With the unprecedented demand for cloud computing, ensuring trust in the underlying environment is challenging. Applications executing in the cloud are prone to attacks of different types including malware, network and data manipulation. These attacks may remain undetected for a significant length of time thus causing a lack of trust. Untrusted cloud services can also lead to business losses in many cases and therefore need urgent attention. In this paper, we presentTrusted Public Cloud(TPC), a generic framework ensuring theZero-trustsecurity of client machine. It tracks the system state, alerting the user of unexpected changes in the machine’s state, thus increasing the run-time detection of security vulnerabilities. We validatedTPCon Microsoft Azure with Local, Software Trusted Platform Module (SWTPM) and Software Guard Extension (SGX)-enabled SWTPM security providers. We also evaluated the scalability ofTPCon Amazon Web Services (AWS) with a varying number of client machines executing in a concurrent environment. The execution results show the effectiveness ofTPCas it takes a maximum of 35.6 seconds to recognise the system state when there are 128 client machines attached.

The emergence of cloud computing allows users to execute their applications in a ubiquitous manner. Public cloud offers various ready-to-use services e.g. AWS EC2, Amazon RDS on a pay-per-use basis. Alongside these advantages, the cloud also brings a number of issues, for example offloading data for storage and computation may lead to privacy and security concerns. Also, it is not easy to guarantee the performance of the underlying system. With the increasing performance and security concerns, it is necessary to continuously monitor and evaluate the system and its performance. This can help us to quickly detect anomalies that can hinder system performance and/or make the system untrusted. In this paper, we present PERSECMON: performance and security-aware monitoring framework for continuous run-time monitoring in the public cloud environment. PERSECMON provides not only the system performance metrics but also the security measurements which can be used to analyse the system state at run-time. It uses the BCC/eBPF (BPF Compiler Collection/ Extended Berkeley Packet Filters) framework to instrument the system. PERSECMON is integrated with the open-source user interface framework, Kibana which provides a clear visualisation of the obtained metrics. To show the efficacy of our proposed work, we have developed a benchmarking case study using Bonnie++, Fibonacci Sequence and Netperf executed on Ubuntu Server 21.04. The results show that PERSECMON successfully captures relevant metrics that can be utilised in real-time to analyse the system performance. These metrics can further be accessed to detect the system state including memory leaks, queuing delay and remote access time which may lead to security or reliability events.

A method for quantifiably estimating the deforestation risk exposure of agricultural Forest Risk Commodities in commercial supply chains is presented. The model consists of a series of equations applied using end-to-end data representing quantitative descriptors of the supply chain and its effect on deforestation. A robust penalty is included for historical deforestation and a corresponding reward for reductions in the rate of deforestation. The INternational FOrest Risk Model (INFORM) is a method for data analysis that answers a particular question for any Forest Risk Commodity in a supply chain: what is its cumulative deforestation risk exposure? To illustrate the methodology a case study of a livestock producer in France who sources soya-based animal feed from Brazil and wishes to document the deforestation risk associated with the product is described and calculated. Building on this example a discussion of the future applicability of INFORM within emerging supply-chain transparency initiatives is made including describing clear shortcomings in the method and how it may also be used to motivate the production of better data by those that may be subject of its analysis.

With the deployments of fifth generation mobile networks (5G), rapid development of mobile internet, continued growth in mobile traffic and increased adoption of the internet of things, Multi-access Edge Computing (MEC) remains an inevitable critical future radio access network artefact for an optimized network. Network operators as part of their optimization exercise are also adopting Cloud Radio Access Network (C-RAN) to further improve network operation performance. Combining MEC and C-RAN makes the economics (OPEX + CAPEX) of both technologies more attractive and also enables network operators to support key 5G applications. This research investigates a major challenge of combining MEC + C-RAN: how to efficiently orchestrate cloud resources as a user moves within the edge environment without compromising the overall quality of service. This ongoing research adopts a machine learning technique in orchestrating resources efficiently in order for applications and services to adhere to stringent performance requirements even at geographically dispersed "edge" locations.

As the Industrial Internet of Things (IIoT) grows, systems are increasingly being monitored by arrays of sensors returning time-series data at ever-increasing 'volume, velocity and variety' (i.e. Industrial Big Data). An obvious use for these data is real-time systems condition monitoring and prognostic time to failure analysis (remaining useful life, RUL). (e.g. See white papers by Senseye.io, and output of the NASA Prognostics Center of Excellence (PCoE).) However, as noted by Agrawal and Choudhary 'Our ability to collect "big data" has greatly surpassed our capability to analyze it, underscoring the emergence of the fourth paradigm of science, which is data-driven discovery.' In order to fully utilize the potential of Industrial Big Data we need data-driven techniques that operate at scales that process models cannot. Here we present a prototype technique for data-driven anomaly detection to operate at industrial scale. The method generalizes to application with almost any multivariate dataset based on independent ordinations of repeated (bootstrapped) partitions of the dataset and inspection of the joint distribution of ordinal distances.

Summary In Autumn 2013, we—an international team of climate scientists, computer scientists, eScience researchers, and e‐Infrastructure specialists—participated in the enlighten your research global competition, organized to showcase advanced lightpath technologies in support of state‐of‐the‐art research questions. As one of the winning entries, our enlighten your research global team embarked on a very ambitious project to run an extremely high resolution climate model on a collection of supercomputers distributed over two continents and connected using an advanced 10 G lightpath networking infrastructure. Although good progress was made, we were not able to perform all desired experiments due to a varying combination of technical problems, configuration issues, policy limitations and lack of (budget for) human resources to solve these issues. In this paper, we describe our goals, the technical and non‐technical barriers, we encountered and provide recommendations on how these barriers can be removed so future project of this kind may succeed. Copyright © 2016 John Wiley & Sons, Ltd.

The cloud computing ecosystem is in urgent need of effective and practical trust establishment schemes. Cloud customers currently lack approaches to effectively verify the genuine behaviours of cloud services. They can only blindly believe that the Cloud Service Providers (CSPs) are honest enough to not tamper with their data, while many others have avoided using the cloud entirely. Trust establishment schemes, such as cloud auditing and cloud attestation systems, lack controls and transparency over their trust building processes, which only blur the effectiveness of the proclaimed trustworthiness. We argue that these problems ultimately result from the CSPs' autocratic governance over all the activities inside the cloud. In this paper, we present a Separation-of-Powers (SoP) model by referencing the similar concepts from the discipline of the political philosophy. We define three independent roles to separate the powers of definition, enforcement, and inspection from the CSPs. These roles form the collaborative-restrictive relationship to facilitate trustworthy cloud services and achieve the balance-of-powers. We believe a model of this kind will open new opportunities for achieving trustworthy and open cloud ecosystem governance.

climateprediction.net has traditionally been an activity that requires a large amount of computing resources from its volunteer network, whilst allowing a time-frame of weeks to months for simulations to be returned for each project. However, there is an increasing trend of projects requiring results in shorter and shorter timescales. Under no project is this clearer than in the World Weather Attribution (WWA) initiative, where we are aiming to provide in near to real-time an answer to how anthropogenic climate change has altered the frequency of occurrence of a particular type of extreme weather event, either as it happens or as soon after as is practical. As such we need the ability to run simulations on alternate resources when volunteer resources will not provide results within the necessary timeframe. This paper describes a workflow to distribute ensembles of climateprediction.net simulations in the Amazon Elastic Compute Cloud, to provide urgent compute capability for projects such as WWA. We propose a method of optimizing the use of cloud resources to minimize cost while maximising throughput. A case study is presented to provide a proof of concept of this methodology. As such, this is a clear example of beneficial utilisation of cloud resources to supplement those available through our volunteer community.

Within the Environmental 'omics community Bio-Linux is a widely used tool. This has the advantage of providing in a single deliverable package all necessary software and tools to support common analyses. With the growth in data volumes within the community and increasing constraints on user access and control over their own desktops an alternative delivery method of Bio-Linux and, in future, the Docker container environment is necessary. Within the EOS Cloud project we have constructed a Desktop as a Service system to centrally host virtual machines with these tools preconfigured and maintained. To enable efficient use of the resources we have enabled user controlled resource scaling so that users are able to utilise small scale VMs for task configuration and data manipulation and boost to a larger scale to run analysis applications all the while maintaining the user environment in a consistent manner. Alongside this within the project we have been developed tools to simplify the increasingly popular Docker software usage model. This includes ensure uniformity of behaviour between the host system and the running Docker container. Within the invitation only trial user community we identify two different exemplars groups and explain their usage and how the products and services developed within the project are useful for them. We conclude discussing the useful nature of Desktop as a Service, how it is of great benefit to the bioinformatics community but could also be of great use elsewhere, where the need for a stable user environment with applications already available that do not rely on local ICT support.

This paper details the state of the art, the design, development and deployment of the EGI Federated Cloud platform, an e-infrastructure offering scalable and flexible models of utilization to the European research community. While continuing support for the traditional High Throughput Computing model, the EGI Cloud Platform extends its reach to other models of utilization such as long-lived services and on demand computation. Following a two-year period of development, the EGI Federated Cloud platform was officially launched in May 2014 offering resources provided by trusted academic and research organisations from within the user communities and consistently with their standard funding regime. Since then, the use cases supported have significantly increased both in total number and diversity of model of service required, validating both the choice of enforcing cloud technology agnosticism and of supporting service mobility and portability by means of open standards. These design choices have also allowed for the inclusion of commercial cloud providers into an infrastructure previously supported only by academic institutions. This contributes to a wider goal of funding agencies to create economic and social impact from supported research activities.

Cloud Computing provides an optimal infrastructure to utilise and share both computational and data resources whilst allowing a pay-per-use model, useful to cost-effectively manage hardware investment or to maximise its utilisation. Cloud Computing also offers transitory access to scalable amounts of computational resources, something that is particularly important due to the time and financial constraints of many user communities. The growing number of communities that are adopting large public cloud resources such as Amazon Web Services [1] or Microsoft Azure [2] proves the success and hence usefulness of the Cloud Computing paradigm. Nonetheless, the typical use cases for public clouds involve non-business critical applications, particularly where issues around security of utilization of applications or deposited data within shared public services are binding requisites. In this paper, a use case is presented illustrating how the integration of Trusted Computing technologies into an available cloud infrastructure -- Eucalyptus -- allows the security-critical energy industry to exploit the flexibility and potential economical benefits of the Cloud Computing paradigm for their business-critical applications.

The national grid service (NGS) provides access to compute and data resources for UK academics. Currently users are required to have an X.509 certificate from the UK e-science certification authority (CA) or one of its international peers to access the NGS. The CA must satisfy the requirements for internationally agreed assurance levels and some users find the processes of obtaining and managing certificates difficult. Shibboleth, an implementation of federation identity based authentication, has been widely deployed in academic environments in the UK. The SARoNGS project, was proposed to integrate the Shibboleth and X.509 based infrastructures, to deliver a production level service for accessing the NGS in a user friendly way. This paper describes an architecture by which users are authenticated by the UK access management federation to acquire low assurance credentials to access Grid resources on the NGS. Users can login to NGS resources via NGS portal, using their local institution's authentication system.

Linking up two projects that are dedicated to facilitate the work of documentary scholars, this paper presents image processing algorithms tailored to the study of ancient documents and how they have been made available to the users through a portal that calls upon a web-service exploiting grid computational power. To that end, image processing algorithms were wrapped to fit into the National Grid Service (NGS) Uniform Execution Environment; the data model of an existing Virtual Research Environment (VRE-SDM) was extended; JSR-168 compliant portlets were developed to facilitate secure and seamless distributed image analysis; and a GridSAM interface between the portal and the NGS-installed algorithms was developed. The outcomes of the project include: a web-based application, a proof of concept for the usability of the VRE-SDM platform, an opportunity for wider dissemination for the image processing algorithms, and a proof of feasibility for the use of the NGS for Humanities applications.

Abstract Many production Grid and e‐Science infrastructures have begun to offer services to end‐users during the past several years with an increasing number of scientific applications that require access to a wide variety of resources and services in multiple Grids. Therefore, the Grid Interoperation Now—Community Group of the Open Grid Forum—organizes and manages interoperation efforts among those production Grid infrastructures to reach the goal of a world‐wide Grid vision on a technical level in the near future. This contribution highlights fundamental approaches of the group and discusses open standards in the context of production e‐Science infrastructures. Copyright © 2009 John Wiley & Sons, Ltd.

The Condor matchmaker provides a powerful mechanism for matching together both users job requirements and resource providers requirements in such a manner that not only is a paring selected which satisfies both requirements but is optimal for both. This has made the Condor system a good choice for use as a meta-scheduler within the Grid. Integrating Condor within a wider Grid context is possible but only through modification to the Condor source code. Here we describe how the standards for job submission and resource descriptions can be integrated into the Condor system to allow arbitrary Grid resources which support these standards to be brokered through Condor.

This paper presents work undertaken to integrate the future UK national Shibboleth infrastructure with the UK's National Grid Service (NGS). Our work, ShibGrid, provides both transparent authentication for portal based Grid access and a credential transformation service for users of other Grid access methods. The ShibGrid support for portal-based transparent Grid authentication is provided as a set of standards-based drop-in modules which can be used with any project portal as well as the NGS project in which they are initially deployed. The ShibGrid architecture requires no changes to the UK national Shibboleth authentication infrastructure or the NGS security infrastructure and provides access for users both with and without UK e-Science certificates. In addition to presenting both the architecture of Shib- Grid and its implementation, we additionally place the ShibGrid project within the context of other efforts to integrate Shibboleth with Grids.

With the increasing cost of providing computing and storage facilities for research capability, it has become important that universities make increasingly efficient use of their existing resources. The strategy developed at the University of Bristol has involved the design and construction of a campus grid. This has enabled better utilization of spare capacity on available systems connected to the grid and also the separation, for the first time, of those applications that require parallel compute resources (i.e. closely coupled systems) and those that require serial resources. The overall implementation of this strategy was driven by two prime considerations. Firstly, the contributing cluster systems are, in the main, very heavily used and connecting them onto the grid must be done in a non-invasive way to ensure currently executing applications don't have to be interrupted or any other cluster operations compromised. Secondly, the grid has been considered by many scientific users to be over hyped. This implied that we needed to get a system up and running quickly however 'simple' it was to prove the concept was viable. It was hoped that involving real users at an early stage of the grid's construction would lead to them evangelising about the system and thus, encourage more users to use the system.