Research on dynamic migration of critical virtual machines for multi-tenancy

Shuo ZHAO; Xin-sheng JI; Guo-zhen CHENG; Yu-xing MAO

doi:10.11959/j.issn.2096-109x.2017.00191

您当前的位置：

首页 >

文章列表页 >

Research on dynamic migration of critical virtual machines for multi-tenancy

Papers | 更新时间：2024-06-03

- Research on dynamic migration of critical virtual machines for multi-tenancy
- Chinese Journal of Network and Information Security Vol. 3, Issue 8, Pages: 8-17(2017)
- 作者机构：
  
  1. 国家数字交换系统工程技术研究中心，河南郑州 450002
  2. 解放军理工大学指挥信息系统学院，江苏南京 210007
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00191
  CLC： TP302
- Online First：2017-08，
  
  Published：15 August 2017
- 稿件说明：
移动端阅览
Shuo ZHAO, Xin-sheng JI, Guo-zhen CHENG, et al. Research on dynamic migration of critical virtual machines for multi-tenancy[J]. Chinese Journal of Network and Information Security, 2017, 3(8): 8-17.
DOI：

Shuo ZHAO, Xin-sheng JI, Guo-zhen CHENG, et al. Research on dynamic migration of critical virtual machines for multi-tenancy[J]. Chinese Journal of Network and Information Security, 2017, 3(8): 8-17. DOI： 10.11959/j.issn.2096-109x.2017.00191.

摘要

提出一种面向多租户的关键虚拟机动态迁移方法。首先，根据租户对虚拟机的安全需求设定关键虚拟机的比例，减少虚拟机动态迁移的数量；然后，通过虚拟机之间共存时间约束条件最大化降低虚拟机动态迁移的频率；最后，以最小化迁移开销作为虚拟机迁移的目标函数，进一步降低虚拟机迁移带来的开销。实验表明，与现有的防御方法相比，该方法在有效防御侧信道攻击的前提下，能够减少对网络服务性能的影响，降低虚拟机迁移的成本，更加适用于大规模的网络场景。

Abstract

A dynamic migration method of critical virtual machines for multi-tenancy was proposed.Firstly

the tenants can set ratio of critical virtual machines according to tenant's security requirements

then the dynamic migration frequency of virtual machines were maximized by the coexistence time constraints between virtual machines

finally the migration cost was minimized as an object function for the virtual machines migrated to further reduce the migration cost.Simulation experiments demonstrate that the proposed approach can reduce the impact on the performance of network services and the cost of virtual machines migration

and is more suitable for large-scale network scenarios under the premise of effective defense side-channel attacks.

关键词

Keywords

references

ZHANG Q , CHENG L , BOUTABA R . Cloud computing:state-ofthe-art and research challenges [J ] . Journal of Internet Services and Applications , 2010 , 1 ( 1 ): 7 - 18 .

BUTT S , SRIVASTAVA A , GANAPATHY V . Self-service cloud computing [C ] // ACM Conference on Computer and Communications Security . 2015 : 253 - 264 .

JAIN R , PAUL S . Network virtualization and software defined networking for cloud computing:a survey [J ] . IEEE Communications Magazine , 2013 , 51 ( 11 ): 24 - 31 .

CHOWDHURY N M M K , BOUTABA R . Network virtualization:state of the art and research challenges [J ] . IEEE Communications Magazine , 2009 , 47 ( 7 ): 20 - 26 .

CHOWDHURY N M M K , BOUTABA R . A survey of network virtualization [J ] . Computer Networks , 2010 , 54 ( 5 ): 862 - 876 .

FISCHER A , BOTERO J F , TILL B M , et al . Virtual network embedding:a survey [J ] . IEEE Communications Surveys ＆ Tutorials , 2013 , 15 ( 4 ): 1888 - 1906 .

余涛 , 毕军 , 吴建平 . 未来互联网虚拟化研究 [J ] . 计算机研究与发展 , 2015 , 52 ( 9 ): 2069 - 2082 .

YU T , BI J , WU J P , et al . Research on the virtualization of future internet [J ] . Journal of Computer Research and Development , 2015 , 52 ( 9 ): 2069 - 2082 .

RISTENPART T , TROMER E , SHACHAM H , et al . Hey,you,get off of my cloud:exploring information leakage in third-party compute clouds [C ] // ACM Conference on Computer and Communications Security,CCS 2009,Chicago,Illinois,USA,November . 2009 : 199 - 212 .

GILLANI F , AL-SHAER E , LO S , et al . Agile virtualized infrastructure to proactively defend against cybe attacks [C ] // 2015 IEEE Conference on Computer Communications . 2015 : 729 - 737 .

张玉清 , 王晓菲 , 刘雪峰 , 等 . 云计算环境安全综述 [J ] . 软件学报 , 2016 , 27 ( 6 ): 1328 - 1348 .

ZHANGY Y Q , WANG X F , LIU X F , et al . Survey on cloud computing security [J ] . Journal of Software , 2016 , 27 ( 6 ): 1328 - 1348 .

WU Z , XU Z , WANG H . Whispers in the Hyper-space:high-speed covert channel attacks in the cloud [C ] // USENIX Security symposium . 2012 : 159 - 173 .

IRAZOQUI G , EISENBARTH T , SUNAR B . S$A:a shared cache attack that works across cores and defies VM sandboxing-and its application to AES [C ] // IEEE Symposium on Security ＆ Privacy . 2015 : 591 - 604 .

ZHANG Y , LI M , BAI K , et al . Incentive compatible moving target defense against vm-colocation attacks in clouds [C ] // IFIP International Information Security Conference . 2012 : 388 - 399 .

LI P , GAO D , REITER M K . Stopwatch:a cloud architecture for timing channel mitigation [J ] . ACM Transactions on Information and System Security (TISSEC) , 2014 , 17 ( 2 ): 1 - 28 .

ZHANG Y , REITER M K . Düppel:retrofitting commodity operating systems to mitigate cache side channels in the cloud [C ] // ACM Sigsac Conference on Computer ＆ Communications Security . 2013 : 827 - 838 .

PATTUK E , KANTARCIOGLU M , LIN Z , et al . Preventing cryptographic key leakage in cloud virtual machines [C ] // The 23rd USENIX Security Symposium (USENIX Security 14) . 2014 : 703 - 718 .

GILLANI F , AL-SHAER E , LO S , et al . Agile virtualized infrastructure to proactively defend against cyber attacks [C ] // Computer Communications . 2015 : 729 - 737 .

WANG Y , CHAU P , CHEN F . A framework for security-aware virtual network embedding [C ] // 2015 24th International Conference on Computer Communication and Networks (ICCCN) . 2015 : 1 - 7 .

HAN Y , ALPCAN T , CHAN J , et al . Security games for virtual machine allocation in cloud computing [C ] // International Conference on Decision and Game Theory for Security . 2013 : 99 - 118 .

MOON S J , SEKAR V , REITER M K . Nomad:mitigating arbitrary cloud side channels via provider-assisted migration [C ] // The 22nd ACM SIGSAC Conference on Computer and Communications Security . 2015 : 1595 - 1606 .

LIU F , YAROM Y , GE Q , et al . Last-level cache side-channel attacks are practical [C ] // 2015 IEEE Symposium on Security and Privacy (SP) . 2015 : 605 - 622 .

SUZAKI K , IIJIMA K , YAGI T , et al . Memory deduplication as a threat to the guest OS [C ] // The Fourth European Workshop on System Security . 2011 : 1 - 6 .

OWENS R , WANG W . Non-interactive OS fingerprinting through memory de-duplication technique in virtual machines [C ] // 2011 IEEE 30th International Performance Computing and Communications Conference (IPCCC) . 2011 : 1 - 8 .

Views

1149

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

⁰