An Approach for Secure Virtual Resource Service Differentiation in a Cloud

The cloud computing infrastructure is hosted in data centers. If a service user orders a cloud service, e.g., a virtual machine in Amazon?s EC2, this virtual resource is placed on a physical infrastructure within a data center of the cloud operator. The virtual resource might be moved within the data center from one physical machine to another, e.g., due to maintenance reasons migrating virtual resources to physical machines located in other data centers of the same operator, or to physical machines of other operators automatically is not possible. However, there are some use cases where a ?exible placement of virtual resources is needed, e.g., for optimization reasons (reducing costs or latencies when accessing the virtual resource). In cloud networking, virtual resources are moved automatically from one operator?s cloud infrastructure to another. Therefore, security checks must also be carried out automatically, in order to assure that an operator?s infrastructure follows the service user?s demands. In this paper we show an approach for automated security checks. In our approach a service user can de?ne security requirements and a virtual infrastructure provider can describe its security functionality. A service provider moderates the placement of virtual resources, maps the security demands to security functionality, and if needed moves the virtual resources to another virtual infrastructure provider.