Securing Authentication and Trusted Migration of Weblets in the Cloud ...

2012 Third International Conference on Emerging Intelligent Data and Web Technologies

Securing Authentication and Trusted Migration of Weblets in the Cloud with Reduced Traffic John Panneerselvam 1, Stelios Sotiriadis2, Nik Bessis2, Nick Antonopoulos2 School of Computing & Mathematics, University of Derby, Derby, United Kingdom 1 ([email protected]), 2(s.sotiriadis, n.bessis, n.antonopoulos)@derby.ac.uk

stand-alone computer. Weblets can be launched anywhere in the cloud decided together by the Device Elasticity Manager (DEM) and the Cloud Elasticity Services (CES). The weblets can function independently in the cloud and in the mobile device. Some applications require collective execution of these weblets for their operation. In this case, the weblets in the mobile device and in the cloud need to communicate with each other for exchanging data. So, the weblets are migrated from the cloud to the mobile device and vice versa for the purpose of communication. The weblets to be transmitted are decided collectively by the DEM and the CES. This paper focuses on secure migration and better authentication of the weblets and also to regulate the traffic congestion in the communication channel during the migration of the weblets. The main objective of this paper is to design a secure transmission channel for the weblet migration. The second objective is to deploy a suitable protocol to include additional information to the weblets for building up authentication between the migrating weblets. The final objective is to employ back pressure technique to the designed communication channel to regulate the traffic congestion. With this in mind, the next section (section II) reveals the possible security threats faced by the elastic applications of cloud computing. Following this, in section III, the works carried out by cloud researchers to overcome the security threats and the drawbacks in their solutions are discussed. The proposed solution of this paper and methodological approach to solve the cloud issues are summarized in section IV and we finally conclude with future steps in section V.

Abstract — Cloud computing is making a new revolution in the computing world. Elasticity is one of the key features of the cloud which makes cloud computing further fashionable. Cloud is still in its infant stages and it faces a wide range of security threats. The security downtime of cloud is relatively slowing down the spreading up of cloud computing. This paper focuses on the security threats faced by the weblets during their migration between the cloud and the mobile devices. Weblet migration is an important task during the implementation of elasticity in the cloud. As a primary step, a secure communication channel is designed for the weblet migration by deploying secure shell protocol. Herein, the vulnerabilities in some authentication mechanisms are highlighted and a better way of authenticating the weblets with SFTP (Secure File Transfer Protocol) is suggested. Finally, managing the traffic effectively in the designed channel with the aid of back pressure technique is also covered in this paper. Keywords: Authentication, Backpressure, Channel, Migration, Weblets.

I.

INTRODUCTION

Cloud computing is emerging as a fascinating advancement in today’s computing technology. A cloud can be viewed as a virtual pool of resources that can be accessed through the Internet in a remote fashion [14]. Cloud providers offer services to the cloud users and they use the internet as their communication interface [11]. Cloud computing describes two types of users such as end users and median users. End users access the cloud for their use whereas median users act as an intermediate between the cloud providers and the end users. Median users utilize the elastic application of the cloud more than the end users. Median users tend to expand the cloud resources to provide services to the end users. With its elastic nature, the cloud can be expanded during heavy traffic and can be restricted once the traffic comes under control. One way of implementing elasticity [2] in the cloud is using a mobile device to launch one or more weblets into the cloud. A weblet is a micro site or a webpage that contains the user information regarding the cloud application. Users pack their accessing information in the weblets and launch them into the cloud. For launching the weblets, users need a mobile device. The mobile device used by the users can be any of the computing devices such as a mobile phone or a

978-0-7695-4734-3/12 $26.00 © 2012 IEEE DOI 10.1109/EIDWT.2012.20

II.

SECURING THREATS

Cloud computing relies on the Internet for its communication infrastructure. Thus, the security threats of the Internet are also inherited in cloud computing. In the elastic application of cloud computing, Wi-Fi or 3G is the communication media for the weblet migration. Both the weblets and the communication channels are subjected to external threats from malicious attackers and hackers. . Clouds are vulnerable [3] to DDoS attacks which in turn lead to the failure of any form of hardware. DDoS attacks are more dangerous and it makes the cloud resources unavailable to its corresponding users. The Virtual Machines (VM) are vulnerable and so they can be collapsed by a DDoS attack. 316

logical operators such as “And, Or, Add, Xor, Rotate, and Mod” for the authentication functionality. Security flaws are found in the SHA-1 function that results because of the mathematical weaknesses found in the logical operators. SHA-1 mechanism involves finding the message corresponding to the given digest message by mathematical calculation using the logical operators. A digest message is the identification key message sent by the sending device. Collision results in the hash function if two messages trace the same digest message. The SHA-1 is vulnerable to length extension and collision attacks. A hacker can easily modify the digest message by extending the original message without any knowledge about the security key. The worst case is that the hacker can divert the weblet towards the mobile device with a malicious code. Establishing [2] shared secret keys between the weblets in the device elasticity manager (DEM) and the cloud elasticity service (CES) will build up authentication of the weblets. Of course, this method ensures authentication and the DEM is readily registered with the CES. When a weblet is launched, the DEM generates a pair of authentication message composed of a weblet session key (wsk) and a weblet session secret (wss). If the mobile device sends the weblet through the DEM, the CES matches the wsk with the wss. The DEM do the same procedure during the reverse process. The wss and wsk are included as additional information without modifying the weblet content. If the hacker steals the virtual machine, then they will be able to modify the added vital information by extending their length. Moving data in smaller pieces [3] by employing procedures such as partitioning and fragmenting will enhance security and also reduces the traffic. The process of reducing the size of the data is to be handled by the end users accessing the cloud. The cloud users should employ techniques such as fingerprinting to reduce the size of their data. Cloud computing is focused to provide ease use to the cloud users. In this sense, this method is adding up more responsibilities on the user side than the cloud providers. It is necessary to analyze and classify the resource requirements [3] of the virtual machines to make decisions about resource allocation. A secure cloud computing architecture on the mobile Internet was designed by [4]. In this work, a new approach known as security-as-a-service (SeaaS) is suggested to the cloud providers for offering service to the cloud users. The main task of this work is to integrate several mechanisms such as authentication, authorization, firewall configuration, virtual machine segregation and managing the Intrusion Detection Systems (IDS) and the Intrusion Prevention System (IPS). This work is building up a new platform for the cloud network rather than a protocol to meet the required configuration. Integrating the mentioned tasks into one mechanism in the cloud environment is not practically feasible.

Since the virtual machines are the communication interface, their failure brings down the logical connection between the cloud and the mobile device. The hackers can hide the malicious code in the weblets and forward them to the virtual machines. Once the weblets are analyzed by the virtual machines, the weblet explodes the malicious content. Threats arise from active network entities [2], [3] such as packet injection and Man-in-the-Middle attacks if the weblets are not authenticated properly. Wrong authentication tends to the communication of wrong weblets, which in turn results in the failure of the corresponding execution. In a Man-in-the-middle attack, the attacker directs traffic from the middle of the communication channel both towards the cloud and the mobile device. Increasing the channel traffic results in the collision of the weblets and it increases the time delay. Since the time delay is directly related to the Quality of Service (QoS), hike in time delay is not an encouraging sign to the cloud providers. An attacker can easily handle these types of attack if the communication channel is not secured. When directing traffic towards the mobile device, the attacker loads the weblets with heavy malicious codes. These weblets when executed in the mobile device explode the malicious code and it causes the mobile device to get drain out of power. This scenario will increase the network traffic and in turn affects the cloud performance as a whole. Cloud computing is an open source architecture and the cloud resources are openly available to all types of users that includes hackers and malicious attackers. So, malicious attackers can easily bypass the protective layers of the cloud. Virtual machine provides the interface between the communication channel and the internal cloud. If a hacker takes control of any of the virtual machines, he will be able to modify the content of the weblets. Once the content of the weblet is modified, then the weblet will not be able to communicate with its corresponding weblet. . More number of Cloud Virtual Networks (CVNs) are clustered together [6][9] to form the bigger cloud. Users can manage their own CVN in the cloud. Each CVN has its own virtual machine. Weblets when launched into the cloud should be able to identify their corresponding CVN. So, it is important to build these weblets with necessary authentication information. III.

RELATED WORK

Cloud computing is being a tough challenge for the researchers and lots of suggestions and solutions were given previously by the research cloud community. Employing java like applications [2] to add a signed SHA1 hash values to individual weblets ensures security to the weblets in the cloud. In this process, the cloud elasticity services (CES) compares the signed SHA1 hash value with the device elasticity manager (DEM). Once acknowledged, then the cloud elasticity manager accepts the weblet into the cloud. This solution ensures authentication but there is no evidence for secure migration of the weblets from the mobile device to the cloud. If the hacker traces the weblet in the communication channel, he can easily modify the SHA-1 hash value. SHA-1 is a secure hash algorithm and it uses

IV.

PROPOSED SOLUTION

The proposed model encompasses three internal components organised in the establishing of channels, the building authentication and the reducing traffic. The following sections describe that functionality.

317

A. Establishing channel The communication channel between the mobile device and the cloud must ensure secure migration of the weblets. The communication channel is established by using tunneling. Tunneling is a technique by which communication is performed using various network protocols. Tunneling can be employed by using techniques such as http tunnelling, secure shell tunnelling, and IPSec. Secure Shell (SSH) protocol is employed to establish the communication channel between the mobile device and the cloud. SSH protocol [7] uses the public/private key authentication technique to verify the end nodes. The first step is to tunnel the firewall of the mobile device by employing http tunneling. The http tunneling targets port 80 of the firewall which is a universally opened port. An IP packet containing the necessary information to tunnel the firewall is packed as an http response and sent to the firewall. The local portion of the firewall opens up the IP packet. Once executed, the tunnel is created in the firewall. The newly formed tunnel can also be used by the attackers to come around the firewall. So, the tunnel is kept under constant monitoring for security considerations. Once the firewall is tunnelled, the next step is to establish the communication channel between the mobile device and the cloud. SSH protocol accesses the port 22 to form the tunnel. SSH protocol contains three major components such as transport layer protocol, user authentication protocol and connection protocol. The cloud is considered to be the server and the mobile device is the client. The request is sent from the mobile device to the cloud to establish the tunnel via Internet. Then the transport layer protocol acknowledges the mobile device with the cloud. The user authentication protocol acknowledges the server cloud with the device information. If the verification is successful on both the client and the server side, then the tunnel is established between the cloud and the mobile device by the connection protocol. The connection protocol multiplexes the SSH tunnel into a logical link. SSH tunnel is a better way of communication than using the public Internet as it forms a private tunnel between the mobile and the cloud. The advantageous feature of the SSH tunnel is the established tunnel itself, is encrypted. Now, the IP packet used to tunnel the firewall of the mobile device is again sent through the channel to the cloud as an http response. The firewall in the cloud, analyze this IP Packet. Once unpacked, tunnel is formed in the firewall of the cloud. So, a complete secure channel is formed from the mobile device to the cloud through their firewalls. The existence and the secure nature of the formed channel are tested by sending a specially spoofed IP packet from the mobile device to the cloud. Then, the IP packet is collected and analyzed in the cloud. If the packet is received with the same form and unmodified, then the tunnel is concluded to be safe and ready for weblet migration. The SSH tunneling communication between the cloud and the mobile device is shown in Figure 1.

Figure 1: Communication link between the mobile device and the cloud with SSH tunnel B. Building Authentication Cryptography is the most effective tool for the transmission of vital messages in a virtual environment. Authentication between corresponding weblets in the cloud and the mobile device is achieved by employing cryptography. Public key cryptography is an effective technique, but it requires high computational power [5] and high memory for its implementation. SSH tunnelling focuses to establish an encrypted tunnel between the device and the cloud. Being encrypted, the tunnel assures a certain level of security for weblet transmission. To ensure an additional layer of security to the weblets, the weblets are encrypted before transmission. In order to achieve encryption, the weblets are subjected to secure file transfer protocol (SFTP). SFTP is a file transfer protocol which encrypts the file for secure transmission. It can be seen as an extension of the SSH protocol. After its initialization, SFTP works automatically for the upcoming weblets. It ensures a trusted level of security for the weblet transmission as the weblets are encrypted once they enter the SSH tunnel. SFTP uses the port 22 which is same as the SSH protocol and so it eliminates the need for tunneling another port in the firewall. SFTP adds two important keys to the weblets. One is the user authentication key which is transmitted along with the weblets to prove their genuine mobile location. Another key is the host authentication key which is sent to the cloud before the weblet transmission to ensure right weblet reaches the right cloud virtual network (CVN). The host authentication key is changed frequently by the SSH protocol to protect it from the external attacks. Data integrity is one of the key features of the SFTP protocol which ensures the content of the weblet is not modified during the transmission. So, SSH protocol and SFTP protocol collectively assure secure migration and right authentication of the weblets between the mobile device and the cloud. Using SFTP and SSH protocols for transmission and authentication is better than the method suggested by [2]. The host is aware of the authentication key before the transmission begins and so the process eliminates any mathematical calculations. The architecture gives almost no chance for the hackers to come around. This system reduces the operational requirements since the process is automated

318

settings e.g. [13]. If the resistance of the cloud is made harder against the threatening attacks, then it not far away from now to have a fully efficient cloud computing environment.

after its initialization. It is more effective cryptographically, since both the tunnel and the weblets are encrypted. So, the tunnel and the weblets appear in a different view to the public Internet such that the users of the public Internet will have no clue about the transmission channel and the weblets. The testing technique employed to the SSH tunnel is also applicable to the SFTP protocol as the two protocols operate together. So, sending a specially crafted IP packet through the tunnel can test the working of the SFTP. Then, the IP packet is collected in the cloud and analyzed for any content modification. If the IP packet is unmodified, then the protocol can be used for weblet transmission.

REFERENCES [1]

[2]

[3]

C. Reducing traffic Once the weblet transmission is started, then the channel should be monitored consistently. Network Intrusion Detection System (NDIS) is a passive monitoring technique used to monitor the channel. NDIS checks the traffic status of the channel and also monitors for any possible network attacks. The transmission channel is deployed with back pressure technique which comes into play if the network traffic increases. The operation of back pressure technique in the transmission channel is very much similar to backpressure in fluids [8] flowing down a pipe. If one end of the pipe is blocked, then the fluid pressure backs up the pipe to the point of origin, where the flow is congested. The same principle can be applied to the logical connections. If the traffic goes high or if the weblet finds any attacker in the channel, then the backpressure technique backs up the weblets towards the weblet’s origin. If the weblet is transmitted from the mobile device to the cloud, then during traffic the weblets are backed up towards the mobile device and vice versa. Then the channel waits for the traffic to get cleared and once the traffic comes under control, the channel releases the back pressure to transmit the weblets. Thus traffic is managed effectively in the communication channel. V.

[4]

[5]

[6]

[7]

[8] [9] [10]

[11]

CONCLUSION AND FUTURE STEPS [12]

Cloud computing is implementing new insights and innovations in the computing world. Elasticity of the cloud makes it flexible for the network traffic and it enhances the fault tolerance capability of the cloud which makes the cloud to be robust to the occurring faults [12]. A secure communication channel between the mobile device and the cloud is proposed in this paper. The enhancement of authentication mechanism along with effective traffic management in elastic cloud computing have also been discussed. The most threatening security issues of cloud computing are discussed in this paper and the solutions suggested overcoming the security threats are believed to be effective in the cloud environment. The designed methodologies are user friendly in nature and so it can be encouraged by the cloud providers. The methodologies suggested herein are to be implemented during the installation phase of the cloud. Hence, the counter measuring tasks are to be performed by the cloud providers rather than the end users. The future step is to integrate the techniques suggested in this paper to develop a common strategic approach for securing cloud computing in large scale cloud

[13]

[14]

319

Rajan,S., and Jairath,A. (2011) Cloud Computing: The Fifth Generation of Computing, Communication Systems and Network Technologies, pp 665-667 IEEE Xplore. Zhang,X., Schiffman,J., Gibbs,S., Kunjithapatham,A., and Jeong,S. (2009) Securing Elastic Applications on Mobile Devices for Cloud Computing, Cloud Computing Security Workshop, pp 127-134 ACM Digital Library[Online]. Sabahi,F. (2011) Cloud Computing Security Threats and Responses, Communication Software and Networks, pp 245-249. Xiu-feng,Q., Jian-wei,L., and Peng-chuan,Z. (2011) Secure Cloud Computing Architecture on Mobile Internet, Artificial Intelligence, Management Science and Electronic Commerce, pp 619-622. Salam,I., Kumar,P., and Lee,H. (2010) An Efficient Key Predistribution Scheme for Wireless Sensor Network Using Public Key Cryptography, Networked Computing and Advanced Information Management(NCM), pp 402-407. Choi,T., Kodirav,N., Lee,T., Kim,D., and Lee,J., (2011) Autonomic Management Framework for Cloud-based Virtual Networks, Network Operations and Management Symposium, pp 1-7. Iyappan,P., Arvind,S,. Geetha,N., and Vanitha,s. (2009) Pluggable Encryption Algorithm In Secure Shell(SSH) Protocol, Emerging Trends in Engineering and Technology, pp 808-813. Stallings,W. (2010). High Speed Networks and Internets. America, State: Pearson. Reese,G. (2009). Cloud Application Architectures, America, State: O’Reilly. James E.Swebert (2006). Tunneling with SSH, IBM Developer Works. [Online]. Available at: http://www.ibm.com/developerworks/aix/library/autunnelingssh/index.html . Bessis, N., Sotiriadis, S., Cristea, V., and Pop, F. (2011). Towards inter-cloud schedulers: Modelling Requirements for Enabling MetaScheduling in Inter-Clouds and Inter-Enterprises, Third International Conference on Intelligent Networking and Collaborative Systems (INCOS 2011) , Nov 30 - Dec 2 2011, Fukuoka, Japan. Bessis, N., Sotiriadis, S., Xhafa, F., Cristea, V., and Pop, F. (2012). Meta-scheduling issues in interoperable HPCs, Grids and Clouds, International Journal of Web and Grid Services, volume 8, no 2. Sotiriadis, S., Bessis, N., and Antonopoulos, A. (2012). Decentralized Meta-brokers for Inter-Cloud: Modeling brokering coordinators for interoperable resource management. The 2012 9th International Conference on Fuzzy Systems and Knowledge Discovery (FSKD'12). Sotiriadis, S., Bessis, N., Xhafa, F., and Antonopoulos, N. (2012). From Meta-computing to Interoperable Infrastructures: A Review of Meta-schedulers for HPC, Grid and Cloud. In Proceedings of the 2012 IEEE 26th International Conference on Advanced Information Networking and Applications (AINA '12). IEEE Computer Society, Washington, DC, USA, 874-883.