Introduction:-
Cloud computing has recently emerged as a new paradigm for hosting and delivering services over the Internet. Cloud computing is attractive to business owners as it eliminates the requirement for users to plan ahead for provisioning, and allows enterprises to start from the small and increase resources only when there is a rise in service demand. Major cloud infrastructure providers are Amazon, Google, Microsoft Azure and MSN etc. Cloud computing providers provide a variety of services to the customers and these services include e-mails, storage, software-as-a-services, infrastructure-as-a-services etc. Following diagram shows the cloud computing architecture.
Figure 1 Cloud Computing Architecture
In practice, cloud service providers tend to offer services that can be grouped into three categories: software as a service, platform as a service, and infrastructure as a service. These categories group together the various layers illustrated in Figure2, with some overlap.
Figure 2 Cloud Services and Application
Software as a Service (SaaS):- provides software services on demand. The use of single instance of the application runs on the cloud services and multiple end users or client organizations. The most widely known example of SaaS is salesforce.com.
Platform as a service (PaaS):- encapsulates a layer of software and provides it as a service that can be used to build higher-level services.
Infrastructure as a service (IaaS):- delivers basic storage and compute capabilities as standardized services over the network. Servers, storage systems, switches, routers, and other systems are pooled and made available to handle workloads that range from application components to high-performance computing applications.
As we know that information is being placed in the virtual arena, and being accessed by thin clients so there is always a problem of threat. Out of which some of the major threats are given below:-
- Failures in Provider Security
- Attacks by Other Customers
- Availability and Reliability Issues
- Legal and Regulatory Issues
- Perimeter Security Model Broken
- Integrating Provider and Customer Security Systems
- Abuse and Nefarious Use of Cloud Computing
- Insecure Application Programming Interfaces
- Malicious Insiders
- Shared Technology Vulnerabilities
- Data Loss/Leakage
- Account, Service & Traffic Hijacking
- Unknown Risk Profile
Following are the information security principles, need to get followed:-
C I A (Confidentiality, Integrity, Availability)
Confidentiality – Prevent unauthorized disclosure
Integrity – Preserve information integrity
Availability – Ensure information is available when needed
Issues to clarify before adapting Cloud Computing:-
As cloud computing has a major concerns of security so it’s imperative to clarify following issues before adopting cloud computing through any cloud service provider:-
1. User Access. Ask providers for specific information on the hiring and oversight of privileged administrators and the controls over their access to information. Major Companies should demand and enforce their own hiring criteria for personnel that will operate heir cloud computing environments.
2. Regulatory Compliance. Make sure your provider is willing to submit to external Audits and security certifications.
3. Data location. Enterprises should require that the cloud computing provider store and process data in specific jurisdictions and should obey the privacy rules of those Jurisdictions.
4. Data Segregation. Find out what is done to segregate your data, and ask for proof that encryption schemes are deployed and are effective.
5. Disaster Recovery Verification. Know what will happen if disaster strikes by asking whether your provider will be able to completely restore your data and service, and find out how long it will take.
6. Disaster Recovery. Ask the provider for a contractual commitment to support specific types of investigations, such as the research involved in the discovery phase of a lawsuit, and verify that the provider has successfully supported such activities in the past. Without evidence, don’t assume that it can do so.
7. Long-term Viability. Ask prospective providers how you would get your data back if they were to fail or be acquired, and find out if the data would be in a format that you could easily import into a replacement application.
Apart from that it’s imperative to seek for the solutions of security issues:-
Solution 1:-
By finding better cloud service provider it’s possible to have better security concerns.
Solution 2:-
Encrypting critical data becomes essential, and strongly advisable. In cloud where we do not have desired physical control over our data, cryptography seems to be the best way for protecting sensitive information. The server-side encryption in an untrustworthy environment like public cloud is too risky. server-side encryption in a public environment has disadvantages because of multitenancy characteristics, unsatisfied malicious, dismissed employees or even outside attackers that can increase the probability of fraud, collusion and falsified transaction On the other hand, client-side encryption can undermine the benefits of cloud since it is a time-consuming task for encryption and decryption. Moreover, it is not safe when all certificates and keys save on a client while flexibility in cloud allows to be connected to cloud through other desktops or PDAs. Furthermore, in case of forgetting key, user will lose his data on cloud.
There are some customized cryptographic techniques such as identity-based encryption, attribute-based encryption, homomorphic and searchable encryption, isolation of encryption/ decryption, combination of symmetric and asymmetric algorithms.
Solution 3: –
A solution has been given by [29],in order to prepare a trustable third party in role of EaaS (Enryption as a Service), should carry out three steps: first, implementing private cloud; second, providing encryption algorithms; and, last, multi-threading features based on a number of VM cores. Some of the well-known frameworks for the purpose are OpenNebula, Nimbus, OpenStack and Eucalyptus as per user requirements.
Motivation:-
Now-a-days Cloud computing is playing a major role, as it provides a virtual arena to place data and information that can be accessed from anywhere remotely and because of which it’s become easy to place huge amount of information, for which there is no need to worry about its maintenance cost and infrastructure cost. But there is another face of coin as organization doesn’t know that how and where their data is being placed, and also cloud can be easily accessible by public and so there is always a risk of information security breach. Because of which trust of organizations are being reduced, which is also hampering market of Cloud Computing. If information security problem can be resolved then it would help to regain trust of the organization and only then all benefits can be achieved and utilized by the organization. This motivated me to work upon this area.