Increase in healthcare awareness has raised the number of subscriptions for e-Healthcare applications. Consequently e-Healthcare application providers are adopting Cloud computing to handle immense processing load and to reduce service delivery cost. Identity management has been an issue which hinders in adoption of e-Healthcare applications, due to sensitivity of the data involved in it. Existing Cloud based e-Healthcare applications provide access to their services though Single-Sign-On (SSO) protocols. Traditional SSO uses asymmetric encryption, thus increasing the execution load on Cloud gateway and on Identity Provider as well. In this paper we propose a methodology of SSO for Cloud applications by utilizing Peer-to-Peer concepts to distribute processing load among computing nodes within Cloud. The proposed scheme, called Chord for Cloud (C4C), decreases the number of authentication request send to Identity Provider and disseminates the authentication process within the federated environment of Cloud, through Chord algorithm. The effectiveness of the proposed technique has been shown through argumentation scenarios.
Chord Based Identity Management for e-Healthcare Cloud Applications Il Kon Kim, Zeeshan Pervez, Asad Masood Khattak, Sungyoung Lee Department of Medical Informatics Graduate, Kyung Pook National University, Department of Computer Engineering, Kyung Hee University, Korea ikkim@knu.ac.kr, {zeeshan, asad.masood, sylee}@oslab.khu.ac.kr Abstract - Increase in healthcare awareness has raised the number of subscriptions for e-Healthcare applications. Consequently e- Healthcare application providers are adopting Cloud computing to handle immense processing load and to reduce service delivery cost. Identity management has been an issue which hinders in adoption of e-Healthcare applications, due to sensitivity of the data involved in it. Existing Cloud based e-Healthcare applications provide access to their services though Single-Sign-On (SSO) protocols. Traditional SSO uses asymmetric encryption, thus increasing the execution load on Cloud gateway and on Identity Provider as well. In this paper we propose a methodology of SSO for Cloud applications by utilizing Peer-to-Peer concepts to distribute processing load among computing nodes within Cloud. The proposed scheme, called Chord for Cloud (C4C), decreases the number of authentication request send to Identity Provider and disseminates the authentication process within the federated environment of Cloud, through Chord algorithm. The effectiveness of the proposed technique has been shown through argumentation scenarios. I.I NTRODUCTION Wireless Sensor Network (WSN) nowadays becomes more attractive to computer science researchers, due to its low cost and ease of deployment within the selected areas. Sensors are used to monitor patient’s health status and movements to provide health services. Increase in healthcare awareness has encouraged companies like Microsoft and Google to provide e-Healthcare applications. Microsoft has developed a platform to store and maintain health and fitness information, called Health Vault [1]. It is a cloud service that helps people collect, store, and share their personal health information. Meanwhile, Google provides a personal health information centralization services, known as Google Health [2], which allow users to volunteer their health records, either manually or by logging into their accounts at partnered health services providers, into the Google Health system. Health Vault and Google Health both are SaaS [3] based applications, which provides health services to patients, medical doctors, pharmacies and laboratories. SaaS is becoming increasingly popular, due to the fact that services which are offered through SOA can be configured in Cloud, which makes them the most suitable candidate for Cloud computing. Service accessibility in SOA is one of the most important concerns for both service provider and service consumer. A number of different algorithms have been proposed in literature and standards have been developed by the industry. However, algorithms and standards were developed keeping in view client server architecture of internet. Employing these standards to Cloud services restrict service provider to fully avail benefits of Cloud computing. Single-Sign-On (SSO) provides seamless services accessibility. SSO methodologies are aligned to SOA, but when services are hosted to Cloud this ease of accessibility raises concern like computation service latency and computation load of asymmetric encryption on service provider and identity providers end. In order to make existing solutions work with Cloud there is need to alter the way session information is manipulated and stored in Cloud. Cloud provides enormous process and storage power. We can harness these implicit benefits of Cloud to make hosted services more responsive and secure, by limiting the interaction required to provide SSO functionality. The rest of the paper is organized as follows. Section 2 discusses the related work. Section 3 presents the proposed algorithm. In Section 4 we will discuss algorithms for Cloud service provisioning. Section 5 discusses the implementation strategy of proposed algorithm and in Section 6 we will conclude the paper. II. R ELATED W ORK Cloud computing is being put to work in variety of services and solutions like collaborative services, social network, hosted emails and online backup services. Most significantly it is being adopted by e-Healthcare applications. In an e- Healthcare applications sensitive data is manipulated which includes patient’s medical history, laboratory test report and medicine prescriptions by the doctor. Numerous authentication techniques have been proposed in literature and adopted by service provider. OpenId and SAML are two authentication mechanisms which have been used by Microsoft and Google in their e-Healthcare services. Microsoft Health Vault provides support for OpenId [4], whereas, Google Health uses it own SAML [5] based authentication model. Both of these solutions provide seamless services access through variant SSO techniques. OpenID and SAML were developed to support SSO in web services. In most of the cases web services are migrated to Cloud, but applying the existing authentication techniques do 2010 10th Annual International Symposium on Applications and the Internet 978-0-7695-4107-5/10 $26.00 © 2010 IEEE DOI 10.1109/SAINT.2010.68 303 2010 10th Annual International Symposium on Applications and the Internet 978-0-7695-4107-5/10 $26.00 © 2010 IEEE DOI 10.1109/SAINT.2010.68 352 2010 10th Annual International Symposium on Applications and the Internet 978-0-7695-4107-5/10 $26.00 © 2010 IEEE DOI 10.1109/SAINT.2010.68 372 2010 10th Annual International Symposium on Applications and the Internet 978-0-7695-4107-5/10 $26.00 © 2010 IEEE DOI 10.1109/SAINT.2010.68 372 2010 10th Annual International Symposium on Applications and the Internet 978-0-7695-4107-5/10 $26.00 © 2010 IEEE DOI 10.1109/SAINT.2010.68 372 2010 10th Annual International Symposium on Applications and the Internet 978-0-7695-4107-5/10 $26.00 © 2010 IEEE DOI 10.1109/SAINT.2010.68 372 2010 10th Annual International Symposium on Applications and the Internet 978-0-7695-4107-5/10 $26.00 © 2010 IEEE DOI 10.1109/SAINT.2010.68 371 2010 10th Annual International Symposium on Applications and the Internet 978-0-7695-4107-5/10 $26.00 © 2010 IEEE DOI 10.1109/SAINT.2010.68 379 2010 10th Annual International Symposium on Applications and the Internet 978-0-7695-4107-5/10 $26.00 © 2010 IEEE DOI 10.1109/SAINT.2010.68 391 not conform to the Cloud computing core properties which is efficient resource utilization. Applying existing authentication techniques creates bottle necks, during service delivery. OpenId and SAML are third party based identity management protocol. Figure 1 shows identity provided by third party IdP. Every authentication request which is send to IdP, requires asymmetric encryption at both ends. [6], [7] explains that asymmetric encryption is more resource intensive as compared to symmetric encryption algorithms. In addition to that, whenever request is routed outside the federated environment of the Cloud, probability of security breach increases. There is need to limit down the resources exhaustive encryption and routing of request outside the Cloud. Figure 1 Cloud Authentication Procedures: Identity Provded by third party identity provider. Similarly, Figure 2 shows identity provided by Cloud’s Identity Management System (IMS) itself, rather than the third party IdP. There is huge amount of load on IMS. For every service request IMS has to verify service consumers’ credentials and session information to provide seamless service accessibility, through SSO. This causes service latency, and greatly affect Service Level Agreement (SLA). Figure 2 Cloud Authentication Procedures: Identity provided by Cloud Service Provider. Secure Enterprise Services Consumption for SaaS Technology Platforms [10] has proposed a Kerberos [11] based authentication for SaaS. Although Kerberos has been adopted by a number of applications including Microsoft Windows, however it was not designed keeping in view the virtualized environment of Cloud. SSO framework proposed in [12] uses OpenId and OAuth to authenticate and authorized service consumer. They did not consider resource intensive asymmetric encryption which is required on both sides (Cloud and IdP), which could lead to less responsive service. Keeping in view the limitation of existing authentication procedures, here we propose a solution which limits the number of asymmetric encryption required and reduces the execution load on IMS, by distributing authentication capabilities on computing nodes throughout the Cloud. This increases end user response time and at the same time decreases the risk, faced by every authentication request outside Cloud Area Network (CAN). III.P ROPOSED S OLUTION :C HORD F OR C LOUD (C4C) Peer-to-Peer (P2P) is relatively mature as compared to emerging Cloud computing paradigm. A number of P2P algorithms have been published in literature and implemented by the software industry. Anonymity, efficient searching, load balancing and security are some of issues addressed by these algorithms. In the proposed solution we have selected Chord (P2P routing algorithm) [9], for its robustness and efficiency to distribute the processing load among the computing node. C4C utilizes Chord to distribute session information among the computing nodes within Cloud. Once information is distributed then it can be authenticated by the individual nodes itself rather than by single dedicated server (IMS). Figure 3 shows the proposed architecture. User trying to access a particular service hosted in Cloud, sends his request to Cloud Gateway. Upon receiving the request it routes the request within Cloud, on which decision can be made by respective computing node. Instead of deploying entire authentication logic at a single compute node, it is distributed within Cloud. Every computing node is guarded by Cloud IDS (Intrusion Detection System) and Cloud Firewalls, sensitive information can be stored and manipulated on them without much concern of security. Figure 3 Chord for Cloud (C4C): Managing Single-Sign-On Process in Cloud through Chord. The core benefit provided by Chord is dissemination of working load within the Cloud. Once user is authenticated either by third party IdP or by IMS, session information is distributed within the Cloud. Next time, when user requests for a service its authenticity can be checked by individual node rather than routing the request outside federated environment of Cloud or to Cloud IMS. C4C is divided into five different components. Collectively these components provide user authentication procedure for the Cloud. Initially, user can be authenticated by any authentication protocol, once authenticated, than its session information is stored in Cloud through C4C. A. Cloud Gateway (CG) CG acts as a point of interaction between service consumer and hosted service, shown in Figure 3. In C4C, CG provides functionality of a broker. It takes request from service consumer irrespective of its type route it in the Cloud. According to type of the request appropriate response is generated from Cloud. This generated response could request User Laboratory Service Patient Medical Record Diet Planner Hospital Service Pharmacy Service Identity Provider Emergency Service Query User Credentials Asymmetric Encryption to secure communication Cloud Gateway User Cloud Gateway Identity Management Service Access Cloud Service Register to the Identity Provider User Authentication & Session Management Load Laboratory Service Patient Medical Record Diet Planner Hospital Service Pharmacy Service Emergency Service Node Manager Key Manager Session Manager Cloud Gateway Chord Manager Cloud Resource Manager User Access Cloud Service Cloud Service Response 29 75 1 2 17 4 304353373373373373372380392 service consumer to prove his authenticity or could include actual response generated by the service, if user is legitimate and has access privileges to use the service. B. Cloud Resource Manager (CRM) Seamless resource availability is one of the core feature of Cloud computing. Clouds are deployed in huge data centers. A single data centers has thousands of storage and compute nodes. In such an environment keeping track of resources is a colossal task. As shown in Figure 3 CRM plays a fundamental role of resource management in C4C. Whenever there is a need to remove or add a new node in Cloud, CRM is intimated. At any quantum of time CRM can provide information about the current execution load and available computing and storage capacity in Cloud. C. Session Manager (SM) Access to a particular service requires an active session, which provides information about the user validity. A new session is created whenever legitimate user proves his identity to the Cloud or to third party IdP, which remains valid for a particular period of time. Session provides information about the legitimate user, when ever user tries to access a service its session value is validated, if succeeded then next authorization process starts. SSO is a powerful methodology, which increases user experience in consuming hosted service. The core purpose of SM in C4C is to create session for legitimate users. Once created, information about the user and its validity period is encoded in the session, and then it is assigned to a particular node within the Cloud. SM works in conjunction with Chord Manager (CM) and Key Manager (KM) to distribute session inside the Cloud. D. Key Manager (KM) In Cloud as all of the resources are deployed within the federated environment, sensitive information can be distributed among the resources. In C4C we are distributing the session information among the computing nodes within Cloud. There is a valid reason to do this, as all resources are protected from Cloud enterprise security components like Cloud IDS and Cloud Firewall. Shown in Figure 3, KM works in conjunction with SM. Whenever a session is created, KM is informed to assign an appropriate key. Numbers of methods are available to assign keys, one way is to compute the Hash value and consider it as a key. Then instead of refereeing the actual session, it hash value could be used, this speeds up the process of assigning sessions to particular node within the Cloud. E. Chord Manager (CM) Chord has proven his robustness and usefulness in P2P computing. Although the concepts of P2P and Cloud computing are poles apart, but the behavior of Chord is so adaptive that it can be put to work within the Cloud. The core purpose of CM is to manage the session information, which is distributed among computing nodes. CM works with KM to add new sessions to the Cloud. It utilizes the information provided by the CRM to redistribute key among computing nodes in case when nodes join or leave (become active/inactive). F. Node Manager (NM) Virtualization is the concept which gives birth to Cloud computing. Computing power was available before virtualization, but it provides the concept of on-demand resource availability. Through it, resources are managed and utilized efficiently. It makes possible to replicate the resources to cater high processing load and then reclaim them when they are no longer required. Figure 4 Compute Node, having Session Information, Service Infromation and Finger Table. NM is a part of C4C which provides information about a particular node within the Cloud. In contrast with CRM it provides detailed information about a single computing node. Such as, how much processing load is currently handled by a node, and which services are hosted on it, and most importance which user can be authenticated through it. Figure 4 shows how information about the active sessions stored on the individual node. It keeps track of the active sessions, number of request executed by a particular user and time of the last request executed. Finger Table: The core purpose of finger table is to speed up the searching within available resources. With the help of finger table locating key within the Chord becomes extremely efficient. Each node keeps information about certain number of nodes. These nodes are scattered throughout the Chord. Main purpose is to cover maximum area of Chord. In Figure 4 each computing node keeps information about the other node within the Chord. So whenever there is request to locate a session key finger table is scanned first instead of scanning the whole Chord. If the information about the resource is not available in the finger table then request is delegated on to the node which is most likely to have the information. Keys are assigned to individual nodes relevant to their Id. IV. S ERVICE P ROVISIONING IN C4C C4C provides the functionality of SSO, through which services can be provisioned seamlessly. In Error! Reference source not found. 5 service provisioning algorithm is proposed. At first user session value is extracted out from the request, and then it is routed in Cloud. Once request is routed to the particular node, its session value is validated and if Laboratory Service Patient Medical Record Diet Planner Hospital Serivce Pharmacy Service Emergency Service Session Info Key LRT RC D06BD19A 2010.01.10 13:55:02 5 E1D08D62 2010.01.10 12:14:17 18 D63338F4 2010.01.10 13:55:37 7 BBAE54DC 2010.01.10 08:23:18 11 Finger Table n Key Range N+1 2 N+2 3 4 N+4 5 10 Node 2 4 5 2 Node Manager Key Manager Session Manager Chord Manager Cloud Resource Manager Cloud Gateway User Access Cloud Service Cloud Service Response 305354374374374374373381393 succeeded access to the service is granted. Difference between the currently employed SSO methodology and C4C is depicted in Equation 1 and 2. defines the service provisioning function, which consists of service execution ɘ and authentication. Ɂ defines third party authentication which included asymmetric encryptions and decryptions, and ɀ represents C4C authentication using Cloud compute node. Execution time of ɀ is far less than Ɂdue to the fact the session is locally authenticated instead of validating it through third party IdP or IMS. Sev Set of Services hosted in Cloud (Service Manager) si is session information c computing node CCR Cloud Computing Resources ft finger table Begin 01 function GetServiceRequest(Request r) 02 if r Sev then 03 si ĸ getSessionInfo(r) 04 rout si in Cloud 05 choose compute node c’ from CCR 06 if si C si then 07 if validate(si) = true then 08 sent success response 09 else 10 send request for re-login 11 else 12 load ft 13 if si ft then 14 rout r to respected node 15 else 16 choose closet node 17 else 18 send invalid reqeust response End Figure 5 Session validation and Service Provisioning in C4C ݂ ሺ ሻ ط൝ Ɂ ሺ ሻ ɘ ሺ ሻ ݓ݄݁ݎ݁ݏ݅՚ߩ ሺ ݎ ሻ - (1) ݂ ሺ ሻ ط൝ ɀ ሺ ሻ ɘ ሺ ሻ ݓ݄݁ݎ݁ݏ݅՚ߩ ሺ ݎ ሻ - (2) ɀ ሺ ሻ اɁ ሺ ሻ - (3) V. I MPLEMENTATION At the point of writing CloudSIM [8] is only emulator which is available for Cloud computing simulation. For C4C implementation we have proposed a few modifications to cloudsim.Cloudlet package. An additional memory structure is required to hold the session information and its corresponding key. To distribute the keys among Cloud, C4C uses the functionality provided by the implementation of Chord Algorithm by [9]. Each instance of cloudsim.Cloudlet is assigned a unique Id, by CRM. The distribution of keys is then left to the CM itself, whenever there is a need to remove computing nodes, its keys are automatically rearranged by the CM, and finger tables are updated. This helps in seamless maintenance of computing resources, besides this, information within the Cloud remains constants and load is distributed throughout the Cloud. Once user is authenticated, throughout the active period of his session he can access the service provided by the Cloud. As a result of which, IMS does not becomes a bottle neck and also if third party IdP is used there is no need to repeatedly send authentication request. VI. CONCLUSION Clouds are deployed on huge data centers, which provides enormous amount of processing and storage capacity. Majority of software vendors are providing these services though Cloud, which tends to increase load on IdP just to name few of them; OpenId, Google Identity Management. Apart from that if identities are managed by software vendors themselves; load on their in house IMS escalates in proportion to the increase of subscribers. With C4C we have proposed a solution which applies the concept of P2P Computing to store the identity within Cloud. It reduces the processing load on IdP and decreases the number of attack that can be executed during communication between Cloud and IdP. Additionally, it utilizes the computation power available within Cloud in an efficient manner, by delegating the task of session authentication to respective computing node VII.A CKNOWLEDGEMENT This research was supported by the MKE (Ministry of Knowledge Economy), Korea, under the ITRC(Information Technology Research Center) support program supervised by the NIPA(National IT Industry Promotion Agency)" (NIPA- 2009-(C1090-0902-0002)). REFERENCES [1]. Microsoft Health Vault http://www.healthvault.com/ [2]. Google Health http://www.google.com/health [3]. Buyya, R., Yeo, C. S., Venugopal, S., Broberg, J., and Brandic, I. 2009. Cloud computing and emerging IT platforms: Vision, hype, and reality for delivering computing as the 5th utility. Future Gener. Comput. Syst. 25, 6 (June. 2009). [4]. OpenId - http://openid.net/ [5]. SAML - Security Assertion Markup Language http://www.oasis- open.org/committees/tc_home.php?wg_abbrev=security [6]. Moralis, A., Pouli, V., Papavassiliou, S., and Maglaris, V. 2009. A Kerberos security architecture for web services based instrumentation grids. Future Gener. Comput. Syst. 25, 7 (July. 2009). [7]. S. Hirasuna, A. Slominski, L. Fang, D. Gannon, Performance comparison of security mechanisms for grid services, in: Proc. of Fifth IEEE/ACM International Workshop on Grid Computing, November 2004. [8]. Buyya, R., Pandey, S., and Vecchiola, C. 2009. Cloudbus Toolkit for Market-Oriented Cloud Computing. In Proceedings of the 1st international Conference on Cloud Computing, China, December, 2009. [9]. Stoica, I., Morris, R., Liben-Nowell, D., Karger, D. R., Kaashoek, M. F., Dabek, F., and Balakrishnan, H. 2003. Chord: a scalable peer-to-peer lookup protocol for internet applications. IEEE/ACM Trans. Netw. 11, 1 (February 2003). [10]. Karabulut, Y. and Nassi, I. 2009. Secure Enterprise Services Consumption for SaaS Technology Platforms. In Proceedings of the 2009 IEEE international Conference on Data Engineering (March 29 - April 02, 2009). [11]. http://web.mit.edu/Kerberos/ [12]. Bin, W., Yuan, H. H., Xi, L. X., and Min, X. J. 2009. Open Identity Management Framework for SaaS Ecosystem. In Proceedings of the 2009 IEEE international Conference on E-Business Engineering (October 21 - 23, 2009). 306355375375375375374382394 . 1 Cloud Authentication Procedures: Identity Provded by third party identity provider. Similarly, Figure 2 shows identity provided by Cloud s Identity Management. Chord Based Identity Management for e-Healthcare Cloud Applications Il Kon Kim, Zeeshan Pervez, Asad Masood