Grid and Cloud Computing Security

1. UNIT – V
UNIT V SECURITY
Trust models for Grid security environment –Authentication and
Authorization methods – Grid security infrastructure – Cloud
Infrastructure security: network, host and application level –
aspects of data security, provider data and its security, Identity and
access management architecture, IAM practices in the cloud, SaaS,
PaaS, IaaS availability in the cloud, Key privacy issues in the cloud.

2. INTRODUCTION
• The security is an important factor in planning and maintaining a grid
as well as cloud environment.
• Secure operations in both the environments requires applications and
services to be capable of supporting variety of security functions such
as authentication, authorization, credential conversion, auditing and
delegation.
• Trust – belief in the competence of an entity
• 1 – trustworthy
• 0 - untrustworthy

3. Trust Models for Grid Security Environment
• Security is the important factor which has to be handled carefully.
• The lack of security may generate various issues like
• Denial of access
• Faulty and malicious operations
• Network sniffing
• Attack provenance
• System level vulnerabilities
• The domain of grid is very large which span across multiple locations.
Therefore trusted and secure end-to-end delivery of grid services is
required.

4. • Two parameter used in security assurance condition : TI ≥ SD
• A user job demands the resource site to provide security assurance
by issuing a security demand (SD).
• The site needs to reveal its trustworthiness, called its trust index (TI).
• These attributes and their values are dynamically changing and
depend heavily on
• the trust model,
• security policy,
• accumulated reputation,
• self-defense capability,
• attack history and site vulnerability.

5. • Three challenges:
• How to integrate new security infrastructure for existing system.
• Interoperability between different hosting environment.
• Maintaining trust relationship between different hosting sites.
• Different trust models:
• Conventional trust model
• Reputation based trust model
• Fuzzy based trust model

6. Conventional trust model
Grid resource request
Security controller
Trustworthiness
Interfernce mechanism with aggregation
Reputation factors Recommended trust safeguards
Response and TAT firewall
Utilization rate IDS
Success rate IPS
Avg slowdown ratio Antivirus

7. Reputation based trust model
• In reputation based model, the user sent job to resource site for
computation but it will be delivered only if site is trustworthy to fulfill
user demand.
• assessed according to such factors as intrusion detection, firewall,
response capabilities, anti-virus capacity, and so on.
• The safeguards are used to protect site itself from various attacks
using IDS, IPS, firewalls or antivirus.
• A positive experience associated with a site will improve its
reputation.
• On the contrary, a negative experience with a site will decrease its
reputation

8. Fuzzy based trust model
• The fuzzy based model is based on Security Demand(SD) and Trust
Index(TI) of a site.
• two-level fuzzy logic to estimate the aggregation of numerous
• trust parameters and security attributes into scalar quantities that are
easy to use in the job scheduling and resource mapping process.
• TI – 1- high risk 0 – risk free
• The fuzzy inference is accomplished through four steps:
fuzzification,inference, aggregation, and defuzzification.
• SD > TI , the trust model could deduce detailed security features to
guide the site security upgrade as a result of tuning the fuzzy system.

9. Authentication and Authorization
Methods
• Authentication and Authorization methods are the security
mechanisms work together to prevent security attacks in grid
environment.

10. Authentication Methods
• The authentication is a process of checking authenticity of entities
using different authentication methods like
• Password(User name, Password)
• Public key Infrastructure(PKI)(CA)
• Kerberos(Session Key)

11. Authorization Methods
• The authorization is a process of determining who is allowed to
access which shared resources under what condition.
• Three types of authorities namely
• Attribute Authorities – issue attribute assertions
• Policy Authorities – issues authorization policies wrt resources
• Identity Authorities – issues certificates using Public key infrastructure (PKI)
• Three basic entities
• Subject – defines a set of policies determines how its authorization used
• Resource – component of the system
• Authority – capable of issuing validating and revoking the proofs of subjects
of rights

12. Authentication Models
2 1
4 3
Authorization
authority
Subject
Resource
1. Subject push authorization model
The user conducts handshake with the authority first and then with the resource
site in a sequence.

13. 2. Resource pull authorization model
3 2
• puts the resource in the middle.
• The user checks the resource first. Then the resource 1 4
• contacts its authority to verify the request, and the
Authority authorizes at step 3.
• Finally the resource accepts or rejects the request from the subject at
step 4
Authorization
authority
Resource
Subject

14. 3. The agent based authorization model
• puts the resource in the middle.
• The user checks the resource first. Then the resource
• contacts its authority to verify the request, and the authority
• authorizes at step 3. Finally the resource accepts or rejects
the request from the subject at step 4
1 4
3 2
Subject
Resource
Authorization
authority
Authorization
agent

15. Grid Security Infrastructure
• Grid environment seeks a security infrastructure that meets the
following basic requirements.
• Easy to use
• Meets the VO’s security when working with site policies
• An appropriate authentication and encryption for all interactions
• GSI also part of globus toolkit and provides basic security services
• Message protection
• Authentication and delegation
• Authorization

16. GSI
• Functional Layers of GSI
• Transport Level Security of GSI
• Message Level Security of GSI
• Authentication and Delegation of GSI
• Trust Delegation of GSI

17. Functional Layers of GSI
• GT4 offers various WS and pre-WS authentication and authorization
capabilities.
• Four functions are
• Message protection
• Authentication
• Delegation
• Authorization

18. Transport Level Security of GSI
• TLS is based on SOAP(Simple Object Access Protocol) message passed
over a network connection protected by TLS.
• TLS is responsible for providing
• Integrity protection
• Privacy
• TLS performs the authentication via
•Username
•Password

19. Message Level Security of GSI
• GSI offers message level security for SOAP messages by
implementing the WS – security standard and using the WS – secure
conversation specification.
• WS – secure conversation specification is a standard proposed from
IBM and Microsoft which allows exchange of messages.
• Three more protection mechanisms
• Integrity protection
• Encryption
• Replay prevention

20. Authentication and Delegation of GSI
• GSI offers both authentication and delegation by using CA and public
key.
• It also provides through username and password .
• GSI certificate contains the following components.
• Name of the subject
• Public key of the subject
• Identify the signature
• Digital signature that belongs to the CA

21. Trust Delegation of GSI
• GSI offers delegation capability and services through an interface.
• This interface allows client to delegate certificate to a service.
• The interface is based on WS – Trust specification.

22. Cloud Security infrastructure
Network Level
• When looking at the network level of infrastructure security
• It is important to distinguish between public clouds and private clouds
• Four significant risk factors in this use case:
• Ensuring the confidentiality and integrity of your organization’s data-in-
transit to and from your public cloud provider
• Ensuring proper access control (authentication, authorization, and auditing)
to whatever resources you are using at your public cloud provider
• Ensuring the availability of the Internet-facing resources in a public cloud
• that are being used by your organization, or have been assigned to your
organization by your public cloud providers
• Replacing the established model of network zones and tiers with domains

23. • Host Level
• When reviewing host security and assessing risks,
• Consider the context of
• Cloud services delivery models (SaaS, PaaS, and IaaS) and
• Deployment models (public, private, and hybrid).
• There are no known new threats to hosts that are specific to cloud
computing, virtualization security threats — such as
• VM escape,
• System configuration drift, and
• Insider threats by way of weak access control to the hypervisor
• Understand the trust boundary and the responsibilities that fall on
you to secure the host infrastructure that you manage.
• There are also some providers’ responsibilities in securing the part of
host infrastructure the CSP manages.

24. • Application Level
• Application or software security should be a critical element of your
security program.
• Designing and implementing applications targeted for deployment on
a cloud platform requires application security programs
• This discussion only focus towards web application security:
• Web applications in the cloud accessed by users with standard Internet
browsers, such as Firefox, from any computer connected to the Internet.
• Browser has emerged as the end user client for accessing in-cloud
applications,
• Hence, it is important for application security programs to include
browser security into the scope of application security.
• Together they determine the strength of end-to-end cloud security
that helps protect the confidentiality, integrity, and availability of the
information processed by cloud services.

25. Aspects of Data Security
• Security for
• 1.Data in transit
• 2.Data at rest
• 3.Processing of data including multitenancy
• 4.Data Lineage
• 5.Data Provenance
• 6.Data remanance
• Solutions include encryption, identity management,sanitation

26. Provider Data and its Security
• how can this data be secured?
1.Data security issues
2.Access control,
• Key management for encrypting
• Confidentiality (Encryption ),
• Integrity (message authentication code MAC & cipher block chaining CBC)and
Availability (down time in SLA) are objectives of data security in the cloud

27. Identity And Access Management
Architecture
• Support for Identity and Access Management (IAM )features
• aid in Authentication, Authorization, and Auditing (AAA) of users accessing
cloud services.
• Authentication
• Process of verifying the identity of a user or system
• Authorization
• Process of determining the privileges the user is entitled to once the identity
is established.

28. • Auditing
• Process of review and examination of authentication, authorization records,
and activities
• to determine the adequacy of IAM system controls,
• to verify compliance with established security policies and procedures,
• to detect breaches in security services, and
• to recommend any changes that are indicated for countermeasures.
• IAM processes to support the business can be broadly categorized as
follows:
• User management
• Activities for the effective governance and management of identity life cycles
• Authentication management
• Activities for the effective governance and management of the process
for determining that an entity is who or what it claims to be
• Authorization management
• Activities for the effective governance and management of the process

29. Availability Management
• SaaS availability
• Customer responsibility: Customer must understand
• SLA and communication methods
• SaaS health monitoring
• PaaS availability
• Customer responsibility
• ‘PaaS health monitoring
• IaaS availability
• Customer responsibility
• IaaS health monitoring

30. • Access Control Management in the Cloud
• Who should have access and why
• How is a resources accessed
• How is the access monitored
• Impact of access control of SaaS, PaaS and IaaS
• Security Vulnerability, Patch and Configuration (VPC) Management
• How can security vulnerability, patch and configuration management for
• an organization be extended to a cloud environment
• What is the impact of VPS on SaaS, PaaS and IaaS