview of the Data 107
4.6.3 Approach 109
4.6.3.1 The Model: Bayesian Network 109
4.6.3.2 Training of the Bayesian Network 110
4.6.4 Analysis of the Incidents 112
4.6.4.1 Sample Incident 112
4.6.4.2 Discussion 113
4.6.5 Supporting Decisions with the Bayesian Network Approach 114
4.6.5.1 Analysis of the Incidents 114
4.6.5.2 Analysis of the Borderline Cases 116
4.6.6 Conclusion 118
4.7 Integrating Attribute-Based Policies into Role-Based Access Control 118
4.7.1 Framework Description 119
4.7.2 Aboveground Level: Tables 119
4.7.2.1 Environment 120
4.7.2.2 User-Role Assignments 120
4.7.2.3 Role-Permission Assignments 121
4.7.3 Underground Level: Policies 121
4.7.3.1 Role-Permission Assignment Policy 122
4.7.3.2 User-Role Assignment Policy 123
4.7.4 Case Study: Large-Scale ICS 123
4.7.4.1 RBAC Model-Building Process 124
4.7.4.2 Discussion of Case Study 127
4.7.5 Concluding Remarks 128
4.8 The Future 128
5 Scalability, Workloads, and Performance: Replication, Popularity, Modeling, and Geo-Distributed File Stores 133 Roy H. Campbell, Shadi A. Noghabi, and Cristina L. Abad
5.1 Introduction 133
5.2 Vision: Using Cloud Technology in Missions 134
5.3 State of the Art 136
5.4 Data Replication in a Cloud File System 137
5.4.1 MapReduce Clusters 138
5.4.1.1 File Popularity, Temporal Locality, and Arrival Patterns 142
5.4.1.2 Synthetic Workloads for Big Data 144
5.4.2 Related Work 147
5.4.3 Contribution from Our Approach to Generating Big Data Request Streams Using Clustered Renewal Processes 149
5.4.3.1 Scalable Geo-Distributed Storage 149
5.4.4 Related Work 151
5.4.5 Summary of Ambry 152
5.5 Summary 153
5.6 The Future 153
6 Resource Management: Performance Assuredness in Distributed Cloud Computing via Online Reconfigurations 160 Mainak Ghosh, Le Xu, and Indranil Gupta
6.1 Introduction 161
6.2 Vision: Using Cloud Technology in Missions 163
6.3 State of the Art 164
6.3.1 State of the Art: Reconfigurations in Sharded Databases/Storage 164
6.3.1.1 Database Reconfigurations 164
6.3.1.2 Live Migration 164
6.3.1.3 Network Flow Scheduling 164
6.3.2 State of the Art: Scale-Out/Scale-In in Distributed Stream Processing Systems 165
6.3.2.1 Real-Time Reconfigurations 165
6.3.2.2 Live Migration 165
6.3.2.3 Real-Time Elasticity 165
6.3.3 State of the Art: Scale-Out/Scale-In in Distributed Graph Processing Systems 166
6.3.3.1 Data Centers 166
6.3.3.2 Cloud and Storage Systems 166
6.3.3.3 Data Processing Frameworks 166
6.3.3.4 Partitioning in Graph Processing 166
6.3.3.5 Dynamic Repartitioning in Graph Processing 167
6.3.4 State of the Art: Priorities and Deadlines in Batch Processing Systems 167
6.3.4.1 OS Mechanisms 167
6.3.4.2 Preemption 167
6.3.4.3 Real-Time Scheduling 168
6.3.4.4 Fairness 168
6.3.4.5 Cluster Management with SLOs 168
6.4 Reconfigurations in NoSQL and Key-Value Storage/Databases 169
6.4.1 Motivation 169
6.4.2 Morphus: Reconfigurations in Sharded Databases/Storage 170
6.4.2.1 Assumptions 170
6.4.2.2 MongoDB System Model 170
6.4.2.3 Reconfiguration Phases in Morphus 171
6.4.2.4 Algorithms for Efficient Shard Key Reconfigurations 172
6.4.2.5 Network Awareness 175
6.4.2.6 Evaluation 175
6.4.3 Parqua: Reconfigurations in Distributed Key-Value Stores 179
6.4.3.1 System Model 180
6.4.3.2 System Design and Implementation 181
6.4.3.3 Experimental Evaluation 183
6.5 Scale-Out and Scale-In Operations 185
6.5.1 Stela: Scale-Out/Scale-In in Distributed Stream Processing Systems 186
6.5.1.1 Motivation 186
6.5.1.2 Data Stream Processing Model and Assumptions 187
6.5.1.3 Stela: Scale-Out Overview 187
6.5.1.4 Effective Throughput Percentage (ETP) 188
6.5.1.5 Iterative Assignment and Intuition 190
6.5.1.6 Stela: Scale-In 191
6.5.1.7 Core Architecture 191
6.5.1.8 Evaluation 193
6.5.1.9 Experimental Setup 193
6.5.1.10 Yahoo! Storm Topologies and Network Monitoring Topology 193
6.5.1.11 Convergence Time 195
6.5.1.12 Scale-In Experiments 196
6.5.2 Scale-Out/Scale-In in Distributed Graph Processing Systems 197
6.5.2.1 Motivation 197
6.5.2.2 What to Migrate, and How? 199
6.5.2.3 When to Migrate? 201
6.5.2.4 Evaluation 203
6.6 Priorities and Deadlines in Batch Processing Systems 204
6.6.1 Natjam: Supporting Priorities and Deadlines in Hadoop 204
6.6.1.1 Motivation 204
6.6.1.2 Eviction Policies for a Dual-Priority Setting 206
6.6.1.3 Natjam Architecture 209
6.6.1.4 Natjam-R: Deadline-Based Eviction 215
6.6.1.5 Microbenchmarks 216
6.6.1.6 Natjam-R Evaluation 221
6.7 Summary 223
6.8 The Future 224
7 Theoretical Considerations: Inferring and Enforcing Use Patterns for Mobile Cloud Assurance 237 Gul Agha, Minas Charalambides, Kirill Mechitov, Karl Palmskog,Atul Sandur, and Reza Shiftehfar
7.1 Introduction 237
7.2 Vision 239
7.3 State of the Art 240
7.3.1 Code Offloading 241
7.3.2 Coordination Constraints 241
7.3.3 Session Types 242
7.4 Code Offloading and the IMCM Framework 243
7.4.1 IMCM Framework: Overview 244
7.4.2 Cloud Application and Infrastructure Models 244
7.4.3 Cloud Application Model 245
7.4.4 Defining Privacy for Mobile Hybrid Cloud Applications 247
7.4.5 A Face Recognition Application 247
7.4.6 The Design of an Authorization System 249
7.4.7 Mobile Hybrid Cloud Authorization Language 250
7.4.7.1 Grouping, Selection, and Binding 252
7.4.7.2 Policy Description 252
7.4.7.3 Policy Evaluation 253
7.4.8 Performance- and Energy-Usage-Based Code Offloading 254
7.4.8.1 Offloading for Sequential Execution on a Single Server 254
7.4.8.2 Offloading for Parallel Execution on Hybrid Clouds 255
7.4.8.3 Maximizing Performance 255
7.4.8.4 Minimizing Energy Consumption 256
7.4.8.5 Energy Monitoring 257
7.4.8.6 Security Policies and Energy Monitoring 258
7.5 Coordinating Actors 259
7.5.1 Expressing Coordination 259
7.5.1.1 Synchronizers 260
7.5.1.2 Security Issues in Synchronizers 260
7.6 Session Types 264
7.6.1 Session Types for Actors 265
7.6.1.1 Example: Sliding Window Protocol 265
7.6.2 Global Types 266
7.6.3 Programming Language 268
7.6.4 Local Types and Type Checking 269
7.6.5 Realization of Global Types 270
7.7 The Future 271
Acknowledgments 272
8 Certifications Past and Future: A Future Model for Assigning Certifications that Incorporate Lessons Learned from Past Practices 277 Masooda Bashir, Carlo Di Giulio, and Charles A. Kamhoua
8.1 Introduction 277
8.1.1 What Is a Standard? 279
8.1.2 Standards and Cloud Computing 281
8.2 Vision: Using Cloud Technology in Missions 283
8.3 State of the Art 284
8.3.1 The Federal Risk Authorization Management Program 286
8.3.2 SOC Reports and TSPC 288
8.3.3 ISO/IEC 27001 291
8.3.4 Main Differences among the Standards 292
8.3.5 Other Existing Frameworks 293
8.3.5.1 PCI-DSS 293
8.3.5.2 C5 294
8.3.5.3 STAR 294
8.3.6 What Protections Do Standards Offer against Vulnerabilities in the Cloud? 294
8.4 Comparison among Standards 296
8.4.1 Strategy for Comparing Standards 298
8.4.2 Patterns, Anomalies, and Discoveries 299
8.5 The Future 302
8.5.1 Current Challenges 304
8.5.2 Opportunities 305
9 Summary and Future Work 312 Roy H. Campbell
9.1 Survivability 312
9.2 Risks and Benefits 313
9.3 Detection and Security 314
9.4 Scalability, Workloads, and Performance 316
9.5 Resource Management 319
9.6 Theoretical Considerations: Inferring and Enforcing Use Patterns for Mobile Cloud Assurance 321
9.7 Certifications 322
Index 327
1
Introduction
Roy H. Campbell
Department of Computer Science, University of Illinois at Urbana-Champaign, Urbana, IL, USA
Mission assurance for critical cloud applications is of growing importance to governments and military organizations, yet mission-critical cloud computing may face the challenge of needing to use hybrid (public, private, and/or heterogeneous) clouds and require the realization of "end-to-end" and "cross-layered" security, dependability, and timeliness. In this book, we consider cloud applications in which assigned tasks or duties are performed in accordance with an intended purpose or plan in order to accomplish an assured mission.
1.1 Introduction
Rapid technological advancements in global networking, commercial off-the-shelf technology, security, agility, scalability, reliability, and mobility created a window of opportunity in 2009 for reducing the costs of computation and led to the development of what is now known as cloud computing [1-3]. Later, in 2010, the Obama Administration [4] announced an
"extensive adoption of cloud computing in the federal government to improve information technology (IT) efficiency, reduce costs, and provide a standard platform for delivering government services. In a cloud computing environment, IT resources-services, applications, storage devices and servers, for example-are pooled and managed centrally. These resources can be provisioned and made available on demand via the Internet. The cloud model strengthens the resiliency of mission-critical applications by removing dependency on underlying hardware. Applications can be easily moved from one system to another in the event of system failures or cyber attacks" [5].
In the same year, the Air Force signed an initial contract with IBM to build a mission-assured cloud computing capability [5].
Cloud computing was eventually defined by the National Institute of Standards and Technology (as finalized in 2011) as follows [6]: "Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models." That model of cloud computing is depicted in Table 1.1.
Table 1.1 Model of cloud computing.
Service Models Deployment Models Software as a Service Private Cloud Community Cloud Hybrid Cloud Public Cloud Platform as a Service Infrastructure as a Service EssentialCharacteristics Resource Pooling Rapid Elasticity Measured Service Broad Network
Access
One of the economic reasons for the success of cloud computing has been the scalability of the computational resources that it provides to an organization. Instead of requiring users to size a planned computation exactly (e.g., in terms of the number of needed Web servers, file systems, databases, or compute engines), cloud computing allows the computation to scale easily in a time-dependent way. Thus, if a service has high demand, it can be replicated to make it more available. Instead of having two Web servers provide a mission-critical service, the system might allow five more Web servers to be added to the service to increase its availability. Likewise, if demand for a service drops, the resources it uses can be released, and thus be freed up to be used for other worthwhile computation. This flexible approach allows a cloud to economically support a number of organizations at the same time, thereby lowering the costs of cloud computation. In later chapters, we will discuss scaling performance and how to assure the correctness of a mission-oriented cloud computation as it changes in size, especially when the scaling occurs dynamically (i.e., is elastic).
1.1.1 Mission-Critical Cloud Solutions for the Military
As government organizations began to adopt cloud computing, security, availability, and robustness became growing concerns; there was a desire to use cloud computing even in mission-critical contexts, where a mission-critical system is one that is essential to the survival of an organization. In 2010, in response to military recognition of the inadequacy of the then state-of-the-art technologies, IBM was awarded an Air Force contract to build a secure cloud computing infrastructure capable of supporting defense and intelligence networks [5]. However, the need for cloud computing systems that could support missions involved more numerous major concerns than could easily be solved in a single, focused initiative and, in particular, raised the question of how to assure cloud support for mission-oriented computations-the subject of this book. Mission-critical cloud computing can stretch across private, community, hybrid, and public clouds, requiring the realization of "end-to-end" and "cross-layered" security, dependability, and timeliness. That is, cloud computations and computing systems should survive malicious attacks and accidental failures, should be secure, and should execute in a timely manner, despite the heterogeneous ownership and nature of the hardware components.
End-to-end implies that the properties should hold throughout the lifetime of individual events, for example, a packet transit or a session between two machines, and that they should be assured in a manner that is independent of the environment through which such events pass. Similarly, cross-layer encompasses multiple layers, from the end device through the network and up to the applications or computations in the cloud. A survivable and distributed cloud-computing-based infrastructure requires the configuration and management of dynamic systems-of-systems with both trusted and partially trusted resources (including data, sensors, networks, computers, etc.) and services sourced from multiple organizations. For mission-critical computations and workflows that rely on such dynamically configured systems-of-systems, we must ensure that a given configuration doesn't violate any security or reliability requirements. Furthermore, we should be able to model the trustworthiness of a workflow or computation's completion for a given configuration in order to specify the right configuration for high assurance.
Rapid technological advances and computer-based weapons systems have created the need for net-centric military superiority. Overseas commitments and operations stretch net-centricity with global networking requirements, use of government and commercial off-the-shelf technology, and the need for agility, mobility, and secure computing over a mixture of blue and gray networks. (Blue networks are military networks that are considered secure, while gray networks are those in private hands, or run by other nations, that may not be secure.) An important goal is to ensure the confidentiality and integrity of data and communications needed to get missions done, even amid cyberattacks and failures.
1.2 Overview of the Book
This book encompasses the topics of architecture, design, testing, and formal verification for assured cloud computing. The authors propose approaches for using formal methods to analyze, reason, prototype, and evaluate the architectures, designs, and performance of secure, timely, fault-tolerant, mission-oriented cloud computing. They examine a wide range of necessary assured cloud computing components and many urgent concerns of these systems.
The chapters of this book provide research overviews of (1) flexible and dynamic distributed cloud-computing-based architectures that are survivable; (2) novel security primitives, protocols, and mechanisms to secure and support assured computations; (3) algorithms and techniques to enhance end-to-end timeliness of computations; (4) algorithms that detect security policy or reliability requirement violations in a given configuration; (5) algorithms that dynamically configure resources for a given workflow based on security policy and reliability requirements; and (6) algorithms, models, and tools to estimate the probability of completion of a workflow for a given configuration. Further, we discuss how formal methods can be used to analyze designed architectures, algorithms, protocols, and techniques to verify the properties they enable. Prototypes and implementations may be built, formally verified against specifications, and tested as components in real systems, and their performance can be evaluated.
While our research has spanned most of the cloud computing phenomenon's lifetime to date, it has had, like all fast-moving technological advances, only a short history (starting 2011). Much work is still to be done as cloud computing evolves and "mission-critical" takes on new meanings within the modern world. Wherever possible, throughout the volume (and in the concluding chapter) we have offered reflections on the state of the art and commented on future directions.
- Chapter 2: Survivability: Design, Formal Modeling, and Validation of Cloud Storage Systems Using Maude, José Meseguer in...
