As Cloud services become more commonplace, recent works have uncovered vulnerabilities unique to such systems. Specifi cally, the paradigm promotes a risk of information leakage across virtual machine isolation via side-channels. Unlike conventional computing, the infrastructure supporting a Cloud environment allows mutually dis- trusting clients simultaneous access to the underlying hardware, a seldom met requirement for a side-channel attack. This thesis investigates the current state of side-channel vulnerabilities involving the CPU cache, and identifi es the shortcomings of traditional defenses in a Cloud environment. It explores why solutions to non-Cloud cache-based side-channels cease to work in Cloud environments, and describes new mitigation techniques applicable for Cloud security. Speci cally, it separates canonical cache-based side-channel attacks into two categories, Sequential and Parallel attacks, based on their implementation and devises a unique mitigation technique for each. Applying these solutions to a canonical Cloud environment, this thesis demonstrates the validity of these Cloud-specifi c, cache-based side-channel mitigation techniques. Furthermore, it shows that they can be implemented, together, as a server-side approach to improve security without inconveniencing the client. Finally, it conducts a comparison of our solutions to the current state-of-the-art. / Thesis (Master, Computing) -- Queen's University, 2013-09-25 18:03:47.737

International Telemetering Conference Proceedings / October 17-20, 1994 / Town & Country Hotel and Conference Center, San Diego, California / An increasing need among telemetry data analysts for new mechanisms for efficient access to high-speed data in distributed environments has led BBN to develop a new architecture for data analysis. The data sets of concern can be from either real-time or post-test sources. This architecture consists of an expandable suite of tools based upon a data distribution software "backbone" which allows the interchange of high volume data streams among server processes and client workstations. One benefit of this architecture is that it allows one to assemble software systems from a set of off-the-shelf, interoperable software modules. This modularity and interoperability allows these systems to be configurable and customizable, while requiring little applications programming by the system integrator.

Approved for public release; distribution in unlimited. / Contemporary large-scale networked systems have improved the efficiency and effectiveness of our way of life. However, such benefit is accompanied by elevated risks of intrusion and compromises. Incorporating survivability capabilities into systems is one of the ways to mitigate these risks. The Server Agent-based Active network Management (SAAM) project was initiated as part of the next generation Internet project to address the increasing multi-media Internet service demands. Its objective is to provide a consistent and dedicated quality of service to the users. SAAM monitors the network traffic conditions in a region and responds to routing requests from the routers in that region with optimal routes. Mobility has been incorporated to SAAM server to prevent a single point of failure from bringing down the entire SAAM server and its service. With mobility, it is very important to select a good SAAM server locality from the client's point of view. The choice of the server must be a node where connection to the client is most survivable. In order to do that, a general metric is defined to measure the connection survivability of each of the potential server hosts. However, due to the complexity of the network, the computation of the metric becomes very complex too. This thesis develops heuristic solutions of polynomial complexity to find the hosting server node. In doing so, it minimizes the time and computer power required. / Defence Science & Technology Agency (Singapore)

Primary goal of my thesis is managerial recommendation, which should ease the management decision making process whether AutoCont would add Private cloud (SaaS) option of project management software in its service portfolio. There will be presented the Total Cost of Ownership analysis for both On premise and Private cloud option on an example of SME in practical part.

Under VT 2019 ägde projektet rum varav denna rapport är ett av resultaten. Projektets mål var att skapa en CI/CD pipeline vars syfte var tänkt att frekvent kunna leverera färdigtestad kod till olika molntjänster som Google Cloud Platform, Amazon Web Services och Azure. Projektspecifikationerna gavs av företaget Skira för att skapa en snabbare integrationsprocess för nya utvecklare. Detta så en ny utvecklare skulle kunna lägga mer tid på att koda istället för att gräva ner sig i leverans-/testningsprocessen. Slutprodukten ger företag möjligheten att koda direkt på sitt utvecklingskluster.

Este trabalho apresenta um estudo, implementação e avaliação em ambiente real de um protótipo de servidor Web com diferenciação de serviços (SWDS) para provisão de QoS relativa em servidores Web. Para tanto foram considerados algoritmos de reserva de recursos e escalonamento baseado em prioridades para prover diferenciação entre as classes de serviço, além de mecanismos de controle de admissão a fim de controlar a carga no sistema. A meta é oferecer melhor tratamento para requisições de maior prioridade, sem prejudicar em excesso as requisições de prioridade menor. Foi observado que os algoritmos de reserva de recursos (RSV e RSVadap) são eficientes para prover diferenciação entre as classes consideradas, no entanto seus desempenhos não foram satisfatórios em alguns casos, tanto devido a arquitetura em que foram implementados, como por motivos inerentes à própria natureza do algoritmo. O algoritmo de escalonamento baseado em prioridades considerado (PriProcess), mostrou-se eficiente tanto no sentido de prover diferenciação de serviços entre as classes, como na questão de desempenho, com a classe de maior prioridade sempre sendo melhor atendida em relação à classe de menor prioridade. Também foi alvo do estudo a criação de um mecanismo de controle de admissão com diferenciação de serviços. Os resultados alcançados sinalizam uma melhora em termos de tempos de respostas e número de requisições completadas para a classe de maior prioridade / This work presents a study, implementation and evaluation in real environment of a Web server architecture with service differentiation (SWDS) for provision of relative QoS in Web servers. Algorithms of resources reservation and scheduling based on priorities were considered to provide service differentiation among the request classes, besides implementation of a mechanism for admission control in order to control the load in the system. The goal is to offer better treatment for higher priority requests without harming in excess lower priority ones. It was observed that the algorithms for resource reservation (RSV and RSVapap) are efficient to provide differentiation among the considered classes, however their performance was not satisfactory in some cases, due to both, the archtectures through which they were implemented and the specific features of the algorithm nature. The considered scheduling algorithm based on priorities (PriProcess) was efficient both in the sense of providing service differentiation among the classes and with regards to performance, with the higher priority class always being better served than the lower priority one. It was also studied the creation of a mechanism for admission control with service differentiation. The achieved results show an improvement in terms of response times and the number of completed requests for the higher priority class

Cloud-based applications especially SaaS applications have become essential for startups and various sized businesses. Adapting to these web applications helps to reduce operational costs and further provide flexibility in accessing individual data of the users. On the other hand, usage of these cloud services poses security-related issues such as authentication, authorization, web application security. Additionally, if the on-premises application is moved to the cloud then the traditional Identity solutions will not work, which affects the user authentication. This thesis considers ‘Authentication’ as one of the main security issues to be addressed. Thus, a new federated Identity and Access Management (IAM) system needs to be realized, which can be used for both on-premises and cloud to authenticate users correctly and securely. To meet the described challenges within the cybersecurity domain, this thesis focuses on two aspects of IT Security: 1) SaaS application rely on IAM; 2) IAM for securely authenticating users. This thesis work addresses both these aspects in two parts. First, by developing a SaaS web application that includes an authentication module with the support of the SAML 2.0 standard protocol. Second, the use of open source WSO2 IAM server for authenticating the users securely. To implement a SaaS application, a play framework PAC4j security library is used to support SAML SSO profile for authenticating users. The profile provides functionality for the two scenarios: SAML- Service provider and SAML- Identity Provider. The developed SaaS application acts as a service provider while WSO2 identity server acts as an Identity Provider. The SAML request-response authentication workflow between these providers are verified to prove the correctness and security of user login information. The research presented in this thesis is helpful for startup companies, that are initially looking to minimize application cost that works both on-premises and cloud without compromising on the security of user’s login information.

Este trabalho apresenta um estudo, implementação e avaliação em ambiente real de um protótipo de servidor Web com diferenciação de serviços (SWDS) para provisão de QoS relativa em servidores Web. Para tanto foram considerados algoritmos de reserva de recursos e escalonamento baseado em prioridades para prover diferenciação entre as classes de serviço, além de mecanismos de controle de admissão a fim de controlar a carga no sistema. A meta é oferecer melhor tratamento para requisições de maior prioridade, sem prejudicar em excesso as requisições de prioridade menor. Foi observado que os algoritmos de reserva de recursos (RSV e RSVadap) são eficientes para prover diferenciação entre as classes consideradas, no entanto seus desempenhos não foram satisfatórios em alguns casos, tanto devido a arquitetura em que foram implementados, como por motivos inerentes à própria natureza do algoritmo. O algoritmo de escalonamento baseado em prioridades considerado (PriProcess), mostrou-se eficiente tanto no sentido de prover diferenciação de serviços entre as classes, como na questão de desempenho, com a classe de maior prioridade sempre sendo melhor atendida em relação à classe de menor prioridade. Também foi alvo do estudo a criação de um mecanismo de controle de admissão com diferenciação de serviços. Os resultados alcançados sinalizam uma melhora em termos de tempos de respostas e número de requisições completadas para a classe de maior prioridade / This work presents a study, implementation and evaluation in real environment of a Web server architecture with service differentiation (SWDS) for provision of relative QoS in Web servers. Algorithms of resources reservation and scheduling based on priorities were considered to provide service differentiation among the request classes, besides implementation of a mechanism for admission control in order to control the load in the system. The goal is to offer better treatment for higher priority requests without harming in excess lower priority ones. It was observed that the algorithms for resource reservation (RSV and RSVapap) are efficient to provide differentiation among the considered classes, however their performance was not satisfactory in some cases, due to both, the archtectures through which they were implemented and the specific features of the algorithm nature. The considered scheduling algorithm based on priorities (PriProcess) was efficient both in the sense of providing service differentiation among the classes and with regards to performance, with the higher priority class always being better served than the lower priority one. It was also studied the creation of a mechanism for admission control with service differentiation. The achieved results show an improvement in terms of response times and the number of completed requests for the higher priority class

The end-to-end argument describes the communication between a client and server using functionality that is located at the end points of a distributed system. From a security and privacy perspective, clients only need to trust the server they are trying to reach instead of intermediate system nodes and other third-party entities. Clients accessing the Internet today and more specifically the World Wide Web have to interact with a plethora of network entities for name resolution, traffic routing and content delivery. While individual communications with those entities may some times be end to end, from the user's perspective they are intermediaries the user has to trust in order to access the website behind a domain name. This complex interaction lacks transparency and control and expands the attack surface beyond the server clients are trying to reach directly. In this dissertation, we develop a set of novel design principles and architectures to reduce the number of third-party services and networks a client's traffic is exposed to when browsing the web. Our proposals bring additional intelligence to the client and can be adopted without changes to the third parties. Websites can include content, such as images and iframes, located on third-party servers. Browsers loading an HTML page will contact these additional servers to satisfy external content dependencies. Such interaction has privacy implications because it includes context related to the user's browsing history. For example, the widespread adoption of "social plugins" enables the respective social networking services to track a growing part of its members' online activity. These plugins are commonly implemented as HTML iframes originating from the domain of the respective social network. They are embedded in sites users might visit, for instance to read the news or do shopping. Facebook's Like button is an example of a social plugin. While one could prevent the browser from connecting to third-party servers, it would break existing functionality and thus be unlikely to be widely adopted. We propose a novel design for privacy-preserving social plugins that decouples the retrieval of user-specific content from the loading of third-party content. Our approach can be adopted by web browsers without the need for server-side changes. Our design has the benefit of avoiding the transmission of user-identifying information to the third-party server while preserving the original functionality of the plugins. In addition, we propose an architecture which reduces the networks involved when routing traffic to a website. Users then have to trust fewer organizations with their traffic. Such trust is necessary today because for example we observe that only 30% of popular web servers offer HTTPS. At the same time there is evidence that network adversaries carry out active and passive attacks against users. We argue that if end-to-end security with a server is not available the next best thing is a secure link to a network that is close to the server and will act as a gateway. Our approach identifies network vantage points in the cloud, enables a client to establish secure tunnels to them and intelligently routes traffic based on its destination. The proliferation of infrastructure-as-a-service platforms makes it practical for users to benefit from the cloud. We determine that our architecture is practical because our proposed use of the cloud aligns with existing ways end-user devices leverage it today. Users control both endpoints of the tunnel and do not depend on the cooperation of individual websites. We are thus able to eliminate third-party networks for 20% of popular web servers, reduce network paths to 1 hop for an additional 20% and shorten the rest. We hypothesize that user privacy on the web can be improved in terms of transparency and control by reducing the systems and services that are indirectly and automatically involved. We also hypothesize that such reduction can be achieved unilaterally through client-side initiatives and without affecting the operation of individual websites.

This thesis deals with a new trend and a marketing tool -- collective buying. The aim of the work is to describe this trend from two different perspectives and to provide a short-term forecast. In the theoretical sections, we give overview of the history of collective buying, basic terms from the field, and the current situation in the Czech Republic and worldwide. We continue with sections describing the operations of a specific company from the field, BonyBony, which entered the market in September 2010. Author of this thesis has been employed in the company since its founding. In these sections we describe basic operation of the company, marketing tools used and advantages over the competition. The future of companies dealing with collective buying is uncertain; many of them are in red numbers. The last part of this work therefore tries to project the short-term forecast for this company using expert view based on the data acquired from a survey.