CTS2014 Tutorial:

Cloud Based Federated Infrastructure for Big Data eScience and Collaboration(European focus and examples)

Yuri Demchenko
System and Network Engineering, University of Amsterdam
CTS2014 Conference
19-23 May 2014, Minneapolis, USA
CTS2014 Tutorial

Cloud Federation for e-Science1Outline• e-Science and Big Data challenges– The 4th Paradigm, Big Data and long-tale science– European Research Areas (ERA) and projects• Collaboration and information sharing• e-Science and Research Infrastructures as a basis for wide collaborationin science– EU-Brazil Cloud Connect Project and use cases– European Grid Infrastructure: EGI Federated Cloud Infrastructure– GEANT European Research and Education Network• Scientific Data Infrastructure for Big Data
• Federated security models in cloud– Legacy Virtual Organisations (VO) based federated access control
infrastructure– Generic Federated Access Control and Identity Management in cloud• Implementation in the GEANT Infrastructure• Discussion
http://www.uazone.org/demch/presentations/cts2014tutorial02.pdf
CTS2014 Tutorial

Cloud Federation for e-Science2This week 19-23 May 2014: Conferences andEvents•TERENA Networking Conference TNC2014–•

European Grid Infrastructure (EGI)–•

http://cf2014.egi.eu/

EU-Brazil Cloud Connect Project–•

https://tnc2014.terena.org/

http://www.eubrazilcloudconnect.eu/

GEANT Network for Research and Education in Europe–

http://www.geant.net/MediaCentreEvents/Events/GEAN
T_at_TNC_2014/Pages/Home.aspx

CTS2014 Tutorial

Cloud Federation for e-Science3

Yuri Demchenko – Professional Summary•

Graduated from National Technical University of Ukraine “Kiev Polytechnic
Institute” (KPI) in Instrumentation and Measurement (aka Industry Automation)
–

•
•
•
•

Candidate of Science (Tech) – Dissertation on System Oriented Precision Generators (1989)

Teaching at KPI 1989-1998 – Computer Networking, Internet Technologies,
Security
Professional work in Internet technologies since 1993
Work at TERENA (Trans-European R&E Networking Association) – 1998-2002
Work at UvA with SNE group – since 2003
– Main research areas: Cloud Computing, Big Data Infrastructures, Application andInfrastructure Security, Generic AAA&Authorisation, Grid and collaborative systems– EU Projects: GEYSERS, GEANT3, Phosphorus, EGEE I-II, Collaboratory.nl– Standardisation activity – IETF, Open Grid Forum (OGF) – ISOD-RG chairing, NIST
Cloud Collaboration, NIST Big Data WG, ISO/IEC Big Data Study Group– Now/2014: Big Data Architecture, Big Data Security, Big Data Curriculum development

CTS2014 Tutorial

Cloud Federation for e-Science4

e-Science and Big Data:
Seminal works, High level reports, Initiatives
The Fourth Paradigm: Data-Intensive Scientific Discovery.
By Jim Gray, Microsoft, 2009. Edited by Tony Hey, et al.
http://research.microsoft.com/en-us/collaboration/fourthparadigm/
Riding the wave: How Europe can gain fromthe rising tide of scientific data.
Final report of the High Level Expert Group on
Scientific Data. October 2010.
http://cordis.europa.eu/fp7/ict/einfrastructure/docs/hlg-sdi-report.pdf

https://www.rd-alliance.org/

AAA Study: Study on
AAA Platforms For
Scientificdata/information
Resources in Europe,
TERENA, UvA, LIBER,
UinvDeb.

NIST Big Data Working Group (NBD-WG)
https://www.rd-alliance.org/
CTS2014 Tutorial

Cloud Federation for e-Science

5

The Fourth Paradigm of Scientific Research
1. Theory, hypothesis and logical reasoning
2. Observation or Experiment––E.g. Newton observed apples falling to design his theory ofmechanics
But Gallileo Galilei made experiments with falling objects from thePisa leaning tower

3. Simulation of theory or model–

Digital simulation can prove theory or model

4. Data-driven Scientific Discovery (aka Data Science)– More data beat hypnotized theory– e-Science as computing and Information Technologies empoweredscience

CTS2014 Tutorial

Cloud Federation for e-Science6

Big Data and Data Intensive Science - The
next/current technology focus• Based on e-Science concept and entire information and artifacts
digitising– Requires also new information and semantic models for information
structuring and presentation– Requires new research methods using large data sets and data mining• Methods to evolve and results to be improved• Changes the way how the modern research is done (in e-Science)– Secondary research, data re-focusing, linking data and publications• Big Data requires a new infrastructure to support both distributed data(collection, storage, processing) and metadata/discovery services– High performance network and computing, distributed storage and access– Cloud Computing as a native platform for distributed dynamic virtualised(data supporting) infrastructure– Demand for trusted/trustworthy infrastructure

CTS2014 Tutorial

Cloud Federation for e-Science7

e-Science Features
•

•

•
•
•

•

Automation of all e-Science processes including data collection, storing,classification, indexing and other components of the general data curation andprovenanceTransformation of all processes, events and products into digital form bymeans of multi-dimensional multi-faceted measurements, monitoring andcontrol; digitising existing artifacts and other content
Possibility to re-use the initial and published research data with possible data
re-purposing for secondary research
Global data availability and access over the network for cooperative group of
researchers, including wide public access to scientific data
Existence of necessary infrastructure components and management tools thatallows fast infrastructures and services composition, adaptation andprovisioning on demand for specific research projects and tasks
Advanced security and access control technologies that ensure secure
operation of the complex research infrastructures and scientific instruments andallow creating trusted secure environment for cooperating groups andindividual researchers.

CTS2014 Tutorial

Cloud Federation for e-Science8Modern e-Science in search for new knowledge
as a Big Data technology driver
Scientific experiments and tools are becoming bigger and heavily based ondata processing and mining– 3 V of Big Data challenges for Scientific Data Infrastructure (SDI)• Volume – Terabyte records, transactions, tables, files.
– LHC – 5 PB a month (now is under re-construction)– LOFAR, SKA – 5 PB every hour, requires processing asap to discard noninformative data
– Large Synoptic Survey Telescope (LSST) - 10 Petabytes per year
– Genomic research – x10 TB per individual– Earth, climate and weather data

• Velocity – batch, near-time, real-time, streams.
– LHC ATLAS detector generates about 1 Petabyte raw data per second, during thecollision time about 1 ms

• Variety – structures, unstructured, semi-structured, and all the above in amix
– Biodiversity, Biological and medical, facial research– Human, psychology and behavior research– History, archeology and artifacts

CTS2014 Tutorial

Cloud Federation for e-Science

9

The Long Tail of Science (aka “Dark Data”)• Collectively “Long Tail” science is generating a lot of data
– Estimated as over 1PB per year and it is growing fast with the newtechnology proliferation• 80-20 rule: 20% users generate 80% data but not necessarily 80%
knowledge
Source: Dennis Gannon (Microsoft)
CTS2014 Tutorial

Cloud Federation for e-Science

NIST Big Data Workshop, 201210

European Research Area (ERA) - Coordination•

European Commission – but not only
– Horizon2020 new EU Framework Program 2014-2020 to support Research and Innovation in
Research and Industry•

EIROforum – European Intergovernmental Research Organisation– Profile committees organised by scientific domain•

ESFRI – European Strategy Forum for Research Infrastructure– Coordinates projects and funding for Research Infrastructures (RI)•eIRG – e-Infrastructure Reflection Group– High level policy development for Europe on e-Infrastructure•

EEF - European e-Infrastructure Forum– Principles and practices to create synergies for distributed Infrastructures•

TERENA and DANTE– GEANT high performance European Research and Education Network– REFEDS – Research and Education Federations•

LIBER – Association of European libraries– Growing role of scientific libraries including access to research information• Research Data Alliance (RDA)– Joint initiative by ERA/EC, NSF, NISTCTS2014 Tutorial

Cloud Federation for e-Science11

Big Data Science and European Research Areas (1)• High Energy Physics (HEP)– Running experiment on LHC and infrastructure WLCG (Worldwide LHC
Grid)• Already producing PBytes of information• Worldwide distribution and processing– CERN and national HEP centers• Low Energy Physics and Material Science (photon, proton, laser,
spectrometry)– Number of research facilities serving international communities– Multiple short projects producing TBytes of information• Experimental data storage, identification, trusted access to multiple users(including public and private researchers)• Earth, weather and space observation– Climate research and Earth observation• With new 4? satellites to be launched starting 2017 to produce PBytes monthly– ESA (European Space Agency)

CTS2014 Tutorial

Cloud Federation for e-Science

12

Big Data Science and European Research Areas (2)• Life science and biodiversity (Genomic, Biomedical and Healthcare
research)– Human genome (EMBL-EBI)• Currently centralised databases but evolving to distributed• ELSI data - Special requirements to data integrity and privacy– Living species and biodiversity• Mobile/field access, filtering and on-demand computing• Public contribution, vocational or citizen researchers– Numerous local/offline databases to be brought online– Projects: ENVRI, LifeWatch, ELIXIR, HelixNebula• Humanities (History, languages, human behaviour)– Rediscovering research with total information digitising• Expected huge amount of data to digitise all human heritage– Very spread research community– Projects: CLARIN, DARIAH, EUDAT• Outreach and cooperation with developing research communities– Brazil, China, Africa

CTS2014 Tutorial

Cloud Federation for e-Science

13

Existing and emerging Europe wide SDI• WLCG – Worldwide LHC Grid (CERN, Geneva)• EGI – European Grid Infrastructure (successor of the EGEE project)– Operational Grid infrastructure serving around 10,000 researches worldwide– Published “Seeking new horizons: EGI’s role for 2020”– Federated Cloud Infrastructure provides an infrastructure platform for
operational and legacy Grid services• PRACE – Partnership for Advanced Computing in Europe• HELIX Nebula – The Science Cloud (prospective cloud based SDI for
ERA)– Private Partnership Project with wide industry participation (limited EC/FP7
support)• Growing Research Infrastructures for different research communities– CLARIN, EUDAT, LifeWatch, ELIXIR, etc.
• Less technology and more subject focused

CTS2014 Tutorial

Cloud Federation for e-Science14

Open Access to Scientific Publications• EC initiative on Open Access scientific publications frompublicly funded projects– Included into Declaration from the H2020 Rome meeting (2012)– Approx 3500 publicly funded ROs and 2000 privately funded ROs– Special funding scheme for reimbursing publications– Issues with China, India, Russia compliance to OA principles• Consultation at high governmental level• OpenAIRE project exploring models for open access topublications– PID (Persistent ID for data), ORCHID (Open Researcher ID), Linked
data• Community initiative - Panton Principles for Open Data in
Science (http://pantonprinciples.org/)
CTS2014 Tutorial

Cloud Federation for e-Science15

Persistent Identifier (PID)• PID – Persistent Identifier for Digital Objects– Managed by European PID Consortium (EPIC)
http://www.pidconsortium.eu/– Superset of DOI - Digital Object Identifier (http://www.doi.org/)– Handle System by CNRI (Corporation for National Research
Initiatives) for resolving DOI (http://www.handle.net/)• PID provides a mechanism to link data during the whole
research data transformation cycle– EPIC RESTful Web Service API
published May 2013

CTS2014 Tutorial

Cloud Federation for e-Science

16

ORCID (Open Researcher and Contributor ID)• ORCID is a nonproprietary alphanumeric code to uniquely identify
scientific and other academic authors– Launched October 2012

• ORCID Statistics – May 2014
– Live ORCID IDs 511, 203 (October 2013 - 329,265)– ORCID IDs with at least one work 121,529 (October 2013 - 79,332)– Works 2,205,971– Works with unique DOIs
1,267,083• Personal ORCID– ORCID 0000-0001-7474-9506– http://orcid.org/0000-0001-7474-9506– Scopus Author ID 8904483500

CTS2014 Tutorial

Cloud Federation for e-Science17

Scientific Data Types• Raw data collected from observationand from experiment (according to an
initial research model)
Publicationsand Linked
Data

Published Data
Structured Data
Raw Data

CTS2014 Tutorial• Structured data and datasets that went
through data filtering and processing(supporting some particular formal
model)• Published data that supports one or
another scientific hypothesis, research
result or statement• Data linked to publications to support
the wide research consolidation,
integration, and openness.

Cloud Federation for e-Science18

Scientific Data Types
EC Open Access Initiative
Requires data linking at alllevels and stages

Publicationsand Linked
Data

Published Data
Structured Data
Raw Data

CTS2014 Tutorial• Raw data collected from observationand from experiment (according to an
initial research model)• Structured data and datasets that went
through data filtering and processing(supporting some particular formal
model)• Published data that supports one or
another scientific hypothesis, research
result or statement• Data linked to publications to support
the wide research consolidation,
integration, and openness.

Cloud Federation for e-Science19

Traditional Data Lifecycle Model - I
Traditional Data Lifecycle Model
Project/
Experiment
Planning

Data collection

Data
Integration andprocessing

Publishingresearch
results

Discussion/
feedback

Archivingor
Discarding

User

•
•
•
•
•

Data collection
Data processing
Publishing research results
Discussion
Data and publications
archiving
Lack of initial data preservationand data linking to publications
CTS2014 Tutorial

Cloud Federation for e-Science

20

Data Lifecycle Model in e-Science – II
Data Lifecycle Model in e-Science

User
Researcher

Data discovery

Data Curation(including retirement and clean up)
Data
recycling

Raw Data
Experimental
Data

Project/
Experiment
Planning

Data collection
andfiltering

Structured
Scientific
Data

Data analysis

DB

Data archiving

Data
Re-purpose

Data linkage
to papers

Data sharing/
Data publishing

Data Re-purpose

Data Linkage Issues•
Persistent Identifiers (PID)•
ORCID (Open Researcher andContributor ID)•
Lined Data

CTS2014 Tutorial

End of project

Open
PublicUse

Data Clean up and Retirement•
Ownership and authority•
Data Detainment
Data Links

Cloud Federation for e-ScienceDataarchiving

Metadata &
Mngnt

21

European Research Infrastructure:
Examples and Projects
Scientific
Applications
Cloud/Grid
Infrastructure
Network
Infrastructure•

EU-Brazil Cloud Connect Project– http://www.eubrazilcloudconnect.eu/•

European Grid Infrastructure (EGI)– http://www.egi.eu/•

GEANT Network for Research and
Education in Europe– http://www.geant.net/

CTS2014 Tutorial

Cloud Federation for e-Science22

CTS2014 Tutorial

Cloud Federation for e-Science23

CTS2014 Tutorial

Cloud Federation for e-Science24

CTS2014 Tutorial

Cloud Federation for e-Science25

CTS2014 Tutorial

Cloud Federation for e-Science26

CTS2014 Tutorial

Cloud Federation for e-Science27

CTS2014 Tutorial

Cloud Federation for e-Science28

CTS2014 Tutorial

Cloud Federation for e-Science29

CTS2014 Tutorial

Cloud Federation for e-Science30

EGI Federated Cloud
EGI – European Grid Initiative• Follow up after EGEE project (2004-2010) to createa Grid infrastructure to support LHC experiment in
CERN– Worldwide LHC Grid (WLCG) http://wlcg.web.cern.ch/• Legacy federated resources sharing and security
around VO (Virtual Organisations)• Currently moving Grid applications to Cloud platform

CTS2014 Tutorial

Cloud Federation for e-Science

31

EGI Participation – Feb 2014
Cyfronet

FZJ

OeRC

EGI.euCESNET

GWDG

BIFI

KISTI

CNRS

IN2P3

SAGridMembers

KTH

•
•
•

CETA
IGI
RADICA
L
STFC
BSC

MasarykTechnologies•
142 individuals•~37 institutions
20 countries (EU & non-EU) ••Stakeholders• 23 Resource Providers•• 13 production•• 10 Certified•• 10 Technology Providers •• 10 User Communities•• 4 Liaisons

FCTSG

INFNCNAF

OpenNebula
StratusLab*
OpenStackSynnefo
Cloudstack
PERUN
SlipStream
APEL
GOCDB

CESGA
SARA

IFCA
SZTAKI
GRNET

DANTE

ISRGrid
LMU
CTS2014 Tutorial

INFNBARI

IPHC

IISAS

SixSq

100%IT

CSC

Cloud Federation for e-Science

IFAE

DESY

SRCE

32

EGI Mission and Principles
MISSION: To support international researcher collaborations from all
disciplines with the reliable and innovative ICT services they need toaccelerate science excellence• Natural and physical sciences• Medical and health sciences• Engineering and technology

EC EGI-InSPIRE project (2010-2014) http://www.egi.eu/case-studies/• Uniform access to heterogeneous data and compute services– Grid and Cloud platforms• Federation of services from– Publicly funded infrastructures– Institutional infrastructures– Commercial providers (incl. partnership with HelixNebula)• Free at point of delivery/pay per use

CTS2014 Tutorial

Cloud Federation for e-Science33

CTS2014 Tutorial

Cloud Federation for e-Science34

CTS2014 Tutorial

Cloud Federation for e-Science35

CTS2014 Tutorial

Cloud Federation for e-Science36

CTS2014 Tutorial

Cloud Federation for e-Science37

CTS2014 Tutorial

Cloud Federation for e-Science38

CTS2014 Tutorial

Cloud Federation for e-Science39

CTS2014 Tutorial

Cloud Federation for e-Science40

CTS2014 Tutorial

Cloud Federation for e-Science

41

EGI Services for Federated Operations• Activities and tools for the operations of
distributed services– Central operations tools (message brokers, operations
dashboards, VO management, service and security
monitoring, service registry)– Federated accounting (distributed repositories andportal)– Technical support and incident management– Security operations coordination, policy development,
software vulnerability– Software distribution, verification, validation

CTS2014 Tutorial

Cloud Federation for e-Science

42

EGI Long-term vision for European RIs and ERA• One European High Throughput Computing (HTC) andCloud infrastructure– Technical integration• Europe – e.g. EUDAT, PRACE• World-wide (liaison) – e.g. OSDC, XSEDE, OSG, SAGrid, PIRE

– Complemented with commercial (Cloud) Service Providers• Distributed network of Competence Centres– Discipline / domain oriented• E.g. structural biology, Astronomy, Archeology– Cross-cutting competence centres• E.g. security, Cloud Compouting, parallel computing, Big Data

CTS2014 Tutorial

Cloud Federation for e-Science

43

SDI and Cloud Computing

CTS2014 Tutorial

Cloud Federation for e-Science44General requirements to SDI for emerging Big
Data Science
•
•
•
•
•
•

Support for long running experiments and large data volumes generated
at high speed
Multi-tier inter-linked data distribution and replication
On-demand infrastructure provisioning to support data sets andscientific workflows, mobility of data-centric scientific applications
Support of virtual scientists communities, addressing dynamic usergroups creation and management, federated identity management
Support for the whole data lifecycle including metadata and data source
linkage
Trusted environment for data storage and processing–••

Research need to trust SDI to put all their data on it

Support for data integrity, confidentiality, accountability
Policy binding to data to protect privacy, confidentiality and IPR

CTS2014 Tutorial

Cloud Federation for e-Science45

Defining Architecture framework for SDI and FADI
• Scientific Data Lifecycle Management (SDLM) model• e-SDI multi-layer architecture model• Capabilities, Roles, Actors– RORA (Resource-Ownership-Role-Actor) model defines
relationship between resources, owners, managers, users– Initially defined for telecom domain– Potentially new actor in SDI – Subject of data (e.g. patient, orscientific object/paper)• Security and Federated Access Control and Delivery
Infrastructure (FADI)– Authentication, Authorisation, Accounting• Federated Access Control and Identity Management– Extended to support data access control and operations ondata– Trust management infrastructure
CTS2014 Tutorial

Cloud Federation for e-Science46

SDI Architecture Model and Federated
Infrastructure components

Layer B6
Scientific
Applications

ScientificDatasetApplicScientific
ApplicScientific
ApplicScientificUser/Scientific Applications Layer

User
portals

Metadata and Lifecycle Management

Security and AAI

Operation Support and Management Service (OSMS)

Layers

Policy and distributed Collaborative
Groups Support

Layer B5
Federated Accessand Delivery(FADI)

Shared Scientific Platform and Instruments(specific for scientific area, also Grid based)

Layer B4
Scientific Platform
and Instruments

Scientific specialist
applications
Library resources

FADI: Optical Network
Infrastructure
Federated Identity
Management:
eduGAIN, REFEDS,
VOMS, InCommon,
OCX
PRACE/DEISA

Cloud/Grid Infrastructure
Virtualisation and Management
Middleware
ComputeResources

Sensors andDevices

Middleware
security

StorageResources

Network infrastructure

CTS2014 Tutorial

Technologies andsolutions

Cloud Federation for e-Science

Layer B3
Infrastructure
Virtualisation

Layer B2
Datacenter andComputing Facility
Layer B1
Network Infrastructure

Grid/Cloud, OCX

CloudsAutobahn, eduroam

47

SDI Architecture Layers• Layer D1: Network infrastructure layer represented by the general
purpose Internet infrastructure and dedicated network infrastructure• Layer D2: Datacenters and computing resources/facilities, including
sensor network• Layer D3: Infrastructure virtualisation layer that is represented by the
Cloud/Grid infrastructure services and middleware supporting specialised
scientific platforms deployment and operation• Layer D4: (Shared) Scientific platforms and instruments specific fordifferent research areas• Layer D5: Federated Access and Delivery Infrastructure: Federation
infrastructure components, including policy and collaborative user groups
support functionality• Layer D6: Scientific applications and user portals/clientsCTS2014 Tutorial

Cloud Federation for e-Science48

SDI move to Clouds• Cloud technologies allow for infrastructure virtualisation andits profiling for specific data structures or to support specificscientific workflows• Clouds provide just right technology for infrastructure virtualisation to
support data sets
• Complex distributed data require infrastructure– Demand for inter-cloud infrastructure• Cloud can provide infrastructure on-demand to support
project related scientific workflows– Similar to Grid but with benefits of the full infrastructure provisioning
on-demand• Software Defined Infrastructure Services– As wider than currently emerging SDN (Software Defined Networks)• Distributed Hadoop clusters for HPC and MPP
CTS2014 Tutorial

Cloud Federation for e-Science49

Data Analysis Architecture [ref]Support Scientific Simulations (Data Mining and Data Analysis)

Applications/
Algorithms

Kernels, Genomics, Proteomics, Information Retrieval, Polar Science, Scientific
Simulation Data Analysis and Management, Dissimilarity Computation,
Clustering, Multidimensional Scaling, Generative Topological Mapping
Security, Provenance, Portal
Services and Workflow

Programming
ModelHigh Level Language

Runtime

Cross Platform Iterative MapReduce (Collectives, Fault Tolerance, Scheduling)

Storage

Distributed File Systems

InfrastructureLinux HPC
Bare-system

Amazon Cloud
Virtualization

Hardware

CTS2014 Tutorial

CPU Nodes

Object Store
Windows Server
HPC
Bare-system

Data Parallel File System
Azure Cloud

Grid
Appliance

Virtualization
GPU Nodes[ref] Source: presentation by Judy Qiu “Analysis Tools for Data Enabled Science”
at the Big Data Analytics Workshop (BDAW2013)
Cloud Federation for e-Science50General use case for infrastructure provisioning:
Workflow => Logical (Cloud) InfrastructureEnterprise/Scientific workflow
Storage
Data

SpecialProc 1
Data
Filtering

Input
Data

VisualPresent
SpecialProc 2

Instrum.
Data

Campus A

Data
Archive

Visualisation

Visualisation

CE

User
Group A

Campus B

CE

User
User
User

User
User
User

VR6

Cloud 2 PaaS

VR2

User
Group B

VR7
VR4

VR1

VR5

Resource/
Service
ProviderVR3Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

Resource/
Service
Provider
CN

CN
CN

CN
CN

CN

Cloud PaaS Provider

CN
CN

CN

CN
CN

Cloud IaaS Provider

CTS2014 Tutorial

Cloud Federation for e-Science51

General use case for infrastructure provisioning:
Workflow => Logical (Cloud) InfrastructureEnterprise/Scientific workflow
Storage
Data

SpecialProc 1
Data
Filtering

Input
Data

VisualPresent
SpecialProc 2

Instrum.
Data

Campus A

Data
Archive

Visualisation

Visualisation

CE

User
Group A

Campus B

CE

User
User
User

User
User
User

VR6

Cloud 2 PaaS

VR2

User
Group B

VR7
VR4

VR1

VR5

Resource/
Service
ProviderVR3Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

Resource/
Service
Provider
CN

CN
CN

CN
CN

CN

Cloud PaaS Provider

CN
CN

CN

CN
CN

Cloud IaaS Provider

CTS2014 Tutorial

Cloud Federation for e-Science52General use case for infrastructure provisioning:
Logical Infrastructure => Network Infrastructure (1)Resource and Cloud Provider Domains
Cloud 1 IaaS
VR3

VR1

Cloud 2 PaaS

VR5

VR7

Campus A
Infrastructure

Campus B
Infrastructure

VR2

Campus A

VR4

VR6

Cloud Carrier Network Infrastructure

Visualisation

Visualisation

CE

User
Group A

Campus B

CE

User
User
User

User
User
User

VR6

Cloud 2 PaaS

VR2

VR7
VR4

VR1

VR5

Resource/
Service
ProviderDefined as
InterCloud Architecture
Framework (ICAF)

UserGroup B

VR3

Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

Resource/
Service
Provider
CN

CN
CN

CN
CN

CN

Cloud PaaS Provider

CN
CN

CN

CN
CN

Cloud IaaS Provider

CTS2014 Tutorial

Cloud Federation for e-Science53InterCloud Architecture Framework (ICAF)
Components (proposed by UvA, submitted to IETF)• Multi-layer Cloud Services Model (CSM)– Combines IaaS, PaaS, SaaS into multi-layer model with inter-layer interfaces– Including interfaces between cloud service layers and virtualisation platform• InterCloud Control and Management Plane (ICCMP)– Allows signaling, monitoring, dynamic configuration and synchronisation of
the distributed heterogeneous clouds– Including management interface from applications to network infrastructure
and virtualisation platform• InterCloud Federation Framework (ICFF)– Defines set of protocols and mechanisms to ensure heterogeneous clouds
integration at service and business level– Addresses Identity Federation, federated network access, etc.

• InterCloud Operations Framework (ICOF)– RORA model: Resource, Ownership, Role, Action– Business processes support, cloud broker and federation operation
Intercloud Architecture for Interoperability and Integration, Release 1, Draft Version 0.5. SNETechnical Report 2012-03-02, 6 September 2012
http://staff.science.uva.nl/~demch/worksinprogress/sne2012-techreport-12-05-intercloud-architecture-draft05.pdf

CTS2014 Tutorial

Cloud Federation for e-Science54

Cloud Federation and Federated AAI• Virtual Organisations legacy Federation model• Users and resources federation in clouds– Federation models• Federated Access Control in clouds

CTS2014 Tutorial

Cloud Federation for e-Science55

Cloud Federation and VO based Federated Grid
Infrastructure• Grid federates resources and users by creating Virtual Organisations(VO)– VO membership is maintained by assigning VO membership attributes to VO
resources and members• VO Membership Service (VOMS)– Users remain members of their Home Organisations (HO)• AuthN takes place at HO or Grid portal• To access VO resources, VO members need to obtain VOMS certificate or VOMS
credentials– Resources remain under control of the resource owner organisation Grid
Centers– Scalability and on-demand provisioning issues• In clouds, both resources and user accounts are created/provisioned ondemand as virtualised components/entities– User accounts/identities can be provisioned together with access rights tovirtual resources
CTS2014 Tutorial

Cloud Federation for e-Science56

VO bridging inter-organisational barriers
VO users and services

Service xa

Service xd

User x1

Service xe
User x2
Service xb
User x5
User x4

Virtual Organisation X
User a1
User A2

Service Ab

User A1

User a1Service Bb

Barrier
User a1Service Bc

User A3
Service Ac
Organisation A•

Organisation B

Service Ba

Service Aa

VO allows bridging inter-organisational barriers without changing local policies– Requires VO Agreement and VO Security policy– VO dynamics depends on implementation but all current implementations are rather staticVO-based Dynamic Security Associations in Collaborative Grid
Environment, COLSEC’06 Workshop, 15 May 2006, Las Vegas

CTS2014 Tutorial

Cloud Federation for e-Science

Slide_57

Example VO Security services operation
VO Context(VO ID/name)
Requestor
Service xa(1a)Resource
Service xd
(3)

(2)

VOMS
functionality(4)
Identity
Provider (2a)(1b)

Attribute
Authority

Authentication
Service(4b)Authorisation
Service

VO Mngnt
PolicyAuthority

UserDB

(4a)
Trust
Mngnt

Trust

Virtual Organisation X
AuthN

AuthN

IP/STS

AttrA

IP/STS

Directory
Trust
Policy

AttrA

AuthZ

Factory

AuthZ

Factory
Directory

Logging
Accounting

Trust

VOMS*

Trust
PolicyLogAccLogAccOrganisation B
Organisation A

VO-based Dynamic Security Associations in Collaborative Grid
Environment, COLSEC’06 Workshop, 15 May 2006, Las Vegas
CTS2014 Tutorial

Cloud Federation for e-Science

Slide_58

Cloud Federation: (new) Actors and Roles• Cloud Service Provider (CSP)• Cloud Customer (organisational)– Multi-tenancy is provided by virtualisation of cloud resources
provided to all/multiple customers– Cloud tenant is associated with the customer organisation• Cloud User (end user)– Cloud User can be a user/role for different tenants/services• Cloud (Service) Broker• Identity Provider (IDP)• Cloud Carrier• Cloud Service Operator• Cloud Auditor
CTS2014 Tutorial

Cloud Federation for e-Science59

Cloud Federation – Scaling up and down
• Scalability is one of the main cloud feature– To be considered in the context of hybrid cloud service
model• Cloud burst and outsourcing enterprise services to cloud• Cloud services migration and replication between CSP• Scaling up– Identities provisioning– Populating sessions context• Scaling down
– Identity deprovisioning: Credentials revocation?
– Sessions invalidation vs restarting• Initiated by provider and by user/customer
CTS2014 Tutorial

Cloud Federation for e-Science60Cloud Federation Models – Identified models
User/customer side federation• (1.1) Federating users/HO and CSP/cloud domains– Customer doesn’t have own IDP (IDP-HO)– Cloud Provider’s IDP is used (IDP-CSP)• (1.2) Federating HO and CSP domains– Customer has own IDP-HO1– It needs to federate with IDP-CSP, i.e. have ability to use HO
identities at CSP services• (1.3) Using 3rd party IDP for external users– Example: Web server is run on cloud and external user are registeredfor services

Provider (resources) side federation• (2.1) Federating CSP’s/multi-provider cloud resources– Used to outsource and share resources between CSP– Typical for community clouds
CTS2014 Tutorial

Cloud Federation for e-Science61Basic Cloud Federation model (1.1) – Federating
users/HO and CSP/cloud domains (no IDP-HO)

HO1
Admin/Mngnt
SystemUser UserUser
HO1.1
HO1.2
HO1.3

Customer Home
Organisation(Infrastructure services)Management(Ops&Sec)IDP-HO•

Federation relations

•
•

CSP
IDP/
Broker•

CTS2014 Tutorial

CSP – Customer – User
IDP/Broker

Cloud accounts A1.1-3 areprovisioned for each user 1-3 fromHO with 2 options
–
–

Cloud
Provider A

User side Federation

Simple/basic scenario 1: Federating
Home Organisation (HO) and Cloud
Service Provider (CSP) domains
Cloud based services created forusers from HO1 and managed by
HO1 Admin/Management system
Involved major actors and roles––

User UserUser
A1.2 A1.1A1.3
IDP-XaCloud
Customer A1(Running Service Xa)•

Individual accounts with new ID::pswd
Mapped/federated accounts that allows
SSO/login with user HO ID::pswd

Federated accounts may use Cloud
IDP/Broker (e.g. KeyStone) or thosecreated for Service Xa

IDP-Xa is a virtualised
service of the CSP IDP
Cloud Federation for e-Science62Basic Cloud Federation model (1.2) – Federating
HO and CSP domains (IDP-HO1 and IDP-CSP)

HO1
Admin/Mngnt
SystemUser UserUser
HO1.1
HO1.2
HO1.3

Customer Home
Organisation(Infrastructure services)Management(Ops&Sec)IDP-HO1•

Federation relations

•
•

CSP
IDP/
Broker•

CTS2014 Tutorial

CSP – Customer – User
IDP/Broker

Cloud accounts A1.1-3 areprovisioned for each user 1-3 fromHO with 2 options
–
–

Cloud
Provider A

User side Federation

Simple/basic scenario 1: Federating
Home Organisation (HO) and Cloud
Service Provider (CSP) domains
Cloud based services created forusers from HO1 and managed by
HO1 Admin/Management system
Involved major actors and roles––

User UserUser
A1.2 A1.1A1.3
IDP-XaCloud
Customer A1(Running Service Xa)•

Individual accounts with new ID::pswd
Mapped/federated accounts that allows
SSO/login with user HO ID::pswd

Federated accounts may use Cloud
IDP/Broker (e.g. KeyStone) or thosecreated for Service Xa

IDP-Xa can be implemented
as instantiated service of the CSP IDP
Cloud Federation for e-Science63Basic Cloud Federation model (1.3) – Using 3rdparty IDP for external users
External Users(Open Internet)
User
User2

User
User3
User
User1

Customer 1
Admin/Mngnt
System•

Ext/3rdParty
IDP-HO1

Direct or Dynamic link
Federation relations

Management(Ops&Sec)•––

User User
UserX
Xa.1
Xa.2
a.3
IDP-XaCloud
Customer A1(Running Service Xa)

•

•
CSP
IDP/
Broker•

CTS2014 Tutorial

CSP – Customer – User
IDP/Broker

Cloud accounts A1.1-3 areprovisioned for each user 1-3 fromHO with 2 options
–
–

Cloud
Provider A

User side Federation

Simple/basic scenario 2: Federating
Home Organisation (HO) and Cloud
Service Provider (CSP) domains
Cloud based services created forexternal users (e.g. website) andmanaged by Customer 1
Involved major actors and roles

Individual accounts with new ID::pswd
Mapped/federated accounts that allows
SSO/login with user HO ID::pswd

Federated accounts may use Cloud
IDP/Broker (e.g. KeyStone) or those
IDP-Xa created for Service Xa

IDP-Xa can be implemented
as instantiated service of the CSP IDP
Cloud Federation for e-Science64Basic Cloud Federation model – Combined Userside federation(a) Enterprise
Infrastructure(b) External Users(Open Internet)

User
User2

Management(Ops&Sec)

User
User3
User
User1

(a) HO or(b) Custmr1
MgntSystem(a) IDP-HO1(b) 3rd Party
IDP

•

•

Direct or Dynamic link

IDP-XaCloud
Customer A1(Running Service Xa)

•
CSP
IDP/
BrokerCloud
Provider A

User side Federation

Simple/basic scenario 2: Federating
Home Organisation (HO) and Cloud
Service Provider (CSP) domains
Cloud based services created forexternal users (e.g. website) andmanaged by Customer 1
Involved major actors and roles––

Federation relations

User User
UserX
Xa.2 Xa.1 a.3

CTS2014 Tutorial•

Cloud accounts A1.1-3 areprovisioned for each user 1-3 fromHO with 2 options––•

CSP – Customer – User
IDP/Broker

Individual accounts with new ID::pswd
Mapped/federated accounts that allows
SSO/login with user HO ID::pswd

Federated accounts may use Cloud
IDP/Broker (e.g. KeyStone) or those
IDP-Xa created for Service Xa

IDP-Xa can be implemented
as instantiated service of the CSP IDP
Cloud Federation for e-Science65Basic Cloud Federation model (2.1) – Federating
CSP’s/multi-provider cloud resources
HO1
Admin/Mngnt•

User UserUser
HO1.1
HO1.2
HO1.3

IDP-HO1•

User side Infrastructure services

User UserUser
A1.2 A1.1A1.3

Cloud
Service Xa

Cloud
Provider A
Rsr
Ak2

IDP-Xa

CSP
IDP-A

–

Federation&Trust relations
Rsr
Ak1

•

Rsr
An1

Rsr
Am1

Rsr
K2

Rsr
IDP-K
M2

Cloud
Provider K
CTS2014 Tutorial

Rsr
N1

Rsr
M1

Cloud
Provider M

IDP-M

Rsr
N2

•
IDP-N

Cloud
Provider N

Cloud Federation for e-Science

May be bilateral or via 3rdparty/broker service

Includes translation or
brokering––––Inter-provider federation for resources sharing
Rsr
Kn1

Cloud provider sidefederation for resources
sharing
Federation and Trust
relations are establishedbetween CSP’s via
Identity management
services, e.g. Identity
Providers (IDP)

Trust relations
Namespaces
Attributes semantics
Policies

Inter-provider federationis transparent tocustomers/users

Provider side Federation

66

(a) Enterprise
Infrastructure
User
User2
User
User1

(a) HO or(b) Custmr1
MgntSystem

Management(Ops&Sec)Cloud
Provider A

Cloud Federation
Model - Combined(b) External Users(Open Internet)
User
User3
(a) IDP-HO1(b) 3rd Party
IDP

Direct or Dynamic link

Federation relations
Instantiated
IDP-A => IDP-Xa

UserUserUser
Xa.2Xa.1Xa.3
IDPCloud
Xa
Service Xa

Rsr
Ak2 Rsr
Ak1

Rsr
Am1

Rsr
An1

User sidefederation
CSP
IDP-A
Federation &Trust relations

Provider sidefederation

Inter-provider federation for resources sharing

Rsr
K2

Rsr
Kn1
Cloud
Provider K

CTS2014 Tutorial

Rsr
IDP-K
M2

Rsr
N1

Rsr
M1

Cloud
Provider M

IDP-M

Rsr
N2

IDP-N
Cloud
Provider N

Cloud Federation for e-Science67Basic AuthN and AuthZ services using Federated
IDPs – For additional Credentials validation
2 AuthN & Attrs methods:
Push: Attrs obtained by User
Pull: Attrs fetched by AuthN

IDP-Fed*IDP-Fed*UserRequester

IDP0
Identity Attrs
ID Creds & Attrs

Creds/Attrs Validation
with Federated IDP*
Creds/Attrs Validation
with User Home IDP0

AuthN
AuthN Tok/Assert &ID Attrs

CVS
AuthZ Attrs

PEP - Policy Enforcement Point
PDP/ADF - Policy Decision Point
IDP – Identity Provider
PAP - Policy Authority Point
CtxHandler - Context Handler
CVS – Credentials Validation
Service

CTS2014 Tutorial

PDP

CtxHandler

PolicyPAP(Policy)

PEP

Collection and Validating
AuthZ Attrs
Policy Management

Cloud Federation for e-Science

Resource
Resource Attrs

68

Basic AuthN and AuthZ services using Federated
IDPs – Federation/Trust domains
Admin/Security
Domain 0(User HO)

Admin/Security
Domain1 Service

Federated
IDPs

User

IDP-FedHO

Identity Attrs

IDP-Fed*Serv/Requester

IDP0

User/Req Attrs
ID Creds & Attrs
Creds/Attrs Validation
with Federated IDP-HO

Creds/Attrs Validation
with User Home IDP0

AuthN
AuthN Token/Assert& ID Attrs

CVS
AuthZ Attrs

PDP

PolicyResource
Domain R

CTS2014 Tutorial

PAP(Policy)

CtxHandler

PEP

Collection and Validating
AuthZ Attrs
Policy Management

Cloud Federation for e-Science

Resource
Resource Attrs

69

Implementation: Keystone Identity Server Sequences

CTS2014 Tutorial

Cloud Federation for e-Science70Implementation: Intercloud Federation Infrastructure andOpen Cloud eXchange (OCX) in GEANT Infrastructure• Open Cloud eXchange (OCX) initiative by GN3plus JRA1:
Network Architectures for Horizon 2020
– GEANT Network to support 2Tbps capacity backbone– SURFnet – PSNC 100 Gbps remote robotics demo at TNC2013• From Software Defined Network (SDN) to Software Defined
Infrastructure (SDI)– A new thinking beyond current challenges• Federated Identity Management and Federated Access andDelivery Infrastructure (FADI)

CTS2014 Tutorial

Cloud Federation for e-Science71Intercloud Federation Infrastructure and Open CloudeXchange (OCX)
Resource and Cloud Provider Domains
VR3

VR1

VR5

VR7

Campus A
Infrastructure

Campus B
Infrastructure

VR2

VR4

OCX at Cloud Carrier or Network
Provider (NREN) level

Network Provider 1

Campus A

Visualisation

VR6

Visualisation

Cloud Carrier or Network Provider 2

CE

User
Group A

Campus B

CE

User
User
User

User
User
User

VR6

Cloud 2 PaaS

VR2

VR7
VR4

VR1

VR5

Resource/
Service
ProviderProvisioning network
infrastructure may
involve multiple providers:Introducing OCX(Open Cloud eXchange)

User
Group B

VR3

Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

Resource/
Service
Provider
CN

CN
CN

CN
CN

CN

Cloud PaaS ProviderCN

OCX (Open CloudeXchange)
Similar to Amazon
Direct Connect

CN
CN

CN
CN

Cloud IaaS Provider

CTS2014 Tutorial

Cloud Federation for e-Science72

Implementation: Intercloud Federation Infrastructure andOpen Cloud eXchange (OCX) in GEANT infrastructure
Federated Cloud
Instance Customer A(University A)

Trust
BrokerTrust
BrokerBrokerOCX
Services
Cert Repo(TACAR) TTP Trusted
Introducer

Broker

OCX and federated
network infrastructure

Cloud
Service
BrokerFedIDP

CTS2014 Tutorial

Federated Cloud
Instance Customer B(University B)

Discovery
Directory

Directory(RepoSLA)(RepoSLA)

Gateway

Gateway

Gateway

Gateway

AAA

AAA

AAA

AAA

(I/P/S)aaS
Provider(I/P/S)aaS
Provider(I/P/S)aaS
Provider

IDP

IDP

IDP

…

Cloud Federation for e-Science

GEANT
TransEuropean
infrastructure(I/P/S)aaS
ProviderIDP

73

OCX Definition and Operational Principles• Direct service/inter-member peering– Re-use and leverage Internet eXchange Point (IXP) experience– Open collocation services• No third party (intermediary/broker) services– Transparency for cloud based services– No involvement into peering or mutual business relations• Trusted Third Party (TTP)– To support dynamic service agreements and/or federation
establishment– Enables creating federations on-demand– Trusted Introducer for dynamic trust establishment• May include other special services to support smoothservices delivery and integration between CSP and
Customer– E.g., Local policies, service registry and discovery, Application/VM
repository
CTS2014 Tutorial

Cloud Federation for e-Science

74

OCX Trusted Third Party services
OCX L0-L2/L3 topology• Any-to-any• Distributed, collapsed, hierarchical• Topology information exchange L0L2 + L3?
• QoS control• SDN control over OCX switching

TTP

TTP goals and services• Enable dynamic federations
establishment• Trusted Certificates and CA’s
Repository

OCX– Similar to TACAR (TERENA Academic
CA Repository)•

Trusted Introducer Service– Trusted Introduction Protocol

Pre-established trust relation with OCX as TTP
Trust relations established as a part ofdynamic federation between OCX members
CTS2014 Tutorial••

Service Registry and Discovery
SLA repository and clearinghouse

Cloud Federation for e-Science

75

OCX Hierarchical Topology Model
GEANT

CSP

NREN

University

Visualisation

VR6

CE

VR7

OCX

VR4
VR5

User
User
User

VR3

DFlow
IP/L3
L2

Visualisation

VR6

CE

VR7

L1

OCX

VR4

User
User
User

VR5

L0

CTS2014 Tutorial

VR3

Cloud Federation for e-Science76

GEANT: European and Worldwide Scale ofInfrastructure (2013-2014)

CTS2014 Tutorial

Cloud Federation for e-Science

77

OCX Pilot: Demo at TNC2014 Conference(19-22 May 2014, Dublin)? Using the routed internet as comparison

621

Routed Internet

5

University of
Amsterdam

Okeanos

SURFnet7

NetherLight
OCX

1
3

5
Cloud
Sigma

GÉANT

2014
Networking
Conference

2

GRNET
OCX

6

SWITCH
OCX

4

Video Processing Sequence
4 - Transcoding at Cloud Sigma VMs
1 - Spawn VMs at Okeanos and send video frames towards these VMs
5 - Okeanos VMs send transcoded frames to UvA
2 - Transcoding at Okeanos VMs
6 - Cloud Sigma VMs send transcoded Frames to UvA
3 - More CPU power required; spawn VMs at Cloud Sigma and send video 7 - Show results at TNC
frames towards these VMs

CTS2014 Tutorial

Cloud Federation for e-Science78

TNC2104 Demo Scenario: HD video editing
and streaming
The University of Amsterdam (UvA) has some 4K movies that need efficient transcoding• Using local OCX (NetherLight) the UvA can get access to necessary compute resources atdifferent Cloud Service Providers via high performance dedicated network links.
–••

The demo uses Okeanos (connected via GRNET OCX) and Cloud Sigma (connected via SWITCH OCX).

The UvA created scheduling software that is able to spawn virtual machines at Okeanos or
Cloud Sigma
The machines are spawned inside the L2-domain of the UvA

OCX enabled GEANT infrastructure provides the following benefits• Allow the R&E community to select from a broad range of cloud services that ensure
network service levels and/or have a logical separation from the Internet• Allow CSPs to deliver their services efficient, using optimized paths, to the R&E community(everyone is welcome, no limitations on “cross-connects”)• Facilitate transparent connectivity between the R&E community and CSPs (allow jumbo
frames, no firewalls/policies, private network, etc)
• Enhance “time-to-market” by using Bandwidth-on-Demand or other Software Defined
Networking (SDN) solutions

CTS2014 Tutorial

Cloud Federation for e-Science

79

Questions and discussion• Which cloud federation model to use?
• What research community cloud to join?
• Research grants by the major cloud providers
Amazon AWS, Microsoft Azure, IBM

CTS2014 Tutorial

Cloud Federation for e-Science80Additional Information• Cloud Security Challenges and models

CTS2014 Tutorial

Cloud Federation for e-Science81Multilayer Cloud Services Model (CSM)

Security InfrastructureManagement

Operations Support System

User/Client Services* Identity services (IDP)* Visualisation

User/Customer Side Functions and Resources

Administration andManagement Functions(Client)

Content/Data Services* Data * Content * Sensor * Device

1

Endpoint Functions* Service Gateway* Portal/Desktop

Access and Delivery
InfrastructureInter-cloud Functions* Registry and Discovery* Federation Infrastructure

Cloud Services (Infrastructure, Platform, Application, Software)

IaaS

SaaS

PaaS

PaaS-IaaS IF

Layer C5
Services
Access/Delivery

Layer C4Cloud Services(Infrastructure,
Platforms,
Applications,
Software)PaaS-IaaS Interface
IaaS – Virtualisation Platform Interface

Cloud Management
Software(Generic Functions)

Cloud Management Platforms
OpenNebula

Virtualisation Platform

OpenStack

KVM

VM

VM

VPN

Other
CMS

XEN

VMwareNetwork
Virtualis

Proxy (adaptors/containers) - Component Services and Resources

StorageResources

ComputeResources

Contrl&Mngnt Links
CTS2014 Tutorial

Layer C6
User/Customer
side Functions

Hardware/PhysicalResources

Network
Infrastructure

Layer C3
Virtual Resources
Composition andControl(Orchestration)

CSM layers(C6) User/Customer side
Functions(C5) Intercloud Access andDelivery Infrastructure(C4) Cloud Services(Infrastructure, Platform,
Applications)(C3) Virtual Resources
Composition andOrchestration(C2) Virtualisation Layer(C1) Hardware platform anddedicated network
infrastructure

Layer C2
Virtualisation

Layer C1
PhysicalHardwarePlatform andNetwork

Control/
Mngnt Links

Data Links

Data Links

Cloud Federation for e-Science

Slide_82

Cloud Computing Security – Challenges• Fundamental security challenges and main user concerns in
Clouds– Data security: Where are my data? Are they protected? What control
has Cloud provider over data security and location?
– Identity management and access control: Who has access to mydata?

• Two main tasks in making Cloud secure and trustworthy– Secure operation of Cloud (provider) infrastructure– User controlled access control (security) infrastructure• Provide sufficient amount of security controls for user

• Cloud security infrastructure should provide a framework for
dynamically provisioned Cloud security services andinfrastructure
CTS2014 Tutorial

Cloud Federation for e-Science83Current Cloud Security Model• SLA and Provider based security model– SLA between provider and user defines the provider responsibility and guarantees• Data protection is attributed to user responsibility• Actually no provider responsibility on user run applications or stored data

– Providers undergo certification of their Cloud infrastructure (insufficient for highly
distributed and virtualised environment)– Customer/User must trust Provider• Using VPN and SSH keys generated for user infrastructure/VMs– Works for single Cloud provider– Inherited key management problems• Not scalable• Not easy integration with legacy user/customer infrastructure andphysical resources• Simple access control, however can be installed by user using SSO to
Cloud provider site
• Trade-off between simplicity and manageability
CTS2014 Tutorial

Cloud Federation for e-Science84

Cloud Environment and Problems to be addressed
•
•
•
•
•

Virtualised services
On-demand/dynamic provisioning
Multi-tenant/multi-user
Multi-domain
Uncontrolled execution and data storage environment– Data protection• Trusted Computing Platform Architecture (TCPA)• Promising homomorphic/elastic encryption (to be researched)• Integration with customer legacy security
services/infrastructure– Campus/office local network/accounts• Integration with the providers business workflow

CTS2014 Tutorial

Cloud Federation for e-Science85

Emerging Cloud Security Models• Former (legacy): Provider - User/Customer• New Cloud oriented security provisioning models– Provider - Customer - User
• Enterprise as a Customer, and employees as Users• Enterprise/campus infrastructure and legacy services– Provider – Operator (Broker) - Customer – User
• Application area IT/telecom company serves as an Operator for
application services infrastructure created for customer company• Security issues/problems in new security provisioning
models– Integration of the customer and provider security services– Identity Management and Single Sign On (SSO)• Identity provisioning for dynamically created Cloud based infrastructure orapplications
CTS2014 Tutorial

Cloud Federation for e-Science86