Welcome!

@CloudExpo Authors: Liz McMillan, Elizabeth White, William Schmarzo, Rene Buest, Pat Romanski

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog

@CloudExpo: Article

The Role of Trusted Infrastructure in Application Deployment

Users need to treat trust as an operating cost of the cloud

While there is much talk about how to secure data and systems in cloud computing, many gaps remain in implementing such security. As users of any physical security systems can attest, it just takes one unsecured door or window to provide easy access to an intruder and loss of valued property. Of course with data in the cloud, the situation is much worse. Cloud users can have their data stolen by more than one intruder. And, the cost of a security breach can easily run into the millions of dollars range - far more than most thieves could steal in hardware.

The root problem of cloud security is caused by users' inability to verify directly the trusted computing base. In the cloud, users have the choice of either verifying to establish trust prior to implementing cloud services or simply trust to begin with and then hope for the best. The latter approach is not recommended. The recommended process of initial verification involves standards, technology and certification. Deeper verification involves the use of integrity measurement and remote attestation of the components of the cloud computing base.

Using legacy applications in the shared IT environment of cloud computing requires replacing physical with virtual boundaries. This is the infrastructure consolidation challenge for cloud users and providers. Today, most of the products and existing standards address specific devices or functionality within the overall end to end process. While many standards and products contribute to the ability to solve various portions of the problem, no comprehensive framework exists to describe the needs of various businesses and validate the compliance of the entire solution. As applications migrate into the cloud and the service-oriented components of composite applications are hosted on infrastructure that is shared with other tenants and potentially provided by multiple providers, it is critical to the integrity of the overall composite application to establish a trust domain that describes a coherent policy for the infrastructure services that become part of the application domain.

Trusted Computing Group (TCG) experts have determined that in a Trusted Multi-Tenant Infrastructure (TMI), potential users are looking for protection of processing and information in motion and at rest, as well as the ability to share physical platforms among tenant domain components or shared services. In addition, users want visibility and auditability of actions across the enterprise. This imposes a few constraints on the solution.

Among the constraints is the ability to manage physical resources independently of domain resources as well as the ability to run legacy workload unmodified within a secure context. This also requires the ability to control the flow of information between tenant domains within policy constraints. A further implication is a loosely coupled architecture that can be managed using the application of appropriate policy and trust considerations. In addition, it requires the ability to address various security models to protect the integrity and confidentiality of services and data exchanges within the enterprise.

Closing Security Gaps
Today, the classic approach to deploying SOA application services involves separate infrastructure for each component or client. This approach makes end-to-end visibility, security and management very difficult. Existing solutions also increase space, power usage and cooling requirements. In contrast, the target multi-tenant solution supports more efficient use of space, power and hardware, as well as a consistent security and management policy across shared infrastructure and providers.

The trusted multi-tenant solution is being developed by the Trusted Computing Group (TCG), which consists of member companies from over 100 key technology providers of hardware, software and services as well as several security conscious users. TCG has developed several specifications to establish and improve trust within organizations. The initial specification defined a Trusted Platform Module or TPM - a hardware root of trust for the computing platform. Today, TPM 1.2 is an ISO standard.

The TPM is security hardware that is resident on the motherboard. Based on open specifications from TCG, the TPM resists tampering and software attacks. It is an integral part of almost all enterprise PCs but it is off by default, requiring users to opt in. It features secure key storage cryptographic functions and integrity checking and remote attestation. As a result, the TPM is used for strong user and the machine authentication, secure storage and for trusted/secure boot.

TCG specifications also define a chain of trust architecture that enables attestation of trusted platform properties. Figure 1 shows a visual example of the various TCG standards that have been established for trusted systems. One missing element, especially relevant for cloud computing, is the reference model that brings these existing standards together.

Figure 1: Trusted Computing Group Standards address key data security issues within small to large enterprises.

To address the missing piece and close the gap, TCG is describing the overall framework for integrated Trusted Multi-Tenant Infrastructure solutions. Its Trusted Multi-Tenant Infrastructure (TMI) solution-oriented work group (WG) is focused on the business or mission outcomes using the output of TCG's technical work groups. The intent is to produce a logical reference model consisting of components interfaces, use cases, standards alignment and gaps as well as compliance validation. This open model will be used by TMI WG industry experts as a framework for building secure enterprise solutions.

In addition to identifying and addressing gaps in existing standards, the TMI work group's objectives include developing a standards framework for implementing shared infrastructures and multi-provider infrastructures as well as developing reference models and implementation guidance.

As part of its somewhat different approach to standards, the TMI WG focuses on a new class of membership including IT product vendors and integrators. The goal of this committee's efforts is an IT solution based on multi-tenant shared infrastructure that establishes trustworthiness in the provider of the IT services. Additionally, the solution will address establishing and monitoring compliance of the changing IT policies as well as accessing and monitoring compliance across policy and performance objectives - all in a multi-sourced, multi-supplier ecosystem.

Use Cases within the TMI Architecture
The use cases that have been developed for the TMI reference architecture are based on a small set of core primitive capabilities. The first core function establishes a trusted context for interaction across the multi-tenant domain by aligning the Public Key Infrastructure (PKIv3) security architecture and the TPM. This function allows the establishment of a level of trust including identity of the components in a solution, integrity measurement and compliance attestations that support the degree and type of information to be accepted between parties. The second core function requires exchanging information within the established trusted context. The trusted context provides the ability to ensure that the information is exchanged between parties within the boundaries of the trusted relationship.

Finally, the third core function requires definition and application of consistent policy governing the state, configuration, interaction and management of components within the TMI.

In a broad sense, the TMI WG is defining use cases using the vocabulary associated with the core primitive functions. This will allow transmitting information from a confidential source to a recipient in another tenant domain with the assurance of the ability to trust that the information is reliable. Also, it will allow users and providers to determine if workload from a tenant domain can be provisioned to an external cloud provider in accordance with the policies of both provider and the consumer of services.

Figure 2 shows an example of a generic use case from TCG Trusted Multi-Tenant Infrastructure Use Cases Version 1.0. The use case identifies the relationship between the various components involved in the provisioning of a Peripheral Device in a provider's environment while maintaining compliance with the published policies of the Trusted Systems Domain.

Figure 2. A generic use case identifies how to provision a peripheral device within the Trusted Systems Domain.

With the use cases established, the next step involves deriving a reference model. A logical view of the TMI reference architecture is shown in Figure 3. In this figure, the User Access Device (UAD) supports connecting to one or more concurrent domains. Servers indicate a federated data center of servers that can host multiple independent domains. Exchange represents logical components both physical and virtual that define cross domain information flow rules. Storage is also federated and the network represents devices that can transfer data from multiple domains.

Figure 3: The logical view of the TMI reference architecture shows the separation of the consumers in various cloud aspects.

The management view of the TMI reference model framework shows that both consumers and providers have management responsibilities within the TMI. Specifically, the consumer manages his policy and resources allocated within his domain. In contrast, the provider manages resource allocation to the consumers as well as the platform. A consumer has no direct control over the underlying platform and the provider has no insight into the information and processing within the resources allocated to the consumer. In addition, the provider establishes trust relationships with other providers and consumers to enable migration, bursting and interaction between tenant consumers. Figure 4 shows these relationships.

Figure 4: The management view of the TMI reference architecture shows the consumer and provider management responsibilities within the TMI.

A New Paradigm for Trusted Applications
A company that wants to add cloud resources to its existing resources without compromising security usually has several specific requirements. To proceed without compromising security, a company needs a means to interrogate the infrastructure and obtain answers that have a level of integrity to determine that the responses are true. The information exchange involves the platform information, assured compliance to agreed policies and measurement of platform state.

With the TMI solution, patterns are brought together to establish a trust relationship with a potential provider and then overlaid with the three core functions identified previously. This provides the process to have a policy discussion and establish a trust domain. The set of policies that need to be enforced are established through the use cases.  Using this approach, a user can interview potential suppliers and verify which ones are willing to provide resources that are compliant with the organization's policies. With these security policies in place, the user can be confident that the cloud security is essentially the same as the security within that organization.

Building upon the concepts the TMI reference model describes a set of requirements and implementation patterns that can be used to construct solutions. A requirement is mapped to a set of patterns that describe a number of ways that the requirement can be met. Each pattern is then mapped to industry standards and practices that can then be mapped to products that implement the standards. This mapping allows architects to construct valid solutions within a shared infrastructure cloud.

For example, a consumer of cloud services may determine a need for virtual machines to host components of a service-oriented application. Certain of the services must run on dedicated hardware, others can share hardware, but must be located in a specific geography and others may be shared only if strong separation is enforced by the hypervisor. The hardware must be able to prove that it has not been compromised by malware through attestation of a trusted boot and integrity measurement of key modules within the bios, hypervisor and OS. The application runtime environment must be at a certain patch level. These policies are sent to the environment provider, who returns signed attestations of compliance within the trusted context established between the provider and consumer. The consumer then determines that the application components can be provisioned on the resources and devices for which the provider has attested policy compliance. The consumer may choose to re-validate compliance at various times to ensure nothing has changed.

While not yet a part of the TMI reference model, there is no reason why the same process could not be applied to application components using code signing and attestation of integrity measurement of running application services.

The value of using a trusted infrastructure for service-oriented application deployment should be clear. Even the best written applications can be compromised if the platform can be intercepted maliciously or the content of memory or storage changed. If an application can validate the integrity of the platform upon which the code is executing, then it becomes a less difficult decision to use shared resources or cloud hosting to deploy and scale the application. Combine this with trusted coding and application integrity measurement and the decision process for a consumer to entrust their data to a cloud based application becomes easier.

Looking at Trust Differently than in the Past
According to Ponemon Institutes' Cost of a Data Breach 2010 study, the average cost of a data breach is about $3.44 million and ranges from $1.83 to $6.75 million in different regions of the world.  Enterprises must consider the cost of protecting business data, whether in the internal data center or the cloud just like the cost of higher security door locks or hiring security staff.

Instead of considering trust as an afterthought, users need to treat trust as an operating cost of the cloud. Standards are one way of minimizing this cost. While a trusted secure cloud may not be the lowest initial cost option, in the long run, the risk of exposure must be balanced against the compromise of the information that a user puts into the cloud. TCG's Trusted Multi-Tenant Infrastructure WG has made significant progress towards providing the industry with a standard for IT managers.

The TMI solution working group encourages vendors and end-user organizations to get involved in defining the requirements for the TMI specification.

More Stories By Michael Donovan

Michael Donovan is the Chief Technologist for Strategic Capabilities with HP Enterprise Services, responsible for framework implementation to support capabilities and offering development for clients across the U.S. Public Sector. His responsibilities include harvesting existing solutions for re-use and developing new capabilities to meet the complex needs of federal, state and local governments, leveraging the best of our current account and corporate capabilities and those supported by our partner ecosystem and HP Labs. He also co-chairs the Trusted Multi-Tenant Infrastructure Work Group of the Trusted Computing Group.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@CloudExpo Stories
"We want to show that our solution is far less expensive with a much better total cost of ownership so we announced several key features. One is called geo-distributed erasure coding, another is support for KVM and we introduced a new capability called Multi-Part," explained Tim Desai, Senior Product Marketing Manager at Hitachi Data Systems, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
There is a huge demand for responsive, real-time mobile and web experiences, but current architectural patterns do not easily accommodate applications that respond to events in real time. Common solutions using message queues or HTTP long-polling quickly lead to resiliency, scalability and development velocity challenges. In his session at 21st Cloud Expo, Ryland Degnan, a Senior Software Engineer on the Netflix Edge Platform team, will discuss how by leveraging a reactive stream-based protocol,...
DevOps at Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to w...
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devic...
"The Striim platform is a full end-to-end streaming integration and analytics platform that is middleware that covers a lot of different use cases," explained Steve Wilkes, Founder and CTO at Striim, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
SYS-CON Events announced today that Calligo, an innovative cloud service provider offering mid-sized companies the highest levels of data privacy and security, has been named "Bronze Sponsor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Calligo offers unparalleled application performance guarantees, commercial flexibility and a personalised support service from its globally located cloud plat...
"With Digital Experience Monitoring what used to be a simple visit to a web page has exploded into app on phones, data from social media feeds, competitive benchmarking - these are all components that are only available because of some type of digital asset," explained Leo Vasiliou, Director of Web Performance Engineering at Catchpoint Systems, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
21st International Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Me...
SYS-CON Events announced today that DXWorldExpo has been named “Global Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Digital Transformation is the key issue driving the global enterprise IT business. Digital Transformation is most prominent among Global 2000 enterprises and government institutions.
SYS-CON Events announced today that Datera, that offers a radically new data management architecture, has been named "Exhibitor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Datera is transforming the traditional datacenter model through modern cloud simplicity. The technology industry is at another major inflection point. The rise of mobile, the Internet of Things, data storage and Big...
Kubernetes is an open source system for automating deployment, scaling, and management of containerized applications. Kubernetes was originally built by Google, leveraging years of experience with managing container workloads, and is now a Cloud Native Compute Foundation (CNCF) project. Kubernetes has been widely adopted by the community, supported on all major public and private cloud providers, and is gaining rapid adoption in enterprises. However, Kubernetes may seem intimidating and complex ...
"Outscale was founded in 2010, is based in France, is a strategic partner to Dassault Systémes and has done quite a bit of work with divisions of Dassault," explained Jackie Funk, Digital Marketing exec at Outscale, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"DivvyCloud as a company set out to help customers automate solutions to the most common cloud problems," noted Jeremy Snyder, VP of Business Development at DivvyCloud, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We focus on SAP workloads because they are among the most powerful but somewhat challenging workloads out there to take into public cloud," explained Swen Conrad, CEO of Ocean9, Inc., in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We are still a relatively small software house and we are focusing on certain industries like FinTech, med tech, energy and utilities. We help our customers with their digital transformation," noted Piotr Stawinski, Founder and CEO of EARP Integration, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"I think DevOps is now a rambunctious teenager – it’s starting to get a mind of its own, wanting to get its own things but it still needs some adult supervision," explained Thomas Hooker, VP of marketing at CollabNet, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We've been engaging with a lot of customers including Panasonic, we've been involved with Cisco and now we're working with the U.S. government - the Department of Homeland Security," explained Peter Jung, Chief Product Officer at Pulzze Systems, in this SYS-CON.tv interview at @ThingsExpo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We're here to tell the world about our cloud-scale infrastructure that we have at Juniper combined with the world-class security that we put into the cloud," explained Lisa Guess, VP of Systems Engineering at Juniper Networks, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Your homes and cars can be automated and self-serviced. Why can't your storage? From simply asking questions to analyze and troubleshoot your infrastructure, to provisioning storage with snapshots, recovery and replication, your wildest sci-fi dream has come true. In his session at @DevOpsSummit at 20th Cloud Expo, Dan Florea, Director of Product Management at Tintri, provided a ChatOps demo where you can talk to your storage and manage it from anywhere, through Slack and similar services with...
"We were founded in 2003 and the way we were founded was about good backup and good disaster recovery for our clients, and for the last 20 years we've been pretty consistent with that," noted Marc Malafronte, Territory Manager at StorageCraft, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.