SPECIAL SECTION ON INTERNET-OF-THINGS (IOT) BIG DATA TRUST MANAGEMENT

Received August 23, 2018, accepted September 16, 2018, date of publication October 16, 2018, date of current version October 31, 2018.
Digital Object Identifier 10.1109/ACCESS.2018.2873812

A Framework for Orchestrating Secure and

Dynamic Access of IoT Services in
Multi-Cloud Environments
MUHAMMAD KAZIM , LU LIU , (Member, IEEE), AND SHAO YING ZHU, (Member IEEE)
College of Engineering and Technology, University of Derby, Derby DE22 1GB, U.K.
Corresponding authors: Muhammad Kazim ([email protected]), Lu Liu ([email protected]),
and Shao Ying Zhu ([email protected])

ABSTRACT IoT devices have complex requirements but their limitations in terms of storage, network,
computing, data analytics, scalability, and big data management require it to be used it with a technology
like cloud computing. IoT backend with cloud computing can present new ways to offer services that are
massively scalable, can be dynamically configured, and delivered on demand with large scale infrastructure
resources. However, a single cloud infrastructure might be unable to deal with the increasing demand
of cloud services in which hundreds of users might be accessing cloud resources, leading to a big data
problem and the need for efficient frameworks to handle a large number of user requests for IoT services.
These challenges require new functional elements and provisioning schemes. To this end, we propose the
usage of multi-clouds with IoT which can optimize the user requirements by allowing them to choose best
IoT services from many services hosted in various cloud platforms and provide them with more infrastructure
and platform resources to meet their requirements. This paper presents a novel framework for dynamic
and secure IoT services access across multi-clouds using the cloud on-demand model. To facilitate multi-
cloud collaboration, novel protocols are designed and implemented on cloud platforms. The various stages
involved in the framework for allowing users access to IoT services in multi-clouds are service matchmaking
(i.e., to choose the best service matching user requirements), authentication (i.e., a lightweight mechanism
to authenticate users at runtime before granting them service access), and SLA management (including,
SLA negotiation, enforcement, and monitoring). SLA management offers benefits like negotiating required
service parameters, enforcing mechanisms to ensure that service execution in the external cloud is according
to the agreed SLAs and monitoring to verify that the cloud provider complies with those SLAs. The detailed
system design to establish secure multi-cloud collaboration has been presented. Moreover, the designed
protocols are empirically implemented on two different clouds, including OpenStack and Amazon AWS.
Experiments indicate that the proposed system is scalable, authentication protocols result only in a limited
overhead compared to standard authentication protocols, and any SLA violation by a cloud provider could
be recorded and reported back to the user.

INDEX TERMS Authentication, IoT, IoT services, multi-clouds, security, secure collaboration, service level
agreement, service matchmaking.

I. INTRODUCTION capture information from physical objects and send it as data

The Internet of Things (IoT) paradigm has revolutionized the streams [1]. Moreover, IoT objects directly co-operate with
IT industry by bringing together technologies such as Radio physical and virtual resources over the internet to deliver data
Frequency Identification (RFID), Wireless Sensor and Actor and functionalities to end users and applications. IoT has
Networks (WSANs) and ubiquitous computing domains. played a critical role in advancing human lives by bringing
Internet of Things (IoT) connects billions of devices over applications with usage in the real world. From users per-
the Internet. The heterogeneous IoT objects are provided spective, IoT plays a critical role in application scenarios
with sensing and actuation capabilities, that enable them to such as smart homes, healthcare, vehicular networks, and

2169-3536 2018 IEEE. Translations and content mining are permitted for academic research only.
VOLUME 6, 2018 Personal use is also permitted, but republication/redistribution requires IEEE permission. 58619
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
 M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

enhanced learning. While from the business viewpoint, In a multi-cloud environment, users access services across
the major applications of IoT are in the areas of logistics, multiple cloud providers which changes the traditional cloud
transportation, agriculture, retail and smart cities. It is pre- landscape. However, a very limited research has been done
dicted that the growth of the global IoT services market will to support IoT services deployment and access across multi-
be at a compound annual growth rate (CAGR) of 24 percent clouds. Therefore, advanced development frameworks are
until 2021 [2]. As the number of IoT devices increases and required that can offer IoT services orchestration across
they generate large volumes of big data, it brings forwards the multi-clouds and reduce companies time-to-market to keep
challenges related to data collection, analysis, management, cloud services running smoothly. Along with the service
and storage. orchestration issues in multi-clouds, many security concerns
Cloud computing has been proposed as a solution that can are also related to their adoption and application. The basic
potentially solve the problem of managing big data in IoT [3]. authentication solutions that exist for traditional networks
Some key advantages cloud computing offers are that: it is fail to meet the need of a dynamic collaboration of clouds
massively scalable, can be dynamically configured, deliv- and services (such as IoT services) in multi-clouds. Consider
ers on-demand services and provides users with immediate a scenario in which a cloud (local cloud) user is accessing
access to hardware resources without capital investments [4]. IoT service located in another cloud (foreign cloud). That
Different companies using cloud have infrastructures that cloud user would have no mechanism to verify that the service
scale over several data centres and cloud also has a sim- being used is trustworthy and neither do they have insights on
ple pricing model that lets you pay as you go and only what is happening with their data being handled by services.
for the services they are being used. Due to these advan- In order to trust the cloud services, users depend on their
tages, cloud vendors including Google (Google Cloud IoT), assurances given by the cloud provider. Cloud providers give
Amazon (AWS IoT) and Microsoft (Azure IoT Solution very limited evidence or accountability to users which offers
Accelerators) are offering services to support IoT devices and them the ability to hide some behavior of the service.
services in terms of computing, storage, resource elasticity In order to address these challenges, we propose a
and data analytics. Despite the benefits offered by the cloud novel framework named called Multi-cloud Collaboration
to IoT sector, the variety and proliferation of services offered for IoT (MC-IoT) in this paper that can facilitate multi-
by the cloud provider raise some challenges relevant to cloud cloud collaboration and provide guarantees to the user that
environment. These challenges include portability issues of the software or service (such as IoT service) running on a
IoT services on various IaaS and PaaS platforms, interoper- foreign cloud node is secure and the agreed service level
ability of distributed IoT applications on various cloud plat- agreements (SLAs) are not being violated. The key challenge
forms, PaaS dealing with the heterogeneity of cloud protocols in designing this framework is to develop solutions for multi-
to support IoT service interactions, and the requirement of cloud that can support efficient authentication, authorization
geo-diverse platforms [5]. of large number of cloud users, enable the users to select most
The multi-cloud architecture can provide a solution to suitable service in foreign cloud according to their require-
these challenges. Multi-cloud environment is dependent on ments as well as to ensure that services in foreign cloud are
multiple clouds, and a user can be reliant on multiple cloud compliant with the service level agreement (SLA) between
service providers such as Amazon, Microsoft, or OpenStack user and cloud provider. The proposed framework is based
which are communicating. IoT applications can benefit from on NIST cloud computing security architecture standard [8].
the adoption of multi-clouds from their abilities to run work- It satisfies the following conditions: i) rapid provisioning by
loads on best-suited platforms, avoiding the need to migrate automated service deployment; ii) mapping authenticated and
legacy IoT applications and creating redundancy to avoid authorised data and tasks onto VMs; iii) monitoring the cloud
vendor lock-in [6]. Multi-cloud providers are increasingly in resources, operations and performance; iv) metering active
demand. In a survey by 451-Microsoft, around 50% compa- user accounts to guarantee that security policies are always
nies’ representatives were looking for providers that could enforced; v) maintaining the service level agreement (SLA)
provide one-stop-shopping from various cloud providers and established between customers and service providers.
establish contracts with different providers for additional ser- In an IoT based multi-cloud architecture, hundreds of
vices on their behalf [7]. cloud users might be using thousands of IoT services across
Multi-clouds provide an increased level of efficiency to multi-clouds. The basic authentication solutions that exist
cloud providers by enabling them to share their services for traditional networks fail to meet the need for a dynamic
for improving revenues. In terms of IoT, the services to be collaboration of clouds and services in multi-cloud. There-
shared between multi-clouds can include SaaS, PaaS or IaaS fore, this paper provides a lightweight and novel technique
service while the clients using these services can be other for the dynamic authentication which provides single sign-
clouds, organizations or a single user. Other factors driving on to users trying to connect to the foreign cloud. The pro-
the adoption of multi-clouds for cloud provider can vary from posed authentication solution achieves better performance
dealing with a peak in service requests, having backup servers than traditional authentication protocols like SAML and Ker-
to diminish downtime scenarios and enhancing its own offers beros while maintaining security. Next, we provide a ser-
to get a market competitive edge. vice selection algorithm to select the best IoT service from

58620 VOLUME 6, 2018

M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

multiple cloud providers that best match user quality of the area of multi-clouds, and IoT based cloud systems. In the
service requirements (QoS). In the next stage, service level end, the conclusion of the paper is presented.
agreements (SLAs) are used to ensure security and handle ser-
vice execution in the foreign cloud. The usage of SLA mech- II. BACKGROUND
anisms ensures that QoS parameters including the functional Multiple clouds have two delivery models which are fed-
(CPU, RAM, memory etc.) and non-functional requirements erated cloud and multi-cloud. In federated clouds, there is
(bandwidth, latency, availability, reliability etc.) of users for an agreement between different providers that want to col-
a particular IoT service are negotiated and secure collabora- laborate, and also the user is not aware of the fact if the
tion between multi-clouds is setup. The multi-cloud handling resources are being used from another cloud. However, multi-
user requests will be responsible to enforce mechanisms that clouds provide a way for dynamic collaboration between
fulfill the QoS requirements agreed in the SLA. While the various clouds as there is no former agreement between par-
monitoring phase in SLA involves monitoring the IoT service ticipating clouds and collaboration is established at runtime
execution in the foreign cloud to check its compliance with according to requirements. Moreover, in multi-clouds user
the SLA and report it back to the user. has the knowledge of all connected clouds and is directly
MC-IoT has been designed with the goal to enhance secure responsible to the provisioning of services from multiple
multi-cloud collaboration in which cloud providers can easily clouds which can be more beneficial from customers and
apply their business model to achieve extended functionali- organizations perspective. Therefore, this work focuses on
ties. The proposed model is based on an architectural solution multi-clouds so that users and organizations can dynami-
that can be used to setup multi-cloud collaboration between cally access IoT services across various cloud providers. The
any clouds irrespective of their underlying implementation. multi-cloud communication scenario that provides access
Experiments indicate that the proposed approach supports of IoT services to users across multi-clouds is shown
collaboration among a large number of IoT services across in figure 1.
multi-clouds and incurs a minor overhead. In a multi-cloud environment, the user’s access IoT ser-
The major contributions of this paper are the following: vices across multiple cloud providers which changes the
• A novel framework is proposed for providing users traditional cloud landscape. Multi-clouds offer greater agility,
secure dynamic collaboration and access to IoT services innovation and more intense collaboration and they can be
in multi-clouds. The protocols to support the framework predicted to become an industry norm to handle IoT big
and the functionalities of its components responsible for data and their associated applications, however, managing
multi-cloud collaboration are presented. service orchestration is still an open issue. Advanced devel-
• Dynamic and lightweight authentication protocol to opment frameworks are required that can reduce companies
setup single sign-on (SSO) between multi-clouds has time-to-market.
been presented. Along with the service orchestration issues in multi-clouds,
• A service selection algorithm is proposed that achieves multi-clouds bring many security concerns as well. The tra-
high accuracy by providing distance correlation weight- ditional authentication solutions that exist for networks fail
ing mechanism among large number of IoT services to meet the need of a dynamic collaboration of users and
QoS parameters. services in multi-cloud due to performance overhead and/or
• Mechanisms to setup service level agreements (SLAs) difference of underlying authentication mechanisms across
for multi-cloud collaboration have been presented. The different clouds. Along with authentication problems, secure
various stages in setting up SLA include negotiation, service orchestration is also a challenge. Once a service
enforcement and monitoring. They help in negotiating from a foreign cloud is being used, the cloud users have
QoS parameters for IoT services between the user and no mechanism to verify that the service they are using is
foreign cloud provider, enforce a mechanism to comply trustworthy and depend on that provider to ensure service
with the agreed SLAs, monitor client usage of IoT ser- execution. As a user is accessing services in the foreign cloud,
vice in the foreign cloud and report back any violation the interaction with malicious or faulty service can lead to
of SLA. the manipulation of data processing results, failure to provide
• Business and use cases have been presented to discuss advertised services, violation of the security properties such
how the proposed framework can be used in various as confidentiality, integrity and availability, and other mali-
applications cious activities without user consent.
This paper has been organized as follows: Section 2 The general mechanisms described in the literature on
presents the background of this work and section 3 presents service security in cloud are based on having a guarantee that
framework design with the detailed description of various the software or service running on a cloud node is similar
protocols for authentication, service selection and SLA man- to its original implementation and it cannot be modified at
agement. In section 4 the workflow of system components runtime at foreign cloud. However, cloud customers cannot
has been presented. Experimental results of our system have know if the service functionality has been altered when using
been given in section 5. Section 6 provides the use cases of services to the foreign cloud. Therefore, advanced mech-
this work and section 7 details the literature review related to anisms are required that can support efficient IoT service

VOLUME 6, 2018 58621

 M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

FIGURE 1. Multi-cloud collaboration scenario where user U1 made a request to MC-IoT in local cloud to access service S3 in
foreign cloud. The multi-cloud collaboration is setup using MC-IoT after which U1 can directly access service S3 .

FIGURE 2. Proposed framework MC-IoT for multi-cloud collaboration.

selection according to client functional and non-functional III. PROPOSED FRAMEWORK (MC-IoT)
QoS requirements, provide efficient and secure authentica- Based on heterogeneous requirements of multi-clouds and
tion, and enable service level agreement (SLA) management IoT services, we propose a novel framework named
to ensure that proper mechanisms are implemented to comply MC-IoT that can enable dynamic collaboration between
with agreed SLA parameters, and monitor the service exe- users and services in multi-clouds. The architecture of
cution to guarantee that foreign cloud always complies with MC-IoT involves various components that have been imple-
those parameters. mented in each participating cloud to achieve the secure

58622 VOLUME 6, 2018

M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

multi-cloud authentication. These components involved Algorithm 1 System Initialization ()

in system design are authenticator for managing iden- 1. BEGIN: Boot the required services to enable multi-
tity and authorization, controller to manage user requests cloud collaboration
and communication with external clouds (functionality 2. while (the system is running)
mentioned in section 4), matchmaker to select suitable 3. For i = 1 to n:
IoT service meeting user specifications and SLA coor- 4. LC (Auth_service) -> Check (Cert)
dinator for managing SLA negotiation, enforcement and // Checking client’s cert
authorization. 5. if Valid (Cert):
Figure 1 displays various components in a local cloud 6. goto 17
to communicate and collaborate with foreign clouds. All 7. else: // Request a new certificate to TP
the system components serve different functions which are 8. Auth_service -> Send_request
described below. In this paper, the communicating clouds (Cert, ID) -> TP
are referred to as local cloud (in which user is located) and 9. LC -> Mapping_data(LC) -> TPi
foreign cloud (to which user needs access and collaboration 10. TPi -> Publish(Cert)
has to be established). 11. TPi -> Send_certificate (Cert) ->
LC
12. LC (Auth_service) -> Receive
A. COLLABORATION OBJECTIVE
(Cert)
The objective of multi-cloud collaboration is the maximum 13. end if
number of user requests from local cloud to be handled and 14. LC (Auth_service) -> Check (Cert)
successfully granted access to services in foreign cloud. The 15. if Valid (Cert):
overall objective for multi-cloud collaboration for M cloud 16. wait (Request)
users (j = 1, 2 . . . M) in local cloud, with requests of S 17. else:
IoT services (i = 1, 2 . . . N) in a foreign cloud can be 18. goto 7
formally defined as: 19. end if
XN XM 20. end for
O(i, j) = Max (Rij − Cij ) (1) 21. END
i=1 j=1

In the above equation, N and M are the numbers of

services requested and a number of users making requests
respectively. Rij is the required number of user’s requests for
C. AUTHENTICATION PROTOCOL
IoT services to be granted while Cij is the number of
This protocol describes how multi-cloud authentication is
IoT services that were actually granted.
setup between participating clouds. In a distributed environ-
ment usually a large number of clouds are present with each
B. INITIALIZATION PROTOCOL cloud having tens of users, which makes credential manage-
The initialization protocol is the first step that is used to set ment a big challenge. Moreover, in a dynamic communication
up the system services, parameters and attributes required setup between multi-clouds, each cloud might have different
for multi-cloud collaboration. When the required services authentication mechanisms. This raises a need to develop a
are booted in MC-IoT, and user request for multi-cloud single sign-on (SSO) authentication mechanism by which any
access is received, authentication service in the Authen- cloud user in the local cloud can authenticate itself with the
ticator component establishes if it has the certificate for foreign cloud, and access required resources. In our case,
that user that can be used for authentication with foreign we use a Trusted Party (TP) which acts as an identity provider
clouds. If the certificate does not exist in the cloud, Authen- on which a requesting user must hold a digital identity, based
ticator which is a RESTful web service submits a request on which TP grants a digital certificate to that user that it can
on behalf of its cloud to Trusted Party (TP) for certificate use to authenticate with the foreign cloud. Since the foreign
generation. cloud also trusts TP, the user is able to authenticate itself and
A feature of TP is to generate a certificate for cloud Trusted access resources based on that certificate.
Party (TP) after receiving a request and cloud parameters and We assume that the local cloud’s request is composed
to use a function to map a certificate to client ID which is of two parts namely the certificate and the required cloud
returned to the requesting cloud. The Authentication Service service. Initially, a certificate is sent by the local cloud (LC) to
of cloud receives the certificate and stores it to be used the foreign cloud (FC) for proving its identity. This certificate
for communication with foreign clouds. Similarly, it is the contains a set of attributes including the cloud identifier,
responsibility of Authenticator component to ensure that the digital signature, and validity period of the certificate. This
certificate obtained from TP is valid and to get a new cer- message is encrypted by the public key of FC.
tificate if the existing one is revoked or rejected by foreign FC checks the validity of the certificate sent by LC.
cloud. If the certificate is valid, FC then sends a response message

VOLUME 6, 2018 58623

 M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

to LC that it is authenticated. However, if the certificate is Algorithm 2 Authentication and Authorization ()

invalid, FC sends the message of failed authentication to LC 1. BEGIN
and waits for a new certificate. This message is encrypted 2. Data: request: Communication request received by
with the public key of LC. In case the message received from cloud controller
FC is that authentication certificate was invalid, LC sends 3. LC -> Send_request (authentication) -> FC //Secured
a message with its credentials to the Trusted Party (TP) to using SSL
generate a new certificate. TP generates a new certificate and 4. for j = 1 to n do:
sends it to the LC which is sent from LC to FC. 5. FC -> Verify (Cert, ID)
FC checks the new certificate received from LC. If the 6. if Verify (Cert, ID):
certificate is invalid again, the authentication request is ter- 7. goto 17
minated. If authentication of LC is successful, both FC and 8. else:
LC exchange nonce messages to agree on a session key using 9. FC -> Send_request (New_Cert) ->
Diffie-Hellman (DH) algorithm [9]. Since DH key exchange LC
is performed after certificate exchange, it is called authenti- 10. end if
cated DH which is more secure compared to usual DH. 11. LC -> Send_request ((Cert), Profile) -> TP
After cloud authentication, LC sends a message to 12. TP -> Send (Cert) ->CC //Generates updated
FC containing client authorization details as well as resources certificate for LC and sends to LC]
required from FC. As FC receives details of IoT services 13. LC -> Send_msg (Cert) -> FC
which are to be accessed and required resources message, 14. if Not_valid (Cert):
it locally computes if the tasks from LC have the authorization 15. End
to access the required services. The corresponding FC com- 16. else:
putes the status of the IoT services associated to the request. 17. FC -> Send_msg(n) -> LC
The status is computed due to the fact that users on a local 18. end if
cloud can have the different status of privileges that can affect 19. FC -> Wait (response) -> LC
their level of access to resources. For example, only doctors 20. if no_resp():
might have access to some expensive IoT services and other 21. End
hospital staff might not have access to them. The return result 22. else:
is one of the following possible statuses: 23. LC -> Send_msg(n+1) -> FC
• Privileged encrypted using LC- FC session key generated
• Non-privileged by DH
If the result returned is privileged users are granted access to 24. FC -> Send_msg(request_authori-
services, otherwise they are not granted access. zation) -> LC encrypted using LC-FC session
key
D. SERVICE MATCHMAKING 25. LC-> Send_msg(Send_LCAutho-
The cloud services states can change dynamically during rization_level) -> FC encrypted using LC-FC
runtime. Moreover, the dynamic collaboration between users session key
in multi-clouds can make service automatic detection compli- 26. FC -> compute_local_level (LC)
cated. Cloud customers can have varying requirements and 27. if compute_local_level = True:
in multi-cloud scenarios best services that can meet their 28. FC->Authentication_local
required quality of service (QoS) need to be selected from (LC,FC,+)
various providers. 29. else:
To select the most suitable services, the first goal is the FC ->Authentication_local
efficient discovery according to the characteristics of ser- (LC,FC,-)
vices. Service discovery for dynamic multi-cloud collabo- 30. end if
ration could be hard due to requirements such as satisfying 31. end if
service QoS, functionalities and other metrics. Moreover, 27. end for
lack of central repositories for cloud services makes service 28. END
selection a challenging task.
There might be cases when a single service would be able
to satisfy all user requirements and the service that matches
most requirements might need to be selected. This leads to selection is an extension of our previous work on partial web
partial matchmaking where the service that matches most service selection for disaster services [10].
required QoS criteria will be selected. In this section, we pro- The proposed protocol has three essential characteristics.
pose an efficient and dynamic algorithm for selection of cloud • Firstly, the proposed protocol provides service selection
services in multi-cloud scenarios based on partial or closest among all services in a dynamic decentralized environ-
matching of service QoS attributes. This protocol for service ment of multi-clouds with high accuracy.

58624 VOLUME 6, 2018

M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

• Secondly, different QoS requirements of services can Requirement matrix, R can be defined as:
be supported. In case, there is no exact match of user
 RQ1 RQ2 . . . RQn 
QoS requirements with available services, services
S1 r11 r12 . . . r1n
matching the most requirements are selected using par-
S2 
 r21 r22 . . . r2n 
tial matching.
..  . . . ... ... ... 

• And thirdly, the protocol is able to support a
Sm rm1 rm2 . . . rmn
large number of services and by using distance
co-relation weighting mechanism it can support various A service not satisfying the mandatory QoS requirements
IoT services QoS requirements such as response time, RQ is removed from the selection process.
availability, reliability, cost, energy, throughput, latency
and best practices. 3) ACCURACY MATRIX CONSTRUCTION (PHASE 3)
Once a cloud controller receives a response from various The calculation of accuracy matrix, A, is dependent on the
foreign clouds that can deliver required services, it communi- tendency of QoS parameters. The tendency which describes
cates with service matchmaking module to select the required how the numeric value of a service QoS parameters changes
service. for a service to be observed as better. It indicates whether
high or low values of a QoS parameter are preferred in
1) USER REQUEST AND SERVICE QOS ANALYSIS (PHASE 1) an ideal case. For example, an ideal service will require
The process of service selection starts with the cloud con- availability and throughput parameters to be high while its
troller passing the requirements to service matchmaking response time and latency should be low.
module which includes the required service and desired QoS. Using the user described QoS range and service QoS
Such as a user might require high throughput compared to offered, elements of the accuracy matrix is calculated using
cost saving while it might be opposite for another user. More- case dependent formulae as mentioned in equations below:
over, the module collects the results of available services in For values with high tendency:
the foreign cloud from the controller component. Qij
Here we represent various denotations for request types: when Qij < Q1
• RQ represents a set of user functional QoS requirements,
Q1
RQ = {q1 , q2 , q3 , . . . ., qn }, where n ε N Qij − Q1
+α
• S is a set of available services with similar functionality, Qh − Q1
S = {s1 , s2 , s3 . . . sm }, where m ε N Qij + β
when Qij > Qh
• Each service S has QS property matrices, QS = {QS1 , Qmax
QS2 , QS3 . . . QSi }, where QSi = {qi1 , qi2 , qi3 . . . .qij }, i,
For values with low tendency:
j ε N. QSi represents quality matrices for service i.
Qh
when Qij > Qh
2) REQUIREMENT MATRIX CONSTRUCTION (PHASE 2) Qij
Once the QoS requirements have been gathered, the mod- Qh − Qij + α
ule collects all possible service offers and their associated when Q1 ≤ Qij ≤ Qh
Qh − Q1
QoS parameters. These are used to construct an accuracy Qmin
matrix and for the calculation of offers ranks. + β when Qij < Q1
Qij
In an ideal scenario, user QoS requirements QR must be
similar to the service QoS parameters mentioned in QSi . In the above equations, Qij is the value of ith QoS property
In other words, an ideal service for user request can be of jth service, Q1 is the lower limit of user requirements for
represented as, an attribute, Qh is the highest limit of user requirements for
an attribute. Qmax and Qmin are respectively the maximum
RQ = QSi
and minimum values of a QoS property being offered by a
However, in real case scenario that user requirements RQ service. α and β belong to {1, 2, 3, . . . } where α < β.
and the number of quality matrices QSi will be different. The results from the above equations are normalized in the
Therefore, RQ is taken as a baseline and quality matrices range [0, 1].
could be arranged in the following way: α and β are used to differentiate between loose range,
• If the quality service matrix QSi lacks in user QR , it is preferred range and tight range. The preferred range for any
removed and QR is assigned 0 service is between Q1 and Qh . If a value falls in this range,
To construct accuracy matrix, n consumer requests RQ are α is added to normalize the value so that results are in range
identified along with m available services that can satisfy (α, α+1). The values in the loose range (between Qmin and Q1
user requirements, an m∗ n matrix is constructed which is for high tendency parameters, and between Qh and Qmax for
called R. The columns in the matrix represent QoS parameters low tendency parameters) are normalized between 0 and 1.
RQ while each available service is represented in a row for the While the values in the tight range (between Qh and Qmax
selection process. for high tendency parameters, and between Qmin and Q1 for

VOLUME 6, 2018 58625

 M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

low tendency parameters) are normalized by adding β so that viewpoint, SLAs define the mechanisms to securely access
results are in the range (β, β +1). Therefore, for all the values services while the SLAs are utilized by cloud administra-
in accuracy matrix lie between (0, β + 1) which helps in tors to manage the mechanisms to offer cloud services.
consistency. Moreover, β > α which always guarantees that SLA-coordinator negotiates the SLAs on behalf of the user
higher range always has a higher value in accuracy matrix if there is full match of QoS requirements in the stated SLAs.
than other two ranges. However, as described earlier there might be a partial
The results of these equations are used to calculate the match after which user can have the ability to negotiate
accuracy matrix, A. It shows how precisely each service SLAs itself. Therefore, SLA coordinator component
matches the user requirements. After constructing the accu- in MC-IoT offers added features to customers such as nego-
racy matrix, the rank of each service can be calculated in the tiating an SLA or switching to a new provider in a multi-
following way: cloud scenario if selected provider and user cannot agree on
Xn an SLA.
Ri = Aij ∗ Wj (2) As discussed earlier, the matchmaking component checks
j=1
the service specs like base service, features, cost and recom-
In the above equation, Ri represents the rank of service i,
mends them to the user. SLA Negotiation involves agreeing
Aij represents the accuracy value of the jth QoS property of
to the service terms for SLA and QoS parameters, measur-
service i, and Wj represents the weight of the jth QoS property.
ing metrics (service level objectives) and defining how the
metrics will be measured. While service providers also check
Algorithm 3 Service Matchmaking () if they can provide requested service and perform basic risk
1. BEGIN evaluation in case. As provider reputation is on a stake if it
2. Data: Input: <Client functional and non-functional QoS fails to provide the service agreed in SLA.
requirements (CR)>, Integrating the security parameters within SLAs is a novel
<List of services (LS)> problem and a very limited research has been done in this
3. Service LS = {1, 2, . . . ., n}; // Total list of available area. For the case of secure multi-cloud collaboration, we pro-
services pose a service level objective (SLO) called service identity
4. <Service,CR> ServiceContenderList (SCL) = NULL which can help customers to negotiate the SLAs for secure
//List of services satisfying requirements service execution on the foreign cloud.
5. Service S=NULL // Single service instance
6. CR Q=NULL //Single QoS requirement 1) SERVICE IDENTITY
7. <Service, CR> O=NULL; Service identity as an important property to maintain strong
8. For each S in LS do: IoT service security and compliance in the foreign cloud.
9. if (Satisfy(S ,CR)) //Add to SCL all appropri- A set j services Fj deployed on a single cloud platform with
ate services matching user requirements functional properties Funci and non-functional properties
10. SCL.add (S,CR) NFunci can be defined as:
11. end if
12. end for Fi = {Funci , NFunci } 1≤i≤j
13. For each O in SCL do: During service execution in the foreign cloud, both func-
14. for each Q in O.CR do: tional and non-functional properties of service instances
15. Normalize (AccuracyMatrix being used by users must be maintained. Functional proper-
(Max(Q),Min(Q) )) //Generate accuracy matrix ties of instances that could be violated include a change in the
16. end for code or implementation of service to make it do certain other
17. end for activities affecting the original behavior of service. While a
18. For each O in SCL: few non-functional issues can include service taking more
19. Score = Calculate_Score(O.Service) processing time, charging more cost than agreed or remaining
// Calculate score of each service unavailable during required times.
20. end for If F is the original service deployed by the service provider
21. SCL.sort(Score) // Rank all services in SCL in cloud after agreeing SLAs and F’ is the instance of that ser-
22. Return SCL vice running in cloud that is being used by client, the service
23. END identity can be satisfied only if F = F’ holds true for that
particular instance of F running in the cloud during the entire
lifecycle of F from deployment to decommissioning. The
E. SLA NEGOTIATION service identity can be described by the following equation:
The SLA coordinator receives user requirements and SLA’s
F ≡ F0 (a)
from the foreign cloud and negotiates a dynamic SLA
between them. These SLAs exist within the customer domain In order for functional properties of a service instance F’
that wants to access foreign cloud resources. From the client to hold, its functional properties must be the same as

58626 VOLUME 6, 2018

M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

original instance. While the case for non-functional proper- F. SLA ENFORCEMENT
ties is more complex as the service states can change dynami- Once a user is authorized to access cloud resources, next stage
cally during runtime. Moreover, each user will have different is the enforcement of security mechanisms by the provider.
QoS requirements from a service. As an example, users X In this stage, mechanisms are implemented that can guarantee
and Y using different instances of F’ of same service F can SLA assurances. The enforcement of agreed SLA is done
have varying availability, and cost requirements. Therefore, in two stages. The first stage involves implementing the
we define a threshold value for non-functional parameters software modules that can be activated for the acquisition of
of a service instance that it must maintain to ensure service resources for enforcing security policies and second stages
identity. involve dynamic reconfiguration of the resources after a secu-
The non-functional parameters of a service agreed in the rity alert is generated.
SLA can be defined as a tuple: This paper focuses on the implementation of mechanisms
for non-functional properties of IoT services to ensure that
NFunc = {Mini , Maxi , Wi } 0≤i≤l service complies with the defined SLA policy. The enforce-
ment of policies for SLA enforcement is done by foreign
i is the QoS parameter, Min and Max show the accepted cloud in its infrastructure by acquiring enough resources
boundaries or threshold values for that parameter, and for service execution and employing required mechanisms.
W denotes the weight assigned to a particular parameter by a
QoS parameters mentioned in SLAs are measured by main-
user which shows the importance given to that parameter by
taining current system configuration information and runtime
a user. The range of W is [0, 1] with the higher value showing
information of parameters that are part of SLOs (measurable
that parameter is important for the user and it will have a metrics). Depending on the client requirements some or all
larger impact on service quality, and vice versa for the lower SLA parameters could be measured, and SLOs such as
value. In case a user does not define i, medium importance is request latency or service throughput could be measured by
given to that parameter and for that purpose a medium value
retrieving resource metrics.
is chosen in the range of W which is 0.5. For non-functional
Development of mechanisms for maintaining functional
properties to hold true in an instance, the following condition
property is not in the scope of this paper. We discuss var-
must be satisfied at all times: ious mechanisms that exist in the literature that could be
Mini ≤ NFunci ≤ Maxi (b) deployed for secure service execution such as trusted comput-
ing. Trusted computing is a paradigm used to enforce trust-
To comply with functional requirements such as security worthy behavior of computing platforms. It is based on using
different techniques can be agreed in the SLA which can a hardware crypto-processor module named Trusted Platform
ensure that functional behavior of service instances F’ will Module (TPM) [11]. This feature can be used to run services
not change. For example, to maintain service identity trusted on only those cloud nodes whose fingerprints are trusted [12].
platform module (TPM) mechanism could be used. The func- Various mechanisms for cloud computing based on TPM have
tional property of a service could be defined as: been proposed that are used for security of services, data
and other resources. Excalibur [12] is a system that can be
F − F0 = Ø (c) used to design trusted computing services for cloud. It uses
policy sealed data (data encrypted according to customer
If both equations (b) and (c) hold than equation (a) will policy) that can only be unsealed (decrypted) by nodes whose
hold. However, in case if service security is compromised configuration match the node policy. Excalibur uses Attribute
than the equation will become F’ ⊃ F meaning that service Based Encryption to bind policies and attributes to node con-
identity does not hold. figurations. A mechanism that uses a hardened hypervisor to
Meanwhile, various authors have proposed definitions attest that the image of the VM running on a cloud node is the
of other functional and non-functional metrics (SLOs) for same as the one uploaded originally by the service provider
IoT services that can be agreed between customer and and initiated by cloud was proposed by Bouchenak et al. [13].
provider during SLA negotiation. These parameters include It confines the execution of VM to secure nodes inside the
request latency, availability, accessibility, service throughput, cloud and guarantees that even the system admin with root
completion time, and mean times to repair and failure, energy privileges cannot tamper with the VM memory. Some other
cost and financial cost. recommendations provided by NIST for hardening the hyper-
The proposed system uses WSDL to express the func- visor include maintaining proper isolation, separating the
tional security requirements and non-functional require- duties of administrative functions and restricting administra-
ments. The XML data structures are generated on the basis of tor access to security checks [14].
WSDL document, the service interface definition and its
implementation. Therefore, QoS tags are associated with a G. SLA MONITORING
new category to recognize security and other properties. The Currently, no solutions exist to check for SLA compliance for
protocols for SLA management are implemented in the form user support. However, researchers have recommended using
of a REST based service and API. the monitoring mechanisms to check for SLA compliance on

VOLUME 6, 2018 58627

 M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

implemented as RESTful web service in cloud and its respon-

sibilities are two folds. First in the local cloud when it wants
to access a foreign cloud and second in a foreign cloud when
a connection request is received.
When a user in the local cloud needs to access service
in a foreign cloud, it is the responsibility of a controller to
establish a connection with the other foreign cloud. Before
sending a message to the foreign cloud, it communicates with
the local authenticator component to get the certificate. After
sending an authentication request, on behalf of local cloud
it establishes the communication channel by sharing session
keys.
In a foreign cloud, requests for communication from the
local cloud are received by cloud controller. Cloud controller
is then responsible to check whether, (a) the requested service
is available in the foreign cloud, (b) the connecting local
FIGURE 3. Workflow of MC-IoT.
cloud is trustworthy, and (c) respond to the foreign clouds
request.
the cloud provider which involves, i). verifying that SLAs are
followed through infrastructure access, and ii). generating an B. AUTHENTICATOR
alert notification if the SLAs are violated to take corrective Authenticator component is responsible to manage the
steps. authentication of multi-clouds. Once the communication
Monitoring could either be performed by the client from request from the local cloud reaches the foreign cloud, cloud
data received from cloud provider or by the cloud provider Controller of the foreign cloud connects with the authen-
at the infrastructure level which is the focus of this paper. ticator to verify if the connecting user (of local cloud) is
The input to monitoring component provided by tbe cloud trusted or not. When the authenticator component receives
provider is the formal requirements to be monitored in a for- the message containing the identity of local cloud and its
mal language such as XML. The monitoring component than digital certificate, it checks whether the certificate is valid
derives the pattern of events that could occur during service and responds to controller component. Based on the response
execution and imply SLA violation. In the proposed system from the authenticator, cloud controller of the foreign cloud
uses event-driven modules to collect all generated events responds to the cloud controller of the local cloud.
and performs required filtration operations before analyzing In a local cloud, when a collaboration request is to be
them. The description of event captors and monitor is used to sent to foreign cloud authenticator is responsible to contact
monitor SLA parameter. trusted party (TP) which generates the certificate for the local
The analysis is performed based on captured events to cloud, signs it and returns it to the local cloud. Before sending
check if any generated events show an SLA violation. If a a communication request to the foreign cloud, local cloud
security violation is reported by the monitoring component, controller gets its certificate from the authenticator.
it logs the event and estimates the current status of service.
Monitor also reports to the user if the foreign cloud is com- C. TRUSTED PARTY
pliant with the signed SLA or not. In case of SLA violations, Trusted party (TP) is the identity provider responsible to
user can enforce penalties on the provider. handle the authentication among multi-clouds. It has list
of trusted cloud providers, and before establishing session
IV. WORKFLOW the connecting clouds communicate with it to acquire their
This section explains the workflow for the overall system and certificate. After receiving a certificate request, it generates
the details of various components. A user request to connect a certificate, signs it with its private key and returns it to
to the foreign cloud for accessing an IoT service is received by the requesting cloud. Any cloud registered with a TP receiv-
cloud controller that advertises request to connect to multiple ing a certificate signed with a private key of that particular
foreign clouds and receives their responses. Service Match- TP considers it true.
maker selects the best provider based on user QoS require-
ments. The authenticator is responsible for authentication D. SLA COORDINATOR
while the SLA coordinator is responsible for SLA manage- This component is responsible to manage SLA’s in the pro-
ment. Workflow of the proposed system is shown in figure 3. posed framework. It has features including adaptability and
rapid response. It initially selects the suitable service for a
A. CLOUD CONTROLLER client in local cloud based on his requirements using nego-
This is the major component responsible to handle the multi- tiation. Once a foreign cloud provider has been selected,
cloud communication and authentication. The controller is security and QoS parameters are negotiated. The enforcement

58628 VOLUME 6, 2018

M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

component is responsible to ensure that service execution in

the foreign cloud is according to the QoS parameters agreed
in the SLA. Moreover, the monitor is responsible to ensure
that the service used by the cloud provider complies with the
SLA and in case there is a violation of SLA it reports that
violation to the service provider.

V. EXPERIMENTS AND RESULTS

To examine the feasibility of the proposed design empirically,
it was implemented on two different clouds. The experiments
were conducted to assess the, (i) scalability of the proposed
system and (ii) runtime overheads of the system during a FIGURE 4. Authentication time for various instances.
collaboration between multi-clouds.
The prototype was tested on two different cloud infras-
tructures. One of the cloud infrastructures was an OpenStack
cloud based in University of Derby. This setup consists of
six server machines. Each machine has 12 cores with two
6-core Intel Xeon processors running at 2.4 GHz with 32 GB
RAM and 2 TB storage capacity. The cloud nodes on which
the experiments were performed had 4 VCPUs running at
2.4 GHz each, 8 GB RAM, and data storage of 100 GB per
node. The second cloud was also based on Amazon AWS.
The cloud nodes on this machine had 4 VCPUs, 8 GB RAM
and 100 GB storage.
Both the Cloud Controller and Cloud Authenticator are
employed as web services which help in avoiding tightly
bound security. While WS-Agreement was used to implement
the SLA components. To enable the interaction among com-
ponents in the prototype according to the proposed system,
FIGURE 5. Performance comaprison of proposed authentication scheme
cloud controller of local cloud submits requests for resources in multi-cloud scenario.
to other foreign clouds. When the foreign cloud controller
initializes and receives a request for available services from
a local cloud, it shares exchange information about available
services and their characteristics.
In the experiments, to check the scalability of the system
initially a large number of service requests were created in the
local cloud so that they can be connected to multiple instances
in the foreign cloud. To start the communication, cloud con-
troller from a local cloud invokes the cloud controller in the
foreign cloud. This is then followed by various operations
in the foreign cloud including checking the availability of
the required services, verifying if the local cloud user that
wants to connect is authorized and SLA negotiation to agree
the functional and non-functional requirements of services
that need to be satisfied. After performing authentication and
communication among multiple instances, a large number
of users from local cloud were able to request for multi- FIGURE 6. Precision of Accuracy matrix for service selection.

cloud collaboration and access service instances in the for-

eign cloud, and those instances were generated according to authentication protocols like SAML [15] and Kerberos [16].
negotiated SLA parameters. Figure 5 shows that the proposed authentication protocol is
To evaluate the overhead caused by protocol, the time taken very efficient compared to other protocols. 2. The proposed
by different operations was calculated. The time taken by authentication protocol has better performance than tradi-
different instances during authentication of instances in the tional protocols like SAML and Kerberos as it is designed
foreign cloud using the proposed system is shown in figure 4. specifically for heterogeneous multi-cloud scenarios. Ker-
To assess the effectiveness of our proposed proto- beros is a centralized protocol and distributes tickets to all
type, we compared the results with other commonly used communicating parties which increases its processing time.

VOLUME 6, 2018 58629

 M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

FIGURE 7. UI of client side showing SLA parameters compliance in foreign cloud (Red color shows SLA violations while green shows SLA
compliance).

Although SAML is a distributed authentication protocol, and smart homes. The proposed framework MC-IoT offers
it does not support heterogeneous client attributes, and when various advantages and use cases for IoT. Among these is
used in a secure way (in conjunction with SSL) it takes longer the usage of MC-IoT in e-Healthcare, smart cities, vehicular
than proposed protocol to perform authentication of multiple networks and smart retail. In this section, we present how
clients. the proposed framework can be used in e-Healthcare and
To check the accuracy of the service selection algorithm, improving supply chains.
service selection requests were made from a large number of
services instances, and the algorithm was successfully able A. E-HEALTHCARE
to select the service with the highest match of QoS properties Healthcare IoT devices such as sensors including implantable,
using accuracy matrix compared to SPSE and simple additive bio-sensors, micro-electromechanical silicon and nano-
weighting (SAW) technique [17]. Precision measured as the sensors can potentially bring huge benefits to e-Healthcare
ratio of a total number of correctly returned services to a industry in the coming years. Some of the benefits offered to
total number of returned services of using accuracy matrix patients include remote monitoring of patients with chronic
compared to SPSE and SAW is shown in figure 6. illness, helping in the treatment of diseases, and monitoring
To measure the performance SLA co-ordinator and effec- of health statistics by patients themselves can help them to
tiveness of monitoring we did experiments to measure the steps to improve their health. With the significant advantages
accuracy monitoring component during service execution offered by using sensor data in health care, the challenge
in the foreign cloud. A basic user interface (UI) was cre- arises with storing huge amount of data generated by sensors.
ated on the client side to report any SLA violations of the Moreover, e-Healthcare requires data processing, storage and
SLA metrics. Figure 7 shows the client UI after accessing analytics that can be potentially be used by collaborative
a few services in the foreign cloud. The boxes in red are healthcare entities and applications.
SLA violations that were captured while green boxes indicate e-Healthcare solutions enable the delivery of health care
the SLA parameters that were successfully implemented and services at any required time however, its deployment also
followed. raises several challenges. The world population is increas-
To measure the delay caused by monitoring, the average ing with the passage of time and more healthcare chal-
time taken to make a decision about the events captured lenges can be expected in the future. Due to the rise
and violations recorded. It is used to measure the difference in healthcare cost, more sophisticated procedures such as
between the time at which the event leading to the violation e-Healthcare are required. Sensor based e-Healthcare systems
of SLA occurred and the time taken by the monitor to decide can monitor patient’s health remotely and the doctor can view
that a violation has been recorded. The average delay in patients health using e-Health applications without the need
measuring 1000 events was found out to be 123.34 ms and it of patients visiting a doctor. This ubiquitous monitoring has
remained stable as the number of events increased. Therefore, been predicted as the future of modern healthcare.
it can be said that monitoring of SLA parameters take a small Multi-cloud system can provide a service based and
amount of time to detect and record violations which can be application-oriented infrastructure that can be suitable for
reported to the foreign cloud so that these violations could be sensor based e-Healthcare system due to many reasons
decreased. including the following: sensors generate a large amount of
data, number of patient’s records being managed is very large,
VI. USE CASES healthcare workers need inter-organizational and collabora-
IoT has brought revolutionary changes by having applica- tive data sharing, some e-Health services need a specific plat-
tions varying from manufacturing, transport to healthcare form to run, healthcare workers might need to use an e-Health

58630 VOLUME 6, 2018

M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

service being run on remote platform only for a limited period To address the authentication issues in multi-clouds dif-
that will be economically inefficient to be purchased for a ferent architectures were proposed. Xu et al. [20] proposed
long time, and performing data analytics on large datasets of an architecture by which different organizations can collab-
healthcare needs more resources than traditional infrastruc- orate to use business services. The proposed methodology
ture. Based on heterogeneous requirements of multi-cloud coordinates security pre-requisites in SOA-based business
and e-Healthcare services, this work proposed framework can forms and presents techniques for authentication of services
enable dynamic collaboration between e-Health services in from various domains for SOA-based business forms at run-
multi-clouds. time. Their architecture requires neither credential exchange
Using MC-IoT based healthcare system, users including nor foundation of any validation for creating a business
patients and healthcare workers will only need to get authen- session. The accuracy of the convention is formally broke
ticated by their local cloud and the proposed system will down and demonstrated, and an observational review is
enable them to use services in foreign clouds according to performed utilizing two creation quality Grid frameworks,
requirement. The proposed system design can revolutionize Globus 4 and CROWN.
the healthcare by providing key benefits such as ability to use Celesti et al. [21] propose a design to empower cloud
multiple e-Health services on various platforms, scale com- federation in view of a three-stage model. These stages
puting resources such as storage according to requirements are named as discovery, matchmaking and authentication.
and share collaborative data with health care workers from The design includes a matchmaking agent which facilitates
other clouds. brokering, given by a match-production operator, whose
errand is picking the more helpful Cloud(s) wherewith to
B. BUSINESS CASE set up an organization in view of data gathered both at the
As described earlier, MC-IoT can be used to enable users of a IaaS layer (e.g., CPU or RAM memory) and higher layers
cloud platform to access services in another cloud. There are (e.g., QoS level). The proposed inter-cloud identity manage-
many other business cases of this framework that can help to ment infrastructure extends from XMPP, and XACML to
improve the business supply chain. SAML [22].
Consider a case in which an organization named Bohli et al. [23] give a study of security and protection
E-Packagers is using cloud resources and services on a cloud arrangements that expand on the idea of the synchronous use
service provider. The company needs cloud resources during of multiple clouds. Pearson [24] talk about how the ideas
peak times between 9 am to 5 pm on working days and of privacy, security, and trust develop with the emergence
usage of these resources and their services on weekends is of cloud, and propose conceivable ways to deal with their
close to none. In this scenario, E-Packagers will have to pay insurance and administration.
for the time when the usage of their allocated resources is Al-Aqrabi [25] developed an authentication scheme that
really low. However, using MC-IoT the company can further can be used to build up certain trust connections among
lease its services to be used by users from other clouds who these business intelligence service instances and clients by
can directly contact E-Packagers and use their services for sharing a typical session key to all members of a session. The
a certain time without cloud provider interaction. This can distribution and generation of secret keys were managed by
help the company to generate additional revenues and users a central authority called session authority. The correctness
to access services with lesser conditions in less time. of the protocol was verified and performance overhead was
evaluated using a trusted third party.
The concept of IoT backed by cloud was introduced as the
VII. RELATED WORK
advantages of cloud including unlimited storage and process-
Delivery models for multiple clouds can be classified into ing can significantly improve IoT performance. IoT based
two types which are federated cloud and multi-cloud. These
clouds have introduced concepts such as smart things, things
models contrast in the level of co-operation between the as a service and sensor as a service (SenaaS) [26]. Due to
included Clouds and the way that the client communicates benefits offered by cloud in IoT, several new concepts were
with them [18]. proposed.
Celesti et al. abridge the prerequisites of identity manage- The idea of cloud federation using IoT has been presented
ment across clouds in two classifications [19]:
by authors in three stages [27]. The first stage includes
1). Single Sign-On (SSO) authentication, where a Cloud embedded devices to be connected to IoT cloud systems,
must have the capacity to verify itself to access the the second stage includes cloud providers leveraging IoT as
assets gave by federated foreign Clouds having a place a service while the third stage includes federation of IoT
to a similar trust setting without further identity checks. providers to extend their services and achieve more flexibility.
2). Digital identities and third parties, where a cloud must Leitner et al. [28] have proposed a dynamic data-driven
be considered as a subject particularly distinguished by architecture that is able enough to ensure service provision-
credentials and each cloud must have the capacity to ing in cloud federation with minimum violations of service
confirm itself with outside clouds utilizing its digital level agreement (SLAs). The author provided the simulation
identity. studies to validate the proposed approach. Rak et al. [29]

VOLUME 6, 2018 58631

 M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

has introduced a novel approach named SPECS. The SPECS [10] M. Ahmed, L. Liu, B. Yuan, M. Trovati, and J. Hardy, ‘‘Context-aware ser-
approach helps to offer various mechanisms to access security vice discovery and selection in decentralized environments,’’ in Proc. IEEE
Int. Conf. Comput. Inf. Technol., Ubiquitous Comput. Commun., Depend-
features that have been offered by CSPs, specify security able, Autonomic Secure Comput., Pervasive Intell. Comput., Oct. 2015,
requirements and to integrate the security services with cloud pp. 2224–2231.
services to form security as a service approach. [11] A. Awad, S. Kadry, B. Lee, and S. Zhang, ‘‘Property based attestation for a
secure cloud monitoring system,’’ in Proc. EEE/ACM 7th Int. Conf. Utility
Despite the considerable amount of research in multi- Cloud Comput., Dec. 2014, pp. 934–940.
clouds, establishing dynamic communication to access ser- [12] N. Santos, R. Rodrigues, K. P. Gummadi, and S. Saroiu, ‘‘Policy-sealed
vices (particularly IoT services) in heterogeneous clouds is data: A new abstraction for building trusted cloud services,’’ in Proc.
USENIX Secur. Symp., Aug. 2012.
still an open research problem. Current work lacks the pro- [13] S. Bouchenak, G. Chockler, H. Chockler, G. Gheorghe, N. Santos, and
tocols and frameworks that can be used for dynamic multi- A. Shraer, ‘‘Verifying cloud services: Present and future,’’ACM SIGOPS
cloud service collaboration and this research aims to solve Operating Systems Review, 2013.
[14] M. Kazim and S. Y. Zhu, ‘‘Virtualization security in cloud computing,’’ in
this problem. Guide to Security Assurance for Cloud Computing. Springer, 2015.
[15] SAML. Accessed: Aug. 26, 2018. [Online]. Available: https://developers.
VIII. CONCLUSION onelogin.com/saml
[16] Kerberos. Accessed: Jul. 16, 2018. [Online]. Available: http://web.mit.
Multi-clouds offer a promising solution to efficiently deliver edu/kerberos/
IoT services, but their adoption also raises challenges due [17] A. Afshari, M. Mojahed, and R. M. Yusuff, ‘‘Simple additive weighting
to lack of supporting frameworks. This paper provides a approach to personnel selection problem,’’ Int. J. Innov., Manage. Technol.,
vol. 1, no. 5, pp. 511–515, 2010.
novel framework to establish secure collaboration across [18] D. Petcu, ‘‘Multi-Cloud: Expectations and current approaches,’’ in Proc.
multi-clouds to access services running in the foreign cloud. Int. Workshop Multi-Cloud Appl. Federated Clouds, Apr. 2013, pp. 1–6.
An authentication scheme is presented by which communi- [19] A. Celesti, F. Tusa, M. Villari, and A. Puliafito, ‘‘How to enhance cloud
architectures to enable cross-federation,’’ in Proc. IEEE 3rd Int. Conf.
cating clouds can authenticate each other dynamically. Ser- Cloud Comput., Jul. 2010, pp. 337–345.
vice matchmaking technique is proposed to select the best [20] J. Xu, D. Zhang, L. Liu, and X. Li, ‘‘Dynamic authentication for cross-
IoT service matching user requirements among multiple for- realm SOA-based business processes,’’ IEEE Trans. Services Comput.,
vol. 5, no. 1, pp. 20–32, Jan./Mar. 2012.
eign clouds, and SLA approach is used to ensure service [21] A. Celesti, F. Tusa, M. Villari, and A. Puliafito, ‘‘Three-phase cross-cloud
execution in the foreign cloud is according to the agreed federation model: The cloud SSO authentication,’’ in Proc. 2nd Int. Conf.
SLA parameters between the user and the provider. Moreover, Adv. Future Internet (AFIN), Jul. 2010, pp. 94–101.
[22] A. Celesti, F. Tusa, M. Villari, and A. Puliafito, ‘‘Security and cloud
we also present the detailed system design to implement these computing: Intercloud identity management infrastructure,’’ in Proc. 19th
protocols and framework. The experiments are performed on IEEE Int. Workshops Enabling Technol., Infrastruct. Collaborative Enter-
two cloud systems based on OpenStack and Amazon AWS prises (WETICE), Jun. 2010, pp. 263–265.
[23] J.-M. Bohli, N. Gruschka, M. Jensen, L. L. Iacono, and N. Marnau,
and the results show that our protocols only result in a limited ‘‘Security and privacy-enhancing multicloud architectures,’’ IEEE Trans.
overhead. Furthermore, the use case scenarios are presented Dependable Secure Comput., vol. 10, no. 4, pp. 212–224, Jul./Aug. 2013.
to show applications of the proposed framework. [24] S. Pearson, ‘‘Privacy, security and trust in cloud computing,’’ in Pri-
vacy and Security for Cloud Computing. London, U.K.: Springer, 2013,
pp. 3–42.
REFERENCES [25] H. Al-Aqrabi, ‘‘Cloud BI: A multi-party authentication framework
[1] J. Gubbi, R. Buyya, S. Marusic, and M. Palaniswami, ‘‘Internet of Things for securing business intelligence on the cloud,’’ Ph.D. dissertation,
(IoT): A vision, architectural elements, and future directions,’’ Future 2016.
Gener. Comput. Syst., vol. 29, no. 7, pp. 1645–1660, 2013. [26] E. Cavalcante et al., ‘‘On the interplay of Internet of Things and
[2] (2017). Roundup Of Internet Of Things Forecasts. Accessed: cloud computing: A systematic mapping study,’’ Comput. Commun.,
Aug. 4, 2018. [Online]. Available: https://www.forbes.com/ vols. 89–90, pp. 17–33, Sep. 2016.
sites/louiscolumbus/2017/12/10/2017-roundup-of-internet-of-things- [27] A. Celesti, M. Fazio, M. Giacobbe, A. Puliafito, and M. Villari, ‘‘Charac-
forecasts/#3a4c69321480 terizing cloud federation in IoT,’’ in Proc. 30th Int. Conf. Adv. Inf. Netw.
[3] A. Botta, W. De Donato, V. Persico, and A. Pescapé, ‘‘On the integration Appl. Workshops (WAINA), Mar. 2016, pp. 93–98.
of cloud computing and Internet of Things,’’ in Proc. Int. Conf. Future [28] P. Leitner, J. Ferner, W. Hummer, and S. Dustdar, ‘‘Data-driven and auto-
Internet Things Cloud (FiCloud), Aug. 2014, pp. 23–30. mated prediction of service level agreement violations in service composi-
[4] R. Buyya, C. S. Yeo, and S. Venugopal, ‘‘Market-oriented cloud com- tions,’’ Distrib. Parallel Databases, vol. 31, no. 3, pp. 447–470, Sep. 2013.
puting: Vision, hype, and reality for delivering it services as computing [29] M. Rak, N. Suri, J. Luna, D. Petcu, V. Casola, and U. Villano, ‘‘Security
utilities,’’ in Proc. 10th IEEE Int. Conf. High Perform. Comput. Commun., as a service using an SLA-based approach via SPECS,’’ in Proc. IEEE 5th
Vancouver, BC, Canada, Sep. 2008, p. 1. Int. Conf. Cloud Comput. Technol. Sci. (CloudCom), Vol. 2, Dec. 2013,
[5] F. Paraiso, N. Haderer, P. Merle, R. Rouvoy, and L. Seinturier, ‘‘A federated pp. 1–6.
multi-cloud PaaS infrastructure,’’ in Proc. IEEE 5th Int. Conf. Cloud
Comput., Jun. 2012, pp. 392–399.
[6] N. Ferry, A. Rossini, F. Chauvel, B. Morin, and A. Solberg, ‘‘Towards
model-driven provisioning, deployment, monitoring, and adaptation of MUHAMMAD KAZIM received the bachelor’s
multi-cloud systems,’’ in Proc. IEEE 6th Int. Conf. Cloud Comput., degree in computer engineering and the master’s
Jun./Jul. 2017, pp. 887–894. degree in computer security from the National
[7] 451 Research. Accessed: Aug. 15, 2018. [Online]. Available: University of Sciences and Technology, Pakistan.
https://451research.com/images/Marketing/press_releases/Pre_Re- He is currently pursuing the Ph.D. degree in com-
Invent_2018_press_release_final_11_22.pdf puter science at the University of Derby, U.K. He
[8] F. Liu et al., NIST Cloud Computing Reference Architecture, vol. 500, has worked at various academic positions at the
no. 2011. Gaithersburg, MD, USA: NIST, 2011, pp. 1–28. University of Derby including, as an Associate
[9] E. Bresson, O. Chevassut, D. Pointcheval, and J. J. Quisquater, ‘‘Provably Academic and a Graduate Teaching Assistant. His
authenticated group Diffie-Hellman key exchange,’’ in Proc. 8th ACM
research interests include cloud security, IoT, IoT
Conf. Comput. Commun. Secur., Nov. 2001, pp. 255–264.
security, networks security, and distributed systems.
58632 VOLUME 6, 2018
M. Kazim et al.: Framework for Orchestrating Secure and Dynamic Access of IoT Services in Multi-Cloud Environments

LU LIU (M’07) received the M.Sc. degree in data SHAO YING ZHU is currently a Senior Lecturer
communication systems from Brunel University in computing at the University of Derby, U.K.
and the Ph.D. degree from the University of Surrey She is the Programme Leader for M.Sc. Advanced
(funded by DIF DTC). He is currently a Professor Computer Networks and B.Sc. (Honors) Computer
of distributed computing with the University of Networks and Security. She has published many
Derby, an Adjunct Professor with Jiangsu Univer- peer-reviewed conference and journal papers on a
sity, and a Visiting Research Fellow with Tongji wide range of topics, such as image processing,
University. He has secured many research projects, E-learning, computer networks, and cloud secu-
which are supported by U.K. Research Councils, rity. She has edited a number of books for
BIS and RLTF, and industrial research partners. He Springer’s Computer Communications and Net-
has authored over 100 scientific publications in reputable journals, academic works Series and organized many IEEE workshops in network security
books, and international conferences. His research interests are in the areas subject areas. She has also served as a technical programme committee
of cloud computing, service computing, peer-to-peer computing, virtual member for many conferences in networking area.
computing, and system of systems engineering. He is a member of BCS.
He was recognized as a promising Researcher by the University of Derby
in 2011. He received the BCL Faculty Research Award in 2012. He has
chaired many international conference and workshops and has served as an
editorial board member for several international computing journals.

VOLUME 6, 2018 58633