Multi-cloud Mayhem

If you're having trouble getting your head around a single cloud deployment, please feel free to skip this article.  Now if you're someone who thinks that most IT resource will eventually live in a private or public cloud-based domain, you're not alone, and you may start looking into how best to work in a multi-cloud environment.

Paul Krill's article "Cerf urges standards for cloud computing" highlights cloud interoperability and portability issues discussed by Vint Cerf, co-designer of the TCP/IP protocol that forms the back bone of modern communication.  It behooves us to consider Cerf's viewpoint on what's required for successful cloud computing.  Some of the points that he makes are as follows:

Authentication/Security
According to Cerf, "Strong authentication will be a critical element in the securing of clouds."  We know that authentication is a core for establishing trust between transacting parties.  This requirement is now further heightened because of the expansion of corporate boundaries out to cloud-based services.  Authenticating to cloud services and accessing only authorized services in a multi-tenant environment will continue to be the most important aspect of establishing trusted connections between enterprises and IaaS, PaaS and SaaS providers.

Now imagine having a set of enterprise applications and systems that have to interact with a set of cloud providers, in a many-to-many topology.  You may, for example, call a SaaS for a commodity business service to create your composite service, while archiving information to Amazon S3 and running intensive business intelligence queries on Amazon EC2.  In this scenario, cloud services, even from the same vendor, may expect different identity tokens, some standards-based, others proprietary.  The problem of multi-cloud computing decomposes to fundamental issues including identity token management, security, and central management and control of such functions.

Here are a couple of resources that are helpful in highlighting identity related issues surrounding cloud computing:

• Federated SOA:  A pre-requisite for enterprise cloud computing.
• Domain 12:  Identity and Access Management, Security Guidance for Critical Areas of Focus in Cloud Computing v 2.1, Cloud Security Alliance

Portability
The second item that Cerf points out is regarding moving your data (business information, virtual images, algorithms, database instances, etc.) between different cloud providers. According to Cerf, "At some point, it makes sense for somebody to say, 'I want to move my data from cloud A to cloud B,' " but the different clouds do not know each other."

Cloud interoperability has a number of dimensions including communication interoperability (HTTP, SOAP, REST), cloud management and interaction API interoperability (createImage, terminateImage, etc.), and image portability.

The good news is that at least most cloud providers have a REST-XML/JSON or a SOAP-based API.  The API calls signatures are all different, but one can readily consume such APIs for image provisioning/de-provisioning and other IaaS functions.  There has been a recent effort to standardize cloud API operations including Open Cloud Computing Interface Working Group.

In addition to such API standardization, moving entire images between various cloud providers would also provide the portability necessary for establishing reliability across multi-cloud environments.  Instead of maintaining multiple images for say Amazon EC2 and Rackspace, having a single image that runs across IaaS providers would reduce management burden on enterprises.  The DMTF Open Virtualization Format provides a common container formats for greater multi-cloud portability.  Here are a couple of resources that one should review while looking at best practices for cloud interoperability and portability:

• Section 3.6, Changing Cloud Vendors, Cloud Computing Use Cases
• OVF and Cloud Portability

Cloud gateways have become a core component of managing not just the traffic between enterprises and their cloud providers, but also for managing and protecting security and identity tokens required for enterprise-to-cloud interaction. To avoid Multi-cloud Mayhem, the industry now needs to show greater commitment towards standardization for inter-cloud interoperability, portability and security. Unless our desire is to relive the stone-age era of pre-TCP/IP communication, ask Vint Cerf, he'll give you a few reason on why not to.

The Guillotine Effect of Cloud Computing

David Linthicum of InfoWorld wrote an intriguing article titled "Cloud Computing will kill these three technologies" in which he writes obituaries for:  i) design-time governance ii) older and smaller clouds iii) and Tier 2 enterprise software providers.  Of these predictions, the one that resonates most is design-time governance.

Design time Service Governance:  I am particularly happy to see this category listed on the chopping block (from David's perspective) and here is why.  Over the last decade or so, we have seen significant run-time SOA Governance deployments at the edge of an enterprise used for interacting with SaaS platforms using SOAP, XML or REST.  We have seen customers choose not use glorified UDDI registries. Instead, they have focused on using the SOA/Cloud/XML Governance Gateway as the system of truth for services produced and consumed (import and export WSDLs).  The Gateways serve as the catalog of services aggregated for centralize control at design-time.  Based on consumer credentials, access to only authorized services is provided to the consumer.

David is spot on in stating: "Many of the existing runtime SOA governance players support enough design and implementation capabilities that separate design-time tools are not required."  The burden of design-time SOA Governance has entirely been taken over by XML Gateways including service generation and consumption, service cataloguing, service virtualization, and most importantly, service monitoring.  Gateways are, by nature, non-intrusive and agent-less, whereas classic service monitoring companies are historically rooted in agent-based monitoring with weak gateway products, if any.  Such agent-based solutions are unlikely to work in highly distrubuted environments typical of cloud computing.  Try asking your SaaS partner to put an agent in their container -- good luck!

The writing is on the wall, so I quote David here directly:

Cloud computing is simply accelerating the focus on the requirement for runtime SOA governance, and sooner or later design time will fall by the wayside.

For addtional technologies that face a not-so-fun-filled future, see David's ominous article: "Cloud Computing will kill these three technologies."

MIT Techology Review covers Cloud Security

MIT Technogy review recently published a great article titled: Security in the Ether addressing security, privacy and reliability issues resulting from cloud computing.  Some of the interesting points in this article include:

1. The cloud security threat is across two related dimensions:
• cloud resident data may be lost due to equipment/software failure or stolen by a hacker because of the shared resouce nature of cloud computing.
• cloud data may be mishandled by the cloud provider because of technology gaps, but more importantly, such information can be extracted through a court issued subpoena.  Whether the data resident in the cloud versus on-premise makes it more or less likely to a subpoena being exercised is yet to be seen.  Bit and bytes lost accidentally or intentionally have a strange way of persisting and being recovered eventually.  22 Million emails "lost" during Bush's era were "suprisingly" recovered by computer technicians recently.
2. Cloud outages are directly related to security vulnerabilities.  A single corrupted bit caused Amazon S3 outage is 2008.
3. Cloud vendors can provide rapid remidiation that is transparent to the cloud consumers.  If there is a security. reliability, or scalaibility flaw, cloud vendors can patch their platforms quickly and address the problem.  This is their core business, so theoritically, they should be on their toes more so that an enterprise IT team with only 5%-10% of the corporate budget tied to IT.  The continual battle/cost justification faced by CIOs for more IT budget to enhance infrastructure only delays the remediation process againsts new and emerging issues.  The speed of remediation by cloud vendor should be more rapid than enterprise IT Data centers owing to the scale of impact and the number of companies calling in for quick remediation.  Fault tolerance by using multiple cloud providers will become crucial for enterprises seeking to reduce the risk even further in case of failure cause by a security exposure is a particular cloud.  The ecomomics of using multiple cloud providers will be far more compelling that sticking with a single provider or an on-premise deployment for storage- and cpu- intensive applications.
4. "The very term cloud computing should be replace by swamp computing." Ron Rivest, MIT Computer Scientist, co-inventor, RSA public key cryptography algorithm.
5. Granular encryption will become a significant factor in protecting data in the cloud.  This has been the cornerstone of XML and SOAP Security where any element or fragment can be encrypted with any selected key.  Using XML/Cloud Gateways such as Forum Sentry, any information that is to reside on a public cloud can be granularly encrypted using a hierarchy of keys.

Security in the Ether, by David Talbot

Cloud Reliability will be bigger than Cloud Security for 2010-11

We have all the tools for securing information in a Cloud: establishing trust through identity, data privacy through encryption, and content integrity through signatures.  We are overly focused on Cloud Security  issues and less on reliability.  This is all about to change.  Following the outages experience by Amazon EC2 in 2009, another premiere cloud provide, Rackspace, suffered an outage on December 18.  Using technology such as Forum Systems XML/ Cloud gateways is essential for establishing multi-cloud reliability and fault tolerance.

Rackspace Cloud Computing Outage
— According to an Apparent Networks Performance Advisory issued today, cloud services provider Rackspace experienced a connectivity loss at its Dallas-Fort Worth data center on Dec. 18, 2009. Access to business services at that data center was not possible during the outage, which began at approximately 4:37 p.m. eastern time and lasted about 35 minutes. The Apparent Networks Performance Advisory is based on intelligence provided by the company’s Cloud Performance Center, a free service that utilizes Apparent Network’s PathView Cloud service to test the performance of cloud service providers such as Amazon, Google and GoGrid.

Why is a Cloud Gateway Required?

Security has been on the forefront of discussion in the technology community as being the primary concern gating enterprise adoption of cloud computing.  Although this is a valid concern, most cloud providers, owing to the security demands of maintaining a multi-tenant infrastructure, provide strong security provisions, perhaps better than an enterprise's own data center.  Legal, compliance and process issues become more significant rather than technical security concerns.

Moving into 2010, reliability will be a higher concern for enterprises.  Recent outages in Amazon EC2 point towards corporations developing failover strategies across clouds.  For example, Amazon EC2 has had a couple of outages in 2009.  The First Outage reported in June 2009, where EC2 services were disrupted for four hours, was as a result of a lightening storm.  The Second Outage, reported in December 2009, was "only" for 44 minutes.

For customer concerned about business impact of cloud downtime, but sold on the financial and business advantages of using Cloud computing, redundancy and fault tolerance across cloud providers should be considered.  This is where Cloud Gateways come in -- by using a cloud gateway, such as Forum Sentry, deployed on-premise, enterprises can enforce load-balancing and failover strategies across multiple cloud providers.