Research ReseaFeaturchre Feature IEEE TRANSACTIONS ON VOL:46 NO:2 YEAR 2013

Collaboration in Multicloud Computing Environments: Framework and Security Issues

Mukesh Singhal and Santosh Chandrasekhar, University of California, Merced Tingjian Ge, University of Massachusetts Lowell Ravi Sandhu and Ram Krishnan, University of Texas at San Antonio Gail-Joon Ahn, Arizona State University Elisa Bertino, Purdue University

A proposed proxy-based multicloud computing framework allows dynamic, on- the-fly collaborations and resource sharing among cloud-based services, addressing trust, policy, and privacy issues without preestablished collabora- tion agreements or standardized interfaces.

he recent surge in cloud computing arises from As more organizations adopt cloud computing, cloud its ability to provide , infrastructure, service providers (CSPs) are developing new technologies and platform services without requiring large to enhance the cloud’s capabilities. Cloud mashups are a T investments or expenses to manage and oper- recent trend; mashups combine services from multiple ate them. Clouds typically involve service providers, clouds into a single service or application, possibly with infrastructure/resource providers, and service users (or on-premises (client-side) data and services. This service clients). They include applications delivered as services, composition lets CSPs offer new functionalities to clients as well as the hardware and software systems providing at lower development costs. Examples of cloud mashups these services. and technologies to support them include the following: Cloud computing characteristics include a ubiquitous (network-based) access channel; resource pooling; multi- • IBM’s Mashup Center, a platform for rapid creation, tenancy; automatic and elastic provisioning and release sharing, and discovery of reusable application build- of computing capabilities; and metering of resource ing blocks (like widgets and feeds) with tools to easily usage (typically on a pay-per-use basis).1 of assemble them into new Web applications. resources such as processors, network, memory, and stor- • Appirio , a cloud-based storage service age ensures scalability and high availability of computing that lets .com cloud customers store infor- capabilities. Clouds can dynamically provision these virtual mation about accounts, opportunities, and so on in the resources to hosted applications or to clients that use them Amazon S3 cloud. to develop their own applications or to store data. Rapid • Force.com for the App Engine, a set of libraries provisioning and dynamic reconfiguration of resources help that enable development of Web and business applica- cope with variable demand and ensure optimum resource tions using resources in the Salesforce.com and Google utilization. clouds.

Collaboration among multiple cloud-based services, will continue to improve as more cloud services become like cloud mashups, opens up opportunities for CSPs to interoperable in the future. offer more-sophisticated services that will benefit the next Cloud-based computing also introduces new security generation of clients. concerns that affect collaboration across multicloud ap- For example, cloud-based electronic medical record plications, including the following:8 (EMR) management systems like Practice Fusion, Ve- rizon Health Information Exchange, Medscribbler, and • increase in the attack surface due to system GE Healthcare Centricity Advance are emerging. In addi- complexity, tion, government agencies are working toward building • loss of client’s control over resources and data due to interoperable healthcare information systems that promote asset migration, electronic exchange of data across multiple organizations. • threats that target exposed interfaces due to data stor- These developments will influence healthcare providers age in public domains, and to interact with multiple cloud-based EMR systems in the • data privacy concerns due to multitenancy. future. Today, cloud mashups require preestablished agreements The research community is begin- among providers as well as the use of custom-built, propri- ning to develop architectures, etary tools that combine services through low-level, tightly controlled and constraining integration techniques. This technologies, and standards to approach to building new collaborative services does not support collaboration among support agility, flexibility, and openness. Realizing multi- multiple cloud systems. cloud collaboration’s full potential will require implicit, transparent, universal, and on-the-fly interaction involving different services spread across multiple clouds that lack pre- Some specific security issues associated with collabora- established agreements and proprietary collaboration tools. tion among heterogeneous clouds include The research community is beginning to develop ar- chitectures, technologies, and standards to support • establishing trust among different cloud providers to collaboration among multiple cloud systems.2-5 However, encourage collaboration; these research proposals still remain constraining due to • addressing policy heterogeneity among multiple their provider-centric approach or limited scope. clouds so that composite services will include effective As the name suggests, provider-centric approaches monitoring of policy anomalies to minimize security require CSPs to adopt and implement the changes that breaches; and facilitate collaboration—changes such as standardized • maintaining privacy of data and identity during interfaces, protocols, formats, and other specifications, collaboration. as well as new architectural and infrastructure com- ponents. Without these provider-centric changes, Mechanisms for collaboration across multiple clouds current proposals do not provide facilities for client-centric, must undergo a rigorous, in-depth security analysis to iden- on-the-fly, and opportunistic combinations of heteroge- tify new threats and concerns resulting from collaboration. neous cloud-based services. They must have the support of innovative, systematic, and While cloud standardization will promote collaboration, usable mechanisms that provide effective security for data there are several hurdles to its adoption.6,7 From a market and applications. Such security mechanisms are essential perspective, it is unlikely that multiple CSPs will agree on for gaining the trust of the general public and organizations an easy and standardized way to access services, as this in adopting this new paradigm. would give clients total freedom in changing providers, leading to increased open and direct competition with other COLLABORATION FRAMEWORK providers. CSPs often offer differentiated services with spe- FOR MULTICLOUD SYSTEMS cialized proprietary products and services. Standardization Our proposed framework for generic cloud col- also reduces the efficacy of CSPs that use such differenti- laboration allows clients and cloud applications to ated service offerings to attract and maintain more clients. simultaneously use services from and route data among For cloud collaboration to be viable in the current en- multiple clouds. This framework supports universal and vironment, researchers need to develop mechanisms that dynamic collaboration in a multicloud system. It lets allow opportunistic collaboration among services without clients simultaneously use services from multiple clouds requiring standards and extensive changes to the cloud without prior business agreements among cloud pro- service delivery model. This approach will allow incremen- viders, and without adopting common standards and tal provisioning of collaborative services to clients, which specifications.

Research Feature

Use of proxies for collaboration or a set of physical nodes connected via an underlying net- In the current environment, a client that wishes to si- work infrastructure. multaneously use services from multiple clouds must The basic idea is to enable proxies that act on behalf individually interact with each cloud service, gather inter- of a subscribing client or a cloud to provide a diverse set mediate results, process the collective data, and generate of functionalities: cloud service interaction on behalf of a final results. The following restrictions in the current cloud client, data processing using a rich set of operations, cach- computing model prevent direct collaboration among ap- ing of intermediate results, and routing, among others. plications hosted by different clouds: With these additional functionalities, proxies can act as mediators for collaboration among services on differ- • Heterogeneity and tight coupling. Clouds implement ent clouds. Proxy deployment can be strategic—in close proprietary interfaces for service access, configura- geographical proximity to the clouds, for example—to tion, and management as well as for interaction with improve performance and facilitate execution of long- other cloud components. Each service layer of a cloud lived applications without additional user intervention. tightly integrates with lower service layers or is highly As an example of proxy-facilitated collaboration be- dependent on the value-added proprietary solutions tween clouds, consider a case in which a client or CSP that the cloud offers. This heterogeneity and tight wishes to simultaneously use a collection of services that coupling prohibit interoperation between services multiple clouds offer. First, the requesting entity chooses from different clouds. proxies to act on its behalf and to interact with cloud applications. A client or a CSP might employ multiple Proxies can facilitate collaboration proxies to interact with multiple CSPs. It can select prox- without requiring prior agreements ies based on, for example, latencies between proxies and between the cloud service providers. clouds or workload conditions at various proxies. Once it chooses proxies, the client or CSP delegates the necessary service-specific privileges to the proxies to carry • Preestablished business agreements. The current out the service request using the necessary security precau- business model requires preestablished agreements tions. These proxies can further delegate to other proxies between CSPs before collaboration can occur. These if necessary and initiate the service request. In some in- agreements are necessary for clouds to establish their stances, clients or CSPs can assign special roles to one or willingness to collaborate and establish trust with more proxies in the network to coordinate the operations one another. The lack of such agreements prohibits in a service request among the multiple delegate proxies. multicloud collaborative efforts due to incompatible Following delegation, the requesting entity need not further intentions, business rules, and policies. Moreover, col- interact with the proxy network until the proxies complete laborations resulting from preestablished agreements the service request. typically exhibit tight integration between the par- During execution of a service request, proxies would in- ticipants and cannot be extended to provide universal teract with cloud-based applications, playing the role of the and dynamic collaboration. service subscriber(s). By independently requesting services • Service delivery model. Clouds use a service delivery from the clouds, and by routing data between each other model that provides service access to legitimate sub- in a manner transparent to cloud applications, proxies can scribing clients and denies all other requests because facilitate collaboration without requiring prior agreements of security and privacy concerns. This prevents direct between the CSPs. Proxies can also perform operations to interaction between services from different clouds. help overcome incompatibilities among services to allow Also, CSPs typically package their service offerings data exchange between them. with other resources and services. This results in a tight dependency of a service on the hosting CSP. Such Architectural overview a service delivery model limits a client’s ability to cus- Clouds consist of multiple network-connected resource tomize a service and use it in combination with service clusters such as server farms, data warehouses, and so offerings from different CSPs. on that host geographically distributed virtual machines and storage components that ensure scalability, reliability, A technique that could overcome these restrictions uses and high availability. A multicloud system that employs a network of proxies. A proxy is an edge-node-hosted soft- proxies for collaboration consists of three architectural ware instance that a client or a CSP can delegate to carry components: multiple cloud computing systems, networks out operations on its behalf. Depending on the context, the of proxies, and clients (or service users). system can regard a network of proxies as a collection of Such systems can use several possible strategies for plac- virtual software instances connected via a virtual network ing proxies in the proxy network.

Cloud-hosted proxy. As Figure 1 C2 shows, each CSP can host prox- C1 ies within its cloud infrastructure, manage all proxies within its administrative domain, and handle service requests from cli- ents that wish to use those proxies for collaboration. The proxy instances might need to be CSP- specific. For example, in Figure 1, C3 both C1 and C2 might mutually and dynamically provision shar- Client ing and collaboration logic as Service VM instance proxy virtual instances within Proxy VM instance their respective administrative C1, C2, C3 Cloud service providers domains. Proxy . As Figure 2 shows, this scenario involves Figure 1. Client sends a request to cloud C1, which dynamically discovers the need to use deploying proxies as an auton- services from clouds C2 and C3. C1 employs proxies to manage these interactions. omous cloud that offers collaborative services to clients PSP and CSPs. A group of CSPs that are willing to collaborate can manage this proxy-as-a-service cloud, or a third-party entity, a proxy ser- vice provider (PSP), can provide management. Clients directly sub- scribe to the proxy cloud service C1 C2 and employ them for intercloud collaboration. Peer-to-peer proxy. Proxies can also interact in a peer-to-peer network managed by either a PSP or a group of CSPs that wish to (a) collaborate. Another possibility is for proxies to have no collective Client PSP management: each proxy in the Service VM instance peer-to-peer network is an inde- Proxy VM instance pendent entity that manages itself. C1, C2 Cloud service providers In this case, the proxy itself must PSP Proxy service provider handle requests to use its services. On-premise proxy. In the sce- nario shown in Figure 3, a client C1 C2 can host proxies within its organi- zation’s infrastructure (or on premises) and manage all proxies within its administrative domain. A client that wishes to use prox- ies for collaboration will employ (b) its on-premises proxies, whereas CSPs that wish to collaborate with Figure 2. Proxy as a service. In this scenario, cloud service providers (CSPs) deploy proxies other CSPs must employ proxies as an autonomous cloud system and offer it as a service to clients. (a) A client employs two that are within the domain of the proxies to interact with CSPs C1 and C2. (b) Alternatively, a client initiates a service request service-requesting client. with C1, which then discovers the need for a service from C2. PSP: proxy service provider.

Research Feature

C1 use cases, and, if possible, merge C0 the architectures into a universal proxy-based architecture for mul- ticloud collaboration. Another important task is de- veloping a full suite of protocols C2 and mechanisms that proxies must implement to support all Client the functionalities necessary for Service VM instance acting as mediators among ser- Proxy VM instance vices from multiple clouds. For C1, C2 Cloud service providers example, supporting collabo- ration scenarios that migrate a (a) C0 Client organization client-subscribed virtual machine C1 from one cloud to another re- C0 quires techniques for translation between various virtual machine packages and distribution formats.

C2 SECURITY ISSUES IN MULTICLOUD COLLABORATION Researchers and industry specialists have highlighted several security issues in cloud computing, including isolation (b) management, data exposure and confidentiality, virtual OS security, Figure 3. On-premises proxy. Clients deploy proxies within the infrastructure of their trust and compliance, and mis- organization. (a) A client employs two proxies to interact with CSPs C1 and C2. (b) A client sion assurance.8 Specific security initiates a service request with C1, which then discovers the need for a service from C2. issues emerge during dynamic Hybrid proxy infrastructure. A hybrid infrastructure can sharing and collaboration across include on-premises, CSP- and PSP-maintained, and peer- multiple clouds. In particular, issues pertaining to trust, to-peer proxies. Selecting proxies for collaboration will policy, and privacy are a concern in multicloud computing depend on the type of service being requested and the environments. entity that initiates collaboration, among other factors. For example, clients that must initiate a service request Establishing trust and secure delegation with two CSPs can employ on-premises proxies for col- As in other IT systems, security in clouds relies heav- laboration. On the other hand, a cloud-based application ily on establishing trust relationships among the involved that discovers it needs a service from another CSP to ful- entities. The need for trust arises because a client relin- fill a client’s request can employ a CSP-maintained proxy. quishes direct control of its assets’ security and privacy The proposed architectures illustrate the various options to a CSP. Doing so exposes a client’s assets to new risks that are available for deploying proxies to support collabo- that are otherwise lessened or avoidable in an internal or- ration. Developing these architectures serves as the first ganization. These risks include insider security threats, step in building a proxy-based, collaborative, multicloud weakening of data ownership rights, transitive trust issues computing environment. with third-party providers in composite cloud services, A complete solution will entail several additional tasks. and diminished oversight of system security.8 A client must For example, an important task is a comprehensive study confer a high level of trust to a CSP with regard to its ability and evaluation of the proposed proxy-based architec- to implement effective controls and processes to secure tures. Such an evaluation must cover each architecture’s assets. Thus, a client must be able to accept the higher levels possible variations under diverse practical use cases and of risk in using cloud-based services. scenarios for multicloud collaboration. Based on this Using proxies moves the trust boundary one step further: study, researchers can refine the proposed architectures, clients and CSPs now must establish trust relationships develop new variations to support different scenarios and with proxies, which includes accepting a proxy’s security,

reliability, availability, and business continuity guarantees. signing rights to provide authentication of proxies.9 Simple Moreover, CSPs responding to service requests that a proxy public-key infrastructure authorization certificates10 or makes on behalf of a client or another CSP must trust the the OAuth protocol11 can facilitate the secure delegation of proxy to legitimately act on behalf of the requesting entity. access rights and permissions. Researchers must thoroughly Establishing a trust relationship with proxies depends on evaluate existing secure-delegation techniques and develop the strategy used to establish, manage, and administer a comprehensive protocol suite that implements mecha- the proxy network. The entity managing the proxies must nisms that support secure delegation and proxy operation. provide guarantees of its own trustworthy operation; addi- tionally, it must provide assurances of the proxies’ security, Policy heterogeneity and conflicts reliability, and availability. When proxies enable dynamic collaboration between From the client’s point of view, employing on-premises multiple CSPs, heterogeneous security policies can be the proxies that are within the client’s administrative domain source of policy conflicts that result in security breaches. can exacerbate trust issues. By using on-premises proxies, Proxies must monitor for and defend against such breaches. a client maintains control over its assets while proxies Even though existing policy evaluation mechanisms can process them during a collaborative service request. Simi- verify individual domain policies, security violations larly, using proxies within the CSP's administrative domain can easily occur during integration.12 In multicloud col- lets the CSP exercise control over the proxies’ operations, laborations using proxies, service requirements can drive and thus it can trust the proxies to enable collaboration. dynamic, transient, and intensive interactions among Proxy networks are a potential platform for develop- different administrative domains. Thus, a proxy’s policy ing proxy-based security architectures and solutions for integration tasks must address challenges such as semantic multicloud systems. At a minimum, the proxy network must implement security and privacy mechanisms that mirror, extend, or complement similar mechanisms of- To protect data at rest and data fered by clouds8 to maintain asset protection outside the in transit, proxies must provide a domain of clouds and client organizations. For example, to trusted computing platform that protect data at rest and data in transit, proxies must pro- prevents malicious software from vide a trusted computing platform that prevents malicious taking control and compromising software from taking control and compromising sensitive sensitive client and cloud applica- client and cloud application data. They must also guaran- tion data. tee data confidentiality and integrity during transmission through the proxy network, possibly by using standards such as the Transport Layer Security protocol. heterogeneity, secure interoperability, and policy evolu- In addition, clients, clouds, and proxies must implement tion management. The design of access control policies for mechanisms that ensure secure delegation, which entails multicloud collaboration must permit careful management the following: by proxies while ensuring that policy integration does not lead to security breaches. • On-the-fly agreements. Delegating to a proxy must es- Policy analysis generally includes property verifica- tablish, on the fly, an explicit agreement between the tion and conflict detection, as well as an analysis of the delegator and proxy that lets the proxy act on the del- differences between policy versions. For a collaborative egator’s behalf. Techniques for delegation to a proxy service, a proxy must deal with several registered services must include mechanisms that restrict the proxy’s be- from multiple clouds as well as proxies. This requires havior, including data and resource access, to comply various proxies to locally conduct policy integration and with delegator-specified constraints. decomposition. • Expected behavior. After delegation, a proxy must not Policy integration aims to generate agreement on access deviate from the expected behavior. It must act only rights for each party involved in a collaborative project. on behalf of the delegator (a client or a CSP). After the A policy integration process for intercloud collabora- proxy fulfills the service request, it can no longer act tion must systematically handle potential conflicts and on the delegator’s behalf. The proxy cannot modify resolution problems. Proxies must analyze relationships the intended service request or misuse client assets, between policies to detect and resolve policy anomalies and it must not transitively delegate its capabilities to using mechanisms that easily adapt to handle composite other proxies without the delegator’s explicit consent. policies evaluated as a whole. Possible policy anomalies include policy inconsistencies and inefficiencies. The technologies for secure delegation to proxies include Policy inconsistency. Access control policies reflect the use of warrant-based proxy signatures for delegation of security requirements, which should be consistent within

Research Feature

and across multiple participating parties to accommodate fore necessary to develop a flexible and extensible conflict the dynamic and complex nature of multicloud environ- resolution approach to achieve fine-grained conflict resolu- ments. Policy inconsistencies can result in security and tion. Such an approach must let a proxy automatically map availability problems; they include the following: different conflict resolution strategies that resolve different conflicts. • Contradiction. Two policies are contradictory if they Situations in which a policy component becomes in- have different effects on the same subjects, targets, volved in multiple conflicts also require a correlation and conditions. Contradictions are the most common mechanism that identifies dependent relationships among form of policy conflicts. conflicting segments. Such a mechanism ensures that con- • Exception. A policy is an exception of another policy if flict resolution does not introduce new policy violations they have different effects, but one policy is a subset of during the resolution process. Earlier research applied an the other. The exception might not be a policy conflict, approach for detecting and resolving policy anomalies but access policy evaluation mechanisms commonly to healthcare domains.13,14 Specifically, our preliminary use exceptions to exclude a specific access request study demonstrates how to achieve compliance and conflict from a general access permission. analysis in EMR management systems, as applied to data • Correlation. Two policies are correlated if they have sharing and Health Insurance Portability and Accountabil- different effects but intersect each other. In this case, ity Act (HIPAA) policies. one policy permits the intersection, but the other does not. This is a partial policy conflict. Identity attributes and data privacy In shared computing environments like clouds, protect- Policy inefficiency. The composition of policies from ing the privacy of client assets is critical.8 The privacy issues multiple origins can result in a large collection of policies pertaining to both data and identity. controlling the access to federated applications in multi- Identity attributes privacy. (DaaS), such clouds. Since an access request’s response time largely as Amazon S3 and Azure, is an emerging cloud depends on the number of policies that proxies must parse, service in which organizations can seamlessly store data inefficiencies in composite policies can adversely affect in the cloud and retrieve it based on access control policies performance. Inefficiencies in composite policies include that cover legal requirements and organizational policies. An expressive access control model, such as XACML, can • redundancy—a policy is redundant if every access re- specify access control policies on protected objects in terms quest that matches the policy also matches another of a subject’s properties, called identity attributes. These policy with the same effect; and can include a subject’s email address, organizational role, • verbosity—similar to data element merging in data age, and location of access. Such an attribute-based access integration, policy composition can merge similar control (ABAC) model provides fine-grained data access and policies from different origins; resolving the policy expresses policies closer to organizational policies. verbosity during composition affects the policy size. A crucial issue in this context is that identity attributes required by subjects to access protected objects often encode sensitive information. Many existing cloud data With cloud computing initiatives, services provide similar access control models, in which the scope of insider threats, a ma- individual and organizational privacy, a key requirement jor source of data theft and privacy for digital identity management, is unprotected. breaches, is no longer limited to the Also, with cloud computing initiatives, the scope of organizational perimeter. insider threats, a major source of data theft and privacy breaches, is no longer limited to the organizational pe- rimeter. Multicloud environments exacerbate these issues Once proxies identify conflicts, they must use conflict because proxies can access data (which the environment resolution strategies to resolve them. However, current might dynamically move or partition across different conflict resolution mechanisms have limitations. For ex- clouds) on behalf of clients. Revealing sensitive information ample, existing conflict resolution mechanisms—including in identity attributes to proxies that grants them autho- Extensible Access Control Markup Language (XACML) rization to access the data on behalf of clients is not an policies—are too restrictive because they only allow the attractive solution. Thus, assuring the private and consis- selection of one resolution algorithm to resolve all the iden- tent management of information relevant to ABAC becomes tified conflicts. more complex in multicloud systems. Multicloud environments require adaptively applying In multicloud environments, where proxies use ABAC different algorithms to resolve different conflicts. It is there- to retrieve client data from the clouds, clients need to

hide their identity attributes from both proxies and CSPs work. Compression methods such as dictionary encoding to preserve the privacy of sensitive client information. can reduce both communication and query processing However, clients must still give proxies the information that costs—for example, CSPs and proxies can perform much grants them access to requested data. This requirement of the query processing over the encoded format.17 calls for the use of identity attribute and data encoding Favorable solutions to ensure data privacy must employ techniques that, used together, permit oblivious data transfer flexible data perturbation methods that provide control between CSPs, proxies, and clients while providing privacy- over the tradeoff between the privacy guarantee and the preserving ABAC. utility of the query results. Perturbation methods must pro- The techniques for encoding client identity attributes vide high accuracy for queries that involve a large number must permit clients to transfer the encoded attributes to of records. At the same time, they must introduce large proxies; the proxies, in turn, must convince CSPs of the amounts of noise in the results for queries over a few re- ownership and validity of the encoding, without having the cords, which is desirable for privacy. client reveal its identity attributes to either entity. Data and In the multiple-CSP context, a CSP can use local data identity attribute encoding techniques must ensure that perturbation techniques to perturb its sensitive data and decoding the data is possible when the identity attributes then ship it to another CSP for collaborative query process- match the ABAC policies, without revealing the attribute to ing. Local techniques permit query processing at one site the proxy or the CSP. to avoid on-the-fly data communication costs. Moreover, Client data privacy. Often, clients must protect data pri- vacy before sharing the data. Consider an example in which multiple medical in- Favorable solutions to ensure data surance companies, each of which has a designated CSP, privacy must employ flexible data would like to share customer data to have a much larger perturbation methods that provide customer database from which to obtain useful statistical control over the tradeoff between query results. One CSP might have an application that the privacy guarantee and the utility requires information on the percentage of male construc- of the query results. tion workers in the US who are younger than 40 and have respiratory diseases. This would require collecting data from multiple CSPs for the analytical results to be mean- when a query itself must be private, a CSP can limit query ingful, since the data from one CSP might be inadequate processing to its own site by using local techniques. (after filtering for multiple selective predicates) or atypical In some applications, the receiving CSP need not perturb (say, one CSP only has data for customers in a particular its own sensitive data. These situations present opportu- region of the US). nities to further optimize the accuracy and efficiency of In this example, the disease attribute of records is sensi- query processing that researchers can explore by judi- tive and requires protection when shared among multiple ciously determining which CSP should answer a particular CSPs. Using encryption is not a viable option because main- query (when queries are not private and sharable). Finally, taining the data’s utility is a key requirement for many multicloud scenarios require new privacy definitions that applications. Most applications require a well-balanced will allow formal proofs of privacy guarantees for protec- tradeoff between formal privacy and practical utility. tion schemes. Privacy protection methods (other than encryption) fall broadly into two categories:15 o facilitate dynamic collaboration between clouds, • data perturbation (also known as input perturbation), we proposed a framework that uses proxies to act as which adds some form of noise to the data itself, and T mediators between applications in multiple clouds that • output perturbation, which adds noise to the otherwise must share data. Our proposed framework has the poten- accurate query answers. tial to overcome several restrictions in the current cloud computing model that can prevent dynamic collaboration Earlier research studied data privacy in outsourcing data among applications hosted by different cloud systems. aggregation services.16 Regardless of the methods used to Future research directions for the proposed framework maintain data privacy, the resulting solution must scale to include refining the proxy deployment scenarios and devel- use for large amounts of data and many CSPs. opment of infrastructural and operational components Perturbation methods often produce data with high of a multicloud system. This must be accompanied by redundancies, which can lead to scalability issues in multi- implementation of an experimental platform using cloud environments; a client’s request for data can result open source tools and libraries that work in combi- in a large communication overhead in the proxy net- nation with real-world cloud services to evaluate the

Research Feature

system’s functionality and limitations, and make further 16. L. Xiong, S. Chitti, and L. Liu, “Preserving Data Privacy in refinements. Outsourcing Data Aggregation Services,” ACM Trans. Inter- Currently, our research team is working toward a net Technology, Aug. 2007, p. 17. single viable proxy deployment strategy based on use 17. D.J. Abadi, S. Madden, and M. Ferreira, “Integrating Com- pression and Execution in Column-Oriented Database cases, trust, and security requirements. We are also de- Systems,” Proc. ACM SIGMOD Int’l Conf. Management of veloping specifications to instantiate, deploy, maintain, Data (SIGMOD 06), ACM, 2006, pp. 671-682. and release proxy virtual machines reliably and securely, along with a suite of proxy services to support various Mukesh Singhal is a Chancellor’s Professor in the Computer collaboration use cases. Our incremental approach to the Science and Engineering program at the University of Cali- development of proxy services for collaboration initially fornia, Merced. His research interests include distributed computing, cloud computing, security, and networks. Sing- provides support for simple use cases, later progressing hal received a PhD in computer science from the University of to more complex use cases. Maryland, College Park. He is an IEEE Fellow. Contact him at [email protected]. References Santosh Chandrasekhar is a postdoctoral research scholar 1. P. Mell and T. Grance, The NIST Definition of Cloud Comput- at the University of California, Merced. His research interests ing, special publication 800-145, Nat’l Inst. Standards and include building cryptographic protocols for securing wired Technology, 2011, p. iii + 3. and wireless networks and their applications. Chandrasekhar 2. D. Bernstein and D. Vij, “Intercloud Security Consider- received a PhD in computer science from the University of Ken- ations,” Proc. 2nd Int’l Conf. Cloud Computing (CloudCom tucky. Contact him at [email protected]. 10), IEEE Press, 2010, pp. 537-544. Tingjian Ge is an assistant professor of computer science at 3. R. Buyya et al., “Market-Oriented Cloud Computing: Vision, the University of Massachusetts Lowell. His research interests Hype, and Reality of Delivering Computing as the 5th Util- include database security and privacy, uncertain and probabi- ity,” Proc. 9th IEEE/ACM Int’l Symp. Cluster Computing and listic data, and scientific data management. Ge received a PhD the Grid (CCGRID 09), IEEE CS, 2009, pp. 599-616. in computer science from Brown University. Contact him at 4. B. Rochwerger et al., “Reservoir—When One Cloud Is Not [email protected]. Enough,” Computer, Mar. 2011, pp. 44-51. Ravi Sandhu is the executive director of the Institute for Cyber 5. M.P. Papazoglou and W. van den Heuvel, “Blueprinting the Security at the University of Texas at San Antonio, where he Cloud,” IEEE Computing, Nov./Dec 2011, pp. 74-79. holds the Lutcher Brown Endowed Chair in Cyber Security. His 6. S. Ortiz Jr., “The Problem with Cloud Computing Standard- research interests focus on cybersecurity practice and educa- ization,” Computer, July 2011, pp. 13-16. tion. Sandhu received a PhD in computer science from Rutgers 7. P. Mell and T. Grance, “Perspectives on Cloud Computing University. He is an IEEE, ACM, and AAAS Fellow. Contact him and Standards, NIST Information Technology Laboratory,” at [email protected]. Nat’l Inst. Standards and Technology, 2008; http://csrc.nist. gov/groups/SMA/ispab/documents/minutes/2008-12/cloud- Ram Krishnan is an assistant professor in the Department of computing-standards_ISPAB-Dec2008_P-Mell.pdf. Electrical and Computer Engineering at the University of Texas at San Antonio. His research interests include the authoriza- 8. W. Jansen and T. Grance, Guidelines on Security and Privacy tion aspects of computer security. Krishnan received a PhD in in Public Cloud Computing, special publication 800-144, computer science from George Mason University. Contact him Nat’l Inst. Standards and Technology, 2011, p. x + 70. at [email protected]. 9. S. Chandrasekhar et al., “Efficient Proxy Signatures Based on Trapdoor Hash Functions,” IET Information Security, Gail-Joon Ahn is an associate professor in the School of Com- Dec. 2010, pp. 322-332. puting, Informatics, and Decision Systems Engineering at 10. C.M. Ellison et al., SPKI Certificate Theory, IETF RFC 2693, Arizona State University, and the director of security engi- Sept. 1999; www.ietf.org/rfc/rfc2693.txt. neering for the Future Computing Laboratory. His research 11. E. Hammer-Lahav, ed., The OAuth 1.0 Protocol, IETF RFC interests focus on vulnerability and risk management, access 5849, Apr. 2010; http://tools.ietf.org/html/rfc5849. control, and security architectures for distributed systems. Ahn received a PhD in computer science from George Mason 12. Y. Zhang and J.B.D. Joshi, “Access Control and Trust Man- University. Contact him at [email protected]. agement for Emerging Multidomain Environments,” Ann. Emerging Research in Information Assurance, Security and Elisa Bertino is a professor of computer science at Purdue Privacy Services, Emerald Group Publishing, 2009, pp. University, research director for the Center of Education and 421-452. Research in Information Assurance and Security (CERIAS), and 13. J. Jin et al., “Patient-Centric Authorization Framework for director of the Discovery Park Cyber Center. Her research inter- Electronic Healthcare Services,” Computers & Security, ests focus on data privacy and security. Bertino received a PhD Mar.-May 2011, pp. 116-127. in computer science from the University of Pisa, Italy. She is an 14. R. Wu, G.J. Ahn, and H. Hu, “Towards HIPAA-Compliant IEEE and ACM Fellow. Contact her at [email protected]. Healthcare Systems,” Proc. 2nd ACM Int’l Symp. Health In- formatics (IHI 12), ACM, 2012, pp. 593-602. 15. N.R. Adam and J.C. Wortmann, “Security-Control Methods for Statistical Databases: A Comparative Study,” ACM Com- Selected CS articles and columns are available puting Surveys, Mar. 1989, pp. 515-556. for free at http://ComputingNow.computer.org.

84 computer