微信服务号

微信订阅号

2025年3月24日 15:15 星期一
首页 > 过刊浏览>2016年第27卷第6期 >1538-1548. DOI:10.13328/j.cnki.jos.004997
PDF HTML阅读 XML下载 导出引用 引用提醒
一种透明的可信云租户隔离机制研究
作者:
基金项目:

国家自然科学基金(61363030);广西可信软件重点实验室研究课题(KX201531)


Trusted Cloud Tenant Separation Mechanism Supporting Transparency
Author:
Fund Project:

National Natural Science Foundation of China (61363030); Guangxi Key Laboratory of Trusted Software (KX201531)

  • 摘要
    • | |
  • 访问统计
    • |
  • 参考文献 [38]
    • |
  • 相似文献
    • |
  • 引证文献
    • | |
  • 文章评论
    摘要:

    租户隔离是云计算能被作为第三方服务提供给租户的重要前提,因此,云租户隔离机制的安全有效性能否被租户信任,对云计算服务的推广非常关键.但在云计算这种第三方服务模式中,由于租户不能参与云服务基础设施及其安全隔离机制的建设和管理过程,因此他们难以对云租户隔离机制的安全有效性建立信心.将透明性要求视为可信云租户隔离机制的一部分,将云租户隔离机制和租户透明要求都转化为云服务系统中不同安全域之间的信息流,对云租户隔离机制进行定义,并制定云计算平台中的域间信息流策略控制方式,最后,基于信息流无干扰理论证明了所定义的云租户隔离机制在安全方面的有效性.

    Abstract:

    Tenant separation is a provision for cloud computing to be provided to tenants as a third party service, therefore the tenants' confidence in the security effectiveness of cloud tenant is critical to the promotion of cloud services. However, in a third party service such as cloud computing, tenants have few opportunities to take part in the construction and management of the infrastructure of cloud computing, making it hard for the tenants to trust the tenant separation mechanism in cloud. This paper views the transparency requirement as a part of trusted cloud tenant separation mechanism, implements a cloud tenant separation mechanism and its transparency requirement based on the inter-domain information flow control policy in cloud computing systems, and proves that the resulting cloud tenant separation mechanism is secure and effective by non-interference theory.

    参考文献
    [1] Cloud Security Alliance. Security guidance for critical areas of focus in cloud computing. http://www.cloudsecurityalliance.org/ guidance/csaguide.pdf
    [2] NIST. The NIST definition of cloud computing. http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf
    [3] Survey: Cloud computing ‘no hype', but fear of security and control slowing adoption. http://www.circleid.com/posts/20090226_ cloud_computing_hype_security/
    [4] F5 networks: Cloud computing survey results June—July 2009. 2009. http://www.f5.com/pdf/reports/cloud-computing-survey- results-2009.pdf
    [5] Mather T, Kumaraswamy S, Latif S. Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance. O'Reilly, 2009.
    [6] Almond C. A Practical Guide to Cloud Computing Security. A White Paper from Accenture and Microsoft. 2009.
    [7] Wang C, Wang Q, Ren K, Lou WJ. Privacy-Preserving public auditing for data storage security in cloud computing. In: Proc. of the 2010 IEEE INFOCOM. IEEE, 2010. 1-9. [doi: 10.1109/INFCOM.2010.5462173]
    [8] Kaufman LM. Can a trusted environment provide security? Security & Privacy, IEEE, 2010,8(1):50-52. [doi: 10.1109/ MSP.2010.33]
    [9] Pauley WA. Cloud provider transparency: An empirical evaluation. Security & Privacy, IEEE, 2010,8(6):32-39. [doi: 10.1109/ MSP.2010.140]
    [10] Khan KM, Malluhi Q. Establishing trust in cloud computing. IT Professional, 2010,12(5):20-27. [doi: 10.1109/MITP.2010.128]
    [11] Huang J, Nicol DM. Trust mechanisms for cloud computing. Journal of Cloud Computing, 2013,2(1):1-14. [doi: 10.1186/2192- 113X-2-9]
    [12] Sunyaev A, Schneider S. Cloud services certification. Communications of the ACM, 2013,56(2):33-36. [doi: 10.1145/2408776. 2408789]
    [13] Kumar N, Chakraborti B, Kumar A, Giri S. Reduction of cost by implementing transparency in cloud computing through different approaches. In: Proc. of the 2014 Int'l Conf. on Advanced Communication Control and Computing Technologies (ICACCCT). IEEE, 2014. 1723-1725. [doi: 10.1109/ICACCCT.2014.7019403]
    [14] Dev H, Ali ME, Sen T, Basak M. AntiqueData: A proxy to maintain computational transparency in cloud. In: Proc. of the Database Systems for Advanced Applications. Berlin, Heidelberg: Springer-Verlag, 2014. 256-267. [doi: 10.1007/978-3-662-43984-5_19]
    [15] Rushby J. A formal model for MILS integration. Project Report, Menlo Park, CA: Computer Science Laboratory, SRI International, 2008.
    [16] Barham P, Dragovic B, Fraser K, Hand S, Harris T, Ho A, Neugebauer R, Pratt I, Warfield A. Xen and the art of virtualization. ACM SIGOPS Operating Systems Review, 2003,37(5):164-177. [doi: 10.1145/1165389.945462]
    [17] Mell P, Grance T. The NIST definition of cloud computing. National Institute of Standards and Technology, 2009,53(6):50.
    [18] Chow R, Golle P, Jakobsson M, Masuoka R, Molina J. Controlling data in the cloud: Outsourcing computation without outsourcing control. In: Proc. of the 2009 ACM Workshop on Cloud Computing Security. ACM Press, 2009. 85-90. [doi: 10.1145/1655008. 1655020]
    [19] Khan KM, Malluhi Q. Establishing trust in cloud computing. IT Professional, 2010,12(5):20-27. [doi: 10.1109/MITP.2010.128]
    [20] TCG. https://www.trustedcomputinggroup.org/home
    [21] Patel A, Dansena P. TPM as a middleware for enterprise data security. Int'l Journal of Computer Science and Mobile Computing, 2013,2(7):327-332.
    [22] Kekkonen T, Kanstrén T, Hatonen K. Towards trusted environment in cloud monitoring. In: Proc. of the 2014 11th Int'l Conf. on Information Technology: New Generations (ITNG). IEEE, 2014. 180-185. [doi: 10.1109/ITNG.2014.104]
    [23] Li XY, Zhou LT, Shi Y, Guo Y. A trusted computing environment model in cloud architecture. In: Proc. of the 2010 Int'l Conf. on Machine Learning and Cybernetics (ICMLC). IEEE, 2010. 2843-2848. [doi: 10.1109/ICMLC.2010.5580769]
    [24] Varadharajan V, Tupakula U. TREASURE: Trust enhanced security for cloud environments. In: Proc. of the 2012 IEEE 11th Int'l Conf. on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, 2012. 145-152. [doi: 10.1109/ TrustCom.2012.283]
    [25] Chen C, Raj H, Saroiu S, Wolman A. cTPM: A cloud TPM for cross-device trusted applications. In: Proc. of the 11th USENIX Conf. on Networked Systems Design and Implementation. 2014. 187-201.
    [26] Gebhardt C, Dalton CI, Brown R. Preventing hypervisor-based rootkits with trusted execution technology. Network Security, 2008, 11(2008):7-12. [doi: 10.1016/S1353-4858(08)70128-4]
    [27] Nie C. Dynamic root of trust in trusted computing. TKK T1105290 Seminar on Network Security, 2007.
    [28] Singaravelu L, Pu C, Härtig H, Helmuth C. Reducing TCB complexity for security-sensitive applications: Three case studies. ACM SIGOPS Operating Systems Review, 2006,40(4):161-174. [doi: 10.1145/1217935.1217951]
    [29] Murray DG, Milos G, Hand S. Improving Xen security through disaggregation. In: Proc. of the 4th ACM SIGPLAN/SIGOPS Int'l Conf. on Virtual Execution Environments. ACM Press, 2008. 151-160. [doi: 10.1145/1346256.1346278]
    [30] Chen Y, Paxson V, Katz RH. What's new about cloud computing security. Berkeley Report, No.UCB/EECS-2010-5, University of California, 2010.
    [31] Department of Defense. Trusted computer system evaluation criteria (orange book). DoD Computer Security Center, 1983. http://csrc.nist.gov/publications/history/dod85.pdf
    [32] ISO/IEC 15408 Standard. Common criteria for information technology security evaluation version 3.1 revision 4. 2014. http://www. commoncriteriaportal.org/cc/
    [33] Goguen JA, Meseguer J. Security policies and security models. In: Proc. of the IEEE Symp. on Security and Privacy. 1982. [doi: 10.1109/SP.1982.10014]
    [34] Goguen JA, Meseguer J. Inference control and unwinding. In: Proc. of the 1984 Symp. on Security and Privacy. Oakland: IEEE Computer Society, 1984. 75-86. [doi: 10.1109/SP.1984.10019]
    [35] Haigh JT, Young WD. Extending the noninterference version of MLS for SAT. IEEE Trans. on Software Engineering, 1987,2: 141-150. [doi: 10.1109/TSE.1987.226478]
    [36] Rushby J. Noninterference, transitivity, and channel-control security policies. SRI Int'l, Computer Science Laboratory, 1992.
    [37] Van Der Meyden R. What, indeed, is intransitive noninterference? In: Proc. of the Computer Security (ESORICS 2007). Berlin, Heidelberg: Springer-Verlag, 2007. 235-250. [doi: 10.1007/978-3-540-74835-9_16]
    [38] Boettcher C, DeLong R, Rushby J, Sifre W. The MILS component integration approach to secure information sharing. In: Proc. of the IEEE/AIAA 27th Digital Avionics Systems Conf. (DASC 2008). IEEE, 2008. [doi: 10.1109/DASC.2008.4702758]
    相似文献
    引证文献
    网友评论
    网友评论
    分享到微博
    发 布
引用本文

石勇,郭煜,刘吉强,韩臻,马威,常亮.一种透明的可信云租户隔离机制研究.软件学报,2016,27(6):1538-1548

复制
分享
文章指标
  • 点击次数:5249
  • 下载次数: 6597
  • HTML阅读次数: 3228
  • 引用次数: 0
历史
  • 收稿日期:2015-08-14
  • 最后修改日期:2015-10-09
  • 在线发布日期: 2016-01-22
文章二维码
友情链接:中国科学院软件研究所中国计算机学会中国科学院国家自然科学基金委员会CCF数字图书馆Int'l J of Softw Info计算机系统应用
您是第19728229位访问者
版权所有：中国科学院软件研究所 京ICP备05046678号-3
地址：北京市海淀区中关村南四街4号,邮政编码：100190
电话：010-62562563 传真：010-62562533 Email：jos@iscas.ac.cn
技术支持：北京勤云科技发展有限公司

京公网安备 11040202500063号