Grant: Collaborative Research and Development Grants

Cloud computing is emerging as a promising IT solution for enabling ubiquitous, convenient, and on-demand accesses to a shared pool of configurable computing resources. However, despite the obvious benefits, widespread adoption of cloud is still being hindered by security and privacy concerns. The mere existence of security mechanisms is usually insufficient to fully relieve cloud tenants from their security and privacy concerns. In order to guarantee the cloud tenants that their desired security policies are respected in the cloud, there is need for a clear evidence of effectiveness of such security mechanisms. To increase tenants' trust in cloud, it is of paramount importance to provide adequate auditing mechanisms and tools for the tenants to verify at any time that the security postures of their applications actually comply with their pre-defined security policies. Such a capability is, and will be more in the future, a strategic factor for Canada's cloud industry's overall competitiveness. The primary objective of the proposed research is to develop a comprehensive solution for automating the security monitoring, auditing, and compliance verification processes inside a cloud. The new knowledge and technologies that would be transferred to Canadian industry through this project include a framework for automating compliance verification and auditing in cloud, methods for collecting and processing data, languages and algorithms for formally verifying security properties, and novel approaches for detecting violation of security requirements. The key benefits expected to accrue to both the industry and academia include the desirable capability of automatically providing evidences of security compliance to cloud tenants to ease their security concerns as this is necessary for providing proof to cloud tenants of secure deployment of applications in the cloud, a research prototype that can be integrated with existing cloud management systems, such as the Ericsson Cloud Manager, as a value-added feature, and finally the training of HQP for an emerging industry which increasingly demands highly specialized expertise.