Читать книгу Cyber Security and Network Security - Группа авторов - Страница 18

Every device produces metadata based on the client’s request. For securing cloud base applications, metadata exchange is also necessary to maintain nondisrupting service. Any hacker can easily take advantage of those metadata and use that for any malicious intention like malware injection and many others. In this case, a hacker needs to inject malicious code or service of the valid instance running in the cloud. If the hacker is successful, then the cloud will suffer from deadlocks and eavesdropping which forces real users to wait until the process is not completed. This type of attack is also known as metadata spoofing attack. In this way, anyone can get access to the cloud easily [3, 4].

Imagining that Raspberry Pi is connected to the internet using a wireless router and it sends data to the cloud. Here, if any hacker joins the network, then he places himself between two communicating parties and relaying messages for them. Here, the hacker is also getting full access to the data, and he can also monitor and change the contents of messages.

SQL injection is an attack that toxins dynamic SQL statements to comment out certain parts of the statement or append a condition that will ceaselessly be true. It takes advantage of the planning flaws in poorly designed net applications to require advantage of SQL statements to execute malicious SQL code. Thus, in our proposed approach, we have used a NoSQL database. In a NoSQL database, traditional SQL injection should not cause a risk to the system.

If only HTTPS is used and data is not encrypted, then it is in readable form before being sent to a private network, so it can be manipulated by any third person intriguing in the system. So, SSL Certificate (Secure Socket Layers) is used which ensures that it remains impossible for anyone else other than the receiver and sender to read the data by using encryption algorithms already integrated in it. However, HTTPS can be decoded using SSL man in the middle (MITM) through various ways. One of them is enabling the packet routing feature on hacker machines and running a DNS spoof so that the victim connects to hacker machine through HTTP/ HTTPS port [5].

In the paper “Security Enhancement for Data Migration in the Cloud”, J. R. N. Sighom et al. discussed regarding securing data in the cloud are one of the key roles. To maintain the privacy and security of data, researchers have combined several encryption algorithms like IDA (Information Dispersal Algorithm), SHA 512 (Secure Hash Algorithm), and AES 256 (Advanced Encryption Standard). The encrypted data is split into several parts. During the decoding process, the validation stages are observed first. IDA is used after the reconstruction of encrypted data, and it is reconverted into the initial data using AES 256. Consistent with the result, the common execution time is higher when the decoding time process is verification 1.453 [6].

Researchers have also tried to improve the security of data in the cloud by using the DES (Data Encryption Standard) and AES (Advanced Encryption Standard) algorithm together. Cloud computers well describe the set of resources or services that it offers on the internet, to meet the requirements of cloud providers [7].

Cloud computing systems have come a long way in implementing and executing applications in a sandboxed environment minimizing threat, and maximizing reliability, scalability, availability, and security. Although there has been much research to make the cloud platforms interoperable in between multiple organizations by organizing and reorganizing the cloud federation [8, 9], i.e., giving the companies the power to collaborate and share resources among each other. Multiple federation architecture is being proposed such as cloud brokering, aggregation, and cloud bursting and is worked upon to find out the most suitable among them [10]. However, there have been issues of portability and interoperability among them [11]. Primarily, the partially coupled federation is being followed where the company private servers and the services hosted on the public cloud are interoperable and there is an understanding and sharing of resources between the servers depending on the flow of traffic and load.