Secure Logical Isolation for Multi-tenancy in cloud storage

Abstract

Abstract-Storage cloud systems achieve economies of scale by serving multiple tenants from a shared pool of servers and disks. This leads to the commingling of data from different tenants on the same devices. Typically, a request is processed by an application running with sufficient privileges to access any tenant's data; this application authenticates the user and authorizes the request prior to carrying it out. Since the only protection is at the application level, a single vulnerability threatens the data of all tenants, and could lead to cross-tenant data leakage, making the cloud much less secure than dedicated physical resources. To provide security close to physical isolation while allowing complete resource pooling, we propose Secure Logical Isolation for Multi-tenancy (SLIM). SLIM incorporates the first complete security model and set of principles for the safe logical isolation between tenant resources in a cloud storage system, as well as a set of mechanisms for implementing the model. We show how to implement SLIM for OpenStack Swift and present initial performance results.

A Survey of Security and Privacy Challenges in Cloud Computing: Solutions and Future Directions

“…In [64], the concept of tenant-ID is introduced on the data-link layer to securely segment, isolate and identify tenants and their assets in the cloud. The authors in [65] propose a security model and a set of principles to secure logical isolation between tenant resources in a cloud storage system.…”

NoSQL Injection: Data Security on Web Vulnerability

“…In an XSS attack, a malicious code in inserted into the database [7]. When the injected malicious code is executed in a visitor's browser, it can manage the browser to do whatever the attacker needed.…”

Efficient and agile storage management in software defined environments

“…It provides the scalability and agility that file-and block-based storage is lacking because of the strict inherent legacy semantics embedded into them. Moreover, IBM Research has demonstrated advanced capabilities such as computational storage [19], metadata and search [20], and secure multi-tenancy for object storage [21].…”