A review on cloud security issues and solutions

1.1. Need of security in cloud computing

In Cloud computing, virtualization and multi-tenancy provided virtualized resources to the customer and services are delivered through the Internet. Resources are accessed and managed by web applications [6]. The same physical system could be allocated to the different users due to the multi-tenant environment, resulting in physical resource utilization. There is always a kind of risk associated with these technologies. Data visibility to the other users, privileged unauthorized access and virtual machine-related risks are introduced into the system. SaaS is the top model built over the PaaS and IaaS is the lowest model. All three development models are dependent on each other, which resulted dependency in the security related risk. If any service model compromised by the attacker, he or she will access all other layers also.

CSPs frequently launch a Service Level Agreement (SLA) to underline the security of the related services. There must be some standard methods to design an SLA. CSPs rely on detailed SLAs to guarantee security and other parameters to their customers. Security is the primary concern for any Cloud consumer because they have considerably less idea about the quality of Cloud security methods used by CSPs. The Cloud Security depends on policies and strategies used to secure Cloud services.

A recent survey by Flexera 2021 [34] about the use of Cloud services finds that security is still the most challenging issue for implementing and adopting the Cloud computing in the years 2021. Today, almost every organization that uses Cloud infrastructure is encountering security issues. 73% of businesses are highly to extremely worried about Cloud security. In the previous 18 months, 98% of respondents said they had experienced at least one Cloud data breach, with 67% reporting three or more instances. Security vulnerabilities were recognised as a key root cause of Cloud breaches by 60% of big and huge businesses and almost 40% of healthcare organizations [26].

Confidentiality, Integrity and authentication and authorization are basic security services. Confidentiality, ensures that data or information is sent (and received) without being accessed by unauthorized individuals while in transit. Unauthorized individuals, entities, or processes do not have access to the information. Data encryption is an excellent method for achieving confidentiality. Integrity guarantees that the information sent by anyone is the same when an authorized user receives it. There is no modification done by a third party to the received information. Authentication verifies the identity of the sender and receiver. The integrity and confidentiality of data are meaningful just when the identities of senders and receivers are adequately verified.

In literature, research work related to security issues in Cloud computing are surveyed and reviewed by many authors. Some researchers have presented basic introduction of cloud, security attacks and open issues in their work. Some have discussed cloud security issues with solutions in brief. In this work, we have discussed above topics related to cloud in detail with summary.

This paper differs from the other related works in terms of level wise classification of security issues and their latest existing solutions. The major focus is to review level wise security solutions for different security issues. At the end of the discussion of each level, the summary is provided with their strength and limitation for individual approaches.

The organization of this paper is as follows. Section 2 discusses the Cloud computing basic framework and related work. Section 3 classifies security issues at various levels of Cloud computing architecture. Section 4 reviews existing solutions and discusses open issues that still need more exploration. Section 5 concludes this paper.

2.1. Cloud computing framework

It is essential to be aware of Cloud computing basic concepts and framework, so it becomes easier to understand Cloud computing security issues. The National Institute of Standard and Technology (NIST) gives the Cloud computing definition. “Cloud computing is a paradigm for providing ubiquitous, simple, on-demand network access to a shared pool of configurable computing resources that can be swiftly provisioned and provided with minimal managerial efforts by service providers” [35]. The NIST definition for Cloud computing is universally accepted. They define Cloud computing as the threefold model for service distribution. It has five essential characteristics, four deployment models and three service models as shown in Fig. 1.

2.1.1. Essential characteristics

Based on the user requirements and service qualities, Cloud computing have some characteristics. NIST define mainly five key characteristics as follows:

OPEN IN VIEWER

Fig. 1.

Cloud computing definition framework [6].

On-demand self-service: CSP automatically provides Cloud services and resources to the customer as and when required without any human interaction. Web services and management interfaces are responsible for management of these resources and services.

Broad network access: The data and services are available on the network by using the standard mechanisms and access through mobile phones, laptops, workstations, tablets, etc.

Resource pooling: In Cloud computing, multiple customers share resources and dynamically allocate on demand. The resources are location-independent and unknown to the customer.

Rapid elasticity: The resources are rapidly scaled in and out according to the customer needs. Unrestricted and adequate resources are the first choice for any type of customer.

Measured service: The usage of the resources is monitored and reported according to the service type offered.

2.2. Related work to cloud security

Cloud computing security is the most discussed topic in industries and academic researchers. Here some existing survey works related to Cloud computing security are discussed.

Waqas Ahmad et al. [2] presented comprehensive survey for security in IoT and Cloud computing. They have discussed about IoT-Cloud short history, architecture and attacks in brief. Cloud security issues have categorized in four types and presented in details with summary. At the end they have provided future direction for researchers to work in the area of IoT and Cloud computing. Tabrizchi et al. [62] introduced the Cloud computing architecture with all related entities. They categorized Cloud security issues and challenges in five abstract types to provide new classification and discussed the Cloud security threats model. The OWASP [61] based attacks were briefly presented without security solutions. Donno et al. [15] provided a well-structured and fine survey about Cloud security issues in the IoT era and discussed security issues and their impact on the Cloud. They proposed a structured layer-wise classification for Cloud-specific and generic security issues. They identified the security issues that affected the CIA security properties on each Cloud layer.

Subramanian et al. [58] explored the security challenges faced by Cloud actors. They focused on the issues related to the Computational level which further classified in Virtual Machine, Hypervisor and Hardware level issues. The causes and effects of different attacks are presented in detail without security solutions. Basu et al. [9] presented survey about Cloud security challenges based on the Cloud security requirements. Confidentiality, Integrity and Availability has been considered for Cloud security evaluation. They also summarised existing security solutions and concluded work with some open issues.

Singh et al. [54] surveyed on different security issues and challenges related to virtualization, multi-tenancy and the public Cloud. They explored various Cloud services and analyzed the security of each service provider. They introduced three levels of security architecture to enhanced Cloud security. The architecture presented three levels of Cloud services with necessary security considerations and open issues. Coppolino et al. [14] presented an analysis of threats that affected Cloud computing adoption and provided full reviews of current solutions. They also presented the research directions based on the leading research developments and recognized approaches to solve security issues.

Khalil et al. [32] provided a complete review related to Cloud security. They recognized Cloud vulnerabilities and classified security threats and attacks. They also presented security solutions to manage them. They discussed the limitations of the current solutions and provided insights for future research directions. Modi et al. [39] surveyed the factors affecting Cloud adoption and discussed the different layers wise privacy and security in Cloud computing. They try to show the various security vulnerabilities, threats, attacks and solutions. According to them the CIA characteristics of Cloud resources and services are affected by different threats and attacks. The layer-wise classification is shown based on the security issues related to each layer.

Varukonda et al. [47] discussed issues related to Cloud storage, data theft, breaches and their solutions. They also provided an idea about the service models, deployment models with their related security issues. Rao et al. [33] explored various data-related security issues in Cloud and presented the technique to conquer security issues. The deployment model and service delivery model are also discussed in detail to understand the Cloud infrastructure.

The novelty of this paper is in level wise classification of various Cloud security issues and their solutions. The summary is provided for the same with their strength and limitation for individual approaches.

Table 1 compares our review work with other related existing works based on their discussion about security issues, attacks, solutions and open research issues in Cloud computing.

In Table 1, the “✓” indicates that the topic listed in the columns has been discussed and presented in a particular research work. The “×” indicates that the topic has not been covered and discussed in detail in a particular research work. The “✓(In Brief)” indicates that the topic covered in brief only.

Column name Scope of literature review provides research work ranges in years covered in their survey by individuals. Cloud overview introduce Cloud with basic Cloud definition and framework. Cloud attacks represent discussion about Cloud attacks on Cloud security levels. Security solution provides the review of Cloud security existing solutions. Last column Open issues, provide the discussion of open research issues for further exploration. For example, research work presented by Basu et al. is not discussed Cloud overview, Cloud attacks and open issue, but in this research work, all the topics are discussed and reviewed in detail.

While Cloud computing models have several advantages, this beneficial phenomena is vulnerable to both internal and external threats. As a result, Cloud developers enhance their understanding of critical vulnerabilities, the most typical forms of attacks, and Cloud security solutions. The following are some Cloud attacks presented in detail. Table 2 presented summary related to attacks on cloud security.

Denial of service (DOS) attack. [68] also known as a flooding attack, tries flooding a VM by delivering massive amounts of packets over the network from unsuspecting hosts (zombies). UDP, TCP, ICMP, or a combination of these protocols may be used to send packets. This attack aims to prevent legitimate users from accessing the Cloud services and then hacking them. An attacker may be able to make the intended service unavailable by focusing on a single server that provides it. It’s referred to as a direct DoS attack. The flood re-quests deplete the physical components of the server to the point where future service instances on the same physical device are unable to perform their required tasks.

User-root attack. In user to root attack [60], after gaining access to a system’s regular user account (password sniffer, a dictionary attack) the attacker allows a malicious to get root access. Buffer overflow attacks, perl, xterm, and other user to root attacks are just a few examples.

Port Scanning. [65] Ports are scanned by the attacker for finding out the vulnerable ports. Example of this includes the open ports, the closed ports and the ports that are filtered. Attackers could use port Scanning to detect vulnerable ports and services operating on them. Existing port scanning techniques include SYN, ACK, TCP, Windows, FIN, and UDP scanning. This scanning method displays all the network packets, including MAC addresses, IP addresses, router and gateway filters, and firewall rules, among other things. A port scanning attack in the Cloud environment could jeopardize the Cloud’s secrecy and integrity.

Man-in-the-middle attack. A man in the middle attack occurs when an attacker intervenes in the data flow between two parties. Because of a security configuration flaw in a Secure Socket Layer, this attack is possible (SSL). When two parties, including providers, communicate in the Cloud, an attacker resides in the middle and has access to the data if the communication channels are not secure.

Virtualization/Hypervisor attack. [52] An attacker can gain access to a VM by exploiting the hypervisor. By targeting zero-day attacks in VM, attackers can simply target and get access to them, potentially resulting in the loss of numerous websites that rely on virtual servers.

Metadata Spoofing. In this type of attack, an adversary modifies or changes the Web Services Description Language (WSDL) file, which stores descriptions about service instances. This attack is possible if the adversary is successful in interrupting service invocation code from the WSDL file at delivery time. To protect against such an attack, information about services and applications should be kept encrypted. For access to such sensitive information, strong authentication should be required.

Sniffing attack. [24] In Sniffing, attacker use a sniffer to intercept network traffic. The sniffer is a process that seeks to collect network sent packets across networks. Moreover, If security systems are implemented incorrectly, this sort of attack might acquire sensitive data by sniffing network traffic or permitting remotely stored user data in the Cloud environment. An attackers scan open ports for any vulnerable services on the network to capture useful sensitive data. Encryption security Encryption protects private data from malicious hackers by keeping devices secure on the network.

Phishing attack. Phishing attack [41] is used to manipulate a web link. As a result of the attack, a valid user is led to a specious web page, where he believes the open web page is a secure page and enters his username and password. After then, the attacker has access to his credentials.

Insider Attack. [18] An insider attack is described as the malicious use of computer system and network by users. The attackers can try to obtain and abuse privileges that have been assigned to them. As a result, they can defraud others, deliberately alter data, or expose secrets to competitors. This is a substantial breach of confidentiality. An inner DoS attack was performed targeting Amazon (EC2) as an example [71].

Cross VM side channel attack. A side-channel attack, as defined by Ainapure [3] in 2017, is one that relies on data collected from a computer system’s application rather than faults in the algorithm alone. Timing data, power usage, electromagnetic leaks, and sometimes even sound is used to provide an additional source of information. VM running on a similar core of the OS are targeted by malicious or anomalous attacks, which include side-channel attacks. The cache is a shared resource between numerous VMs running simultaneously on the similar core of the OS. The attacker can use the victim’s cache functionality to launch a (cache-base) memory side-channel attack.

Backdoor channel attacks. [49] Attacker attacks via the backdoor. It is a passive attack in which hackers attain remote access to a compromised node to compromise user privacy. Hackers can monitor a victim’s resources and turn it into a monster for a DDoS attack by using backdoor channels. It could be utilized obtain sensitive information about the victim. As a result, the infected device may have trouble executing its routine tasks. In the Cloud environment, an attacker could utilize a backdoor channel to acquire access and control of a user’s resources, as well as turn a VM into a zombie to launch a DDoS attack.

Protocol manipulation. To investigate the target’s security, network protocols might be subject to well-known attacks such as denial of service, exploiting application communication weaknesses, and changing the contents of XML information exchanged between users and servers. In reality, improper protocol implementation leads to this sort of attack by sending erroneous messages that exploit vulnerabilities in protocol implementations, and attackers can crash or hijack victims.

The network is the fundamental building block of Cloud computing. As a result, problems exist not just in the VM, service, or application, but also at the network level. Issues at the network level might have a direct impact on the Cloud system. The network boundaries are modified to allow the user and service to communicate. As a result, the present state of network security necessitates the adoption of new trends [7].

Network Security: Security issues at the network level consider as both internal and external networks. Sniffer attacks, cross-site scripting, DNS poisoning, phishing, port scanning, ARP spoofing, and IP spoofing are common network-level attacks [39]. The attackers have executed these attacks to gain unauthorized access to Cloud resources. The unauthorized user can ability to access other users’ resources without any difficulty. The internal attackers might be official admin users or users from the same Cloud network. External attackers have limited privileges in network, resources, and security mechanisms compared to internal ones. The vulnerable Internet protocols, intrusions, data transmission and attacks, session hijacking are some of the main network-level issues.

3.3. Application and CSP level security issues

The Application and CSP level security issues are widely covered in this section. The issues discussed are due to the web technologies that provide Cloud services through the Internet.

Web Application: Services and applications are utilized, managed over the web and always available for users to access universally. The same application may access by different users simultaneously because Cloud applications are not bounded with specific users, which is one of the most significant characteristics of the Cloud [55]. The less secure web application in the Cloud generates some issues related to the Co-location of multiple users, their data, and other resources [21].

3.4. Virtualization level security issues

Virtualization in Cloud computing is a result of the widespread usage of Cloud computing in the industry. The development of a Cloud service for commercial purposes necessitates the Cloud provider’s reliance in the VM. Virtualization is the essential prerequisite for any service in Cloud environments. The virtualization security issues are widely covered in this section.

VM Isolation: The VMs isolation is necessary for VMs running on the common hardware to guarantee the security and safety of the system even if another VM is compromised on the same system. There is always logical isolation among VMs, therefore access to the same resources can lead towards cross-VM and data breach attacks [38]. Reuse of IP addresses between VMs can crack the isolation and raise the issues like the destruction of the complete system.

3.5. Data storage level security issues

In Cloud computing, the data in transit and data in rest are to different conditions for any kind of data. The data in transit state, the data transfer through the Transport Layer Services (TLS), which provides a better security mechanism for data transfer in Clouds. Therefore, the data in rest is less secure and more favorable to breach from the attacker’s viewpoint.

There are several security concerns and solutions associated with data storage. A Cloud storage provider must use the correct technology and procedures to store data in the Cloud effectively and reliably.

Table 3 provides the list of level-wise Cloud computing security issues with existing solutions.

4.1. Network level

To alleviate some of the network difficulties, leading Cloud providers are hosting their apps behind a firewall. However, it only offers protection at the network’s outside and cannot detect inside threats. Network based intrusion detection system (NIDS) can be integrated to address some of the security issues. A NIDS, on the other hand, should be set to detect both external and internal intrusions. The following sections describe existing research attempts to solve network security challenges in the Cloud. The frameworks proposed in [8] and [31] are able to detect the virtual network level attacks using NIDS. The approach in [36] is hypervisor based NIDS to secure the virtualization level.

OPEN IN VIEWER

Fig. 4.

Design of the intrusion detection framework for cloud [8].

Arjunan et al. [8] proposed a security framework to detect intrusions at the virtual network layer of the Cloud. The framework is based on the combination of signature and anomaly detection techniques. They used different machine learning techniques for feature selection and attack classifications. The intrusion evidence is collected from every area of Cloud to detect the distributed attacks. The Dempster-Shafer theory (DST) [51] is used to make final decision-making procedures for alert generation. Figure 4 shows the proposed intrusion detection framework for Cloud.

Mishra et al. [36] proposed the Malicious Network Packet Detection (MNPD) out-VM monitoring security approach. The VMs are monitored from outside at network as well as the virtualization layer. MNDP analyzed the behavior of network packets at Cloud Networking Server (CNS) to provides intrusion detection at the network level. MNDP validated the VM traffic at the hypervisor level to detected spoofing attacks from other VMs. The approach provided the second level defense to detect the intrusions at the virtualization level. The non-spoofed packets were further analyzed to sense any irregularity in the virtual traffic. The Random Forest statistical learning technique is integrated with feature selection to analyze the behavior of network traffic. The MNDP detects packets that never pass through the physical interface and hence not detected by conventional IDS. Therefore, no extra memory or timing overhead.

Kadam et al. [31] proposed an intrusion detection framework to secure virtual machines against network attacks in Cloud environments. The framework used snort for signature-based detection. A variety of feature selection techniques based on machine learning, as well as a combination of classification approaches, utilized for anomaly detection. It increased the accuracy of Cloud intrusion detection while decreasing false alarms.

Tayyebi et al. [64] proposed IDS with new algorithm based on the VM and network layer behaviors. They have introduced a new concept to improve system accuracy by reducing the resource requirement for attack detection and prevention. The IDS placed at each VM and built based on the VM feature and network behavior. The weights are attached with each known attack signatures and updated dynamically based on the new signatures and network behaviors. Minimum required signatures are selected according to the VM feature, network behavior and total weight associated with each signature. The system became more accurate by lower resource utilization and false alerts.

Patil et al. [43] presented NIDS to detect physical and virtual network related attacks. they deployed IDS at each Cloud server on privilege control VM. The Internal, external and Virtual network are monitored by IDS. The alerts generated from various Cloud servers are correlated with each other for distributed attack detection. The new attack signatures are updated in database for future use.

To overcome the limitations of the above-presented approaches, further work related to NIDS needed to provide a fully secured network environment in Cloud computing. This section discussed several solutions to network-level security issues in Cloud computing. Table 4 provides a summary of their strength and limitation.

Application level security refers to the use of software and hardware resources to secure applications so that attackers cannot get control of them and change their format.

It is possible to change an eavesdropped communication despite the fact that it is digitally signed, based on application level vulnerabilities. As a result, an attacker is able to execute arbitrary computer commands on behalf of a legitimate user. Data should be transferred through a secure channel, and fine-grained authentication and authorization techniques can be employed to prevent unwanted access to the data. The following sections describe existing research attempts to solve application level challenges in the Cloud computing.

Ruj et al. [48] proposed a new scheme for secure data storage in Clouds that provides robust, decentralized access control and anonymous authentication. Cloud verified the authenticity of users before storing or modifying the data. The user’s authentication process done without releasing the user’s identity. Several Key Distribution Centers (KDCs) provided for key management process. If two different users are not authorized individually, no user colluded and accessed the data or authenticated them. Access control and authentication are not vulnerable to collusion. Only valid users can decode the information because of the access control. The users after the revocation process not able to access the data. The scheme prevented replay attacks and supported creating, modifying, and reading the data stored in the Cloud. The overheads for communication, processing, and storage are comparable to centralized alternatives.

Patel et al. [42] proposed a privacy-enhanced authentication method to achieve high level security in Cloud computing. The basic security and privacy are provided to CSPs and Cloud users based on Pretty Good Privacy (PGP) [20] and Kerberos [56]. According to the author, Kerberos authenticated the user’s identity over networks, provided data integrity and secrecy, and prevented replay attacks. Kerberos used a trusted third party (KDC) to perform secure user verification and not supported non-repudiation. They used the concept of digital signatures and public-key cryptography, along with Pretty Good Privacy to solve Kerberos weakness.

OPEN IN VIEWER

Fig. 5.

Method for authentication in cloud [42].

The proposed method for authentication for Cloud is shown in Fig. 5. First, users registered themselves to the Kerberos (KDC). The ticket provided to the registered users for communication with CSP by the Kerberos server. The tickets and registered user identities also provided to CSP who stored these for future use. The KDC acknowledges user credentials arrival and storage by CSP. The user data first encrypted before sending in to the Cloud for storage. The PGP authenticated the user and sent encrypted data to the Cloud. PGP also sent the user authentication message to CSP. The requested data by the user sent to PGP. The user data and information decrypted and sent to the authorized user by PGP. They presented the security analysis of the proposed framework. According to the analysis, there should be very little chance for successful mathematical attacks and brute force attacks due to the secure use of RSA. The scheme provided good user privacy by using encrypted data transfer. The registered user credentials stored for better identity management.

Sukhodolskiy et al. [59] implemented a multi-user system prototype that provided access control to datasets stored in a Cloud. The Cloud users created their unique ID using provided set of attributes. The system implemented on the multi-authority attribute-based encryption scheme. The security is increased by a Certificate Authority (CA) independent of the CSP and signed Revocation Lists. They used API to connect their prototype to existing Cloud storage. Instead of attributing the computational burden to a single party, it is divided among multiple users.

Joshi et al. [29] developed a new attribute-based authorization system using Attribute Based Encryption (ABE) [23]. The system is centralized, which provides secure access to patient records. The service management overhead shifted from patients to the medical organization. The mechanism corporated the Attribute Based Access Control (ABAC) [28] with access control policies to evaluate access to the system. They encrypted the patient’s Electronic Health Records (EHRs) using Attribute Based Encryption (ABE) to provide data security assurance. They developed a HIPAA [13] compliant knowledge graph using the HIPAA Ontology. The graph contains details about various medical organizations concerning various attributes. The information is kept on the EHR Cloud service provider’s server. From the knowledge graph, the user and EHR field attributes are extracted. The retrieved data was utilized to construct attribute-based encryption and safe access control. Every patient is saved as a separate node in the knowledge graph, allowing easy data access.

Wei et al. [69] presented secure and cost-effective attribute-based access control to Cloud storage systems for a multi-authority based on Ciphertext-Attribute Based Encryption (CP-ABE). The attribute authorities provided separate secret keys for individual users. The public parameter of the system remains unchanged throughout the system’s life cycle. It is used to update the ciphertext without the data owner and the authority. The implemented system provided both forward security and backward security. Because the method permitted dynamic and scalable user revocation, the revoked user cannot access previously available data.

Wu et al. [70] proposed an API access control based on OAuth that simplified the process flow in various application situations. It simplified the authentication and authorization flow. The standard IT technology and tools used to implement that mechanism. OAuth provided access to server resources to the third-party applications. The resources accessed without sharing the resource owner’s access credentials by generating the tokens instead of access credentials. Each token allowed access to a particular site for particular resources. They proposed the TBAC model based on tokens and private key to verify the API user. The model used the integration of private keys and temporary access tokens to validated users. The APIs management platform worked as a mediator between API users and providers to distribute, discover, and consume an API. API users start to use the capabilities offered by the APIs management platform. The proposed API management system tested execution and response times to serve the different API users.

This section discusses several security solutions related to Application and CSP level security issues in Cloud computing. Table 5 provides a summary of their strength and limitation.

In a virtualized environment, several operating systems run concurrently on a host machine through a hypervisor. Existing vulnerabilities in a VM that are distributed throughout the physical and virtual enterprise resources allow cyber attackers, malware, or other threats to exploit remotely. As the number of guest operating systems (OSs) running on a hypervisor increase, the security concerns with that newer guest OSs also increase. If a hacker gains control of the hypervisor, he may modify any of the guest OSs and get access to any data moving through the hypervisor.

There should be a standard approach for ensuring the integrity of guest VMs in order to effectively execute workload while preventing interruptions in computation, data loss, and resource misallocation. The following sections describe existing research attempts to solve virtualization level challenges in the Cloud computing.

Wang et al. [67] focused on the issues related to pour availability of VMs. They proposed the approach called LiveRB to remotely backup and save the running states of VMs. LiveRB run the backup process in the background. The backup process is visible to VM apps. A virtual block device is cached I/O operations in memory and saved the VM’s incremental virtual disc data to a remote server. The effectiveness and efficiency of the LiveRB are used to implement and assess it.

OPEN IN VIEWER

Fig. 6.

Architecture of LiveRB for VM image backup [67].

The architecture of LiveRB in the hypervisor layer shown in Fig. 6 is mainly divided into two components. The live migration module saved the running states of VM to remote storage and the virtual block device managed the saving of VM states to remote storage. The live migration module kept the application data as pages at the time of memory access by applications. During the backup process, the saved pages transferred to the remote storage along with other memory pages. The first task of virtual box device is to put on hold the writing process of all memory disk i/o operations until the saved pages by migration module are transferred to remote storage. The i/o writes redirected to memory cache for temporary storage and backup the pages saved between current virtual disk state and last saved disk state. After completing the backup task, the cached i/o with other memory pages are stored into the virtual disk by the virtual block device.

Islam et al. [27] author proposed a security framework to secure the stored virtual machine images. The security model used encryption, decryption mechanisms and Kerberos to defend the virtual machine images. The proposed system has three main modules. Image Management Module (IMM) managed the virtual machine image encryption and decryption process at the time of storage into a disk or at the time of launch. The Key Management Module (KMM) managed the generation and storage processes for encryption-decryption keys and supplied the Image Management Module’s keys. All communications between KMM, IMM and Kerberos did through the secure channel. They combined encryption plus Kerberos and setup in an OpenStack environment to enhance the security. They compared the various features of the proposed model with existing security models. The Kerberos provided the extra layer of security and work based on the onion security model. Kerberos’s disk encryption and authentication combination include some computational overhead to the Cloud system.

Dildar et al. [17] proposed Virtual Machines and Hypervisor Intrusion Detection System (VMHIDS) to protect the hypervisor. They categorized the hypervisor attacks into the Cloud infrastructure attacks and external attacks with a brief overview of all infrastructure related attacks. They discussed the five existing techniques to prevent the hypervisor with all their strengths and weaknesses. The IDPS, virtual firewall, Network-based IDS, Host-based IDS and Hypervisor-based IDS techniques have not protected the Cloud against the hypervisor attack. Therefore, to overcome the existing weakness they proposed VMHIDS. Hypervisor based IDS placed with the hypervisor layer. The proposed VMHIDS is placed with the hypervisor and each associated VMs with the hypervisor. The hypervisor attack initiated with delivered packets through the Internet. The hypervisor and virtual machines protected by VMHIDS against insider and external attacks on Cloud. The real time anomaly based detection techniques used to detect and block the malicious packets through the tracking and traffic analysis by VMHIDS.

Mishra et al. [37] proposed VMGuard architecture to detect malicious activities at the VMM level based on VMI with Machine Learning technique. They claim that, various attacks based on malicious hidden process, disable security tools in VM and alter the behavior of legitimate applications to access sensitive data detected by the system. They used Term Frequency-Inverse Document Frequency TF-IDF [46] for Bags on N-grams based method for feature selection and Random Forest (RF) for classification. The LibVMI [45] interface and Drakvuf advanced VMI tools used to collect system calls and rekall tool for acquired the details of guest OS kernel symbols and their address location. The authors not consider the early analysis of the malware but VMGuard is found to perform fine in detecting program subversion attacks.

This section discusses several existing solutions related to virtualization level security issues in Cloud computing. Table 6 provides the summary with their strength and limitation.

Even if efforts are made to prevent unauthorized access, data may be compromised as a result of application defects. The biggest issue with data on the Cloud is loss of control if an unauthorized user accesses the data in a shared environment. Because the encryption and decryption keys can be compromised by a malicious user, storage devices with built-in encryption algorithms failed to prevent unauthorized access. Because of the shared environment, protecting data integrity is the most difficult challenge in the Cloud. The following sections describe existing research attempts to solve data storage level challenges in the Cloud computing.

Data security and privacy are very essential for organizations that wanted to adopt Cloud computing. Different types of data require different levels of protection. Shaikh et al. [53] proposed a data classification method to secure Cloud computing. The technique defined various parameters based on a variety of dimensions. The data security depended on the predefined levels and the required protection. The security requirements applied to the data storage are based on the classified data as per the dimensions. The data need perfect classification techniques to improve security and strength significantly.

More et al. [40] discussed the public data auditing scheme for Cloud storage to ensure data integrity with the help of a Third Party Auditor (TPA). The scheme is straightforward and secure. It observed general security requirements like public auditing, privacy-preserving and maintaining integrity and confidentiality. The scheme used three entities, the data owner, Cloud server and the TPA. TPA requested encrypted data from the Cloud server when the client requested data auditing and generated all the above values and signatures using the same algorithms. TPA compared both the signatures for the integrity verification process and if they matched with each other, it means data is not altered by outsiders or attackers. One of the limitations of the scheme was timing overhead.

Considering that security is a critical issue Akhil et al. [4] presented the system to enhance Cloud data security using the AES algorithm. They discussed existing work related to Cloud security algorithms. According to the authors, many users use the same network for data transfers so the data become less secure against different security attacks and becomes prone to intruders or attackers.

The proposed security Cloud server model shown in Fig. 7 works as follows: The users requested data storage to the server. On receiving the storage request, the TPA called by the server to verified the identity of users. The TPA not only verified the user but also selected the available Cloud server storage. On the user side, the data is encrypted using the AES algorithm and transfer through the secure channel to the server for storage. The server stored the encrypted data safely. The third-party auditor was unaware of the encryption and decryption process in the system. The encryption-decryption overhead should be there on the user side.

OPEN IN VIEWER

Fig. 7.

Cloud data security model [4].

Jothy et al. [30] author proposed the new architecture to secure data storage in the multi-Cloud environment when data travel through the network to Clouds. The symmetric cryptographic algorithm AES (Advanced Encryption Standard) and PGP (Pretty Good Privacy) provided security to the data at rest and data at motion respectively. According to the author, symmetric cryptosystems provided more resilient encryption with longer key lengths, as well as the speed and computational efficiency to handle massive volumes of data encryption.

Before passing through the secure channel, the data encrypted using the AES algorithm and further encrypted using the PGP algorithm. According to the total number of Clouds, the encrypted data divided into equal parts and stored in each Cloud. AES is a practically strong encryption technique based on substitutions, permutations and linear transformations. Therefore, AES is a preferable encryption technique for banks security, governments, and other high-security organizations. To improve the open network security they used the PGP (Pretty Good Privacy). The cryptographic algorithm and number of key generation would take long time duration.

Sajay et al. [50] They proposed a hybrid algorithm to enhance Cloud data security using encryption algorithm and securely stored huge amount of information in Cloud. The scheme combined the homographic encryption and blowfish encryption algorithms to enhance Cloud security. The homographic encryption applied on input bits then bit strings are joined and passed to second layer of blowfish encryption. The reverse process applied for decryption of string to obtain the original message. The approach used reversible multilayer encryption which provided enhanced security to Cloud. According to the author, the blowfish algorithm is a variable-length algorithm, and key generation for both encryption and decryption in the blowfish algorithm is much faster and more secure. The homographic encryption offers a new dimension to storage in Cloud and also offers data confidentiality as in no stage information is exposed in plain text.

This section discusses several solutions related to Cloud computing data storage level security issues. Table 7 provides a summary of their strength and limitation.

The researcher should not focus only on the few selected issues but there should be a need to find integrated solutions that resolve almost all security requirements. The researcher finds solutions for specific issues and implements multiple mitigation techniques for different security requirements. It is not practical to use the number of security solutions to the same number of security requirements. The integrated security solutions are straightforward to deploy and manage. Therefore, there is a need for framework or integrated solutions at each level to provide security against these issues.

The researcher presents many security issues and solutions to achieve total security, but many open issues and challenges need to be explored. To provide full security to Cloud infrastructure, there must a need to find the solutions for these open issues.

One of the key issues at the network level is the unavailability of services. Denial of Service (DoS) and Distributed Denial of Service (DDoS) are main threats to service unavailability [68]. These attacks cause inconvenience to customers and prevent their access to the Cloud services. Though the virtual network provides a secure network, it requires traffic monitoring to detect malicious activities. Solutions [8,31] [43] provides traffic monitoring with high detection accuracy but suffer from high processing overhead. There must be adequate solution to provide traffic monitoring with high accuracy and low processing cost.

User and CSP level, due to the resource sharing and different domain services the security for access control and identity management is somehow a complicated task [29]. Different organizations have their own level of access controls and identities in Clouds. The mapping of these IDs is time taking procedure [48]. Unauthorized or malicious user identification are still open issues for Cloud computing. There is a need to design strong security measures and provide fine-grained access control mechanisms for controlling user data access. The researcher offers many solutions [42,69], but they have limitations to solve the issues.

Virtualization level security issues are concerned with virtualization [67]. The multi-tenancy is a crucial feature of Cloud computing used to optimize resource utilization. Providing security to multi-tenant environment is a big challenge for Cloud computing. Security of the VMs, hypervisor and host are the crucial concerns in the Cloud environment. The Cloud user requires standard protocols and formats to migrate data from one Cloud to another [17]. Therefore, Cloud migration is also a challenging task for researcher.

Data storage level security issues need more concerns and focus on ensuring data privacy and confidentiality. Ensuring the isolation between the user’s data is a significant security concern [37,53]. Need secure TPA based authentication solutions for user verification [4,40]. Some operations in the Cloud need unencrypted data during computation [50]. The locations where data stored temporarily during processes may not be secure. Therefore, data security during processing in Cloud is still an open issue and needs to solve.