The project involved a study and analysis of different security techniques being developed for cloud computing and methods to improve them.

1. Study and Analysis of SecurityTechniques for Cloud
Computing
Priyanka Goswami
Electrical and Computer Engineering
The University of Arizona
Tucson, USA
priyankag@email.arizona.edu
Ganesh Raikhelkar
Electrical and Computer Engineering
The University of Arizona
Tucson, USA
ganeshraikhelkar@email.arizona.edu
Abstract— Although Cloud Computing started developing in
the early 1970s, even today it is evolving and developing. With
more people and organizations using the cloud and its services
(SaaS, PaaS and IaaS) for everyday computation needs like data
storage, analysis and management, application development,
working on different platforms and operating systems and
accessing an shared pool of resources, Cloud has become
vulnerable to malicious attacks targeting user information, data
theft, denial of service, data corruption and privacy and
confidentiality issues. This is also due to the reason that there is
lack of standardization in cloud and service providers often do
not provide complete security solutions to the users, thus leaving
them vulnerable to attack. The paper aims to address all the
above issues. Also two possible solutions that address security in
cloud network have been reviewed and compared, with possible
modifications that can be made to make the proposed methods
more immune to possible threats.
Keywords—cloud; security;honeypots;service;network
I. INTRODUCTION
The concept of Cloud Computing, was first explored
in the 1970s, when the cloud symbol was used to
represent an aggregation of computing equipments, in
the ARPANET and then by the CSNET. Over the years,
cloud has evolved by adopting and modifying the
existing technology of Internet and has emerged as a
platform that provides its users services like storage,
data analytics, softwares and various services at optimal
cost. A standard definition for cloud computing was
given by National Institute of Standards and Technology
(NIST) in 2011, as “an model for enabling ubiquitous/
omnipresent convenient, on-demand network access to a
shared pool of configurable computing resources that
can be rapidly provisioned and released with minimal
management effort or service provider interaction [1].
Some of the essential characteristics of cloud, as listed
by NIST, are on-demand self service, wide,
geographically and device independent standard network
access, resource pooling, rapid elasticity to adapt to
changes and metering of resources by the consumer and
the service provider, like pay-per-use. The main services
that are provided by the cloud can be briefly categorized
as follows [1]:
 Software as a Service – Also called SaaS, it basically
allows multiple users to access applications,
simultaneously on their devices like laptops or smart
phones, through a network like the Internet, on
different platform like a web browser or user
interface.
 Platform as a Service – Also called PaaS, this allows
user to use libraries, tools, languages and softwares
made available by the providers for creating
applications on the cloud.
 Infrastructure as a Service – Also called IaaS, this
allows user to store their data on virtual storage space
(the cloud) and access it anywhere and on any device
via the network. Besides storage, users can also
access different operating systems, deploy and run
softwares on different platforms, etc.
 With the incorporation of cloud with the Internet of
Things (IoT), many other services like DBaaS
(Database as a Service), SaaS (Sensor as a Service or
Sensor Cloud). SAaaS (Sensing and Actuation as a
Service) and IPMaaS (Identity and Policy
Management as a Service)
With increase in smart phones and wearable
technology and more people getting connected to the
Internet, the no. of service provided by the cloud will
keep increasing and becoming more diverse. According
to the Cisco Global Cloud Index [2], it is predicted by
2020, 90% of all data will be processed in cloud centers,
with the global cloud IP traffic reaching 14.1 ZB and
major part of this traffic (74%), will be targeted for
Software-as-a-Service (SaaS). Additionally, Public cloud
and Community cloud will have an increase in the no. of
user compared to Private cloud.
But with the growth of cloud and an increase in users
with all the services being connected and accessible via

2. network like Internet, Cloud faces many security issues
that maybe similar to the security threats faced by
computers or smart devices connected to the net or
specific to some services provided by cloud like stealing
of confidential data stored on cloud, or denial of service,
that affects not only the Quality of Service but also has
monetary affects, and so in the recent years researchers
and security providers have focused on the different
security issues that affect cloud and possible solutions to
prevent them, which is the focus of this paper. In the
following sections, we will summarize some of the main
security threats that affect cloud and review and compare
possible solutions that can prevent attacks on the cloud.
II. SECURITY ISSUES IN CLOUD COMPUTING
Compared to the traditional Internet based application
and services, Cloud faces higher security threats and is
more prone to attack because first it is still in its initial
developing stage with, no standardization and second
features of cloud like virtualization, location
independence and multiple users with no authentication
makes cloud vulnerable to deception. Security risks like
data loss, denial of service, lack of privacy and assurance
of data integrity is prevalent in the cloud environment
because every cloud service provider will have a
different type of security system, and there is a chance it
may not cover all the aspects. Attackers can use this
weak spot and launch an automated attack on the, using
devices like botnets. This is especially possible if the
cloud is used for static data storage [3].
A major challenge faced by cloud is the threat posed
by “bad repositories” or “Bar”, where services like IaaS
and PaaS are used by attackers, to develop malicious
applications that can compromise the security, data and
privacy of other users [4]. The main reason, for this, as
stated in [4] is the refusal of service providers to scan
user repositories without consent due to privacy policy
and ethical reasons, which causes the attackers to
develop malicious application and softwares undetected,
the lack of transparency to outside security providing
services and observers and different hosting strategies
and security services provided by different cloud service
providers (lack off standard framework). Even if hosts
were able to scan repositories, it is extremely difficult to
detect malicious activities if it is random and
unconnected
Another issue faced on the cloud is ensuring the
privacy of user data, or preventing data theft. With
massive amount of data getting generated every day (big
data), most of it is being stored on the cloud. Some of
the causes of data theft and loss of data integrity,
highlighted in [5] are first users can operate on the data
only remotely but the data may be spread over different
clouds belonging to un-trusted third party organizations
thus compromising data privacy and integrity, second
cloud is a dynamic environment with new data and
services continuously getting stored and old data being
moved around, thus exposing sensitive data to attackers
and third hosts allow services and applications to be run
on the platform, without scanning them. Another issue
with data storage on cloud is breach of confidentiality
and privacy. This can be in the form of some malicious
attack aiming to compromise data integrity and steal
information, or from government agencies
Also most of the current security techniques, which
have been designed keeping the traditional network
framework in mind work on the "fault tolerance
mechanism" [6]. They try to stop an attack, after it has
happened and been detected, i.e. they respond to an
attack. But sometimes there is no attack. An intruder
may simply observe the traffic, keeping track of which
service the user is requesting or type of data the user is
storing in the cloud. With many organizations using
cloud for their everyday transactions and storage, this
information can be critical and is a breach of user
privacy and confidentiality. There are certain techniques
like implementing firewalls and obfuscation based
systems, but they consume resources and also increase
system latency. This cannot be tolerated for resource
intensive applications like using cloud for IoT systems
like smart vehicles and medicine (wearable heart
monitor), where both confidentiality and latency play
critical roles.
Another issue, which is especially relevant to
applications and services being provided on the public
cloud, is authorization and user authentication. In cloud
most SaaS applications require users to authenticate
using user name and password. In the present scenario,
with numerous developers and companies developing
and providing different applications on the cloud, and at
an extremely fast pace, the authentication job is sourced
out to different third party cloud services like Auth0 and
Amazon EC2 [7]. The problem with this scenario is that
if, for example, Amazon EC2 is attacked the user ID and
authentication of a large no. of users are compromised,
irrespective of which application they are using. Also
most developers do not have an in-depth knowledge
about cryptography techniques and network security,
and may create applications that are vulnerable to attack.

3. In this paper we will be focusing on techniques that
address the security issues faced by the network that
connects the user to the cloud (cloud network) and is
used to provide services like SaaS and IaaS. In the
following sections, we will review two possible
solutions, to counter security threats affecting the cloud
network, underlying assumptions, results and the overall
effectiveness of the techniques to handle security threats.
Figure 2. Deployment of decoys, in response to attackers using the active deception model [3] [Source: A. Brzeczko, A.
Uluagac, R. Beyah, J. Copeland, “Active Deception Model for Securing Cloud Infrastructure”, INFOCOM WKSHPS, May
2014]
III. POSSIBLE SOLUTIONS FOR CLOUD SECURITY
There are many varied security measures that are
currently employed by different cloud service providers.
But these techniques are based on the traditional network
structure and do not give the best possible protection
against attackers. Hence there have been many new
methods proposed in the recent years, that are designed
considering the needs and structure of cloud and cloud
based services. In this section we review two such
techniques.
A. Solution 1 – Active Deception Model
The first solution is an active deception model
developed using the underlying principle of honeypots,
by A. Brzeczko, A. Uluagac, R. Beyah, J. Copeland
as described in [3] and is used to counter automated
attacks that target the cloud SaaS which can cause issues
like denial of service and latency. Honeypots/honeynets
have no production value and don't provide any services.
Hence legitimate users will not interact with them, but
intruders will attack every host, without considering if
they provide actual service and in an attack, honeypots
will see sudden increase in traffic, alert the system about
it and since it has no value, the attackers will be allowed
to attack so that more information can be gained from it.
But the problem with using honeypots is they have large
overhead and consume resources like memory and IP
space, which is inefficient. Also they have to be
designed and deployed very carefully into the system
because if the integration is not seamless, attackers will
identify them and avoid them to target the actual services
The method is based on the fact that the cloud is
dynamic since new devices and services are added to it
all the time and this can be used to deceive potential
attackers. In the proposed technique unused resources
like network/IP space, bandwidth, etc. are used to set up
decoys. Attacks are classified and according to the
priority, corresponding no. of decoys are employed. As
the attackers will assume that the decoys are part of the
network, they will continue interacting with the decoys
and this will help the system to collect intelligence about
it and use it for training, assigning priority and future
reference. Hence in the future, if the system encounters a
similar attack, it will identify the malicious host and
direct it away from the main services and production [3].
Figure 2 shows the algorithm and structure of the
technique developed:
The main assumptions made in this method are as
follows:
 Decoys are deployed only when demand of resources
on the cloud is less
 Because the actual network devices change at a very
fast rate (assuming mobile devices like smart
phones), attackers cannot use a similar technique
every time, unlike in fixed networks.
 The decoy coordinator will control the firewall, but
cannot generate content that will affect production.

4. Also production/ actual services will have no role in
the generation of decoys.
 Decoys and the actual production hosts are placed on
separate subnets and there is no form of
communication between them
The method was implemented in Canonical’s Juju
framework since it is compatible with most of the
current cloud based APIs [3]. For the testing phase the
authors employed 20% of the resources for setting up
decoys and used an automatic deployment strategy to
respond to threats on N most frequently attacked public
subnet points. The prototype of the method was
developed in python and deployed in a Linux
environment. Testing was carried out on IPv4 subnet
addresses in academic network and the technique was
able to detect 1255 attacks and divert 97.5% of the
malicious traffic, while maintaining communication with
the attacker, in order to collect information, to classify
and prevent similar future attacks, and train the system
further. Figure 3 shows the results of the live setup in
which the decoy library was relegated to Kippo (SSH),
Glastopf (Web) and Dionaea (numerous protocols).
Figure 3. Results of the live test for the active deception
model [3] [Source: A. Brzeczko, A. Uluagac, R. Beyah, J.
Copeland, “Active Deception Model for Securing Cloud
Infrastructure”, INFOCOM WKSHPS, May 2014]
B. Solution 2 – Security Based on Defense in Depth
The second solution is a multilayered system based
on defense in depth, developed by T. Mavroeidakos, A.
Michalas and D. D. Vergados [8]. In the proposed method the
cloud infrastructure is divided into separate defensive zones,
based on the type of data with the proposed security
architecture being deployed in each zone. The actual
architecture will consist of different layers like the perimeter
defense layer, deceptive layer, detection layer and the
cryptography layer, as shown in Figure 4. Along with the
above proposed security architecture, for each defensive
zone separate firewalls and honeynets are also deployed
to prevent attackers from targeting the actual hosts.
Figure 4. Different layers of the proposed security system
architecture in [8] [Source: T. Mavroeidakos, A. Michalas and
D. D. Vergados, "Security architecture based on defense in
depth for Cloud Computing environment," INFOCOM
WKSHPS. 2016]
The model is deployed in the network layer of the
cloud computing environment of OpenStack and consists
of the controller, compute, network, block and object
nodes and implemented on Ubuntu 14.04. The
evaluation was performed using automated tools like
DDOSim, R-U-Dead-Yet (RUDY), LOIC, Nmap,
Nessus and Tcpdump [8] and Table 1 shows the
response of the proposed system to the attacks:
Table 1. Response time of the proposed system in [8] to
simulated attacks [Source: T. Mavroeidakos, A. Michalas and
D. D. Vergados, "Security architecture based on defense in
depth for Cloud Computing environment," INFOCOM
WKSHPS. 2016]

5. C. Analysis of the two proposed solutions
 The first solution proposed in [3], the decoys
developed overcome the disadvantages of using
honeypots and also utilise less resources. But since
decoys are developed only when network resources
are free, cloud services will be vulnerable to attack
during periods of high user traffic and resource
utilisation. Also the technique is based on the
assumption that the cloud structure keeps changing.
Hence this feature of variability in cloud is used to
assume that the attacker will probably encounter a
decoy host. So this technique will not be equally
effective for static cloud service like data storage.
 The second solution proposed in [8], because of the
deployment of honeypots along with the developed
security system, resources will be used and this will
lower the efficiency of the cloud network. Also by
dividing the cloud in different zones, the load on the
system will be less, and it can fend of different types
of attack. But this arrangement is possible only for
IaaS based storage services. In case of SaaS and
PaaS, the division of cloud cannot be done easily and
for such cases this security architecture will not work.
 Also in the simulation result of the second method, it
takes close to 30 min to detect some form of the
attacks. If employed in an real time environment, a
large amount of data and users may be affected even
before the attack is detected and steps are taken to
stop it. Hence there is a need of much more robust
system that prevents the attack from occurring, rather
than take measures, after the attack has occured
 One possible solution is to incorporate parts of both
the above techniques together. For example in the
second technique, instead of using honeypots, decoys
developed in the first method can be incorporated to
reduce the resource consumption.
CONCLUSION
Cloud Computing is still evolving and its integration
with other developing technologies like the Internet of
Things, has lead to new services and applications getting
incorporated every day. One of the main reasons for the
popularity of the cloud with application developers and
new users is the ease of access and but this is also the
main reason which leaves cloud exposed to attacks that
target data and user information and also affect the
Quality of Service. Because of the lack of a fixed
security structure, every cloud service provider offers
different set of security measure and this leaves them
exposed to attackers. Also lack of user authentication
and scanning of data and application on the cloud
increases the security risks. Although the above
discussed techniques provide a robust and resource
efficient solution to prevent attacks, still they operate
under assumptions that may not hold true in the real
environment. Although the above techniques provide
robust and effective solutions, they target specific
services of the cloud. In the future there is need of an
standardised security model that can be used effectively
for all types of services provided on the cloud and also
uses minimum network and cloud resources. Also with
IoT devices using cloud for data storage, analysis and
retrieval, security methods have to be designed keeping
in mind the services like SAaaS and DBaaS.
REFERENCES
[1].P. Mell, T. Grance,”The NIST Definition of Cloud
Computing (Technical report)”, National Institute of
Standards and Technology: U.S. Department of
Commerce, doi:10.6028/NIST.SP.800-145, Special
publication 800-145, September 2011
[2]. “Cisco Global Cloud Index: Forecast and
Methodology, 2015-2020 White Paper”, [online]:
www.cisco.com/c/dam/en/us/solutions/...cloud-
index.../white-paper-c11-738085.pdf
[3]. A. Brzeczko, A. S. Uluagac, R. Beyah and J.
Copeland, "Active deception model for securing cloud
infrastructure," 2014 IEEE Conference on Computer
Communications Workshops (INFOCOM WKSHPS),
Toronto, ON, 2014, pp. 535-540.
[4]. X Liao, S Alrwais, K Yuan, L Xing, XF Wang, S
Hao, R. Beyah, ‘Lurking Malice in the Cloud:
Understanding and Detecting Cloud Repository as a
Malicious Service’,Proceedings of the 2016 ACM
SIGSAC Conference on Computer and Communications
Security, Pages 1541-1552, October 2016
[5]. P. Li, S, Guo, T, Miyazaki, M. Xie, J. HU, W.
Zhuang, “Privacy-Preserving Access to Big Data in the
Cloud”, IEEE Cloud Computing, Vol 3, Issue 5, Pages
34-42. Sept.-Oct. 2016
[6]. R. Padilha, F. Pedone, "Confidentiality in the
cloud", Security Privacy IEEE, vol. 13, no. 1, pp. 57-60,
Jan 2015

6. [7]. J. Margulies, “Securing Cloud-Based Applications,
Part 1”, IEEE Security & Privacy Vol. 13, Issue 5,pages
96-98, Sept.-Oct. 2015
[8]. T. Mavroeidakos, A. Michalas and D. D. Vergados,
"Security architecture based on defense in depth for
Cloud Computing environment," 2016 IEEE Conference
on Computer Communications Workshops (INFOCOM
WKSHPS), San Francisco, CA, 2016, pp. 334-339