Welcome!

@CloudExpo Authors: Liz McMillan, Pat Romanski, Flint Brenton, Elizabeth White, Cameron Van Orman

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog

@CloudExpo: Article

The Role of Trusted Infrastructure in Application Deployment

Users need to treat trust as an operating cost of the cloud

While there is much talk about how to secure data and systems in cloud computing, many gaps remain in implementing such security. As users of any physical security systems can attest, it just takes one unsecured door or window to provide easy access to an intruder and loss of valued property. Of course with data in the cloud, the situation is much worse. Cloud users can have their data stolen by more than one intruder. And, the cost of a security breach can easily run into the millions of dollars range - far more than most thieves could steal in hardware.

The root problem of cloud security is caused by users' inability to verify directly the trusted computing base. In the cloud, users have the choice of either verifying to establish trust prior to implementing cloud services or simply trust to begin with and then hope for the best. The latter approach is not recommended. The recommended process of initial verification involves standards, technology and certification. Deeper verification involves the use of integrity measurement and remote attestation of the components of the cloud computing base.

Using legacy applications in the shared IT environment of cloud computing requires replacing physical with virtual boundaries. This is the infrastructure consolidation challenge for cloud users and providers. Today, most of the products and existing standards address specific devices or functionality within the overall end to end process. While many standards and products contribute to the ability to solve various portions of the problem, no comprehensive framework exists to describe the needs of various businesses and validate the compliance of the entire solution. As applications migrate into the cloud and the service-oriented components of composite applications are hosted on infrastructure that is shared with other tenants and potentially provided by multiple providers, it is critical to the integrity of the overall composite application to establish a trust domain that describes a coherent policy for the infrastructure services that become part of the application domain.

Trusted Computing Group (TCG) experts have determined that in a Trusted Multi-Tenant Infrastructure (TMI), potential users are looking for protection of processing and information in motion and at rest, as well as the ability to share physical platforms among tenant domain components or shared services. In addition, users want visibility and auditability of actions across the enterprise. This imposes a few constraints on the solution.

Among the constraints is the ability to manage physical resources independently of domain resources as well as the ability to run legacy workload unmodified within a secure context. This also requires the ability to control the flow of information between tenant domains within policy constraints. A further implication is a loosely coupled architecture that can be managed using the application of appropriate policy and trust considerations. In addition, it requires the ability to address various security models to protect the integrity and confidentiality of services and data exchanges within the enterprise.

Closing Security Gaps
Today, the classic approach to deploying SOA application services involves separate infrastructure for each component or client. This approach makes end-to-end visibility, security and management very difficult. Existing solutions also increase space, power usage and cooling requirements. In contrast, the target multi-tenant solution supports more efficient use of space, power and hardware, as well as a consistent security and management policy across shared infrastructure and providers.

The trusted multi-tenant solution is being developed by the Trusted Computing Group (TCG), which consists of member companies from over 100 key technology providers of hardware, software and services as well as several security conscious users. TCG has developed several specifications to establish and improve trust within organizations. The initial specification defined a Trusted Platform Module or TPM - a hardware root of trust for the computing platform. Today, TPM 1.2 is an ISO standard.

The TPM is security hardware that is resident on the motherboard. Based on open specifications from TCG, the TPM resists tampering and software attacks. It is an integral part of almost all enterprise PCs but it is off by default, requiring users to opt in. It features secure key storage cryptographic functions and integrity checking and remote attestation. As a result, the TPM is used for strong user and the machine authentication, secure storage and for trusted/secure boot.

TCG specifications also define a chain of trust architecture that enables attestation of trusted platform properties. Figure 1 shows a visual example of the various TCG standards that have been established for trusted systems. One missing element, especially relevant for cloud computing, is the reference model that brings these existing standards together.

Figure 1: Trusted Computing Group Standards address key data security issues within small to large enterprises.

To address the missing piece and close the gap, TCG is describing the overall framework for integrated Trusted Multi-Tenant Infrastructure solutions. Its Trusted Multi-Tenant Infrastructure (TMI) solution-oriented work group (WG) is focused on the business or mission outcomes using the output of TCG's technical work groups. The intent is to produce a logical reference model consisting of components interfaces, use cases, standards alignment and gaps as well as compliance validation. This open model will be used by TMI WG industry experts as a framework for building secure enterprise solutions.

In addition to identifying and addressing gaps in existing standards, the TMI work group's objectives include developing a standards framework for implementing shared infrastructures and multi-provider infrastructures as well as developing reference models and implementation guidance.

As part of its somewhat different approach to standards, the TMI WG focuses on a new class of membership including IT product vendors and integrators. The goal of this committee's efforts is an IT solution based on multi-tenant shared infrastructure that establishes trustworthiness in the provider of the IT services. Additionally, the solution will address establishing and monitoring compliance of the changing IT policies as well as accessing and monitoring compliance across policy and performance objectives - all in a multi-sourced, multi-supplier ecosystem.

Use Cases within the TMI Architecture
The use cases that have been developed for the TMI reference architecture are based on a small set of core primitive capabilities. The first core function establishes a trusted context for interaction across the multi-tenant domain by aligning the Public Key Infrastructure (PKIv3) security architecture and the TPM. This function allows the establishment of a level of trust including identity of the components in a solution, integrity measurement and compliance attestations that support the degree and type of information to be accepted between parties. The second core function requires exchanging information within the established trusted context. The trusted context provides the ability to ensure that the information is exchanged between parties within the boundaries of the trusted relationship.

Finally, the third core function requires definition and application of consistent policy governing the state, configuration, interaction and management of components within the TMI.

In a broad sense, the TMI WG is defining use cases using the vocabulary associated with the core primitive functions. This will allow transmitting information from a confidential source to a recipient in another tenant domain with the assurance of the ability to trust that the information is reliable. Also, it will allow users and providers to determine if workload from a tenant domain can be provisioned to an external cloud provider in accordance with the policies of both provider and the consumer of services.

Figure 2 shows an example of a generic use case from TCG Trusted Multi-Tenant Infrastructure Use Cases Version 1.0. The use case identifies the relationship between the various components involved in the provisioning of a Peripheral Device in a provider's environment while maintaining compliance with the published policies of the Trusted Systems Domain.

Figure 2. A generic use case identifies how to provision a peripheral device within the Trusted Systems Domain.

With the use cases established, the next step involves deriving a reference model. A logical view of the TMI reference architecture is shown in Figure 3. In this figure, the User Access Device (UAD) supports connecting to one or more concurrent domains. Servers indicate a federated data center of servers that can host multiple independent domains. Exchange represents logical components both physical and virtual that define cross domain information flow rules. Storage is also federated and the network represents devices that can transfer data from multiple domains.

Figure 3: The logical view of the TMI reference architecture shows the separation of the consumers in various cloud aspects.

The management view of the TMI reference model framework shows that both consumers and providers have management responsibilities within the TMI. Specifically, the consumer manages his policy and resources allocated within his domain. In contrast, the provider manages resource allocation to the consumers as well as the platform. A consumer has no direct control over the underlying platform and the provider has no insight into the information and processing within the resources allocated to the consumer. In addition, the provider establishes trust relationships with other providers and consumers to enable migration, bursting and interaction between tenant consumers. Figure 4 shows these relationships.

Figure 4: The management view of the TMI reference architecture shows the consumer and provider management responsibilities within the TMI.

A New Paradigm for Trusted Applications
A company that wants to add cloud resources to its existing resources without compromising security usually has several specific requirements. To proceed without compromising security, a company needs a means to interrogate the infrastructure and obtain answers that have a level of integrity to determine that the responses are true. The information exchange involves the platform information, assured compliance to agreed policies and measurement of platform state.

With the TMI solution, patterns are brought together to establish a trust relationship with a potential provider and then overlaid with the three core functions identified previously. This provides the process to have a policy discussion and establish a trust domain. The set of policies that need to be enforced are established through the use cases.  Using this approach, a user can interview potential suppliers and verify which ones are willing to provide resources that are compliant with the organization's policies. With these security policies in place, the user can be confident that the cloud security is essentially the same as the security within that organization.

Building upon the concepts the TMI reference model describes a set of requirements and implementation patterns that can be used to construct solutions. A requirement is mapped to a set of patterns that describe a number of ways that the requirement can be met. Each pattern is then mapped to industry standards and practices that can then be mapped to products that implement the standards. This mapping allows architects to construct valid solutions within a shared infrastructure cloud.

For example, a consumer of cloud services may determine a need for virtual machines to host components of a service-oriented application. Certain of the services must run on dedicated hardware, others can share hardware, but must be located in a specific geography and others may be shared only if strong separation is enforced by the hypervisor. The hardware must be able to prove that it has not been compromised by malware through attestation of a trusted boot and integrity measurement of key modules within the bios, hypervisor and OS. The application runtime environment must be at a certain patch level. These policies are sent to the environment provider, who returns signed attestations of compliance within the trusted context established between the provider and consumer. The consumer then determines that the application components can be provisioned on the resources and devices for which the provider has attested policy compliance. The consumer may choose to re-validate compliance at various times to ensure nothing has changed.

While not yet a part of the TMI reference model, there is no reason why the same process could not be applied to application components using code signing and attestation of integrity measurement of running application services.

The value of using a trusted infrastructure for service-oriented application deployment should be clear. Even the best written applications can be compromised if the platform can be intercepted maliciously or the content of memory or storage changed. If an application can validate the integrity of the platform upon which the code is executing, then it becomes a less difficult decision to use shared resources or cloud hosting to deploy and scale the application. Combine this with trusted coding and application integrity measurement and the decision process for a consumer to entrust their data to a cloud based application becomes easier.

Looking at Trust Differently than in the Past
According to Ponemon Institutes' Cost of a Data Breach 2010 study, the average cost of a data breach is about $3.44 million and ranges from $1.83 to $6.75 million in different regions of the world.  Enterprises must consider the cost of protecting business data, whether in the internal data center or the cloud just like the cost of higher security door locks or hiring security staff.

Instead of considering trust as an afterthought, users need to treat trust as an operating cost of the cloud. Standards are one way of minimizing this cost. While a trusted secure cloud may not be the lowest initial cost option, in the long run, the risk of exposure must be balanced against the compromise of the information that a user puts into the cloud. TCG's Trusted Multi-Tenant Infrastructure WG has made significant progress towards providing the industry with a standard for IT managers.

The TMI solution working group encourages vendors and end-user organizations to get involved in defining the requirements for the TMI specification.

More Stories By Michael Donovan

Michael Donovan is the Chief Technologist for Strategic Capabilities with HP Enterprise Services, responsible for framework implementation to support capabilities and offering development for clients across the U.S. Public Sector. His responsibilities include harvesting existing solutions for re-use and developing new capabilities to meet the complex needs of federal, state and local governments, leveraging the best of our current account and corporate capabilities and those supported by our partner ecosystem and HP Labs. He also co-chairs the Trusted Multi-Tenant Infrastructure Work Group of the Trusted Computing Group.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@CloudExpo Stories
Join IBM November 1 at 21st Cloud Expo at the Santa Clara Convention Center in Santa Clara, CA, and learn how IBM Watson can bring cognitive services and AI to intelligent, unmanned systems. Cognitive analysis impacts today’s systems with unparalleled ability that were previously available only to manned, back-end operations. Thanks to cloud processing, IBM Watson can bring cognitive services and AI to intelligent, unmanned systems. Imagine a robot vacuum that becomes your personal assistant th...
SYS-CON Events announced today that B2Cloud will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. B2Cloud specializes in IoT devices for preventive and predictive maintenance in any kind of equipment retrieving data like Energy consumption, working time, temperature, humidity, pressure, etc.
Today traditional IT approaches leverage well-architected compute/networking domains to control what applications can access what data, and how. DevOps includes rapid application development/deployment leveraging concepts like containerization, third-party sourced applications and databases. Such applications need access to production data for its test and iteration cycles. Data Security? That sounds like a roadblock to DevOps vs. protecting the crown jewels to those in IT.
SYS-CON Events announced today that Cedexis will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Cedexis is the leader in data-driven enterprise global traffic management. Whether optimizing traffic through datacenters, clouds, CDNs, or any combination, Cedexis solutions drive quality and cost-effectiveness.
Many companies start their journey to the cloud in the DevOps environment, where software engineers want self-service access to the custom tools and frameworks they need. Machine learning technology can help IT departments keep up with these demands. In his session at 21st Cloud Expo, Ajay Gulati, Co-Founder, CTO and Board Member at ZeroStack, will discuss the use of machine learning for automating provisioning of DevOps resources, taking the burden off IT teams.
SYS-CON Events announced today that NetApp has been named “Bronze Sponsor” of SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. NetApp is the data authority for hybrid cloud. NetApp provides a full range of hybrid cloud data services that simplify management of applications and data across cloud and on-premises environments to accelerate digital transformation. Together with their partners, NetApp em...
Is advanced scheduling in Kubernetes achievable? Yes, however, how do you properly accommodate every real-life scenario that a Kubernetes user might encounter? How do you leverage advanced scheduling techniques to shape and describe each scenario in easy-to-use rules and configurations? In his session at @DevOpsSummit at 21st Cloud Expo, Oleg Chunikhin, CTO at Kublr, will answer these questions and demonstrate techniques for implementing advanced scheduling. For example, using spot instances ...
Why Federal cloud? What is in Federal Clouds and integrations? This session will identify the process and the FedRAMP initiative. But is it sufficient? What is the remedy for keeping abreast of cutting-edge technology? In his session at 21st Cloud Expo, Rasananda Behera will examine the proposed solutions: Private or public or hybrid cloud Responsible governing bodies How can we accomplish?
SYS-CON Events announced today that Ryobi Systems will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Ryobi Systems Co., Ltd., as an information service company, specialized in business support for local governments and medical industry. We are challenging to achive the precision farming with AI. For more information, visit http:...
Cloud-based disaster recovery is critical to any production environment and is a high priority for many enterprise organizations today. Nearly 40% of organizations have had to execute their BCDR plan due to a service disruption in the past two years. Zerto on IBM Cloud offer VMware and Microsoft customers simple, automated recovery of on-premise VMware and Microsoft workloads to IBM Cloud data centers.
SYS-CON Events announced today that mruby Forum will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. mruby is the lightweight implementation of the Ruby language. We introduce mruby and the mruby IoT framework that enhances development productivity. For more information, visit http://forum.mruby.org/.
Cloud applications are seeing a deluge of requests to support the exploding advanced analytics market. “Open analytics” is the emerging strategy to deliver that data through an open data access layer, in the cloud, to be directly consumed by external analytics tools and popular programming languages. An increasing number of data engineers and data scientists use a variety of platforms and advanced analytics languages such as SAS, R, Python and Java, as well as frameworks such as Hadoop and Spark...
SYS-CON Events announced today that Mobile Create USA will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Mobile Create USA Inc. is an MVNO-based business model that uses portable communication devices and cellular-based infrastructure in the development, sales, operation and mobile communications systems incorporating GPS capabi...
SYS-CON Events announced today that Enroute Lab will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Enroute Lab is an industrial design, research and development company of unmanned robotic vehicle system. For more information, please visit http://elab.co.jp/.
SYS-CON Events announced today that Nihon Micron will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Nihon Micron Co., Ltd. strives for technological innovation to establish high-density, high-precision processing technology for providing printed circuit board and metal mount RFID tags used for communication devices. For more inf...
SYS-CON Events announced today that Suzuki Inc. will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Suzuki Inc. is a semiconductor-related business, including sales of consuming parts, parts repair, and maintenance for semiconductor manufacturing machines, etc. It is also a health care business providing experimental research for...
IBM helps FinTechs and financial services companies build and monetize cognitive-enabled financial services apps quickly and at scale. Hosted on IBM Bluemix, IBM’s platform builds in customer insights, regulatory compliance analytics and security to help reduce development time and testing. In his session at 21st Cloud Expo, Lennart Frantzell, a Developer Advocate with IBM, will discuss how these tools simplify the time-consuming tasks of selection, mapping and data integration, allowing devel...
SYS-CON Events announced today that N3N will exhibit at SYS-CON's @ThingsExpo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. N3N’s solutions increase the effectiveness of operations and control centers, increase the value of IoT investments, and facilitate real-time operational decision making. N3N enables operations teams with a four dimensional digital “big board” that consolidates real-time live video feeds alongside IoT sensor data a...
Mobile device usage has increased exponentially during the past several years, as consumers rely on handhelds for everything from news and weather to banking and purchases. What can we expect in the next few years? The way in which we interact with our devices will fundamentally change, as businesses leverage Artificial Intelligence. We already see this taking shape as businesses leverage AI for cost savings and customer responsiveness. This trend will continue, as AI is used for more sophistica...
Today most companies are adopting or evaluating container technology - Docker in particular - to speed up application deployment, drive down cost, ease management and make application delivery more flexible overall. As with most new architectures, this dream takes significant work to become a reality. Even when you do get your application componentized enough and packaged properly, there are still challenges for DevOps teams to making the shift to continuous delivery and achieving that reducti...