Abstract The collaboration among different organizations is considered one of the main benefits of moving applications and services to a cloud computing environment. Unfortunately, this collaboration raises many challenges such as the access of sensitive resources by unauthorized people. Usually, Role-Based Access-Control (RBAC) model is deployed in large organizations. This paper addresses the scalability problem of the online stored rules. This problem affects the performance of the access control system due to increasing number of shared resources and/or number of collaborating organizations in the same cloud environment. Therefore, this paper proposes replacing the cross-domain RBAC rules with Role-To-Role (RTR) mapping rules among all organizations. The RTR mapping rules are generated using a newly proposed Role-Mapping algorithm. A comparative study is performed to evaluate the proposed algorithm’s performance with concerning the Rule-Store size and the authorization response time. According to the results, it is found that the proposed algorithm reduces the number of stored rules which minimizes the Rule-Store size and reduces the authorization response time. Additionally, this paper proposes applying a concurrent approach on the RTR mapping model using the proposed Role-Mapping algorithm to achieve more savings in the authorization response time. Therefore, it will be suitable in highly-collaborative cloud environments.

In PaaS model, providers have different proprietary APIs, which make developers locked inside a specific platform and not able to easily port their applications among different platforms. So, vendor lock-in problem appeared. One solution to this problem is to use generic APIs with specific adapters. However, any update in a PaaS specific-API makes its corresponding adapter is unusable which causes, what we call, API synchronization problem. Therefore, STAGER (SemanTic-based GenERation of Generic-API Adapters) framework is proposed. STAGER framework provides a semi-automatic adapter generation process, which generates specific adapters of generic APIs for PaaS services (e.g., blob storage and datastore services) for target PaaS platforms. The adapter generation process is based on semantic annotations of the generic APIs and their corresponding PaaS specific-APIs. In order to evaluate STAGER framework, two generic APIs for blob storage and NoSQL datastore services have been proposed. STAGER framework is used to generate the adapters of these generic APIs for two PaaS platforms: Google App Engine (GAE) and Windows Azure. Although there is some overhead for semantically annotating the PaaS APIs, the evaluation results prove the feasibility of STAGER framework and promote the usage of the generated adapters for implementing portable cloud applications.

The Virtual Design Advisor (VDA) has addressed the problem of optimizing the performance of Database Management System (DBMS) instances running on virtual machines that share a common physical machine pool. In this work, the search algorithm in the optimization module of the VDA is improved. The particle swarm optimization (PSO) heuristic is used as a controller of the greedy heuristic algorithm to reduce trapping into local optima. Our proposed algorithm, called Greedy Particle Swarm Optimization (GPSO), was evaluated using prototype experiments on TPC-H benchmark queries against PostgreSQL instances in Xen virtualization environment. Our results show that the GPSO algorithm required more computation but in many test cases have succeeded to escape local optima and reduced the cost as compared to the greedy algorithm alone.

Exploiting software vulnerabilities, such as stack overflow, heap overflow, and format string exploits, enables attackers to break into victim machines. Moreover, attackers tend to use obfuscation techniques, such as encryption, to evade intrusion detection systems. In this paper, we show that a common stack-overflow attack, namely the return-to-libc attack, coupled with a common defense, namely the Address Space Layout Randomization (ASLR), together allow for constructing a key-agreement protocol that allows two entities (e.g., a Trojan and a controller) to agree on a shared key, whereas the shared key can then be used to encrypt further communication. We have developed a prototype of our key-agreement protocol to evaluate its feasibility and performance. Our results show that both time and message overhead of our protocol are linear in key length. Although our key-agreement protocol can be used by attackers for malicious purposes, it has low computation overhead, making it a candidate for adoption in CPU-constrained platforms.