当前云计算面临的主要问题(谈谈对云计算发展的看法和建议)

A big problem facing cloud computing is energy saving.
Cloud computing is a type of distributed computing, which refers to decomposing huge data computing processing programs into countless small programs through the network "cloud", and then processing and analyzing these through a system composed of multiple servers. The applet gets the results and returns them to the user. In the early days of cloud computing, to put it simply, it was simple distributed computing that solved task distribution and merged calculation results.
Cloud computing is another new innovation in the information age after the Internet and computers. Cloud computing is a big leap in the information age. The future era may be the era of cloud computing. Although the current definition of cloud computing is Many, but generally speaking, although cloud computing has many meanings, in summary, the basic meaning of cloud computing is the same, that is, cloud computing has strong scalability and demand, and can provide users with a brand new Experience, the core of cloud computing is to coordinate many computer resources together.

The report released by the Cloud Computing Security Alliance (CSA) summarizes 9 threats to cloud computing security. Among them, three types of threats, data leakage, data loss and data hijacking, rank high.
Security Threat 1: Data Breach
To show the extent of the harm to enterprises caused by data breaches, CSA mentioned in the report a research article published in November 2012, which described This article describes how hackers can use Side-Channel time information to obtain the private keys used by other virtual machines on the same server by invading a virtual machine. However, in fact, malicious hackers may not necessarily need to take such painstaking efforts to ensure that such an attack is successful. If the multi-tenant cloud service database is improperly designed, even if there is only one vulnerability in a user's application, an attacker can obtain this user's data, and also obtain the data of other users.
Security Threat 2: Data Loss
CSA believes that the second largest threat to the cloud computing environment is data loss. Users may watch those valuable data disappear without a trace, but there is nothing they can do about it. A malicious hacker will delete the target's data. A careless service provider or a disaster (such as a fire, flood, or earthquake) can also result in user data loss. What makes the situation even more serious is that if the user loses the encryption key, the act of encrypting the data will cause trouble for the user.
Security Threat 3: Data Hijacking
The third largest cloud computing security risk is the hijacking of account or service traffic. CSA believes that cloud computing adds a new threat in this regard. If a hacker obtains a company's login information, it is possible for them to eavesdrop on related activities and transactions, manipulate data, return false information, and direct corporate customers to illegal websites. The report states: "Your account or service instance may become a new base for attackers. They will then use your good reputation to launch external attacks." CSA mentioned in the report that Amazon encountered cross-site scripting (XSS) in 2010. )attack.
Security Threat 4: Insecure Interfaces
The fourth largest security threat is insecure interfaces (APIs). IT administrators will use APIs to configure, manage, coordinate and monitor cloud services. APIs are extremely important to the security and availability of cloud services in general. Enterprises and third parties therefore often develop on top of these interfaces and provide additional services. "This adds complexity to interface management," CSA said in the report. "This approach also increases risk by requiring companies to hand over login details to third parties in order to communicate with each other."

Security Threat 5: Denial of Service Attack
Distributed Denial of Service (DDoS) is listed as the fifth largest security threat facing cloud computing. DDoS has been a major threat to the Internet for many years. In the era of cloud computing, many enterprises will require one or more services to maintain 24/7 availability. In this case, this threat becomes particularly serious. Service outages caused by DDoS can cause service providers to lose customers, and can also cause heavy losses to users who pay for cloud services based on usage time and disk space.
Security Threat 6: “Temporary Workers” with malicious intentions
The sixth major threat is malicious insiders. These people may be current or former employees, contractors, or business Partner. They gain access to networks, systems or data with malicious intent. In scenarios where cloud services are poorly designed, malicious insiders may cause greater damage. From Infrastructure as a Service (IaaS), Platform as a Service (PaaS) to Software as a Service (SaaS), malicious insiders have higher levels of access than outsiders, allowing them to access important systems and ultimately data. .
Security Threat 7: Abuse of Cloud Services
The seventh major security threat is the abuse of cloud services. For example, bad guys use cloud services to crack encryption keys that are difficult for ordinary computers to crack. Another example is malicious hackers using cloud servers to launch distributed denial-of-service attacks, spread malware, or share pirated software.
Security Threat 8: Acting Hastily
The eighth major cloud computing security threat is insufficient investigation, that is to say, the enterprise has not fully understood the system environment and related risks of the cloud computing service provider. Just use cloud services rashly. Therefore, enterprises entering the cloud need to sign contracts with service providers to clarify issues of responsibility and transparency. In addition, if the company's development team is not familiar with cloud technology and puts applications in the cloud hastily, operational and architectural problems may arise.
Security Threat 9: Shared Isolation Issues
Finally, CSA lists security vulnerabilities in shared technologies as the ninth largest security threat faced by cloud computing. Cloud service providers often share infrastructure, platforms, and applications and deliver services in a flexible and scalable manner.

The development of cloud computing faces four problems:
1. Cloud service capabilities need to be improved urgently and supporting resources are scarce. There is still a big gap between domestic cloud computing service capabilities and developed countries such as the United States. The scale of the public cloud computing service industry is relatively small, the business is relatively single, and the supporting environment construction is lagging behind. As Google, Amazon and other companies accelerate their deployment around the world and around China, the risk of cloud computing services being concentrated overseas will further increase.
2. The information security laws, regulations and supervision system are not sound enough. In terms of data and privacy protection, security management, etc. related to cloud computing security, China's cloud computing industry ecology has major deficiencies. At the same time, due to security concerns and other concerns, the usage rate of cloud computing services in China is also lower than that in developed countries such as the United States.
3. The deployment structure of the cloud data center is not reasonable enough and the resource utilization rate is low. Statistics show that in terms of scale structure, the proportion of large-scale data centers in China is relatively low. The development scale of large-scale data centers is even less than the total number of a certain foreign Internet company. Intensive and large-scale construction has not yet been achieved.
4. Cloud talent gap and lack of mature business model. According to data, China's cloud computing talent gap reaches one million levels, and cloud computing-related positions grew by more than 150% in 2012. The cloud industry ecology requires the integrated development of IT and CT industries, as well as the cultivation and construction of compound talents. Therefore, subject integration and the cultivation of compound talents are particularly important.

The existing problems in cloud computing applications mainly include the following points:
1. Virtualization security issues: If If the physical host is damaged, the virtual server it manages may be compromised due to communication with the physical host. If the physical host and the virtual machine do not communicate, the virtual machine may escape. If the virtual network on the physical host is compromised, the virtual machine will also be compromised due to the communication between the physical host and the virtual machine, and the scenario where one virtual machine monitors another virtual machine.
2. Security issues in data sets: User data storage, processing, network transmission, etc. are all related to cloud computing systems, including how to effectively store data to avoid data loss or damage, and how to apply multi-tenant applications Perform data isolation, how to avoid data services being blocked, etc.
3. Cloud platform availability issues: Users’ data and business applications are in a problem system where the cloud platform is attacked, and its business processes will depend on cloud platform service continuity, SLA and IT processes, and security policies. , event processing and analysis, etc. pose challenges. In addition, when a system failure occurs, how to ensure the rapid recovery of user data has also become an important issue.
4. The problem of attacks on cloud platforms: Due to the high concentration of users and information resources, cloud computing platforms are easy to become targets of hacker attacks. The consequences and destructiveness caused by this denial of service will be obvious. Exceeding the traditional enterprise network application environment.
5. Legal risks: Cloud computing has weak application areas and high information mobility. Information services or user data may be distributed in different regions or even different countries. There are legal differences and differences in government information security supervision and other aspects. Disputes; at the same time, the judicial evidence collection problems that may be caused by the blurring of physical boundaries between users caused by technologies such as virtualization cannot be ignored.