An Autonomic Cloud Management System for Enforcing Security and Assurance Properties

Engineering secure software remains a significant challenge for today's software organizations as they struggle to understand the implications of security o the system and develop systems that guarantee specified software security properties. Despite many software engineering advances, current methods for deriving a design from a set of requirements that guarantee the retention of the intended security properties remains difficult and often unachievable. If security requirements are formalized and transformed into design using formal methods, the result would reduce the potential for security vulnerabilities through better clarity, completeness, and consistency. To this end, we outline a requirements-driven security engineering approach for deriving design specifications from security requirements that guarantee security properties specified in requirements are retained. We build on the goal-oriented KAOS (Knowledge Acquisition in autOmated Specifications) framework to formally construct a complete, consistent, and clear security requirements model. The resulting model is then transformed to the B language to derive security design specifications. Using B enables us to further implement the design while preserving requirements relevant security properties. Using the B refinement mechanism, we generate design specifications and ultimately implementation. The approach treats security-specific elements in a systematic and constructive way while considering security early in the development lifecycle with assurance of completeness, consistency and clarity throughout the development. Moreover, our approach allows for requirement traceability at the various phases of development that helps security evaluators to have more confidence in the target of evaluation.

A QoS-driven approach for cloud computing addressing attributes of performance and security

A company planning to implement a public cloud solution should be aware of the risks associated with cloud computing. This is due to the rapidly evolving threats to cloud security that are emerging at an increasing rate in recent years, also to multi-tenant and open nature of the public cloud. Cloud computing is a powerful technology in IT environment and to take advantage of all the benefits of cloud computing, it is necessary to have security and privacy requirements for the implementation and use of the cloud. A risk analysis must be done initially with a cloud provider in order to identify the existing vulnerabilities and to implement the measures to counter those threats. This paper explores the key issues surrounding cloud security, and passes on valuable guidance about not only information security and broadly risk. Also, it will help providers to make informed security decisions about their diverse cloud set-ups and better understand how to reap all the benefits of cloud without compromising their organizations’ security. As well, it discusses the security requirements, and various risks related to the public cloud.

The use of formal methods has long been advocated in the development of secure systems. Yet, methods for deriving design from requirements that guarantee retention of the intended security properties remain largely unrealized on a repeatable and consistent basis. We present the FADES (Formal Analysis and Design approach for Engineering Security) that integrates KAOS (Knowledge Acquisition in autOmated Specifications) with the B specification language to derive security design specifications and further implementation from security requirements. We demonstrate the capability of the approach to handle changes to security requirements by introducing corrective changes to the security requirements of a case study, the spy network system. The objective is to bridge the gap between formal requirements and design for security requirements. Our initial results show promise with FADES in preserving security properties and detecting security vulnerabilities early during requirements. Encouraged by these, we are more quantitatively assessing the FADES capabilities.

We investigate privacy-preserving Public-Key Infrastructures (PKIs) with additional security, privacy, and performance requirements meant to support vehicular networks. While conventional PKIs are a cornerstone for identity management in certain security applications, they do not offer the privacy properties that vehicular networks demand. Over the last few years, there have been efforts to generalize conventional PKIs to meet these new privacy and security demands. One particular example is the class of multiple certificate PKIs where each vehicle is given multiple short-lived and anonymous certificates that can function as credentials until the vehicle is due for, say, the next inspection or dealership visit. While such PKIs offer attractive security and privacy properties, achieving acceptable performance has remained an open problem thus questioning their practicality.In this paper, we formally define and investigate the efficient certificate revocation list (CRL) search problem for multiple certificate PKIs, which asks whether it is possible to efficiently test CRL membership of a given certificate in the same order of computational complexity as in conventional PKIs (that is, by a simple and fast binary search over the set of revoked PKI members). Any solution to this problem is of particular interest when it does not introduce unacceptable compromises on other important properties such as security and privacy. We start by formally defining vehicular networks and a number of security, privacy and performance requirements for them. Then we demonstrate that for PKIs based on general classes of efficient algorithms, containing binary search over totally ordered sets and approximate nearest neighbor search over metric spaces, a solution to the efficient CRL search problem can be used to violate privacy. Finally, we present and analyze new solutions that simultaneously solve the efficient cRL search problem and satisfy privacy requirements by allowing all vehicles to locally (i.e., with minimal help from the CA) and consistently (i.e., with the same results across all vehicles) manage their CRLs. Using these ideas, we can maintain security and privacy properties while reducing the CRL membership testing time to logarithmic in the number of revoked vehicles, which is essentially the same performance that one obtains with conventional PKIs where privacy is not required.

Previous work on electronic coupon (e-coupon) systems mainly focused on security properties such as unforgeability, double-redemption detection, and anonymity/unlinkability. However, achieving both traceability against dishonest users and anonymity for honest users without involving any third party is an open problem that has not been solved by the previous work. Another desirable feature of an e-coupon system that has not been studied in the literature is user privacy, which means the shop cannot identify the good (among all the choices specified in the coupon) that has been chosen by the customer during the redemption process. In this paper, we present a novel e-coupon system that can achieve all these desirable properties. We define the formal security models for these new security requirements, and show that our new e-coupon system is proven secure in the proposed models.

The main topic of this thesis is related to the state of the art in designing cryptographic primitives from a hardware point of view. A special emphasis is dedicated to low-power/low-energy CMOS design. A set of solutions is proposed including an LFSR based stream cipher with self-synchronizing capabilities, a new memory-less Rijndael block cipher architecture and a public key scheme in the class of discrete logarithm. The former is based on arithmetic in large finite field, mainly Galois extension field GF(2‴). These solutions are droved using low-energy techniques, in order to decrease both the switching activity and the total delay. The fundamental motivation supporting this work, is to demonstrate that practical solutions can be obtained for implementing such complex primitives in large scaled circuits, that arc at once, high performance architectures (low-power, high-speed) and cryptographicaly strong, using the well known trade-off between area-speed or area-power. Security constraint has been duly considered, mainly by increasing the key-size. In this work, we explore the general aspects of designing the above mentioned cryptographic functions. We give an extensive survey of some cryptographic primitives from the hardware point of view and expose their security properties. The thesis favours stream cipher and public-key schemes, as currently the most promising advance to capture the notion of key generation and establishment and data bulk encryption. One contribution is the convenient notation for expressing cryptographic self-synchronizing stream ciphers SSSC schemes and our SSMG proposal, a scheme based on packet fingerprint identification, that relies on keyed cryptographic hash function to achieve the security requirements. We maintain an important distinction between hardware implementation and algorithm's security, because the security of cryptographic primitives cannot be based on mathematically strong functions only but requires an extensive cryptanalysis at different levels including the application. This causes a concern for a formalization of the security of an implemented cryptographic primitive. Nevertheless, while some schemes arc well known to be secure such as DL based public key schemes and enough cryptanalyzed such as the new standard Rijndael, some security aspects of the SSMG are discussed. A part of this work studies the specific aspects related to hardware implementation of Rijndael block cipher, the new standard designed to be a substitute for DES. An efficient architecture is developed targeting FPGA implementation, by simply avoiding memory blocks dedicated to the implementation of S-boxes and replacing them by on-chip forward computation using composite Galois field. This technique helps to reduce considerably the amount of hardware required at the cost of little increase of the switching activity. The main conclusion is that, while security constraint of cryptographic primitives increases the hardware complexity and reduces the performances, practical solutions exist for reducing such complexities while keeping or increasing the level of security. Nevertheless, major open questions remain both for a firm theoretical foundation and the proper cryptanalysis of certain solutions.

Nowadays, security policies are the key point of every modern infrastructure. The specification and testing of such policies are the fundamental steps in the development of a secure system. To address both challenges, we propose a framework that automatically generates test sequences to validate the conformance of a security policy. The functional behavior of the system is specified using a formal description technique based on Extended Finite-State Machines (EFSMs), while security requirements are specified using XACML. We develop specific algorithms to integrate the security rules into the functional system specification. In this way, we obtain a complete specification of the secured system. Then, automatic test generation is performed using a dedicated tool called TestGen-IF which was developed in our laboratory. This generation is based on the security properties as test objectives. Finally, a case study is presented to demonstrate the reliability of our framework.

In this paper, we focus on formal analysis of SET Registration protocol and in order to prove it satisfies two security properties, that is, authentication and secrecy, reasonable method Strand Space is used. First, we describe SET Registration protocol in strand space formula and construct their bundles in graph mode. Second, we formalize the goals to be proved. Third, we use minimal element to prove the protocols meet the above secure requirements. It shows that Strand space approach can be used formal analysis on complicated e-commerce protocol visually.

A lot of new applications in the field of electronic commerce require customers to pay small amounts of money to purchase low-value services, goods or pieces of information. These kinds of payments, called micropayments, provide a trade-off between efficiency and security requirements. In a previous work, we presented an efficient and secure micropayment scheme which fulfills both the security properties that guarantee no financial risk and the desired privacy for customers. In this paper we present a successful implementation of the scheme on the Android Platform and its performance evaluation to prove that the proposal is viable using current mobile devices. Several tests validate that our scheme can execute very fast payments with our simple but secure spending protocol, even when we need to use multiple tokens to pay for more expensive products. Moreover, we have proved that data storage requirements are low.

SummaryThis paper focus on providing a secure and trustworthy solution for virtual machine (VM) migration within an existing cloud provider domain, and/or to the other federating cloud providers. The infrastructure‐as‐a‐service (IaaS) cloud service model is mainly addressed to extend and complement the previous Trusted Computing techniques for secure VM launch and VM migration case. The VM migration solution proposed in this paper uses a Trust_Token based to guarantee that the user VMs can only be migrated and hosted on a trustworthy and/or compliant cloud platforms. The possibility to also check the compliance of the cloud platforms with the pre‐defined baseline configurations makes our solution compatible with an existing widely accepted standards‐based, security‐focused cloud frameworks like FedRAMP. Our proposed solution can be used for both inter‐ and intra‐cloud VM migrations. Different from previous schemes, our solution is not dependent on an active (on‐line) trusted third party; that is, the trusted third party only performs the platform certification and is not involved in the actual VM migration process. We use the Tamarin solver to realize a formal security analysis of the proposed migration protocol and show that our protocol is safe under the Dolev‐Yao intruder model. Finally, we show how our proposed mechanisms fulfill major security and trust requirements for secure VM migration in cloud environments.

Cloud computing has emerged as a fast-growing technology in the past few years. It provides a great flexibility for storing, sharing and delivering data over the Internet without investing on new technology or resources. In spite of the development and wide array of cloud usage, security perspective of cloud computing still remains its infancy. Security challenges faced by cloud environment becomes more complicated when we include various stakeholders' perspectives. In a cloud environment, security perspectives and requirements are usually designed by software engineers or security experts. Sometimes clients' requirements are either ignored or given a very high importance. In order to implement cloud security by providing equal importance to client organizations, software engineers and security experts, we propose a new methodology in this paper. We use Microsoft's STRIDE-DREAD model to assess threats existing in the cloud environment and also to measure its consequences. Our aim is to rank the threats based on the nature of its severity, and also giving a significant importance for clients' requirements on security perspective. Our methodology would act as a guiding tool for security experts and software engineers to proceed with securing process especially for a private or a hybrid cloud. Once threats are ranked, we provide a link to a well-known security pattern classification. Although we have some security pattern classification schemes in the literature, we need a methodology to select a particular category of patterns. In this paper, we provide a novel methodology to select a set of security patterns for securing a cloud software. This methodology could aid a security expert or a software professional to assess the current vulnerability condition and prioritize by also including client's security requirements in a cloud environment.

Cloud computing is becoming increasingly important for provision of services and storage of data in the Internet. However there are several significant challenges in securing cloud infrastructures from different types of attacks. The focus of this paper is on the security services that a cloud provider can offer as part of its infrastructure to its customers (tenants) to counteract these attacks. Our main contribution is a security architecture that provides a flexible security as a service model that a cloud provider can offer to its tenants and customers of its tenants. Our security as a service model while offering a baseline security to the provider to protect its own cloud infrastructure also provides flexibility to tenants to have additional security functionalities that suit their security requirements. The paper describes the design of the security architecture and discusses how different types of attacks are counteracted by the proposed architecture. We have implemented the security architecture and the paper discusses analysis and performance evaluation results.

The technological landscape is rapidly evolving, and organizations are increasingly recognizing the benefits of multi - cloud environments, which allow them to leverage different cloud platforms to meet specific requirements. This shift from a reliance on a single cloud provider underscores the need to embrace the adaptability and flexibility relevant to simultaneous multi - cloud utilization. Within the complexities of multi - cloud environments, effective cost management is key. This necessitates a strategic way to approach costs aligned with the unique needs of every organization. By deploying tools, implementing processes, and continuously monitoring tools, businesses can achieve cost savings while capitalizing on the advantages offered by different cloud providers. Additionally, as multi - cloud adoption becomes common in IT enterprises, the challenges related to managing multi - cloud infrastructure can discourage IT operations. This paper advocates for extending the DevOps approach to multi - cloud environments by emphasizing its potential to support and simplify application development, delivery, and maintenance. While adopting DevOps into a multi - cloud strategy may need compromises, they speed up democratizing development and maintenance work, thus fostering an organization?s competitive advantage. DevOps is an emerging field in IT infrastructure management and cloud automation; it is explored in continuous improvement and optimization. Organizations invest resources in enhancing efficiency, reducing redundancy, and optimizing costs in developing and deploying enterprise applications. Managing multiple environments can be challenging, necessitating continuous monitoring and optimization of operational tasks and improved collaboration across different organizational teams. The migration to the cloud and the prevalence of multiple cloud environments further complicate the management of DevOps in a multi - cloud setting, thus needing mechanisms to address key risks and challenges. It is vital for rapid software development to meet organizational objectives in the competitive landscape, which is highlighted by positioning DevOps as an essential technique. This approach allows enterprises to deliver high - quality software capabilities through automation by enhancing team communication and increasing efficiency across the software product lifestyle. The research problem depicts the shift in organizational workloads towards automation, mainly regarding cloud - based applications to keep up with the demand for new technologies and products. In this trend of multi - cloud deployments, it is important to ensure the security of workloads across diverse cloud platforms to allow organizational focus. While security controls may be uniform, differences in deployment approaches, architecture, tools, and processes bring challenges. The dynamic nature of the cloud further complicates security visibility addressed by Cloud Security Posture Management (CPSM) solutions. These solutions are key in providing visibility as organizations? cloud footprints expand. This comprehensive analysis delves into the complexities of multi - cloud deployments in DevOps, providing insights into the challenges and strategies employed to navigate this landscape.

To enjoy the full benefits of cloud computing, it is necessary to have built-in security, privacy, compliance and legal requirements for the cloud implementation and use. Each industry has its own risk levels that it could work within. A company, which is planning to use public cloud services, should be conscious of the regulations and industry risks and need to monitor it and abide by the same. This is due to multi-tenant and open to all nature of public cloud. A thorough risk analysis must be done initially with a public cloud provider. The main objective is to identify the existing vulnerabilities and to implement the measures to counter those threats. There are a variety of risks such as vendor lock-in, non-compliance, poor provisioning, unauthorized access, loss of control, Service Level Agreement (SLA) violations, Internet attacks, etc. To alleviate the risks, there are several measures that could be deployed. This paper deals with mitigation mechanism, security requirements and various risks associated with public cloud.