Search

Os principais provedores de computação em nuvem, como Amazon, Google e Microsoft, utilizam tecnologias proprietárias para oferecer seus serviços. Usuários têm o desejo de usar múltiplos provedores para aumentar a disponibilidade de seus serviços, reduzir custos, não depender de um único fornecedor, dentre outros motivos. Federações de Políticas de Autorização (APFs) permitem a definição de uma política de controle de acesso única que pode ser aplicada em múltiplos provedores heterogêneos. Para isso, essas políticas, descritas na Forma Normal Disjuntiva (DNF) e semântica definida por uma ontologia, devem ser mapeadas para o contexto local de cada usuário e nuvem. Este trabalho discute os processos de mapeamento sintático e semântico das políticas e a métrica Nível de Equivalência Semântica (LSE) utilizada para medir sua efetividade.

Cloud computing is maturing and becoming ubiquitous in people’s daily lives. As a result, cloud environments are providing moreand more services with better quality of service. Cloud customers, however, have suff ered from the vendor lock-in problem, in such a way that those who wish to migrate to another cloud provider require partial or total reimplementation of applications and virtual infrastructure. Moreover, the problem of heterogeneity among distinct cloud environments makes it diffi cult for the portability of resources between them. Therefore, this work focuses on the development of an ontology to handle multi-cloud heterogeneity, and thus, bring interoperability in the form of a service to perform the portability of virtual machines between diff erent providers.

Current Infrastructure as a Service (IaaS) cloud platforms have their own authorisation system, containing different access control policies and models. Clients with accounts in multiple cloud providers struggle to manage their rules in order to provide a homogeneous access control experience to users. This work proposes a solution: an Authorisation Policy Federation (APF) of heterogeneous cloud accounts. These federated accounts share a centrally managed policy written in Disjunctive Normal Form (DNF) using a cloud-independent ontology. This shared abstract policy can be translated to local cloud formats, and back again. Prototypes were implemented for OpenStack and Amazon Web Services (AWS) cloud formats, and rules were successfully translated with a Level of Semantic Equivalence (LSE) higher than 80.

Summary Identity federations enable users, service providers, and identity providers from different organizations to exchange authentication and authorization information in a secure way. In this paper, we present a novel identity federation architecture for cloud services based on the integration of a cloud identity management service with an authentication, authorization, and accounting infrastructure. Specifically, we analyse how this type of authentication, authorization, and accounting–based federation can be smoothly integrated into OpenStack, the leading open source cloud software solution, using the Internet Engineering Task Force (IETF) Application Bridging for Federated Access Beyond web specification for authentication and authorization. We provide details of the implementation undertaken in GEANT's CLASSe project and show its validation in a real testbed.

Privacy of the data processed and/or stored in the cloud is a concern for the users of these services. Cloud platforms are exposed in the Internet, managed by third parties, and their usage is shared by different users. Identity and access control mechanisms are relevant because they intend to protect data from improper access. Among these mechanisms, identity federations let users' authentication be performed by entities that are closer to them. The proposal of this work is to integrate the Open stack cloud platform to identity federations using SAML and OpenID Connect protocols. These protocols are compared observing the ease of integration and performance.

This work evaluates cache algorithms for block devices in terms of hit rate for different replacement and prediction algorithms, and also focuses on choosing suitable replacement and prediction strategies to be implemented in a storage array caching solution employing solid-state drives. As case study, a real workload was continuously collected from web proxy server network. Such replacement and prediction algorithms were evaluated in detail and compared between them considering traced SCSI commands collected from Linux kernel. Comparison results for replacement algorithms LRU, CLOCK, LRFU and LRU-WAR applied to real workload indicates that LRU obtained good results in the majority of the cases. GHB and ReadAhead prefetching algorithms also were integrated and improvements of about 5.5% were achieved when ReadAhead was used.