A brief review: security issues in cloud computing and their solutions

Cloud computing is an Internet-based, emerging technology, tends to be prevailing in our environment especially in the field of computer sciences and information technologies which require network computing on large scale. Cloud Computing is a shared pool of services which is gaining popularity due to its cost, effectiveness, avilability and great production. Along with its numerous benefits, cloud computing brings much more challenging situation regarding data privacy, data protection, authenticated access, Intellectual property rights etc. Due to these issues, adoption of cloud computing is becoming difficult in today’s world. In this review paper, various security issues regarding data privacy and reliability, key factors which are affecting cloud computing, have been addressed and also suggestions on particular areas have been discussed.

This paper is divided into following sections: section 1 tells about the introduction of cloud computing, section 2 gives the idea of cloud computing models while section 3 is the brief introduction of related works. Section 4 is about the factors affecting cloud computing, section 5 is the possible threats regarding the cloud computing paradigm and finally section 6 gives some solutions to the security issues. The conclusive remark is in section 7.

Cloud Service Models
The benefits and impotence of cloud computing might be very appealing and demandable, but it has got huge number of risks and security issues like data leakage, data loss, intruder attacks, malicious insiders etc. Following service models are defined by NIST which includes three categories [1,3,4]: -Infrastructure as a Service (IaaS): IaaS is all about providing the virtual machine, operating systems or networks to the end users. Some other computing resources are also supported in IaaS, where the customer or client can run arbitrary operating system on virtual machine or any other software. Client can control only the operating system or software which he is running but he loses his control on the infrastructure which is providing him all these services. -Software as a Service (SaaS): In this kind of scenario, user is only using the applications which are being provided by the vendor and those applications run on the cloud services. Same application is accessible by many other clients as well through some common mechanism, for example by using web browser or email. Additionally, the clients or users have no control over the application or underlying infrastructure, network server or operating system upon which these applications run. -Platform as a Service (PaaS): In PaaS, the client is able to create their own desired application by using some programming language, linked libraries. These languages or libraries are supported by the vendor. After creating the user desired application, it is deployed on the server provided by the vendor. User has also the authority to configure its application or can change the configuration settings later on. The next Figure 2 shows the relationships of the clients and three service models defined bu NIST.

Related Works
Agarwal A et al. highlight the emergence of cloud computing along with its security concerns like data loss, data breaches, insecure APIs, account hijacking, denial of services [4,5]. P Garg et al. have worked on different cloud security aspects like basic security which includes Cross site scripting attacks, SQL injection attacks, Man in the middle attacks [6]. Pradeep Kumar Sharma et al. also work for the security concerns of cloud like cost model charge [6,7], service level agreements and issue of migration should be dealt. Naseer Amara et al. highlighted the security threats, architectural principles and cloud security attacks with their techniques that can minimize the effects of malicious attacks (mitigation techniques) [8,9]. Iqbal Ahmed et al. introduces green IT as a Service (GaaS), which is important for modern days sustainability concern [10]. S Ajoudaninan et al. said that following three parameters were the most crucial (a) data confidentiality (b) integrity (c) availability [11]. She proposed a new security model (CIA) [11], for cloud computing.

Factors Affecting Cloud Security
There are numerous key factors which may affect cloud computing performance because it is surrounded by many technologies, for example, load balancing, network, concurrency control, virtualization, operating system, database, memory management etc [12]. The main key factors which are affecting cloud performance are shown in Figure 3. The security factors of these technologies affecting the cloud computing are appropriate; for example, network which connects the cloud computing to the outer world has to be secured. Virtualization concept has to be carried out securely when mapping with the physical systems. Load balancing involves the handling of incoming requests traffic which sometimes overloads the server. Data mining algorithms can be applied to cope with malicious attacks.

Possible Threats Regarding Cloud Computing
Nowadays cloud computing is getting so much popularity that it is in the limelight of modern era. Along with its huge benefits cloud computing is facing much security issues which need considerable attention to resolve them for the betterment of this services. Following are the major concerns [13]: -Outsourcing: in outsourcing the data, consumer might get lose the control. Some kind of appropriate mechanism is needed to prevent the cloud service provider (CSPs) to use the data against the consent of their clients. -Multitenancy: cloud is a shared pool of resources. Protection of data must be taken into account while providing the multi-tenant environment. Cloud seller should mention in the SLAs that in case of any disaster what should be the remedy or solutions to such problems. There is very rare chance of whole system failure like flood etc. -Data Redundancy: Data redundancy is a situation in which same data is being kept on two different places. In case of cloud computing, it can be understood as to provide copies of same data, systems or equipment to the clients, cloud provider should try to keep data redundancy minimum.

Solutions to Security Challenges in Cloud Computing
Security challenges in cloud computing need to be addressed properly. If appropriate solutions are not being provided, adoption of cloud environment becomes more difficult. Apart of adoption, data transmission and operation tend to become more tedious. Figure 4 elaborates that data protection and privacy is the most crucial factor among all [14]. Following are some solutions which needs to be considered while considering about cloud computing security challenges.

Data Encryption
Encryption is said to be a better approach regarding data security. Data should be encrypted before sending it to cloud. Data owner can permit some particular members to have access to that data [14]. The file or data being sent to cloud should be encrypted first then before storing it on cloud it should be again encrypted by the cloud provider; the process is known as multistage encryption. It has been observed that combination of different encryption algorithms provides better encryption on data. Experimental results show that RSA+IDEA gives the higher performance of encryption in securing the data [15,16].

Legal Jurisdiction
When it comes to understand and analyse the legal jurisdiction of cloud computing, the very basic aspects of cloud environment complicate the data protection, for example presence of internet, virtualization, dynamically distributed data, multinational elements. Consumers normally do not know that where their data resides in cloud. For example, a client from India may be using a server deployed in USA, using an application which has been developed in Japan and storing his crucial data at a data centre which is physically located in Switzerland [17]. Therefore, the resource allocated to the consumers should be marked to make sure that data is segregated [18].

Distributed Denial of Service (DDoS)
Distributed Denial of Service is a kind of attack in which attacker creates some zombie machine by infecting the machine over the internet [19][20][21][22]. Then these infected machines are used to attack on victim. When attacks/traffic from so many infected machines are directed towards one victim, its resource like CPU, bandwidth and memory starts getting exhausted and particular resource becomes unavailable for consumers. To cope with this Deepali et al. [19] has introduced a layer named as fog layer which sites in between cloud server and user. All the requests made to server are filtered through this fog layer and DDoS attacks get minimized.

Digital Signature
Digital signature is powerful tool for securing data in cloud computing [23,24]. P Rewagad et al. [25] has proposed a solution using digital signature to secure data along with Diffie Hellman key exchange with AES encryption algorithm. Diffie Hellman key exchange facility marks it useless if the key is hacked in transmission because it us useless without private key of user, which is confined to legitimate user only. This three-way mechanism which is proposed in that paper makes it harder to hack security system, therefore, protecting the data that resides in cloud.

Conclusion
This paper gave the overview of cloud computing, its various security aspects and key factors which are affecting the cloud security. Cloud consumer and provider should be sure that their cloud is fully secure and protected. Cloud computing is growing in every industry however it suffers from certain issues regarding security and protection which are hurdle in its adoption widely. Solutions to these problems have been suggested which can be used for better performance of cloud services in future.