Cloud Computing Security Workshop最新文献_第3页

Benchmarking cloud security level agreements using quantitative policy trees 使用定量策略树对云安全级别协议进行基准测试

Cloud Computing Security Workshop Pub Date : 2012-10-19 DOI: 10.1145/2381913.2381932

Jesus Luna, R. Langenberg, N. Suri

{"title":"Benchmarking cloud security level agreements using quantitative policy trees","authors":"Jesus Luna, R. Langenberg, N. Suri","doi":"10.1145/2381913.2381932","DOIUrl":"https://doi.org/10.1145/2381913.2381932","url":null,"abstract":"While the many economic and technological advantages of Cloud computing are apparent, the migration of key sector applications onto it has been limited, in part, due to the lack of security assurance on the Cloud Service Provider (CSP). However, the recent efforts on specification of security statements in Service Level Agreements, also known as \"Security Level Agreements\" or SecLAs is a positive development. While a consistent notion of Cloud SecLAs is still developing, already some major CSPs are creating and storing their advocated SecLAs in publicly available repositories e.g., the Cloud Security Alliance's \"Security, Trust & Assurance Registry\" (CSA STAR). While several academic and industrial efforts are developing the methods to build and specify Cloud SecLAs, very few works deal with the techniques to quantitatively reason about SecLAs in order to provide security assurance. This paper proposes a method to benchmark - both quantitatively and qualitatively -- the Cloud SecLAs of one or more CSPs with respect to a user-defined requirement, also in the form of a SecLA. The contributed security benchmark methodology rests on the notion of Quantitative Policy Trees (QPT), a data structure that we propose to represent and systematically reason about SecLAs. In this paper we perform the initial validation of the contributed methodology with respect to another state of the art proposal, which in turn was empirically validated using the SecLAs stored on the CSA STAR repository. Finally, our research also contributes with QUANTS-as-a-Service (QUANTSaaS), a system that implements the proposed Cloud SecLA benchmark methodology.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-10-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123998843","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 65

Practical applications of homomorphic encryption 同态加密的实际应用

Cloud Computing Security Workshop Pub Date : 2012-10-19 DOI: 10.1145/2381913.2381924

K. Lauter

引用次数: 24

Efficient query integrity for outsourced dynamic databases 外包动态数据库的高效查询完整性

Cloud Computing Security Workshop Pub Date : 2012-10-19 DOI: 10.1145/2381913.2381927

Qingji Zheng, Shouhuai Xu, G. Ateniese

引用次数: 42

What if we got a do-over? 如果我们重新来过呢?

Cloud Computing Security Workshop Pub Date : 2012-10-19 DOI: 10.1145/2381913.2381923

H. Shrobe

引用次数: 3

Cloud security: myth or reality? 云安全:神话还是现实?

Cloud Computing Security Workshop Pub Date : 2011-10-21 DOI: 10.1145/2046660.2046674

T. Brown

引用次数: 0

All your clouds are belong to us: security analysis of cloud management interfaces 您所有的云都属于我们:云管理接口的安全分析

Cloud Computing Security Workshop Pub Date : 2011-10-21 DOI: 10.1145/2046660.2046664

Juraj Somorovsky, M. Heiderich, Meiko Jensen, Jörg Schwenk, Nils Gruschka, Luigi Lo Iacono

引用次数: 187

Privacy-preserving outsourcing of brute-force key searches 保护隐私的外包暴力破解密钥搜索

Cloud Computing Security Workshop Pub Date : 2011-10-21 DOI: 10.1145/2046660.2046681

Ghassan O. Karame, Srdjan Capkun, U. Maurer

引用次数: 8

Verifiable resource accounting for cloud computing services 云计算服务的可验证资源记帐

Cloud Computing Security Workshop Pub Date : 2011-10-21 DOI: 10.1145/2046660.2046666

V. Sekar, Petros Maniatis

{"title":"Verifiable resource accounting for cloud computing services","authors":"V. Sekar, Petros Maniatis","doi":"10.1145/2046660.2046666","DOIUrl":"https://doi.org/10.1145/2046660.2046666","url":null,"abstract":"Cloud computing offers users the potential to reduce operating and capital expenses by leveraging the amortization benefits offered by large, managed infrastructures. However, the black-box and dynamic nature of the cloud infrastructure makes it difficult for them to reason about the expenses that their applications incur. At the same time, the profitability of cloud providers depends on their ability to multiplex several customer applications to maintain high utilization levels. However, this multiplexing may cause providers to incorrectly attribute resource consumption to customers or implicitly bear additional costs thereby reducing their cost-effectiveness. Our position in this paper is that for cloud computing as a paradigm to be sustainable in the long term, we need a systematic approach for verifiable resource accounting. Verifiability here means that cloud customers can be assured that (a) their applications indeed physically consumed the resources they were charged for and (b) that this consumption was justified based on an agreed policy. As a first step toward this vision, in this paper we articulate the challenges and opportunities for realizing such a framework.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"35 4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131999880","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 84

Managing multi-jurisdictional requirements in the cloud: towards a computational legal landscape 管理云中的多司法管辖区要求:迈向计算法律环境

Cloud Computing Security Workshop Pub Date : 2011-10-21 DOI: 10.1145/2046660.2046678

David G. Gordon, T. Breaux

{"title":"Managing multi-jurisdictional requirements in the cloud: towards a computational legal landscape","authors":"David G. Gordon, T. Breaux","doi":"10.1145/2046660.2046678","DOIUrl":"https://doi.org/10.1145/2046660.2046678","url":null,"abstract":"Although cloud services allow organizations to transfer the planning and setup to the service provider and thus reduce costs through reuse, these services raise new questions regarding the privacy and security of personal information stored in and transferred across systems in the cloud. Prior to cloud services, personal information was commonly stored within the owning or licensing company's locality where the company maintained its facilities. Cloud services, however, move data to remote, potentially unknown, locations maintained by third parties. The responsibility for data protection and integrity no longer remains exclusively with its owner or licensee, but with these third parties. Thus, both parties must identify and manage the many regulatory requirements that govern their services and products in this multi-jurisdictional environment. To simplify this problem, we are developing methods to extract and codify regulatory requirements from government laws. We apply previously validated metrics to measure gaps and overlaps between the codified regulations. Our findings include a semi-formalization of the legal landscape using operational constructs for high- and low-watermark practices, which correspond to high- and low standards of care, respectively. Business analysts and system developers can use these watermarks to reason about compliance trade-offs based on perceived businesses costs and risks. We discovered and validated these constructs using seven U.S. state data breach notification laws that govern transactions of financial and health information of residents of these seven states.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134276613","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 12

Detecting fraudulent use of cloud resources 检测欺诈性使用云资源

Cloud Computing Security Workshop Pub Date : 2011-10-21 DOI: 10.1145/2046660.2046676

Joseph Idziorek, Mark Tannian, D. Jacobson

{"title":"Detecting fraudulent use of cloud resources","authors":"Joseph Idziorek, Mark Tannian, D. Jacobson","doi":"10.1145/2046660.2046676","DOIUrl":"https://doi.org/10.1145/2046660.2046676","url":null,"abstract":"Initial threat modeling and security research on the public cloud model has primarily focused on the confidentiality and integrity of data transferred, processed, and stored in the cloud. Little attention has been paid to the external threat sources that have the capability to affect the financial viability, hence the long-term availability, of services hosted in the public cloud. Similar to an application-layer DDoS attack, a Fraudulent Resource Consumption (FRC) attack is a much more subtle attack carried out over a longer duration of time. The objective of the attacker is to exploit the utility pricing model which governs the resource usage in the cloud model by fraudulently consuming web content with the purpose of depriving the victim of their long-term economic availability of hosting publicly accessible web content in the cloud. In this paper, we thoroughly describe the FRC attack and discuss why current application-layer DDoS detection schemes are not applicable to a more subtle attack. We propose three detection metrics that together form the criteria for identifying a FRC attack from that of normal web activity. Experimental results based on three plausible attack scenarios show that an attacker without knowledge of the web log has a difficult time mimicking the self-similar and consistent request semantics of normal web activity.","PeriodicalId":300613,"journal":{"name":"Cloud Computing Security Workshop","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115184811","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 47