Page 858 - Cloud computing: From paradigm to operation

5 Intercloud and interoperability

The inter-cloud computing functional architecture [ITU-T Y.3516] identifies inter-cloud specific extensions to
functional components that are part of integration, security systems, operations support systems (OSSs) and
business support systems (BSSs). For trusted inter-cloud, it defines a function called trust management. The
trust management functionalities (see clause 6.2 of [ITU-T Y.3514]) are supported by the "authorization and
security policy management" functional component within the multi-layer functions of the cloud computing
reference architecture [ITU-T Y.3502]. Inter-cloud trust management can be realized using above functional
components and functionalities. Inter-cloud trust management is also supported by functional components
for managing isolation and security mechanisms, these functional components located in the
"security systems" of the cloud computing reference architecture, as well.
This Recommendation is based on the functions defined in [ITU-T Y.3502], [ITU-T Y.3516] and [ITU-T Y.3514].
This Recommendation focuses on the trust management model and requirements in an inter-cloud
environment based on the establishment of relationships (patterns) among multiple peer CSPs, including
peering, federation and intermediary which are defined in [ITU-T Y.3511].

7 Requirements for inter-cloud trust management

This clause identifies requirements applicable to inter-cloud trust management.

7.1 Inter-cloud trust policies and credentials
It is recommended that a CSP provides specification of policies and credentials used for trust management.

It is recommended that a CSP implements a trust management system to evaluate whether the provided
credentials satisfy the specified policy.

7.2 Inter-cloud reputation scoring
It is recommended that a CSP uses a trust scheme to evaluate whether other CSPs among inter-cloud
relationships fulfil trust management requirements.
It is recommended that a CSP evaluate other CSPs among inter-cloud relationships to create and update
reputation scoring of CSPs.

7.3 Inter-cloud reputation-based trust evaluation
It is recommended that a CSP has a trust evaluation system to manage other CSPs' reputations.

It is recommended that a CSP supports query and compares reputation of other CSPs from a third- party trust
evaluation system.

7.4 SSO authentication
It is recommended that a CSP supports an SSO mechanism to enable a CSC’s access to various services offered
by different CSPs once it is successfully authenticated by inter-cloud.

7.5 Periodical verification
It is recommended that a CSP supports a periodical verification mechanism to check if a CSC still has the
privilege of accessing the CSP's service.

7.6 Control privilege for VM and data

It is recommended that a CSP avoids inspection or analysis of a CSC's data and VM instances without explicit
CSC consent.

It is recommended that a CSP supports fine-grained CSC control over protection of its cloud resources
according to a given security SLA.

850