Multi-cloud policy enforcement through semantic modeling and mapping

This paper presents the design, implementation, and evaluation of a new system for provisioning of Hadoop clusters across multiple cloud domains. The Hadoop clusters are created on-demand and are composed of virtual machines from multiple cloud sites linked with bandwidth-provisioned network pipes. The prototype uses an existing federated cloud control framework called Open Resource Control Architecture (ORCA), which orchestrates the leasing and configuration of virtual infrastructure from multiple autonomous cloud sites and network providers. ORCA enables computational and network resources from multiple clouds and network substrates to be aggregated into a single virtual slice of resources, built to order for the needs of the application. The experiments examine various provisioning alternatives by evaluating the performance of representative Hadoop benchmarks and applications on resource topologies with varying bandwidths. The evaluations examine conditions in which multi-cloud Hadoop deployments pose significant advantages or disadvantages during Map/Reduce/Shuffle operations. Further, the experiments compare multi-cloud Hadoop deployments with single-cloud deployments and investigate Hadoop Distributed File System (HDFS) performance under varying network configurations. The results show that networked clouds make cross-cloud Hadoop deployment feasible with high bandwidth network links between clouds. As expected, performance for some benchmarks degrades rapidly with constrained inter-cloud bandwidth. MapReduce shuffle patterns and certain Hadoop Distributed File System (HDFS) operations that span the constrained links are particularly sensitive to network performance. Hadoop's topology-awareness feature can mitigate these penalties to a modest degree in these hybrid bandwidth scenarios. Additional observations show that contention among co-located virtual machines is a source of irregular performance for Hadoop applications on virtual cloud infrastructure.

The state-of-the-art scheduler of containerized cloud services considers load balance as the only criterion; many other important properties, including application performance, are overlooked. In the era of Big Data, however, applications evolve to be increasingly more data-intensive thus perform poorly when deployed on containerized cloud services. To that end, this paper aims to improve today's cloud service by taking application performance into account for the next-generation container schedulers. More specifically, in this work we build and analyze a new model that respects both load balance and application performance. Unlike prior studies, our model abstracts the dilemma between load balance and application performance into a unified optimization problem and then employs a statistical method to efficiently solve it. The most challenging part is that some sub-problems are extremely complex (for example, NP-hard), and heuristic algorithms have to be devised. Last but not least, we implement a system prototype of the proposed scheduling strategy for containerized cloud services. Experimental results show that our system can significantly boost application performance while preserving high load balance.

Security of systems and services has been dominant research area in recent years as today's cloud services, big data and networked systems, especially when they provide wireless application access where personal and confidential data to be transmitted across the networked systems. Numerous tools and technologies are available to ensure system's security; however, external threats to computer systems and applications residents thereon, are also becoming more and more sophisticated and on the increase. Therefore, the key aim of this research is to integrate security engineering techniques and process with systems development life-cycle and process improvement frameworks. This paper presents a framework that consists of two components: 1) a security assessment model to looks at the existing security infrastructure of an organisation to determine its security maturity level; and 2) a security improvement maturity model to suggest an improvement mechanism for the organisation to progress from one maturity level to the next higher level. The intention is to provide a scheme to improve the organisation's Systems and network security with the aim that it becomes more efficient and effective than before.

Despite the substantial efficiency advancements, today's cloud services and related paradigms need vast amounts of energy and network, and this demand is only expected to grow. One of the main research questions is whether and how transitioning to edge computing may help reverse this trend. Simulations play a vital role in research since real-world deployments of edge or fog infrastructure are infrequent. In this research, we look at how to use a range of simulation tools to help with computation-intensive offloading in edge networks. This paper aims to determine the average energy consumption of compute nodes, as well as network traffic and applications, over experimental edge-based networks using an adaptive offloading approach and a blend of analytical and precisely defined modeling tools.

Background Organizations achieve agility, scalability, and enhanced resource utilization in multi-cloud environments, but face challenges in ensuring uniform and robust security across diverse cloud platforms. Variations in configuration and security mechanisms among providers hinder consistent policy enforcement and expose systems to data breaches and evasive threats. Additionally, the dynamic and distributed nature of multi-cloud operations broadens the attack surface, making real-time threat mitigation more complex. Methods To address these challenges, we introduced a groundbreaking software-defined networking (SDN)-enabled framework that incorporates deep learning for attack detection and adaptive security policy management. The framework consists of two primary components: the Software-Defined Multicloud Defense Controller (SDMDC), which enables centralized, real-time security policy enforcement (control plane), and the Multicloud Intrusion Detection System Gateways (MCIDS-G), which facilitate distributed threat detection across cloud platforms (data plane). The SDMDC’s integrated IDS is built using the Cross-Cloud Threat Transformer (CCTT) model, while the MCIDS-G’s regional IDS is based on the Long Short-Term Memory (LSTM) model. Additionally, the Lemurs Optimizer (LO) is employed in the SDMDC for cost-efficient policy management. SDMDC enforces security standards across all cloud environments where applications operate. Results The proposed solution addresses long-standing cloud security issues by combining coordinated global security strategies with automated threat detection and centralized policy management. SDMDC ensures consistent policy enforcement across cloud environments and manages ingress/egress and east–west traffic between cloud domains, including Amazon Web Service (AWS) and other service providers. The architecture supports dynamic resource orchestration and horizontal scalability, enabling adaptive performance under varying load conditions. The system also enables automatic policy implementation across platforms and facilitates real-time threat response to maintain consistent security. Conclusion The presented framework represents a significant advancement over existing multi-cloud protection solutions. It introduces new research directions, particularly in traffic management, firewall integration, and fully qualified domain name (FQDN) policy enforcement with proxy management.

Security enforcement mechanisms like execution monitors are used to make sure that some untrusted program complies with a policy. Different enforcement mechanisms have different strengths and weaknesses and hence it is important to understand the qualities of various enforcement mechanisms. This paper studies runtime enforcement mechanisms for reactive programs. We study the impact of two important constraints that many practical enforcement mechanisms satisfy: (1) the enforcement mechanism must handle each input/output event in finite time and on occurrence of the event (as opposed to for instance Ligatti's edit automata that have the power to buffer events for an arbitrary amount of time), and (2) the enforcement mechanism treats the untrusted program as a black box : it can monitor and/or edit the input/output events that the program exhibits on execution and it can explore alternative executions of the program by running additional copies of the program and providing these different inputs. It can not inspect the source or machine code of the untrusted program. Such enforcement mechanisms are important in practice: they include for instance many execution monitors, virtual machine monitors, and secure multi-execution or shadow executions. We establish upper and lower bounds for the class of policies that are enforceable by such black box mechanisms, and we propose a generic enforcement mechanism that works for a wide range of policies. We also show how our generic enforcement mechanism can be instantiated to enforce specific classes of policies, at the same time showing that many existing enforcement mechanisms are optimized instances of our construction.

The rapid adoption of cloud computing has transformed the way data is stored, shared, and accessed across organizationsand individuals. Despite its scalability and cost efficiency, cloud storage introduces serious security and privacy challenges, particularly when sensitive data is outsourced to third-party cloud service providers. Traditional access control mechanisms often rely on the cloud provider’s trustworthiness, which may expose data to unauthorized access, insider threats, and data breaches. To address these concerns, CryptCloud+ is proposed as a secure and expressive data access control framework that enforces fine-grained authorization directly through cryptographic techniques. CryptCloud+ focuses on ensuring data confidentiality while enabling flexible and policy-driven access control over encrypted cloud data. The system leverages encryption-based access control, where data is encrypted before being uploaded to the cloud, and only authorized users possessing valid cryptographic credentials can decrypt and access the data. This approach eliminates the need to trust the cloud service provider, as all sensitive operations related to data access are handled at the client side. A key contribution of CryptCloud+ is its support for expressive access policies, allowing data owners to define complex rules based on user attributes such as roles, departments, access levels, or time constraints. These policies enable fine grained access control without requiring data owners to manage individual permissions manually. The framework ensures that users can access only the data they are authorized for, while unauthorized users, including cloud administrators, are unable to infer any meaningful information from the encrypted data. The proposed system is implemented using Python, taking advantage of its robust cryptographic libraries, simplicity, and integration capabilities. Python-based modules handle key generation, encryption, decryption, and policy enforcement, making the system modular and easy to extend. The implementation demonstrates how secure key management and attribute-based access enforcement can be achieved efficiently in a real-world cloud environment. CryptCloud+ also addresses scalability and performance concerns by minimizing computation overhead during data access. Encryption and decryption operations are optimized to ensure that system performance remains practical even as the number of users and data files increases. Experimental results indicate that the framework maintains strong security guarantees while providing acceptable response times for authorized users. In addition to security, the system enhances usability by allowing seamless data sharing among multiple users without re encrypting data for each individual. This significantly reduces management complexity for data owners while preserving strict access control policies. The system design ensures compatibility with existing cloud storage services, making itadaptable to various deployment scenarios. Overall, CryptCloud+ presents a secure, flexible, and effiient solution for cloud data access control. By combining cryptographic enforcement with expressive policy definition and Python-based implementation, the frameworkstrengthens data security, protects user privacy, and improves trust in cloud storage systems. The proposed model demonstrates the feasibility of practical, cryptography-driven access control for modern cloud environments.

The enforcement of security policies in outsourced environments is still an open challenge for policy-based systems. On the one hand, taking the appropriate security decision requires access to the policies. However, if such access is allowed in an untrusted environment then confidential information might be leaked by the policies. Current solutions are based on cryptographic operations that embed security policies with the security mechanism. Therefore, the enforcement of such policies is performed by allowing the authorised parties to access the appropriate keys. We believe that such solutions are far too rigid because they strictly intertwine authorisation policies with the enforcing mechanism. In this paper, we want to address the issue of enforcing security policies in an untrusted environment while protecting the policy confidentiality. Our solution ESPOON is aiming at providing a clear separation between security policies and the enforcement mechanism. However, the enforcement mechanism should learn as less as possible about both the policies and the requester attributes.

Big players in cloud service market like Microsoft, Amazon and Google keeps changing their service price. Increasing cloud service offerings have motivated cloud providers to develop cloud service marketplace such as AWS, Google Apps and Cloud Surfing. However, these marketplaces lack dynamic pricing mechanism. The idea of dynamic pricing in the cloud services market has emerged in recent years and there is a need to design and implement an appropriate pricing model for managing the service demand and capacity. This paper reviews dynamic pricing implementation in cloud services and similar areas. This paper reviews recent concurrent cloud SLA negotiation frameworks. A concurrent cloud SLA negotiation mechanism with adaptive pricing is proposed. The proposed mechanism is designed to address multiplicity, information sharing and complexity issues in current frameworks. © 2016 American Scientific Publishers. All rights reserved.

Until today, Cloud providers only offer a limited set of non-negotiable service levels to their customers. Most often these service levels are expressed as guarantees for availability together with the offer to have access to a virtualised environment with a certain performance the customer may select from a number of predefined configurations. This simplifies the life of the provider, e.g., in terms of effort to maintain an adequate infrastructure, or regarding the effort for reducing the risk violating Service Level Agreements (SLAs) with its customer. In consequence, the current practice is slanted towards the benefit of the provider and ignores more specific requirements of its customers, e.g. regarding data protection and related guarantees. An analysis of the underlying problems shows two major fields to be worked on for solving the problem: Firstly, each provider uses its own proprietary technology for managing SLAs throughout their life-cycles. However, first standards are available and could be employed allowing the customer to use a single standard interface to negotiate with several providers. Secondly, there is neither a common set of terms to describe Cloud customers requirements regarding the Cloud services requested, nor, the back side of the medal, there is a common set of terms to describe the Quality of Service (QoS) of the Cloud providers' offerings. The focus of the presented work is (i) on the standard technology for negotiating and creating SLAs and (ii) the common terms and metrics describing providers' offerings and customers' requirements. Without these terms mapping the customers' requirements to cloud providers' offerings is a tedious manual and error-prone process and resulting SLAs will remain rudimentary. Additionally, both providers and their customers would benefit from more sophisticated and negotiable Service Level Agreements using existing standards. These SLAs are both (i) binding and monitorable agreements between the customer and the provider covering the customers' requirements and (ii) the basis for a QoS-aware Cloud resource management on the side of the provider including provisioning of physical machines and optimised allocation of virtual machines. Besides more traditional QoS aspects, terms related to Cloud Federation, Data Protection or Security Level Agreements are covered. Customers may use standards compliant agreement templates with the providers' offerings to select suitable providers for starting the negotiation to the extent the provider allows in the template. During the negotiation the provider may take into account the actual degree of capacity utilisation of its infrastructure and active SLAs, and may use the SLA resulting from a successful negotiation to further optimise its infrastructure through application and VM consolidation. The work presented in this thesis covers about a decade of research starting in the environment of Grid computing and ending with today's Cloud computing.

CloudLaunch: Discover and deploy cloud applications

End-to-end security is one of the biggest challenges for mobile clouds today: mobile cloud computing may mean the worst of cloud and device worlds regarding threats. Unfortunately, previous solutions considered the problem from one end only, lacking device-to-cloud virtual organizations (VOrgs), end-to-end VOrg isolation, and automated security supervision. This paper presents Orange MC2, a new security architecture and implementation overcoming such limitations. For homogeneous security SLA guarantees, execution environments in device and cloud domains are dynamically set up into VOrgs called MC2s, forming end-to-end security planes over the infrastructure. Strict plane separation is agnostic to underlying isolation mechanisms using a policy framework for security policy distribution and enforcement throughout an MC2. Security may be autonomically regulated at several levels of granularity in MC2s, both across domains and infrastructure layers. The paper also reports on a case study implementation. Results show that the architecture may be deployed effectively in practice, offering a first simple solution for selective end-to-end mobile cloud security, with interesting perspectives for a network operator.

The technological landscape is rapidly evolving, and organizations are increasingly recognizing the benefits of multi - cloud environments, which allow them to leverage different cloud platforms to meet specific requirements. This shift from a reliance on a single cloud provider underscores the need to embrace the adaptability and flexibility relevant to simultaneous multi - cloud utilization. Within the complexities of multi - cloud environments, effective cost management is key. This necessitates a strategic way to approach costs aligned with the unique needs of every organization. By deploying tools, implementing processes, and continuously monitoring tools, businesses can achieve cost savings while capitalizing on the advantages offered by different cloud providers. Additionally, as multi - cloud adoption becomes common in IT enterprises, the challenges related to managing multi - cloud infrastructure can discourage IT operations. This paper advocates for extending the DevOps approach to multi - cloud environments by emphasizing its potential to support and simplify application development, delivery, and maintenance. While adopting DevOps into a multi - cloud strategy may need compromises, they speed up democratizing development and maintenance work, thus fostering an organization?s competitive advantage. DevOps is an emerging field in IT infrastructure management and cloud automation; it is explored in continuous improvement and optimization. Organizations invest resources in enhancing efficiency, reducing redundancy, and optimizing costs in developing and deploying enterprise applications. Managing multiple environments can be challenging, necessitating continuous monitoring and optimization of operational tasks and improved collaboration across different organizational teams. The migration to the cloud and the prevalence of multiple cloud environments further complicate the management of DevOps in a multi - cloud setting, thus needing mechanisms to address key risks and challenges. It is vital for rapid software development to meet organizational objectives in the competitive landscape, which is highlighted by positioning DevOps as an essential technique. This approach allows enterprises to deliver high - quality software capabilities through automation by enhancing team communication and increasing efficiency across the software product lifestyle. The research problem depicts the shift in organizational workloads towards automation, mainly regarding cloud - based applications to keep up with the demand for new technologies and products. In this trend of multi - cloud deployments, it is important to ensure the security of workloads across diverse cloud platforms to allow organizational focus. While security controls may be uniform, differences in deployment approaches, architecture, tools, and processes bring challenges. The dynamic nature of the cloud further complicates security visibility addressed by Cloud Security Posture Management (CPSM) solutions. These solutions are key in providing visibility as organizations? cloud footprints expand. This comprehensive analysis delves into the complexities of multi - cloud deployments in DevOps, providing insights into the challenges and strategies employed to navigate this landscape.

We present an approach to the proactive enforcement of provisions and obligations, suitable for building policy enforcement mechanisms that both prevent and cause system actions. Our approach encompasses abstract requirements for proactive policy enforcement, a system model describing how enforcement mechanisms interact with and control target systems, and concrete policy languages and associated enforcement mechanisms. As examples of policy languages, we consider finite automata and timed dynamic condition response (DCR) graphs. We use finite automata to illustrate the basic principles and DCR graphs to show how these principles can be adapted to a practical, real-time policy language. In both cases, we show how to algorithmically determine whether a given policy is enforceable and, when this is the case, construct an associated enforcement mechanism. Our approach improves upon existing formalisms in two ways: (1) we exploit the target system’s existing functionality to avert policy violations proactively, rather than compensate for them reactively; and (2) rather than requiring the manual specification of remedial actions in the policy, we deduce required actions directly from the policy.

Cloud computing has emerged as a popular computing paradigm in recent years. However, today's cloud computing architectures often lack support for computer forensic investigations. Analyzing various logs (e.g., process logs, network logs) plays a vital role in computer forensics. Unfortunately, collecting logs from a cloud is very hard given the black-box nature of clouds and the multi-tenant cloud models, where many users share the same processing and network resources. Researchers have proposed using log API or cloud management console to mitigate the challenges of collecting logs from cloud infrastructure. However, there has been no concrete work, which shows how to provide cloud logs to investigator while preserving users' privacy and integrity of the logs. In this paper, we introduce Secure-Logging-as-a-Service (SecLaaS), which stores virtual machines' logs and provides access to forensic investigators ensuring the confidentiality of the cloud users. Additionally, SeclaaS preserves proofs of past log and thus protects the integrity of the logs from dishonest investigators or cloud providers. Finally, we evaluate the feasibility of the scheme by implementing SecLaaS for network access logs in OpenStack -- a popular open source cloud platform.