Audit Ready Cloud

云计算正在成为一种有前途的IT解决方案，用于实现对可配置计算资源的共享池的无处不在、方便和按需访问。然而，尽管有明显的好处，云计算的广泛采用仍然受到安全和隐私问题的阻碍。仅仅存在安全机制通常不足以完全缓解云租户的安全和隐私问题。为了保证云租户在云中遵守其期望的安全策略，需要明确证明此类安全机制的有效性。为了增加租户对云的信任，为租户提供足够的审计机制和工具，以便随时验证其应用程序的安全状况是否符合其预定义的安全策略，这一点至关重要。这种能力是，并将在未来成为加拿大云计算行业整体竞争力的战略因素。拟议研究的主要目标是开发一个全面的解决方案，用于自动化云中的安全监控，审计和合规性验证过程。通过该项目将向加拿大工业转移的新知识和技术包括云合规性验证和审计自动化框架，收集和处理数据的方法，正式验证安全属性的语言和算法，以及检测违反安全要求的新方法。预计将为业界和学术界带来的主要好处包括自动向云租户提供安全合规性证据以缓解其安全问题的理想能力，因为这对于向云租户提供云中应用程序安全部署的证据是必要的，可以与现有云管理系统集成的研究原型，例如爱立信云管理器，作为一种增值功能，最后是为一个日益需要高度专业知识的新兴行业培训HQP。

Cloud computing is emerging as a promising IT solution for enabling ubiquitous, convenient, and on-demand accesses to a shared pool of configurable computing resources. However, despite the obvious benefits, widespread adoption of cloud is still being hindered by security and privacy concerns. The mere existence of security mechanisms is usually insufficient to fully relieve cloud tenants from their security and privacy concerns. In order to guarantee the cloud tenants that their desired security policies are respected in the cloud, there is need for a clear evidence of effectiveness of such security mechanisms. To increase tenants' trust in cloud, it is of paramount importance to provide adequate auditing mechanisms and tools for the tenants to verify at any time that the security postures of their applications actually comply with their pre-defined security policies. Such a capability is, and will be more in the future, a strategic factor for Canada's cloud industry's overall competitiveness. The primary objective of the proposed research is to develop a comprehensive solution for automating the security monitoring, auditing, and compliance verification processes inside a cloud. The new knowledge and technologies that would be transferred to Canadian industry through this project include a framework for automating compliance verification and auditing in cloud, methods for collecting and processing data, languages and algorithms for formally verifying security properties, and novel approaches for detecting violation of security requirements. The key benefits expected to accrue to both the industry and academia include the desirable capability of automatically providing evidences of security compliance to cloud tenants to ease their security concerns as this is necessary for providing proof to cloud tenants of secure deployment of applications in the cloud, a research prototype that can be integrated with existing cloud management systems, such as the Ericsson Cloud Manager, as a value-added feature, and finally the training of HQP for an emerging industry which increasingly demands highly specialized expertise.