CFP last date
22 April 2024
Reseach Article

A Proposed Cloud Security Framework for Service Providers in Ghana

by Richard Okoampa-Larbi, Frimpong Twum, J. B. Hayfron-Acquah
International Journal of Computer Applications
Foundation of Computer Science (FCS), NY, USA
Volume 158 - Number 1
Year of Publication: 2017
Authors: Richard Okoampa-Larbi, Frimpong Twum, J. B. Hayfron-Acquah
10.5120/ijca2017912722

Richard Okoampa-Larbi, Frimpong Twum, J. B. Hayfron-Acquah . A Proposed Cloud Security Framework for Service Providers in Ghana. International Journal of Computer Applications. 158, 1 ( Jan 2017), 17-22. DOI=10.5120/ijca2017912722

@article{ 10.5120/ijca2017912722,
author = { Richard Okoampa-Larbi, Frimpong Twum, J. B. Hayfron-Acquah },
title = { A Proposed Cloud Security Framework for Service Providers in Ghana },
journal = { International Journal of Computer Applications },
issue_date = { Jan 2017 },
volume = { 158 },
number = { 1 },
month = { Jan },
year = { 2017 },
issn = { 0975-8887 },
pages = { 17-22 },
numpages = {9},
url = { https://ijcaonline.org/archives/volume158/number1/26872-2017912722/ },
doi = { 10.5120/ijca2017912722 },
publisher = {Foundation of Computer Science (FCS), NY, USA},
address = {New York, USA}
}
%0 Journal Article
%1 2024-02-07T00:03:39.750899+05:30
%A Richard Okoampa-Larbi
%A Frimpong Twum
%A J. B. Hayfron-Acquah
%T A Proposed Cloud Security Framework for Service Providers in Ghana
%J International Journal of Computer Applications
%@ 0975-8887
%V 158
%N 1
%P 17-22
%D 2017
%I Foundation of Computer Science (FCS), NY, USA
Abstract

The study proposes a cloud security framework for Cloud Service Providers (CSPs) in Ghana. It adopted a number of strategies, such as experimental research achieved through integrated simulation and mixed mode research method approach, using SPSS for data analysis to execute the study expectations of proposing a new cloud security framework. It also carried out an investigation into cloud security deployment technologies, and then undertook a comparative study of these technologies. In addition, it also investigated whether or not CSPs in Ghana follow any cloud security policy guidelines to deliver cloud services in Ghana. An experimental research approach adopted an Open AM server for the purpose of achieving integrity and secure authorization in the proposed framework which employed XACML Version 3.0 to define and enforce policies. Tools such as, Cygwin, curl/libcurl, Scala and IntelliJ IDEA IDE were used together to enhance simulation in the study. The results from analysis revealed that, HSM, OTFE and other cloud based security systems are the major security technologies deployed by service providers for integrity and authorization. Two curl HTTP/ 1.1 GET request were made at the service application endpoint where the access controller is wrapped over. Based on the rule set, two basic users were allowed and disallowed when accessing a cloud resource. A basic resource of an application with HTTP gave a status and a security token. To maintain the integrity of cloud data, the study recommends a root hardware TPM Chip be adopted to ensure maximum application security and systems performance. The proposed security framework assures cloud data integrity and also ensures authorization. The study therefore also recommends XACML V 3.0 to be adopted as a language for cloud systems for policy definition and enforcement.

References
  1. Bisong, A., Rahman, M.S., 2011. An Overview of the Security Concerns in Enterprise Cloud Computing. International Journal of Network Security & Its Applications (IJNSA), Vol.3, No.1, January 2011. DOI: 10.5121/ijnsa.2011.3103 30 from: http://airccse.org/journal/nsa/0111jnsa03.pdf ON 13th February,2015.
  2. Lewis, G.A., 2012. The Role of Standards in Cloud- Computing Interoperability. (October).
  3. Rajaraman, V., 2014. Cloud Computing. , (March), pp.242–258.
  4. Ramachandran, M., 2012. Service Component Architecture for building enterprise cloud services. Service technology magazine. Retrieved from http://www.servicetechmag.com/I65/0812-4 on 14th July, 2016.
  5. Mell, P. and Grance, T. 2011. The NIST definition of Cloud computing. Gaithersburg, MD: Computer Security Division, Information Technology Laboratory, National Institute of Standards and Technology.
  6. Mogull, R. u.d. Best Practices for Endpoint Data Loss Prevention, Securosis, L.L.C.D. Sponsored by Symantec Inc.
  7. Department of Homeland Security, 2004, A Comparison of Cyber Security Standards Developed by the Oil and Gas Segment. (November 5, 2004).
  8. Price Water Cooperhouse, 2014.Why you should adopt the NIST Cyber security Framework. www.pwc.com/cybersecurity. May 2014
  9. Weiss, A., 2013. Cloud Security Standards: What You Should Know Retrieved from eSecurity Planet http://www.esecurityplanet.com/network-security/cloud-security-standards-what-you-should-know.html on 16th March, 2016.
  10. Brewer, D., 2013. Moving from ISO/IEC 27001:2005 to ISO/IEC 27001:2013 The new international standard for information security management systems. BSI Group Information Security Management - Transition guide
  11. PCI Security Standards Council, 2013. Payment Card Industry (PCI) Data Security Standard. Summary of Changes from PCI DSS Version 2.0 to 3.0 Data Security Standard © 2006-2013, LLC. All Rights Reserved. Updated on November, 2013
  12. Indian Association of Extracorporeal Technology, IsecT, 2016
  13. Zeltser, L, 2016. Limitations of Frameworks in Information Security. Retrieved from htt1ps://zeltser.com/limitations-of-frameworks-in-infosec/ On 30 March, 2016.
  14. Davis, F. D., Bagozzi, R. P., and Warshaw, P. R., 1989. User acceptance of computer technology: A comparison of two theoretical model. Management Science, 35(8), 982-1003
  15. International Telecommunication Union, ITU, 2012. Cloud computing in Africa. Situation and perspective. Technology Development Centre. Regulatory & market environment
  16. National Institute of Standards for Technology, 2011.Cloud Computing Standards Roadmap, NIST CCSRWG– 070, Eleventh Working Draft, May 2, 2011 NIST Reference Architecture http://www.nist.gov/itl/cloud/refarch.cfm
  17. Naruchitparames, J. and Güneş, M.H., 2011, July. Enhancing data privacy and integrity in the cloud. In High Performance Computing and Simulation (HPCS), 2011 International Conference on (pp. 427-434). IEEE.
  18. McLellan, C. 2015. Cyber security in 2015: What to expect. Retrieved from
  19. http://www.zdnet.com/article/cybersecurity-in-2015-what-to-expect/ on 14th July, 2016.
Index Terms

Computer Science
Information Sciences

Keywords

Proposed Cloud security framework Cloud Service Service Providers in Ghana Cloud security Policies Cloud security technologies Framework for Cloud security. CSP - Cloud Service Provider DEK- Decryption Encryption Key OTFE- On-The-Fly Encryption TDE-Transparent Data Encryption AC-Access Control AP- Attribute Store Policy Store XACML-eXtensible Access Control Markup Language.