Architectural concept
TREDISEC aims to design, implement and deploy a set of security properties and solutions (in the form of security primitives) related to security and privacy in cloud (e.g. secure storage, access control, secure deletion, etc.). More in particular, the core feature of the proposed security primitives is that they do not only preserve the security and privacy of providers and TREDISEC users but also improve efficiency and cost effectiveness of the cloud systems where they are deployed.
Initially, there were identified three different architectures that we could use for providing security for the Cloud: security-as-a-service, end-to-end security and an hybrid approach as a combination of both. After analysing these approaches we thought end-to-end security is the best strategy in order to increase the security of the systems so they are the basis for the security primitives to be designed and developed in the project and provided by the TREDISEC Framework.
The TREDISEC Architecture has been designed in order to fulfil all the requirements identified in the first stage of the project while providing user-friendly functionalities for the creation, management and use of the security primitives.
The TREDISEC Framework
The TREDISEC Framework is a component that allows the creation, use, management and deployment of security primitives in a target cloud. It provides an online packaging of security primitives to be used by the different roles identified (End-User, Security Expert Engineer, TREDISEC Framework Administrator and the Security Technology Providers) together with tools for specific functionalities (e.g. user interface for managing it, testing and deployment component for testing the security primitives and do their deployment, etc.).
The framework offers three operational modes: development, maintenance and provisioning. The first covers the design, development and testing of the security primitives along its lifecycle (from security primitive pattern to TREDISEC Recipe), the maintenance mode covers the functionality and lifecycle of the update, refining, extension, etc. of the different artefacts of TREDISEC. Finally, the deployment phase covers the functionality and lifecycle of the TREDISEC Recipes into the target cloud.
Development mode
This mode covers the phases of creation of the security primitives, the TREDISEC Recipes, their testing and preparation. Here, both the Security Expert and the Security Technology Provider participate, using and creating different artefacts of the security primitives, which are described in the next section.
Maintenance mode
In this mode the Security Technology Provider is able to modify a security primitive in order to solve an error, unexpected behaviour, add new functionalities, create a new composition of security primitives or add a new implementation of the security or performance solution provided by the security property, etc.
Provisioning mode
The Provisioning Mode refers to the process of applying a security primitive to the targeted Cloud for its use. These artefacts are deployed and configured in a semi-automatic way according to the parameters specified by the user for each particular instantiation (system under development).
Security Primitives
The Security Primitive artefact describes a security solution in a cloud system together with performance capabilities. Due to the constraints and different characteristics that this artefact has to provide, represent and the different implementations it can have (together with the specific configurations) we have designed an architecture (see Figure 4) for the security primitives that cover all their requirements defined in the project.
There are different phases associated to the security primitives from their initial design and definition till they are deployed into a cloud system, the so-called Security Primitives Lifecycle depicted in Figure 5. Two roles interact mainly in this lifecycle: the security expert engineer and the security technology provider.
The initial and basis artefact, the security primitive pattern, is created by the security expert engineer using the TREDISEC Framework, her expertise, knowledge, and security and performance cloud information. This way she creates a security solution for a cloud system (together with performance capacities) and stores it in the repository of the security primitives of the framework.
Following, the security technology provider obtains a security primitive and provides an implementation along with specific information of the implementation (refining information already provided by the security technology provider about the solution but in a more high-level) and also information of the cloud system where this security primitive is targeted to. The result of this process is the security primitive implementation, which is also stored in the repository of the TREDISEC Framework. Next, this artefact is tested in the testing environment, which reproduces the cloud system, characteristics and requirements of the targeted cloud system where the security primitive will be used, and the security technology provider updates and refines it. Also, if necessary, the security technology provider can send feedback to the security expert engineer if an update is necessary at a higher level.
Finally, when the security primitive implementation has been tested it is stored in the TREDISEC Framework as a TREDISEC Recipe, which not only contains the implementation of the security primitive but also information for deployment, requirements, etc. in the targeted cloud.
More details about the TREDISEC architecture can be found in deliverables D2.3 and D2.4