As we all know a major challenge in adoption of cloud as an organization (user) is that of auditing usage of cloud services. This is important because mostly cloud usage is identified by pay as you go. So far , what I know is that the auditing support is given by the provider. but then, it will be appropriate that the logs or audit information provided by the service providers can be verified for legitimacy and correctness at the organization. Please suggest if this kind of facility is available somewhere? Can we implement the verifiable auditing in cloud services?
Verifiable logs are maintained at the cloud service provider end. As the users access the cloud services from various parts of the world and from various devices, the central logs are available at the cloud service provider end only.
Mr. Muhammad Riaz, Thanks for your reply. At provider's side the logs can be manipulated by the provider and there's no means to test its trueness. However, if we can have the same logging maintained at both ends (with minimal resources) then it cant be manipulated at either ends. I need your suggestion. Thanks in advance.
Security setup at the cloud end is more stringent as compared to user end. At the cloud end, you have centralized logs and you can always compare them with user end logs (users are scattered over globe!). Instead of worrying about manipulation, you can always ask the service provider to satisfy you with respect to 'purity' of logs. By adopting the best of breed security processes, cloud service providers have won the trust of their clients similar to banks. Your money is more safe with banks as your data is more safe with cloud service providers.
Take a look at the A4Cloud project (http://www.a4cloud.eu/), an FP7 project led by Hewlett Packard. They are looking at many cloud-related accountability issues, including audit logs. This is also an area that my group is currently researching; we hope to publish our initial work on audit log provenance in the near future.
Ajay Prasad: "At provider's side the logs can be manipulated by the provider and there's no means to test its trueness."
If I understand your question correct you want some proof that the logs created at the provider's site are correct. This proof should be sent securely (integrity is important) to the cloud customer. That is what you want, correct?
We have build a system (including a running prototype) that allows the cloud customer to get a proof that a reference platform is running on the providers site. This proof is called "attestation". We used Trusted Computing technology for this "proof". Additionally we used trusted boot (also a TCG technology) which allows to measure all executed HW and SW components during startup of the provider's system. The measurement (=integrity) values can be sent in a secure way to the customer. We also implemented Mandatory Access Control to prevent the cloud provider’s administrator to change/manipulate the log files. This way we can create a non-manipulatable audit log from the provider to the customer.
If you are interested in this, see my paper: "Retaining Control Over Private Virtual Machines Hosted by a Cloud Provider". You get the full text via research gate.
Thanks Armin, Ya, you are right, I wud like to add that the verifiability should be from both sides and not only from cloud provider side. I will certainly go through your paper, thanks for the help n advice.
- Badges
- Science method