Cloud solutions in education
Josef Horalek, Ondrej Marik, Sona Neradova,
Stanislav Zitta
Faculty of electrical engineering and informatics, University of Pardubice, Pardubice, Czech Republic [email protected], [email protected], [email protected], [email protected] Abstract—These This paper describes the cloud solutions
and its possible use in education. First part is devoted to introduction in to the cloud technologies and terms used in this area. Second part describes penetration testing of cloud solutions as an important part of security concerns of implementation. Last part introduces an ideas for implementing cloud solutions in to the technical education on technical universities.
I. INTRODUCTION
The term “cloud computing” was defined by American National Standardization Institute (NIST) in 2011 as follows [1]: “Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models.” This particular model gives the most emphasis on availability. It is composed from three service models and four deployment models. To name services as a cloud services, according to NITS it should have the following characteristics [2]:
• On demand, self-service – services are available for end user almost immediately after the sign up, without bigger delay.
• Broadband network access – services have to be available via computer network from desktops, notebooks, mobile devices etc.
• Resource pooling – resource are shared between isolated customers.
• Rapid elasticity – solution is able to fast react on bigger demand on system resources (even automatically), sources are infinite from customers point of view.
• Measure service – solution is able to monitor, manage and report amount of used resources to customer and provider (for example storage space, data transfers, number of logged users etc.).
Individual elements of cloud computing can be divided from topology point of view on three groups: clients, data center and distributed servers. Each of these groups has irreplaceable role in whole architecture. As a client we can call common workstation, desktop, notebook, tablet, mobile phone etc. These devices are used by end users and they are connected via computer network with distributed servers and data centers across the world. Clients can be divided as thin where all computing and data manipulation is on server side and client is used just for data
visualization and input control, and for thick client which is a common computer. Data center is a place where the servers are operated and where are storages with applications and cloud computing data. This place must have perfect connectivity and equipment for high availability which is usually about 99.9% and more. Physical servers usually use some kind of virtualization technology.
Virtualization technology allows partitioning of computing sources on one physical system so we can divide on source for more than one operating system. Source can be understood as whole physical server or its parts – CPU, RAM, network interfaces, data storage etc. There are also more approaches for virtualization in cloud computing environment but most common is full virtualization or paravirtualization. Full virtualization is technique where is simulated whole hardware. It allows running of operating systems without additional modification so from operating system point of view it is the same as running on physical hardware. It also allows running of more virtual machines in one time with different operating systems but all of them are running on the same hardware architecture. Big advantage of this technique is isolated run of different operating systems (Windows, UNIX …). On the other hand the disadvantage is, that all virtual machines have installed complete operating system and it consumes very much storage space and it is more computationally demanding.
Paravirtualization is technique where virtual machines use just modified copy of layer responsible for physical hardware. Hosted operating system also contains tiny modifications of its core which are necessary for fast access on the physical hardware. Hosted operating systems knows, it runs in virtual environment. In many cases operating systems also use different approach for managing system resources like RAM. Big advantage is high power and significantly smaller virtual machines images. The disadvantage is modification which is necessary to do in hosted operating system.
To ensure high availability of servers, they are not usually in the same place. Mostly they are geographically dispersed across the world, but from cloud user point of view, they works as if they are in the same place. User is completely isolated from informations about real server he communicate. As a result of this, when something happen with server in one location, users can access server in other location without interrupting of services. For example Amazon, Google and Microsoft has data centers dispersed across the continents. Important fact is, that not all services can be distributed.
More information about virtualization which is the core technology of cloud computing and services with their performance comparison can be found in [3] [4].
II. CLOUD
A. Cloud in terms of services – Service Models
Cloud computing was already in the early stages defined with shortcuts SaaS, PaaS and IaaS. This is known as service models.Service model determines the form of “rent” of computing time and resources from the fund of cloud solution provider. Compared to common webhosting services (renting the space and application for web pages) is the difference that services are usually charged by smaller time units (even by hour) and amount of allocated resources can be dynamically changed (rapid elasticity). Cloud technology renting can flexible react on the step increase needs and provide better bandwidth for time of bigger load.
IAAS (infrastructure as a service)
Infrastructure as a service – providers offer computers (usually virtual computers), network devices, storage space etc. in this model of services. Access to these devices is realized via data network from user’s computers. The client does not need to buy servers, software, racks even pay for it housing in data center. He just simply rent all of these sources from service provider. Rent for services are usually based on the merits so provider usually charge it by the consumed resources (mostly by hour). The basic measured resource are CPU, RAM, storage, connectivity and it also depends on the form of service level agreement (SLA).
One of the important benefits of these services for the customer is scalability. Provider usually offers simple management tools to monitor current parameters, change performance and setup virtual servers. As an example of these type of services can be Amazon Web Services (Amazon Elastic Compute Cloud), IBM SmartCloud Enterprise or Windows Azure.
SAAS (software as a service)
Software as a service – application is in this model hosted and offers like a service for customer which access it over internet. Customer can simply use the software on a remote as a service. SaaS was developed as reaction to the need to reduce costs on software. Total cost on applications are lowered for example by missing licenses for server side of products. For customer it means he does not care about managing and supporting of application, because provider does this for him. The disadvantage is that providers can make decision and change the provided application (reduce functions, change design, upgrade and functionality change). On the other hand this could be also one of big benefits for customers who wants up to date version of its software.
Software that is well suited for SaaS is the one that performs simple task and does not need complicated integration with others systems. Typical example of this type of software is Customer Relationship Management (CRM) software for managing relationship with customers for example Microsoft Dynamics CRM. One of the most known SaaS software is Office 365.
In early stages was SaaS marked as potential security risk. Many companies want to keep its internal data under own control but in nowadays has SaaS providers their servers secure significantly better than the customers themselves can afford, and offer even more generally added services for even greater security.
A certain disadvantage is when customer wants to change SaaS provider. It can be very difficult or even not possible. Usually if there is a way to do it, is not user friendly and it needs investments.
PAAS (platform as a service)
Platform as a service – it is almost same model as a SaaS, but services provided by these products is not for the end user but for the developers. The main aim of these services is to provide resources for development, testing, implementation and application hosting. It also covers whole lifetime cycle of application development and application services. Cloud service provider provide to customer environment where is possible to create, host, manage his application and provider also gives to him products for web services integration, databases, security tools, storage, scalability, version control etc. As an example we can mention Google App Engine and Windows Azure. Disadvantage of these services is dependence on one provider and proprietary solution so portability of application is limited. Also if provider ends up on market, customers has to develop their applications for different service provider or they lost their data.
B. Cloud from the perspective of ownership
Public cloud
Under the term of public cloud we can imagine services of providers, which are mostly the same or similar for all clients across the world. It is shared services provided to anyone from the general public who is interested. We can typically imagine the public and free mail services like seznam.cz, gmail.com or the oldest one hotmail.com.
The basis of public cloud is a huge cluster (loose group of computers that work closely) containing hundreds or even thousands of physical servers and individual virtual machines deployed over these clusters. In contrast to private cloud is usually based on specialized hardware and customized server software. Computing resources are shared across the customers.
Private cloud
Problem of private cloud from customer’s perspective is security concern. Companies are afraid of their data because they do not know where are stored or they do not trust to service provider. Truth is that in case of public cloud, the data are stored on one particular place but they can move across datacenters or continents in this can have several legal problems like the one where laws say that sensitive data (medical informations etc.) cannot leave the country.
The solutions is very simple – private cloud. It is solution for one particular subject which is operated on the dedicated resources. Resources can be inside the organization or even outside but customer has it under control. Also he does not lose all advantages like scalability, efficiency etc. He has also simple web management interface where he can set up his environment and it is possible to run automated scenario and create, delete or manage virtual machines. All of these command are automatically without intervention of data center administrators.
If we compare SaaS in the public cloud and in the private one, public services also does not have any initial costs. There are usually big initial investments connected with private cloud deployment and this solutions is more or less targeted on bigger companies. The advantage,
however, is the possibility of customization of solution on need of customer which is not possible in public cloud solution. Example of private cloud solution can be Microsoft Private Cloud.
Community cloud
If there are more companies with the same target or field of interested, they will probably need or require similar or same cloud services. Community cloud provides these same services (usually by field of interest) for more organizations in same business sector. Community clouds helps to small companies to decrease total costs on IT or make their IT build on state of the art. Community cloud can be applied in government’s organization and administration. Example of it is IBM Federal Community Cloud.
Hybrid cloud
Under the hybrid cloud we understand union of two or more solutions defined earlier in paper – public, private or community cloud. Although it looks as a one solutions from “outside”, there are isolated parts of different type of cloud solutions which communicates with each other. So how can the realization look like?
If customer has its own resource which he wants to use in cloud solution, he can connect these private resources with public cloud with hybrid cloud tools. For example in common operation services can be in the private cloud but in case of failure or maintenance the can be moved into the public cloud. The problem of hybrid cloud is security. Security experts says that there is no simple recipe for securing these type of scenario. Example of this technology can be VMware vCloud Datacenter or combination of Microsoft Private Cloud with Windows Azure.
Because we mention cloud security several times in this paper, we would like to introduce this topic to you more so second part of this document is devoted to security of cloud solutions.
III. SECURITY OF CLOUD SOLUTIONS
As cloud market is growing rapidly, cloud security is becoming more and more important. Amount of data that are top secret, and which need to be secured as much as possible and are stored in a cloud, grows continually. Therefore penetration testing needs to be done in order to determine possible security issues that could lead to data leak. When data leak or any similar security incident occurs, a typical consequence is loss of reputation of a cloud provider and a decrease in customer numbers.
It is necessary to deploy methods that help to reveal unsecure spots of computer systems. One such method is a discipline called penetration testing. Penetration tester is a skilled person who has knowledge across varied computer fields including programming and computer networks. His task is to simulate hacking activities against tested components, but with one essential difference. The tenant of the tested infrastructure usually asks the penetration tester for a penetration test and the penetration test is done with the tenant’s full knowledge.
The first thing which needs to be defined prior to start of the penetration test is scope. Scope of a penetration test is a set of components, against which the penetration test is performed. In standard enterprise networks, the scope is usually determined by an infrastructure owner that is a
CIO or a CEO of the company. In a cloud, on the other hand, the fact that a common infrastructure is shared by multiple customers and one needs to be sure, that a planned penetration test does not affect other tenants on said shared infrastructure needs to be taken into account. The scope of a penetration test is mostly influenced by cloud deployment model. In other words, the penetration tester and the tenant have to take into consideration whether the tenant‘s deployment model is IaaS, PaaS or SaaS.
IaaS model of deployment is a model, where a penetration test is usually the widest in terms of tested components. Typically, the tenant rents one or more multiple virtual machines, where his applications run. Since the virtual machine is a property of the tenant, the tester can verify whether there are any possibly exploitable vulnerabilities in the operating system of that virtual machine. After determining, whether the operating system is safe for production or not, the testing can move towards the application itself. Different approach can be chosen hen the desire for a penetration test stems from a provider. This extends the possible set of tested components by hypervisor. Virtual machine escape attacks have been known for a few years [3].
PaaS model of deployment narrows the set of components, which can be tested. In this deployment model, the tenant provides the application, the provider delivers the rest. One potential issue is associated with this fact. Some software components are usually shared by multiple tenants (e.g. operating system) and there is a slight possibility, that the penetration test will affect another tenant’s application run. It is so because e.g. resource exhaustion can be a collateral effect of some penetration testing techniques. Solution to that problem can be sandbox testing. The tested software can be deployed aside from production environment and appropriate penetration testing techniques can be carried out against that sandbox with no possibility of influencing or crashing another tenant’s properties.
With SaaS deployment model, the set of components that can be tested narrows even more. In SaaS, tenant usually leases software product which runs in a cloud and that software product is usually the subject of interest of the penetration tester. There is a possibility to use some approaches known from classic penetration testing such as usage of methodology. Well-known methodology for testing software security is OWASP. Although this methodology is primarily used whit testing security of web applications, principles introduced there can be used for software products in general.
Another feature which can be deployed in order to increase cloud security is introspection. Whether it helps or not is actually a tricky question. Basically, virtualization allows only limited insight into virtual machines which are hosted on a hypervisor. One can’t monitor and analyze data stored on hard drives or executed in memory. Introspection introduces a new approach which allows, for example, to monitor data in memory, or data flowing out from or into the virtual machine. Although this undoubtedly can increase level of security under certain circumstances, under another circumstances the level of security can decrease, ironically. The level of security decreases mostly in situations, when the hypervisor itself is under attack. When a successful exploitation of the hypervisor happens,
the attacker gains permission to interact with or monitor all virtual machines that have introspection enabled and are running on the exploited hypervisor.
Since cloud technology is improving day by day and the cloud market is growing, the topic of cloud security is becoming more and more important. Proactive approach from providers of cloud services is necessary, because only customers on their own are not able to guarantee system safety. There is also a need for robust and complex methodology for cloud penetration testing purposes.
IV. CLOUD ON UNIVERSITIES
Before we proceed to the next part of this paper, we should first define the concept of modern ICT as it is understood in the emergence of new technologies and their growing influence on the business needs of the company. While in earlier times, IT departments were perceived more as a necessity that helped cover the basic needs for the operation of computers, today is the IT department in many companies, one of the most important department with big impact on the business model of the company. In general terms, IT departments are changing and they transform their infrastructure to service model. IT department are building larger or smaller data centers over which they guarantee services required by business needs as well as their availability. In practice, there is some standardization and definition of processes within the ICT infrastructure, which in turn allow them to automate and implement them on the cloud solutions.
Normal University is in terms of ICT society just a large corporation with hundreds or thousands of users, which has many specific requirements in some area. Modern universities provide to their users service of data infrastructure, access to information systems, communications equipment, specific internal applications, user support etc. From the perspective of the overall ICT environment we can divide it into two parts – internal and students. Each of these sections has its own specifications and requirements, however, both parts should cooperate with each other and share the infrastructure.
A. Internal ICT
Internal part of ICT services is targeted on the internal needs of university and its employees. It usually provides services like Group Ware, ERP, CRM and DMS. This part of environment is mostly well planned and predicted. We can more or less simply predict that at the tax preparation time ERP will be busy slightly more than usually because accountants will close financial statements and will perform extensive calculations on the data while in normal workload we will need slightly more of performance move on the other departments. Also there is advantage that users have work computers which can be managed and control by IT department so they can predict impact of employees on the infrastructure.
B. ICT for students
Completely different situation is on services provided to students. Here, the emphasis must be on the security, because we never do not know what device student use and if it is not infected. Also we do not know if someone stole his password or computer. Other area we should take care of is mobility of services and its availability outside of the campus. From performance point of view we can
observer the problem with elasticity. Part of ICT for students can suffer by the tip of the performance capability. As an example we can show internal information system for student’s agenda (creating a schedule, exams registration, study materials, grants, tests, etc.) on the University of Pardubice. This system will be with high probability load very unevenly and we can expects higher load at the start of the semester and at its end.
C. Reference system
As we mention earlier example of reference system can be information system STAG, which is used on the University of Pardubice. Error! Reference source not
found. shows unique visits of this system from 1.9.2013
to 28.2.2014. This is the time of fall semester which start and end is indicate by the red lines. We can observer that traffic is growing near the start of the semester where students prepares their individual schedule and signs up on courses. Second wave is closely to the end of the semester when students finished their home works and signs up on the exams terms. After the end of the semester we can observer that slowly falls to the average. This fall is influenced by traffic grow when students create individual schedule for the summer semester.
In terms of total traffic is very interesting comparison of daily traffic and average one. This situation is showed on
the Error! Reference source not found. and we can see,
that infrastructure will be used over the average only in 39% of total computing time.
Figure 2. Server visits from average value perspective When designing the infrastructure required to run this system, we would most likely suit rather a solution that covers the average traffic, but also would have been able to multiply the infrastructure in the short term to cover the bigger traffic tips. Exactly for these situations is appropriate deployment of cloud services that provide us these features both in the form of increased performance provided by the infrastructure ( PaaS ) such as load balancing across multiple servers ( IaaS ).
Between other aspects we should consider during planning process is access to information systems of university from networks outside of the campus and especially from abroad from mobile devices. In this case can be the interaction and availability of information system influenced by worst data connection and big
latency time in mobile networks. In many situation this problem can looks as insignificant but in case that our university has a lot of external employees and students in the branches or research centers across the world this problem this problem is really serious. It is because in this branches we can expect many people who needs internal system if they have to wait for long response of it, their work can be very ineffective. Solution of this problem is not simple and in case we try to solve it by our infrastructure, it is also usually expensive. The first and most used approach for this situation is installation of private infrastructure on every branch and creating of secure connection to data center in university campus. This can be reached by technologies like BranchCache, site-to-site VPN, terminal services etc. More elegant and in our opinion more effective approach is use of global cloud solution providers. They can offer us server across the world in their datacenter so every time user wants to access our system, the network and application protocols finds closest server for him. This solution reduces latency to minimum. Error! Reference source not found. shows illustration of the proportion between mobile devices and classical computers of unique access on our reference systems during fall semester. Although 11% of the approaches may seem insignificant, in fact, this number represents 224 918 of the total 2 025 330 unique visits during the reporting period (fall semester).
Figure 3. System access based on device
V. CLOUD SERVICES IN EDUCATION
This part of paper is devoted to concrete use cases and ideas for use of cloud services for communication and education on technical university.
A. Means of communication
Every organization in nowadays have to provide for its user at least two basic services – emails and phones. This is a matter of course for university employees but how to deal with communication for students? Because there are too many students according to employees on every university, the most often solutions is deployment of two independent systems. For internal staff IT department often choose standard Group Ware like MS Exchange, IceWarp, IBM Lotus Notes etc. For students they choose something low cost like standard email solution with access via POP, IMAP and web based on open source
technology. It is understandable because universities are companies like others they also wants to decrease total costs on ICT.
One of the way how to do it is implementation of cloud solutions of big market players – Google (Google Apps) and Microsoft (Office 365). Both of them provide their basic cloud solutions of Group Ware system for education organizations completely for free. These editions contains also tools and function for integration of these service in to university infrastructure so we can connect it with authentication and authorization systems and with tools for management of our infrastructure. End user must not know they works with cloud solutions. In case of implementation of Office 365 from Microsoft, universities also got sophisticated solution for videoconferencing and cooperation Lync which is possible to use as for internal and external communication even for online education and conferencing. Educational institutions can then use cloud-based solutions that get completely free to completely change the way of communication and teaching.
B. Programing of internet and mobile applications
Programing of internet and mobile applications is one of the core stones of the current generation of developers. Most of universities respect this fact and they try to react and implement these courses into their fields of study. The problem that is unfortunately encountered in practice is that students learn how to design, develop and debug application on their computer but mostly they do not finish the whole development process with deployment phase. Most of professional developers know, that correct application run on development infrastructure is not the same as in production environment. There you can find problems you cannot simulate and you can find weak place of code according to performance, security, response etc. Cloud solutions can more or less help to provide to students efficient and real environment for application deployment. It can be services like Azure from Microsoft or AWS from Amazon which provide development platform for globally available applications. These products also offer specialized components for mobile and web service so student can learn and try to develop applications which can test in production environment but the can also publish them with zero cots and try to rule the world. The main advantage is that these type of service support beginners and students so they can use special tariff where they got for example 100$ service for free every month. Another advantage is that most of this platforms offers free IDE for development so university must not pay for licenses. In many cases may be undesirable fi students to use these public services. It can be given by study materials and exams when university wants to keep continuity of study fields. In these situations is solution a private cloud with own PaaS. This option offers for example Microsoft with his product Azure.
C. Managing operating systems and computer networks
In course like managing and administration of operating system students learn how to install, configure and mainly use server side operating systems in corporate environment. Problem of these course is that for most interesting and useful practice we need several servers and end devices. These type of infrastructure for every student is mostly not available because is necessary just for time of practice so universities solve it by virtualization on
students desktop. Problem is that desktop are not that powerful as a server and their hardware limits are significant. Also there is problem that if want to use virtualization on client computer, we are missing some function compare to server virtualization.
Much better solution would be use of private cloud solution where we can prepare resource pool for every student. In practice then every student has private amount of RAM, CPU and storage and he can built labs on his own or by starting automatized scenario. If use this solution we can also do more interesting labs like network deployment or managing large amount of client computers.
Related to managing operating systems are computer networks. Teaching of this course is highly connected to Cisco network academy so students has enough equipment for labs and they can focus just on the network layer. Unfortunately this equipment is not sufficient for real life scenario where students will often needs to setup server for communication with network devices to cooperation. As an example we can provide connection between virtualization server and switches where we need backup LAN connection and divide data from VLAN on the server.
As a next scenario where cloud solution can help us is connection internal infrastructure with public cloud. Does not matter if it is by site-to-site VPN or by technologies of operating systems. My own experience was that even if I knew how to configure site-to-site VPN from CCNA security in real implementation, I had huge problem to implement it with VMware cloud solutions from public provider. Days when we debug it with technicians from provider gave me a lot of experience I could get in the school. To be clear I have to mention, that problem was in incompatibility of providers gate. I believe if university would have private cloud solution for education purposes, we can test it and students can be prepared for real life and challenges.
VI. CONCLUSION
The main aim of this paper was to introduce to reader the problematic of cloud computing, its security concerns
and implementation and possible use in technical education. In first part we have described theory and common terms used in this technical area. Second part was devoted to security of cloud solutions and its penetration testing.
We have provided several ideas and tips how cloud solution can make academic life better and more interesting for students in last part of paper. We believe that cloud computing and generally cloud solutions are the future of modern digital era and it should be implemented into education plan and studies because when coming generation comes into to their first job, they will be using these solutions every day.
ACKNOWLEDGMENT
This work and contribution is supported by the project IN2 CZ.1.07/2.2.00/28.0272 financed from European
Social Funds. REFERENCES
[1] National Institute of Standards and Technology (NIST), „Final Version of NIST Cloud Computing Definition Published,“ 12 5 2012. [Online]. Available: http://www.nist.gov/itl/csd/cloud-102511.cfm. [Přístup získán 31 3 2014].
[2] P. Mell a T. Grance, „The NIST Definition of Cloud Computing,“
9 2011. [Online]. Available: http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf.
[Přístup získán 28 3 2014].
[3] J. Horalek, P. Suba a M. Hatas, „Comparison of technologies for software virtualization,“ v Recent Advances in Applied and Biomedical Informatics and Computational Engineering in Systems Applications - AIC'11, BEBI'11, Florence, 2011. [4] J. Horalek, L. Sobeslav a J. Matyska, „Performance comparison of
selected virtualization platforms,“ v CINTI 2013 - 14th IEEE International Symposium on Computational Intelligence and Informatics Proceedings, Budapest, 2013.
[5] M. Mimoso, „IRTUAL MACHINE ESCAPE EXPLOIT TARGETS XEN,“ 2012. [Online]. Available: http://threatpost.com/virtual-machine-escape-exploit-targets-xen-090612/76979.M. Young, The Technical Writer's Handbook. Mill Valley, CA: University Science, 1989.
