Is public cloud computing secure enough for IC design work? Two different perspectives emerged at the IEEE Electronic Design Processes (EDP) workshop April 7-8, where an Intel manager detailed security concerns his company has about public clouds, and the CEO of EDA startup Physware explained why his company is doing all its development in the cloud.
The attractiveness of cloud computing is undeniable. It gives users access to whatever compute power they need when they need it, without having to buy their own servers or set up a data center. For those who already have a compute infrastructure, the cloud can absorb peak demand ("cloud bursting") or provide Software as a Service (SaaS), two concepts that were discussed at the April 7 EDA Consortium panel on cloud computing.
But the big question in the EDA community is whether design data is sufficiently secure in a public cloud. Intel isn't ready to say "yes," according to Naresh Sehgal (right), software architecture manager at Intel and chair of this year's EDP workshop.
Waiting for a Green Light
Why would a company like Intel, which has a huge compute infrastructure, be interested in cloud computing? "We are running millions of jobs," Sehgal explained. "We found that the average run time of a job was one hour and the average wait was three hours. So you wait for three hours at a red light and then run for one hour. That's not good."
So the IT folks at Intel wanted to see if they could take some of their jobs, such as back-end layout, and use the Amazon public cloud to offload some of the processing that was clogging the Intel data center. But there were two problems. One was that all of Intel's CAD licenses were for Intel machines only, and another was security.
Of particular concern, Sehgal said, was multi-tenancy - where one computer is shared between multiple users. "A server could be running a job from Intel, and the next job could be from... who knows," he said. "Who has physical access to a machine? Could somebody go over the USB and make a copy [of the data]?"
Another question is whether the communications channel is secure, given that large amounts of data are being transferred over open channels. A side issue is long transfer times - not a security issue, perhaps, but a cost issue.
A third challenge is data security within the cloud, with protection from fake log-ins or unauthorized access. And, Sehgal asked, what happens to the data when the job is done? "Does Amazon keep a copy? Is a footprint still there? I don't know," he said. Solutions are available for some of these security concerns, but they might impact performance by 30 to 40 percent, he observed.
Security Worse than VPN
Some might think that cloud computing isn't significantly more risky than accessing company data from outside the firewall using VPN. Not so, Sehgal said. With VPN access, there is at least a "central island of security" in which all of the company servers are behind a firewall and someone is monitoring traffic coming in and out. "In the cloud, things are spread out all over the place. I could be going to a lot of third-party data centers," he said.
Sehgal expressed concerns about the virtual machine software layer. "I can be my own virtual machine, I can override my VM boundary, and I can corrupt somebody else's virtual machine," he said. "Today in the CPU cache we don't know where the VM boundaries are. Each VM brings its own data into the cache and then out. If one VM starts to misbehave they can cause another VM cache to flush out."
Sehgal also said that Intel would want a "service level agreement" stating when a job will be done, but that's not available yet. "Unless we take care of the security problem, and the assurance problem on quality of service, people will not look at putting any design job in the cloud," he concluded. "Security is the dead moose in the room nobody wants to talk about."
Raul Camposano, Physware CEO, disagreed with Sehgal. He noted that many companies, such as Salesforce.com, are doing "incredibly well" in the clouds, and he said that most people who use the cloud think it's safer than their own facility.
In his own presentation, Camposano said that the cloud is really "utility computing." It provides the "illusion of infinite resources," lets companies avoid capital expenditures, decreases the need for IT, provides on-demand computing, and allows "end user provisioning" in minutes instead of months. Costs are as low as 3 cents/hour for the cheapest Amazon computers. "The advantages are just overwhelming," he said.
For these reasons Physware does all its development in the cloud. Physware provides 3D electromagnetic (EM) modeling, an application that's easily parallelized and thus lends itself well to cloud computing. "I think electronic design will move to the cloud more rapidly than many of you think," Camposano said.
What about security? Camposano read this quote from Simon Crosby, CTO of the datacenter and cloud division at Citrix Systems:
"Why do you think people started keeping their money in a bank instead of at home? Because the bank has a better safe. So does Amazon. It's even better, as we've seen, than PayPal or Visa. The largest cloud providers have defense resources far beyond anything you could match in your own datacenter."
With an apparent nod to Intel, Camposano remarked that this quote "is not true for very large companies, is probably true for most companies, and is certainly true for little companies." He noted that Physware takes advantage of such features as key pairs, certification, and 120-bit encryption, and uses a one-port VPN connection to the cloud.
What we're seeing here is two very different viewpoints of cloud computing -- one from a very large company that already has an extensive and secure compute infrastructure, and one from a small startup. Small and medium-sized companies are most likely to take advantage of the cloud first. For startups, it's great -- people will start companies they couldn't even dream of back when everybody had to buy their own compute resources.
But the security concerns are real, and large companies (some of whom already have internal private clouds) will have to be convinced their data is safe in public clouds. In the world of EDA and chip design, many questions about public cloud security remain.