Distributed and Cloud Computing
K. Hwang, G. Fox and J. Dongarra
Chapter 4: Cloud Platform Architecture
over Virtualized Datacenters
(suggested for use in 5 lectures in 250 minutes)
Prepared by Kai Hwang
University of Southern California
April 3, 2012
Copyright © 2012, Elsevier Inc. All rights reserved. 4-1
Copyright © 2012, Elsevier Inc. All rights reserved. 4-2
Copyright © 2012, Elsevier Inc. All rights reserved. 4-3
Copyright © 2012, Elsevier Inc. All rights reserved. 4-4
Trusted Zones for VM Insulation
Insulate Anti-malware
Federate infrastructure
Identity
identities from Malware, Cybercrime
federation intelligence
with Trojans and
public cybercriminal Strong
APP APP
clouds OS OS
Tena s authentication
nt #2 Insulate
Control Virtual Infrastructure
Virtual and isolate informatio Data loss
network VM in the n prevention
security virtual APP APP from other
OS OS
Tena tenants
infrastruct nt #1
ure Virtual Infrastructure Insulate Encryption &
Access Segregate informatio key mgmt
Mgmt and control n from
cloud Tokenization
user access Cloud Provider providers’
Security Info. &
Physical employees
Event Mgmt Infrastructure
Physical Infrastructure GRC
Enable end to end view of security events
and compliance across infrastructures
Copyright © 2012, Elsevier Inc. All rights reserved.
October 26, 2011 4-5
Security Issues on VMs
Access Control is discretionary. Fine-grained multilevel controls are
needed (Iitegrity lock architecture)
Secure Boot – The boot process needs to be secured. Proper attestation
methods desired. More robust logging is needed.
Component Isolation – Dom0 in XEN supports networking, disk I/O, VM boot
loading, hardware emulation and workload balancing, all need to be
decomposed into components
Logging –Introspection – a VM running security software is allowed to look
inside the memory of another VM. Software such as IPS and antriviruses,
using introspection should be safe from tampering.
Avoiding man-in-the-middle attack on VMs during VM migration.
Copyright © 2012, Elsevier Inc. All rights reserved.
October 26, 2011 Prof. Kai Hwang, USC/THU 4-6
Copyright © 2012, Elsevier Inc. All rights reserved. 4-7
Fine-grained Access Control with Hive
Hive is a data warehouse infrastructure built on top of Hadoop that
provides tools to enable easy data summarization, adhoc querying and
analysis of large datasets stored in Hadoop files. It provides a
mechanism to put structure on this data with a simple query language
called Hive QL based on SQL.
Policies include content dependent access control, association based
access control, time-dependent access control
Table/View definition and loading,
Users create tables as well as load data into tables. Further, they
can also upload XACML policies for the table they are creating.
Users can also create XACML policies for tables/views.
Users define views only if they have permissions for all tables
Specifing in the query to create the view, they can create XACML
policies for the views defined.
Copyright © 2012, Elsevier Inc. All rights reserved. 4-8
(Courtesy of Hai Jin, 2012)
Copyright © 2012, Elsevier Inc. All rights reserved. 4-9
(Courtesy of Hai Jin, 2012)
Copyright © 2012, Elsevier Inc. All rights reserved. 4 - 10
(Courtesy of Hai Jin, 2012)
Copyright © 2012, Elsevier Inc. All rights reserved. 4 - 11
(Courtesy of Hai Jin, 2012)
Copyright © 2012, Elsevier Inc. All rights reserved. 4 - 12
Copyright © 2012, Elsevier Inc. All rights reserved. 4 - 13
Reputation Systems for Social
Networks and Cloud Systems
Copyright © 2012, Elsevier Inc. All rights reserved. 14
4 - 14
PowerTrust Built over A Trust Overlay Network
Global Reputation Scores V
v1 v2 v3 ... ... ... ... vn
Power
Initial Reputation Nodes
Reputation Updating
Aggregation
Regular Random Walk Look-ahead Random Walk Distributed Ranking Module
Local Trust Scores
Trust Overlay Network
(Courtesy of R. Zhou and K. Hwang, “PowerTrust : A scalable and robust reputation
system for structured P2P networks”, IEEE-TPDS, May 2007)
Copyright © 2012, Elsevier Inc. All rights reserved. 4 - 15
Data Coloring for Cloud Privacy Protection
Copyright © 2012, Elsevier Inc. All rights reserved. 4 - 16
Copyright © 2012, Elsevier Inc. All rights reserved. 4 - 17
Clouds vs. Job Opportunities
Clouds forming a major industry thrust that IDC estimates will grow to
$44.2 billion investment in 2013 while 15% of IT investment in 2011 was
related to cloud systems.
Gartner rates cloud computing high on list of critical emerging
technologies that are transformational (their highest rating for impact)
in the next 2 - 5 years.
There are many opportunities for new jobs in cloud computing with a
recent European study estimating 2.4 million new cloud computing
jobs in Europe alone by 2015.
Cloud computing spans research and economy and so attractive
component of curriculum for students that mix “going on to PhD” or
“graduating and working in industry”
(Courtesy of Geoffrey Fox, 2012)
Copyright © 2012, Elsevier Inc. All rights reserved. 4 - 18
Conclusions:
Computing clouds are changing the whole IT , service
industry, and global economy. Clearly, cloud computing
demands ubiquity, efficiency, security, and
trustworthiness.
Cloud computing has become a common practice in business,
government, education, and entertainment leveraging 50 millions
of servers globally installed at thousands of datacenters today.
Private clouds will become widespread in addition to using a few
public clouds, that are under heavy competition among Google, MS,
Amazon, Intel, EMC, IBM, SGI, VMWare, Saleforce.com, etc.
Effective trust management, guaranteed security, user privacy,
data integrity, mobility support, and copyright protection are crucial
to the universal acceptance of cloud as a ubiquitous service.
Copyright © 2012, Elsevier Inc. All rights reserved. 4 - 19
Basic Papers to Read:
1. M. Armbrust, et al, “Above the Clouds: A Berkeley View of Cloud
Computing”, Technical Report, UCB/EECS-2009-28, Feb.2009.
2. K. Hwang and D. Li, “ Trusted Cloud Computing with Secure
Resources and Data Coloring”, IEEE Internet Computing, Sept.
2010.
3. M. Rosenblum and T. Garfinkel, “Virtual Machine Monitors: Current
Technology and Future Trends”, IEEE Computer, May 2005, pp.39-
47.
4. B. Sotomayor, R. Montero, and I. Foster, “Virtual Infrastructure
Management in Private and Hybrid Clouds”, IEEE Internet
Copyright © 2012, Elsevier Inc. All rights reserved. 4 - 20
Computing, Sept. 2009
