Abstract
Trustworthy selection of cloud services has become a significant issue in emerging cloud marketplaces. As a consequence, the Cloud Security Alliance (CSA) has formulated a self-assessment framework for cloud providers to publish their cloud platform's security controls and capabilities. This framework enables consumers to select a cloud service based on the capabilities and controls published by the providers. However, a fundamental question that arises is, how can consumers trust that the security controls are satisfied as claimed by the providers and are compliant with consumers' requirements. This paper proposes a trust-aware framework to verify and evaluate these security controls considering consumers' requirements. First, we model the security controls in the form of trust properties. Then, we introduce a taxonomy of these properties based on their semantics and identify the authorities who can validate the properties. The taxonomy of these properties is the basis of trust formalisation in our proposed framework. The framework rests on the notion of hybrid trust that combines hard and soft trust mechanisms for verifying the trust properties. Furthermore, a decision model is proposed as an integral part of the framework in order to empower consumers to determine trustworthiness of cloud providers. Finally, we demonstrate that the proposed trust-aware security evaluation framework could be potentially useful in practice for consumers to determine trustworthy cloud providers in a competitive marketplace.
Original language | English |
---|---|
Title of host publication | TrustCom 2013 |
Subtitle of host publication | TrustCom 2013 : 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications : proceedings : 16-18 July 2013, Melbourne, Victoria, Australia |
Place of Publication | Piscataway, NJ |
Publisher | Institute of Electrical and Electronics Engineers (IEEE) |
Pages | 459-468 |
Number of pages | 10 |
ISBN (Print) | 9780769550220 |
DOIs | |
Publication status | Published - 2013 |
Event | 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2013 - Melbourne, VIC, Australia Duration: 16 Jul 2013 → 18 Jul 2013 |
Other
Other | 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2013 |
---|---|
Country/Territory | Australia |
City | Melbourne, VIC |
Period | 16/07/13 → 18/07/13 |