A trust-aware framework for evaluating security controls of service providers in cloud marketplaces

Sheikh Mahbub Habib, Vijay Varadharajan, Max Mühlhäuser

Research output: Chapter in Book/Report/Conference proceedingConference proceeding contributionpeer-review

26 Citations (Scopus)

Abstract

Trustworthy selection of cloud services has become a significant issue in emerging cloud marketplaces. As a consequence, the Cloud Security Alliance (CSA) has formulated a self-assessment framework for cloud providers to publish their cloud platform's security controls and capabilities. This framework enables consumers to select a cloud service based on the capabilities and controls published by the providers. However, a fundamental question that arises is, how can consumers trust that the security controls are satisfied as claimed by the providers and are compliant with consumers' requirements. This paper proposes a trust-aware framework to verify and evaluate these security controls considering consumers' requirements. First, we model the security controls in the form of trust properties. Then, we introduce a taxonomy of these properties based on their semantics and identify the authorities who can validate the properties. The taxonomy of these properties is the basis of trust formalisation in our proposed framework. The framework rests on the notion of hybrid trust that combines hard and soft trust mechanisms for verifying the trust properties. Furthermore, a decision model is proposed as an integral part of the framework in order to empower consumers to determine trustworthiness of cloud providers. Finally, we demonstrate that the proposed trust-aware security evaluation framework could be potentially useful in practice for consumers to determine trustworthy cloud providers in a competitive marketplace.

Original languageEnglish
Title of host publicationTrustCom 2013
Subtitle of host publicationTrustCom 2013 : 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications : proceedings : 16-18 July 2013, Melbourne, Victoria, Australia
Place of PublicationPiscataway, NJ
PublisherInstitute of Electrical and Electronics Engineers (IEEE)
Pages459-468
Number of pages10
ISBN (Print)9780769550220
DOIs
Publication statusPublished - 2013
Event12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2013 - Melbourne, VIC, Australia
Duration: 16 Jul 201318 Jul 2013

Other

Other12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2013
Country/TerritoryAustralia
CityMelbourne, VIC
Period16/07/1318/07/13

Fingerprint

Dive into the research topics of 'A trust-aware framework for evaluating security controls of service providers in cloud marketplaces'. Together they form a unique fingerprint.

Cite this