基于改进期望值决策法的虚拟机可信审计方法

doi:10.11959/j.issn.1000-436x.2018110

Abstract

Abstract:

Whether the cloud computing environment is credible is the key factor in the promotion and effective use of cloud computing.For this reason,the expected value decision method in risk decision-making was improved.The usage scenarios was redefined,the cost and benefit of audit scheme was digitized,and a virtual machine trusted auditing strategy based on improved expectation decision method was proposed.Several levels of security protection for the user virtual machine was provided,and the optimal audit scheme was selected autonomously according to the security protection level chosen by the user for the virtual machine.The virtual machine introspection (VMI) technology was used to obtain the virtual machine information that needs to be audited.The designed encryption mechanism was used to protect the security of users selected security protection level,so as to ensure the security of user virtual machine selection audit strategy.Finally,the simulation results show that the scheme has good performance and validity.

Key words: trusted auditing, trusted computing, risk decision method, virtual machine introspection

CLC Number:

TP309

Junfeng TIAN,Yongchao ZHANG. Trusted auditing method of virtual machine based on improved expectation decision method[J]. Journal on Communications, 2018, 39(6): 52-63.

Figures/Tables 13

References 26

[1]	ALI M , KHAN S U , VASILAKOS A V . Security in cloud computing:opportunities and challenges[J]. Information Sciences, 2015,305: 357-383.
[2]	ABDELBAKI N , RADWAN T , AZER M A . Cloud computing security:challenges and future trends[J]. International Journal of Computer Applications in Technology, 2017,55(2):158.
[3]	KO R K L , JAGADPRAMANA P , MOWBRAY M ,et al. TrustCloud:a framework for accountability and trust in cloud computing[C]// IEEE World Congress on Services. 2011: 584-588.
[4]	KHALIL I , KHREISHAH A , AZEEM M . Cloud computing security:a survey[J]. Computers, 2014,3(1): 1-35.
[5]	KATZ G , ELOVICI Y , SHAPIRA B . CoBAn:a context based model for data leakage prevention[J]. Information Sciences, 2014,262(3): 137-158.
[6]	JANSEN W , GRANCE T . Guidelines on security and privacy in public cloud computing[J]. Journal of E-Governance, 2011,34(3): 149-151.
[7]	赵新泉, 彭勇行 . 管理决策分析[M]. 北京: 科学出版社, 2008.
	ZHANG X Q , PENG Y X . Management decision analysis[M]. Beijing: Science PressPress, 2008.
[8]	MICHAEL J B . Trusted computing:an elusive goal[J]. Computer, 2015,48(3): 99-101.
[9]	BERGER S , GOLDMAN K A , PEREZ R ,et al. vTPM:virtualizing the trusted platform module[C]// Conference on Usenix Security Symposium. 2006:21.
[10]	刘川意, 王国峰, 林杰 ,等. 可信的云计算运行环境构建和审计[J]. 计算机学报, 2016,39(2): 339-350.
	LIU C Y , WANG G F , LIN J ,et al. Practical construction and audit for trusted cloud execution environment[J]. Chinese Journal of Computers, 2016,39(2): 339-350.
[11]	KURSAWE K , SCHELLEKENS D . Flexible muTPMs through disembedding[C]// ACM Symposium on Information,Computer and Communications Security. 2009: 116-124.
[12]	STUMPF F , ECKERT C . Enhancing trusted platform modules with hardware-based virtualization techniques[C]// Second International Conference on Emerging Security Information,Systems and Technologies. 2008: 1-9.
[13]	ENGLAND P , LOESER J . Para-virtualized TPM sharing[C]// International Conference on Trusted Computing and Trust in Information Technologies:Trusted Computing-Challenges and Applications. 2008: 119-132.
[14]	林杰, 刘川意, 方滨兴 . IVirt:基于虚拟机自省的运行环境完整性度量机制[J]. 计算机学报, 2015,38(1): 191-203.
	LIN J , LIU C Y , FANG B X . IVirt:runtime environment integrity measurement mechanism based on virtual machine introspection[J]. Chinese Journal of Computers, 2015,38(1): 191-203.
[15]	SAILER R , ZHANG X , JAEGER T ,et al. Design and implementation of a TCG-based integrity measurement architecture[C]// Conference on Usenix Security Symposium. 2004:16.
[16]	杜瑞忠, 王少泫, 田俊峰 . 基于封闭环境加密的云存储方案[J]. 通信学报, 2017,38(7): 1-10.
	DU R Z , WANG S X , TIAN J F . Cloud storage scheme based on closed-box encryption[J]. Journal on Communications, 2017,38(7): 1-10.
[17]	郭晓勇, 付安民, 况博裕 ,等. 基于收敛加密的云安全去重与完整性审计系统[J]. 通信学报, 2017,38(S2): 156-163.
	GUO X Y , FU A M , KUANG B Y ,et al. Secure deduplication and integrity audit system based on convergent encryption for cloud storage[J]. Journal on Communications, 2017,38(S2): 156-163.
[18]	王惠峰, 李战怀, 张晓 ,等. 云存储中数据完整性自适应审计方法[J]. 计算机研究与发展, 2017,54(1): 172-183.
	WANG H F , LI Z H , ZHANG X ,et al. A self-adaptive audit method of data integrity in the cloud storage[J]. Journal of Computer Research and Development, 2017,54(1): 172-183.
[19]	KOLHAR M ABU-ALHAJ M M EL-ATTY S M A . Cloud data auditing techniques with a focus on privacy and security[J]. IEEE Security ＆ Privacy, 2017,15(1): 42-51.
[20]	RODRIGUEZ A , ORTEGA P , CONCEPCION R . An intuitionistic method for the selection of a risk management approach to information technology projects[J]. Information Sciences, 2017,375: 202-218.
[21]	张玉清, 王晓菲, 刘雪峰 . 云计算环境安全综述[J]. 软件学报, 2016,27(6): 1328-1348.
	ZHANG Y Q , WANG X F , LIU X F . Survey on cloud computing security[J]. Journal of Software, 2016,27(6): 1328-1348.
[22]	叶厚元 . 统计学原理与分析[M]. 武汉: 武汉理工大学出版社, 2012.
	YE H Y . Statistical principle and analysis[M]. Wuhan: University of Technology PressPress, 2012.
[23]	李保珲, 徐克付, 张鹏 . 虚拟机自省技术研究与应用进展[J]. 软件学报, 2016,27(6): 1384-1401.
	LI B H , XU K F , ZHANG P . Research and application progress of virtual machine introspection technology[J]. Journal of Software, 2016,27(6): 1384-1401.
[24]	YU P , XIA M , LIN Q ,et al. Real-time enhancement for Xen hypervisor[C]// IEEE. 2010.
[25]	HOLIK F , HORALEK J , MARIK O ,et al. Effective penetration testing with metasploit framework and methodologies[C]// IEEE,International Symposium on Computational Intelligence and Informatics. 2015: 237-242.
[26]	ABBOTT M L , FISHER M T . The art of scalability:scalable Web architecture,processes,and organizations for the modern enterprise[M]. Addison-Wesley Professional. 2009.

Metrics

Recommended 0

No Suggested Reading articles found!

配置项	物理服务器	虚拟机
CPU	Intel Xeon X5650 2.66 GHz	Intel Xeon X5650
	单个6核，共24核	2.66 GHz
内存	单个8 GB，共32 GB	4 GB
缓存	12 MB	4 MB
硬盘容量	1 TB	30 GB

审计策略	内存资源	CPU资源	平均值cost(b_i)
b₁	3.10%	3.30%	3.20%
b₂	3.00%	3.10%	3.05%
b₃	3.30%	3.20%	3.25%
b₄	2.90%	2.80%	2.85%
b₅	3.20%	3.30%	3.25%

安全保护级别θ			收益值
安全保护级别θ	b₁	b₂	b₃	b₄	b₅
底限级	1.00	0.33	0.11	0.04	0.04
低级	3.00	0.33	0.33	0.04	0.04
中级	3.00	1.00	0.33	0.11	0.04
高级	3.00	1.00	0.33	0.11	0.11
顶级	3.00	1.00	1.00	0.11	0.33

安全保护级别θ	发生的概率	方案B₂	方案B₃	方案B₅	方案B₆	方案B₇
底限级	0.054	4.44	2.37	4.48	4.48	2.41
低级	0.244	6.66	4.37	6.70	6.70	4.41
中级	0.404	7.33	5.11	7.44	7.37	5.15
高级	0.244	7.33	5.11	7.44	7.44	5.22
顶级	0.054	8.00	5.11	8.11	8.33	5.44

名称	功能描述
IOZone	IOZone 是一个 benchmark 工具用于文件系统，可以测试多种操作系统中文件系统的读写能力
ByteMark	ByteMark利用多种计算密集型任务的算法，可以测试系统的处理器、高速缓存以及协处理器性能
PostMark	Postmark用于测试存储系统的存储性能，主要针对进行频繁、大量存取小文件的存储系统。原理：构建一个测试文件池，然后进行事务的初始化，对每一个事务中读取/附加，创建/删除等所占的比例进行设置来模拟真实应用场景

Trusted auditing method of virtual machine based on improved expectation decision method

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 13

References 26

Related Articles 15

Metrics

Recommended 0

[1]	Xinfeng HE,Junfeng TIAN,Fanming LIU. Survey on trusted cloud platform technology [J]. Journal on Communications, 2019, 40(2): 154-163.
[2]	Junfeng TIAN,Tianle LI. Data integrity verification based on model cloud federation of TPA [J]. Journal on Communications, 2018, 39(8): 113-124.
[3]	Liang TAN,Neng QI,Lingbi HU. New extension method of trusted certificate chain in virtual platform environment [J]. Journal on Communications, 2018, 39(6): 133-145.
[4]	Xingshu CHEN,Wei WANG,Xin JIN. Label-based protection scheme of vTPM secret [J]. Journal on Communications, 2018, 39(11): 170-180.
[5]	Tian-shu WANG,Gong-xuan ZHANG,Xi-chen YANG. Trusted solution monitoring system based on ZigBee wireless sensor network [J]. Journal on Communications, 2017, 38(Z2): 67-77.
[6]	Lei WANG,Ming-hua YANG,Zeng-liang LIU,Jian-qun ZHENG. Trust chain generating and updating algorithm for dual redundancy system [J]. Journal on Communications, 2017, 38(1): 1-8.
[7]	Chao-yuan CUI,Yun WU,Ping LI,Xiao-ming ZHANG. Narrowing the semantic gap in virtual machine introspection [J]. Journal on Communications, 2015, 36(8): 31-37.
[8]	Wei FENG,Yu QIN,Deng-guo FENG,Bo YANG,Ying-jun ZHANG. Design and implementation of secure Windows platform based on TCM [J]. Journal on Communications, 2015, 36(8): 91-103.
[9]	. Research of a trusted execution environment module for multiple platforms [J]. Journal on Communications, 2014, 35(Z2): 11-85.
[10]	. Trusted virtual machine management model for cloud computing [J]. Journal on Communications, 2014, 35(Z2): 13-105.
[11]	Qian-ying ZHANG,Shi-jun ZHAO,Wei FENG,Yu QIN,Deng-guo FENG. Research of a trusted execution environment module for multiple platforms [J]. Journal on Communications, 2014, 35(Z2): 72-85.
[12]	Zhen-ji ZHOU,Li-fa WU,Zheng HONG,Hai-guang LAI,Cheng-hui ZHENG. Trusted virtual machine management model for cloud computing [J]. Journal on Communications, 2014, 35(Z2): 94-105.
[13]	Qian-ying ZHANG,Deng-guo FENG,Shi-jun ZHAO. Research of platform identity attestation based on trusted chip [J]. Journal on Communications, 2014, 35(8): 94-106.
[14]	. Research of platform identity attestation based on trusted chip [J]. Journal on Communications, 2014, 35(8): 13-106.
[15]	Yue-lei XIAO,Yu-min WANG,Liao-jun PANG,Shi-chong TAN. WLAN Mesh security association scheme in trusted computing environment [J]. Journal on Communications, 2014, 35(7): 94-103.