Research on consistency protection mechanism for secure states of virtual domain in cloud environment

Wei-qi DAI; De-qing ZOU; Hai JIN; Yan XIA

doi:10.11959/j.issn.2096-109x.2016.00103

您当前的位置：

首页 >

文章列表页 >

Research on consistency protection mechanism for secure states of virtual domain in cloud environment

Papers | 更新时间：2024-06-03

- Research on consistency protection mechanism for secure states of virtual domain in cloud environment
- Chinese Journal of Network and Information Security Vol. 2, Issue 10, Pages: 48-57(2016)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2016.00103
  CLC： TP309.2
- Online First：2016-10，
  
  Published：15 October 2016
- 稿件说明：
移动端阅览
Wei-qi DAI, De-qing ZOU, Hai JIN, et al. Research on consistency protection mechanism for secure states of virtual domain in cloud environment[J]. Chinese Journal of Network and Information Security, 2016, 2(10): 48-57.
DOI：

Wei-qi DAI, De-qing ZOU, Hai JIN, et al. Research on consistency protection mechanism for secure states of virtual domain in cloud environment[J]. Chinese Journal of Network and Information Security, 2016, 2(10): 48-57. DOI： 10.11959/j.issn.2096-109x.2016.00103.

摘要

由于云环境虚拟化特性及高动态性（回滚、迁移等操作）给虚拟域带来了时间、空间状态不一致，从而造成了严重的安全威胁。针对该问题，提出了云环境虚拟域安全基础架构、时间安全状态一致性机制、空间安全状态一致性机制，有效地保障了云虚拟域安全状态的一致性，有助于提高公共服务效率和信息安全可控性。

Abstract

The traditional trusted computing architecture was suffering from the cloud uncertainty and dynamics caused by VM rollback or migration

which was a fatal threat to the cloud security.following investigations were conducted.Secure cloud virtual domain basic architecture; Time state consistence and collection mechanism.Cyber state consistence and collection mechanism.This study guaranteed security state consistence of virtual domain and improved the security and efficiency of the online service platform for both government institutions and companies.

关键词

Keywords

references

[EB/OL ] . http://news.163.com/14/1111/06/AAOGEHRH00014AEE.html http://news.163.com/14/1111/06/AAOGEHRH00014AEE.html . 2016 .

SAILER R , ZHANG X , JAEGER T , et al . Design and implementation of a TCG-based integrity measurement architecture [C ] // Proceedings of USENIX Security Symposium . 2004 : 223 - 238 .

MCCUNE J , PARNO B , PERRIG A , et al . Flicker:an execution infrastructure for TCB minimization [C ] // ACM Eurosys’08 . 2008 : 315 - 328 .

MCCUNE J , PARNO B , PERRIG A , et al . Minimal TCB code execution [C ] // IEEE Symposium on Security and Privacy (SP’07) . 2007 : 267 - 272 .

PEREZ R , SAILER R , DOORN L V . vTPM:virtualizing the trusted platform module [C ] // The 15th Conference on USENIX Security Symposium . 2006 : 305 - 320 .

ZHANG F , CHEN J , CHEN H , et al . Cloudvisor:retrofitting protection of virtual machines in multi-tenant cloud with nested virtualization [C ] // ACM SOSP . 2011 : 203 - 216 .

项国富 , 金海 , 邹德清 , 等 . 基于虚拟化的安全监控 [J ] . 软件学报 , 2012 , 23 ( 8 ): 2173 - 2187 .

XIANG G F , JIN H , ZOU D Q , et al . Virtualization-based security monitoring [J ] . Journal of Software , 2012 , 23 ( 8 ): 2173 - 2187 .

CRISWELL J , DAUTENHAHN N , ADVE V . Virtual ghost:protecting applications from hostile operating systems [C ] // The 19th International Conference on Architectural Support for Programming Languages and Operating Systems,ASPLOS’14 . 2014 : 81 - 96 .

LI Y , MCCUNE J M , NEWSOME J , et al . MiniBox:a two-way sandbox for x86 native code [C ] // 2014 USENIX Annual Technical Conference . 2014 .

MCCUNE J M , LI Y , QU N , et al . TrustVisor:efficient TCB reduction and attestation [C ] // IEEE Symposium on Security and Privacy . 2010 : 143 - 158 .

YEE B , SEHR D , DARDYK G , et al . Native client:a sandbox for portable,untrusted x86 native code [C ] // IEEE Symposium on Security and Privacy . 2009 .

FU M , BASS L , LIU A . Towards a taxonomy of cloud recovery strategies [C ] // Dependable Systems and Networks (DSN),2014 44th Annual IEEE/IFIP International Conference on IEEE . 2014 : 696 - 701 .

GARFINKEL T , ROSENBLUM M . When virtual is harder than real:Security challenges in virtual machine based computing environments [C ] // Proceedings of HotOS . 2005 :20.

GOLDMAN K , BERGER S . Virtualization-based security monitoring [J ] . Journal of Software , 2012 , 23 ( 8 ): 2173 - 2187 .

ENGLAND P , LOSER J . Para-virtualized TPM sharing [C ] // The 1st International Conference on Trusted Computing and Trust in Information Technologies:Trusted Computing Challenges and Applications . 2008 : 119 - 132 .

XIA Y , LIU Y , CHEN H , et al . Defending against vm rollback attack [C ] // The 2012 IEEE/IFIP 42nd International Conference on Dependable Systems and Networks Workshops (DSN-W) . 2012 : 1 - 5 .

PARNO B , LORCH J R , DOUCEUR J R , et al . Memoir:practical state continuity for protected modules [C ] // The 2011 IEEE Symposium on Security and Privacy . 2011 : 379 - 394 .

YIN H , POOSANKAM P , HANNA S , et al . Hookscout:proactive binary-centric hook detection,detection of intrusions and malware,and vulnerability assessment [M ] . Berlin Heidelberg : SpringerPress , 2010 : 1 - 20 .

CHOW J , LUCCHETTI D , GARFINKEL T , et al . Multi-stage replay with crosscut [J ] . ACM Sigplan Notices , 2010 , 45 ( 7 ): 13 - 24 .

LAGAR-CAVILLA H A , WHITNEY J , SCANNELL A , et al . Snowflock:rapid virtual machine cloning for cloud computing [C ] // The 4th ACM European conference on Computer systems (EuroSys’09) . 2009 : 1 - 2 .

PATCHIN P,LAGAR-CAVILLA H A , LARA E D , et al . Adding the easy button to the cloud with snowflock and MPI [C ] // The 3rd ACM Workshop on System-level Virtualization for High Performance Computing . ACM , 2009 : 1 - 8 .

CABUK S , DALTON C , RAMASAMY H , et al . Towards Automated provisioning of secure virtualized networks [C ] // The 14th ACM Conference on Computer and Communications Security,Alexandria . Virginia,USA , 2007 . 235 - 245 .

CABUK S , DALTON C I , ERIKSSON K , et al . Towards automated security policy enforcement in multi-tenant virtual data centers [J ] . Journal of Computer Security , 2010 , 18 ( 1 ): 89 - 121

SCHAEFER M , . If A1 is the answer,what was the question? an edgy naif´s retrospective on promulgating the trusted computer systems evaluation criteria [C ] // The 20th Annual Computer Security Applications Conference (CSAC 2004) . 2004 : 204 - 228 .

CALERO J M A , EDWARDS N , KIRSCHNICK J , et al . Toward a multitenancy authorization system for cloud services [J ] . IEEE Security & Privacy , 2010 , 8 ( 6 ): 48 - 55 .

BERGER S , CACERES R , PENDARAKIS D , et al . TVDc:Managing security in the trusted virtual datacenter [J ] . ACM SIGOPS Operating Systems Review , 2008 , 42 ( 1 ): 40 - 47 .

GRIFFIN J L , JAEGER T , PEREZ R , et al . Trusted virtual domains:toward secure distributed services [C ] // The 1st IEEE Workshop on Hot Topics in System Dependability . 2005 .

BERGER S , CACERES R , GOLDMAN K , et al . Security for the cloud infrastructure:Trusted virtual data center implementation [J ] . IBM Journal of Research and Development , 2009 , 53 ( 4 ): 560 - 571 .

DAVI L , DMITRIENKO A , KOWALSKI C , et al . Trusted virtual domains on OKL4:secure information sharing on smart phones [C ] // The Sixth ACM Workshop on Scalable Trusted Computing . ACM , 2011 : 49 - 58 .

DAI W Q , ZOU D Q , et al , TEE:a virtual DRTM based execution environment for secure cloud-end computing [J ] . Future Generation Computer System (FGCS) , 2015 , 49 : 47 - 57 .

DAI W QL , JIN H , ZOU D Q , et al , TEE:a virtual DRTM based execution environment for secure cloud-end computing [C ] // The 17th ACM Conference on Computer and Communications Security (CCS Poster),Hyatt Regency Chicago,IL,USA , 2010 : 663 - 665 .

DAI W Q , PARKER T P , JIN H , et al , Enhancing data trustworthiness via assured digital signing [J ] . IEEE Transactions on Dependable and Secure Computing (TDSC) , 2012 , 9 ( 6 ): 838 - 851 .

Views

469

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Scheme of virtual machine trusted migration in cloud environment

HyperSpector:VMM dynamic trusted monitor based on UEFI

Multi-authority based CP-ABE proxy re-encryption scheme for cloud computing

Strategy of container migration and honeypot deployment based on signal game in cloud environment

Trust evaluation optimization mechanism for cloud user behavior based on FANP

Related Author

Jianbiao ZHANG

Yuanxi ZHU

Jun HU

Xiao WANG

Fei1 YAN

Fan, HUANG

Zhi-hua LI

Kai WANG

Related Institution

Faculty of Information Technology, Beijing University of Technology

Beijing Key Laboratory of Trusted Computing

Key Laboratory of Aerospace Information Security and Trusted Computing of Ministry of Education

School of Computer,Wuhan University

School of Computer, Qinghai Normal University

⁰