El dictamen de RSM Assurance & Audit S.A

When operating a cloud infrastructure, the cloud provider has to ensure the compliant allo- cation of hardware resources for hosting virtual resources requested by corporate customers. The decision-making and enforcement when it comes to resource allocation are based on the classification of hardware resources which depends on the hardware resources’ location and theeffective level of security(cf. Section5.3.4). In general, the hardware resources are not under the direct control of the cloud provider since they are operated by subcontracted hard- ware providers. Therefore, the cloud provider has to rely on the correctness of the location of hardware resources and the effective level of securityprovided by the hardware provider. In particular, the information on hardware resource location and theeffective level of securityhas to be accurate, to allow a correct classification of hardware resources. Since this information is provided by the hardware provider, the cloud provider has to be able to trust this information, i.e., there has to be a relationship of trust between cloud provider and hardware provider. In practice, the relationship of trust is established on a contractual basis. When subcontracting hardware providers, location and theeffective level of securityis defined in the contract signed by the hardware provider. However, provided hardware resources do not necessarily have to comply with the contractual requirements. For example, due to hardware failure the availability of hardware resources is lower that what was contracted. It is also possible that requirements for hardware resources may vary and are requested on demand. For example, hardware re- sources are highly available only when explicitly requested at the time when virtual resources are assigned, otherwise they have a lower availability. Therefore, for operation control, it is necessary that the cloud provider should have the capability to verify the hardware resource lo-

cation and theeffective level of security. Manual controls, i.e., inspecting each hosting site and their hardware resources physically, are not suitable for large cloud infrastructures. In partic- ular in global cloud scenarios there are multiple hosting sites established in multiple countries which have to be inspected individually by personnel being physically present. Additionally, hosting sites does not host exclusively for a single cloud provider but can have multiple cus- tomers. Thus, physical inspections by each customer are often not practical and, moreover, physical security may be undermined if physical access is frequently granted to externals. In addition, there exist IT security standards for the secure operation of hardware resources (e.g., Trusted Site Infrastructure [206], ISO/IEC 27001 [112]).

A better solution is for all information on location and theeffective level of securityto be provided and validated automatically, and instead of physically inspecting the hosting sites, the hosting sites security is implemented and certified according to IT security standards such as Trusted Site Infrastructure [206] and ISO/IEC 27001 [112]. Consequently, the question arises as to what technical possibilities exist to validate hardware resources’ location and aneffec- tive level of securityremotely and automatically. In the context of this thesis, the hardware resources’effective level of securitydepends on their capabilities to ensure confidentiality, in- tegrity, and availability. In the following, technical capabilities when it comes to remote and automated validation of confidentiality, integrity, availability, and location are discussed:

Confidentiality can be ensured remotely by transmitting only encrypted data and keeping the key for decryption secret. Data processing on encrypted data at the current state of the art is possible using homomorphic encryption schemes. They are, however feasible only for simple operations like computing sum and variance of numeric values [147]. Complex operations on encrypted data like program or virtual machine execution are still beyond the state of the art. Therefore, data has to be decrypted at remote locations to enable data processing. For that reason, hardware resources at remote locations have to be able to protect decrypted information from disclosure, and the effectiveness of enforcing non-disclosure has to be attested remotely. Here, it is possible to ensure trusted computing in cloud infrastructures by using a trusted hypervisor [79]. In particular, trusted hypervisors can be utilised to ensure confidential data processing on virtual resources by controlling access to virtual resources and enforcing the encryption of virtual storage [180, pp. 19-26]. Further, trusted hypervisors support remote attestation of executed virtual resources and software [79] [180, pp. 16-19], which can be utilised to validate whether there was access to confidential virtual resources and they were operating correctly. This information can be used to validate whether confidentiality has been ensured at remote locations, and particularly, to detect unauthorised access to virtual resources [80].

Integrity is difficult to ensure remotely since existing methods on integrity protection ad- dress detection and correction of modifications but do not prevent the processing of modified data (cf. Section4.2.3.1). Therefore, hardware resources at remote locations have to be able to protect the integrity of virtual resources (e.g.,ECC[94] and cryptographic hashes [59]). Fur- ther, it is possible to validate integrity by using cryptographic hash functions in combination with signature schemes reliably (e.g.,Digital Signature Algorithm (DSA)[152]). Using trusted hypervisors as well, the integrity of virtual resources, executed software and processed data at remote locations can be attested remotely [79] [180, pp. 16-19].

Availability is also difficult to ensure remotely since controlling availability requires phys- ical access to the hardware resource. Therefore, the availability of hardware resources has to be ensured at the remote location (i.e., by the hardware provider). A possible strategy to address this issue remotely is to introduce redundancy where the use of multiple hardware resources ensures the operation of specific virtual resources (e.g., distributed storage replication [124]). This can help to ensure the availability of virtual resources but does not help to ensure the availability of individual hardware resources. However, the availability of a specific hardware resource can be validated remotely by measuring its uptime and downtime based on possible remote access and calculating the asymptotic availability (cf. Def.5.43).

Location of hardware resources cannot be ensured remotely since physical control of the hardware resource is necessary. Further, determining the location of hardware resources re- motely is a widely investigated problem. In wired networks, existing approaches can be clas- sified into semantic-based and measurement-based. In semantic-based approaches, the infor- mation on the IP address is mapped to location information, for example by using the routing information and location information of reference hosts to locate clusters of IP addresses [160]. In measurement-based approaches, the round trip time is used to estimate the propagation de- lay and the resulting distance to so called ‘landmarks’ (i.e., hosts with known location), for example, Shortest Ping [226]. There also exist approaches using multiple landmarks, e.g., Constraint Based Geolocation (CBG)[91]. Further, there exist hybrid approaches which are semantic- and measurement-based, for example, 3-Tier Geolocation [218] which estimates the postal address of hosts by combining Constraint Based Geolocation, traceroute, and mapping IP addresses to postal codes. Semantic-based approaches are limited by the topographic neigh- bourhood of the IP addresses and do not apply to private address spaces.1 In virtual networks, private address spaces are used, and at the access network, gateways withNetwork Address Translation (NAT)are usually used, masking the connection endpoint in the virtual network. Measurement-based approaches are limited by the accuracy of measuring the propagation de- lay. Since the round-trip time is measured to estimate the propagation delay, the measurement is influenced by any delay that applies to the round-trip time. In virtual networks, the substrate network does not necessarily have the same topology as the embedded network. Therefore, additional delays are introduced by hidden routers and links in the substrate network. Further, the connection end-point does not necessarily have to be the host processing the data, since network relaying to the data processing host is possible. Then, the propagation delay after the connection end-point is indistinguishable from the processing delay of the back-end sys- tem. Nonetheless, measurement-based approaches can be accurate if sufficient landmarks are available and they are combined with semantic-based approaches – for example, 3-Tier Ge- olocationhas a mean error of less than 1 km [218]. An alternative approach to determining the location of hardware resources remotely is to let the hardware resources themselves pro- vide location information and validate the correctness of this information (e.g., by plausibility checks using measurement-based location determination like 3-Tier Geolocation). If hardware resources supportTPMit is possible to authenticate hardware resources uniquely by their cryp- tographic key [15]. In addition, the location of hardware resources withTPMsupport can be verified through physical inspection (particularly by authorised third parties), and it is possible

to reference these hardware resources in contracts.

To conclude, cloud providers can classify hardware resources’ thrustworthiness by confi- dentiality, integrity, availability, and location, since it is technically possible to verify the clas- sification remotely for each hardware resource. The key technology is the hardware resources’ support ofTPMwhich enables remote attention and authentication of hardware resources.