Francesco Tusa

Security and Cloud Computing: InterCloud Identity Management Infrastructure

Cloud Computing is becoming one of the most important topics in the IT world. Several challenges are being raised from the adoption of this computational paradigm including security, privacy, and federation. This paper aims to introduce new concepts in cloud computing and security, focusing on heterogeneous and federated scenarios. We present a reference architecture able to address the Identity Management (IdM) problem in the InterCloud context and show how it can be successfully applied to manage the authentication needed among clouds for the federation establishment.

Three-Phase Cross-Cloud Federation Model: The Cloud SSO Authentication

Cloud federation aims to cost-effective assets and resources optimization among heterogeneous environments where clouds can cooperate together with the goal of obtaining unbounded computation resources, hence new business opportunities. This paper describes an architecture for the federation establishment, where clouds that need external resources ask to federated clouds the renting of extra physical resources. Our architecture introduces a new module named Cross-Cloud Federation Manager including three agents (Discovery, Match-making and Authentication). In this work, we specifically focus on the authentication agent, which is responsible for a secure federation. To address such problem we propose a technical solution based on the IdP/SP model along with the SAML technology.

CLEVER: A cloud-enabled virtual environment

A cloud-enabled virtual environment called CLEVER is proposed in this paper. CLEVER simplifies the access management of private/hybrid clouds and provides simple and easily accessible interfaces to interact with different “interconnected” clouds, deploy Virtual Machines and perform load balancing through migration. The concept of interface is also exploited for integrating security, contextualization, VM disk image management and federation functionalities made available from higher level software components. Due to its pluggable design, CLEVER is able to grant high scalability, modularity and flexibility in the middleware architecture, while fault tolerance requirements are also satisfied. A prototype version of CLEVER has been developed to implement and test its main features, as discussed in the final part the paper.

Integration of CLEVER clouds with third party software systems through a REST web service interface

Nowadays, a typical scenario in the panorama of cloud computing includes an IaaS cloud provider offering on-demand VM hosting services to its clients. In this field, famous examples of large scale commercial providers are Amazon and Rackspace. However, how to arrange analogous providers with open source tools is not totally clear. Moreover, the integration between an IaaS cloud middleware with third party legacy software systems, today, represents a difficult task to accomplish. CLEVER is an open source cloud IaaS middleware allowing the allocation and management of VMs. In this paper, through the development of a REST interface, we discuss how a CLEVER-based cloud provider can be integrated with third party systems, hence satisfying their VM allocation requests.

How CLEVER-based clouds conceive horizontal and vertical federations

Nowadays, the cloud computing ecosystem includes hundreds of independent and heterogeneous clouds. Most of such cloud platforms can be considered as “islands in the ocean of the cloud computing” and do not present any form of federation. At the same time several clouds are beginning to use the cloud-based services of other clouds, but there is still a long way to go toward the establishment of a worldwide ecosystem including thousands of cooperation federated clouds. This paper aims to investigate the existing cloud middleware solutions able to address all the potential issues involved in these new cloud scenarios. In particular, the CLEVER cloud middleware will be analyzed, highlighting its design and features, and explaining the motivations that allow us to consider it suitable to the different phases of the evolution of federated cloud computing.

Data Reliability in Multi-provider Cloud Storage Service with RRNS

Nowadays, more and more Cloud storage providers are appearing on the market. Nevertheless, data availability and confidentiality represent critical issues considering Cloud computing. This paper discusses an approach that on one hand enables customers to use at the same time different Cloud storage providers, and that on the other hand guarantees both data redundancy and obfuscation. According to our approach, files are fragmented and stored in different Cloud storage providers by means of the Redundant Residue Number System (RRNS). Besides providing us data redundancy, RRNS allows us to preserve the data confidentiality by means of an obfuscation-base strategy spreading metadata over different cloud providers. In addition, our approach allows a customer to retrieve his/her files even if a cloud storage provider is not available anymore. Experiments highlight the factors that have to be considered to configure the system according to the customer’s requirements.

AAA in a Cloud-Based Virtual DIME Network Architecture (DNA)

The design of a cloud architecture can be difficult according the business logic complexity which Cloud Service Providers (SPs) want to achieve. This paper describes a possible solution for simplifying the design of cloud-based services exploiting a DIME Network Architecture (DNA). More specifically, exploiting the signaling channel and FCAPS of DIMEs, we discuss an approach for the management of SSO Authentication, Authorization, and Accounting in cloud-based services.

Achieving Federated and Self-Manageable Cloud Infrastructures: Theory and Practice

Massimo Villari is an Aggregate Professor in Computer Engineering at the University of Messina, Italy. In 2003 he received his PhD in Computer Science School of Engineering. Since 2006 he is an Aggregate Professor at University of Messina. He is actively working as IT Security and Distributed Systems Analyst in cloud computing, virtualization and Storage for the European Union Projects “RESERVOIR” and “VISION-CLOUD”. Previously, he was an academic advisor of STMicroelectronics, help an internship in Cisco Systems, in Sophia Antipolis, and worked on the MPEG4IP and IPv6-NEMO projects. He investigated issues related with user mobility and security, in wireless and ad hoc and sensor networks. He is IEEE member. Currently he is strongly involved on EU Future Internet initiatives, specifically Cloud Computing and Security in Distributed Systems. His main research interests include virtualization, migration, security, federation, and autonomic systems. In UniME is also the Cloud Architect of CLEVER; a cloud middleware aimed at federated clouds. Massimo Villari (Università degli Studi di Messina, Italy), Ivona Brandic (Vienna University of Technology, Austria) and Francesco Tusa (Università degli Studi di Messina, Italy)

How to federate VISION clouds through SAML/Shibboleth authentication

Federation is currently finding a wide argumentation in Cloud Computing. The federation among cloud operators should allow new opportunities and businesses even making the role of SMEs crucial in these new scenarios. In this work, we provide a solution on how to federate Storage Cloud providers, enabling the transparent and dynamic federation among storage suppliers adding new functionalities for end-users. VISION Cloud represents the reference architecture dealing with Storage Clouds, and our work attempts to design a solution applied on VISION, but suitable for any similar architecture.

How a structured testbed enables the rapid development and deployment of cloud services: The VISION Cloud use case

The right setup of a testbed is important for enabling the rapid development and deployment of cloud services, in particular all the times the testbed hosts more concurrent interactions. This work shows how to configure an environment where more developers insist on it. In particular what tools are indispensable for managing compelling distributed cloud environments. We looked at mature Open Source solutions, performing their smoothed integration. The paper describes all parts necessary for accomplishing complex scenarios, even in a bounded perimeter as the VISION Cloud EU project offering. VISION Cloud represents the reference architecture dealing with Cloud Storage, and our work attempts to provide solutions applied on VISION, but suitable for any type of framework.