Principles of Computer Security Instructor: Haibin Zhang hbzhang@umbc.edu

Cloud Computing and Cloud Security

Client-Server Architecture

--> Cloud Computing

NIST Definitions of Cloud Computing Software as a service (SaaS) Platform as a service (PaaS) Infrastructure as a service (IaaS)

Software as a service (SaaS) “The capability provided to the consumer is to use the provider's applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.”

Platform as a Service (PaaS) The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.

Infrastructure as a Service (IaaS) Infrastructure as a Service (IaaS). The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls).

Go Beyond These Definitions

Go Beyond These Definitions Someone could modify your cloud according to your need!

Go Beyond These Definitions Someone could modify your cloud according to your need! You could own your own cloud!

Go Beyond These Definitions Someone could modify your cloud according to your need! You could own your own cloud! OpenStack allows you to do that, with some (painful) price…

Azure and EC2 MS and Amazon’s specific IaaS

EC2

Azure Storage Questions How does Azure prevent from disaster? Did Azure use Paxos? What’s the replication factor in Azure? Azure Storage is an append-only storage. What does it mean?

Azure Storage

OpenStack (In a Nutshell) Nova Keystone Cinder Swift Glance Neutron

Deployment Scenarios

BTW, cloud side channel attacks

Nova Open-source IaaS

OpenStack (Slightly More Complex)

Visualizing OpenStack Dependency Flow The following: Visualizing OpenStack Dependency Flow Haibin Zhang

Basic---Launching an Instance Creating/Running a VM without Networks (Neutron), without Persistent Storage (Cinder) Time User credentials token token; request; project Id Keystone “Success” token vrf (interactive) token vrf (interactive) Nova The common recognition is “EC is now and the future.” token; request for VM image image Glance

Extending Basic for Complex Settings 1) Adding persistent storage/Cinder; 2) Adding networks/Neutron Time User credentials token token; request; project Id Keystone “Success” token vrf (interactive) token vrf (interactive) Nova token; request for VM image Cinder image “NetworkReady” Glance Neutron

So far we use Glance as a black-box What’s behind it So far we use Glance as a black-box What’s behind it? How it interacts with backend storage? Time User credentials token token; request; project Id Keystone “Success” token vrf (interactive) token vrf (interactive) Nova token; request for VM image image Glance Backend Storage e.g., Swift

Method 1: Glance as a proxy (default; direct_URL is disabled) Time User credentials token token; request; project Id Keystone “Success” token vrf (interactive) token vrf (interactive) Nova token; request for VM image image Glance Backend Storage e.g., Swift

Method 2: Glance return image/object URL; Nova contacts Swift directly Time User credentials token token; request; project Id Keystone “Success” token vrf (interactive) token vrf (interactive) Nova token; request for VM image image Glance Backend Storage e.g., Swift

Note that this is for the most recent API Time User credentials token token; request; project Id Keystone “Success” token vrf (interactive) token vrf (interactive) Nova token; request for VM image image Glance Backend Storage e.g., Swift

Keystone and OpenStack Token UUID: 32 bytes PKI PKIz Fernet token