Vol. 03, No. 02, pp.

101 –111 (2022)

ISSN: 2708-0757

JOURNAL OF APPLIED SCIENCE AND TECHNOLOGY TRENDS

www.jastt.org

A Survey on Cloud Security: Concepts, Types, Limitations,

and Challenges

Marya Ayoub Omer*, Abdulmajeed Adil Yazdeen, Hayfaa Subhi Malallah, Lozan Mohammed Abdulrahman

ITM Dept., Technical College of Administration, Duhok Polytechnic University, Duhok, Iraq, ([email protected]
[email protected], [email protected], [email protected])

*Corresponding Author [email protected]

Abstract
Given the world's current situation with the COVID-19 pandemic, several businesses have recently encouraged remote working from
home. A variety of benefits are provided by cloud computing, including simplified IT and management, secure Internet-based remote
access from practically anywhere, and cost savings. As a result, more people use the cloud, but there are also increasing cyber-attacks
on cloud networks. However, several companies and organizations, who do not know the security threats that Cloud systems pose, are
still worried about using the cloud. Reports previously released by researchers from academia, business, and standard organizations
proposed solutions to these problems. This paper examines state-of-the-art papers on topics, challenges to requirements, and identified
security system vulnerabilities. In addition, we will review the different components and the security and privacy concerns of current
cloud computing systems. Finally, we present a variety of security threats targeting and addressing cloud storage services. In particular,
we raise awareness on security issues that cloud organizations including cloud service providers, data owners and cloud users face and
address them.

Keywords—Cloud computing, Security, Data security, cloud services limitation, SaaS, PaaS, IaaS.
Received: October 05th, 2022 / Accepted: December 27th, 2022 / Online: December 29th, 2022
_________________________________________________________________________________________________________

service model. However, when services are outsourced to other

I. INTRODUCTION parties, there is an increased risk of data breaches, data loss,
The exponential rise of global data sets has posed a and service denial.
dilemma for the information technology sector. The white book
Data-Age 2025 published by International Data Corporation A number of well-known cloud storage alternatives,
forecasts that the world's data universe will more than triple including OpenStack Swift, Ceph, Dropbox, Google Drive, and
from 33 zettabytes in 2018 to 175 zettabytes by the year 2025.
Microsoft OneDrive, have been put into us. As a direct
In the next years, it is anticipated that the market for cloud consequence of this, the most important issue facing the cloud
computing would expand at a rapid rate. One solution to the computing business in the present day is one of data security.
challenges caused by the increase of data is cloud storage, Customers rely on CSPs to protect the information they
which makes use of a network that is connected to several data provide, the services they provide, and the availability of those
centers in order to combine multiple storage devices into a services, as well as to demonstrate that they comply with all
single storage pool. Cloud storage enables users to store data, applicable security standards [2].
exchange it with other users, and access it at any time and from
any place by using a computer that is linked to a network, most Evaluating the security of a CSP is a difficult process
often the Internet [1]. because of the intangible nature of the component. Since of
this, the process of adopting cloud computing is sped up
When referring to a technique of storing and accessing data because customers are better able to make informed judgments
through the Internet rather than on a local server, the phrase based on reliable and consistent information about the security
"cloud computing" is used. of the services they are contemplating using. This in turn
Customers stand to gain a number of exciting benefits as a speeds up the adoption process. A Security Service Level
result of the company owners' decision to move their Agreement (also known as a Security SLA) is currently being
operations into the cloud. These benefits include scalability, drafted by security service providers and their customers in
resilience, high performance, on-demand, and a Pay-Per-Use order to control the nature of their relationship with regard to

doi:10.38094/jastt301137
101
 Omer et al. / Journal of Applied Science and Technology Trends Vol. 03, No. 02, pp. 101 –111 (2022)

the management of security [3]. Within this document, the TABLE 1: Comparison of Cloud Computing Service Model [5].
rights of each party are safeguarded, and each party is required
to collaborate with the other parties in order to avoid security
Managed Security Disadvan
breaches and the accompanying financial and technical Model Scope
by Level
Advantages
tages
penalties. As a result of the notion of cloud computing, cloud Scalability and
service providers (CSPs) are confronted with a myriad of Can be
Public and Providers reliability with
Public unreliable
challenges, some of the most significant of which include Model
private of cloud Low on-demand
Less
sectors services resources Easy
output guarantee, resource restrictions, disaster recovery to use
secure
planning, regional workload distribution, and regulatory
More
considerations. As a potential solution to these issues, the idea Single Single Organization- costly
Privat
of a cloud federation was conceived as a possible solution. It e
organizatio organizati High specific Requires
makes it possible for a CSP to keep complete control and n on Customizable IT
Model
expertise
visibility over the processing of a portion of the requests made Organizatio
by its users while delegating those requests to third-party ns with Many
service providers [4]. common organizati Flexible and costly
Comm
strategies ons or Scalable than the
unity High
and cloud public
Model
reservations service cloud
The remainder of this paper is structured as follows: section about providers
II discussed types of cloud. In section III, the concept of the protection
Potential
cloud services model is outlined. Section IV depicts cloud challenges
service model limitations. Cloud security issues and challenges Flexible
in
Hybri Public and Public and infrastructure
are presented in section V Section VI presents the literature d organizatio organizati
Medium
Cost controls
applicatio
n and data
review. Section VII presented discussion and comparison, and Model n on Faster speeds
integratio
section VIII concludes the paper. n

II.CLOUD TYPES
III.CLOUD SERVICES MODEL
 Private Cloud: it is restricted and open to a small
community of people and organizations. This cloud model Cloud services fall into three categories as shown in Figure 1:
provides more protection and resource management. a) Software as a Service (SaaS): This model provides cloud
 Public Cloud: every subscriber is allowed to access the customers with a variety of applications for a variety of
cloud via public cloud internet connectivity. The public or operations. Web Browsers are used by users to access the
organizations therefore manage public cloud resources. applications. They just charge based on the number of times
This cloud type contains little control of resources and less a program, such as Microsoft Word, Notepad, or Paint, is
privacy [5, 6] . used. Google, ZOHO, Intuit, and Salesforce.com are all
 Community Cloud: this type of cloud shares more than examples of SaaS providers [9].
two cloud-like organizations. A third party or company b) Platform as a Service (PaaS): This model Platform-like
manages it. It offers services to large users compared to Operating System provides services to users. Users create
the private cloud, providing more protection than the their own frameworks and work with an Integrated
public cloud [7]. Development Environment (IDE) that includes a compiler,
 Hybrid Cloud: Companies that use a hybrid cloud model editor, and other tools. PaaS providers include Google Apps,
Force.com, and Bungee Connect [10].
make use of both private and public cloud resources. A
company uses private cloud resources for routine c) Infrastructure as a Service (IaaS): This model provides cloud
operations but uses public cloud resources for scalability users with infrastructures such as storage, networks, and
and cost-effectiveness [8]. servers as a service. Consumers use these programs based on
their own requirements, paying only for what they use. The
There is a distinction between cloud computing service models, user manages the operating system and the program's
which is illustrated in Table 1. deployment but does not manage or track the cloud
environment. IaaS services include Amazon Elastic Compute
Cloud (EC2) and EMC Atmos [11].

102
 Omer et al. / Journal of Applied Science and Technology Trends Vol. 03, No. 02, pp. 101 –111 (2022)

B. Limitations in PaaS

Software developers working for educational institutions

may be able to develop and move SaaS applications to the
cloud in a more expedient manner by using a platform known
as PaaS. Nevertheless, working with PaaS services might
provide developers with a number of obstacles to overcome.
To begin, increasing capability makes it simpler for developers
to integrate and manage cloud-based apps provided by other
parties. Users of PaaS have yet another significant challenge in
the form of being constrained to certain programming
paradigms or tiers of service providers. Before being moved to
a new PaaS environment, these models and services need to
undergo a comprehensive redesign. This is necessary since
Fig 1. Cloud services [12]. they are highly dependent on their current setting. Users are
unable to switch networks since they are restricted to the one
they are currently using. On top of the platform, developers
may build and maintain their apps, but they have no clue about
the security that the platform's service provider has permitted
IV.CLOUD SERVICE MODEL LIMITATIONS
below the platform [15].
A. Limitations in SaaS

Data localization and data integrity are two significant C. Limitations in IaaS
limits that may have an effect on the adoption of software as a
service (SaaS) applications. The majority of the time, the IaaS provides its customers with a higher level of security-
customer is unaware of the location at which the service related agency as compared to the previous two service
provider maintains its data or the measures that must be taken categories. When selecting a source, the reliability of the
to protect it from unwanted modifications. The lack of trust information that the source provides is the single most
that exists between cloud customers and cloud providers is one important consideration to make. In the model of infrastructure
of the most significant issues that arises with software as a as a service (IaaS), security is shared responsibility between
service [13]. service providers and end users. Because of the supplier's
In order to protect sensitive student information, the IT obligation, stringent safeguards have to be taken to secure both
department of the university may decide to host the SaaS the physical and the digital surroundings. On the other hand, it
application on a dedicated server or to make use of the is the responsibility of the cloud client to guarantee the safety
infrastructure services offered by reputable third-party vendors of their own data, applications, and operating system. The
such as Google, Amazon, and others. Both of these options are model known as Infrastructure as a Service places a significant
available to the university. These criteria explain why the emphasis on virtualization. In a scenario that makes use of
majority of the high schools that participated in our study virtualization, the possibility of a cross-tenant attack exists
choose to use private clouds rather than public or hybrid ones whenever several tenants use the same physical infrastructure.
(Figure 2). In this scenario, an attacker must first get root access in order
to access the cloud accounts of the majority of tenants [16] .

V. CLOUD SECURITY ISSUES AND CHALLENGES

The use of cloud computing has made some tasks simpler
to do, but it has also raised new safety issues. As a result of the
fact that various types of data are dispersed throughout the
network and stored in a variety of cloud services, there are
probably a great many distinct vulnerabilities that may be taken
advantage of by bad actors. The five various ways in which a
cloud environment could be safe are shown for us in Figure 3 :
in terms of security rules, data security, user-oriented security,
network security, and application security [17].

A. Security policies

Fig 2: Surveyed Institutions' Use Of Cloud Models [14]. The goal of security policies is to lay out the procedures
that should be followed in order to protect a system from being

103
 Omer et al. / Journal of Applied Science and Technology Trends Vol. 03, No. 02, pp. 101 –111 (2022)

compromised in some way. The implementation of these

standards will hopefully result in a cloud workspace that can be Cloud security issues
relied upon and is safe. It is possible for a variety of classification
circumstances, such as regulatory authorities, service level
agreements (SLAs), client management challenges, and
established trust, to have an effect on security policies [18] .

 Service-level agreement (SLA)

In each of these client-service provider interactions, the

Service Level Agreement (SLA) is applicable. SLAs are Security User-oriented Data Applicatio Network
necessary for suppliers that wish to keep their customers' policies security storage n
expectations in control and are required to meet those
expectations. Service providers, on the other hand, are often Operating Intrusion
Service level Authentication CIA Tired
shielded from liability under the provisions of service level agreement systems prevention
agreements in the event of errors or results that are below par Front end/
system
Client Authorization Malware Intrusion
(SLAs) [19]. Another factor that should be considered when Backend
management detection
assessing the quality of a service is the use of service level issue Meta
Identity and Application system
agreements, or SLAs. On the other hand, SLA is unable to access data vulnerabilities
Antecedent Firewalls
guarantee assurance for a specific method. To restate, the SLA management Data
trust
does not promise outstanding service and cannot enhance the warehou
quality of delivery that is below standard. The SLA includes a se
statement of concerns as well as a list of resources that are Fig 3. Different types of cloud security issues [18]
considered to be within its jurisdiction. In addition to this, it
specifies the duties that the service provider must fulfill as well  Authentication
as the responsibilities that the customer must fulfill. The
Service Level Agreement (SLA) [20] details the measures for With cloud computing, organizations are able to store a
performance, availability, usage, and reaction time. greater volume of data at a lower cost. For this reason, the
news that service providers are permitted to adopt creative
ways of customer verification comes as a welcome relief.
 Antecedent trust Depending on their needs, machines may either conduct
complete or partial authentication. In the context of cloud
Establishing mutual trust is one of the most important first
computing, a fundamental authentication method will not let
steps in any business collaboration. As a direct consequence of
you to access data from a variety of cloud service providers.
this, cloud computing is still having trouble overcoming these
Access for privileged users may be granted even if doing so
challenges [21].
carries some inherent danger. Nevertheless, this problem may
be solved by using any one of a number of other authentication
B. User-oriented security processes. It is common for users to be granted dedicate access
authority when they provide information only they are aware
Because of the complexity of utilizing cloud storage, it is of, such as a card number or a password they have created
necessary to have strong security that is user-oriented in order themselves. The following are the two primary classifications
to safeguard data and resources. Cloud service providers that these techniques belong to: The two most important types
monitoring user-submitted data while it is being stored and of security verification are known as physical authentication
processed is a huge security risk. The capacity to identify, and digital authentication [20].
verify, authorize, and deal with access concerns are all
included in this aspect of security's capabilities [22].
 Authorization

The component of information security known as

"authorization" is responsible for deciding whether or not to
comply with a user's request to get access to a certain resource.
An administrator of the system functions as a liaison between
the users of the system and the system itself [5] ageed. Because
the cloud is a distributed computing environment, a single
client may make use of services offered by a number of distinct
providers, each of which may use a security approach that is
slightly unlike to the others. For instance, when the user has
given authorization to the program, the application may then be
available from the outside world. In this context, one may
make use of either access management rules or access delegate

104
 Omer et al. / Journal of Applied Science and Technology Trends Vol. 03, No. 02, pp. 101 –111 (2022)

credentials. Authorized users are the only ones who are able to outside. OneDrive, the cloud storage service offered by
manage and make use of available services and resources [21]. Microsoft, does not provide any type of encryption for the
private data stored by its customers, in contrast to both
One of the advantages of a centralized access system is that Dropbox and Google Drive [26].
it protects sensitive data while also eliminating a number of
management and security processes. Another advantage is that
it saves time. The MAC, DAC, RBAC, and ABAC are only a  Metadata
few examples of several kinds of authorization systems [23].
A collection of files constitutes metadata in its most basic
form. The use of cloud computing has increased in popularity,
 Identity and access management which has resulted in a considerable expansion of the
significance and complexity of metadata. Metadata now stores
Identity and access management, which is a policy-based sensitive data. What was done, where it was done, the flee
framework for controlling digital identity inside an style, the data format, and other types of information are
organization, is one of the most well-supported approaches to examples of the sorts of information that may be found in
identify identity management capabilities. This is because metadata. Metadata may also include information on the format
identity and access management is a framework. Identity of the data. Cybercriminals are able to access the information
access management systems are required to take all necessary that is saved in metadata, which has a tremendous deal of
steps in order to ensure the security of user credentials during value. On the other hand, corporations make use of metadata
storage and recording, as well as to prevent unauthorized data to extract more monetary value from their already-existing
access to this information. data. In addition, given that metadata might include
Manage the access that users have to the corporate database confidential and private information, it is of the utmost
and make adjustments as required. The identity and access importance to protect metadata using appropriate encryption
management system acts as a directory that is accessible technology. Unfortunately, only records of massages may be
throughout the whole organization and takes into consideration encrypted; this means that any information about touches will
the many different categories of users that the firm has. still be exposed. The use of Virtual Private Networks (VPNs)
Nevertheless, as of just this moment, neither productivity nor makes it simple to prevent unauthorized access to the type of
income are being negatively impacted by the identity and sensitive data that is being discussed here [5].
access control system. As a direct consequence of this, it is
very difficult to get financial support for these endeavors. The
D. Application security
current state of identity and access management in the business
world, on the other hand, poses a risk to both corporate Vulnerabilities in application security are one of the most
compliance and overall security [24]. significant challenges posed by cloud computing in terms of
data protection. Before developing any software applications,
C. Data storage there are a number of security considerations associated with
the creation of cloud apps and networking that need to be taken
The data associated with the logical pool is stored in a into consideration. The trust mechanism is of the utmost
digital archive that is hosted in the cloud. The information is importance when it comes to the provision of web-based
physically kept on a large number of servers, each of which is business services that are secure. OWASP's core area of focus
operated and maintained by a distinct web hosting provider. As is the security of back-end components of web applications
more and more people use the internet and many other [27].
connected devices, there is an increasing need for distributed Mobile apps have long been one of the most popular ways
computing systems to store data in a manner that is both safe to interact with the Internet, but web application vulnerability
and accessible. Concerns over storage, availability, security has had many drawbacks. Hackers do, in reality, use
confidentiality, the CIA, and other sorts of security have endpoint-sent-traffic to inject malicious executable codes. It's
surfaced as a direct consequence of difficulties with data referred to as code injection. Malicious code can also be used
management. It is the responsibility of the cloud service in cross-site scripting. Scripts are differentiated. Web apps are
provider to ensure that the data are always accessible [25]. vulnerable to threshold, exception, and password
programming. Configuration or incomplete changes are often
 CIA tired in data security the result of management issues. Make special programming
languages more difficult. Protecting web applications also adds
When it comes to cloud computing, the three most pressing to the complexity of other issues, such as Internet security. OSs
concerns are accessibility, honesty, and privacy. (CIA) The are also crucial in application cloud protection, application
ACID property should be adhered to by any and all data that is program, and related OS. Indeed, as a computer program, the
kept in the cloud in order to provide both privacy and operating system is responsible for managing and monitoring
transparency. Cloud service providers recognize that high all resources (hard drives, memory, screens, and so on) that are
availability is beneficial not just to them but also to the used to run and exchange multiple applications at the same
customers they serve [5]. The dependability of a service may time [28].
be jeopardized by a variety of factors, including hardware
failures, software defects, and aggressive attacks from the

105
 Omer et al. / Journal of Applied Science and Technology Trends Vol. 03, No. 02, pp. 101 –111 (2022)

E. Network Stakeholders are not updated on computing security issues

related to their cloud computing.
Since cloud computing is basically network-based, serious
security concerns arose. The key parallels between network Researchers of [27] suggested The multi-workflow QoS
security and cloud security are emerging data protection, Controlled Scheduling approach fulfills the various QoS goals
network security, and the information security sub-area. Many of the client, such as execution time, cost, and ongoing work
real-world security problems confront networks. Using data planning. They focus only on cost or time, or both in
and cloud technology protections and services, network unchanged quality and accessibility. This number meets
administrators will need to follow acceptable security policies various service quality, such as time, costs, and consistency
[29]. and transparency. This proposed diagram satisfies various
service quality aspects, including time, cost, accuracy, and
Unfortunately, connectivity problems including denial of transparency. As a result, planning is performed in one target
service (DoS), distributed denial of service (DDoS), flooding for the basic QoS specifications of a client.
attacks, and network protocol vulnerabilities emerged. The
easiest way to prevent attacks is to use firewalls. End-users,
servers, and cyberspace routers are also subject to data security Paper [32] covered cloud computing and mobile cloud
audits in the cloud. Traditional firewalls are equivalent to computing, combining cloud computing with IoT, and how
firewalls-as-a-service. Since the service is hosted in the cloud, cloud convergence supports mobile apps. Integrating cloud
it is available on any network [30]. computing for mobile devices and IoT leads to many
vulnerabilities in encryption and security compromises. The
FWaaS is a good choice for any security network enterprise authors concentrated primarily on mobile cloud IoT integration
because it is less expensive, more powerful, and more flexible security issues and numerous factors affecting mobile cloud
than traditional firewalls. Firewalls aren't ideal for preventing IoT security's normal functioning. The various security issues
cloud service attacks, but they do help to limit vulnerabilities in this field and the various factors affecting security in this
and divisions. Simply put, a firewall can prevent backdoor area were also discussed, and how they can be managed to
Trojans from entering, but it cannot eliminate viruses, worms, provide IoT-enabled service for efficient and natural mobile
or malware. A firewall must communicate; a firewall only cloud computing. And grouped security problems into three
examines packet headers when malicious network access is types: architectural, infrastructural, privacy, and compliance
detected and logged; protocol sorting, protected address, issues. Some preventive measures suggested by various mobile
destination address, and secure port policy are all things that a cloud computing researchers based on different mobile cloud
firewall must consider. IDS seeks to gather valuable data for computing areas were also discussed.
future safety assessments in addition to avoiding attacks. IPS
stands for "unnecessary network access." IPS helps to prevent Work in [33] established key architectural elements of
intrusion or ransomware in addition to detecting and tracking SDCC. The key motivation is achieving agreement within the
risks. Finally, keep in mind the broader sense of network research community and promoting the SDE concept in cloud
security. Additional articles [31]. environments. Many suppliers actively create SDCC products
and specifications. This will benefit ultra-large service
providers (e.g., Google, Yahoo, and Amazon). SDCC concepts
promote innovation in many fields including physical
VI.LITERATURES REVIEW hardware, network management and legacy networks, and
Authors of [21] reveal some cloud benefits in the technology bridging elements. Authors strongly believe that
education sector and highlight certain cloud disadvantages. SDCC will continue to see huge growth in the near future,
Services, as well as security issues When using cloud bringing new levels of versatility to cloud network
technologies, companies face many challenges. Any programming and management.
educational institutions conducted the survey. Investigating
Paper [34] concentrated on realizing the security and
stakeholders' cloud security viewpoints Vulnerabilities and
forensic problems of the MK Smart project, concentrating on
overcoming methods, the author proposed as a starting point.
the challenges of securing such massive amounts of data on a
When using the cloud, stop all potential security risks.
datahub and focusing on the best way to forensically
Computing in high-school institutions. Reviews by the author
investigate large complex data such as data stored on Datahub.
the conclusions and discusses them. Via a survey conducted at
Authors looked at MK Smart's issues. As this project relies
several universities that switched to cloud computing
heavily on data (Big Data), countermeasures are important for
Collecting this material. The methodology is used to identify
data protection and cyber-attacks (Forensics). MK Datahub is
stakeholders' views on cloud security vulnerabilities and tactics
stable with Arcserve UDP implementation and has reliable
to overcome them at colleges and Students of universities,
backup and recovery solution. MK Smart Project also works on
faculty members Students and IT workers filled out the
digital forensics. Big data forensics remains a challenge for the
questionnaire. It is approximately 64% of universities were
discipline of digital forensics, but data system like Hadoop
found cloud-based. Just 36% are cloud service providers,
supported data acquisition through its layers, making it easy to
however. Even a supplier Looking at the responses to the
define and specify data on the data hub.
questionnaire, we noticed something. That several respondents
are uninitiated when it comes to privacy risks to their cloud or The work of [35] went through the service specifics in-
protection measures in place Avoid at any expense. This means depth and looked at their contacts to see what service
responsibility on those responsible for cloud computing. information they were referring to. LDA2 and word2 can help

106
 Omer et al. / Journal of Applied Science and Technology Trends Vol. 03, No. 02, pp. 101 –111 (2022)

to balance accuracy and speed in this situation. The results are predict high-priority transmissions. Before collecting tracks
applicable in the real world. Transfer learning (i.e. training and from a Ceph storage, authors defined three key types of traffic
testing) word representations has been shown to improve the flows: low, medium, and high volume. Next, find the best
LDA algorithm's performance. This is especially true in cold solution based on diversity and network latency parameters for
climates and when using other approaches to create cutting- these flows. A GRA-based flow scheduling tool was then used
edge models. Personal recommendations are made based on the to solve the routing path optimization problem covering both
users' own results; Similar domain-based transfer learning will aggregation and edge switches. They trace in a realistic setting.
be implemented in the Cloud to further reduce data scarcity. Authors performed several experiments to demonstrate that
We also know that when used in this setting, it is efficient. GRSA can provide sufficient capacity while avoiding high-
critical delays in busy conditions. But we want GRSA in a
Some virtualization issues related to cloud computing large cloud.
technology isolation were investigated in [36]. Distributed
side-channel attacks, including modern multi-domain Using Honeypot, the authors showed a new way to handle
architectures, are a major cloud infrastructure concern, malicious users [26]. Honeypot may be used by organizations
according to the researchers. The first DSCA classification to to monitor alleged rogue members. Emulating the attacker will
take advantage of isolation violations was introduced: DSCAs easily understand the victim's actions. Additional precautions
are coordinated attacks that use multiple local SCAs to are required as with each passing day, risks are greater.
infiltrate sensitive data from various parts of a distributed Honeypots enhance detection and surveillance capabilities as
system. Finally, they proposed a plan for preventing side- they build on more technologies. They use cloud storage to be
channel attacks, which included using an autonomous stable, fast, and affordable. With all this tremendous industry
mechanism to execute a moving defensive strategy, among growth, this innovation's protection is at risk. Traffic diversion
other things. They are primarily concerned with the design and can be achieved in different ways, but one of the most effective
implementation of integrated cloud infrastructure for an is using honeypots. The method showed promising results in
autonomous mitigation platform for a variety of SCA groups. protective systems evolution. Given the many legal problems
that can occur when installing Honeypot, a file-sharing
Scholars of [19] proposed a model for cloud federation application is placed on a third-party server.
creation that considers CSP security levels. They begin by
constructing a collection of parameters that quantitatively Scholars of [38] proposed architecture for a collaborative
define the Security-SLA in the cloud using the Goal-Question- security system focuses on risk recognition and analysis during
Metric (GQM) process, and then using it to compare the the collaborative platform's life cycle. the protection system is
security levels of CSPs and existing federations to a given a dynamic, active security system. A "1+3" security framework
Security-SLA baseline, taking into account CSP customers' collaboration network is proposed by the authors. In the
security satisfaction. The Cloud Federation's creation phase is framework, they build on the details of the defense model
then modeled after a hedonic alliance game focused on CSP construction scheme. It provides new theoretical support for
security and reputation. They propose a federation-building collaborative research in security technology.
algorithm that enables CSPs to enter a federation while
mitigating security losses and avoiding federations that are RDFI methods for overcoming challenges were proposed.
unstable. Experiments show that our model helps existing RDFI uses chaos engineering concepts to secure the cloud,
federations maintain higher standards of safety while reducing executing, monitoring, analyzing, and scheduling security-
the frequency and severity of Security-SLA violations. based injection campaigns across feedback loops [39]. The
fault models in the knowledge base are focused on reliable
The various characteristics of the Transportation Systems baselines, cloud security best practices, and input from iterative
Internet, security and privacy systems were discussed in [37]. fault injection campaigns. These findings aid in the detection of
Explore how to combine AI and defense and cloud-based flaws while also ensuring that security attributes are adequately
transport systems were presented. Finally, he explained how to tested (integrity, confidentiality and availability). Furthermore,
connect AI, Protection, and Things Internet. 'It's just begun to through exchanging security knowledge with security systems,
detect the depths of the Internet of Things they understand RDFI facilitates risk detection and security hardening. We
various types of attacks and formulate ML techniques to fight developed and implemented RDFI techniques as a software
them. Also, consider how best to handle the attacks on the ML tool, including various chaos engineering algorithms:
techniques needed for IoT device development. Finally, we CloudStrike. CloudStrike performed several technology tests
must decide to shift the analytics firms to the stable cloud. on Amazon Web Services and Google Cloud Platform, two big
cloud infrastructure providers. With rising attack rates,
Academics of [26] created a cloud flow optimization performance improves linearly over time. In addition, the
application and performed an optimization Grey Relational efficacy of CloudStrike security information was demonstrated
Approach (GREY). The resulting solution is a GRSA by using vulnerability analysis discovered by security fault
architecture that efficiently uses requested flow type and injection to harden cloud resource security. As a result, we
current network conditions to route flows through cloud data believe our methods are appropriate for addressing current
center networks, ensuring optimal service levels. An cloud security concerns.
experimental GRSA study showed it provides better balanced
loads, uses less energy from the grid, and decreases the average Researchers of [40] employed the new paradigm for cloud
transmission delay compared to ECMP. This work aims to computing requirements that incorporates four components,
optimize QoS cloud storage by guiding high-priority flows to including data security, risk assessment, law enforcement,

107
 Omer et al. / Journal of Applied Science and Technology Trends Vol. 03, No. 02, pp. 101 –111 (2022)

industry, and innovations to produce a dataset that scientists reconciler pattern CSBA, which employs a specific mechanism
can work with in Local governments benefit from attending to for computing vulnerability severity scores (GCP) to target
their present and legacy IT system's ability to be various platforms with varying outcomes (GCP). CSBAuditor
interconnected. promoting internal protection also enhances the has a performance rate of over 98 percent in detecting
system's controls and firewalls Both government and cloud problems. Furthermore, the production cost is adequate.
service providers have expressed their support for shared
responsibility The discovery of how important regulations are With service cost and multi-cloud risk perspectives, the
to cloud protection also highlights the greater need for web service composition problem is formulated as a bi-
enforcement in local settings. For good measure, the business objective optimization problem [45]. This is unmistakably an
and security specifications mention that governments should NP-hard issue. To solve the combinatorial problem, the authors
know about data recovery, and encryption must also. studies devise a bi-objective time-varying particle swarm optimization
study and learn about cloud protection requirements in local (BOTV-PSO) algorithm. To achieve a reasonable balance of
governments We are making progress in the areas of cloud exploration and extraction, the parameters are changed based
protection, but there are still major organizational, human, and on the amount of time elapsed. To demonstrate the
legal challenges to work around as well. effectiveness of the proposed algorithm, the authors identified
several scenarios and compared its performance to that of a
AuthPrivacyChain, a blockchain-based privacy multi-objective GA-based (MOGA) optimizer, a single
management framework, was proposed in [41]. They use the objective genetic algorithm (SOGA) that only optimizes the
blockchain node account address as a form of identification cost function and ignores CSR, and a multi-objective simulated
while also redefining cloud data access control authorization, annealing algorithm. According to the experimental results, the
which is encrypted and stored in the blockchain. After that, proposed BOTV-PSO outperformed other approaches in terms
AuthPrivacyChain creates protocols for access control, of convergence, diversity, fitness, performance, and even
authorization, and revocation. They have used Enterprise scalability.
Operating System (EOS) to implement AuthPrivacyChain, and
the results show that AuthPrivacyChain is capable of not only
stopping hackers and administrators from accessing resources VII.DISCUSSION AND COMPARISON
illegally, but also of protecting privacy.
Depending on the reviewed research in the literature review
Biometrics-based two-factor authentication and a hybrid section, a summarized comparison has extracted as shown in
encryption algorithm are implemented [42]. The efficiency of Table II. Hence, the following points can be highlighted:
this architecture is determined in Various tests on the internet
network include data uploading and downloading. The Frag  The majority of research has focused on or is aimed at
Secure Module encrypts the data, and then authentication is enhancing security, ensuring optimal service levels.
checked and matched against the fingerprint. As this cloud protecting data in the cloud, and ensuring optimal
architecture is implemented, the findings show that fake and service levels. They want something that is safe, fast,
real users can be distinguished 100% of the time. and affordable.
Authors of [29] addressed the issues that arise when data is  Machine learning has used to Best manage attacks on
inaccessible. There was a lot of discussion about IoT devices that required ML techniques.
interoperability, but in a few key cases, an open standard was  focus only on cost or time, or both in quality and
proposed. The authors focus on major cloud computing threats
accessibility Focus on mobile cloud IoT security
including denial of service attacks, VM-level attacks, and
DDoS-related service interruption attacks. problems and various factors affecting mobile IoT
security [5].
Research [43] proposed a cloud computing and healthcare  Most of the researchers proposed methods for avoiding
cloud computing method. They would strengthen the authors'
healthcare architecture; cloud infrastructure has the ability to security threats as much as possible.
significantly reduce healthcare costs while also allowing  Based on an enterprise operation system (EOS), the
countries to improve their overall health. Cloud protection address the issue of leaked data by hackers or cloud
issues, including healthcare, have also been addressed. They've internal managers blockchain-based access control
also discussed and suggested ways to improve cloud security. framework with privacy protection called
Study [44] colleagues to enhance protection, the multi pein AuthPrivacyChain implemented AuthPrivacyChain
security scheme was proposed, which provides more security hacks and admins can be prevented, along with privacy
than any single-layer scheme currently in use. The algorithm, being safeguarded.
in particular, ensures that only pre-authorized users have access  Suggested a different way of using Honeypot to treat
to cloud data and that downloading and uploading files is faster malicious users. Monitor potential rogue
and more reliable.
representatives more comfortably using the Honeypot
CSBAuditor, a novel cloud security application proposed Technique in organizations. The acts of the perpetrator
by [44] , can track device changes and incidents. The entities can clearly be understood.
can be linked together using the state transformation and

108
 Omer et al. / Journal of Applied Science and Technology Trends Vol. 03, No. 02, pp. 101 –111 (2022)

TABLE I: LITERATURE REVIEW OF VARIOUS RESEARCH WORKS IN CLOUD SECURITY

Authors Achieved Objectives Depended Method Implemented Field Advantages

Investigate stakeholders' cloud method for avoiding security threats discover some cloud benefits and
[21] educational institutions.
protection as much as possible. highlight key cloud disadvantages.
Carries out the multiple QoS priorities of
focus only on cost or time, or both in Suggested The QoS multi-workflow
[27] QoS requirements the client, such as implementation time,
quality and accessibility scheduling solution
cost and ongoing job preparation.
Focus on mobile cloud IoT security Addressed the preventive steps
Integrating IoT cloud computing, Integrating mobile cloud networks
[32] problems and various factors suggested by mobile cloud researchers in
mobile cloud infrastructure, and IoT and IoT
affecting mobile IoT security. different mobile cloud computing areas
link the research community and Adding new levels of cloud network
identified the SDCC's fundamental SDCC values promote change in
[33] encourage SDE in cloud programming and management
architectural elements large organizations
environments. flexibility.

Concentrated on knowing MK MK Smart Project is also working secure and has a reliable backup and
[34] UDP implementation, and MK
Smart's security and forensic issues on digital forensics recovery solution
Datahub
the accuracy of recommendation used to examine the service
provide personalized services based on
[35] will be improved with the growth of descriptions and perform LDA on applied in various fields
the users’ historical data
individual data both the text and location data
Develop and deploy autonomous Classification of DSCAs used to virtualization problems related to
they have outlined a method to reduce
cloud mitigation infrastructure for exploit isolation violations was isolation of cloud computing
[36] side-channel attacks
several SCA groups. introduced infrastructures
increases protection for existing compare the security levels of CSPs
using the Goal-Question-Metric minimizing security losses and avoiding
[19] federations and reduces the and federations using a known
(GQM). unstable federations
frequency and impact of TrustNss.. Federated-SEC baseline
Internet features of Transportation
Best manage attacks on IoT device AI and security can be mixed And
[37] Networks, Protection and Privacy it has been more secure
required ML techniques cloud-based transport systems.
Systems.
Created an integer cloud flow
uses fewer system resources, and
[26] Cloud storage data efficiently, optimization program and performed enhance the QoS for cloud storage
reduces the average transmission delay
ensuring optimum service levels. (GREY) for optimization.
They want safe, fast, and affordable. track alleged rogue members more
[38] With all this tremendous industry a new way to handle malicious users, using the Honeypot strategy in comfortably. one can easily understand
growth. by using Honeypot. Organizations the victim's actions.
focused on risk recognition and It offers new theoretical support for
[39] review of the collaborative collaborative manufacturing collaborative security technology
dynamic and active security system.
platform's entire life cycle. platform. research.
a useful during testing of security
Risk-driven Fault Injection (RDFI) RDFI applies chaos engineering
[40] mitigating of cloud issues requirements (integrity, confidentiality,
techniques principles to cloud security
and availability).
emphasized the importance of cloud Incorporating the international
provide critical insights for governments
[41] service providers and governments standard ISO 27002 and a number of cloud services by local governments
that are adopting cloud services
as sharing their resources good practice security controls
blockchain-based access control implemented AuthPrivacyChain
address issue of leaked data by hacks and admins can be prevented,
[42] framework with privacy protection based on an enterprise operation
hackers or cloud internal managers along with privacy being safeguarded
called AuthPrivacyChain system (EOS),
predictive efficacy of the cloud
identification of fake and actual performance of this proposed
[29] Biometric based Security technique architecture and provide 100% accuracy
users. architecture is done in the .Net
of fake and real user IDs
Solve the problems related to the
an open standardized framework in
[43] effects of the inaccessibility of the major cloud paradigm security
each of the influential usage examples. denial of service attacks
data threats
faster and better while doing so when
[44] enhance the cloud security levels a multilevel security scheme Cloud space of individual users
accessing a certain file
system that continuously scans the It can find configuration errors in real
[45] cloud for malicious and CSBAuditor cloud infrastructure time with an accuracy rate of 98% The
unauthorized activity performance requirements are also met.

109
 Omer et al. / Journal of Applied Science and Technology Trends Vol. 03, No. 02, pp. 101 –111 (2022)

approaches in cloud systems," Qubahan Academic Journal, vol. 1, pp.

VIII.CONCLUSION 29-38, 2021.
[14] H. Al-Shqeerat, F. Al-Shrouf, M. R. Hassan, and H. Fajraoui, "Cloud
Over the past decade, cloud-based market opportunities computing security challenges in higher educational institutions-A
have expanded tremendously. Cloud technologies are now a survey," International Journal of Computer Applications, vol. 161, pp.
vital part of corporate life, providing a momentous opportunity 22-29, 2017.
to drive business by allowing us to be agile with our capital, [15] M. H. Ryu, J. Kim, and S. Kim, "Factors affecting application
generating new collaborative opportunities. The cloud gives developers’ loyalty to mobile platforms," Computers in Human
companies, organizations, and even nations many advantages. Behavior, vol. 40, pp. 78-85, 2014.
Despite several advantages, the cloud still faces many security [16] D. A. Fernandes, L. F. Soares, J. V. Gomes, M. M. Freire, and P. R.
challenges. That's why the cloud's greatest challenge is Inácio, "Security issues in cloud environments: a survey," International
Journal of Information Security, vol. 13, pp. 113-170, 2014.
stability. Despite bringing many benefits, the cloud also faces
[17] S. H. Haji, S. Zeebaree, R. H. Saeed, S. Y. Ameen, H. M. Shukur, N.
several security challenges. That's why stability is the cloud's Omar, et al., "Comparison of software defined networking with
biggest problem. Customers and suppliers are mindful of traditional networking," Asian Journal of Research in Computer Science,
security risks. This paper reviewed the cloud computing model pp. 1-18, 2021.
in terms of different viewpoints including definitions, cloud [18] Z. J. Hamad and S. R. Zeebaree, "Recourses utilization in a distributed
architectures, methods, and challenges. Three service models system: A review," International Journal of Science and Business, vol. 5,
(SaaS, PaaS and IaaS) and four deployment models (private, pp. 42-53, 2021.
public, hybrid and community cloud) are identified, and the [19] T. Halabi and M. Bellaiche, "Towards security-based formation of cloud
federations: A game theoretical approach," IEEE transactions on cloud
main objective of the current study is to present all possible computing, vol. 8, pp. 928-942, 2018.
security challenges in cloud computing and provide adequate [20] Z. S. Hammed, S. Y. Ameen, and S. R. Zeebaree, "Massive MIMO-
solutions to these problems. OFDM performance enhancement on 5G," in 2021 International
Conference on Software, Telecommunications and Computer Networks
(SoftCOM), 2021, pp. 1-6.
[21] R. J. Hassan, S. Zeebaree, S. Y. Ameen, S. F. Kak, M. Sadeeq, Z. S.
REFERENCES Ageed, et al., "State of art survey for iot effects on smart city
[1] L. M. Abdulrahman, S. Zeebaree, S. F. Kak, M. Sadeeq, A. Adel, B. W. technology: challenges, opportunities, and solutions," Asian Journal of
Salim, et al., "A state of art for smart gateways issues and modification," Research in Computer Science, vol. 22, pp. 32-48, 2021.
Asian Journal of Research in Computer Science, pp. 1-13, 2021. [22] T. M. G. Sami, Z. S. Ageed, Z. N. Rashid, and Y. S. Jghef, "Distributed,
[2] Z. Ageed, M. R. Mahmood, M. Sadeeq, M. B. Abdulrazzaq, and H. Cloud, and Fog Computing Motivations on Improving Security and
Dino, "Cloud computing resources impacts on heavy-load parallel Privacy of Internet of Things," Mathematical Statistician and
processing approaches," IOSR Journal of Computer Engineering (IOSR- Engineering Applications, vol. 71, pp. 7630-7660, 2022.
JCE), vol. 22, pp. 30-41, 2020. [23] Y. S. Jghef and S. Zeebaree, "State of art survey for significant relations
[3] C. A. Sennewald and C. Baillie, Effective security management: between cloud computing and distributed computing," International
Butterworth-Heinemann, 2020. Journal of Science and Business, vol. 4, pp. 53-61, 2020.
[4] F. Abedi, S. R. Zeebaree, Z. S. Ageed, H. M. Ghanimi, A. Alkhayyat, [24] Y.-W. Huang, S.-K. Huang, T.-P. Lin, and C.-H. Tsai, "Web application
M. A. Sadeeq, et al., "Severity Based Light-Weight Encryption Model security assessment by fault injection and behavior monitoring," in
for Secure Medical Information System." Proceedings of the 12th international conference on World Wide Web,
[5] H. Malallah, S. Zeebaree, R. R. Zebari, M. Sadeeq, Z. S. Ageed, I. M. 2003, pp. 148-159.
Ibrahim, et al., "A comprehensive study of kernel (issues and concepts) [25] B. T. Jijo, S. Zeebaree, R. R. Zebari, M. Sadeeq, A. B. Sallow, S.
in different operating systems," Asian Journal of Research in Computer Mohsin, et al., "A comprehensive survey of 5G mm-wave technology
Science, vol. 8, pp. 16-31, 2021. design challenges," Asian Journal of Research in Computer Science, vol.
[6] D. Berdik, S. Otoum, N. Schmidt, D. Porter, and Y. Jararweh, "A survey 8, pp. 1-20, 2021.
on blockchain for information systems management and security," [26] W. Ke, Y. Wang, and M. Ye, "GRSA: service-aware flow scheduling for
Information Processing & Management, vol. 58, p. 102397, 2021. cloud storage datacenter networks," China Communications, vol. 17, pp.
[7] L. M. Haji, O. M. Ahmad, S. Zeebaree, H. I. Dino, R. R. Zebari, and H. 164-179, 2020.
M. Shukur, "Impact of cloud computing and internet of things on the [27] A. Kumar, P. S. Kumar, and T. Sairam, "Organization Assignment in
future internet," Technology Reports of Kansai University, vol. 62, pp. Federated Cloud Environments based on Multi‐Target Optimization of
2179-2190, 2020. Security," Cyber Security in Parallel and Distributed Computing:
[8] K. D. Ahmed and S. R. Zeebaree, "Resource allocation in fog Concepts, Techniques, Applications and Case Studies, pp. 139-147,
computing: A review," International Journal of Science and Business, 2019.
vol. 5, pp. 54-63, 2021. [28] N. T. Muhammed, S. R. Zeebaree, and Z. N. Rashid, "Distributed Cloud
[9] Z. S. Ageed, S. R. Zeebaree, M. M. Sadeeq, S. F. Kak, Z. N. Rashid, A. Computing and Mobile Cloud Computing: A Review," QALAAI
A. Salih, et al., "A survey of data mining implementation in smart city ZANIST JOURNAL, vol. 7, pp. 1183-1201, 2022.
applications," Qubahan Academic Journal, vol. 1, pp. 91-99, 2021. [29] A. Narang, D. Gupta, and A. Kaur, "Biometrics-based un-locker to
[10] S. S. Wagle, M. Guzek, P. Bouvry, and R. Bisdorff, "An evaluation enhance cloud security systems," International journal of cloud
model for selecting cloud services from commercially available cloud applications and computing (IJCAC), vol. 10, pp. 1-12, 2020.
providers," in 2015 IEEE 7th International Conference on Cloud [30] G. A. Qadir and S. R. Zeebaree, "Evaluation of QoS in distributed
Computing Technology and Science (CloudCom), 2015, pp. 107-114. systems: A review," International Journal of Science and Business, vol.
[11] R. W. Anwar, T. Abdullah, and F. Pastore, "Firewall Best Practices for 5, pp. 89-101, 2021.
Securing Smart Healthcare Environment: A Review," Applied Sciences, [31] H. S. Yahia, S. Zeebaree, M. Sadeeq, N. Salim, S. F. Kak, A. Adel, et
vol. 11, p. 9183, 2021. al., "Comprehensive survey for cloud computing based nature-inspired
[12] A. Sunyaev and S. Schneider, "Cloud services certification," algorithms optimization scheduling," Asian Journal of Research in
Communications of the ACM, vol. 56, pp. 33-36, 2013. Computer Science, vol. 8, pp. 1-16, 2021.
[13] Z. S. Ageed, S. R. Zeebaree, M. M. Sadeeq, S. F. Kak, H. S. Yahia, M.
R. Mahmood, et al., "Comprehensive survey of big data mining

110
 Omer et al. / Journal of Applied Science and Technology Trends Vol. 03, No. 02, pp. 101 –111 (2022)

[32] A. Dumka, M. Memoria, and A. Ashok, "Security and Challenges in

Mobile Cloud Computing," Security Designs for the Cloud, Iot, and
Social Networking, pp. 43-57, 2019.
[33] A. A. Abbasi, A. Abbasi, S. Shamshirband, A. T. Chronopoulos, V.
Persico, and A. Pescapè, "Software-defined cloud computing: A
systematic review on latest trends and developments," IEEE Access, vol.
7, pp. 93294-93314, 2019.
[34] E. Okai, X. Feng, and P. Sant, "Security and Forensics Challenges to
The MK Smart Project," in 2019 IEEE SmartWorld, Ubiquitous
Intelligence & Computing, Advanced & Trusted Computing, Scalable
Computing & Communications, Cloud & Big Data Computing, Internet
of People and Smart City Innovation
(SmartWorld/SCALCOM/UIC/ATC/CBDCom/IOP/SCI), 2019, pp.
1666-1670.
[35] C. Lei, H. Dai, Z. Yu, and R. Li, "A service recommendation algorithm
with the transfer learning based matrix factorization to improve cloud
security," Information Sciences, vol. 513, pp. 98-111, 2020.
[36] M.-M. Bazm, M. Lacoste, M. Südholt, and J.-M. Menaud, "Isolation in
cloud computing infrastructures: new security challenges," Annals of
Telecommunications, vol. 74, pp. 197-209, 2019.
[37] B. Thuraisingham, "Cyber security and artificial intelligence for cloud-
based internet of transportation systems," in 2020 7th IEEE International
Conference on Cyber Security and Cloud Computing (CSCloud)/2020
6th IEEE International Conference on Edge Computing and Scalable
Cloud (EdgeCom), 2020, pp. 8-10.
[38] P. S. Negi, A. Garg, and R. Lal, "Intrusion detection and prevention
using honeypot network for cloud security," in 2020 10th International
Conference on Cloud Computing, Data Science & Engineering
(Confluence), 2020, pp. 129-132.
[39] K. Lu, Q. Han, G. Zhu, and B. Huang, "Research on the whole process
security system framework of network collaborative manufacture," in
2020 Chinese Control And Decision Conference (CCDC), 2020, pp.
5530-5534.
[40] K. A. Torkura, M. I. Sukmana, F. Cheng, and C. Meinel, "Cloudstrike:
Chaos engineering for security and resiliency in cloud infrastructure,"
IEEE Access, vol. 8, pp. 123044-123060, 2020.
[41] O. Ali, A. Shrestha, A. Chatfield, and P. Murray, "Assessing information
security risks in the cloud: A case study of Australian local government
authorities," Government Information Quarterly, vol. 37, p. 101419,
2020.
[42] C. Yang, L. Tan, N. Shi, B. Xu, Y. Cao, and K. Yu, "AuthPrivacyChain:
A blockchain-based access control framework with privacy protection in
cloud," IEEE Access, vol. 8, pp. 70604-70615, 2020.
[43] T. Alam, "Cloud Computing and its role in the Information
Technology," IAIC Transactions on Sustainable Digital Innovation
(ITSDI), vol. 1, pp. 108-115, 2020.
[44] S. M. Altowaijri, "An architecture to improve the security of cloud
computing in the healthcare sector," in Smart Infrastructure and
Applications, ed: Springer, 2020, pp. 249-266.
[45] K. A. Torkura, M. I. Sukmana, F. Cheng, and C. Meinel, "Continuous
auditing and threat detection in multi-cloud infrastructure," Computers
& Security, vol. 102, p. 102124, 2021.

111