TU Darmstadt / ULB / TUbiblio

A Trust-aware Framework for Evaluating Security Controls of Service Providers in Cloud Marketplaces

Habib, Sheikh Mahbub ; Varadharajan, Vijay ; Mühlhäuser, Max (2013)
A Trust-aware Framework for Evaluating Security Controls of Service Providers in Cloud Marketplaces.
Melbourne, Australia
doi: 10.1109/TrustCom.2013.58
Conference or Workshop Item, Bibliographie

Abstract

Trustworthy selection of cloud services has become a significant issue in emerging cloud marketplaces. As a consequence, the Cloud Security Alliance (CSA) has formulated a self-assessment framework for cloud providers to publish their cloud platform's security controls and capabilities. This framework enables consumers to select a cloud service based on the capabilities and controls published by the providers. However, a fundamental question that arises is, how can consumers trust that the security controls are satisfied as claimed by the providers and are compliant with consumers' requirements. This paper proposes a trust-aware framework to verify and evaluate these security controls considering consumers' requirements. First, we model the security controls in the form of trust properties. Then, we introduce a taxonomy of these properties based on their semantics and identify the authorities who can validate the properties. The taxonomy of these properties is the basis of trust formalisation in our proposed framework. The framework rests on the notion of hybrid trust that combines hard and soft trust mechanisms for verifying the trust properties. Furthermore, a decision model is proposed as an integral part of the framework in order to empower consumers to determine trustworthiness of cloud providers. Finally, we demonstrate that the proposed trust-aware security evaluation framework could be potentially useful in practice for consumers to determine trustworthy cloud providers in a competitive marketplace

Item Type: Conference or Workshop Item
Erschienen: 2013
Creators: Habib, Sheikh Mahbub ; Varadharajan, Vijay ; Mühlhäuser, Max
Type of entry: Bibliographie
Title: A Trust-aware Framework for Evaluating Security Controls of Service Providers in Cloud Marketplaces
Language: English
Date: July 2013
Publisher: IEEE
Book Title: Trust, Security and Privacy in Computing and Communications (TrustCom), 2013 12th IEEE International Conference on
Event Location: Melbourne, Australia
DOI: 10.1109/TrustCom.2013.58
Abstract:

Trustworthy selection of cloud services has become a significant issue in emerging cloud marketplaces. As a consequence, the Cloud Security Alliance (CSA) has formulated a self-assessment framework for cloud providers to publish their cloud platform's security controls and capabilities. This framework enables consumers to select a cloud service based on the capabilities and controls published by the providers. However, a fundamental question that arises is, how can consumers trust that the security controls are satisfied as claimed by the providers and are compliant with consumers' requirements. This paper proposes a trust-aware framework to verify and evaluate these security controls considering consumers' requirements. First, we model the security controls in the form of trust properties. Then, we introduce a taxonomy of these properties based on their semantics and identify the authorities who can validate the properties. The taxonomy of these properties is the basis of trust formalisation in our proposed framework. The framework rests on the notion of hybrid trust that combines hard and soft trust mechanisms for verifying the trust properties. Furthermore, a decision model is proposed as an integral part of the framework in order to empower consumers to determine trustworthiness of cloud providers. Finally, we demonstrate that the proposed trust-aware security evaluation framework could be potentially useful in practice for consumers to determine trustworthy cloud providers in a competitive marketplace

Uncontrolled Keywords: - SST: CASED:;- SST: CASED;- SST - Area Smart Security and Trust;SPIN: Smart Protection in Infrastructures and Networks;Cloud Security
Identification Number: TUD-CS-2013-0466
Divisions: 20 Department of Computer Science
20 Department of Computer Science > Telecooperation
Profile Areas
Profile Areas > Cybersecurity (CYSEC)
LOEWE
LOEWE > LOEWE-Zentren
LOEWE > LOEWE-Zentren > CASED – Center for Advanced Security Research Darmstadt
Date Deposited: 22 Jan 2017 18:57
Last Modified: 14 Jun 2021 06:14
PPN:
Export:
Suche nach Titel in: TUfind oder in Google
Send an inquiry Send an inquiry

Options (only for editors)
Show editorial Details Show editorial Details