An Approach in the Design of Common Authentication Solution for a Multi-Platform Cloud Environment
Total Page:16
File Type:pdf, Size:1020Kb
An Approach in the Design of Common Authentication Solution for a Multi-Platform Cloud Environment Primož Cigoj1,2, Borka Jerman Blažič2 and Tomaž Klobučar2 1Jožef Stefan International Postgraduate School, Jamova cesta 39, 1000 Ljubljana, Slovenia 2Jozef Stefan Institute, Laboratory for Open Systems and Networks, Jamova cesta 39, 1000 Ljubljana, Slovenia Keywords: Single Sign-on, Identity Management, Identity Federation, Cloud Computing, Security, Cloud Management, Cloud Provisioning, Infrastructure-as-a-Service, IaaS, Multi-platform Cloud, Access Control, Authentication, Authorization, Cloud Service Provider, Privacy, Software Platform, Centralized Systems, OpenStack, VMware. Abstract: The security provision within multi-platform cloud computing environment is still considered not to be properly solved due to different problems with technical and human-based origin. This paper presents an attempt to provide an authentication and authorization solution based on the single sign-on (SSO) approach for cloud service users and administrators in a multi-platform environment. The problem of authentication in cloud services is briefly introduced and the approach implemented for cloud environment with two different proprietary (VMware) and open source (OpenStack) platforms is described. 1 INTRODUCTION the user level (Tripathi and Mishra, 2011), it is also complex to manage and create authentication Cloud computing has revolutionized the provision of mechanisms for several services and several computing services, transferring them from local to platforms (Fernandes, Soares, Gomes, Freire and locally unspecified remote environments, which are Inácio, 2014). Identity federation and single sign-on controlled by third party service providers. The main (SSO) techniques address these issues by allowing cloud computing challenge for vendors, providers and exchange of authentication and authorization users of clouds remains protection of the cloud information between two parties, such as an Identity technology, services and users with adequate security Provider (IdP) and a Service Provider (SP). measures. According to the survey conducted by While the identity federation and single sign-on Microsoft and the National Institute of Standards and concepts have been well covered in the literature in Technology (NIST), security in the cloud computing the past years, in general as well as in the cloud model was the ICT executives’ main concern (Jansen context e.g. (Pérez-Méndez, Pereniguez-Garcia, and Grance, 2011; Microsoft, 2010). Consequently, Marin-Lopez, López-Millán and Howlett, 2014), many business entities are still not very keen on (Cruz Zapata, Fernández-Alemán and Toval, 2014), adopting cloud computing. there are still practical issues that prevent their In the cloud users alone have no control over their straightforward and simple application in the multi- data and their cloud identity. Installation procedures platform cloud environments. Our attempt described are often complex and there is no adequate and in this paper was to design and develop a solution that complete security solution that ensures the safe would provide trustworthy and secure authentication deployment of the underlying infrastructure and safe and authorization service in such environment. The use of the services. Especially in the multi-platform proposed solution is based on the SSO principle and clouds and inter-clouds, where multiple cloud was implemented on two different platforms systems can be accessed, users and administrators are (OpenStack and VMware). It was tested and faced with different authentication and authorisation evaluated within a large National Competence Centre systems, different login dialogs, and each login dialog project on cloud-assisted services for different fields is matched with different credentials. In addition to of application. being difficult implementing strong authentication at The paper discusses the problem and related work first. Then it introduces the selected SSO- based Cigoj P., Jerman Blažicˇ B. and Klobucarˇ T.. 365 An Approach in the Design of Common Authentication Solution for a Multi-Platform Cloud Environment. DOI: 10.5220/0005351103650372 In Proceedings of the 5th International Conference on Cloud Computing and Services Science (CLOSER-2015), pages 365-372 ISBN: 978-989-758-104-5 Copyright c 2015 SCITEPRESS (Science and Technology Publications, Lda.) CLOSER2015-5thInternationalConferenceonCloudComputingandServicesScience solution, and describes the development approach and attributes are securely shared across multiple the implementation course. The presentation ends IdM systems. Federation of identities can be with discussion and plans for future work. achieved in several ways; e.g., based on SAML (Cantor, Kemp, Philpott and Maler, 2005) or the OpenID solution (Ferg, Fitzpatrick and 2 AUTHENTICATION AND Howells, 2007). One of the important properties is the required compatibility of cloud IDENTITY MANAGEMENT providers’ IdM systems. SERVICES IN . Authorization: Authorization specifies the MULTI-PLATFORM CLOUD rights of individual user accounts. It is important for the cloud the account INFRASTRUCTURE management procedures to be set up and for the rights verification from the highest system According to the Cloud Security Alliance (CSA) authority. Furthermore, the granted right (Simmonds, Rezek and Reed, 2011), the leader in the should be consistent with the policy. field of cloud security, the largest identified cloud . Access control: Access control requirements security problem is related to the shared technology vary widely according to the type of the end- issues. Infrastructure resource sharing can potentially user (an individual or an organization). In order allow one consumer to peek into another consumer’s to implement an access control system, an data if the system does not provide strong system for access control policy must be set, and its authorization and authentication. Here, the problems implementation should allow the performed of account hijacking or user credential theft are also actions to be traceable. relevant. The traditional identity management (IdM) Apart from these recommendations it becomes approach is more centralized compared to the current obvious that an optimal system for ensuring solution used in cloud computing, and usually is authentication and authorization in a multi-platform based on user personal data, such as real name, user cloud system would also benefit from the single sign- name, e-mail address, identification number, access on approach principles. The Open Group defines SSO permissions, etc. The use of a separate IdM system as “a mechanism whereby a single action of user within an organisation, and its connection with the authentication and authorization can permit a user to cloud is quite complicated, and there is no simple way access all computers and systems where that user has to extend its use to the cloud (Lonea, Tianfield and access permission, without the need to enter multiple Popescu, 2013). In order this to become part of the passwords” (Group TO, 2014). The most important cloud system the following actions and the security property that the SSO principle brings is the corresponding implementations are required (Cantor, common secure infrastructure, which can be carefully Kemp, Philpott and Maler, 2005): managed and protected (Andronache and Nisipasiu, . Registration of identities: Verification of a user 2011). At the same time, when using the SSO account is needed before proceeding with the approach, the cloud services do not have to manage registration in accordance with the relevant each user account. Account management can be security standards. Organizations that transfer carried out by a central authentication system. their user accounts to the cloud must make sure Although the concepts of identity federation and their user account management system is up-to- single sign-on are well known in the cloud research date and safe. literature there are still some practical design and . Authentication: Management and implementation issues worth discussing, especially in implementation of the user authentication must the multi-platform cloud environments, cloud be performed in a trustworthy way. The IdM federations, and inter clouds. General proposed systems should allow configuration of the solutions for a multi-platform environment often do authentication systems. Another important not take into account the current implementation property of the system should be the cloud- status, functionalities and openness of the available providers’ identification disclosure to third cloud platforms, as well as not take advantage of their party providers and the use of authentication by existing services. The papers also do not give enough both parties. details of the proposed solutions and their integration . Federation of identities: Federation of into existing platforms. identities allows users to use the same set of Panarello et al., for example, analyse credentials to obtain access to different requirements for IaaS cloud federation (Panarello, resources. User`s electronic identity and 366 AnApproachintheDesignofCommonAuthenticationSolutionforaMulti-PlatformCloudEnvironment Celesti, Fazio, Villari and Puliafito, 2014). While VMware vCloud Director is a cloud platform they envisage SAML, OpenID and Shibboleth as an software solution that enables enterprises to build authentication solution, only a standard and general secure, multi-tenant private clouds by pooling identity