Cloud Security - SAP Labs

Yuecel Karabulut, with the awesome title of Chief Security Advisor and Head of Security Strategy, Central Technology Strategy, Office of the CTO at SAP Labs in Palo Alto, believes rigorous metrics and innovative uses of encryption are key to cloud security.

In the area of metrics, Karabulut, a former adjunct professor at Carnegie Mellon University (CMU), advocated that software vendors supplement other security measures with a formal approach to the measurement of application attack surfaces. Reducing attack surfaces is even more important in cloud computing because of the rapidly evolving nature of the technology. Cloud security architectures, Karabulut argued, must be based on the assumption of constant change: “As new threats emerge, code considered secure today may not be secure tomorrow.”

Karabulut explained a method for measuring attack surfaces that he developed with other researchers at CMU. The method involves summing the damage potential-effort ratios (DER) of relevant resources. The relevant resources of an application include its channels, such as TCP ports; methods, such as API calls; and data, whether persistent, in memory, or in transit. The DER of a resource is the ratio of potential damage to the effort required to breach the resource.

Karabulut demonstrated a tool for calculating attack surfaces that he and colleagues at SAP developed as an extension to Eclipse, a popular open-source integrated development environment. The tool discovers application resources and combines that data with DER numbers to generate attack surface metrics for software components. While the discovery of resources is fully automated, the tool requires context specific configuration based on experience, judgment, and a threat modeling process. Karabulut believes the success of the tool, now in pilot at SAP, depends mostly on usability and the appropriate definition of usage scenarios.

Also important to cloud security, Karabulut argued, is the application of encryption to reduce the trust required for customers to adopt cloud computing. Karabulut pointed out that cloud vendors are now telling customers to trust them, forcing customers to either make that leap of faith or forego cloud computing. Arguing that encryption can overcome this impasse, he presented a scalable approach for encrypting data in the cloud. Combining attribute-based encryption (ABE) and symmetric cryptography, the model calls for a Message Warehousing Service (MWS) that securely makes content available to users whose exact identities are unknown to the content creator but who meet the requirements set forth by attributes attached to the content.

In this model, the cloud vendor has access only to metadata, not the encrypted content. The approach is scalable because it does not require specialized software on user devices, reduces loads on processors, and frees users from knowing the identities, and thus public keys, of those who require access, which is important in the dynamic world of cloud computing. Ultimately, this method gives users greater control over who is allowed to see their data. While the MWS approach is still under development, Karabulut said, it a good example of how encryption can solve the problem of cloud security by enabling the collaborative and message exchange scenarios necessary for the delivery of software as a service.

WEF Global Info Tech Report 2008-09 -"Network Readiness"

The World Economic Forum has released it's Global Information Technology Report 2008-2009, the eighth study conducted by the WEF in conjunction with the INSEAD business school and sponsored by Cisco Systems. The report gauges how 134 economies around the world are prepared to use ICT effectively.

Part 1 contains essays examining different topics related to mobility and ICT. These include mobile telephony and its imact on economic grouth and networked readiness; Internet ubiquity, mobile reality mining, and mobility of human talent and R&D flow.

It also contains an extensive global survey of "network readiness", which provides a useful snapshot of 134 economies' ICT strategies and achievements.

Skype and Enterprise Markets

Global Insight from PriceWaterhouseCoopers (PwC): March 2009

eBay's access-independent VoIP business, Skype, has announced the latest move to penetrate the enterprise voice market with the beta version of 'Skype for Session Initiation Protocol (SIP) for Business Users'. The service allows users to make low-cost calls over the global Skype VoIP system and receive calls directly from any of the 405 million Skype users without connecting to the PSTN and therefore at no cost to the customer. Enterprises can also buy numbers in over 20 countries to receive calls from local users at lower costs. The Skype application integrates with existing PBX hardware and facilitates call-handling functionality, such as routing and conferencing, statistics, phone menus and voicemail systems.

Significance: Skype is working to convert its massive user base into paying customers with some success, increasing revenues by 44% over 2008 to US$526 million, although this is notably barely US$1.30 per user. The number of users has in fact grown more quickly, up 47% year-on-year (y/y) to 405.3 million. The enterprise market is a key source of valuable customers who are willing to pay for communications services and make high use of international calls while being price-sensitive. There has been some reticence from enterprises with regards to VoIP, largely over an historical perception of reliability issues as it relies on a non-managed internet connection and peer-to-peer capabilities. However, this move will help Skype to tap into the enterprise marketplace, leveraging legacy equipment and ensuring the maintenance of legacy system capabilities.

An Update to 3D TV

From Physics.org:

Researchers at the University of Tokyo and Hitachi recently demonstrated TransCAIP, a three-dimensional (3D) TV system that captures a live scene in real time and reproduces it on an autostereoscopic display. In addition to providing 3D images, TransCAIP offers interactive control, enabling users to adjust viewing parameters such as cropping a scene and reproducing an appropriate amount of depth.

The system captures a live scene using 64 video cameras connected via Ethernet cables to a single PC, which converts input from all the video cameras into images for the display. Each camera has a built-in HTTP server, which sends motion JPEG sequences to the PC. "The greatest advantage of our system is to provide interactive control of the viewing parameters," says University of Tokyo Ph.D. student Yuichi Taguchi. "The interactive control is essential for reproducing a dynamic 3D scene with desirable conditions, which depend on the contents of the scene, the viewer's preference, and the display specifications."

The PC converts the 64 images into an integral photography image made from 60 views, which correspond to the viewing directions of the display. The process, called field conversion, is implemented in real time and requires only a few hundred milliseconds per frame. Like other autostereoscopic displays, TransCAIP does not require viewers to wear special glasses. Instead, the display reproduces various viewpoint images, which allows viewers to see a different image in each eye.

Google and Semantic Search

Google has added semantic search to its Web search engine, which will enable it to identify associations and concepts related to a query, thus improving the list of related search terms Google displays next to the results. "For example, if you search for 'principles of physics,' the algorithms understand that 'angular momentum,' 'special relativity,' 'big bang,' and 'quantum mechanic' are related terms that could help you find what you need," according to Google's Ori Allon and Ken Wilder.

Enterprise-focused Web Communication : Cisco and Jabber Inc.

Cisco is adding another company to its enterprise-focused Web communication products. Jabber Inc. (the company ) is in the process of being acquired.

Jabber (the standard) originally presented in May 2006 is a widely-accepted set of Linux-based, open source streaming XML protocols and technologies that enable any two entities on the Internet to exchange messages, presence, and other structured information in close to real time. Jingle (originally Google Talk’s effort to integrate SIP-based VoIP with the XMPP specification) is a new set of extensions to the Jabber protocols for use in VoIP, video, and other peer-to-peer multimedia sessions.

Jabber Inc. provides instant messaging software that supports different devices and applications, and allows users on different networks (Google Talk, Yahoo Messenger) to connect and communicate with each other. Their presence and messaging technologies could be integrated into Cisco's WebEx Connect and Unified Communications platforms.

Google Android Developer Challenge - Winning Mobile Apps

The Google Android Developer Challenge (round 1 of 2) to encourage the developer community to build outstanding mobile apps for the Android platform has concluded and winning apps can be previewed at http://code.google.com/android/adc_gallery/ . A brief rundown on the some of the ones that appeal to me:


Using the always-on and location awareness features and Google Maps integration, Cab4Me enables calling a taxi to any location worldwide with a single click. You do not need to know the number of the local cab company. You do not need to enter or even know the address you want to be picked up at. You do not need to place a call. I want it to work in Cambridge and Berlin, especially on cold, rainy nights when there are public transit strikes.


PicSay is an image editor for your mobile phone camera. Photos can be enhanced with color correction, highlighting, or distortion effects, you can add word balloons and titles to them and then share them via e-mail, your blog, or photo sharing sites. PicSay uses reverse geocoding via Android's location API to provide address information that can be used as text for a picture--instant (and customized) birthday cards, spontaneous dinner invitations, remarkably silly dog moments captured and documented!


No more uninformed, impulse buying with GoCart to help me gather as much information as I need to make smart, informed purchase in realtime in realplace with a bridge to online--"users can scan the barcode of a product in a store using their phone’s built-in camera. Once scanned, it will search for all the best prices on the Internet and through the inventories of nearby, local stores. After scanning a product, users can also read online reviews or create price alerts to help monitor price drops. Ah! No more walking through Frys, encountering the wireless keyboard section, memory being jogged that you need a new one (can't get my speech recognition software to run on Vista), thinking this looks nice and the price is right and then purchasing it at the counter along with the blank DVDs that you originally stopped it to buy, then wondering on the way home what the Amazon reviewers have to say about it or if you could have gotten it cheaper at Best Buy - which is also on your way home. And, as the developer suggests, using the wish list function to build a list for brainstorming gift ideas for the holiday season.