-Cloud computing is becoming a key factor in computer science. It represents a new paradigm of utility computing and enormously growing phenomenon in the present IT industry and economy hype. The cloud users (CUs) increase and require secure, reliable and trustworthy cloud service providers (CSPs) from the market. It's a challenge for a new customer to choose the highly secure provider. In this paper, we propose a cloud broker that analyze and rank the cloud service providers based on measuring the risks of confidentiality, integrity and availability. This model uses a CSP Rank Framework for the group of cloud providers by assessing security metrics which make decision of the more secure provider among all providers and justify the business needs in terms of security and reliability.
I. INTRODUCTION Cloud computing [1] is an active research subject as the information industry sees it as the new model. Many companies, enterprises and organizations outsource some of their information systems to benefit from the cloud services which are Platform as a Service (PaaS), Infrastructure as a Service (IaaS) and Software as a Service (SaaS). The main interesting features of a cloud are the cost decrease and a faster time to market. Based on sharing resources, the cloud computing changes the user concerns from managing an infrastructure to only focusing on their core business. Currently there are many numbers of providers, but finding the best cloud service provider among the available cloud service providers is difficult. Thus, it is a challenge for the users to choose the best secured cloud provider for fulfilling their requirements. Presently, there is a lack of frameworks that can permit customers to evaluate cloud offerings and rank them based on their ability to meet the user’s Quality of Service (QoS) and security requirements. This is a major problem for every user, especially those who are more concerned about data security and privacy from CSP.
A secure computer system provides guarantees regarding the confidentiality, integrity and availability of its objects (such as data, processes or services). Security is related to vulnerabilities in software, and these are hard to foresee or detect before an actual attack; security involves personal aspects (e.g., user or operator issues) and aspects of the operational environment that are often beyond the control of the development teams. Thus, it is necessary to assess and contain risk using precautionary measures that are commensurate. Accordingly, we have to dispose a system that measure and rank the secured cloud service providers and then, the cloud services can make a major impact and will craft a healthy competition among cloud providers to satisfy their Service Level Agreement (SLA) and improve their QoS and trustworthiness [3].
In this work, our aim is to help the new customer to find the most reliable and secured CP in terms of security and trust through a cloud broker that can define, analyze, measure and rank the cloud service providers based on a risk analysis approach that calculate some metrics. Thus, the obtained results make decision of the best option of CP and justify the business needs in terms of security and reliability.
The paper is organized as follows: the next section discusses related work, Section III introduces the proposed model. Section IV describes the CSP Rank Framework. Section V presents an implementation of the model. Section VI gives a conclusion.
Security metrics are one of criteria that play a major role in ranking service providers. A cloud user may require an efficient, cost effective and basically more secure provider for his application. Since there are many providers who will provide same type of services with different level of security, so it will be a challenge for the user to select. Our motivation in this paper is to promote a novel approach for ranking providers based on measuring security metrics of cloud services. In the same context, many researchers have proposed different approaches to help customer in this mission to select the appropriate cloud service. A collaborative filtering approach [2] rank the items based on similar users preferences. This algorithm aggregates all the items purchased by the users and eliminate those items and ask users to rate the remaining services. In [3], cloud rank approach proposed greedy algorithm. It gives a method to rank cloud providers based on existing customer’s feedback. It ranks component rather than service of providers. But there is no guarantee that all explicitly rated items by customers are ranked properly. But similar users will experience the same with same cloud providers so for them this approach will be helpful.
QoS-aware web by collaborative filtering [
Zibin Zheng [
Deepak Kapgate [
An efficient approach [
III. THE CONCEPTUAL MODEL OF THE CSP RANK
FRAMEWORK
We propose a broker which can act as a middleware between customer and cloud service provider. It can get the needed requirements from customer and help the customer by listing out suitable cloud providers. So our cloud broker has an important role to find out the secure cloud service providers existing in the database of our cloud broker. The proposed model is described in the following, in terms of its architecture. This system develops a model to find out the secured cloud service providers based on a security risk assessment approach by determining the vulnerabilities and computing the risks related to cloud service providers list.
The broker collects requirements from user. It may be infrastructure requirements, platform requirements or software requirements.
All the registered cloud service providers give all the services which they are providing. Cloud broker contains the level of security of cloud providers. So the client gives requirements to broker, it checks the provider’s performance based on criteria that are risks computed.
The CSP Rank Framework using a broker provides optimal cloud service provider selection from the more numbers of CSPs based on security metrics, especially risks which provides better selection of providers among many. Thus, we proposed an architecture based on the evaluation of risks related to systems caused by vulnerabilities and threats for making a decision to rank and select the right provider in terms of reliability and security. IV. DESCRIPTION OF THE CSP RANK FRAMEWORK
Probably all cloud service providers have a Service Level Agreements (SLA), but most of these SLAs were written to protect the vendors as opposed to being customer-centric. That has to change, and customers have to demand more with regard to service and the assurance of it. In the same time, cloud providers should protect their data or services from risk and harm. For this aim, the CSP Rank Framework will conduct vulnerability scans and security risk assessment. The obtained results were fed into the security ranking system that offer a list ranked of the secure providers.
Fig. 2 shows our approach for model construction of the cloud
broker for ranking secured CSPs taking into account some
conditions that should be considered [
The CSP Rank Framework must maintain the trust and reliability.
The CSP Rank Framework has enough resources to provide for processing and executing their own work. The broker must be maintained and regulated by strict laws and transparent policies.
Both the broker and CSPs mutually agree before executing the software penetration test.
We consider that a CSP provide IaaS, PaaS and SaaS of its own.
The CSP Rank Framework is only the responsible of computing security metrics from sources and processes these measures for ranking results.
A new cloud user looking for security and reliability should pay to the cloud broker to see the ranked results.
Data Collection
Vulnerability
Analysis
Transition Probability Matrix
Security Risks Assessment of CSPs Total Risks of CSPs
List Ranked of
Secured CSPs
loss or harm [
The Common Vulnerability Scoring System (CVSS) [
The Base metric represents the intrinsic characteristics of vulnerability, and is the only mandatory metric. The optional Environmental and Temporal metrics are used to augment the Base metrics, and depend on the target system and changing circumstances. The Base metrics include two sub-scores termed exploitability and impact. In the last sub-group, we find three metrics, representing the impact of the attack on the three classical security properties: Confidentiality Impact, Integrity Impact and Availability Impact which we are interested in the next sub-section.
Risk is the potential that something will go wrong [
Risk= Likelihood of an adverse event × Impact of the adverse event (1)
The likelihood of the exploitation of vulnerability depends
not only on the nature of the vulnerability but also how easy it
is to access the vulnerability. Researchers have developed a
stochastic model describing the life cycle of a single
vulnerability and containing state transitions [
Vulnerability is a software defect or weakness in the security
system which might be exploited by a malicious user causing
The vulnerability life cycle begins with State 0 in which the
vulnerability is not yet discovered. State 1 represents the next
state when the vulnerability is discovered but it is yet to be
disclosed. When the vulnerability is disclosed with the release
and application of the patch, it is said to be in State 2. State 4
represents scenario wherein the vulnerability is disclosed
without a patch. At State 5, the vulnerability is disclosed with
the patch, but the patch is not applied. In State 3, the
vulnerability is being exploited. Thus, each vulnerability found
after the penetration test by using a scan process [
The security risk can be measured using the risk definition in (1), the model in Fig. 3 and based on the CVSS exploit and impact scores taking into account that the vulnerability must be exploited. Hence, the cumulative risk [18] of a vulnerability being exploited is the likelihood of vulnerability being in State 3.
We consider that Lh_3 as the likelihood of the vulnerability to be in State 3. In this context, we based on Markov chain to compute the Lh_3 for the vulnerability.
The process starts at State 0 for each vulnerability, thereby the vector giving the initial probabilities is V1= [1 0 0 0 0 0]. We define also for a single vulnerability, the state transition matrix M as shown below: Using the initial probabilities V1 and the state transition matrix M, we obtained the state probabilities V3 after two steps as calculated in (2).
V3 = V1 × M 2 Thus, Lh_3 is the third element of the matrix V3 and represents the cumulative risk of a vulnerability being exploited. According to (1), we can assess the risk for a possible vulnerability i as: (2) (3) Next we compute Confidentiality risk, Integrity risk and Availability risk. According to the National Vulnerability Database (NVD) database, we used Confidentiality Impact, Integrity Impact and Availability Impact values of the vulnerability as the impact of exploitation for the three types of risk. Based on (3), the risk expressions for a single vulnerability are given in (4).
(4) (5) The CRVu represents the Confidentiality risk of the vulnerability, IRVu is the Integrity risk of the Vulnerability and ARVu refers to the Availability risk of the vulnerability. Finally, the broker calculates the total risk for each cloud service provider by summing the risks of the individual vulnerabilities detected in this provider. Thereby, the risks related to a cloud service provider j from n providers with m vulnerabilities are expressed in (5).
Where CR_CSPj is the Confidentiality risk of a selected provider j, IR_CSPj is the Integrity risk of a selected provider j and AR_CSPj is the Availability risk of a selected provider j.
Based on the calculation of the total risks CR_CSP, IR_CSP and AR_CSP of each cloud service provider from all providers, our framework provides a list ranked of the secure CSPs starting with the providers having the minimum security risks in terms of confidentiality, integrity and availability.
FRAMEWORK
We illustrate the use of our CSP Rank Framework ins a practical application; we consider three cloud providers X, Y and Z under a number of vulnerabilities.
After the data collection step, a vulnerability analysis quantified the vulnerabilities of our clouds by using the CVSS framework and the NVD website as shown in TABLE I. These vulnerabilities are categorized into in four groups: High exploit and High impact, High exploit and Low impact, Low exploit and High impact, Low exploit and Low impact based on CVSS exploit score and CVSS impact score that are qualified as Low if their score is less than or equal to 5.0 and High if this score is greater than 5.0. Hence, the obtained risks values as shown in TABLE II can be grouped into three classes: High Risk (≥ 0.5), Medium Risk (≥ 0.3 and < 0.5) and Low Risk (< 0.3).
Fig.4 illustrates the comparison of the Availability risk for the three clouds. We conclude that the high risk and medium risk groups are dominated by the clouds X and Y whereas the low risk group is dominated by the cloud Z.
Fig. 5 and Fig. 6 show the Confidentiality risk and Integrity risk comparison respectively between the providers X, Y and Z.
Thus, we see that the providers X and Y dominate the High risk and Medium risk categories where the cloud Z dominates the Low risk category. Cloud Computing became an important technology for many organizations to deliver different types of services. So, the multiple cloud service providers make a dilemma for a cloud user to choose each provider which is more secured and has the minimum security risk. Hence, in this paper, we propose an effective and efficient cloud broker based on CSP Rank Framework that identifies vulnerabilities and measures the security risks. This model represents a raking system helping users to find out the best providers in terms of security and trust, and also satisfy their requirements.