Cloud computing data and information security protection

Cloud computing data processing and storage are carried out on the cloud platform, computing resource owners and users of the separation has become the inherent characteristics of the cloud computing model, resulting in users of their own data security storage and privacy concerns are inevitable.

Specifically, user data even includes privacy-related content in remote computing, there are potential for intentional or unintentional leaks in storage and communication, as well as data loss caused by failures such as power outages or downtime, even for unreliable cloud infrastructure and service providers, and may be inferred from the analysis of user behavior, Learn about the user's privacy information. These problems will directly lead to contradictions and frictions between users and cloud providers, reduce user trust in cloud computing environment, and influence the further popularization of cloud computing applications.

One of the main objectives of information security is to protect user data and information security. When transitioning to cloud computing, traditional data security approaches will be challenged by cloud schema architectures. Flexibility, multi-tenant, new physical and logical architectures, and abstract controls require new data security policies.

1.1 Data security management and challenges

Key challenges in cloud computing data lifecycle security are as follows.

(1) Data security: confidentiality, integrity, usability, authenticity, authorization, authentication and non-repudiation.

(2) Data storage location: All data must be guaranteed to include all replicas and backups, stored in the contract, service level agreement and the geographical location allowed by the regulations. For example, the use of electronic health records managed by the EU's compliance storage regulations may be a challenge for data owners and cloud service providers.

(3) Data deletion or persistence: data must be removed completely and effectively before it is considered destroyed. Therefore, there must be an available technology to ensure the full and effective positioning of cloud computing data, erasing/destroying data, and ensuring that data is completely eliminated or unrecoverable.

(4) Mixing of different customer data: data, especially confidential/sensitive data, cannot be mixed with other customer data in the course of use, storage or transmission without any compensation control. The mix of data will increase security challenges in terms of data security and geo-location.

(5) Data Backup and recovery reconstruction (Recovery and Restoration) program: must ensure data availability, cloud data backup and cloud recovery plan must be in place and effective to prevent data loss, accidental data coverage and destruction. Do not assume that the data in the cloud mode is definitely backed up and recoverable.

(6) Data Discovery (Discovery): As the legal system continues to focus on electronic evidence discovery, cloud service providers and data owners will need to focus on discovering data and ensuring that all data required by legal and regulatory authorities can be recovered. These problems are extremely difficult to answer in a cloud environment and will require management, technology and the necessary legal controls to complement one another.

(7) Data aggregation and inference: data in the cloud, there will be new data aggregation and reasoning concerns, may lead to breaches of sensitive and confidential information confidentiality. Therefore, in practice, to ensure the interests of the data owner and the stakeholders of the data, avoid any slight leakage of data when data is mixed and aggregated (for example, medical data with name and medical information is mixed with other anonymous data, and cross control fields exist on both sides).

As shown in table 1-1, in conjunction with each phase of information lifecycle management, security control requirements are related to the cloud service pattern (SaaS, PAAs, or IaaS) and, depending on the level of confidentiality of the data, define hierarchical control requirements for different levels of information.

Table 11 Data security Control requirements

#生命周期安全控制要求1创建识别可用的数据标签和分类.

Enterprise Digital Rights Management (DRM) may be an option.

User tags for data are already prevalent in Web 2.0 environments and may be useful for classifying data

2 uses activity monitoring, which can be achieved through log files and agent-based tools.

Application logic.

Object-level control based on the solution of database management system

3 access control in environments such as storage-identity file systems, database management system DBMS, and document management systems.

Cryptographic solutions that cover e-mail, network transmissions, databases, files, and file systems.

Content discovery tools (such as DLP data loss protection) can help identify and audit

4 shared activity monitoring, which can be implemented through log files and agent-based tools.

Application logic.

Object-level control based on the solution of database management system.

Identify access controls in the context of file systems, database management systems, and document management systems.

Cryptographic solutions that cover e-mail, network transmissions, databases, files, and file systems.

Content-based Data protection through DLP

5 Archive Activity Monitoring, which can be achieved through log files and agent-based tools.

Application logic.

Object-level control based on the solution of database management system.

Identify access controls in the context of file systems, database management systems, and document management systems.

Cryptographic solutions that cover e-mail, network transmissions, databases, files, and file systems.

Content-based Data protection through DLP

6 destroys encryption and shredding: The destruction of key media associated with all encrypted data.

Secure removal via disk "wipe" and related technology.

Physical destruction, such as physical media degaussing.

Identify the destruction process through content discovery

1.2 Data and information security protection

Cloud computing users of data transmission, processing, storage and so on with the cloud computing system, in many tenants, thin terminal access and other typical application environment, user data face security threats more prominent. In view of the requirement of information security protection in cloud computing environment, it is necessary to provide end-to-end information security and privacy protection for cloud computing users by means of data isolation, access control, encrypted transmission, secure storage and residual information protection, so as to protect the usability, confidentiality and integrity of user information.

The specific protection of data and information security can be divided into the following aspects.

1. Data security Isolation

In order to isolate the data information among different users, the security and privacy of each tenant data can be protected by using the physical isolation, virtualization and multi-tenancy schemes to realize the safety isolation of data and configuration information between different tenants according to the application specific requirements.

2. Data access Control

In the aspect of data access control, a real-time identity monitoring, authorization and certificate checking can be used to prevent unauthorized access between users through the use of authorization control mode based on identity authentication. If you can use the default deny all access control policy, only open the corresponding port or open the related access policy when there is a need for data access. In virtual application environment, the logic boundary security access control strategy can be set up in virtual environment, such as virtual firewall and virtual machine, so as to realize the fine data access control strategy among virtual machines.

3. Data encryption Storage

Data encryption is an important way to achieve data protection, even if the data are illegally stolen, they are only a bunch of garbled, and can not know the specific information content. In the selection of encryption algorithm, we should choose the symmetric encryption algorithm with high encryption performance, such as AES, 3DES and other international general algorithms, or the state-owned business secret algorithm SCB2. In encryption key management, centralized user key management and distribution mechanism should be adopted to realize efficient security management and maintenance of user information storage. For cloud storage services, cloud computing systems should support the provision of cryptographic services, encrypt and store data, and prevent data from being illegally spied on by others; for virtual machines and other services, users are advised to encrypt important user data before uploading and storing.

4. Data encryption Transmission

In the cloud computing application environment, the data network transmission is unavoidable, therefore guarantees the data transmission security is also very important. Data transmission encryption can be selected in the link layer, network layer, transport layer and so on, the use of network transmission encryption technology to ensure the network transmission data information confidentiality, integrity, availability. For the management of information encryption transmission, SSH, SSL and other means for the cloud computing system internal maintenance management to provide data encryption channel, to ensure the maintenance of information security management. For user data encryption transmission, IPSec VPN, SSL and other VPN technologies can be used to improve the network transmission security of user data.

5. Data backup and Recovery

Regardless of where the data is stored, users should carefully consider the risk of data loss, in order to deal with the sudden cloud computing platform system failure or disaster events, the data backup and rapid recovery is important. In virtualized environments, you should be able to support disk-based backup and recovery, enable fast virtual machine recovery, support file-level full and incremental backups, and save incremental changes to improve backup efficiency.

6. Remaining Information protection

Because user data is shared and stored in the cloud computing platform, the storage space allocated to a user today may be assigned to another user tomorrow, so it is necessary to protect the remaining information. So it requires the cloud computing system to allocate storage resources to new users, complete data erasure must be performed, after the Stored User File/object has been deleted, the corresponding storage is completely erased or marked as write only (only new data can be overridden) to prevent illegal malicious recovery.