Kevin Hamlen, Peng Liu, Murat Kantarcioglu, Bhavani Thuraisingham, and Ting Yu.

"Identity Management for

Cloud Computing: Developments and Directions." In Proceedings of the 7th Annual Cyber Security and
Information Intelligence Research Workshop (CSIIRW), October 2011.

IDENTITY MANAGEMENT FOR CLOUD COMPUTING:

DEVELOPMENTS AND DIRECTIONS

Kevin Hamlen1, Peng Liu2, Murat Kantarcioglu1,

Bhavani Thuraisingham1, Ting Yu3
1. The University of Texas at Dallas
2. Pennsylvania State University
3. North Carolina State University

ABSTRACT improve the performance due to incorporating

Cloud computing technologies have been rapidly additional security functionalities, integrated open
adopted by organizations to lower costs and to source software parts, as well as custom developed
enable flexible and efficient access to critical data. software parts to support secure cloud query
As these new cloud technologies emerge, cyber operations on complex data, provide fine-grained
security challenges associated with these access control and reference monitor support, as
technologies have increased at a rapid pace. One of well as provide strong authentication mechanisms.
the critical areas that needs attention for secure Some recent work examines an XACML-based
cloud computing is identity management where the access control model with SAML for security
multiple identities of cloud users operating possibly assertion for a cloud computing framework.
in a federated environment have to be managed and However, due to the fact that numerous identities
maintained. In this paper, we first explore identity for millions of users may have to be managed in a
management technologies and secure cloud cloud environment, we need to reexamine the entire
computing technologies. We will then discuss some concept of identity management for the cloud.
of the security balances for cloud computing with Identity management t or digital identity
respect to identity management. management is closely intertwined with web
services. Users as well as web services have to be
1. INTRODUCTION
authenticated before accessing resources. Single
There is a critical need to securely store, manage,
Sign-on is the popular solution where one time sign-
share and analyze massive amounts of complex
on gives a user of a service access to the various
(e.g., semi-structured and unstructured) data to
resources. Furthermore, SAML currently provides
determine patterns and trends in order to improve
authentication facilities for web services. However,
the quality of healthcare, better safeguard the nation
with regulatory requirements for e-business, and
and explore alternative energy. The emerging cloud
with the emergence of the cloud computing
computing model attempts to handle massive
paradigm, one needs a stronger mechanism for
amounts of data. Google has now introduced the
authentication and this mechanism has come to be
MapReduce framework for processing large
known as identity management [1].
amounts of data on commodity hardware. Apache’s
Federated identity “describes the technologies,
Hadoop distributed file system (HDFS) is emerging
standards and use cases which serve to enable the
as a superior software component for cloud
portability of identity information across otherwise
computing combined with integrated parts such as
autonomous security domains.” [2]. The goal is to
MapReduce. However, state-of-the-art cloud
ensure that users of one domain take advantage of
computing systems are not sufficient due to the fact
all the technologies offered by another domain in a
that (i) they do not provide adequate security
seamless manner. Note that federation is about
mechanisms to protect sensitive data and (ii) they do
organizations working together to carry out a task
not have the capability to process massive amounts
(such as B2B operations) or solving a particular
of semantic web and geospatial data.
problem. While the idea has been around for many
To address the limitations of current cloud
years, it is only recently with the emerging
computing platforms, researchers have utilized
standards of four web services that we can now
state-of-the-art hardware, software and data
have secure federations. In such federations, access
components based on Hadoop and MapReduce
to the resources by users has to be managed without
technologies and are developing a secure cloud
burdening the user. With appropriate federate
computing framework. For example, modern
identity management, users should be able to share
hardware parts (e.g., secure coprocessors) to
data across domains, support single sign-on as well
Permission to make digital or hard copies of all or part of this as enable cross-domain user attribute management
work for personal or classroom use is granted without fee
provided that copies are not made or distributed for profit or
commercial advantage and that copies bear this notice and the
full citation on the first page. To copy otherwise, or republish, to
post on servers or to redistribute to lists, requires prior specific
permission and/or a fee. CSIIRW ’11, October 12 -14, Oak
Ridge, Tennessee, USA Copyright © 2011 ACM 978-1-4503-
0945-5 ISBN. . . $5.00
2
This paper will provide an overview of the various as users can sign in at one place and have access to
developments with identity management as well as the a variety of resources on the web.
secure cloud computing and then examine identity The various web sites are now implementing
management for cloud computing. In Section 2 we federated identity management with Open ID.
will discuss identity management technologies. In OpenID is an open, decentralized user identification
Section 3 we will discuss security for cloud standard, allowing users to log onto many services
computing. Issues on identity management for cloud with the same digital identity. OpenID is essentially
computing will be discussed in Section 4. Standards a URL and the user is authenticated by their OpenID
efforts are discussed in Section 5. The paper is provider. Many corporations such as Symantec and
concluded in Section 6. Microsoft support OpenID. For example, Microsoft
provides interoperability between OpenID and its
2. IDENTITY MANAGEMENT
Windows CardSpace. OpenID extends the entities
Two concepts that are at the foundations of Digital
of the Identity Metasystem and consists of the
Identity Management are (i) Single sign-on and (ii)
following: End-user: The person who wants to
federated identity management. As stated in [2],
assert his or her identity to a site. Identifier: The
Single sign-on (SSO) is a property where a user logs
URL chosen by the end-user as their OpenID
in once and gains access to all systems possibly in a
identifier. Identity provider or OpenID provider:
federation. This way the user has to log in once and
This entity provides the service of registering
has access to the resources in the federation or
OpenID URLs and provides OpenID authentication.
coalition or organization, without being prompted to
Relying party: The site that wants to verify the end-
log in again at each of them. Two types of SSO
user's identifier. (this is essentially the service
mechanisms are Kerberos-based and smart card-
provider). Server or server-agent: The server that
based. With Kerberos mechanism, Kerberos ticket
verifies the end-user's identifier. User-agent: Users
granting ticket TGT is used to grant credentials. In
access the identity provider or a relying party
the smart card based sign-on, the user uses the smart
through the user agent (e.g., the browser). The use
card for sign-on. Enterprise Single Sign-on (E-
of OpenID is as follows. A user visits a relying
SSO), provides the support for minimizing the
party’s (e.g. service provider) web site to request a
number of passwords and user-IDs when accessing
service. This relying party has an OpenID form
multiple applications. As stated earlier “federated
which is the login for the user. User would then give
identity, or the ‘federation’ of identity, describes the
his identity which is provided by an Identity prior to
technologies, standards and use-cases which serve
the logic process. From this information the relying
to enable the portability of identity information
party will discover the identity provider web site.
across otherwise autonomous security domains [2].
Another key system in identity management is
The use cases include typical use-cases including
Shibboleth. Shibboleth is a distributed web resource
cross-domain, web-based single sign-on.
access control system that allows federations to
One important concept in identity management is
cooperate together to share web-based resources It
the Identity Metasystems. Identity Metasystem is an
defines a protocol for carrying authentication
“interoperable architecture for digital identity that
information and user attributes from a home to a
enables people to have and employ a collection of
resource site. The resource site can then use the
digital identities based on multiple underlying
attributes to make access control decisions about the
technologies, implementations, and providers.”
user. This web-based middleware layer uses SAML.
Essentially with this approach, users can continue to
Access control is carried out in stages. In stage one,
maintain their identities and choose the identity
the resource site redirects the user to their home site,
system that will work for them so that the system
and obtains a handle for the user that is
will manage their identities when migrating to
authenticated by the home site. In stage two, the
different technologies. The roles of the Identity
resource site returns the handle to the attribute
Metasystem are identity provider, relying parties
authority of the home site and it returns a set of
and subjects. Identity providers issue digital
attributes of the user, upon which to make an access
identities. Relying parties are the ones who require
control decision.
identities such as various services. Subjects include
There are some issues with single sign-on with
the end users and organizations. Information card is
Shibboleth. How does the resource site know the
an implementation of the Identity Metasystem.
home site of the user? How does it trust the handle
Information cards are personal digital identities that
returned? The answer is, it is handled by the system
people can use online which support single sign-on
trust model. Authentication procedure is as follows.
When the resource site asks for home site from the hypervisors including secure VMware and Secure
user, he selects it from the list of trusted sites which XEN platforms are being examined. Furthermore,
are already authenticated by Certificates. Handles researchers are also examining combinations of
are validated by the SAML signature along with the hardware/software approach is effective for system
message. User selects the home site from the list. assurance. Solutions in virtual machines to defend
Home site authenticates the user if he is already against security threats, such as Key Logger, Buffer
registered. After home server authentication, it Overflow and Intrusions are also being explored.
returns a message with SAML sign to the Target (ii) Secure Cloud Storage Management: Security
Resource site. Resource site (if sign matches) then issues related to cloud storage systems include
provides a pseudonym (handle) for the user and security for the Hadoop framework. Storage
sends an assertion message to home page to find out infrastructure which integrates resources from
if the necessary attributes are available with the multiple providers to form a massive virtual storage
user. To ensure privacy, the system provides a system is being developed. When a storage node
different pseudonym for the user’s identity each hosts the data from multiple domains, a VM will be
time. It needs the release attribute policy from the created for each domain to isolate the information
user attributes each time to provide control over the and corresponding data processing. Since data may
authority attributes in the target site. Agreement be dynamically created and allocated to storage
attribute release policy is between the user and the nodes, it is necessary to support secure VM
administrator. management services such as pool management.
Finally, an organization called the Liberty Alliance The VM will be created dynamically to host data
was formed to promote standards for identity and support processing for each domain. The thread
management. Two major efforts released by this pool concept is leveraged to create VM pools. The
consort are the Liberty Identity Federation (also VM pool will grow and shrink according to the
called identity federation) and the Liberty identity demands and resource constraints. Implementations
web services (also called identity web services). of the virtual global cloud storage infrastructure on
Liberty Identity Federation enables the web users top of Xen and VMware are also being carried out.
(e.g. e-commerce users) to authenticate and sign-on (iii) Secure Cloud Data Management: Various
a domain and from there have access to multiple security issues related to cloud data management
services. This is the basis of SAML 2.0. The include cloud query optimization and query
identity web services standard is an open framework rewriting. For example, secure query processing
for deploying and managing identity-based Web algorithms for RDF (Resource Description
services. These web services applications include Framework) data in clouds with an XACML-based
Geo-location, Contact Book, Calendar, Mobile (eXtensible Access Control Markup Language)
Messaging and Liberty People Service. With these policy manager utilizing the Hadoop/MapReduce
services, one can manage bookmarks, blogs, and Framework have been developed. In addition,
photo sharing and related social services on the web algorithms for secure query processing based on the
in a privacy-preserving manner. Privacy and policy HIVE framework have also been developed. Some
management are key aspects of the work of Liberty researchers are examining risk-aware access control
Alliance. query processing strategies for cloud computing as
well as QoS for clouds.
3. SECURE CLOUD COMPUTING
Secure Cloud Network Management: The
A layered framework for assured cloud computing
potential impact of network-based security threats
consisting of the secure virtual machine layer,
on cloud computing systems and their hosted
secure cloud storage layer, secure cloud data layer,
applications makes cloud computing systems prime
and the secure virtual network monitor layer. Cross-
targets for adversaries. Securing such systems
cutting services are provided by the policy layer, the
requires a multi-level approach as potential security
cloud monitoring layer, the reliability layer and the
threats may come from various entities both internal
risk analysis layer. We discuss the developments in
as well as external to the system. In addition, a
some of the layers [3].
potential security attack on a hosted service
(i) Secure Hypervisors: Virtual machine (VM)
application may also have a negative impact on
technology is widely adopted as an enabler of cloud
other co-located services or applications.
computing and provided through hypervisors.
Security Policy Management for Cloud
Ensuring the security of hypervisors is essential for
Computing: Researchers are examining various
assured cloud computing. Developments in secure
types of policy management in cloud systems. In
4
addition results from the in-line reference monitor provisioning have to take into consideration features
concept as applied to clouds is also being examined. of cloud such as real-time resource allocation.
For example, cloud frameworks often demand more User-IDs in a cloud will be dynamic and therefore
sophisticated policy languages for fine-grained data technologies such as OpenID have to be extended to
confidentiality policies, accountability policies and function in cloud. One of the major challenges in
identity management policies. To support such adapting OpenID is establishing trust relationships
policies, customized OS’s usually become in the cloud. Therefore, an appropriate trust model
necessary. Such OS’s incur computational for the cloud is crucial.
overhead, both in terms of resource consumption As stated earlier, simple role-based access control
and process load-times. The need to customize the (RBAC) is too limiting for a cloud environment.
OS to support new policies introduces inflexibility Attribute-based access control (ABAC), upon which
to the policy language and could add to the trusted standards such as XACML is based on, is widely
computing base of the system. To achieve more adopted for service-oriented systems. However, in a
flexible, lighter-weight, yet high assurance recent article on identity management by Olden [5],
protection for process-level cloud security, the author argues that both RBAC and ABAC may
traditional hypervisor architectures are being not be suitable for the cloud. This is because in a
extended with an extra level of security based on cloud environment, “attributes and role
certified in-lined reference monitors (IRM’s). memberships are decoupled from the operating
Cloud Monitoring: Data mining algorithms are systems and can be distributed across systems via a
being developed for malicious code detection and federation”. With respect to authentication,
network traffic analysis for clouds. For example, technologies such as single sign on with Security
some of these algorithms mine data streams and Assertions Markup Language have received a lot of
detect novel classes of malicious code. There are prominence in a service-oriented environment.
also tools being developed solely to monitor clouds. However, the cost of building an identity
For example, for Infrastructure as a Service (IaaS) infrastructure based on SAML has been extensive
type of cloud computing applications, tools to and its use in a cloud has to be examined.
monitor the utilization and load distribution in the Other features that an identity management system
underlying physical resources are being developed. must provide are auditing and accountability.
Auditing in a distributed environment comes with
4. IDENTITY MANAGEMENT FOR THE numerous challenges such as how much audit data
CLOUD to collect and techniques for analyzing the data. In a
In Section 2 we discussed identity management cloud environment, auditing becomes even more
technologies while in Section 3 we discussed secure challenging, especially in a public cloud. One of the
cloud computing technologies. It is increasingly objectives of the cloud is to dynamically allocate the
being realized that effective identity management is resources regardless of who has requested the
critical for the secure operation of clouds. However, resources and where resources may be. Therefore,
much of the recent work has focused on simple role- in such an environment, capturing all of the
based access control models for secure clouds [3]. activities of all of the users of the cloud becomes a
However, in a cloud environment, it will be difficult challenge.
to define user roles across organizations. Semantic web technologies such as web ontology
Furthermore, a user may have several identities not language are being examined to store and reason
only over multiple systems, but also over multiple about the identities. For example, ontology
clouds. In this section we will explore some of the alignment techniques are being explored to
challenges. determine whether multiple identities of a user can
In an article by Gopalakrishnan [4], the author be aligned. For example in [6], the authors proposed
argues that identity management in a cloud has to the SemID ontology for identity management. This
manage “control points in a dynamic composite ontology represents roles, policies, and access rules
decommissioned machines, virtual device or service to control access to the resources. Such approaches
identities.” The services in a cloud may be dynamic are yet to be examined for the cloud.
in nature and therefore lifecycle management of the Cloud services are often managed by providers from
identities need to take into consecration aspects such different domains. For a cloud user, which services
as service provisioning and de--provisioning, she invokes and the sequence of invocation might
Standards such as Service Provisioning Markup be sensitive, which may not be suitable to be
Language that is being used for web services discovered by service providers, even when they
collude. Thus, identity management for cloud account/attribute management, security tokens and
computing should support certain forms of privacy- audit and compliance.
preserving resource access, which, on the one hand,
allows service providers to authenticat an entity and
control its access according to policies, and 6. SUMMARY AND DIRECTIONS
meanwhile, provides isolation of service access As we have stated in this paper, cloud computing
traces to prevent linkage, if a user chooses to do so. technologies have been rapidly adopted by
This feature also needs to be balanced with auditing organizations to lower costs and to enable flexible
and accountability requirements of cloud computing and efficient access to critical data. As these new
to prevent misuse of cloud services. cloud technologies emerge, cyber security
In summary, what is needed for identity challenges associated with these technologies have
management for the cloud is a trust model that increased at a rapid pace. Some efforts have been
handles (i) various trust relationships, (ii) access reported on the solutions to address the security
control policies based on roles and attributes, (iii) problems for the cloud. However identity
real-time provisioning, (iv) authorization, and (v) management for the cloud has received very little
auditing and accountability. Furthermore the attention.
identity architecture has to be integrated into the In this paper we have discussed identity
cloud architecture. Several technologies have to be management developments including the various
examined to develop the trust model; these include concepts such as single sign-on, and opened as well
service-oriented technologies, standards such as as discussed security issues for cloud computing.
SAML and XACML, and identity management We then discussed some of the challenges on
technologies such as OpenID. Finally, does one size providing identity management for the cloud. In
fit all? That is, can we develop a trust model that particular we discussed identification and
will be applicable to all types of clouds such as authentication, authorization and access control,
private clouds, public clouds and hybrid clouds? auditing and accountability, and trust and privacy
issues for the cloud. We also discussed the goals of
5. STANDARDS FOR IDENTITY
the newly formed OASIS technical committee on
MANAGEMENT IN CLOUDS
identity management. As more progress is made by
While W3C and OASIS have developed several
this technical committee and more research is
standards for identity management, web services,
carried out on this topic, we can expect promising
XML, XACML, SAML and semantic web,
solutions to the very difficult problem of identity
standards for secure clouds are only in the
management in the cloud.
beginning changes. However, OASIS has recently
formed a technical committee (TC) on identity
REFERENCES
management, privacy and trust in cloud computing
[1] http://www.opengroup.org/idm/
services. As stated in [7], “The OASIS IDCloud TC
[2] Federated Identity,
works to address the serious security challenges
http://en.wikipedia.org/wiki/Federated_identity
posed by identity management in cloud computing.
[3] K. Hamlen et al, Security Issues for Cloud
The TC identifies gaps in existing identity
Computing, Journal of Information Security and
management standards and investigates the need for
Privacy, 2010.
profiles to achieve interoperability within current
[4] A. Gopalakrishnan, Cloud Computing Identity
standards. It performs risk and threat analyses on
Management, SETLabs briefings, 2009
collected use cases and produces guidelines for
[5] E. Olden, Architecting a Cloud-Scale Identity
mitigating vulnerabilities.”
Fabric, IEEE Computer, March 2011.
The TC has stated that they will be using the various
[6] M. Choudhury et al, SemID: Combining
OASIS standards as their building blocks to
Semantics with Identity Management,
developed identity management standards for the
SECUREWARE, 2009/
cloud. These building blocks include the following.
[7] http://www.oasis-
Digital Signature Services, Extensible Resource
open.org/committees/tc_home.php?wg_abbrev=id-
Identifier (XRI), and the XRI Data Interchange.
cloud
The use case categories examined by this TC
include infrastructure trust establishment,
Infrastructure identity management, federated
identify management, authentication, authorization,