CYCLONE: Multi-cloud applications deployment and management
platform for research and academic community
Yuri Demchenko, Fatih Turkmen, Cees de Laat (UvA), Eduard Escalona, Mathias Slawik, Christophe Blanchet (CNRS-IFB), Oleg
Lodygensky (CNRS-LAL), Cal Loomis (SixSq), Ralf Fischer (QSC)CYCLONE as a Secure Multi-cloud Infrastructure for Data Intensive Applications

Master>5
Smart Energy
Systems
Usecases

Developer/Customer

Storage
Storage
PoolApp
Dev&OpsTools

WorkerWorkerWorkerWorkerWorkerWorkerWorkerWorkerWorkerWorkerFederated
Security
Services

CloudExt
I/P/SaaS

SlipStreamOutsourcing Workflow/ Compute

Fed IDP& SSO

Archiving Data
IdPIdP
IdP

Federated
AAI/ABAC

Scientific Data
ArchiveWorkerWorkerMaster
Worker Worker
Worker Worker
Worker Worker
WorkerStorage
WorkerScientific
Application(Workflow)
Collaboration & Visualisation> 10
Bioinformatics
Research Usecases

Secure Session
Ctx Mngmt
Trust Bootstrap

Storage
Pool

Secure Logging
SecureNetworking(CNSMO)

SlipStream

Data
Visualis &Collaboration

Cloud1 IaaS VPC

External/Cloud Data
Storage/Apps/Instruments

Hosting Scientific Application
Researcher/User
Data
Storage
Storage

ServerData
Storage
Storage

ServerData
Storage
Storage

Data
Storage
Storage

SciCloud BSciCloud A

Bootstrapping Trust and Integrity Checks

CYCLONE Security Features✓ Infrastructure for consistent access control, security credentials andcontext management for multi-cloud applications.
✓ Federated identity management for users or applications on their behalf
when regulating access to sensitive resources.
✓ Federated access control management in multi-provider and multi-tenantsettings.
✓ Implementation of shared responsibility model to support different typesof multi-cloud application deployment paradigms.
✓ Data protection in all phases of data handling lifecycle; at-rest, on-themove and during-processing.
✓ Bootstrapping of trust on dynamically provisioned cloud resources.
✓ Security Service Lifecycle Management from registration, deployment todecommissioning of security services.
✓ Ensuring compliance at the EU and international levels for security.
CYCLONE Security Infrastructure employs (among others):• eXtensible Access Control Markup Language (authorizations)• Keycloak (federated IDM)
• Kibana/Logstash (distributed logging)• TPM (cryptography)

TenantCertificate Authority

Software CARevocation
ServicevTPM

Bootstrap Key
derivation

VM NodeVM NodeTrustunwrapIdentity
keyTenant CV

Bootstrap
vTPM
keyvTPMvAIK good?

TPMHypervisor

AIKGood?

Tenant Registrar

Deep Quote

Hypervisor

Signedwhitelists

AIK Good?

Enrollment

TPM

Provider Registrar
TPM / Platform
Manufacturer

Provider Whitelist
Authority
TPMGood?

• Trust bootstrapping enables the installation of keys to cloud nodes,
applications and services during their initialization.
• Cyclone implements a trust bootstrapping mechanism similar to keylime [1].

References[1] Nabil Schear, Patrick T. Cable II, Thomas M. Moyer, Bryan Richard, Robert
Rudd: Bootstrapping and maintaining trust in the cloud. ACSAC 2016: 65-77

Acknowledgement

For more information refer to

CYCLONE project is supported by the Horizon 2020 EU funded Integrated
project CYCLONE project, grant number 644925.

CYCLONE website - http://www.cyclone-project.eu/
CYCLONE github - https://github.com/cyclone-projectContact: Yuri Demchenko <y.demchenko@uva.nl>
Eduard Escalona <eduard.escalona@i2cat.net>