基于数字证书的openstack身份认证协议

doi:10.11959/j.issn.1000-436x.2019030

Abstract

Abstract:

As the industry standard for open source cloud platforms,openstack uses the single-factor authentication method based on username and password that provides by keystone components to identity authentication mechanism,while it is not suitable for application scenarios with high security level requirements.A digital certificate-based identity authentication protocol which had cloud user identification protocol and authentication protocol was designed to meet the requirements.With expending the keystone component to achieve a digital certificate-based identity authentication system,a combination of authentication server,UKey technology,encryption technology and well-established key management and so on was used.According to the research,the system can effectively resist multiple cyber-attacks and improve the security of cloud users when they log in to the cloud platform.

Key words: cloud computing, digital certificate, authentication system, authentication protocol

CLC Number:

TP309

Zhiqiang ZHU,Renhao LIN,Cuiyun HU. Openstack authentication protocol based on digital certificate[J]. Journal on Communications, 2019, 40(2): 188-196.

Figures/Tables 11

References 16

[1]	王斌锋, 苏金树, 陈琳 . 云计算数据中心网络设计综述[J]. 计算机研究与发展, 2016,53(9): 2085-2106.
	WANG B F , SU J S , CHEN L . Overview of cloud computing data center network design[J]. Computer Research and Development, 2016,53(9): 2085-2106.
[2]	张玉清, 王晓菲, 刘雪峰 ,等. 云计算环境安全综述[J]. 软件学报, 2016,27(6): 1328-1348.
	ZHANG Y Q , WANG X F , LIU X F ,et al. Survey on cloud computing security[J]. Journal of Software, 2016,27(6): 1328-1348.
[3]	HARN L , REN J . Generalized digital certificate for user authentication and key establishment for secure communications[J]. IEEE Transactions on Wireless Communications, 2011,10(7): 2372-2379.
[4]	WEN X , GU G , LI Q ,et al. Comparison of open-source cloud manegement platforms:openstack and OpenNebula[C]// IEEE Fuzzy Systems and Knowledge Discovery. 2012: 2457-2461.
[5]	SEFRAOUI O , AISSAOUI M , ELEULDJ M . openstack:toward an open-source solution for cloud computing[J]. International Journal of Computer Applications, 2012,55(3): 38-42.
[6]	KHAN R H , YLITALO J , AHMED A S . Openid authentication as a service in openstack[C]// The 7th International Conference on Information Assurance and Security. 2011: 372-377.
[7]	MARTINELLI S , NASH H , TOPOL B . Identity,authentication,and access management in openstack:implementing and deploying keystone[M]. O’Reilly Media, 2015.
[8]	ABDULLA N , ER?ELEBI E , . Identify cloud security weakness related to authentication and identity management (IAM) using openstack keystone model[C]// International Conference on Engineering and Technology,Computer,Basics and Applied Sciences. 2017: 1-5.
[9]	COOPER J D . Analysis of security in cloud platforms using openstack as case study[D]. AGDER:The University of AGDER Faculty of Engineering and Science, 2013.
[10]	TORKURA K A , CHENG F , MEINEL C . Application of quantitative security metrics in cloud computing[J]. Internet Technology ＆ Secured Transactions, 2015: 256-262.
[11]	WOO S W , JOH H C , ALHAZMI O H ,et al. Modeling vulnerability discovery process in apache and iis http servers[J]. Computers ＆ Security, 2011,30(1): 50-62.
[12]	SITARAM D , HARWALKAR S , SIMHA U ,et al. standards based integration of advanced key management capabilities with openstack[C]// IEEE International Conference on Cloud Computing in Emerging Markets. 2016：98-103.
[13]	王帅, 常朝稳, 魏彦芬 . 基于云计算的 USB Key 身份认证方案[J]. 计算机应用研究, 2014,31(7): 2130-2134.
	WANG S , CHANG C W , WEI Y F . USB key authentication scheme based on cloud computing[J]. Computer Application Research, 2014,31(7): 2130-2134.
[14]	李鹏坤, 王小峰, 苏金树 ,等. 基于标识密码的数据报传输层安全协议[J]. 软件学报, 2017,28(2): 90-97.
	LI P K , WANG X F , SU J S ,et al. Datagram transport layer security protocol based on identity cipher[J]. Journal of Software, 2017,28(2): 90-97.
[15]	周长春, 田晓丽, 张宁 ,等. 云计算中身份认证技术研究[J]. 计算机科学, 2016,43(6A): 339-341.
	ZHOU C C , TIAN X L , ZHANG N ,et al. Research on identity authentication technology in cloud computing[J]. Computer Science, 2016,43(6A): 339-341.
[16]	CUI B , XI T . Security analysis of openstack keystone[C]// International Conference on Innovative Mobile ＆ Internet Services in Ubiquitous Computing. 2015: 283-288.

Metrics

Recommended 0

No Suggested Reading articles found!

符号	描述
C	客户端
MT	管理员终端
AS	密码认证服务器
KS	keystone服务器
CS	证书分发服务器
ID	用户身份标识
P	用户PIN码
Dm	域名
\|\|	字符串连接符
A→B：M	节点A向节点B发送消息^*
E(.)	加密操作
H(.)	散列操作
Cer	数字证书
K	密钥
UK	公钥
RK	私钥
SK	共享密钥
SC	签名消息SC：包含随机数N_R、时间戳T₀和接受者信息M_R
T	令牌

对比项	基于UUID token的认证协议	基于PKI token的认证协议	文献[10]协议	文献[15]协议	文献[16]协议	本文协议
加密技术	无	非对称加密	无	Hash加密	对称加密/非对称加密	对称加密/非对称加密/Hash加密
双因素认证	否	否	否	否	否	是
密钥管理安全性	低	低	低	低	低	高
抗重放攻击	否	否	否	否	是	是
抗中间人攻击	否	否	否	否	是	是
抗DoS攻击	否	否	否	否	否	是
协议效率	高	低	高	中	低	低
认证组件负载	中	中	中	中	高	高

Openstack authentication protocol based on digital certificate

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 11

References 16

Related Articles 15

Metrics

Recommended 0

[1]	Ling MA, Qiliang FAN, Ting XU, Guanchen GUO, Shenglin ZHANG, Yongqian SUN, Yuzhi ZHANG. Scheduling framework based on reinforcement learning in online-offline colocated cloud environment [J]. Journal on Communications, 2023, 44(6): 90-102.
[2]	Huaqun WANG, Zhe LIU, Debiao HE, Jiguo LI. Identity-based provable data possession scheme for multi-source IoT terminal data in public cloud [J]. Journal on Communications, 2021, 42(7): 52-60.
[3]	Jianhong ZHANG, Menglong WU, Jing WANG, Pei LIU, Zhengtao JIANG, Changgen PENG. Secure and verifiable multi-keyword searchable encryption scheme in cloud [J]. Journal on Communications, 2021, 42(4): 139-149.
[4]	Ruiqi LI, Chunfu JIA, Yafei WANG. Multi-key homomorphic proxy re-encryption scheme based on NTRU and its application [J]. Journal on Communications, 2021, 42(3): 11-22.
[5]	Xiangmao CHANG, Jun ZHAN, Zhiwei WANG. Low-cost group-based identity security authentication protocol for NB-IoT nodes [J]. Journal on Communications, 2021, 42(12): 152-162.
[6]	Jiawei ZHANG, Jianfeng MA, Zhuo MA, Teng LI. Time-based and privacy protection revocable and traceable data sharing scheme in cloud computing [J]. Journal on Communications, 2021, 42(10): 81-94.
[7]	Wenjuan WANG, Xuehui DU, Dibin SHAN. Construction method of attack scenario in cloud environment based on dynamic probabilistic attack graph [J]. Journal on Communications, 2021, 42(1): 1-17.
[8]	Youliang TIAN,Qin LUO. Verifiable multi-keyword search scheme based on improved Merkle-Tree authentication method [J]. Journal on Communications, 2020, 41(9): 118-129.
[9]	Na WANG,Kun ZHENG,Junsong FU,Jian LI. Method of ciphertext retrieval in mobile edge computing based on block segmentation [J]. Journal on Communications, 2020, 41(7): 95-102.
[10]	Lindong ZHAO,Wenqin ZHUANG,Jianxin CHEN,Liang ZHOU. Hierarchical task offloading in heterogeneous cellular network:modeling and optimization [J]. Journal on Communications, 2020, 41(4): 34-44.
[11]	Bing LIANG,Wen JI. Multiuser computation offloading for edge-cloud collaboration using submodular optimization [J]. Journal on Communications, 2020, 41(10): 25-36.
[12]	SU Mingfeng,WANG Guojun,LI Renfa. Multidimensional QoS cloud computing resource scheduling method based on stakeholder perspective [J]. Journal on Communications, 2019, 40(6): 102-115.
[13]	CHEN Xingshu,HUA Qiang,WANG Yitong,GE Long,ZHU Yi. Research on low-rate DDoS attack of SDN network in cloud environment [J]. Journal on Communications, 2019, 40(6): 210-222.
[14]	Wanliang WANG, Zelin ZANG, Guoqi CHEN, Hangyao TU, Yule WANG, Linyan LU. Research on optimal two element exchange algorithm for large scale cloud computing server scheduling problem [J]. Journal on Communications, 2019, 40(5): 180-191.
[15]	Tian WANG,Xuewei SHEN,Hao LUO,Baisheng CHEN,Guojun WANG,Weijia JIA. Research progress of trusted sensor-cloud based on fog computing [J]. Journal on Communications, 2019, 40(3): 170-181.