Okwuibe, Liyanage, Ahmad, and Ylianttila
386
1) An attack on a virtualized system is tantamount to attacking the actual hardware
components that is virtualizes;
2) Security vulnerability of a virtualized system is the combination of actual system
vulnerabilities and the vulnerabilities of the hypervisor
6
;
3) Security on virtualized systems can be improved by separating functionality and
content, e.g. separating the user data from the network functions;
4) Aggregating multiple virtualization platforms on the same physical systems will
increase risk, except if the hypervisor is configured to avert this risk; and
5) A trusted virtualized system on a mistrusted infrastructure is at higher risk than a
mistrusted virtualized system on a trusted infrastructure.
16.4.2 Cyber‐Physical System (CPS) Security
CPS integrates multiple networking, computing and physical resources on different spatial
scales controlled by computer‐based algorithms. CSPs consist of several communication
technologies, sensors and actuators all linked together over a software system. Typical
applications CPSs include monitoring and control of physical and organizational or business processes, for example, SCADA
7
, integration of different technical disciplines and
application domains, for example, smart grids, distributed or interconnected systems of
systems, as well as other sensor based smart communication systems [31].
Cloud‐based Cyber‐Physical Systems (CCPS) use Cyber‐Physical Clouds (CPC) for
the virtualization of network components like sensors and actuators. These virtualized
components function as conventional cloud resources that can be provisioned for cloud
services. CPCs are prone to several identified security attacks, such as HTTP and XML
Denial of Service (HX‐DoS) attacks. HX‐DoS combines HTTP and XML messages flooded
at rates deliberately meant to overwhelm the cloud CPS infrastructures. This attack can
be lunched on any cloud service models, that is, IaaS, SaaS and PaaS. In [32], authors
present a defense system called Pre‐Decision, Advance Decision, Learning System
(ENDER); this system is designed to identify the HX‐DoS messages before they are
received by the targeted system. Another common attack on CPC is Slowly‐increasing
Polymorphic DDoS Attack Strategy (SIPDAS), identified in [33]. SIPDAS mainly characterizes DoS attacks that dynamically modify their behavior to evade pattern detection
algorithms. Possible control measure to this attack is to frequently check the consumption
of computational resources, as well as the intensity of incoming requests [33].
16.4.3 Secure and Private Data Computation
With cloud computing, user data is usually stored in the CSP data centers, which are
usually unknown to the user. The security of such user data is crucial in any network
environments and even more critical in cloud computing, given that user data could
more easily be moved to any location on the globe over the clouds. It is therefore
the responsibility of the CSP to ensure that both their infrastructures, user data and
applications are protected.
6 In a virtualized system, the hypervisor is the software or firmware that controls the system. In this case, it
is the cloud operating system. More common hypervisors are VMware and VirtualBox.
7 Supervisory Control and Data Acquisition
386
1) An attack on a virtualized system is tantamount to attacking the actual hardware
components that is virtualizes;
2) Security vulnerability of a virtualized system is the combination of actual system
vulnerabilities and the vulnerabilities of the hypervisor
6
;
3) Security on virtualized systems can be improved by separating functionality and
content, e.g. separating the user data from the network functions;
4) Aggregating multiple virtualization platforms on the same physical systems will
increase risk, except if the hypervisor is configured to avert this risk; and
5) A trusted virtualized system on a mistrusted infrastructure is at higher risk than a
mistrusted virtualized system on a trusted infrastructure.
16.4.2 Cyber‐Physical System (CPS) Security
CPS integrates multiple networking, computing and physical resources on different spatial
scales controlled by computer‐based algorithms. CSPs consist of several communication
technologies, sensors and actuators all linked together over a software system. Typical
applications CPSs include monitoring and control of physical and organizational or business processes, for example, SCADA
7
, integration of different technical disciplines and
application domains, for example, smart grids, distributed or interconnected systems of
systems, as well as other sensor based smart communication systems [31].
Cloud‐based Cyber‐Physical Systems (CCPS) use Cyber‐Physical Clouds (CPC) for
the virtualization of network components like sensors and actuators. These virtualized
components function as conventional cloud resources that can be provisioned for cloud
services. CPCs are prone to several identified security attacks, such as HTTP and XML
Denial of Service (HX‐DoS) attacks. HX‐DoS combines HTTP and XML messages flooded
at rates deliberately meant to overwhelm the cloud CPS infrastructures. This attack can
be lunched on any cloud service models, that is, IaaS, SaaS and PaaS. In [32], authors
present a defense system called Pre‐Decision, Advance Decision, Learning System
(ENDER); this system is designed to identify the HX‐DoS messages before they are
received by the targeted system. Another common attack on CPC is Slowly‐increasing
Polymorphic DDoS Attack Strategy (SIPDAS), identified in [33]. SIPDAS mainly characterizes DoS attacks that dynamically modify their behavior to evade pattern detection
algorithms. Possible control measure to this attack is to frequently check the consumption
of computational resources, as well as the intensity of incoming requests [33].
16.4.3 Secure and Private Data Computation
With cloud computing, user data is usually stored in the CSP data centers, which are
usually unknown to the user. The security of such user data is crucial in any network
environments and even more critical in cloud computing, given that user data could
more easily be moved to any location on the globe over the clouds. It is therefore
the responsibility of the CSP to ensure that both their infrastructures, user data and
applications are protected.
6 In a virtualized system, the hypervisor is the software or firmware that controls the system. In this case, it
is the cloud operating system. More common hypervisors are VMware and VirtualBox.
7 Supervisory Control and Data Acquisition