Insider Attacks in Untrusted Infrastructure-as-a-Service Clouds

Abstract

Recent technical advances in utility computing have allowed small and medium sized businesses to move their applications to the cloud, to benefit from features such as auto-scaling and pay-as-you-go facilities. Before clouds are widely adopted, there is a need to address privacy concerns of customer data outsourced to these platforms. A practical approach for protecting the confidentiality and integrity of client data and computation from insider attacks such as cloud clients as well as from the Infrastructure-as-a-Service (IaaS) based cloud system administrator himself. We demonstrate a scenario of how the origin integrity and authenticity of health-care multimedia content processed on the cloud can be verified using digital watermarking in an isolated environment without revealing the watermark details to the cloud administrator. Finally, to verify that our protocol does not compromise confidentiality and integrity of the client data and computation or degrade performance, we have tested a prototype system using two different approaches. Formal verification using ProVerif tool shows that cryptographic operations and protocol communication cannot be compromised using a realistic attacker model. Performance analysis of our implementation demonstrates that it adds negligible overhead.

Existing System

In existing system cloud computing paradigm is used. Cloud platforms security has predominantly focused either on protecting platforms from malicious cloud clients. It required process and/or maintain large data sets and high bandwidth network channels.

Proposed System

In proposed model to prevent inside attack we use two protocols. First protocol namely secures VM launch protocol which enables a secure launch of a client VM on a trusted cloud node the second protocol is called Confidentiality sensitive computation protocol which enables a client to protect the confidentiality and integrity of its data and computation from other client applications in the cloud and from the cloud system administrator.

Architecture

ARCHITECTURE DIAGRAM