Software Defined Network Function Virtualization Framework for Securing Cloud with Data Fusion and Machine Learning Techniques

Cloud storage service is a prominent application for recent years. Several famous cloud service providers (CSPs) offer some free volume to users and provide the file synchronization as a convenient function. However, whether the files stored at a CSP are secure or not is a main concern for users. However, it is reported that some famous CSPs lack sound security protection, like no password verification or the missing of stored files. Therefore, how to ensure the security strength of CSPs is an important issue. Nevertheless, most of current CSPs did not provide convictive security mechanism to beef up their security. For example, most of CSPs only claim that they will encrypt the stored files in their storage servers, but the encryption key are picked by the CSPs themselves. In this paper, a practical third-party auditor (TPA) prototype for cloud storage service is proposed to strengthen the properties of confidentiality, integrity, and availability. Moreover, the TPA cannot realize the content of the stored file during verification. Our scheme also provides a useful function to measure the failure time of the CSP.

Data storage is an important application of cloud computing, where clients can remotely store their data into the cloud. By uploading their data into the cloud, clients can be relieved from the burden of local data storage and maintenance. This new paradigm of data storage service also introduces new security challenges. One of these risks that can attack the cloud computing is the integrity of the data stored in the cloud. In order to overcome the threat of integrity of data, the client must be able to use the assistance of a Third Party Auditor (TPA), in such a way that the TPA verifies the integrity of data stored in cloud with the client's public key on the behalf of the client. The existing schemes with single verifier (TPA) may not scale well for this purpose. In this paper, we propose An Efficient Distributed Verification Protocol (EDVP) to verify the integrity of data in a distributed manner with support of multiple verifiers (Multiple TPAs) instead of single Verifier (TPA). Through the extensive security, performance and experimental results, we show that our scheme is more efficient than single verifier based scheme.

A cloud storage system consisting of a collection of storage server. In cloud, storing data in a third party causes serious concern on data confidentiality. The user stores the encrypted data in the multiple storage servers and with a key. The encryption scheme supports encoding operations in the encrypted message. Forwarding operation performs by the re-encryption key. Each storage server uses the re encryption key to re encrypt its word symbols. The user sends a request to key server for retrieve a message. The key server randomly chose the storage servers to get code codeword symbols and decrypted codeword symbols to get a message.

Cluster-based storage systems connected with TCP/IP networks are expected to achieve a high throughput by striping files across multiple storage servers. However, for the storage system interconnected with the TCP/IP network, several critical issues, like Incast effect and data access interference, invalidate the assumption that higher access parallelism always results in increased I/O throughput. To address this issue, we propose a new file striping strategy, named as storage server grouping (SSG), which changes file striping pattern across the storage servers based on the analysis of file popularity and impact of the number of storage servers on the clients’ perceived performance (I/O speedup) to reduce the interference of data accesses to popular files and avoid dramatic reduction of system throughput caused by the Incast effect. Our experimental evaluation shows that SSG can improve I/O throughput by 22.1% on average.KeywordsThe Incast EffectInterferenceFile StripingLustre

The evolution of interconnected systems and the evolving demands in service requirements have led to data centers integrating multiple heterogeneous technologies that must coexist. Consequently, the resource management and the security of the infrastructure are becoming more complex than in traditional scenarios. In this context, technologies such as Software-Defined Networking (SDN) or Network Function Virtualization (NFV) are being embraced as mechanisms that facilitate communication management. The integration of both technologies into a single framework, termed Software-Defined NFV (SDNFV) introduces a multitude of tools for managing the security of the data center’s resources. This work delineates the primary characteristics of the evolution of these communication networks and their application to information security and communications within a data center. It presents an illustrative use case demonstrating the application of these next-generation technologies to detect and mitigate a security issue through virtualized network functions deployed in containers.

Hadoop framework has been evolved to manage big data in cloud. Hadoop distributed file system and MapReduce, the vital components of this framework, provide scalable and fault-tolerant big data storage and processing services at a lower cost. However, Hadoop does not provide any robust authentication mechanism for principals’ authentication. In fact, the existing state-of-the-art authentication protocols are vulnerable to various security threats, such as man-in-the-middle, replay, password guessing, stolen-verifier, privileged-insider, identity compromization, impersonation, denial-of-service, online/off-line dictionary, chosen plaintext, workstation compromization, and server-side compromisation attacks. Beside these threats, the state-of-the-art mechanisms lack to address the server-side data integrity and confidentiality issues. In addition to this, most of the existing authentication protocols follow a single-server-based user authentication strategy, which, in fact, originates single point of failure and single point of vulnerability issues. To address these limitations, in this paper, we propose a fault-tolerant authentication protocol suitable for the Hadoop framework, which is called the efficient authentication protocol for Hadoop (HEAP). HEAP alleviates the major issues of the existing state-of-the-art authentication mechanisms, namely operating-system-based authentication, password-based approach, and delegated token-based schemes, respectively, which are presently deployed in Hadoop. HEAP follows two-server-based authentication mechanism. HEAP authenticates the principal based on digital signature generation and verification strategy utilizing both advanced encryption standard and elliptic curve cryptography. The security analysis using both the formal security using the broadly accepted real-or-random (ROR) model and the informal (non-mathematical) security shows that HEAP protects several well-known attacks. In addition, the formal security verification using the widely used automated validation of Internet security protocols and applications ensures that HEAP is resilient against replay and man-in-the-middle attacks. Finally, the performance study contemplates that the overheads incurred in HEAP is reasonable and is also comparable to that of other existing state-of-the-art authentication protocols. High security along with comparable overheads makes HEAP to be robust and practical for a secure access to the big data storage and processing services.

The volume of the coming data in HEP is growing. The volume of the data to be held for a long time is growing as well. Large volume of data – big data – is distributed around the planet. The methods, approaches how to organize and manage the globally distributed data storage are required. The distributed storage has several examples for personal needs like own-cloud.org, pydio.com, seafile.com, sparkleshare.org. For enterprise-level there is a number of systems: SWIFT - distributed storage systems (part of Openstack), CEPH and the like which are mostly object storage. When several data center’s resources are integrated, the organization of data links becomes very important issue especially if several parallel data links between data centers are used. The situation in data centers and in data links may vary each hour. All that means each part of distributed data storage has to be able to rearrange usage of data links and storage servers in each data center. In addition, for each customer of distributed storage different requirements could appear. The above topics are planned to be discussed in data storage proposal.

Public auditing for cloud storage is of critical importance as the users relies on semi-trusted cloud storage service for data sharing which does not guarantee/assure the integrity of the data being stored. With public auditing of clouds, users resort to a third party auditor (TPA) who verify and assure the internal consistency/lack of corruption of their data in cloud storage services. Despite the good work previously done by researchers in auditing while preserving privacy, still available mechanisms do not efficiently conceal users' privacy from TPA during sharing of data and yet supporting data and group dynamics. In this paper, we propose privacypreserving auditing scheme that exploits the ring signature to calculate verifications needed to audit data integrity.In this proposed approach, the identities of the user are kept private from public verifier and dynamic groups are supported -that is a new user can be added into the group and an existing group member can be revoked during data sharing.

Battery systems are crucial components for mission-critical data centers. Without secure energy backup, existing under-provisioned data centers are largely unguarded targets for cyber criminals. Particularly for today's scale-out servers, power oversubscription unavoidably taxes a data center's backup energy resources, leaving very little room for dealing with emergency. Besides, the emerging trend towards deploying distributed energy storage architecture causes the associated energy backup of each rack to shrink, making servers vulnerable to power anomalies. As a result, an attacker can generate power peaks to easily crash or disrupt a power-constrained system. This study aims at securing data centers from malicious loads that seek to drain their precious energy storage and overload server racks without prior detection. We term such load as Power Virus (PV) and demonstrate its basic two-phase attacking model and characterize its behaviors on real systems. The PV can learn the victim rack's battery characteristics by disguising as benign loads. Once gaining enough information, the PV can be mutated to generate hidden power spikes that have a high chance to overload the system. To defend against PV, we propose power attack defense (PAD), a novel energy management patch built on lightweight software and hardware mechanisms. PAD not only increases the attacking cost considerably by hiding vulnerable racks from visible spikes, it also strengthens the last line of defense against hidden spikes. Using Google cluster traces we show that PAD can effectively raise the bar of a successful power attack: compared to prior arts, it increases the data center survival time by 1.6~11X and provides better performance guarantee. It enables modern data centers to safely exploit the benefits that power oversubscription may provide, with the slightest cost overhead.

Cloud storage is a new business solution for remote backup outsourcing, as it offers an abstraction of infinite storage space for clients to host data backups in a pay-as you-go manner. However it is indispensable for cloud service providers (CSPs) to provide security techniques for managing their storage services. We tackle this issue by implementing the framework for multicloud storage in which the client's data is manipulated with fine grained policy based access control. In addition an efficient cooperative Provable data possession (CPDP) scheme is designed which offers an efficient verification on the integrity and availability of stored data. The proposed system includes addressing two security issues. First provide guarantees of access control in which only authorized parties can access the outsourced data. Second provides cooperative PDP scheme to support dynamic scalability on multiple storage servers. Extensive security and performance analysis show that the proposed schemes are highly efficient and provably secure.

Exploiting the cloud storage hierarchy both within and across data-centers of different cloud providers empowers Internet applications to choose data centers (DCs) and storage services based on storage needs. However, using multiple storage services across multiple data centers brings a complex data placement problem that depends on a large number of factors including, e.g., desired goals, storage and network characteristics, and pricing policies. In addition, dynamics e.g., changing user locations and access patterns, make it impossible to determine the best data placement statically. In this paper, we present TripS, a lightweight system that considers both data center locations and storage tiers to determine the data placement for geo-distributed storage systems. Such systems make use of TripS by providing inputs including SLA, consistency model, fault tolerance, latency information, and cost information. With given inputs, TripS models and solves the data placement problem using mixed integer linear programming (MILP) to determine data placement. In addition, to adapt quickly to dynamics, we introduce the notion of Target Locale List (TLL), a pro-active approach to avoid expensive re-evaluation of the optimal placement. The TripS prototype is running on Wiera, a policy driven geo-distributed storage system, to show how a storage system can easily utilize TripS for data placement. We evaluate TripS/Wiera on multiple data centers of AWS and Azure. The results show that TripS/Wiera can reduce cost 14.96% ∼ 98.1% based on workloads in comparison with other works' approaches and can handle both short- and long-term dynamics to avoid SLA violations.

Aim: Cloud computing (CC) is a revolutionary new archetype in which users pool their computing resources to provide greater efficiency for everyone. Data become increasingly vulnerable to diverse security threats from attackers when millions of users circulate the same network for data transmission. Protecting these reports has shifted to the vanguard of priorities. The existing data security approach prioritizes protecting data at rest in cloud storage but gives less thought to protecting data in transit. During transmission, the data are vulnerable to intrusion attempts. Methods: The third-party auditor is provided access to data during the transfer phase, which is also the current pattern. As the attacker can now pose as a trusted third party, it makes the data more susceptible to unauthorized access. However, growing concerns regarding data privacy and security have made outsourcing sensitive information to faraway data centers difficult. As a result, new security concerns in the cloud necessitate an improved version of the tried-and-true advanced encryption standard (AES) algorithm. Key aspects presented in this study include a secure and private framework for owner data. It improves upon the 128 AES technique by adding a second round of encryption using a different key, allowing for a throughput of 1000 blocks per second. However, the standard method uses a single round key and only 800 blocks per second. The suggested approach reduces energy consumption, improves load distribution, and optimizes network trust and resource management. Results: The proposed architecture allows for the use of AES with cipher lengths of 16, 32, 64, and 128 bytes. The effectiveness of the algorithm in terms of attaining target quality metrics is illustrated graphically via simulation results. This strategy reduces power consumption by 13.23%, network utilization by 12.43%, and delay by 16.53%, according to the outcomes. Conclusion: As a result, the recommended architecture enhances safety, cuts down on wasted resources, and speeds up the rollout of computational cloud services.

Accurate prediction of data center workload, an important technology of cloud computing, is particular in improving resource utilization and reducing energy consumption. However, the workload presents a quasi-volatile, is challenging to obtain accurate results in cloud resource management. In this paper, the three-way ensemble prediction for workload in the data center is first proposed to improve the accuracy of the prediction. Moreover, we first defined the workload as the stable period, the volatility period, and the jitter period and adopted a simulated annealing algorithm to learn the optimal threshold to divide the workload. Then, according to the basic idea of the three-way decision, we assigned various prediction models based on workload characteristics and a priori error prediction to improve the prediction accuracy further. Finally, all the experimental results carried on the CPU load monitoring logs from Google cluster trace and compared with ARIMA, NN, and DMASVR-3WD, TWD-RCPM improve the accuracy of workload prediction by 69.0%, 68.6% and 72.6%, respectively.

Large scale peer-to-peer (P2P) systems are envisioned as a way to provide online storage service. For a reliable storage service, the participating peers are required to maintain strict commitments for their online duration. On the other hand, recent results show that users participating in volunteer computing collectively exhibit certain patterns in terms of their long-term availability, a metric that denotes periodic online durations for a considerably long time interval. In this article we introduce PeerVault, a P2P platform that leverages the long-term availability of the computer users to form a distributed reliable storage service, targeted to backup of personal data. We further present a distributed monitoring scheme that assists PeerVault to detect peer churns and ensure the reliability of the proposed backup service. To the best of our knowledge, this is the first effort to describe the architecture of a reliable P2P backup service exploiting the long-term availability and idle resources of computing devices. We conduct experiments based on the availability traces of hundreds of thousands of hosts from the SETI@home computing project. The obtained results show that the proposed approach is effective in terms of availability as well as reliability of the offered backup service.

Management of cloud resources and social change in a multi-tier environment: A novel finite automata using ant colony optimization with spanning tree