面向多租户的关键虚拟机动态迁移方法研究

赵硕; 季新生; 程国振; 毛宇星

doi:10.11959/j.issn.2096-109x.2017.00191

您当前的位置：

首页 >

文章列表页 >

面向多租户的关键虚拟机动态迁移方法研究

学术论文 | 更新时间：2024-06-03

- 面向多租户的关键虚拟机动态迁移方法研究
- Research on dynamic migration of critical virtual machines for multi-tenancy
- 网络与信息安全学报 2017年3卷第8期页码：8-17
- 作者机构：
  
  1. 国家数字交换系统工程技术研究中心，河南郑州 450002
  2. 解放军理工大学指挥信息系统学院，江苏南京 210007
- 作者简介：
  
  [ "赵硕（1993-），男，河南安阳人，国家数字交换系统工程技术中心硕士生，主要研究方向为虚拟网安全、软件定义网络。" ]
  [ "季新生（1968-），男，江苏南通人，国家数字交换系统工程技术中心教授、博士生导师，主要研究方向为网络空间安全、拟态安全。" ]
  [ "程国振（1986-），男，山东定陶人，国家数字交换系统工程技术中心助理研究员，主要研究方向为网络空间安全、软件定义网络。" ]
  [ "毛宇星（1989-），男，河北唐山人，解放军理工大学博士生，主要研究方向为网络空间安全、软件定义网络。" ]
- 基金信息：
  
  国家自然科学基金创新研究群体基金资助项目;The Foundation for Innovative Research Groups of the National Natural Science Foundation of China(61521003);信息工程大学新兴方向培育基金资助项目;The Emerging Direction Nurturing Foundation in Information Engineering University(2016610708);国家重点研发计划项目;The National Key R＆D Program of China(2016YFB0800100);国家重点研发计划项目;The National Key R＆D Program of China(2016YFB0800101);河南省科技攻关计划项目;The Science and Technology Research Project of Henan Province(172102210615);国家自然科学基金资助项目;The National Science Foundation for Distinguished Young Scholars of China(61602509)
- DOI：10.11959/j.issn.2096-109x.2017.00191
  中图分类号： TP302
- 网络首发：2017-08，
  
  纸质出版：2017-08-15
- 稿件说明：
移动端阅览
赵硕, 季新生, 程国振, 等. 面向多租户的关键虚拟机动态迁移方法研究[J]. 网络与信息安全学报, 2017,3(8):8-17.

Shuo ZHAO, Xin-sheng JI, Guo-zhen CHENG, et al. Research on dynamic migration of critical virtual machines for multi-tenancy[J]. Chinese Journal of Network and Information Security, 2017, 3(8): 8-17.
赵硕, 季新生, 程国振, 等. 面向多租户的关键虚拟机动态迁移方法研究[J]. 网络与信息安全学报, 2017,3(8):8-17. DOI： 10.11959/j.issn.2096-109x.2017.00191.

Shuo ZHAO, Xin-sheng JI, Guo-zhen CHENG, et al. Research on dynamic migration of critical virtual machines for multi-tenancy[J]. Chinese Journal of Network and Information Security, 2017, 3(8): 8-17. DOI： 10.11959/j.issn.2096-109x.2017.00191.

摘要

提出一种面向多租户的关键虚拟机动态迁移方法。首先，根据租户对虚拟机的安全需求设定关键虚拟机的比例，减少虚拟机动态迁移的数量；然后，通过虚拟机之间共存时间约束条件最大化降低虚拟机动态迁移的频率；最后，以最小化迁移开销作为虚拟机迁移的目标函数，进一步降低虚拟机迁移带来的开销。实验表明，与现有的防御方法相比，该方法在有效防御侧信道攻击的前提下，能够减少对网络服务性能的影响，降低虚拟机迁移的成本，更加适用于大规模的网络场景。

Abstract

A dynamic migration method of critical virtual machines for multi-tenancy was proposed.Firstly

the tenants can set ratio of critical virtual machines according to tenant's security requirements

then the dynamic migration frequency of virtual machines were maximized by the coexistence time constraints between virtual machines

finally the migration cost was minimized as an object function for the virtual machines migrated to further reduce the migration cost.Simulation experiments demonstrate that the proposed approach can reduce the impact on the performance of network services and the cost of virtual machines migration

and is more suitable for large-scale network scenarios under the premise of effective defense side-channel attacks.

关键词

Keywords

references

ZHANG Q , CHENG L , BOUTABA R . Cloud computing:state-ofthe-art and research challenges [J ] . Journal of Internet Services and Applications , 2010 , 1 ( 1 ): 7 - 18 .

BUTT S , SRIVASTAVA A , GANAPATHY V . Self-service cloud computing [C ] // ACM Conference on Computer and Communications Security . 2015 : 253 - 264 .

JAIN R , PAUL S . Network virtualization and software defined networking for cloud computing:a survey [J ] . IEEE Communications Magazine , 2013 , 51 ( 11 ): 24 - 31 .

CHOWDHURY N M M K , BOUTABA R . Network virtualization:state of the art and research challenges [J ] . IEEE Communications Magazine , 2009 , 47 ( 7 ): 20 - 26 .

CHOWDHURY N M M K , BOUTABA R . A survey of network virtualization [J ] . Computer Networks , 2010 , 54 ( 5 ): 862 - 876 .

FISCHER A , BOTERO J F , TILL B M , et al . Virtual network embedding:a survey [J ] . IEEE Communications Surveys ＆ Tutorials , 2013 , 15 ( 4 ): 1888 - 1906 .

余涛 , 毕军 , 吴建平 . 未来互联网虚拟化研究 [J ] . 计算机研究与发展 , 2015 , 52 ( 9 ): 2069 - 2082 .

YU T , BI J , WU J P , et al . Research on the virtualization of future internet [J ] . Journal of Computer Research and Development , 2015 , 52 ( 9 ): 2069 - 2082 .

RISTENPART T , TROMER E , SHACHAM H , et al . Hey,you,get off of my cloud:exploring information leakage in third-party compute clouds [C ] // ACM Conference on Computer and Communications Security,CCS 2009,Chicago,Illinois,USA,November . 2009 : 199 - 212 .

GILLANI F , AL-SHAER E , LO S , et al . Agile virtualized infrastructure to proactively defend against cybe attacks [C ] // 2015 IEEE Conference on Computer Communications . 2015 : 729 - 737 .

张玉清 , 王晓菲 , 刘雪峰 , 等 . 云计算环境安全综述 [J ] . 软件学报 , 2016 , 27 ( 6 ): 1328 - 1348 .

ZHANGY Y Q , WANG X F , LIU X F , et al . Survey on cloud computing security [J ] . Journal of Software , 2016 , 27 ( 6 ): 1328 - 1348 .

WU Z , XU Z , WANG H . Whispers in the Hyper-space:high-speed covert channel attacks in the cloud [C ] // USENIX Security symposium . 2012 : 159 - 173 .

IRAZOQUI G , EISENBARTH T , SUNAR B . S$A:a shared cache attack that works across cores and defies VM sandboxing-and its application to AES [C ] // IEEE Symposium on Security ＆ Privacy . 2015 : 591 - 604 .

ZHANG Y , LI M , BAI K , et al . Incentive compatible moving target defense against vm-colocation attacks in clouds [C ] // IFIP International Information Security Conference . 2012 : 388 - 399 .

LI P , GAO D , REITER M K . Stopwatch:a cloud architecture for timing channel mitigation [J ] . ACM Transactions on Information and System Security (TISSEC) , 2014 , 17 ( 2 ): 1 - 28 .

ZHANG Y , REITER M K . Düppel:retrofitting commodity operating systems to mitigate cache side channels in the cloud [C ] // ACM Sigsac Conference on Computer ＆ Communications Security . 2013 : 827 - 838 .

PATTUK E , KANTARCIOGLU M , LIN Z , et al . Preventing cryptographic key leakage in cloud virtual machines [C ] // The 23rd USENIX Security Symposium (USENIX Security 14) . 2014 : 703 - 718 .

GILLANI F , AL-SHAER E , LO S , et al . Agile virtualized infrastructure to proactively defend against cyber attacks [C ] // Computer Communications . 2015 : 729 - 737 .

WANG Y , CHAU P , CHEN F . A framework for security-aware virtual network embedding [C ] // 2015 24th International Conference on Computer Communication and Networks (ICCCN) . 2015 : 1 - 7 .

HAN Y , ALPCAN T , CHAN J , et al . Security games for virtual machine allocation in cloud computing [C ] // International Conference on Decision and Game Theory for Security . 2013 : 99 - 118 .

MOON S J , SEKAR V , REITER M K . Nomad:mitigating arbitrary cloud side channels via provider-assisted migration [C ] // The 22nd ACM SIGSAC Conference on Computer and Communications Security . 2015 : 1595 - 1606 .

LIU F , YAROM Y , GE Q , et al . Last-level cache side-channel attacks are practical [C ] // 2015 IEEE Symposium on Security and Privacy (SP) . 2015 : 605 - 622 .

SUZAKI K , IIJIMA K , YAGI T , et al . Memory deduplication as a threat to the guest OS [C ] // The Fourth European Workshop on System Security . 2011 : 1 - 6 .

OWENS R , WANG W . Non-interactive OS fingerprinting through memory de-duplication technique in virtual machines [C ] // 2011 IEEE 30th International Performance Computing and Communications Conference (IPCCC) . 2011 : 1 - 8 .

浏览量

1149

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据