面向多租户的关键虚拟机动态迁移方法研究

doi:10.11959/j.issn.2096-109x.2017.00191

Abstract

Abstract:

A dynamic migration method of critical virtual machines for multi-tenancy was proposed.Firstly,the tenants can set ratio of critical virtual machines according to tenant's security requirements,then the dynamic migration frequency of virtual machines were maximized by the coexistence time constraints between virtual machines,finally the migration cost was minimized as an object function for the virtual machines migrated to further reduce the migration cost.Simulation experiments demonstrate that the proposed approach can reduce the impact on the performance of network services and the cost of virtual machines migration,and is more suitable for large-scale network scenarios under the premise of effective defense side-channel attacks.

Key words: side-channel attacks, critical virtual machines, dynamic migration, migration algorithm, migration cost

CLC Number:

TP302

Shuo ZHAO,Xin-sheng JI,Guo-zhen CHENG,Yu-xing MAO. Research on dynamic migration of critical virtual machines for multi-tenancy[J]. Chinese Journal of Network and Information Security, 2017, 3(8): 8-17.

Figures/Tables 9

References 23

[1]	ZHANG Q , CHENG L , BOUTABA R . Cloud computing:state-ofthe-art and research challenges[J]. Journal of Internet Services and Applications, 2010,1(1): 7-18.
[2]	BUTT S , SRIVASTAVA A , GANAPATHY V . Self-service cloud computing[C]// ACM Conference on Computer and Communications Security. 2015: 253-264.
[3]	JAIN R , PAUL S . Network virtualization and software defined networking for cloud computing:a survey[J]. IEEE Communications Magazine, 2013,51(11): 24-31.
[4]	CHOWDHURY N M M K , BOUTABA R . Network virtualization:state of the art and research challenges[J]. IEEE Communications Magazine, 2009,47(7): 20-26.
[5]	CHOWDHURY N M M K , BOUTABA R . A survey of network virtualization[J]. Computer Networks, 2010,54(5): 862-876.
[6]	FISCHER A , BOTERO J F , TILL B M ,et al. Virtual network embedding:a survey[J]. IEEE Communications Surveys ＆ Tutorials, 2013,15(4): 1888-1906.
[7]	余涛, 毕军, 吴建平 . 未来互联网虚拟化研究[J]. 计算机研究与发展, 2015,52(9): 2069-2082.
	YU T , BI J , WU J P ,et al. Research on the virtualization of future internet[J]. Journal of Computer Research and Development, 2015,52(9): 2069-2082.
[8]	RISTENPART T , TROMER E , SHACHAM H ,et al. Hey,you,get off of my cloud:exploring information leakage in third-party compute clouds[C]// ACM Conference on Computer and Communications Security,CCS 2009,Chicago,Illinois,USA,November. 2009: 199-212.
[9]	GILLANI F , AL-SHAER E , LO S ,et al. Agile virtualized infrastructure to proactively defend against cybe attacks[C]// 2015 IEEE Conference on Computer Communications. 2015: 729-737.
[10]	张玉清, 王晓菲, 刘雪峰 ,等. 云计算环境安全综述[J]. 软件学报, 2016,27(6): 1328-1348.
	ZHANGY Y Q , WANG X F , LIU X F ,et al. Survey on cloud computing security[J]. Journal of Software, 2016,27(6): 1328-1348.
[11]	WU Z , XU Z , WANG H . Whispers in the Hyper-space:high-speed covert channel attacks in the cloud[C]// USENIX Security symposium. 2012: 159-173.
[12]	IRAZOQUI G , EISENBARTH T , SUNAR B . S$A:a shared cache attack that works across cores and defies VM sandboxing-and its application to AES[C]// IEEE Symposium on Security ＆ Privacy. 2015: 591-604.
[13]	ZHANG Y , LI M , BAI K ,et al. Incentive compatible moving target defense against vm-colocation attacks in clouds[C]// IFIP International Information Security Conference. 2012: 388-399.
[14]	LI P , GAO D , REITER M K . Stopwatch:a cloud architecture for timing channel mitigation[J]. ACM Transactions on Information and System Security (TISSEC), 2014,17(2): 1-28.
[15]	ZHANG Y , REITER M K . Düppel:retrofitting commodity operating systems to mitigate cache side channels in the cloud[C]// ACM Sigsac Conference on Computer ＆ Communications Security. 2013: 827-838.
[16]	PATTUK E , KANTARCIOGLU M , LIN Z ,et al. Preventing cryptographic key leakage in cloud virtual machines[C]// The 23rd USENIX Security Symposium (USENIX Security 14). 2014: 703-718.
[17]	GILLANI F , AL-SHAER E , LO S ,et al. Agile virtualized infrastructure to proactively defend against cyber attacks[C]// Computer Communications. 2015: 729-737.
[18]	WANG Y , CHAU P , CHEN F . A framework for security-aware virtual network embedding[C]// 2015 24th International Conference on Computer Communication and Networks (ICCCN). 2015: 1-7.
[19]	HAN Y , ALPCAN T , CHAN J ,et al. Security games for virtual machine allocation in cloud computing[C]// International Conference on Decision and Game Theory for Security. 2013: 99-118.
[20]	MOON S J , SEKAR V , REITER M K . Nomad:mitigating arbitrary cloud side channels via provider-assisted migration[C]// The 22nd ACM SIGSAC Conference on Computer and Communications Security. 2015: 1595-1606.
[21]	LIU F , YAROM Y , GE Q ,et al. Last-level cache side-channel attacks are practical[C]// 2015 IEEE Symposium on Security and Privacy (SP). 2015: 605-622.
[22]	SUZAKI K , IIJIMA K , YAGI T ,et al. Memory deduplication as a threat to the guest OS[C]// The Fourth European Workshop on System Security. 2011: 1-6.
[23]	OWENS R , WANG W . Non-interactive OS fingerprinting through memory de-duplication technique in virtual machines[C]// 2011 IEEE 30th International Performance Computing and Communications Conference (IPCCC). 2011: 1-8.

Metrics

Recommended 0

No Suggested Reading articles found!

符号	含义
K	信息泄露速率
Γ	共存的时间间隔数量
ε	最小的时间间隔

Research on dynamic migration of critical virtual machines for multi-tenancy

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 9

References 23

Related Articles 13

Metrics

Recommended 0

[1]	Jin CAO, Xiaoping SHI, Ruhui MA, Hui LI. Fusion of satellite-ground and inter-satellite AKA protocols for double-layer satellite networks [J]. Chinese Journal of Network and Information Security, 2023, 9(1): 18-31.
[2]	Rongna XIE, Xiaonan FAN, Lin YUAN, Zichen GUO, Jiayu ZHU, Guozhen SHI. Research on extended access control mechanism in online social network [J]. Chinese Journal of Network and Information Security, 2021, 7(5): 123-131.
[3]	Yukun NIU,Lingbo WEI,Chi ZHANG,Xia ZHANG,Vejarano Gustavo. Privacy-preserving access control for public wireless LAN utilizing the bitcoin blockchain [J]. Chinese Journal of Network and Information Security, 2020, 6(2): 56-66.
[4]	WENG Jian,WEI Linfeng,ZHANG Yue. Discussion on the cultivation of cyber security talents [J]. Chinese Journal of Network and Information Security, 2019, 5(3): 44-53.
[5]	Lei SUN,Shuai LI,Songhui GUO. Modeling the interrupt transmission process of SR-IOV cryptographic device [J]. Chinese Journal of Network and Information Security, 2019, 5(1): 56-65.
[6]	Delei NIE,Obo ZHA,Chong WANG,Xin WANG,Binghao YAN. Timeout threshold estimation algorithm in mimic multiple executors architecture [J]. Chinese Journal of Network and Information Security, 2018, 4(10): 68-76.
[7]	Qiuhan WU,Wei HU. Design of identity authentication agreement in mobile terminal based on SM2 algorithm and blockchain [J]. Chinese Journal of Network and Information Security, 2018, 4(9): 60-65.
[8]	Yang CHEN,Hongchao HU,Wenyan LIU,Shumin HUO,Hao LIANG. Dynamic and heterogeneous Byzantine system in cloud [J]. Chinese Journal of Network and Information Security, 2018, 4(5): 1-9.
[9]	Danjun LIU,Guilin CAI,Baosheng WANG. AMTD:a way of adaptive moving target defense [J]. Chinese Journal of Network and Information Security, 2018, 4(1): 15-25.
[10]	Jianbiao ZHANG,Yuanxi ZHU,Jun HU,Xiao WANG. Scheme of virtual machine trusted migration in cloud environment [J]. Chinese Journal of Network and Information Security, 2018, 4(1): 6-14.
[11]	Miao ZHANG,Xin-sheng JI,Jian-jian AI,Wen-yan LIU,Hong-chao HU,Shu-min HUO. Secure deployment strategy of virtual machines based on operating system diversity [J]. Chinese Journal of Network and Information Security, 2017, 3(10): 35-43.
[12]	Kai ZHOU,Chang-gen PENG,Yi-jie ZHU,Jian-qiong HE. Homomorphic encryption location privacy-preserving scheme based on Markov model [J]. Chinese Journal of Network and Information Security, 2017, 3(1): 54-60.
[13]	Bing-wen FENG,Jian WENG,Wei LU. Research on outsourcing of digital image forensics based on privacy preserving [J]. Chinese Journal of Network and Information Security, 2016, 2(8): 23-31.