A survey on security issues and solutions at different layers of Cloud computing <s> Application level security issues <s> The Cloud Computing concept offers dynamically scalable resources provisioned as a service over the Internet. Economic benefits are the main driver for the Cloud, since it promises the reduction of capital expenditure (CapEx) and operational expenditure (OpEx). In order for this to become reality, however, there are still some challenges to be solved. Amongst these are security and trust issues, since the user's data has to be released to the Cloud and thus leaves the protection-sphere of the data owner. Most of the discussions on this topics are mainly driven by arguments related to organizational means. This paper focuses on technical security issues arising from the usage of Cloud services and especially by the underlying technologies used to build these cross-domain Internet-connected collaborations. <s> BIB001 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Application level security issues <s> With the development of cloud computing, the mutual understandability among distributed Access Control Policies (ACPs) has become an important issue in the security field of cloud computing. Semantic Web technology provides the solution to semantic interoperability of heterogeneous applications. In this paper, we analysis existing access control methods and present a new Semantic Access Control Policy Language (SACPL) for describing ACPs in cloud computing environment. Access Control Oriented Ontology System (ACOOS) is designed as the semantic basis of SACPL. Ontology-based SACPL language can effectively solve the interoperability issue of distributed ACPs. This study enriches the research that the semantic web technology is applied in the field of security, and provides a new way of thinking of access control in cloud computing. <s> BIB002 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Application level security issues <s> XML Encryption was standardized by W3C in 2002, and is implemented in XML frameworks of major commercial and open-source organizations like Apache, redhat, IBM, and Microsoft. It is employed in a large number of major web-based applications, ranging from business communications, e-commerce, and financial services over healthcare applications to governmental and military infrastructures. In this work we describe a practical attack on XML Encryption, which allows to decrypt a ciphertext by sending related ciphertexts to a Web Service and evaluating the server response. We show that an adversary can decrypt a ciphertext by performing only 14 requests per plaintext byte on average. This poses a serious and truly practical security threat on all currently used implementations of XML Encryption. In a sense the attack can be seen as a generalization of padding oracle attacks (Vaudenay, Eurocrypt 2002). It exploits a subtle correlation between the block cipher mode of operation, the character encoding of encrypted text, and the response behaviour of a Web Service if an XML message cannot be parsed correctly. <s> BIB003 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Application level security issues <s> This paper describes the CloudProtect middleware that empowers users to encrypt sensitive data stored within various cloud applications. However, most web applications require data in plaintext for implementing the various functionalities and in general, do not support encrypted data management. Therefore, CloudProtect strives to carry out the data transformations (encryption/decryption) in a manner that is transparent to the application, i.e., preserves all functionalities of the application, including those that require data to be in plaintext. Additionally, CloudProtect allows users flexibility in trading off performance for security in order to let them optimally balance their privacy needs and usage-experience. <s> BIB004
Application level security refers to the usage of software and hardware resources for providing security to applications such that the attackers are not able to get control over applications and make desirable changes to their format. Since Web applications and SaaS are tightly coupled with providing Cloud services, the security and availability of general cloud services are dependent upon the security of Web browsers, APIs and vulnerability free applications. A Web browser is the platform independent client program that is mostly used to access the Cloud services (SaaS), web applications, web pages, or web 2.0. It uses SSL/TLS protocols for secure transmission and authentication of data. Therefore, attacks on browser based Cloud authentication directly affect the security of Cloud applications. Any attacker can get access to other user's XML tokens (authentication related credentials in the browser) and accesses the services of the victim. One of the solutions viz; XML signature and XML encryption can be used to enhance browser security BIB001 . However, the XML Signature Wrapping attack enables the attacker to change the content of the signed part without invalidating the signature, for example, using XML signature wrapping attack (due to exploitation of cross-site XSS scripting vulnerabilities), it is possible to hijack some live Amazon Web Services (AWS) accounts (that uses SOAP and REST interfaces) BIB003 . Therefore, XML signature or XML Encryption fails to provide browser level security. To address wrapping attacks, the authors in  recommended the use of a redundant bit (STAMP bit) with the SOAP header. If any adversary infers the message during transmission, the STAMP will be changed. On the server side, first STAMP bit is checked and if modified STAMP bit is found, then in the browser, new signature value is generated that is sent back to the server to modify the authenticity checking. Using this approach, an adversary cannot interrupt the customer request with a duplication of the SOAP message because the previous signature value is already altered. For this purpose, only a random signature value generator is needed in the browser end and only the extra message overhead of one bit is required for an authenticity check. However, such approaches are not applied to current Cloud systems and it is still an open challenge to provide a sufficient browser level security. Hu et al. BIB002 presented an ontology-based Semantic Access Control Policy Language (SACPL) for describing access control policies (ACPs) in Cloud computing environment. In this approach, syntax elements of XACML, such as subject, object, action and attribute variables, are annotated with semantic information using the Access Control Oriented Ontology System (ACOOS) and some syntax elements are added such as priority and confidentiality. This approach can solve the problem of semantic inter-operability and mutual understanding on the distributed access control policies of resources when cross organizations are involved. However, it is mentioned that this approach does not provide automatic conflict resolution for rules or policies and semantics-based access control mechanism for variable granularity BIB002 . Diallo et al. BIB004 proposed an approach that extends middleware by incorporating CloudProtect, CloudProtect stores user's application data in encrypted form. It protects the privacy of user's application data. Some applications require access to the data in plain text format. Therefore, it is cumbersome to encrypt and decrypt data. CloudProtect maintains the policies defining which data should be in plain text form and which data should be encrypted on the server. The policies are defined based the user behavior. It offers key management and secure sharing of data. Other key security issues at the application level are service availability and integrity of workload state.