云环境面向虚拟域的安全状态一致性保障机制研究

代炜琦; 邹德清; 金海; 夏妍

doi:10.11959/j.issn.2096-109x.2016.00103

您当前的位置：

首页 >

文章列表页 >

云环境面向虚拟域的安全状态一致性保障机制研究

学术论文 | 更新时间：2024-06-03

- 云环境面向虚拟域的安全状态一致性保障机制研究
- Research on consistency protection mechanism for secure states of virtual domain in cloud environment
- 网络与信息安全学 2016年2卷第10期页码：48-57
- 作者机构：
- 作者简介：
  
  [ "代炜琦（1984-），男，湖北武汉人，博士，华中科技大学讲师、硕士生导师，主要研究方向为云计算安全、可信计算、虚拟化安全、SDN安全等。" ]
  [ "邹德清（1975-），男，湖南长沙人，博士，华中科技大学计算机学院副院长、教授、博士生导师，主要研究方向为虚拟化安全与云安全、网络攻防与漏洞检测、大数据安全、容错计算。" ]
  [ "金海（1966-），男，上海人，博士，华中科技大学教授，主要研究方向为高性能计算、分布式计算、云计算、大数据、云安全。" ]
  [ "夏妍（1993-），女，辽宁朝阳人，华中科技大学硕士生，主要研究方向为云计算安全、虚拟化安全。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61602200；);The Fundamental Research Funds for the Central Universities(HUST2016YXMS087)
- DOI：10.11959/j.issn.2096-109x.2016.00103
  中图分类号： TP309.2
- 网络首发：2016-10，
  
  纸质出版：2016-10-15
- 稿件说明：
移动端阅览
代炜琦, 邹德清, 金海, 等. 云环境面向虚拟域的安全状态一致性保障机制研究[J]. 网络与信息安全学, 2016,2(10):48-57.

Wei-qi DAI, De-qing ZOU, Hai JIN, et al. Research on consistency protection mechanism for secure states of virtual domain in cloud environment[J]. Chinese Journal of Network and Information Security, 2016, 2(10): 48-57.
代炜琦, 邹德清, 金海, 等. 云环境面向虚拟域的安全状态一致性保障机制研究[J]. 网络与信息安全学, 2016,2(10):48-57. DOI： 10.11959/j.issn.2096-109x.2016.00103.

Wei-qi DAI, De-qing ZOU, Hai JIN, et al. Research on consistency protection mechanism for secure states of virtual domain in cloud environment[J]. Chinese Journal of Network and Information Security, 2016, 2(10): 48-57. DOI： 10.11959/j.issn.2096-109x.2016.00103.

摘要

由于云环境虚拟化特性及高动态性（回滚、迁移等操作）给虚拟域带来了时间、空间状态不一致，从而造成了严重的安全威胁。针对该问题，提出了云环境虚拟域安全基础架构、时间安全状态一致性机制、空间安全状态一致性机制，有效地保障了云虚拟域安全状态的一致性，有助于提高公共服务效率和信息安全可控性。

Abstract

The traditional trusted computing architecture was suffering from the cloud uncertainty and dynamics caused by VM rollback or migration

which was a fatal threat to the cloud security.following investigations were conducted.Secure cloud virtual domain basic architecture; Time state consistence and collection mechanism.Cyber state consistence and collection mechanism.This study guaranteed security state consistence of virtual domain and improved the security and efficiency of the online service platform for both government institutions and companies.

关键词

Keywords

references

[EB/OL ] . http://news.163.com/14/1111/06/AAOGEHRH00014AEE.html http://news.163.com/14/1111/06/AAOGEHRH00014AEE.html . 2016 .

SAILER R , ZHANG X , JAEGER T , et al . Design and implementation of a TCG-based integrity measurement architecture [C ] // Proceedings of USENIX Security Symposium . 2004 : 223 - 238 .

MCCUNE J , PARNO B , PERRIG A , et al . Flicker:an execution infrastructure for TCB minimization [C ] // ACM Eurosys’08 . 2008 : 315 - 328 .

MCCUNE J , PARNO B , PERRIG A , et al . Minimal TCB code execution [C ] // IEEE Symposium on Security and Privacy (SP’07) . 2007 : 267 - 272 .

PEREZ R , SAILER R , DOORN L V . vTPM:virtualizing the trusted platform module [C ] // The 15th Conference on USENIX Security Symposium . 2006 : 305 - 320 .

ZHANG F , CHEN J , CHEN H , et al . Cloudvisor:retrofitting protection of virtual machines in multi-tenant cloud with nested virtualization [C ] // ACM SOSP . 2011 : 203 - 216 .

项国富 , 金海 , 邹德清 , 等 . 基于虚拟化的安全监控 [J ] . 软件学报 , 2012 , 23 ( 8 ): 2173 - 2187 .

XIANG G F , JIN H , ZOU D Q , et al . Virtualization-based security monitoring [J ] . Journal of Software , 2012 , 23 ( 8 ): 2173 - 2187 .

CRISWELL J , DAUTENHAHN N , ADVE V . Virtual ghost:protecting applications from hostile operating systems [C ] // The 19th International Conference on Architectural Support for Programming Languages and Operating Systems,ASPLOS’14 . 2014 : 81 - 96 .

LI Y , MCCUNE J M , NEWSOME J , et al . MiniBox:a two-way sandbox for x86 native code [C ] // 2014 USENIX Annual Technical Conference . 2014 .

MCCUNE J M , LI Y , QU N , et al . TrustVisor:efficient TCB reduction and attestation [C ] // IEEE Symposium on Security and Privacy . 2010 : 143 - 158 .

YEE B , SEHR D , DARDYK G , et al . Native client:a sandbox for portable,untrusted x86 native code [C ] // IEEE Symposium on Security and Privacy . 2009 .

FU M , BASS L , LIU A . Towards a taxonomy of cloud recovery strategies [C ] // Dependable Systems and Networks (DSN),2014 44th Annual IEEE/IFIP International Conference on IEEE . 2014 : 696 - 701 .

GARFINKEL T , ROSENBLUM M . When virtual is harder than real:Security challenges in virtual machine based computing environments [C ] // Proceedings of HotOS . 2005 :20.

GOLDMAN K , BERGER S . Virtualization-based security monitoring [J ] . Journal of Software , 2012 , 23 ( 8 ): 2173 - 2187 .

ENGLAND P , LOSER J . Para-virtualized TPM sharing [C ] // The 1st International Conference on Trusted Computing and Trust in Information Technologies:Trusted Computing Challenges and Applications . 2008 : 119 - 132 .

XIA Y , LIU Y , CHEN H , et al . Defending against vm rollback attack [C ] // The 2012 IEEE/IFIP 42nd International Conference on Dependable Systems and Networks Workshops (DSN-W) . 2012 : 1 - 5 .

PARNO B , LORCH J R , DOUCEUR J R , et al . Memoir:practical state continuity for protected modules [C ] // The 2011 IEEE Symposium on Security and Privacy . 2011 : 379 - 394 .

YIN H , POOSANKAM P , HANNA S , et al . Hookscout:proactive binary-centric hook detection,detection of intrusions and malware,and vulnerability assessment [M ] . Berlin Heidelberg : SpringerPress , 2010 : 1 - 20 .

CHOW J , LUCCHETTI D , GARFINKEL T , et al . Multi-stage replay with crosscut [J ] . ACM Sigplan Notices , 2010 , 45 ( 7 ): 13 - 24 .

LAGAR-CAVILLA H A , WHITNEY J , SCANNELL A , et al . Snowflock:rapid virtual machine cloning for cloud computing [C ] // The 4th ACM European conference on Computer systems (EuroSys’09) . 2009 : 1 - 2 .

PATCHIN P,LAGAR-CAVILLA H A , LARA E D , et al . Adding the easy button to the cloud with snowflock and MPI [C ] // The 3rd ACM Workshop on System-level Virtualization for High Performance Computing . ACM , 2009 : 1 - 8 .

CABUK S , DALTON C , RAMASAMY H , et al . Towards Automated provisioning of secure virtualized networks [C ] // The 14th ACM Conference on Computer and Communications Security,Alexandria . Virginia,USA , 2007 . 235 - 245 .

CABUK S , DALTON C I , ERIKSSON K , et al . Towards automated security policy enforcement in multi-tenant virtual data centers [J ] . Journal of Computer Security , 2010 , 18 ( 1 ): 89 - 121

SCHAEFER M , . If A1 is the answer,what was the question? an edgy naif´s retrospective on promulgating the trusted computer systems evaluation criteria [C ] // The 20th Annual Computer Security Applications Conference (CSAC 2004) . 2004 : 204 - 228 .

CALERO J M A , EDWARDS N , KIRSCHNICK J , et al . Toward a multitenancy authorization system for cloud services [J ] . IEEE Security & Privacy , 2010 , 8 ( 6 ): 48 - 55 .

BERGER S , CACERES R , PENDARAKIS D , et al . TVDc:Managing security in the trusted virtual datacenter [J ] . ACM SIGOPS Operating Systems Review , 2008 , 42 ( 1 ): 40 - 47 .

GRIFFIN J L , JAEGER T , PEREZ R , et al . Trusted virtual domains:toward secure distributed services [C ] // The 1st IEEE Workshop on Hot Topics in System Dependability . 2005 .

BERGER S , CACERES R , GOLDMAN K , et al . Security for the cloud infrastructure:Trusted virtual data center implementation [J ] . IBM Journal of Research and Development , 2009 , 53 ( 4 ): 560 - 571 .

DAVI L , DMITRIENKO A , KOWALSKI C , et al . Trusted virtual domains on OKL4:secure information sharing on smart phones [C ] // The Sixth ACM Workshop on Scalable Trusted Computing . ACM , 2011 : 49 - 58 .

DAI W Q , ZOU D Q , et al , TEE:a virtual DRTM based execution environment for secure cloud-end computing [J ] . Future Generation Computer System (FGCS) , 2015 , 49 : 47 - 57 .

DAI W QL , JIN H , ZOU D Q , et al , TEE:a virtual DRTM based execution environment for secure cloud-end computing [C ] // The 17th ACM Conference on Computer and Communications Security (CCS Poster),Hyatt Regency Chicago,IL,USA , 2010 : 663 - 665 .

DAI W Q , PARKER T P , JIN H , et al , Enhancing data trustworthiness via assured digital signing [J ] . IEEE Transactions on Dependable and Secure Computing (TDSC) , 2012 , 9 ( 6 ): 838 - 851 .

浏览量

469

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

面向云环境的虚拟机可信迁移方案

HyperSpector：基于UEFI的VMM动态可信监控基的设计与实现

云计算多授权中心CP-ABE代理重加密方案

容器云中基于信号博弈的容器迁移与蜜罐部署策略

基于FANP的云用户行为信任评估优化机制