基于操作系统多样性的虚拟机安全部署策略

张淼; 季新生; 艾健健; 刘文彦; 扈红超; 霍树民

doi:10.11959/j.issn.2096-109x.2017.00201

您当前的位置：

首页 >

文章列表页 >

基于操作系统多样性的虚拟机安全部署策略

学术论文 | 更新时间：2024-06-03

- 基于操作系统多样性的虚拟机安全部署策略
- Secure deployment strategy of virtual machines based on operating system diversity
- 网络与信息安全学报 2017年3卷第10期页码：35-43
- 作者机构：
- 作者简介：
  
  [ "张淼（1994-），男，湖北孝感人，国家数字交换系统工程技术研究中心硕士生，主要研究方向为网络安全防御。" ]
  [ "季新生（1968-），男，江苏南通人，国家数字交换系统工程技术中心教授、博士生导师，主要研究方向为网络空间安全、拟态安全。" ]
  [ "艾健健（1989-），男，山东广饶人，国家数字交换系统工程技术研究中心博士生，主要研究方向为网络安全、软件定义网络。" ]
  [ "刘文彦（1986-），男，河南鹿邑人，博士，国家数字交换系统工程技术研究中心助理研究员，主要研究方向为网络空间防御和云安全。" ]
  [ "扈红超（1982-），男，河南商丘人，博士，国家数字交换系统工程技术中心副研究员，主要研究方向为网络空间安全、云数据中心。" ]
  [ "霍树民（1985-），山西长治人，博士，国家数字交换系统工程技术研究中心助理研究员，主要研究方向为网络空间安全。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Science Foundation for Distinguished Young Scholars of China(61602509);国家自然科学基金创新研究群体基金资助项目;The Foundation for Innovative Research Groups of the National Natural Science Foundation of China(61521003);国家重点研发计划项目;The National Key R＆D Program of China(2016YFB0800100);国家重点研发计划项目;The National Key R＆D Program of China(2016YFB0800101)
- DOI：10.11959/j.issn.2096-109x.2017.00201
  中图分类号： TP302
- 网络首发：2017-10，
  
  纸质出版：2017-10-15
- 稿件说明：
移动端阅览
张淼, 季新生, 艾健健, 等. 基于操作系统多样性的虚拟机安全部署策略[J]. 网络与信息安全学报, 2017,3(10):35-43.

Miao ZHANG, Xin-sheng JI, Jian-jian AI, et al. Secure deployment strategy of virtual machines based on operating system diversity[J]. Chinese Journal of Network and Information Security, 2017, 3(10): 35-43.
张淼, 季新生, 艾健健, 等. 基于操作系统多样性的虚拟机安全部署策略[J]. 网络与信息安全学报, 2017,3(10):35-43. DOI： 10.11959/j.issn.2096-109x.2017.00201.

Miao ZHANG, Xin-sheng JI, Jian-jian AI, et al. Secure deployment strategy of virtual machines based on operating system diversity[J]. Chinese Journal of Network and Information Security, 2017, 3(10): 35-43. DOI： 10.11959/j.issn.2096-109x.2017.00201.

摘要

云计算的资源共享模式，在极大提高资源利用率的同时，也带来了诸多安全问题，如虚拟机间的共存攻击。特别是当用户使用单一的操作系统时，攻击者可以在较小的开销下，攻破用户的全部虚拟机，从而窃取隐私和数据。针对这一安全威胁，利用不同操作系统漏洞存在差异的特点，提出一种基于操作系统多样性的虚拟机安全部署策略。该方法首先为申请虚拟机的用户推荐一种多样性程度最高的操作系统配置选择；然后通过一种安全的部署策略，最大化地发挥多样性的特点，使攻击者需要付出更大的开销。实验结果表明，与单一操作系统配置的方法相比，该方法至少可以降低33.46%的攻击效益。

Abstract

The resource-sharing model for cloud computing raises many security issues

such as co-resident of virtual machines

while greatly improving resource utilization.In particular

when a user adopts a single operating system

an attacker can steal privacy and data by compromising the user's entire virtual machine at a smaller cost.In view of this security threat

a strategy for the security deployment of virtual machine based on operating system diversity was presented.This method firstly recommended an operating system configuration options for users applying for virtual machines with the highest degree in diversity

and then through the secure deployment strategy

maximized the effect of diversity

thus making the attacker pay more cost.The experimental results show that compared with the method of single operating system

this method can reduce the attack efficiency by 33.46% at least.

关键词

Keywords

references

RISTENPART T , TROMER E , SHACHAM H , et al . Hey,you,get off of my cloud:exploring information leakage in third-party compute clouds [C ] // ACM Conference on Computer and Communications Security . 2009 .

APECECHEA G I , INCI M S , EISENBARTH T , et al . Fine grain cross-VM attacks on Xen and VMware are possible! [J ] . Ecewp.ece.wpi.edu , 2014

OSVIK D A , SHAMIR A , TROMER E . Cache attacks and countermeasures:the case of AES [J ] . Lecture Notes in Computer Science , 2006 ,( 2005 ): 1 - 20 .

YAROM Y , FALKNER K . FLUSH+RELOAD:a high resolution,low noise,L3 cache side-channel attack [C ] // Usenix Conference on Security Symposium . 2014 : 719 - 732 .

ZHANG Y , REITER M K . Düppel:retrofitting commodity operating systems to mitigate cache side channels in the cloud [C ] // ACM Sigsac Conference on Computer ＆ Communications Security . 2013 .

WANG Z , LEE R B . A novel cache architecture with enhanced performance and security [C ] // IEEE/ACM International Symposium on Microarchitecture . 2008 .

MOON S J , SEKAR V , REITER M K . Nomad:mitigating arbitrary cloud side channels via provider-assisted migration [C ] // The 22nd ACM SIGSAC Conference on Computer and Communications Security . 2015 : 1595 - 1606 .

AVIZIENIS A , CHEN L . On the implementation of N-version programming for software fault tolerance during program execution [J ] . Proc of the Compsac , 1977 , 6 ( 1 ): 25 - 37 .

FORREST S , SOMAYAJI A , ACKLEY D . Building diverse computer systems [C ] // The Workshop on Hot Topics in Operating Systems . 1997 : 67 - 72 .

HOFMEYR S A , FORREST S . Architecture for an artificial immune system [J ] . Evolutionary Computation , 2000 , 8 ( 4 ): 443 - 473 .

GASHI I , POPOV P , STRIGINI L . Fault tolerance via diversity for off-the-shelf products:a study with SQL database servers [J ] . IEEE Transactions on Dependable and Secure Computing , 2007 , 4 ( 4 ): 280 - 294 .

NEWELL A , OBENSHAIN D , TANTILLO T , et al . Increasing network resiliency by optimally assigning diverse variants to routing nodes [C ] // IEEE/IFIP International Conference on Dependable Systems and Networks . 2013 .

GARCIA M , BESSANI A , GASHI I , et al . Analysis of operating system diversity for intrusion tolerance [J ] . Software-practice ＆Experience , 2014 , 44 ( 6 ): 735 - 770 .

BATES A , MOOD B , PLETCHER J , et al . Detecting co-residency with active traffic analysis techniques [C ] // The 2012 ACM Workshop on Cloud Computing Security Workshop . 2012

ZHANG Y , JUELS A , OPREA A , et al . HomeAlone:co-residency detection in the cloud via side-channel analysis [C ] // IEEE Symposium on Security and Privacy . 2011 .

ZHANG Y , JUELS A , REITER M K , et al . Cross-VM side channels and their use to extract private keys [C ] // ACM Conference on Computer and Communications Security . 2012

LEINSTER T , COBBOLD C A . Measuring diversity:the importance of species similarity [J ] . Ecology , 2012 , 93 ( 3 ):477.

HAN Y , CHAN J , ALPCAN T , et al . Using virtual machine allocation policies to defend against co-resident attacks in cloud computing [J ] . IEEE Transactions on Dependable ＆ Secure Computing , 2017 , 14 ( 1 ): 95 - 108 .

浏览量

1914

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

NFT图像隐写

容器云中基于Stackelberg博弈的动态异构调度方法

面向SDN的移动目标防御技术研究进展

基于SDN的云安全应用研究综述

可搜索加密的研究进展