Welcome!

@CloudExpo Authors: Dalibor Siroky, Kevin Jackson, Xenia von Wedel, Destiny Bertucci, Elizabeth White

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog

@CloudExpo: Article

The Role of Trusted Infrastructure in Application Deployment

Users need to treat trust as an operating cost of the cloud

While there is much talk about how to secure data and systems in cloud computing, many gaps remain in implementing such security. As users of any physical security systems can attest, it just takes one unsecured door or window to provide easy access to an intruder and loss of valued property. Of course with data in the cloud, the situation is much worse. Cloud users can have their data stolen by more than one intruder. And, the cost of a security breach can easily run into the millions of dollars range - far more than most thieves could steal in hardware.

The root problem of cloud security is caused by users' inability to verify directly the trusted computing base. In the cloud, users have the choice of either verifying to establish trust prior to implementing cloud services or simply trust to begin with and then hope for the best. The latter approach is not recommended. The recommended process of initial verification involves standards, technology and certification. Deeper verification involves the use of integrity measurement and remote attestation of the components of the cloud computing base.

Using legacy applications in the shared IT environment of cloud computing requires replacing physical with virtual boundaries. This is the infrastructure consolidation challenge for cloud users and providers. Today, most of the products and existing standards address specific devices or functionality within the overall end to end process. While many standards and products contribute to the ability to solve various portions of the problem, no comprehensive framework exists to describe the needs of various businesses and validate the compliance of the entire solution. As applications migrate into the cloud and the service-oriented components of composite applications are hosted on infrastructure that is shared with other tenants and potentially provided by multiple providers, it is critical to the integrity of the overall composite application to establish a trust domain that describes a coherent policy for the infrastructure services that become part of the application domain.

Trusted Computing Group (TCG) experts have determined that in a Trusted Multi-Tenant Infrastructure (TMI), potential users are looking for protection of processing and information in motion and at rest, as well as the ability to share physical platforms among tenant domain components or shared services. In addition, users want visibility and auditability of actions across the enterprise. This imposes a few constraints on the solution.

Among the constraints is the ability to manage physical resources independently of domain resources as well as the ability to run legacy workload unmodified within a secure context. This also requires the ability to control the flow of information between tenant domains within policy constraints. A further implication is a loosely coupled architecture that can be managed using the application of appropriate policy and trust considerations. In addition, it requires the ability to address various security models to protect the integrity and confidentiality of services and data exchanges within the enterprise.

Closing Security Gaps
Today, the classic approach to deploying SOA application services involves separate infrastructure for each component or client. This approach makes end-to-end visibility, security and management very difficult. Existing solutions also increase space, power usage and cooling requirements. In contrast, the target multi-tenant solution supports more efficient use of space, power and hardware, as well as a consistent security and management policy across shared infrastructure and providers.

The trusted multi-tenant solution is being developed by the Trusted Computing Group (TCG), which consists of member companies from over 100 key technology providers of hardware, software and services as well as several security conscious users. TCG has developed several specifications to establish and improve trust within organizations. The initial specification defined a Trusted Platform Module or TPM - a hardware root of trust for the computing platform. Today, TPM 1.2 is an ISO standard.

The TPM is security hardware that is resident on the motherboard. Based on open specifications from TCG, the TPM resists tampering and software attacks. It is an integral part of almost all enterprise PCs but it is off by default, requiring users to opt in. It features secure key storage cryptographic functions and integrity checking and remote attestation. As a result, the TPM is used for strong user and the machine authentication, secure storage and for trusted/secure boot.

TCG specifications also define a chain of trust architecture that enables attestation of trusted platform properties. Figure 1 shows a visual example of the various TCG standards that have been established for trusted systems. One missing element, especially relevant for cloud computing, is the reference model that brings these existing standards together.

Figure 1: Trusted Computing Group Standards address key data security issues within small to large enterprises.

To address the missing piece and close the gap, TCG is describing the overall framework for integrated Trusted Multi-Tenant Infrastructure solutions. Its Trusted Multi-Tenant Infrastructure (TMI) solution-oriented work group (WG) is focused on the business or mission outcomes using the output of TCG's technical work groups. The intent is to produce a logical reference model consisting of components interfaces, use cases, standards alignment and gaps as well as compliance validation. This open model will be used by TMI WG industry experts as a framework for building secure enterprise solutions.

In addition to identifying and addressing gaps in existing standards, the TMI work group's objectives include developing a standards framework for implementing shared infrastructures and multi-provider infrastructures as well as developing reference models and implementation guidance.

As part of its somewhat different approach to standards, the TMI WG focuses on a new class of membership including IT product vendors and integrators. The goal of this committee's efforts is an IT solution based on multi-tenant shared infrastructure that establishes trustworthiness in the provider of the IT services. Additionally, the solution will address establishing and monitoring compliance of the changing IT policies as well as accessing and monitoring compliance across policy and performance objectives - all in a multi-sourced, multi-supplier ecosystem.

Use Cases within the TMI Architecture
The use cases that have been developed for the TMI reference architecture are based on a small set of core primitive capabilities. The first core function establishes a trusted context for interaction across the multi-tenant domain by aligning the Public Key Infrastructure (PKIv3) security architecture and the TPM. This function allows the establishment of a level of trust including identity of the components in a solution, integrity measurement and compliance attestations that support the degree and type of information to be accepted between parties. The second core function requires exchanging information within the established trusted context. The trusted context provides the ability to ensure that the information is exchanged between parties within the boundaries of the trusted relationship.

Finally, the third core function requires definition and application of consistent policy governing the state, configuration, interaction and management of components within the TMI.

In a broad sense, the TMI WG is defining use cases using the vocabulary associated with the core primitive functions. This will allow transmitting information from a confidential source to a recipient in another tenant domain with the assurance of the ability to trust that the information is reliable. Also, it will allow users and providers to determine if workload from a tenant domain can be provisioned to an external cloud provider in accordance with the policies of both provider and the consumer of services.

Figure 2 shows an example of a generic use case from TCG Trusted Multi-Tenant Infrastructure Use Cases Version 1.0. The use case identifies the relationship between the various components involved in the provisioning of a Peripheral Device in a provider's environment while maintaining compliance with the published policies of the Trusted Systems Domain.

Figure 2. A generic use case identifies how to provision a peripheral device within the Trusted Systems Domain.

With the use cases established, the next step involves deriving a reference model. A logical view of the TMI reference architecture is shown in Figure 3. In this figure, the User Access Device (UAD) supports connecting to one or more concurrent domains. Servers indicate a federated data center of servers that can host multiple independent domains. Exchange represents logical components both physical and virtual that define cross domain information flow rules. Storage is also federated and the network represents devices that can transfer data from multiple domains.

Figure 3: The logical view of the TMI reference architecture shows the separation of the consumers in various cloud aspects.

The management view of the TMI reference model framework shows that both consumers and providers have management responsibilities within the TMI. Specifically, the consumer manages his policy and resources allocated within his domain. In contrast, the provider manages resource allocation to the consumers as well as the platform. A consumer has no direct control over the underlying platform and the provider has no insight into the information and processing within the resources allocated to the consumer. In addition, the provider establishes trust relationships with other providers and consumers to enable migration, bursting and interaction between tenant consumers. Figure 4 shows these relationships.

Figure 4: The management view of the TMI reference architecture shows the consumer and provider management responsibilities within the TMI.

A New Paradigm for Trusted Applications
A company that wants to add cloud resources to its existing resources without compromising security usually has several specific requirements. To proceed without compromising security, a company needs a means to interrogate the infrastructure and obtain answers that have a level of integrity to determine that the responses are true. The information exchange involves the platform information, assured compliance to agreed policies and measurement of platform state.

With the TMI solution, patterns are brought together to establish a trust relationship with a potential provider and then overlaid with the three core functions identified previously. This provides the process to have a policy discussion and establish a trust domain. The set of policies that need to be enforced are established through the use cases.  Using this approach, a user can interview potential suppliers and verify which ones are willing to provide resources that are compliant with the organization's policies. With these security policies in place, the user can be confident that the cloud security is essentially the same as the security within that organization.

Building upon the concepts the TMI reference model describes a set of requirements and implementation patterns that can be used to construct solutions. A requirement is mapped to a set of patterns that describe a number of ways that the requirement can be met. Each pattern is then mapped to industry standards and practices that can then be mapped to products that implement the standards. This mapping allows architects to construct valid solutions within a shared infrastructure cloud.

For example, a consumer of cloud services may determine a need for virtual machines to host components of a service-oriented application. Certain of the services must run on dedicated hardware, others can share hardware, but must be located in a specific geography and others may be shared only if strong separation is enforced by the hypervisor. The hardware must be able to prove that it has not been compromised by malware through attestation of a trusted boot and integrity measurement of key modules within the bios, hypervisor and OS. The application runtime environment must be at a certain patch level. These policies are sent to the environment provider, who returns signed attestations of compliance within the trusted context established between the provider and consumer. The consumer then determines that the application components can be provisioned on the resources and devices for which the provider has attested policy compliance. The consumer may choose to re-validate compliance at various times to ensure nothing has changed.

While not yet a part of the TMI reference model, there is no reason why the same process could not be applied to application components using code signing and attestation of integrity measurement of running application services.

The value of using a trusted infrastructure for service-oriented application deployment should be clear. Even the best written applications can be compromised if the platform can be intercepted maliciously or the content of memory or storage changed. If an application can validate the integrity of the platform upon which the code is executing, then it becomes a less difficult decision to use shared resources or cloud hosting to deploy and scale the application. Combine this with trusted coding and application integrity measurement and the decision process for a consumer to entrust their data to a cloud based application becomes easier.

Looking at Trust Differently than in the Past
According to Ponemon Institutes' Cost of a Data Breach 2010 study, the average cost of a data breach is about $3.44 million and ranges from $1.83 to $6.75 million in different regions of the world.  Enterprises must consider the cost of protecting business data, whether in the internal data center or the cloud just like the cost of higher security door locks or hiring security staff.

Instead of considering trust as an afterthought, users need to treat trust as an operating cost of the cloud. Standards are one way of minimizing this cost. While a trusted secure cloud may not be the lowest initial cost option, in the long run, the risk of exposure must be balanced against the compromise of the information that a user puts into the cloud. TCG's Trusted Multi-Tenant Infrastructure WG has made significant progress towards providing the industry with a standard for IT managers.

The TMI solution working group encourages vendors and end-user organizations to get involved in defining the requirements for the TMI specification.

More Stories By Michael Donovan

Michael Donovan is the Chief Technologist for Strategic Capabilities with HP Enterprise Services, responsible for framework implementation to support capabilities and offering development for clients across the U.S. Public Sector. His responsibilities include harvesting existing solutions for re-use and developing new capabilities to meet the complex needs of federal, state and local governments, leveraging the best of our current account and corporate capabilities and those supported by our partner ecosystem and HP Labs. He also co-chairs the Trusted Multi-Tenant Infrastructure Work Group of the Trusted Computing Group.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@CloudExpo Stories
"Storpool does only block-level storage so we do one thing extremely well. The growth in data is what drives the move to software-defined technologies in general and software-defined storage," explained Boyan Ivanov, CEO and co-founder at StorPool, in this SYS-CON.tv interview at 16th Cloud Expo, held June 9-11, 2015, at the Javits Center in New York City.
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
As DevOps methodologies expand their reach across the enterprise, organizations face the daunting challenge of adapting related cloud strategies to ensure optimal alignment, from managing complexity to ensuring proper governance. How can culture, automation, legacy apps and even budget be reexamined to enable this ongoing shift within the modern software factory? In her Day 2 Keynote at @DevOpsSummit at 21st Cloud Expo, Aruna Ravichandran, VP, DevOps Solutions Marketing, CA Technologies, was jo...
As Marc Andreessen says software is eating the world. Everything is rapidly moving toward being software-defined – from our phones and cars through our washing machines to the datacenter. However, there are larger challenges when implementing software defined on a larger scale - when building software defined infrastructure. In his session at 16th Cloud Expo, Boyan Ivanov, CEO of StorPool, provided some practical insights on what, how and why when implementing "software-defined" in the datacent...
Blockchain. A day doesn’t seem to go by without seeing articles and discussions about the technology. According to PwC executive Seamus Cushley, approximately $1.4B has been invested in blockchain just last year. In Gartner’s recent hype cycle for emerging technologies, blockchain is approaching the peak. It is considered by Gartner as one of the ‘Key platform-enabling technologies to track.’ While there is a lot of ‘hype vs reality’ discussions going on, there is no arguing that blockchain is b...
Blockchain is a shared, secure record of exchange that establishes trust, accountability and transparency across business networks. Supported by the Linux Foundation's open source, open-standards based Hyperledger Project, Blockchain has the potential to improve regulatory compliance, reduce cost as well as advance trade. Are you curious about how Blockchain is built for business? In her session at 21st Cloud Expo, René Bostic, Technical VP of the IBM Cloud Unit in North America, discussed the b...
You know you need the cloud, but you’re hesitant to simply dump everything at Amazon since you know that not all workloads are suitable for cloud. You know that you want the kind of ease of use and scalability that you get with public cloud, but your applications are architected in a way that makes the public cloud a non-starter. You’re looking at private cloud solutions based on hyperconverged infrastructure, but you’re concerned with the limits inherent in those technologies.
Is advanced scheduling in Kubernetes achievable?Yes, however, how do you properly accommodate every real-life scenario that a Kubernetes user might encounter? How do you leverage advanced scheduling techniques to shape and describe each scenario in easy-to-use rules and configurations? In his session at @DevOpsSummit at 21st Cloud Expo, Oleg Chunikhin, CTO at Kublr, answered these questions and demonstrated techniques for implementing advanced scheduling. For example, using spot instances and co...
The cloud era has reached the stage where it is no longer a question of whether a company should migrate, but when. Enterprises have embraced the outsourcing of where their various applications are stored and who manages them, saving significant investment along the way. Plus, the cloud has become a defining competitive edge. Companies that fail to successfully adapt risk failure. The media, of course, continues to extol the virtues of the cloud, including how easy it is to get there. Migrating...
The use of containers by developers -- and now increasingly IT operators -- has grown from infatuation to deep and abiding love. But as with any long-term affair, the honeymoon soon leads to needing to live well together ... and maybe even getting some relationship help along the way. And so it goes with container orchestration and automation solutions, which are rapidly emerging as the means to maintain the bliss between rapid container adoption and broad container use among multiple cloud host...
Imagine if you will, a retail floor so densely packed with sensors that they can pick up the movements of insects scurrying across a store aisle. Or a component of a piece of factory equipment so well-instrumented that its digital twin provides resolution down to the micrometer.
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settle...
The need for greater agility and scalability necessitated the digital transformation in the form of following equation: monolithic to microservices to serverless architecture (FaaS). To keep up with the cut-throat competition, the organisations need to update their technology stack to make software development their differentiating factor. Thus microservices architecture emerged as a potential method to provide development teams with greater flexibility and other advantages, such as the abili...
Product connectivity goes hand and hand these days with increased use of personal data. New IoT devices are becoming more personalized than ever before. In his session at 22nd Cloud Expo | DXWorld Expo, Nicolas Fierro, CEO of MIMIR Blockchain Solutions, will discuss how in order to protect your data and privacy, IoT applications need to embrace Blockchain technology for a new level of product security never before seen - or needed.
Leading companies, from the Global Fortune 500 to the smallest companies, are adopting hybrid cloud as the path to business advantage. Hybrid cloud depends on cloud services and on-premises infrastructure working in unison. Successful implementations require new levels of data mobility, enabled by an automated and seamless flow across on-premises and cloud resources. In his general session at 21st Cloud Expo, Greg Tevis, an IBM Storage Software Technical Strategist and Customer Solution Architec...
Nordstrom is transforming the way that they do business and the cloud is the key to enabling speed and hyper personalized customer experiences. In his session at 21st Cloud Expo, Ken Schow, VP of Engineering at Nordstrom, discussed some of the key learnings and common pitfalls of large enterprises moving to the cloud. This includes strategies around choosing a cloud provider(s), architecture, and lessons learned. In addition, he covered some of the best practices for structured team migration an...
In his general session at 21st Cloud Expo, Greg Dumas, Calligo’s Vice President and G.M. of US operations, discussed the new Global Data Protection Regulation and how Calligo can help business stay compliant in digitally globalized world. Greg Dumas is Calligo's Vice President and G.M. of US operations. Calligo is an established service provider that provides an innovative platform for trusted cloud solutions. Calligo’s customers are typically most concerned about GDPR compliance, application p...
Coca-Cola’s Google powered digital signage system lays the groundwork for a more valuable connection between Coke and its customers. Digital signs pair software with high-resolution displays so that a message can be changed instantly based on what the operator wants to communicate or sell. In their Day 3 Keynote at 21st Cloud Expo, Greg Chambers, Global Group Director, Digital Innovation, Coca-Cola, and Vidya Nagarajan, a Senior Product Manager at Google, discussed how from store operations and ...
In his session at 21st Cloud Expo, Raju Shreewastava, founder of Big Data Trunk, provided a fun and simple way to introduce Machine Leaning to anyone and everyone. He solved a machine learning problem and demonstrated an easy way to be able to do machine learning without even coding. Raju Shreewastava is the founder of Big Data Trunk (www.BigDataTrunk.com), a Big Data Training and consulting firm with offices in the United States. He previously led the data warehouse/business intelligence and B...
"IBM is really all in on blockchain. We take a look at sort of the history of blockchain ledger technologies. It started out with bitcoin, Ethereum, and IBM evaluated these particular blockchain technologies and found they were anonymous and permissionless and that many companies were looking for permissioned blockchain," stated René Bostic, Technical VP of the IBM Cloud Unit in North America, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventi...