基于小云审大云的云平台可信评测体系结构与技术研究

刘川意; 潘鹤中; 梁露露; 王国峰; 方滨兴

doi:10.11959/j.issn.2096-109x.2016.00102

您当前的位置：

首页 >

文章列表页 >

基于小云审大云的云平台可信评测体系结构与技术研究

学术论文 | 更新时间：2024-06-03

- 基于小云审大云的云平台可信评测体系结构与技术研究
- Cloud Trustworthiness Evaluation as a cloud service:architecture,key technologies and implementations
- 网络与信息安全学 2016年2卷第10期页码：36-47
- 作者机构：
  
  1. 哈尔滨工业大学（深圳）计算机科学与技术学院，广东深圳 518055
  2. 北京邮电大学计算机学院，北京 100876
  3. 中国信息安全测评中心，北京 100085
  4. 东莞电子科技大学电子信息工程研究院，广东东莞 523000
- 作者简介：
  
  [ "刘川意（1982-），男，四川乐山人，博士，哈尔滨工业大学（深圳）副教授，主要研究方向为云计算与云安全、大规模存储系统、数据保护与数据安全。" ]
  [ "潘鹤中（1991-），男，辽本本溪人，北京邮电大学博士生，主要研究方向为云安全、信息安全。" ]
  [ "梁露露（1985-），男，湖北襄阳人，博士，中国信息安全测评中心副研究员，主要研究方向为云计算与大数据安全、无线网络安全。" ]
  [ "王国峰（1988-），男，山东济宁人，北京邮电大学博士生，主要研究方向为云安全、信息安全、云安全技术、数据加密技术。" ]
  [ "方滨兴（1960-），男，江西万年人，中国工程院院士，北京邮电大学教授、博士生导师，主要研究方向为大数据、计算机网络和信息安全。" ]
- 基金信息：
  
  国家高技术研究发展计划（“863”计划）基金资助项目;The National High Technology Research Program of China (863 Program)(2015AA016001);广东省产学研合作基金资助项目;Produc-tion-Study-Research Cooperation Project in Guangdong Province(2016B090921001);山东省自主创新及成果转化专项基金资助项目;Innovation Project in Shandong Province(2014ZZCX03411)
- DOI：10.11959/j.issn.2096-109x.2016.00102
  中图分类号： TP311
- 网络首发：2016-10，
  
  纸质出版：2016-10-15
- 稿件说明：
移动端阅览
刘川意, 潘鹤中, 梁露露, 等. 基于小云审大云的云平台可信评测体系结构与技术研究[J]. 网络与信息安全学, 2016,2(10):36-47.

Chuan-yi LIU, He-zhong PAN, Lu-lu LIANG, et al. Cloud Trustworthiness Evaluation as a cloud service:architecture,key technologies and implementations[J]. Chinese Journal of Network and Information Security, 2016, 2(10): 36-47.
刘川意, 潘鹤中, 梁露露, 等. 基于小云审大云的云平台可信评测体系结构与技术研究[J]. 网络与信息安全学, 2016,2(10):36-47. DOI： 10.11959/j.issn.2096-109x.2016.00102.

Chuan-yi LIU, He-zhong PAN, Lu-lu LIANG, et al. Cloud Trustworthiness Evaluation as a cloud service:architecture,key technologies and implementations[J]. Chinese Journal of Network and Information Security, 2016, 2(10): 36-47. DOI： 10.11959/j.issn.2096-109x.2016.00102.

摘要

提出一种“小云审大云”的云平台可信评测架构，通过引入独立第三方对云平台的可信性进行动态、实时的远程可信数据收集、验证、审计和评价。采用数据流可视化、监控与脱敏技术保障租户数据权益，为租户提供选择可信云平台的依据，为云平台提供证明自身可信的凭据。并突破以下关键技术：1）基于独立第三方的数据采集、行为接入、API代理；2）持续、实时的远程数据收集和数据分析；3）非强侵入式证据收集。

Abstract

A ＂big clouds audited by a small cloud＂ scheme was proposed

by introducing an independent trusted third party (TTP) dealing with run-time data collection

verification

audit and evaluation remotely

in a continuous and data-driven model

compared with traditionally certification based audit.The TTP mainly adopts data flow visualization

data monitoring and encryption to protect the rights of users.It provides the basis for users to choose a trusted cloud platform and for cloud platform to prove own trusted credentials.In-depth study

the following key technologies were broken through:1) the introduction of an independent trusted third party as an intermediate layer between cloud platform and users as well as administrators; 2) continuous

real-time remote data collection and data analysis; 3) strong non-intrusive evidence gathering.

关键词

Keywords

references

BOUCHÉ J , KAPPES M , . Attacking the cloud from an insider perspective [C ] // Internet Technologies and Applications (ITA) . 2015 : 175 - 180 .

ROCHA F , CORREIA M . Lucy in the sky without diamonds:Stealing confidential data in the cloud [C ] // 2011 IEEE/IFIP 41st International Conference on Dependable Systems and Networks Workshops (DSN-W) . 2011 : 129 - 134 .

[EB/OL ] . http://docs.openstack.org. http://docs.openstack.org. .

[EB/OL ] . http://www.qemu.org. http://www.qemu.org. .

[EB/OL ] . http://www.linux-kvm.org/page/Main_Page. http://www.linux-kvm.org/page/Main_Page. .

[EB/OL ] . https://www.xenproject.org. https://www.xenproject.org. .

[EB/OL ] . http://www.vmware.com/cn/products/vsphere.html. http://www.vmware.com/cn/products/vsphere.html. .

[EB/OL ] . http://hvreport.codeplex.com. http://hvreport.codeplex.com. .

BHATT S , MANADHATA P K , ZOMLOT L . The operational role of security information and event management systems [J ] . IEEE Security & Privacy , 2014 , 12 ( 5 ): 35 - 41 .

YEN T F , OPREA A , ONARLIOGLU K , et al . Beehive:large-scale log analysis for detecting suspicious activity in enterprise networks [C ] // The 29th Annual Computer Security Applications Conference . 2013 : 199 - 208 .

ZOMLOT L , SUNDARAMURTHY S C , LUO K , et al . Prioritizing intrusion analysis using dempster-shafer theory [C ] // The 4th ACM Workshop on Security and Artificial Intelligence . 2011 : 59 - 70 .

ZHAI Y , NING P , IYER P , et al . Reasoning about complementary intrusion evidence [C ] // The 20th Computer Security Applications . 2004 : 39 - 48 .

[EB/OL ] . https://www.gartner.com/doc/3406817?ref=SiteSearch&sthkw=Splunk&fnl=search&srcId=1-3478922254 https://www.gartner.com/doc/3406817?ref=SiteSearch&sthkw=Splunk&fnl=search&srcId=1-3478922254 .

[EB/OL ] . http://www-01.ibm.com/software/ http://www-01.ibm.com/software/ .

[EB/OL ] . http://www.splunk.com/ http://www.splunk.com/ .

[EB/OL ] . https://logrhythm.com/ https://logrhythm.com/ .

[EB/OL ] . https://www.elastic.co/products https://www.elastic.co/products .

[EB/OL ] . http://opensoc.github.io/ http://opensoc.github.io/ .

BUTT S,LAGAR-CAVILLA H A , SRIVASTAVA A , et al . Self-service cloud computing [C ] // The 2012 ACM Conference on Computer and Communications Security . 2012 : 253 - 264 .

ZHANG F , CHEN J , CHEN H , et al . CloudVisor:retrofitting protection of virtual machines in multi-tenant cloud with nested virtualization [C ] // The 23rd ACM Symposium on Operating Systems Principles . 2011 : 203 - 216 .

CHEN X , GARFINKEL T , LEWIS E C , et al . Overshadow:a virtualization-based approach to retrofitting protection in commodity operating systems [C ] // ACM Sigarch Computer Architecture News . 2008 , 36 ( 1 ): 2 - 13 .

HOFMANN O S , KIM S , DUNN A M , et al . Inktag:secure applications on an untrusted operating system [C ] // ACM Sigarch Computer Architecture News . 2013 , 41 ( 1 ): 265 - 278 .

HE W , AKHAWE D , JAIN S , et al . Shadowcrypt:encrypted web applications for everyone [C ] // The 2014 ACM Sigsac Conference on Computer and Communications Security . 2014 : 1028 - 1039 .

LAU B , CHUNG S , SONG C , et al . Mimesis aegis:a mimicry privacy shield——a system’s approach to data privacy on public cloud [C ] // The 23rd USENIX Security Symposium (USENIX Security 14) . 2014 : 33 - 48 .

POPA R A , STARK E , VALDEZ S , et al . Building Web applications on top of encrypted data using Mylar [C ] // The 11th USENIX Symposium on Networked Systems Design and Implementation (NSDI 14) . 2014 : 157 - 172 .

[EB/OL ] . http://www.virtru.com http://www.virtru.com .

POPA R A , REDFIELD C , ZELDOVICH N , et al . CryptDB:protecting confidentiality with encrypted query processing [C ] // The 12rd ACM Symposium on Operating Systems Principles . 2011 : 85 - 100 .

[EB/OL ] . http://www.virtru.com http://www.virtru.com .

[EB/OL ] . http://openvswitch.org. http://openvswitch.org. .

浏览量

488

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

云计算多授权中心CP-ABE代理重加密方案

容器云中基于信号博弈的容器迁移与蜜罐部署策略

基于FANP的云用户行为信任评估优化机制

具有密文等值测试功能的公钥加密技术综述

可搜索加密研究进展综述