Quantum transition reached a new level of importance since NIST standardized post-quantum cryptographic algorithms in late 2024. Consequently, several studies addressed the required changes in existing technologies and systems embracing post-quantum algorithms to face an imminent quantum threat. Cloud-based environments are no different, especially when assuring correct authentication and authorization. We address the usage of post-quantum primitives embedded in identitymanagement systems, a crucial entity inside distributed systems. Our proposal is based on SPIFFE / SPIRE, an open-source framework for secure identity production, integrating postquantum and classical primitives in a hybrid manner. Moreover, we discuss using X.509 certificates as part of our infrastructure and their performance, combining different digital signature algorithms.

Cloud computing has become the dominant choice for hosting various systems and services, with substantial public cloud service spending growth. This trend has extended to blockchain technology, which offers decentralized solutions for diverse applications. Concurrently, there is an increasing focus on business models incorporating Environmental, Social and Governance (ESG) aspects. One such initiative is Carbono21, a platform generating tokens in response to reforestation actions and the carbon credit market. In this context, this article examines the performance aspects of generating Non-Fungible Tokens (NFTs) in a blockchain environment under stress conditions. The Hyperledger Caliper was the benchmark tool used in experiments conducted to analyze the blockchain’s resilience and stability. Linear regression models showed a strong positive correlation between memory usage and total transactions. These results highlight the need for precise resource sizing and robust monitoring mechanisms to prevent service degradation under high transaction loads.

Container orchestration platforms are essential for deploying microservices, yet their impact on security-intensive workloads remains largely misunderstood. This work presents a systematic performance comparison of SPIFFE-based identity artifacts across Docker Compose and Kubernetes, evaluating four identity modes through fine-grained instrumentation of token minting and validation operations. Our results reveal orchestration overhead depends critically on connection management: operations employing connection pooling exhibit minimal overhead (0.8-4.9 %), while repeated connection establishment incurs substantial penalties (up to 26.6%). Kubernetes demonstrates 2-10x higher performance variability than Docker Compose, indicating platform selection affects predictability beyond mean latency. These findings, obtained using minimal Container Network Interface (CNI) configuration, represent a conservative baseline for production deployments and provide empirical guidance for platform selection and security architecture design.

We present a cloud-native, end-to-end pipeline that unifies automated attack generation with a modular LLM-as-a-Judge, supports static/adaptive corpora across open and proprietary models, enables calibrated multi-judge consensus, and emits audit-ready cost/latency telemetry-addressing gaps from non-cloud-native scripts, decoupled attack/judgment, and single-judge bias. Evaluated under two budgets (MAX_PROMPTS$=10,32)$on three targets-Llama 3.3 70B Instruct, Mix-tral$8\times 7\mathrm{B}$Instruct, DeepSeek-V3-ASR spans 0-37.5% (10) and 0-26.6% (32); judge accuracy ranges from 92.93% (open Llama 3.3 70B Instruct) to 98.94% (proprietary GPT-4o); mean judgment latency is 1.2-5.6 s$\text { (GPT-4o DeepSeek-V3) }$; and unit cost is $0.10-$2.18 per lk adjudications$(\text{Mixtral}8\times 7\mathrm{B} \rightarrow \text{GPT}-40)$. These results motivate a tiered policy-lightweight open-family judges for high-throughput triage and cross-family/ensemble judges for low-confidence cases-offering a practical blueprint for continuous, auditable adversarial eval-uation of LLM alignment at cloud scale.

Service identities are crucial for authentication and access control, ensuring that only authorized services access specific resources. The SPIFFE framework addresses workload identity management and authentication effectively but needs support for solutions (e.g., extensible tokens) that fine-granular authorization mechanisms in distributed scenarios can use. In this context, we present the Lightweight SVID (LSVID), an identity document in JSON format that can be extended and used as a token. As an extensible token, Lightweight SVID (LSVID) enables features such as delegation, attenuation, and traceability, enhancing its flexibility and applicability. Our approach provides efficient handling of token extensions and validations, demonstrated through a proof-of-concept implemented in Go. Baseline results indicate that LSVID critical operations are efficient, with processing times in the microsecond range, offering significant functional advantages over the traditional JWT-SVIDs, one of two key security documents from SPIFFE.

The use of private or consortium blockchains in organizations’ applications is growing. A relevant aspect of blockchains is the choice of consensus mechanism. This decision delimits which blockchain solutions are suitable for the private scenario. Once the consensus mechanism is chosen, more than one blockchain may be enabled. However, this decision making is not trivial and requires detailed experimental indicators about algorithms and blockchains performance. In this context, we provide a comprehensive performance analysis of the Raft consensus mechanism based on its implementation in Hyperledger Fabric and Ethereum blockchain solutions. We performed our experiments on an OpenStack private cloud using each blockchain developer’s default settings for virtual machines. Our findings show how the implementation of each solution can impact the application’s performance under certain conditions.

The popularization increase of MMORPGs demands new technological approaches to supply users’ requirements with a lower cost of computational resources. Designing these architectures, from the network point of view, is relevant and impacts these games’ success. We analyze and identify the computational resources consumed by the architectures Rudy, Salz, and Willson, which are microservices architectures elaborated for MMORPGs. These architectures were analyzed and tested using automated clients on the architectures deployed in our private computational cloud to identify resource bottlenecks. We conclude the performance, from the point of view of response time, is related to better use of CPU, either by data storage microservices or by data processing microservices. In addition, the application of queuing systems or barriers to manage access or minimize the consumption of an internal service proved feasible, directly impacting the flow of data through the architecture.

A contemporaneous data center (DC) hosts multiple competitive network data flows from different applications, sharing the intermediate switches capacities. In this context, congestion control and avoidance on Transmission Control Protocol (TCP) are critical tasks to ensure the quality of service for hosted applications. Specifically, Software Defined Networking (SDN) created an opportunity to avoid congestion once the centralized controller can gather ongoing and historical information from all network switches and flows. However, the data gathered is enormous, and fast-computing algorithms are crucial for decision-making. In this sense, this work proposes Reinforcement Learning- and SDN-aided Congestion Avoidance Tool (RSCAT), which uses data classification to determine if the network is congested and actor-critic reinforcement learning to find better TCP parameters. Our experimental analysis shows RSCAT could decrease the Flow Completion Time (FCT) of DCTCP and CUBIC variants in several cases without requiring any software update on DC end-points.

Network management on multi-tenant container-based data center has critical impact on performance. Tenants encapsulate applications in containers abstracting away details on hosting infrastructures, and entrust data center management framework with the provisioning of network Quality-of-Service requirements. In this paper, we propose a network-aware multi-criteria container scheduler to jointly process containers and network requirements. We introduce a new Mixed Integer Linear Programming formulation for network-aware scheduling encompassing both tenants and providers metrics. We describe two GPU-accelerated modules to address the complexity barrier of the problem and efficiently process scheduling requests. Our experiments show that our scheduling approach accounting for both network and containers outperforms traditional algorithms used by containers orchestrators.

Summary The adoption of infrastructure as a Service (IaaS) is a reality for academic, industrial, and governmental institutions. Cloud tenants request dynamically provisioned virtual infrastructures (VIs) tailored to their application requirements, detailing not only the virtual compute/storage resources but also the network components, topology, and services. The creation of a large number of cloud providers came along with the widespread use of VIs. The selection of an appropriate provider is a challenging task due to the diversity of the IaaS market and formally is a multicriteria analysis (NP‐hard). Notwithstanding the provider selection complexity, the mobility of VI‐hosted applications is limited due to the optimization anchors introduced by providers. Although the existing IaaS cloud brokers can indicate a hosting provider, they lack on conceptual and technical skills to migrate a VI and all its internal components between providers. This work enhances the state‐of‐the‐art on IaaS cloud brokerage by proposing virtual infrastructure multicriteria allocation and migration–based broker (VIMAM), which performs a multicriteria analysis of providers and VI migration. VIMAM is driven by an analytic hierarchy process (AHP) to select an IaaS provider, offering a set of predefined weighting schemas to represent distinct tenant perspectives. Moreover, to migrate a VI, VIMAM takes into account the virtual machines, containers, switches, and other topology elements. In addition to discussing the AHP ranking weights and frequency of providers selection, the experimental analysis details the implementation of an OpenStack and Docker–based prototype for VI migration.

The installation and configuration of cloud environments has increasingly become automated and therefore simple. For instance, solutions such as RedHat RDO and Mirantis Fuel facilitate the deployment of popular computational clouds like OpenStack. Despite the advances in usability, effort is still required to create and manage multiple users. This is of particular relevance when dealing with sensitive information, a somewhat common case for private clouds. To alleviate this burden, many clouds have adopted federated Single Sign-On (SSO) mechanisms for authenticating their users in a more transparent manner. In this work we analyze the practical security of an OpenStack IaaS cloud when combined with either OpenID Connect (using Google as IdP) or Facebook Connect (using Facebook as IdP). The criteria used in the analysis comprise the ability to provide data encryption, the risks involved in the use of an external IdP, and improper access control. We identify potential issues regarding these solutions and we propose approaches to fix them.

The cloud computing paradigm consolidated the on-demand provisioning of virtual resources. However, the diversity of services, prices, data centers, and geographical footprints, have turned the clouds into a complex and heterogeneous environment. There are several IaaS providers differentiated by the provisioning costs and availability figures. Due to management complexity, the survivability and reliability aspects are often disregarded by tenants, eventually resulting in heavy losses due to unavailability of services that are hosted on Virtual Infrastructures (VIs). We present an alternative to improve VIs survivability and reliability, which considers the use of replicas and the spreading of virtual resources atop providers, regions, and zones. Replicas are used to achieve a user-defined reliability level while the controlled spreading of VI components decrease the probability of full outages. In addition, our proposal performs a cost-effective allocation. We formulate the VI allocation with survivability and reliability requirements as a Mixed Integer Program (MIP). Following, binary constraints are relaxed to obtain a Linear Program (LP). The LP solution is given as input for the simulated annealing technique, composing the Reliable and Survivable Virtual Infrastructure Allocation (RS-VIA) mechanism. Simulation results with different reliability requests indicate an increasing in survivability without inflating costs.

The cloud computing model enables users to view computational resources as unlimited and that can be dynamically reserved. In addition, users are charged according to a contracted configuration and effective reservation time. Thus, it became possible to dynamically provision Virtual Infrastructures (VIs) composed of virtual machines, containers and virtualized network resources. Due to the flexibility in resource provisioning and configuration, VI is being increasingly adopted for hosting data storage services, development platforms and distributed applications. However, when migrating applications to a cloud, users are faced with a significant amount of providers, brokers and services offered. Above all, cloud computing technologies, although innovative, do not ease the migration of virtualized resources between distinct providers, inducing in vendor lock-in. A wide range of cloud providers, APIs, models and management tools further limit the development of VI migration solutions between providers, characterizing an open challenge. This work proposes a mechanism to perform VI migration among providers, based on an architecture agnostic to source and destination providers, as well as VI-hosted applications. In addition, a prototype based on Docker containers and OpenStack clouds was developed both to validate the proposed mechanism and to serve as a reference implementation.

Network configuration, performance, and congestion impact the Quality of Service (QoS) of Moodle Learning Management System (LMS). Moreover, LMSs composing modules have different QoS demands for each activity. Upon a network, they compete for resources with applications for social media, streaming, chat, cloud file synchronization, games, among others. Eventually, the network congestion can leave the LMS service unavailable for students and professors. Recently, the popularization of Software Defined Networks (SDN) revolutionized the network management. We propose SDN4Moodle, a toolset to increase the QoS of Moodle services. SDN4Moodle was implemented in conformity to Moodle's plugin guidelines, and it is controlled by internal Moodle events. Each action performed by a Moodle's user is dynamically translated into network forwarding rules, and switches configuration. Our experimental results indicates SDN4Moodle, an open-source system, efficiently achieves flows isolation and bandwidth control on shared networks.

The disparity between the bandwidth provided by modern processors and by the main memory led to the issue known as memory wall, in which application performance becomes completely bound by memory speed. Newer technologies are trying to increase memory bandwidth to address this issue, but the fact is that the effects of increasing bandwidth to application performance still lack exploration. This paper investigates these effects for scientific workflows focusing on the definition of a performance model and on the execution of experiments to validate the rationale for the model. The main contribution is based on two observations: memory bound applications benefit more from an increase to memory bandwidth, and the effects of improving bandwidth for a particular application gradually diminish as bandwidth is increased.

Virtualization of computing and communication infrastructures were disseminated as possible solutions for networks evolution and deployment of new services on cloud data centers. Although promising, their effective application faces obstacles, mainly caused by rigidity on the management of communication resources. Currently, the Software-Defined Networks (SDN) paradigm has been popularizing customization and flexibility in network management due to separation of control and data planes. However, benefits introduced by SDN are not trivially applied to Virtual Infrastructures (VIs) provisioning on SDN-based cloud providers. An allocation mechanism needs joint information of control and data planes in order to deliver Quality-of-Service (QoS)-aware mappings while achieving provider objectives. In this work, we formulate the online VI allocation on SDN-based cloud data centers as a Mixed Integer Program (MIP). Following, integer constraints are relaxed to obtain a linear program, and rounding techniques are applied. The mechanism performs VI allocation considering latency, bandwidth, and virtual machine requirements. The results indicate that the VIs mean internal latency can be reduced while simultaneously enforcing other QoS constraints.

Several Internet services require different pairs of usernames and passwords in order to authenticate their users. The password management process is time consuming and sus-ceptible to security issues. Moreover, cloud computing solutions already run into related problems. Single Sign-On is a way to handle all the multiple accounts that a user may have and OpenID Connect has a great adoption as a Single Sign-On solution. As well as OpenID Connect, OpenStack is growing as a cloud software due its large community and because its open source code. In this sense, our goal is to analyze the security aspects related to the usage of OpenID Connect, a single sign-on mechanism, in cloud computing solutions based on OpenStack using a external Identity Provider.

This paper presents the GreenHop solution, focused on energy and environmental monitoring in small and medium size Data Centers (DCs). The solution enables the DC administrator to monitor the DC PUE (Power Usage Effectiveness) and maintain the environmental parameters in compliance with standards and good practice guidances. The solution is applied in a case study, showing the consumption of the cooling equipment when setting the DC operating temperature on 18°C, 23°C, 25°C, and free cooling. Thus, we identified an improvement on PUE and reduction of power consumption as a result of the adoption GreenHop monitoring solution.

Workflows are used to represent applications in terms of the computational cost and the interdependencies of tasks. In parallel, clouds are a viable solution to execute complex applications in terms of performance and cost. This paper presents a cloud scheduling framework composed by multiple proactive phases that continuously compute and improve resource allocation and load distribution for workflow execution in cloud environments. The framework relies on a high-level characterization of resources and workflows to describe the capabilities provided by the infrastructure and the performance requirements to be met. Implementation and tests are based on the optimization of workflows executed on three scenarios: a private cloud, a hybrid cloud (private and public), and a multi-cloud setup. Results show improvement of run time performance compared to greedy approaches. Moreover, the framework is able to handle performance fluctuations, especially for long duration workflows.

The development of cloud computing services is speeding up the rate in which the organizations outsource their computational services or sell their idle computational resources. Even though migrating to the cloud remains a tempting trend from a financial perspective, there are several other aspects that must be taken into account by companies before they decide to do so. One of the most important aspect refers to security: while some cloud computing security issues are inherited from the solutions adopted to create such services, many new security questions that are particular to these solutions also arise, including those related to how the services are organized and which kind of service/data can be placed in the cloud. Aiming to give a better understanding of this complex scenario, in this article we identify and classify the main security concerns and solutions in cloud computing, and propose a taxonomy of security in cloud computing, giving an overview of the current status of security in this emerging technology.

The BitTorrent protocol is one of the most successful P2P applications, being largely studied by the research community. Nevertheless, studying the dynamics of a large BitTorrent network presents several challenges, such as difficulty in acquiring network traces or building measurement experiments. Evaluation through simulation is usually utilized for studying BitTorrent networks, yet only a few BitTorrent simulation models are available for the research community. In this article, we present an extensible framework for developing BitTorrent simulations, focusing on realism and without losing on scalability. We developed an accurate version of the protocol by analyzing the source code of mainstream BitTorrent clients and by discussing directly with their developers. The simulation model was developed with the OMNeT++ Framework, inheriting its high extensibility, and with the INET Framework, for accuracy of the underlying network model. We also took into account the effects of multitasking in our model, since BitTorrent applications acquires content from several sources simultaneously, and utilized real world traces for modeling the processing times. We present an analysis of our simulator regarding performance aspects and BitTorrent-related results.

Peer-to-peer (P2P) networks have in the past years become a very attractive method for delivery of media content over the Internet. Many factors have contributed to this success, but the low delivery costs and the inherent scalability of the P2P networks whereby consumers of content are also potential sources are among the most prominent ones. However, the effectiveness and performance of many popular P2P networks (such as BitTorrent based ones) is highly dependent on how well trackers select peers that will provide a content. The peers chosen by a tracker will directly affect the user-perceived performance of the service and the usage of network resources. Moreover, P2P networks have usually no locality awareness, resulting in sub-optimal utilization of network resources. In order to address these issues, we propose a novel hierarchical architecture for P2P locality targeted at managed P2P networks based on the BitTorrent protocol. We then show, through experimentation, that the adoption of the proposed architecture leads to significant network efficiency improvements without compromising end-user experience.

From the four basic functionalities of video delivery systems - linear TV, video on demand (VoD), time-shifted TV (tsTV), and network personal video recorder (nPVR) - most of today's solutions focus either on linear TV, or on VoD. While linear TV usually uses efficient distribution mechanisms such as multicast, VoD is often realized via centralized, bandwidth- inefficient unicast. Even when file sharing P2P algorithms are used for VoD or nPVR, they can not be applied to tsTV since they require the whole content to exist from the beginning. With this paper, we propose a novel solution that aims at offering all four functionalities in one distributed system. Our architecture uses multicast for the distribution of live content, and a modified P2P protocol for offering VoD, nPVR, and tsTV altogether.