Q18Cloud Computing

The NIST architecture is a conceptual model that discusses the requirements, uses, characteristics, and standards of cloud computing. It was developed by the National Institute of Standards and Technology to provide a vendor-neutral way of describing cloud services, taxonomy of major actors, and the interactions between them, so that consumers and providers could compare offerings on a common basis. It defines five primary actors:

1. Cloud Consumer: The person or organization that maintains a business relationship with, and uses service from, Cloud Providers. The Consumer browses a service catalog, requests services, sets up a contract with the provider, and uses the service, being billed according to the agreed usage metrics. 2. Cloud Provider: The entity responsible for making a service available to interested parties. They manage the computing infrastructure required for providing the services, run the cloud software, and deliver services through network access. The provider's activities are grouped into five major areas: service deployment, service orchestration, cloud service management, security, and privacy. 3. Cloud Auditor: A party that can conduct independent assessment of cloud services, information system operations, performance, and security of the cloud implementation. The auditor evaluates the services provided by a Cloud Provider against agreed-upon security controls, privacy impact, and performance metrics, and can conduct audits without disrupting the operation of the service. 4. Cloud Broker: An entity that manages the use, performance, and delivery of cloud services, and negotiates relationships between Cloud Providers and Cloud Consumers. As cloud computing evolves, integrating cloud services can become too complex for consumers to manage themselves, so a broker can provide service intermediation (enhancing a given service by improving some specific capability), service aggregation (combining multiple services into one), and service arbitrage (choosing services from multiple agencies dynamically). 5. Cloud Carrier: An intermediary that provides connectivity and transport of cloud services from Cloud Providers to Cloud Consumers (e.g., telecom providers). The carrier provides access to consumers through network, telecommunication, and other access devices; for example a consumer obtains cloud services through network access devices such as computers, laptops, mobile phones, and connects via the network provided by a carrier.

Interactions Between Actors

The Consumer requests service through the Provider's published service catalog, either directly or via a Broker who negotiates on the Consumer's behalf. The Provider deploys the requested resources using its internal orchestration layer, which spans the physical resource layer, the resource abstraction and control layer (hypervisors, virtual machines, virtual storage), and the service layer (SaaS, PaaS, IaaS interfaces exposed to consumers). Throughout this lifecycle, the Auditor can independently verify that the Provider is meeting its declared security and performance commitments, giving the Consumer confidence without requiring them to audit the infrastructure themselves. The Carrier ensures that connectivity between the Consumer and Provider meets agreed network SLAs, such as guaranteed bandwidth and low latency, often through dedicated network connections for enterprise consumers.

This five-actor model is significant because it cleanly separates concerns: consumers focus on requirements and usage, providers focus on delivery and operations, auditors focus on independent verification, brokers focus on value-added integration, and carriers focus on connectivity. This separation lets each actor specialize and enables an ecosystem where a single cloud deployment can involve multiple organizations working together, rather than a single vendor doing everything end to end.