Tag: a layered cloud workload security approach combining identity protection