Taking back control of privacy: a novel framework for preserving cloud-based firewall policy confidentiality

Abstract

As the cloud computing paradigm evolves, new types of cloud-based services have become available, including security services. Some of the most important and most commonly adopted security services are firewall services. These cannot be easily deployed in a cloud, however, because of a lack of mechanisms preserving firewall policy confidentiality. Even if they were provided, the customer traffic flowing through the Cloud Service Provider infrastructure would still be exposed to eavesdropping and information gaining by performing analysis. To bypass these issues, the following article introduces a novel framework, known as the Ladon Hybrid Cloud, for preserving cloud-based firewall policy confidentiality. It is shown that in this framework, a high level of privacy is provided thanks to leveraging an anonymized firewall approach and a hybrid cloud model. A number of optimization techniques, which help to further improve the Ladon Hybrid Cloud privacy level, are also introduced. Finally, analysis performed on the framework shows that it is possible to find a trade-off between the Ladon Hybrid Cloud privacy level, its congestion probability, and efficiency. This argument has been demonstrated through the results of conducted experiments.

Universal privacy‐preserving platform for SecaaS services

“…This model is not complete for the SecaaS services, however. It was shown by the authors that the original structure of the security policy can be restored by the CSP by eavesdropping and performing an analysis of the traffic flowing between the public and private clouds . To preserve the privacy of the customer, it is then insufficient to maintain the confidentiality of its security policy.…”

“…Liu on the example of the stateless firewall service. Further remarks on these studies following a detailed description of the architecture and operations of BF were given by the authors . None of these works, however, considered using ciphered decisions to eliminate the risk of information leakage and generalizing the framework such that it could be used for the purpose of hosting other kinds of cloud‐based security services.…”

“…Moreover, in the case of the Transmission Control Protocol (TCP) connections, the return traffic also carries information regarding the original structure of the security policy. This problem was studied by the authors . Of the three solutions proposed, two are suitable for use in the UNIPRIV.…”

“…It was shown by the authors that the original structure of the security policy can be restored by the CSP by eavesdropping and performing an analysis of the traffic flowing between the public and private clouds. 16 To preserve the privacy of the customer, it is then insufficient to maintain the confidentiality of its security policy. The system also has to prevent eavesdropping or ensure that the traffic flowing between the clouds carries no information regarding the security policy in use.…”

Designing and building SDN testbeds for energy-aware traffic engineering services

“…We work towards implementing security mechanisms in a cloud computing infrastructure composed of public and private resources. Our research in the area of secure hybrid cloud infrastructure [28] is coordinated with the GETB-AR design, implementation and configuration. Public cloud infrastructure is composed of all DC nodes established in the GETB-AR testbed, private cloud computing resources are represented by all virtual machines attached to network nodes.…”