云环境面向虚拟域的安全状态一致性保障机制研究

doi:10.11959/j.issn.2096-109x.2016.00103

网络与信息安全学报 ›› 2016, Vol. 2 ›› Issue (10): 48-57.doi: 10.11959/j.issn.2096-109x.2016.00103

云环境面向虚拟域的安全状态一致性保障机制研究

代炜琦(),邹德清,金海,夏妍

华中科技大学计算机科学与技术学院，湖北武汉 430074

修回日期:2016-09-05 出版日期:2016-10-01 发布日期:2020-03-17
作者简介:代炜琦（1984-），男，湖北武汉人，博士，华中科技大学讲师、硕士生导师，主要研究方向为云计算安全、可信计算、虚拟化安全、SDN安全等。|邹德清（1975-），男，湖南长沙人，博士，华中科技大学计算机学院副院长、教授、博士生导师，主要研究方向为虚拟化安全与云安全、网络攻防与漏洞检测、大数据安全、容错计算。|金海（1966-），男，上海人，博士，华中科技大学教授，主要研究方向为高性能计算、分布式计算、云计算、大数据、云安全。|夏妍（1993-），女，辽宁朝阳人，华中科技大学硕士生，主要研究方向为云计算安全、虚拟化安全。
基金资助:
国家自然科学基金资助项目(61602200)

Research on consistency protection mechanism for secure states of virtual domain in cloud environment

Wei-qi DAI(),De-qing ZOU,Hai JIN,Yan XIA

School of Computer Science Technology,Huazhong University of Science and Technology,Wuhan 430074,China

Revised:2016-09-05 Online:2016-10-01 Published:2020-03-17
Supported by:
The National Natural Science Foundation of China(61602200);The Fundamental Research Funds for the Central Universities(HUST2016YXMS087)

摘要/Abstract

摘要：

由于云环境虚拟化特性及高动态性（回滚、迁移等操作）给虚拟域带来了时间、空间状态不一致，从而造成了严重的安全威胁。针对该问题，提出了云环境虚拟域安全基础架构、时间安全状态一致性机制、空间安全状态一致性机制，有效地保障了云虚拟域安全状态的一致性，有助于提高公共服务效率和信息安全可控性。

关键词: 云计算, 可信计算, 虚拟域, 虚拟机回滚, 状态一致性

Abstract:

The traditional trusted computing architecture was suffering from the cloud uncertainty and dynamics caused by VM rollback or migration,which was a fatal threat to the cloud security.following investigations were conducted.Secure cloud virtual domain basic architecture; Time state consistence and collection mechanism.Cyber state consistence and collection mechanism.This study guaranteed security state consistence of virtual domain and improved the security and efficiency of the online service platform for both government institutions and companies.

Key words: cloud computing, trusted computing, virtual domain, virtual machine rollback, state consistency

中图分类号:

TP309.2

代炜琦,邹德清,金海,夏妍. 云环境面向虚拟域的安全状态一致性保障机制研究[J]. 网络与信息安全学报, 2016, 2(10): 48-57.

Wei-qi DAI,De-qing ZOU,Hai JIN,Yan XIA. Research on consistency protection mechanism for secure states of virtual domain in cloud environment[J]. Chinese Journal of Network and Information Security, 2016, 2(10): 48-57.

图/表 7

图1

图2

图3

图4

图5

图6

图7

参考文献 32

[1]	[EB/OL].. 2016.
[2]	SAILER R , ZHANG X , JAEGER T ,et al. Design and implementation of a TCG-based integrity measurement architecture[C]// Proceedings of USENIX Security Symposium. 2004: 223-238.
[3]	MCCUNE J , PARNO B , PERRIG A ,et al. Flicker:an execution infrastructure for TCB minimization[C]// ACM Eurosys’08. 2008: 315-328.
[4]	MCCUNE J , PARNO B , PERRIG A ,et al. Minimal TCB code execution[C]// IEEE Symposium on Security and Privacy (SP’07). 2007: 267-272.
[5]	PEREZ R , SAILER R , DOORN L V . vTPM:virtualizing the trusted platform module[C]// The 15th Conference on USENIX Security Symposium. 2006: 305-320.
[6]	ZHANG F , CHEN J , CHEN H ,et al. Cloudvisor:retrofitting protection of virtual machines in multi-tenant cloud with nested virtualization[C]// ACM SOSP. 2011: 203-216.
[7]	项国富, 金海, 邹德清 ,等. 基于虚拟化的安全监控[J]. 软件学报, 2012,23(8): 2173-2187.
	XIANG G F , JIN H , ZOU D Q ,et al. Virtualization-based security monitoring[J]. Journal of Software, 2012,23(8): 2173-2187.
[8]	CRISWELL J , DAUTENHAHN N , ADVE V . Virtual ghost:protecting applications from hostile operating systems[C]// The 19th International Conference on Architectural Support for Programming Languages and Operating Systems,ASPLOS’14. 2014: 81-96.
[9]	LI Y , MCCUNE J M , NEWSOME J ,et al. MiniBox:a two-way sandbox for x86 native code[C]// 2014 USENIX Annual Technical Conference. 2014.
[10]	MCCUNE J M , LI Y , QU N ,et al. TrustVisor:efficient TCB reduction and attestation[C]// IEEE Symposium on Security and Privacy. 2010: 143-158.
[11]	YEE B , SEHR D , DARDYK G ,et al. Native client:a sandbox for portable,untrusted x86 native code[C]// IEEE Symposium on Security and Privacy. 2009.
[12]	FU M , BASS L , LIU A . Towards a taxonomy of cloud recovery strategies[C]// Dependable Systems and Networks (DSN),2014 44th Annual IEEE/IFIP International Conference on IEEE. 2014: 696-701.
[13]	GARFINKEL T , ROSENBLUM M . When virtual is harder than real:Security challenges in virtual machine based computing environments[C]// Proceedings of HotOS. 2005:20.
[14]	GOLDMAN K , BERGER S . Virtualization-based security monitoring[J]. Journal of Software, 2012,23(8): 2173-2187.
[15]	ENGLAND P , LOSER J . Para-virtualized TPM sharing[C]// The 1st International Conference on Trusted Computing and Trust in Information Technologies:Trusted Computing Challenges and Applications. 2008: 119-132.
[16]	XIA Y , LIU Y , CHEN H ,et al. Defending against vm rollback attack[C]// The 2012 IEEE/IFIP 42nd International Conference on Dependable Systems and Networks Workshops (DSN-W). 2012: 1-5.
[17]	PARNO B , LORCH J R , DOUCEUR J R ,et al. Memoir:practical state continuity for protected modules[C]// The 2011 IEEE Symposium on Security and Privacy. 2011: 379-394.
[18]	YIN H , POOSANKAM P , HANNA S ,et al. Hookscout:proactive binary-centric hook detection,detection of intrusions and malware,and vulnerability assessment[M]. Berlin Heidelberg: SpringerPress, 2010: 1-20.
[19]	CHOW J , LUCCHETTI D , GARFINKEL T ,et al. Multi-stage replay with crosscut[J]. ACM Sigplan Notices, 2010,45(7): 13-24.
[20]	LAGAR-CAVILLA H A , WHITNEY J , SCANNELL A ,et al. Snowflock:rapid virtual machine cloning for cloud computing[C]// The 4th ACM European conference on Computer systems (EuroSys’09). 2009: 1-2.
[21]	PATCHIN P,LAGAR-CAVILLA H A , LARA E D , et al . Adding the easy button to the cloud with snowflock and MPI[C]// The 3rd ACM Workshop on System-level Virtualization for High Performance Computing. ACM, 2009: 1-8.
[22]	CABUK S , DALTON C , RAMASAMY H ,et al. Towards Automated provisioning of secure virtualized networks[C]// The 14th ACM Conference on Computer and Communications Security,Alexandria. Virginia,USA, 2007. 235-245.
[23]	CABUK S , DALTON C I , ERIKSSON K ,et al. Towards automated security policy enforcement in multi-tenant virtual data centers[J]. Journal of Computer Security, 2010,18(1): 89-121
[24]	SCHAEFER M , . If A1 is the answer,what was the question? an edgy naif′s retrospective on promulgating the trusted computer systems evaluation criteria[C]// The 20th Annual Computer Security Applications Conference (CSAC 2004). 2004: 204-228.
[25]	CALERO J M A , EDWARDS N , KIRSCHNICK J ,et al. Toward a multitenancy authorization system for cloud services[J]. IEEE Security & Privacy, 2010,8(6): 48-55.
[26]	BERGER S , CACERES R , PENDARAKIS D ,et al. TVDc:Managing security in the trusted virtual datacenter[J]. ACM SIGOPS Operating Systems Review, 2008,42(1): 40-47.
[27]	GRIFFIN J L , JAEGER T , PEREZ R ,et al. Trusted virtual domains:toward secure distributed services[C]// The 1st IEEE Workshop on Hot Topics in System Dependability. 2005.
[28]	BERGER S , CACERES R , GOLDMAN K ,et al. Security for the cloud infrastructure:Trusted virtual data center implementation[J]. IBM Journal of Research and Development, 2009,53(4): 560-571.
[29]	DAVI L , DMITRIENKO A , KOWALSKI C ,et al. Trusted virtual domains on OKL4:secure information sharing on smart phones[C]// The Sixth ACM Workshop on Scalable Trusted Computing. ACM, 2011: 49-58.
[30]	DAI W Q , ZOU D Q , et al, TEE:a virtual DRTM based execution environment for secure cloud-end computing[J]. Future Generation Computer System (FGCS), 2015,49: 47-57.
[31]	DAI W QL , JIN H , ZOU D Q , et al, TEE:a virtual DRTM based execution environment for secure cloud-end computing[C]// The 17th ACM Conference on Computer and Communications Security (CCS Poster),Hyatt Regency Chicago,IL,USA, 2010: 663-665.
[32]	DAI W Q , PARKER T P , JIN H , et al,Enhancing data trustworthiness via assured digital signing[J]. IEEE Transactions on Dependable and Secure Computing (TDSC), 2012,9(6): 838-851.

云环境面向虚拟域的安全状态一致性保障机制研究

Research on consistency protection mechanism for secure states of virtual domain in cloud environment

在线阅读

pdf下载

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 7

参考文献 32

相关文章 15

Metrics

推荐阅读 0

[1]	李凌书, 邬江兴, 曾威, 刘文彦. 容器云中基于信号博弈的容器迁移与蜜罐部署策略[J]. 网络与信息安全学报, 2022, 8(3): 87-96.
[2]	刘尚, 郭银章. 云计算多授权中心CP-ABE代理重加密方案[J]. 网络与信息安全学报, 2022, 8(3): 176-188.
[3]	张艺, 田立勤, 毋泽南, 武文星. 基于FANP的云用户行为信任评估优化机制[J]. 网络与信息安全学报, 2022, 8(2): 175-182.
[4]	赵波, 袁安琪, 安杨. SGX在可信计算中的应用分析[J]. 网络与信息安全学报, 2021, 7(6): 126-142.
[5]	刘国杰, 张建标, 杨萍, 李铮. 基于TPCM的容器云可信环境研究[J]. 网络与信息安全学报, 2021, 7(4): 164-174.
[6]	刘国杰,张建标. 基于TPCM的服务器可信PXE启动方法[J]. 网络与信息安全学报, 2020, 6(6): 105-111.
[7]	赵波, 李想, 严飞, 张立强, 张焕国. 面向第三方的云平台可信性在线评测及分析技术[J]. 网络与信息安全学报, 2019, 5(5): 90-104.
[8]	吴颖,李璇,金彪,金榕榕. 隐私保护的图像内容检索技术研究综述[J]. 网络与信息安全学报, 2019, 5(4): 14-28.
[9]	李济洋,赵鹏远,刘喆. 基于加密SD卡的内网移动终端可信接入方案[J]. 网络与信息安全学报, 2019, 5(4): 108-118.
[10]	李颖, 马春光. 可搜索加密研究进展综述[J]. 网络与信息安全学报, 2018, 4(7): 13-21.
[11]	于孟洋,林晖,田有亮. 移动云计算中一种新的跨层信誉机制[J]. 网络与信息安全学报, 2018, 4(3): 51-58.
[12]	喻潇,田里,刘喆,王捷. 智能电网PDA终端的密钥管理和认证研究[J]. 网络与信息安全学报, 2018, 4(3): 68-75.
[13]	王元昊,李宏博,崔钰钊,郭庆文,黄琼. 具有密文等值测试功能的公钥加密技术综述[J]. 网络与信息安全学报, 2018, 4(11): 13-22.
[14]	张建标,朱元曦,胡俊,王晓. 面向云环境的虚拟机可信迁移方案[J]. 网络与信息安全学报, 2018, 4(1): 6-14.
[15]	李维奉,羌卫中,李伟明,邹德清. 云环境隐私侵犯取证研究[J]. 网络与信息安全学报, 2018, 4(1): 26-35.