Secure deployment strategy of virtual machines based on operating system diversity

Miao ZHANG; Xin-sheng JI; Jian-jian AI; Wen-yan LIU; Hong-chao HU; Shu-min HUO

doi:10.11959/j.issn.2096-109x.2017.00201

您当前的位置：

首页 >

文章列表页 >

Secure deployment strategy of virtual machines based on operating system diversity

Papers | 更新时间：2024-06-03

- Secure deployment strategy of virtual machines based on operating system diversity
- Chinese Journal of Network and Information Security Vol. 3, Issue 10, Pages: 35-43(2017)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00201
  CLC： TP302
- Online First：2017-10，
  
  Published：15 October 2017
- 稿件说明：
移动端阅览
Miao ZHANG, Xin-sheng JI, Jian-jian AI, et al. Secure deployment strategy of virtual machines based on operating system diversity[J]. Chinese Journal of Network and Information Security, 2017, 3(10): 35-43.
DOI：

Miao ZHANG, Xin-sheng JI, Jian-jian AI, et al. Secure deployment strategy of virtual machines based on operating system diversity[J]. Chinese Journal of Network and Information Security, 2017, 3(10): 35-43. DOI： 10.11959/j.issn.2096-109x.2017.00201.

摘要

云计算的资源共享模式，在极大提高资源利用率的同时，也带来了诸多安全问题，如虚拟机间的共存攻击。特别是当用户使用单一的操作系统时，攻击者可以在较小的开销下，攻破用户的全部虚拟机，从而窃取隐私和数据。针对这一安全威胁，利用不同操作系统漏洞存在差异的特点，提出一种基于操作系统多样性的虚拟机安全部署策略。该方法首先为申请虚拟机的用户推荐一种多样性程度最高的操作系统配置选择；然后通过一种安全的部署策略，最大化地发挥多样性的特点，使攻击者需要付出更大的开销。实验结果表明，与单一操作系统配置的方法相比，该方法至少可以降低33.46%的攻击效益。

Abstract

The resource-sharing model for cloud computing raises many security issues

such as co-resident of virtual machines

while greatly improving resource utilization.In particular

when a user adopts a single operating system

an attacker can steal privacy and data by compromising the user's entire virtual machine at a smaller cost.In view of this security threat

a strategy for the security deployment of virtual machine based on operating system diversity was presented.This method firstly recommended an operating system configuration options for users applying for virtual machines with the highest degree in diversity

and then through the secure deployment strategy

maximized the effect of diversity

thus making the attacker pay more cost.The experimental results show that compared with the method of single operating system

this method can reduce the attack efficiency by 33.46% at least.

关键词

Keywords

references

RISTENPART T , TROMER E , SHACHAM H , et al . Hey,you,get off of my cloud:exploring information leakage in third-party compute clouds [C ] // ACM Conference on Computer and Communications Security . 2009 .

APECECHEA G I , INCI M S , EISENBARTH T , et al . Fine grain cross-VM attacks on Xen and VMware are possible! [J ] . Ecewp.ece.wpi.edu , 2014

OSVIK D A , SHAMIR A , TROMER E . Cache attacks and countermeasures:the case of AES [J ] . Lecture Notes in Computer Science , 2006 ,( 2005 ): 1 - 20 .

YAROM Y , FALKNER K . FLUSH+RELOAD:a high resolution,low noise,L3 cache side-channel attack [C ] // Usenix Conference on Security Symposium . 2014 : 719 - 732 .

ZHANG Y , REITER M K . Düppel:retrofitting commodity operating systems to mitigate cache side channels in the cloud [C ] // ACM Sigsac Conference on Computer ＆ Communications Security . 2013 .

WANG Z , LEE R B . A novel cache architecture with enhanced performance and security [C ] // IEEE/ACM International Symposium on Microarchitecture . 2008 .

MOON S J , SEKAR V , REITER M K . Nomad:mitigating arbitrary cloud side channels via provider-assisted migration [C ] // The 22nd ACM SIGSAC Conference on Computer and Communications Security . 2015 : 1595 - 1606 .

AVIZIENIS A , CHEN L . On the implementation of N-version programming for software fault tolerance during program execution [J ] . Proc of the Compsac , 1977 , 6 ( 1 ): 25 - 37 .

FORREST S , SOMAYAJI A , ACKLEY D . Building diverse computer systems [C ] // The Workshop on Hot Topics in Operating Systems . 1997 : 67 - 72 .

HOFMEYR S A , FORREST S . Architecture for an artificial immune system [J ] . Evolutionary Computation , 2000 , 8 ( 4 ): 443 - 473 .

GASHI I , POPOV P , STRIGINI L . Fault tolerance via diversity for off-the-shelf products:a study with SQL database servers [J ] . IEEE Transactions on Dependable and Secure Computing , 2007 , 4 ( 4 ): 280 - 294 .

NEWELL A , OBENSHAIN D , TANTILLO T , et al . Increasing network resiliency by optimally assigning diverse variants to routing nodes [C ] // IEEE/IFIP International Conference on Dependable Systems and Networks . 2013 .

GARCIA M , BESSANI A , GASHI I , et al . Analysis of operating system diversity for intrusion tolerance [J ] . Software-practice ＆Experience , 2014 , 44 ( 6 ): 735 - 770 .

BATES A , MOOD B , PLETCHER J , et al . Detecting co-residency with active traffic analysis techniques [C ] // The 2012 ACM Workshop on Cloud Computing Security Workshop . 2012

ZHANG Y , JUELS A , OPREA A , et al . HomeAlone:co-residency detection in the cloud via side-channel analysis [C ] // IEEE Symposium on Security and Privacy . 2011 .

ZHANG Y , JUELS A , REITER M K , et al . Cross-VM side channels and their use to extract private keys [C ] // ACM Conference on Computer and Communications Security . 2012

LEINSTER T , COBBOLD C A . Measuring diversity:the importance of species similarity [J ] . Ecology , 2012 , 93 ( 3 ):477.

HAN Y , CHAN J , ALPCAN T , et al . Using virtual machine allocation policies to defend against co-resident attacks in cloud computing [J ] . IEEE Transactions on Dependable ＆ Secure Computing , 2017 , 14 ( 1 ): 95 - 108 .

Views

1914

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Steganography in NFT images

Dynamic heterogeneous scheduling method based on Stackelberg game model in container cloud

Research progress on moving target defense for SDN

Research on SDN-based cloud security application

Research on the searchable encryption

Related Author

Xinpeng ZHANG

Guorui FENG

Zichi WANG

Shumin HUO

Lingshu LI

Hongchao HU

Wei ZENG

Xiaohu LIU

Related Institution

School of Communication and Information Engineering, Shanghai University

Shenzhen Key Laboratory of Media Security, Shenzhen University

School of Cryptography Engineering,Information Engineering University

Henan Provincial Key Laboratory of Information Security

Services Computing Technology and System Lab,School of Computer Science and Technology,Huazhong University of Science and Technology

⁰