首页 > 最新文献

2015 IEEE International Conference on Cloud Engineering最新文献

英文 中文
Cloud Storage Infrastructure Optimization Analytics 云存储基础设施优化分析
Pub Date : 2015-03-09 DOI: 10.1109/IC2E.2015.83
R. Routray
Emergence and adoption of cloud computing have become widely prevalent given the value proposition it brings to an enterprise in terms of agility and cost effectiveness. Big data analytical capabilities (specifically treating storage/system management as a big data problem for a service provider) using Cloud delivery models is defined as Analytics as a Service or Software as a Service. This service simplifies obtaining useful insights from an operational enterprise data center leading to cost and performance optimizations.Software defined environments decouple the control planes from the data planes that were often vertically integrated in a traditional networking or storage systems. The decoupling between the control planes and the data planes enables opportunities for improved security, resiliency and IT optimization in general. This talk describes our novel approach in hosting the systems management platform (a.k.a. control plane) in the cloud offered to enterprises in Software as a Service (SaaS) model. Specifically, in this presentation, focus is on the analytics layer with SaaS paradigm enabling data centers to visualize, optimize and forecast infrastructure via a simple capture, analyze and govern framework. At the core, it uses big data analytics to extract actionable insights from system management metrics data. Our system is developed in research and deployed across customers, where core focus is on agility, elasticity and scalability of the analytics framework. We demonstrate few system/storage management analytics case studies to demonstrate cost and performance optimization for both cloud consumer as well as service provider. Actionable insights generated from the analytics platform are implemented in an automated fashion via an OpenStack based platform.
考虑到云计算在敏捷性和成本效益方面给企业带来的价值主张,它的出现和采用已经变得非常普遍。使用云交付模型的大数据分析能力(特别是将存储/系统管理视为服务提供商的大数据问题)被定义为分析即服务或软件即服务。该服务简化了从运营企业数据中心获得有用的见解,从而实现了成本和性能优化。软件定义的环境将控制平面与通常垂直集成在传统网络或存储系统中的数据平面解耦。控制平面和数据平面之间的解耦为提高安全性、弹性和IT优化提供了机会。本演讲描述了我们在云上托管系统管理平台(又名控制平面)的新方法,该方法以软件即服务(SaaS)模型提供给企业。具体来说,在本次演讲中,重点是SaaS范式的分析层,使数据中心能够通过简单的捕获、分析和治理框架对基础设施进行可视化、优化和预测。它的核心是使用大数据分析从系统管理指标数据中提取可操作的见解。我们的系统是在研究中开发的,并在客户中部署,其核心重点是分析框架的敏捷性、弹性和可扩展性。我们演示了几个系统/存储管理分析案例研究,以演示云消费者和服务提供商的成本和性能优化。分析平台生成的可操作见解通过基于OpenStack的平台以自动化的方式实现。
{"title":"Cloud Storage Infrastructure Optimization Analytics","authors":"R. Routray","doi":"10.1109/IC2E.2015.83","DOIUrl":"https://doi.org/10.1109/IC2E.2015.83","url":null,"abstract":"Emergence and adoption of cloud computing have become widely prevalent given the value proposition it brings to an enterprise in terms of agility and cost effectiveness. Big data analytical capabilities (specifically treating storage/system management as a big data problem for a service provider) using Cloud delivery models is defined as Analytics as a Service or Software as a Service. This service simplifies obtaining useful insights from an operational enterprise data center leading to cost and performance optimizations.Software defined environments decouple the control planes from the data planes that were often vertically integrated in a traditional networking or storage systems. The decoupling between the control planes and the data planes enables opportunities for improved security, resiliency and IT optimization in general. This talk describes our novel approach in hosting the systems management platform (a.k.a. control plane) in the cloud offered to enterprises in Software as a Service (SaaS) model. Specifically, in this presentation, focus is on the analytics layer with SaaS paradigm enabling data centers to visualize, optimize and forecast infrastructure via a simple capture, analyze and govern framework. At the core, it uses big data analytics to extract actionable insights from system management metrics data. Our system is developed in research and deployed across customers, where core focus is on agility, elasticity and scalability of the analytics framework. We demonstrate few system/storage management analytics case studies to demonstrate cost and performance optimization for both cloud consumer as well as service provider. Actionable insights generated from the analytics platform are implemented in an automated fashion via an OpenStack based platform.","PeriodicalId":395715,"journal":{"name":"2015 IEEE International Conference on Cloud Engineering","volume":"34 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125668156","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Scalable Attestation: A Step Toward Secure and Trusted Clouds 可扩展认证:迈向安全和可信云的一步
Pub Date : 2015-03-09 DOI: 10.1109/MCC.2015.97
Stefan Berger, Kenneth A. Goldman, D. Pendarakis, D. Safford, Enriquillo Valdez, Mimi Zohar
In this work we present Scalable Attestation, a method which combines both secure boot and trusted boot technologies, and extends them up into the host, its programs, and up into the guest's operating system and workloads, to both detect and prevent integrity attacks. Anchored in hardware, this integrity appraisal and attestation protects persistent data (files) from remote attack, even if the attack is root privileged. As an added benefit of a hardware rooted attestation, we gain a simple hardware based geolocation attestation to help enforce regulatory requirements. This design is implemented in multiple cloud test beds based on the QEMU/KVM hypervisor, Open Stack, and Open Attestation, and is shown to provide significant additional integrity protection at negligible cost.
在这项工作中,我们提出了可扩展的认证,这是一种结合了安全引导和可信引导技术的方法,并将它们扩展到主机、其程序以及客户的操作系统和工作负载中,以检测和防止完整性攻击。这种完整性评估和认证固定在硬件中,可以保护持久数据(文件)免受远程攻击,即使攻击是由root特权发起的。作为基于硬件的认证的一个额外好处,我们获得了一个简单的基于硬件的地理位置认证,以帮助执行法规要求。该设计在基于QEMU/KVM管理程序、Open Stack和Open Attestation的多个云测试平台中实现,并以可忽略不计的成本提供重要的额外完整性保护。
{"title":"Scalable Attestation: A Step Toward Secure and Trusted Clouds","authors":"Stefan Berger, Kenneth A. Goldman, D. Pendarakis, D. Safford, Enriquillo Valdez, Mimi Zohar","doi":"10.1109/MCC.2015.97","DOIUrl":"https://doi.org/10.1109/MCC.2015.97","url":null,"abstract":"In this work we present Scalable Attestation, a method which combines both secure boot and trusted boot technologies, and extends them up into the host, its programs, and up into the guest's operating system and workloads, to both detect and prevent integrity attacks. Anchored in hardware, this integrity appraisal and attestation protects persistent data (files) from remote attack, even if the attack is root privileged. As an added benefit of a hardware rooted attestation, we gain a simple hardware based geolocation attestation to help enforce regulatory requirements. This design is implemented in multiple cloud test beds based on the QEMU/KVM hypervisor, Open Stack, and Open Attestation, and is shown to provide significant additional integrity protection at negligible cost.","PeriodicalId":395715,"journal":{"name":"2015 IEEE International Conference on Cloud Engineering","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132337958","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 38
An SDN Based Intra-Domain Routing and Resource Management Model 基于SDN的域内路由和资源管理模型
Pub Date : 2015-03-09 DOI: 10.1109/IC2E.2015.47
M. R. Çelenlioglu, H. A. Mantar
Software Defined Networking (SDN) has become a promising network architecture that simplifies the network control, management and deployment of differentiated services. SDN architecture decouples control and data planes. Control functions are moved to a logically centralized entity called controller. The underlying infrastructure solely performs forwarding. Most of the previous studies focus on using SDN in data centers. In this paper, we propose scalable routing and resource management model for SDN based intra-domain networks. To virtualize the underlying network, we use pre-established multi-paths (PMP) between each ingress-egress switch. SDN-Controller performs admission control, routing, load balancing and path resizing functions based on these paths. The experimental results show that the proposed model significantly improves routing and signaling scalability, network resource utilization and decreases admission control time.
软件定义网络(SDN)是一种很有发展前景的网络架构,它可以简化网络控制、管理和差异化业务的部署。SDN架构将控制平面和数据平面解耦。控制功能被转移到一个逻辑上集中的实体,称为控制器。底层基础设施单独执行转发。以往的研究大多集中在SDN在数据中心的应用上。本文提出了基于SDN的域内网络的可扩展路由和资源管理模型。为了虚拟化底层网络,我们在每个进出口交换机之间使用预先建立的多路径(PMP)。SDN-Controller基于这些路径实现准入控制、路由、负载均衡和路径大小调整等功能。实验结果表明,该模型显著提高了路由和信令的可扩展性、网络资源利用率和准入控制时间。
{"title":"An SDN Based Intra-Domain Routing and Resource Management Model","authors":"M. R. Çelenlioglu, H. A. Mantar","doi":"10.1109/IC2E.2015.47","DOIUrl":"https://doi.org/10.1109/IC2E.2015.47","url":null,"abstract":"Software Defined Networking (SDN) has become a promising network architecture that simplifies the network control, management and deployment of differentiated services. SDN architecture decouples control and data planes. Control functions are moved to a logically centralized entity called controller. The underlying infrastructure solely performs forwarding. Most of the previous studies focus on using SDN in data centers. In this paper, we propose scalable routing and resource management model for SDN based intra-domain networks. To virtualize the underlying network, we use pre-established multi-paths (PMP) between each ingress-egress switch. SDN-Controller performs admission control, routing, load balancing and path resizing functions based on these paths. The experimental results show that the proposed model significantly improves routing and signaling scalability, network resource utilization and decreases admission control time.","PeriodicalId":395715,"journal":{"name":"2015 IEEE International Conference on Cloud Engineering","volume":"73 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132112001","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 20
Efficient Software-Based Mobile Cloud Computing Framework 高效的基于软件的移动云计算框架
Pub Date : 2015-03-09 DOI: 10.1109/IC2E.2015.48
L. Tawalbeh, Y. Haddad, Omar Khamis, Fahd M. Al-Dosari, E. Benkhelifa
This paper proposes an efficient software based data possession mobile cloud computing framework. The proposed design utilizes the characteristics of two frameworks. The first one is the provable data possession design built for resource-constrained mobile devices and it uses the advantage of trusted computing technology, and the second framework is a lightweight resilient storage outsourcing design for mobile cloud computing systems. Our software based framework utilizes the strength aspects in both mentioned frameworks to gain better performance and security. The evaluation and comparison results showed that our design has better flexibility and efficiency than other related frameworks.
提出了一种高效的基于软件的数据占有移动云计算框架。提出的设计利用了两个框架的特点。第一个框架是针对资源受限的移动设备构建的可证明数据占有设计,它利用了可信计算技术的优势;第二个框架是针对移动云计算系统的轻量级弹性存储外包设计。我们的基于软件的框架利用了上述两个框架的强度方面来获得更好的性能和安全性。评估和比较结果表明,我们的设计比其他相关框架具有更好的灵活性和效率。
{"title":"Efficient Software-Based Mobile Cloud Computing Framework","authors":"L. Tawalbeh, Y. Haddad, Omar Khamis, Fahd M. Al-Dosari, E. Benkhelifa","doi":"10.1109/IC2E.2015.48","DOIUrl":"https://doi.org/10.1109/IC2E.2015.48","url":null,"abstract":"This paper proposes an efficient software based data possession mobile cloud computing framework. The proposed design utilizes the characteristics of two frameworks. The first one is the provable data possession design built for resource-constrained mobile devices and it uses the advantage of trusted computing technology, and the second framework is a lightweight resilient storage outsourcing design for mobile cloud computing systems. Our software based framework utilizes the strength aspects in both mentioned frameworks to gain better performance and security. The evaluation and comparison results showed that our design has better flexibility and efficiency than other related frameworks.","PeriodicalId":395715,"journal":{"name":"2015 IEEE International Conference on Cloud Engineering","volume":"247 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131391075","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 14
Software-Defined Flow Table Pipeline 软件定义流表管道
Pub Date : 2015-03-09 DOI: 10.1109/IC2E.2015.52
Xiaoye Sun, T. Ng, Guohui Wang
Software-Defined Networking (SDN) is revolutionizing data center networks for cloud computing with its ability to enable network virtualization and powerful network resource management that are crucial in any multi-tenant environment. In order to support sophisticated network control logic, the data plane of a switch should have a flexible Flow Table Pipeline (FTP). However, the FTP on state-of-the-art SDN switches is hardware-defined, which greatly limits the advantages of using FTP in cloud computing systems. This paper removes this limitation by introducing software-defined FTP (SDFTP), which provides an extremely flexible FTP as the southbound interface of the SDN control plane. SDFTP offers arbitrary number of pipeline stages and adaptive flow table sizing at runtime by building Software-Defined Flow Tables (SDFTs). Our analysis shows that SDFTP could create 138 times more adaptively sized pipeline stages than the hardware-defined data plane while maintaining comparable performance.
软件定义网络(SDN)正在彻底改变云计算的数据中心网络,它支持网络虚拟化和强大的网络资源管理,这在任何多租户环境中都是至关重要的。为了支持复杂的网络控制逻辑,交换机的数据平面应具有灵活的FTP (Flow Table Pipeline)。然而,最先进的SDN交换机上的FTP是硬件定义的,这极大地限制了在云计算系统中使用FTP的优势。本文通过引入软件定义FTP (SDFTP)来消除这一限制,它提供了一个极其灵活的FTP作为SDN控制平面的南向接口。SDFTP通过构建软件定义流表(SDFTs),在运行时提供任意数量的管道级和自适应流表大小。我们的分析表明,SDFTP可以创建比硬件定义的数据平面多138倍的自适应大小的管道阶段,同时保持相当的性能。
{"title":"Software-Defined Flow Table Pipeline","authors":"Xiaoye Sun, T. Ng, Guohui Wang","doi":"10.1109/IC2E.2015.52","DOIUrl":"https://doi.org/10.1109/IC2E.2015.52","url":null,"abstract":"Software-Defined Networking (SDN) is revolutionizing data center networks for cloud computing with its ability to enable network virtualization and powerful network resource management that are crucial in any multi-tenant environment. In order to support sophisticated network control logic, the data plane of a switch should have a flexible Flow Table Pipeline (FTP). However, the FTP on state-of-the-art SDN switches is hardware-defined, which greatly limits the advantages of using FTP in cloud computing systems. This paper removes this limitation by introducing software-defined FTP (SDFTP), which provides an extremely flexible FTP as the southbound interface of the SDN control plane. SDFTP offers arbitrary number of pipeline stages and adaptive flow table sizing at runtime by building Software-Defined Flow Tables (SDFTs). Our analysis shows that SDFTP could create 138 times more adaptively sized pipeline stages than the hardware-defined data plane while maintaining comparable performance.","PeriodicalId":395715,"journal":{"name":"2015 IEEE International Conference on Cloud Engineering","volume":"44 1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129194579","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 14
ASETS: A SDN Empowered Task Scheduling System for HPCaaS on the Cloud ASETS:用于云上HPCaaS的SDN授权任务调度系统
Pub Date : 2015-03-09 DOI: 10.1109/IC2E.2015.56
S. Jamalian, H. Rajaei
With increasing demands for High Performance Computing (HPC), new ideas and methods are emerged to utilize computing resources more efficiently. Cloud Computing appears to provide benefits such as resource pooling, broad network access and cost efficiency for the HPC applications. However, moving the HPC applications to the cloud can face several key challenges, primarily, the virtualization overhead, multi-tenancy and network latency. Software-Defined Networking (SDN) as an emerging technology appears to pave the road and provide dynamic manipulation of cloud networking such as topology, routing, and bandwidth allocation. This paper presents a new scheme called ASETS which targets dynamic configuration and monitoring of cloud networking using SDN to improve the performance of HPC applications and in particular task scheduling for HPC as a service on the cloud (HPCaaS). Further, SETSA, (SDN-Empowered Task Scheduler Algorithm) is proposed as a novel task scheduling algorithm for the offered ASETS architecture. SETSA monitors the network bandwidth to take advantage of its changes when submitting tasks to the virtual machines. Empirical analysis of the algorithm in different case scenarios show that SETSA has significant potentials to improve the performance of HPCaaS platforms by increasing the bandwidth efficiency and decreasing task turnaround time. In addition, SETSAW, (SETSA Window) is proposed as an improvement of the SETSA algorithm.
随着对高性能计算(HPC)需求的不断增长,人们提出了新的思想和方法来更有效地利用计算资源。云计算似乎为高性能计算应用程序提供了诸如资源池、广泛的网络访问和成本效率等好处。然而,将HPC应用程序迁移到云端可能面临几个关键挑战,主要是虚拟化开销、多租户和网络延迟。软件定义网络(SDN)作为一种新兴技术似乎为云网络铺平了道路,并提供了拓扑、路由和带宽分配等云网络的动态操作。本文提出了一种名为ASETS的新方案,其目标是使用SDN动态配置和监控云网络,以提高HPC应用程序的性能,特别是HPC即云服务(HPCaaS)的任务调度。在此基础上,提出了基于sdn的任务调度算法SETSA (sdn - empowering Task Scheduler Algorithm)作为一种新的任务调度算法。SETSA监视网络带宽,以便在向虚拟机提交任务时利用其变化。在不同场景下的实证分析表明,SETSA通过提高带宽效率和减少任务周转时间来提高HPCaaS平台的性能具有显著的潜力。此外,作为SETSA算法的改进,提出了SETSAW (SETSA窗口)。
{"title":"ASETS: A SDN Empowered Task Scheduling System for HPCaaS on the Cloud","authors":"S. Jamalian, H. Rajaei","doi":"10.1109/IC2E.2015.56","DOIUrl":"https://doi.org/10.1109/IC2E.2015.56","url":null,"abstract":"With increasing demands for High Performance Computing (HPC), new ideas and methods are emerged to utilize computing resources more efficiently. Cloud Computing appears to provide benefits such as resource pooling, broad network access and cost efficiency for the HPC applications. However, moving the HPC applications to the cloud can face several key challenges, primarily, the virtualization overhead, multi-tenancy and network latency. Software-Defined Networking (SDN) as an emerging technology appears to pave the road and provide dynamic manipulation of cloud networking such as topology, routing, and bandwidth allocation. This paper presents a new scheme called ASETS which targets dynamic configuration and monitoring of cloud networking using SDN to improve the performance of HPC applications and in particular task scheduling for HPC as a service on the cloud (HPCaaS). Further, SETSA, (SDN-Empowered Task Scheduler Algorithm) is proposed as a novel task scheduling algorithm for the offered ASETS architecture. SETSA monitors the network bandwidth to take advantage of its changes when submitting tasks to the virtual machines. Empirical analysis of the algorithm in different case scenarios show that SETSA has significant potentials to improve the performance of HPCaaS platforms by increasing the bandwidth efficiency and decreasing task turnaround time. In addition, SETSAW, (SETSA Window) is proposed as an improvement of the SETSA algorithm.","PeriodicalId":395715,"journal":{"name":"2015 IEEE International Conference on Cloud Engineering","volume":"371 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123483261","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
Architecture for High Confidence Cloud Security Monitoring 高置信度云安全监控架构
Pub Date : 2015-03-09 DOI: 10.1109/IC2E.2015.21
T. Kanstrén, S. Lehtonen, R. Savola, Hilkka Kukkohovi, Kimmo Hätönen
Operational security assurance of a networked system requires providing constant and up-to-date evidence of its operational state. In a cloud-based environment we deploy our services as virtual guests running on external hosts. As this environment is not under our full control, we have to find ways to provide assurance that the security information provided from this environment is accurate, and our software is running in the expected environment. In this paper, we present an architecture for providing increased confidence in measurements of such cloud-based deployments. The architecture is based on a set of deployed measurement probes and trusted platform modules (TPM) across both the host infrastructure and guest virtual machines. The TPM are used to verify the integrity of the probes and measurements they provide. This allows us to ensure that the system is running in the expected environment, the monitoring probes have not been tampered with, and the integrity of measurement data provided is maintained. Overall this gives us a basis for increased confidence in the security of running parts of our system in an external cloud-based environment.
网络系统的运行安全保障要求提供其运行状态的持续和最新的证据。在基于云的环境中,我们将服务部署为运行在外部主机上的虚拟来宾。由于这个环境不受我们的完全控制,我们必须找到方法来保证从这个环境中提供的安全信息是准确的,并且我们的软件在预期的环境中运行。在本文中,我们提出了一种架构,用于提高对此类基于云的部署的测量的信心。该体系结构基于一组部署的度量探针和可信平台模块(TPM),这些模块跨主机基础设施和来宾虚拟机。TPM用于验证它们提供的探针和测量的完整性。这使我们能够确保系统在预期的环境中运行,监控探头没有被篡改,并且所提供的测量数据的完整性得到维护。总的来说,这为我们在外部基于云的环境中运行系统部分的安全性增加了信心。
{"title":"Architecture for High Confidence Cloud Security Monitoring","authors":"T. Kanstrén, S. Lehtonen, R. Savola, Hilkka Kukkohovi, Kimmo Hätönen","doi":"10.1109/IC2E.2015.21","DOIUrl":"https://doi.org/10.1109/IC2E.2015.21","url":null,"abstract":"Operational security assurance of a networked system requires providing constant and up-to-date evidence of its operational state. In a cloud-based environment we deploy our services as virtual guests running on external hosts. As this environment is not under our full control, we have to find ways to provide assurance that the security information provided from this environment is accurate, and our software is running in the expected environment. In this paper, we present an architecture for providing increased confidence in measurements of such cloud-based deployments. The architecture is based on a set of deployed measurement probes and trusted platform modules (TPM) across both the host infrastructure and guest virtual machines. The TPM are used to verify the integrity of the probes and measurements they provide. This allows us to ensure that the system is running in the expected environment, the monitoring probes have not been tampered with, and the integrity of measurement data provided is maintained. Overall this gives us a basis for increased confidence in the security of running parts of our system in an external cloud-based environment.","PeriodicalId":395715,"journal":{"name":"2015 IEEE International Conference on Cloud Engineering","volume":"51 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114569675","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 11
Towards a Practical and Efficient Search over Encrypted Data in the Cloud 实现对云中加密数据的实用和高效搜索
Pub Date : 2015-03-09 DOI: 10.1109/IC2E.2015.86
M. Strizhov
Searchable encryption allows a client to encrypt its document collection in such a way that the encrypted collection can still be searched. The most immediate application of searchable encryption is privacy / confidentiality preserving cloud storage, where it enables a client to securely outsource its document collection to an untrusted cloud provider without sacrificing the ability to search over it. Our research focuses on developing a novel searchable encryption framework that allows the cloud server to perform multi-keyword ranked search as well as substring search incorporating position information. We present some advances that we have accomplished in this area. We then layout our planned research work and a timeline to accomplish this.
可搜索加密允许客户端加密其文档集合,这样加密的集合仍然可以被搜索。可搜索加密最直接的应用是保护隐私/机密性的云存储,它使客户能够安全地将其文档集合外包给不受信任的云提供商,而不会牺牲对其进行搜索的能力。我们的研究重点是开发一种新的可搜索加密框架,该框架允许云服务器执行多关键字排名搜索以及包含位置信息的子字符串搜索。我们将介绍我们在这一领域取得的一些进展。然后我们安排我们计划的研究工作和完成这项工作的时间表。
{"title":"Towards a Practical and Efficient Search over Encrypted Data in the Cloud","authors":"M. Strizhov","doi":"10.1109/IC2E.2015.86","DOIUrl":"https://doi.org/10.1109/IC2E.2015.86","url":null,"abstract":"Searchable encryption allows a client to encrypt its document collection in such a way that the encrypted collection can still be searched. The most immediate application of searchable encryption is privacy / confidentiality preserving cloud storage, where it enables a client to securely outsource its document collection to an untrusted cloud provider without sacrificing the ability to search over it. Our research focuses on developing a novel searchable encryption framework that allows the cloud server to perform multi-keyword ranked search as well as substring search incorporating position information. We present some advances that we have accomplished in this area. We then layout our planned research work and a timeline to accomplish this.","PeriodicalId":395715,"journal":{"name":"2015 IEEE International Conference on Cloud Engineering","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114748857","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
Integrating Messaging Middleware and Information Flow Control 集成消息传递中间件和信息流控制
Pub Date : 2015-03-09 DOI: 10.1109/IC2E.2015.13
Jatinder Singh, Thomas Pasquier, J. Bacon, D. Eyers
Security is an ongoing challenge in cloud computing. Currently, cloud consumers have few mechanisms for managing their data within the cloud provider's infrastructure. Information Flow Control (IFC) involves attaching labels to data, to govern its flow throughout a system. We have worked on kernel-level IFC enforcement to protect data flows within a virtual machine (VM). This paper makes the case for, and demonstrates the feasibility of an IFC-enabled messaging middleware, to enforce IFC within and across applications, containers, VMs, and hosts. We detail how such middleware can integrate with local (kernel) enforcement mechanisms, and highlight the benefits of separating data management policy from application/service-logic.
安全性是云计算领域的一个持续挑战。目前,云用户在云提供商的基础设施中管理数据的机制很少。信息流控制(IFC)包括给数据贴上标签,以控制其在整个系统中的流动。我们致力于内核级IFC强制执行,以保护虚拟机(VM)内的数据流。本文阐述并演示了启用IFC的消息传递中间件在应用程序、容器、虚拟机和主机内部和跨应用程序中实施IFC的可行性。我们详细介绍了这些中间件如何与本地(内核)实施机制集成,并强调了将数据管理策略与应用程序/服务逻辑分离的好处。
{"title":"Integrating Messaging Middleware and Information Flow Control","authors":"Jatinder Singh, Thomas Pasquier, J. Bacon, D. Eyers","doi":"10.1109/IC2E.2015.13","DOIUrl":"https://doi.org/10.1109/IC2E.2015.13","url":null,"abstract":"Security is an ongoing challenge in cloud computing. Currently, cloud consumers have few mechanisms for managing their data within the cloud provider's infrastructure. Information Flow Control (IFC) involves attaching labels to data, to govern its flow throughout a system. We have worked on kernel-level IFC enforcement to protect data flows within a virtual machine (VM). This paper makes the case for, and demonstrates the feasibility of an IFC-enabled messaging middleware, to enforce IFC within and across applications, containers, VMs, and hosts. We detail how such middleware can integrate with local (kernel) enforcement mechanisms, and highlight the benefits of separating data management policy from application/service-logic.","PeriodicalId":395715,"journal":{"name":"2015 IEEE International Conference on Cloud Engineering","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116642372","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 16
Online Spike Detection in Cloud Workloads 云工作负载中的在线峰值检测
Pub Date : 2015-03-09 DOI: 10.1109/IC2E.2015.50
Amardeep Mehta, J. Durango, Johan Tordsson, E. Elmroth
We investigate methods for detection of rapid workload increases (load spikes) for cloud workloads. Such rapid and unexpected workload spikes are a main cause for poor performance or even crashing applications as the allocated cloud resources become insufficient. To detect the spikes early is fundamental to perform corrective management actions, like allocating additional resources, before the spikes become large enough to cause problems. For this, we propose a number of methods for early spike detection, based on established techniques from adaptive signal processing. A comparative evaluation shows, for example, to what extent the different methods manage to detect the spikes, how early the detection is made, and how frequently they falsely report spikes.
我们研究了检测云工作负载的快速工作负载增加(负载峰值)的方法。由于分配的云资源不足,这种快速且意外的工作负载峰值是导致性能差甚至应用程序崩溃的主要原因。及早发现尖峰是执行纠正管理行动的基础,比如在尖峰变得足够大而导致问题之前分配额外的资源。为此,我们基于自适应信号处理的成熟技术,提出了许多早期尖峰检测的方法。例如,一项比较评估显示,不同的方法在多大程度上能够检测到峰值,检测的时间有多早,以及它们错误报告峰值的频率有多高。
{"title":"Online Spike Detection in Cloud Workloads","authors":"Amardeep Mehta, J. Durango, Johan Tordsson, E. Elmroth","doi":"10.1109/IC2E.2015.50","DOIUrl":"https://doi.org/10.1109/IC2E.2015.50","url":null,"abstract":"We investigate methods for detection of rapid workload increases (load spikes) for cloud workloads. Such rapid and unexpected workload spikes are a main cause for poor performance or even crashing applications as the allocated cloud resources become insufficient. To detect the spikes early is fundamental to perform corrective management actions, like allocating additional resources, before the spikes become large enough to cause problems. For this, we propose a number of methods for early spike detection, based on established techniques from adaptive signal processing. A comparative evaluation shows, for example, to what extent the different methods manage to detect the spikes, how early the detection is made, and how frequently they falsely report spikes.","PeriodicalId":395715,"journal":{"name":"2015 IEEE International Conference on Cloud Engineering","volume":"73 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117173649","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 18
期刊
2015 IEEE International Conference on Cloud Engineering
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1