![](bg2.png)
response time, throughput or latency. In previous
works such as (Nathuji et al., 2010), an approach as-
suming that the cloud can be modeled as a Multi-
Input-Multi-Output (MIMO) system is implemented
to regulate performance in the cloud. From this per-
spective the cloud is seen as a black box with in-
puts and outputs. The outputs are the different per-
formance measures of interest, while the inputs are
values related to the amount of available virtual re-
sources in the cloud, e.g., CPU utilization and avail-
able memory in a Virtual Machine (VM), as well as
the amount of available VMs in a cluster. The au-
thors assume that the hypervisor allows for a fine-
grained control of the parameters of the Virtual Re-
sources in place. However, based on (Vliet and Pa-
ganelli, 2011; Lim et al., 2009), in a public cloud ser-
vice, specifically in Infrastructure-as-a-Service (IaaS)
such as EC2 from Amazon, the variation of the inter-
nal parameters of the VMs and therefore the response
of the system are coarse-grained. This imposes sev-
eral difficulties to apply methodologies such as Linear
Quadratic Regulation as in the CPU problem in (Yao
et al., 2010) which is effective to regulate MIMO sys-
tems.
In this work, we follow the trend proposed by
(Lim et al., 2009) called proportional threshold-
ing which is suitable for Single-Input-Single-Output
(SISO) systems and overcomes the coarse-granularity
of this problem. The main goal is to confine the de-
sired performance to an interval of values rather than
regulate it to a specific reference value. However,
in order to improve the response of the controller,
we have added on-line model identification (Kulhav
´
y,
1987; Haykin, 2002; Hellerstein et al., 2004), which
allows the update of the model parameters to over-
come the typical workload variations of the cloud.
We implement a policy based usage management
system in multiple cloud environments. This system
treats resources with specific attributes that may be
provisioned according to usage policies. We regulate
the performance of running virtual machines to meet
the service level agreements applying control theory.
This approach is conceptually similar to multi-level
security system implemented in a cloud computing
environment. We will consider an operational en-
vironment that includes a mix of public and private
cloud computing resources, each of which can be cat-
egorized as having a certain level of trust.
The rest of the paper is as follows: Section 2, de-
scribes how usage management goes beyond access
control. Section 3 explains the Usage Management
system for Cloud computing, as well as the system
configuration and the technologies used to build the
system. Section 4 deals with performance control and
finally Section 5 provides concluding remarks.
2 USAGE MANAGEMENT
A conceptual UM system is described in Figure 1
for a cloud computing environment. The UM sys-
tem determines if a user can be granted access to a
resource, such as a data file. In a cloud computing
environment, once a user is granted access to a re-
source, there is a need to control not only how the
resource can be used, but also where. Our primary
goal is to develop and implement a secure, robust,
and inter-operable attribute-based usage management
system for data transactions in cloud computing. This
system will merge usage management systems with
modern cloud computing technologies. Given a data
resource with an associated sensitivity characteristic,
one part of the proposed cloud UM process will be to
determine on which type of cloud computing system
the iresource will be made available.
2.1 Beyond Access Control
Usage management (UM) is defined as the manage-
ment of the usage of resources (and data) across and
within computing environments.(Jamkhedkar et al.,
2010) Usage management incorporates characteris-
tics of traditional access control and digital rights
management. In order to be effective, it must be flex-
ible enough to be scalable and interoperable enough
to provide services across different computational en-
vironments. In an implementation of UM, the first
action provided by the system is access control. A
user logs into a system with credentials and with con-
text that is provided by the user, and/or determined
automatically. The next role of the UM is to ensure
that data is used in an environment that complies with
security policies that are either specified in an associ-
ated license, or are applicable to a security category
for unclassified data.
For instance, a user might specify at which sen-
sitivity level, or classification level he or she wishes
to operate and UM checks the contextual information
before providing access to any resources. Based on
the examination, UM commands a cloud computing
system to instantiate a VM and load an image that
contains the necessary security mechanisms. Then
it transfers the actual data to the VM. In this paper,
we use VM images as the controlled resources, where
each image has a set of policies associated with it that
describe the circumstances under which that image
can be used.
Policy-basedSecurityProvisioningandPerformanceControlintheCloud
503