Privacy-sensitive VM retrospection

Abstract: Encryption is essential in preventing unauthorized access to sensitive data in light of the growing concerns about data security in cloud computing. Homomorphic encryption promises to enable secure calculations on encrypted data without the need for decryption, particularly for cloud-based operations. To evaluate the effectiveness and applicability of several homomorphic encryption algorithms for safe cloud computing, we compare and contrast them in this research paper. Partially homomorphic encryption (PHE), somewhat homomorphic encryption (SHE), and fully homomorphic encryption (FHE) are the three basic homomorphic encryption subtypes that we examine. The implications of this study can aid cloud service providers and organizations in selecting the most appropriate homomorphic encryption scheme based on their specific security requirements and performance considerations. The research contributes to the ongoing efforts to enhance data privacy in cloud computing environments, opening new possibilities for secure data processing in an increasingly connected digital world. The exploration of homomorphic encryption schemes in this study opens new avenues for research and development in the field of cryptographic techniques. As technology continues to evolve, so too must our approaches to safeguarding data. This research serves as a catalyst for further innovations in homomorphic encryption algorithms, enabling even more efficient and robust methods for secure data processing in cloud environments and beyond. The insights derived from this research paper not only empower cloud service providers and organizations to make informed decisions about selecting the most appropriate homomorphic encryption scheme but also contribute to the broader mission of fortifying data privacy and security in cloud computing.

The amount of Internet data is significantly increasing due to the development of network technology, inducing the appearance of big data. Experiments have shown that deep mining and analysis on large datasets would introduce great benefits. Although cloud computing supports data analysis in an outsourced and cost-effective way, it brings serious privacy issues when sending the original data to cloud servers. Meanwhile, the returned analysis result suffers from malicious inference attacks and also discloses user privacy. In this paper, to conquer the above privacy issues, we propose a general framework for Preserving Multiparty Data Privacy (PMDP for short) in cloud computing. The PMDP framework can protect numeric data computing and publishing with the assistance of untrusted cloud servers and achieve delegation of storage simultaneously. Our framework is built upon several cryptography primitives (e.g., secure multiparty computation) and differential privacy mechanism, which guarantees its security against semihonest participants without collusion. We further instantiate PMDP with specific algorithms and demonstrate its security, efficiency, and advantages by presenting security analysis and performance discussion. Moreover, we propose a security enhanced framework sPMDP to resist malicious inside participants and outside adversaries. We illustrate that both PMDP and sPMDP are reliable and scale well and thus are desirable for practical applications.

Data and document privacy concerns are increasingly important in the online world. In Cloud Computing, the story is the same, as the secure processing of personal data represents a huge challenge The main focus is to to preserve and protect personally identifiable information (PII) of individuals, customers, businesses, governments and organisations. The current use of anonymization techniques is not quite efficient because of its failure to use the structure of the datasets under consideration and inability to use a metric that balances the usefulness of information with privacy preservation. In this work, an adaptive lossy decomposition algorithm was developed for preserving privacy in cloud computing. The algorithm uses the foreign key associations to determine the generalizations possible for any attribute in the database. It generates penalties for each obscured attribute when sharing and proposes an optimal decomposition of the relation. Postgraduate database of Federal University of Agriculture, Abeokuta, Nigeria and Adult database provided at the UCIrvine Machine Learning Repository were used for the evaluation. The result shows a system that could be used to improve privacy in cloud computing.

Virtual machine (VM) management is one of the key problems in cloud data centers. Many efforts have been put on finding an (approximate) optimal placement of VMs at physical machines (PMs) to achieve high resource utility. In this paper, we consider to reduce the startup delay of VMs, which is a key issue for improving user experience and resource utility. The basic idea of our work is to cache VM images at PMs so as to reduce the time of VM image retrieval. By handling VM placement and image placement jointly and de-centrally, we design a joint placement algorithm and an associated layered transport VM selection algorithm, so as to start VMs quickly in the meanwhile save some calculation resources. The key point of our algorithms lies in how to accelerate the startup of VM with limited information in a distributed fat-tree network. The proposed algorithms are evaluated by extensive simulations using a distributed system simulator SimGrid. The results show that our algorithms just lost a little performance in most cases, compared with the centralized algorithm and a classical cache placement strategy.

Patient Health Record (PHR) is a complete Patient related health data, which is getting stored in cloud computing to gain cost benefit and better access control.In maintaining PHR, cloud computing plays an inevitable role, since small hospitals and physicians are not affordable to maintain own servers to keep PHRs for cost and security reasons .Providing accessibility to variable stake holders like Patients, Physicians, Hospitals and Insurance Providers, become a tedious process in private individual servers with encryption mechanisms.Cloud solution ensures that PHRs ' availability to the necessary stake holders at any point of time.In any country , there are laws which governs to maintain privacy of patient health records, and hence maintaining PHRs in cloud are subjected to privacy concerns and high risk of getting exploited.There are various encryption schemes exist to preserve PHR's security and privacy in Cloud computing.In this paper, we propose a secure PHR accessing scheme for dynamic environment to preserve privacy in semi trusted cloud servers .

Multimedia processing with cloud is prevalent now, which the cloud server can provide abundant resources to processing various multimedia processing tasks. However, some privacy issues must be considered in cloud computing. For a secret image, the image content should be kept secret while conducting the multimedia processing in the cloud. Multimedia processing in the encrypted domain is essential to protect the privacy in cloud computing. Hu et al. proposed a novel framework to perform complex image processing algorithms in encrypted images with two cryptosystems: additive homomorphic encryption and privacy preserving transform. The additive homomorphic cryptosystem used in their scheme causes huge ciphertext expansion and greatly increases the cloud’s computation. In this paper, we modified their framework to a two-cloud scheme, and also implemented the random nonlocal means denoising algorithm. The complexity analysis and simulation results demonstrate that our new scheme is more efficient than Hu’s under the same denoising performance.

In cloud computing, searchable encryption scheme over outsourced data is a hot research field. However, most existing works on encrypted search over outsourced cloud data follow the model of “one size fits all” and ignore personalized search intention. Moreover, most of them support only exact keyword search, which greatly affects data usability and user experience. So how to design a searchable encryption scheme that supports personalized search and improves user search experience remains a very challenging task. In this paper, for the first time, we study and solve the problem of personalized multi-keyword ranked search over encrypted data (PRSE) while preserving privacy in cloud computing. With the help of semantic ontology WordNet, we build a user interest model for individual user by analyzing the user’s search history, and adopt a scoring mechanism to express user interest smartly. To address the limitations of the model of “one size fit all” and keyword exact search, we propose two PRSE schemes for different search intentions. Extensive experiments on real-world dataset validate our analysis and show that our proposed solution is very efficient and effective.

There are many definitions of the "cloud" and many historical and contemporary synonyms and subcategories (utility computing, grid computing, Platform-as-a-Service, etc.). All of these terms and ideas point toward the same trend: A consolidation of computing, storage, and networking resources within a single, typically shared infrastructure. Naturally, with many stakeholders and users operating side-by-side in a cloud environment, the security and privacy challenges are legion. But the news isn't all bad. Cloud computing also offers opportunities to improve security through the judicious use of virtualization, consolidation of security administrator duties, and general opportunities for rethinking security engineering in a new, centralized platform. Since its inception in 2009, the Cloud Computing Security Workshop (CCSW) has become the premier venue for research on security and privacy in cloud computing. It has also produced some of the most popular and highly cited papers in the CCS family of workshops, and drawn an excellent and diverse range of invited speakers. The workshop aims to bring together researchers and practitioners in all security aspects of cloudcentric and outsourced computing. Like CCS, its parent conference, CCSW offers a program spanning a broad range of topics and disciplines, including network security, consumer privacy, virtualization, secure hardware, and cryptography---to name just a few. This year, we received 28 full-paper submissions from 15 countries and five continents. All submissions received at least three reviews, and most received four. After extensive discussions and vigorous online debate, 11 submissions were accepted to appear at the workshop. These papers cover topics such as probing cloud infrastructure, securely outsourcing computation, authenticating storage using trusted hardware, secure code execution, auditing, and various flavors of encryption. This year also continued the CCSW tradition of high-profile invited speakers, with keynotes from Dr. Jesus Luna, Research Director at the Cloud Security Alliance, Dr. Marnix Dekker, Security Expert and Information Security Officer at the European Network and Information Security Agency (ENISA), and Slava Kavsan, Partner Security Development Manager (Azure) at Microsoft.

With the tremendous growth in migration to cloud computing for traditional applications, the demand for virtualization is the new need for further research and enhancements. The high demand for virtualization in cloud computing is been addressed with the technology enhancement and in terms of virtual machines. Majorly the hardware component management of virtual machine is considerably reaching the pick of research with the recent advancements by multiple companies and open source researches like AlphaVM, Hyper-V, Integrity Virtual Machines, JPC (Virtual Machine), PowerVM, Sun xVM, VMware Workstation and z LPARs. Another most important component of virtualization and virtual machine image storage is been the bottleneck for the further advancement. The limitations are been addressed by clustering and storage area networking, however these existing solutions are no match for the industrial grade demand for the VM image storage requirements.Hence in this work we propose a cloud based virtual machine storage framework designed for large scale deployment satisfying the other needs for storage features like replication and measurements of performance improvements. This work also demonstrates the advancements in performance for virtualization management

Cloud computing is challenging conventional wisdom and practices in the management of IT resources and capabilities; at the same time, the technical underpinnings of cloud computing offer unique opportunities and levers for addressing these challenges. In this talk, I will talk about a number of new research thrusts brought forth by the cloud computing paradigm. First, the large magnitude of a typical virtual machine (VM) image and the large volume of common VM libraries have major performance implications for many cloud operations. Fortunately, content similarity that often exists across distinct VM images may be exploited to optimize the transfer and storage of VM images. Second, resource virtualization in the cloud is at odds with the assumptions in traditional software license models, which must be adapted or extended for virtualized environments. There is also a critical need for new license management techniques to help cloud-based software users achieve cost-effectiveness and compliance. Third, cloud infrastructure is evolving towards heterogeneity and is becoming programmable and composable. The so-called Software-Defined Infrastructure promises agility, flexibility, efficiency, and resilience through continuous and proactive optimization of heterogeneous resources to meet the changing requirements of a wide variety of workloads. For each of these research thrusts, I will discuss the specific technical issues and some initial work conducted at IBM Research.

Hypervisor-enabled virtualization is a promising technology to deploy applications and implement Virtual Machine (VM) migration on cloud data centers. However, one critical aspect in hypervisor-based solution is that to deploy applications each VM is installed with a dedicated guest OS along with the requirement of binaries and library files and substantially large VM's image size. Therefore, it is a significant concern for data center administrators because it causes performance overheads. To solve these issues, a new paradigm of virtualization technology that has attracted considerable attention is containerization. Although, progress has been made to address container-based virtualization, there has been less attention to explore the issue of performance evaluation of container and VM in a migration environment. The main contribution of this research study is to develop an experimental setup to implement and evaluate the performance of LXD/CR container-based migration technique and compared it with the pre-copy VM migration scheme. To conduct this performance evaluation, first we modified Linux kernel and implemented LXD which uses liblxc to launch container, then migration of the running container is facilitated using a checkpoint/restore mechanism of CRIU technique. To ensure the applicability and validity for real-time cloud infrastructure, we executed a wide variety of benchmarks such as web server, CPU-intensive, disk I/O and database. From the results obtained, it is found that compared to pre-copy VM migration scheme, LXD/CR container migration technique reduces the downtime, migration time, amount of data transferred and the number of pages transferred by 75.66%, 65.55%, 76.63%, and 76.78%, respectively. In addition, the migration overhead caused is reduced by 55.89% w.r.t. CPU utilization and 76.52% w.r.t. RAM utilization. This being an important contribution for migrating the running applications efficiently and consequently increase the business value of the cloud infrastructure providers.

A virtual machine (VM) has been serving as a crucial component in cloud computing with its rich set of convenient features. The high overhead of a VM has been well addressed by hardware support such as Intel virtualization technology (VT), and by improvement in recent hypervisor implementation such as Xen, KVM, etc. However, the high demand on VM image storage remains a challenging problem. Existing systems have made efforts to reduce VM image storage consumption by means of deduplication within a storage area network (SAN) cluster. Nevertheless, an SAN cannot satisfy the increasing demand of large-scale VM hosting for cloud computing because of its cost limitation. In this paper, we propose Liquid, a scalable deduplication file system that has been particularly designed for large-scale VM deployment. Its design provides fast VM deployment with peer-to-peer (P2P) data transfer and low storage consumption by means of deduplication on VM images. It also provides a comprehensive set of storage features including instant cloning for VM images, on-demand fetching through a network, and caching with local disks by copy-on-read techniques. Experiments show that Liquid's features perform well and introduce minor performance overhead.

This paper analyzes the current problems in the data security and privacy of cloud computing. On the basis, this paper mainly research about the legitimacy and validity of research cloud computing process. First of all, this paper understand the concept of cloud computing technology, according to the working principle of the structure model of the cloud computing service analyzes the existence of data security and privacy. Cloud computing service providers for cost savings, or application access layer has invasion of illegal users, so cloud computing task submitted by the legitimate user will not be executed or not executed completely, and the users will get that a random outcome, and task submitted by illegal users may be was carried out. Research on the remote computing verification problem, analysis of the existing research on security work, found that the existing calculation in advance and the second validation of remote computing method for cloud computing users spending too big, this paper combines the characteristics of cloud computing mass data processing, puts forward the remote computing verification method based on the third-party certification, efficient and low consumption to ensure security.

Virtual machine (VM) images (VMIs) often share common parts of significant size as they are stored individually. Using existing de-duplication techniques for such images are non-trivial, impose serious technical challenges, and requires direct access to clouds' proprietary image storages, which is not always feasible. We propose an alternative approach to split images into shared parts, called fragments, which are stored only once. Our solution requires a reasonably small set of base images available in the cloud, and additionally only the increments will be stored without the contents of base images, providing significant storage space savings. Composite images consisting of a base image and one or more fragments are assembled on-demand at VM deployment. Our technique can be used in conjunction with practically any popular cloud solution, and the storage of fragments is independent of the proprietary image storage of the cloud provider.

With the rapid development of virtualization technology, virtual machine (VM) is widely used by cloud computing - the more and more popular computing paradigm. Thus, in order to guarantee the security of cloud computing, it is necessary to securely identify the kernel of VM, the software stack running on VM and the hardware platform which VM relies on. This paper designs a system of trusted connection based on virtual machine architecture and implements a system prototype. Our system not only can securely measure and identify the kernel of VM, the software stack running on VM and the hardware platform which VM relies on, but also can realize isolations to untrusted VMs. There are three main parts in our system: trusted chain, attestation and isolation. The experiments described in this paper prove that our system ensures trusted connection of VMs and achieves isolations to untrusted VMs. The performance of our system is also analyzed and evaluated. According to the analysis results, our system is practical in terms of performance.