面向OpenStack的多层身份认证机制和资源态势监控

发布时间：2018-05-04 23:21

本文选题：云平台 + 多层身份认证　；参考：《西安电子科技大学》2014年硕士论文

【摘要】：随着计算机计算能力不断的提高,云计算技术凭借其在可扩展性和提高资源共享能力方面的优势,将分布式集群和网格计算推向国内外研究的热点。OpenStack作为一个旨在为公共云及私有云的建设与管理提供软件的开源项目,简化了云平台的部署过程并为其带来良好的可扩展性,使得云平台技术正在被广泛应用于商业、军事和学术等各个领域中,这就使得对整个云平台的身份认证和资源态势监控显得格外重要。从用户的角度看,需要保证请求访问平台资源的用户身份的合法性,防止平台资源被非法用户获取。从服务器角度看,要保证提供服务的服务器身份的合法性,以防止合法用户的资料外泄。为了能够了解系统的运行状态,需要将系统资源使用态势实时反馈给管理员,从而给管理员提供维护和解决问题的向导。在现有面向OpenStack的身份认证方案中,尚且没有比较全面的保护方案,所以本文提出了一种三层身份认证机制保证云平台的访问控制,并通过开源分布式监控系统ganglia获取主机节点的相关信息,建立二元线性回归模型,对系统资源使用态势进行分析和图形化显示。与现有云平台安全保障技术相比,该三层身份认证机制克服了现有技术认证方式单一的缺点,不仅从三个层面上保证了云平台下用户和服务器身份的合法性,也避免了虚拟机资源的滥用,一定程度上防止了DoS的实施。在认证方式上,本文采用了USBKey技术,该技术通过将CA分配给用户的密钥和颁发的数字证书通过软件形式写入到USBKey内置的芯片中,并且内置常用密码算法,每次采用不同的密码并结合证书这两个因子对用户身份进行验证,既具有传统的基于用户名和密码认证方式的简单性,也避免了身份信息经过内存,使得企图通过内存扫描和网络监听方式获取认证信息的方法失效。在资源使用态势监控方面,首先通过加州伯克利分校发起开发的开源数据中心监控系统ganglia获取每个主机节点的运行状态信息,然后采用二元线性回归模型,基于历史数据,获取主机节点当前估计值,最后在图形化显示时,根据事先设置的正常阀值,对超过阀值的时刻给出报警信息,并用特殊颜色显示,以提醒管理员给予相应的重视,能够一定程度上帮助管理员发现系统性能瓶颈和安全隐患。Ganglia在稳定性和可扩展性方面的优势,使得整个方案能够应用到分布式大规模场景中。
[Abstract]:With the continuous improvement of computer computing power, cloud computing technology with its scalability and improve the ability to share resources, OpenStack is an open source project which aims to provide software for the construction and management of public and private cloud. It simplifies the deployment process of cloud platform and brings good scalability. Cloud platform technology is being widely used in commercial, military, academic and other fields, which makes the whole cloud platform identity authentication and resource situation monitoring is particularly important. From the user's point of view, it is necessary to ensure the legitimacy of the user identity of requesting access to the platform resource and prevent the platform resource from being obtained illegally by the user. From the server point of view, to ensure the server identity of the service to prevent the disclosure of legitimate users. In order to understand the running state of the system, it is necessary to give the real-time feedback of the system resource usage situation to the administrator, thus providing the administrator with a guide to maintain and solve the problem. In the existing identity authentication schemes for OpenStack, there is no comprehensive protection scheme, so this paper proposes a three-layer authentication mechanism to ensure the access control of cloud platform. Through the open source distributed monitoring system (ganglia) to obtain the relevant information of the host node, a binary linear regression model is established, and the system resource usage situation is analyzed and graphically displayed. Compared with the existing cloud platform security technology, the three-layer identity authentication mechanism overcomes the shortcomings of the single authentication mode of the existing technology, and not only ensures the legitimacy of the user and server identity under the cloud platform from three levels. Also avoid the abuse of virtual machine resources, to some extent prevent the implementation of DoS. In the authentication mode, this paper adopts USBKey technology, which writes the key and the digital certificate issued by CA to the embedded chip of USBKey through software, and the common cipher algorithm is built in. Each time, the user identity is verified by different password and certificate, which is not only simple based on user name and password authentication, but also avoids identity information passing through memory. The method that attempts to obtain authentication information through memory scanning and network monitoring is invalidated. In the aspect of resource usage situation monitoring, the open source data center monitoring system (ganglia) developed by Berkeley, California, firstly obtains the running state information of each host node, and then adopts a binary linear regression model based on historical data. Get the current estimate of the host node, finally, according to the pre-set normal threshold value, give the alarm information for the time exceeding the threshold value, and display the special color in order to remind the administrator to pay attention to it. To a certain extent, it can help administrators find the system performance bottlenecks and security vulnerabilities. Ganglia has the advantages of stability and extensibility, so that the whole scheme can be applied to distributed large-scale scenarios.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.09;TP309

【相似文献】