Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Enhancing cloud security with context-aware usage control policies

: Jung, Christian; Eitel, Andreas; Schwarz, Reinhard

Kaiserslautern, 2014, 12 pp.
IESE-Report, 046.14/E
Reportnr.: 046.14/E
Fraunhofer IESE ()
security; security policy; data usage control; usage control; usage control security; KoSiUX; policy enforcement; cloud security; IND²UCE; SECCRIT

Cloud environments strongly rely on virtualization infrastructure that provides virtual resources by abstracting from the physical hardware. Thus, cloud providers can cost-efficiently share physical hardware among multiple tenants, and a single virtual resource may span multiple physical resources at different geo-locations. From a tenant's perspective, the uncertainty about location and context of virtual resources is a potential security threat. For instance, tenants may want to enforce geo-fencing to prevent their applications and data from migrating to undesirable jurisdictions, untrusted co-tenants, or dubious locations. They may also want to ensure that certain virtual resources share (or expressly do not share) a common physical resource, for example, to improve fault tolerance or performance. To tackle these problems, we suggest a flexible policy decision and enforcement framework for enabling usage control in cloud environments. In support of this framework, we collect additional information from the cloud environment to enforce context-aware and therefore more fine-grained usage control policies. Our solution offers flexible controls for secure and resilient cloud management. The paper presents our policy enforcement framework IND2UCE and its extension to enable context-ware policy enforcement on an exemplary cloud infrastructure using VMware products.