Healthcare enterprises are starting to adopt cloud computing due to its numerous advantages over traditional infrastructures. This has become a necessity because of the increased volume, velocity and variety of healthcare data, and the need to facilitate data correlation and large-scale analysis. Cloud computing infrastructures have the power to offer continuous acquisition of data from multiple heterogeneous sources, efficient data integration, and big data analysis. At the same time, security, availability, and disaster recovery are critical factors aiding towards the adoption of cloud computing. However, the migration of healthcare workloads to cloud is not straightforward due to the vagueness in healthcare data standards, heterogeneity and sensitive nature of healthcare data, and many regulations that govern its usage. This paper highlights the need for providing healthcare data acquisition using cloud infrastructures and presents the challenges, requirements, use-cases, and best practices for building a state-of-the-art healthcare data ingestion service on cloud.

Security and compliance auditing is expensive, time-consuming, and error-prone for cloud service providers operating in multiple domains. Existing approaches predominantly use formal logic and domain-specific languages to facilitate collection and validation of evidence needed for compliance certification. Such approaches do not sufficiently account for the uncertainties and challenges caused by human involvement, which are a major contributor to inefficiencies and mistakes in the audit process. We propose that hybrid approaches, in which formal, model-based approaches are combined with machine learning techniques to reason about evidence and historical audit data, are necessary to address such uncertainties. Such approaches can help both auditors and service providers better deal with uncertainties, and reduce costs, errors, and the manual effort required to identify evidence needed for compliance certification. We present a taxonomic framework for understanding the causes of and potential solutions to uncertainty in the audit process. We identify areas within evidence collection and validation in which machine learning can augment model-based techniques to reduce uncertainties. We provide some examples of hybrid approaches that we are exploring and discuss the need for more work in this area.

e era of Internet of ings with billions of connected devices has created an ever larger surface for cyber attackers to exploit, which has resulted in the need for fast and accurate detection of those attacks.e developments in mobile computing, communications, and mass storage architectures in the past decade have brought about the phenomenon of big data, which involves unprecedented amounts of valuable data generated in various forms at a high speed.e ability to process these massive amounts of data in real time using big data analytics tools brings along many bene ts that could be utilized in cyber threat analysis systems.By making use of big data collected from networks, computers, sensors, and cloud systems, cyber threat analysts and intrusion detection/prevention systems can discover useful information in real time.is information can help detect system vulnerabilities and attacks that are becoming prevalent and develop security solutions accordingly.Big data analytics will be a must-have component of any e ective cyber security solution due to the need of fast processing of the high-velocity, high-volume data from various sources to discover anomalies and/or attack patterns as fast as possible to limit the vulnerability of the systems and increase their resilience.Even though many big data analytics tools have been developed in the past few years, their usage in the eld of cyber security warrants new approaches considering many aspects including (a) uni ed data representation, (b) zero-day attack detection, (c) data sharing across threat detection systems, (d) real time analysis, (e) sampling and dimensionality reduction, (f ) resource-constrained data processing, and (g) time series analysis for anomaly detection.is special issue has attracted original contributions that utilize and build big data analytics solutions for cyber

With advances in cloud computing and the emergence of service marketplaces, the popularity of composite services marks a paradigm shift from single-domain monolithic systems to cross-domain distributed services, which raises important privacy and security concerns. Access control becomes a challenge in such systems because authentication, authorization and data disclosure may take place across endpoints that are not known to clients. The clients lack options for specifying policies to control the sharing of their data and have to rely on service providers which offer limited selection of security and privacy preferences. This lack of awareness and loss of control over data sharing increases threats to a client's data and diminishes trust in these systems. We propose EPICS, an efficient and effective solution for enforcing security policies in composite Web services that protects data privacy throughout the service interaction lifecycle. The solution ensures that the data are distributed along with the client policies that dictate data access and an execution monitor that controls data disclosure. It empowers data owners with control of data disclosure decisions during interactions with remote services and reduces the risk of unauthorized access. The paper presents the design, implementation, and evaluation of the EPICS framework.

When clients interact with a cloud-based service, they expect certain levels of quality of service guarantees. These are expressed as security and privacy policies, interaction authorization policies, and service performance policies among others. The main security challenge in a cloud-based service environment, typically modeled using service-oriented architecture (SOA), is that it is difficult to trust all services in a service composition. In addition, the details of the services involved in an end-to-end service invocation chain are usually not exposed to the clients. The complexity of the SOA services and multi-tenancy in the cloud environment leads to a large attack surface. In this paper we propose a novel approach for end-to-end security and privacy in cloud-based service orchestrations, which uses a service activity monitor to audit activities of services in a domain. The service monitor intercepts interactions between a client and services, as well as among services, and provides a pluggable interface for different modules to analyze service interactions and make dynamic decisions based on security policies defined over the service domain. Experiments with a real-world service composition scenario demonstrate that the overhead of monitoring is acceptable for real-time operation of Web services.

B2B (business-to-business) systems often use service-oriented architecture (SOA) with decomposed business services. These services can interact and share data among each other. Service might use a cloud – hosted database, such as a non - relational encrypted key – value store. However, the cloud platform hosting the database can be untrusted. Data owner needs to be sure that each service can access only those segments of a shared database for which the service is authorized. Furthermore, data requests can come from a service also hosted by untrusted cloud. Hence, there is a need for designing a cloud enterprise framework that can ensure privacy-preserving data dissemination in SOA and accurately detect data leakages. We design and prototype a solution that ensures privacy – preserving dissemination of data. The solution is based on (a) role-based access control, (b) cryptographic capabilities of client's browser, (c) authentication method, (d) subject's trust level. The prototype enables privacy – preserving dissemination of Electronic Health Records (EHRs) hosted in an untrusted cloud.

Consumer ratings are widely used in online marketplaces-helping vendors in assessing the quality of offerings and consumers in discovery and purchase decisions. To build trust in a marketplace, which has a direct impact on sales, an accurate assessment of ratings is essential in determining the quality of offerings. This paper proposes novel extensions to consumer Rating as a Service (RaaS)-a rating management service providing consumer rating functionality to a marketplace using hierarchical aggregation, which is a rating aggregation mechanism using hierarchical relationships of components to evaluate composite offerings. Contributions include the optimization of RaaS design for Web-scale, the integration of consumer credibility in hierarchical aggregation, and the application of hierarchical aggregation to existing independent atomic offerings. Various experiments are conducted to demonstrate the practicality of RaaS and correctness of hierarchical aggregation using real ratings from Amazon.com.

Cloud-based analytics allow for inexpensive processing of large amount of data. However, processing protected health information (PHI) in cloud is a challenging task due to strict regulations (e.g., HIPAA) requiring features (e.g., data isolation) which most cloud-based platforms do not currently support in their offerings. This makes it difficult to leverage many technologies well suited to the cloud (e.g., Apache Spark)to process PHI. To address this issue, we have developed the Watson Health Cloud (WHC), a cloud-based platform for the storage and analysis of large amount of PHI. The WHC enables all the features necessary to store and process PHI, with little customization needed by the end-user. This paper describes the lessons learned from developing a cloud platform for PHI. Specifically, we discuss the architecture and implementation challenges we faced throughout development. We hope the insights gained from our experiences help others when designing frameworks and applications which process PHI.

This paper addresses privacy issues in managing electronic health records by a third party cloud based service. Compared to traditional authentication-authorization mechanisms, the proposed approach minimizes the leakage of identity information of involved participants through unlinkability. Furthermore, it gives the ability to health record owners for making access control decisions. This solution employs an identity management scheme that enhances consumer privacy by preventing consumer profiling based on the credentials used to satisfy the service provider policies. The paper proposes a set of mechanisms to allow authenticated unlinkable access to electronic health records, while giving the record owners ability to make access control decisions. The security evaluation for accessing data in the cloud is detailed, and the implementation of the system is evaluated in this paper.

Service-oriented Architecture (SOA) comprises a number of loosely-coupled independent services, which collaborate, interact and share data to accomplish incoming requests. A service invocation can involve multiple services, where each service accesses, processes and shares the client's data. These interactions may share data with unauthorized services and violate client's privacy. The client has no means of identifying if a violation occurred because it has no control over the service invocations beyond its trust domain. Such interactions introduce new security challenges which are not present in traditional systems. This paper proposes a data-centric approach for privacy preserving access control in SOA. Benefits of the proposed approach include the ability to dynamically define access polices by the clients and control data access at the time of each service interaction. A realistic healthcare scenario is used to evaluate the implementation of the proposed solution which validates its viability.

The rise of the mobile-cloud computing paradigm has enabled mobile devices with limited processing power and battery life to achieve complex tasks in real-time. While mobile-cloud computing is promising to overcome limitations of mobile devices for real-time computing needs, the reliance of existing models on strong assumptions such as the availability of a full clone of the application code and non-standard system environments in the cloud makes it harder to manage the performance of mobile-cloud computing based applications. Furthermore, offloading mobile computation to the cloud entails security risks associated with sending data and code to an untrusted platform and perfect security is hard to achieve due to the extra computational overhead introduced by complex mechanisms. In this paper, we present a dynamic computation-offloading model for mobile-cloud computing, based on autonomous agent-based application partitions. We propose a dynamic tamper-resistance approach for managing the security of offloaded computation, by augmenting agents with self-protection capability using a low-overhead introspection and integrity-preserving communication mechanism. Experiments with a real-world mobile application demonstrates the effectiveness of the approach for high-performance, tamper-resistant mobile-cloud computing.

With the wide availability of products and services through popular e-commerce platforms and dozens of similar offerings to choose from, there is a need to accurately assess and evaluate the quality of offerings. Several studies have shown that consumer feedback is an important source of information. This paper presents: (a) consumer Rating as a Service (RaaS) -- a building block service that can be used to add the consumer feedback lifecycle feature in the development of e-commerce platforms, (b) an approach to evaluate the quality of composite offerings based on the aggregation of consumer ratings using the composition structure and component relationships. Benefits of the proposed service include reduced development effort, shorter delivery time and a fine-grained aggregation of consumer ratings for composite offerings even with limited ratings.

Service-Oriented Architecture (SOA) is becoming a major paradigm for distributed application development in the recent explosion of Internet services and cloud computing. However, SOA introduces new security challenges not present in the single-hop client-server architectures due to the involvement of multiple service providers in a service request. The interactions of independent service domains in SOA could violate service policies or SLAs. In addition, users in SOA systems have no control on what happens in the chain of service invocations. Although the establishment of trust across all involved partners is required as a prerequisite to ensure secure interactions, still a new end-to-end security auditing mechanism is needed to verify the actual service invocations and its conformance to the expected service orchestration. In this paper, we provide an efficient solution for end-to-end security auditing in SOA. The proposed security architecture introduces two new components called taint analysis and trust broker in addition to taking advantages of WS-Security and WS-Trust standards. The interaction of these components maintains session auditing and dynamic trust among services. This solution is transparent to the services, which allows auditing of legacy services without modification. Moreover, we have implemented a prototype of the proposed approach and verified its effectiveness in a LAN setting and the Amazon EC2 cloud computing infrastructure.

Entities (e.g., users, services) have to authenticate themselves to service providers (SPs) in order to use their services. An entity provides personally identifiable information (PII) that uniquely identifies it to an SP. In the traditional application-centric Identity Management (IDM) model, each application keeps trace of identities of the entities that use it. In cloud computing, entities may have multiple accounts associated with different SPs, or one SP. Sharing PIIs of the same entity across services along with associated attributes can lead to mapping of PIIs to the entity. We propose an entity-centric approach for IDM in the cloud. The approach is based on: (1) active bundles-each including a payload of PII, privacy policies and a virtual machine that enforces the policies and uses a set of protection mechanisms to protect themselves, (2) anonymous identification to mediate interactions between the entity and cloud services using entity's privacy policies. The main characteristics of the approach are: it is independent of third party, gives minimum information to the SP and provides ability to use identity data on untrusted hosts.

Cloud computing allows the use of Internet-based services to support business processes and rental of IT-services on a utility-like basis. It offers a concentration of resources but also poses risks for data privacy. A single breach can cause significant loss. The heterogeneity of “users” represents a danger of multiple, collaborative threats. In cloud computing, entities may have multiple accounts associated with a single or multiple service providers (SPs). Sharing sensitive identity information (that is, Personally Identifiable information or PII) along with associated attributes of the same entity across services can lead to mapping of the identities to the entity, tantamount to privacy loss. Identity management (IDM) is one of the core components in cloud privacy and security and can help alleviate some of the problems associated with cloud computing. Available solutions use trusted third party (TTP) in identifying entities to SPs. The solution providers do not recommend the usage of their solutions on untrusted hosts. We propose an approach for IDM, which is independent of TTP and has the ability to use identity data on untrusted hosts. The approach is based on the use of predicates over encrypted data and multi-party computing for negotiating a use of a cloud service. It uses active bundle-which is a middleware agent that includes PII data, privacy policies, a virtual machine that enforces the policies, and has a set of protection mechanisms to protect itself. An active bundle interacts on behalf of a user to authenticate to cloud services using user's privacy policies.