多层次的云平台安全防护体系

发布时间：2019-04-26 11:36

【摘要】：近年来公共云服务平台正逐渐的成熟和商业化,公共云平台利用其资源共享的服务方式和弹性的资源管理大大降低了软件服务的开发成本,提高了硬件资源的利用率。但是,目前的公共云服务平台安全方案却依然并不成熟,一方面传统的企业安全方案在开放的云计算服务场景并不完全适用,另一方面,云平台复杂的架构以及采用了大量的支撑技术导致单一层次上的安全防护难以奏效。因此在本文,我们分析主流商业云服务平台的安全防护方案、目前的云安全防护研究成果以及传统安全防护技术在实际云计算场景下应用的主要问题,提出一个多层次的云安全防护机制,利用纵深、多层次的安全防护解决云平台的各种安全威胁,增加云安全防护的可信度。云安全防护体系在虚拟机监控器(VMM)和管理虚拟机可能存在漏洞的情形下,依然保护云用户数据私密性和完整性；平台的Java应用隔离方案能够灵活、细粒度地控制云平台程序的行为,尽可能降低用户的程序从本地迁移到云平台的工作成本；防护体系能够有效采集平台服务和用户服务的运行日志,正确串联成日志调用链,对用户操作的安全审计、云平台服务的入侵检测、故障定位和性能分析等提供信息支持。本文的主要贡献和创新包括： 1.研究了当前云计算的主要安全问题,从云威胁来源和云平台结构分析云平台的主要安全挑战,总结了目前的企业安全方案和研究成果在云计算场景下的主要问题。 2.对Xen增加了镜像加解密操作的支持,将密钥传输、密钥管理和加解密操作同Xen管理虚拟机、虚拟机监控器VMM以及其他云平台服务分离,保证平台安全防护在VMM和管理虚拟机可能存在漏洞的情形下,依然保护云用户镜像数据私密性和完整性。 3.在Java应用隔离沙箱上,利用动态切面注入技术监控Java API的运行,在Java安全模型的基础上增强了对用户代码的控制能力,解决了细粒度的API监控问题和如何对第三方库进行安全授权的问题,保证安全隔离的同时降低用户的服务程序从本地迁移到PaaS平台的工作成本。本文详细描述了多层次云安全防护体系的设计思路,具体框架结构和功能的设计实现,最后通过实验测试该系统的有效性和给出性能影响结果。
[Abstract]:In recent years, the public cloud service platform is gradually mature and commercialized. The public cloud platform uses its resource sharing service mode and flexible resource management to greatly reduce the development cost of software services and improve the utilization of hardware resources. However, the current public cloud services platform security scheme is still immature. On the one hand, the traditional enterprise security scheme is not fully applicable in the open cloud computing service scenario, on the other hand, the traditional enterprise security scheme is not fully applicable in the open cloud computing service scenario. The complex architecture of the cloud platform and the adoption of a large number of supporting technologies make it difficult for a single level of security protection to work. Therefore, in this paper, we analyze the mainstream business cloud services platform security protection solutions, the current research results of cloud security protection and traditional security protection technology in the actual cloud computing scenario of the application of the main issues, A multi-level cloud security protection mechanism is proposed to solve all kinds of security threats of cloud platform by using deep and multi-level security protection to increase the reliability of cloud security protection. The cloud security system still protects the privacy and integrity of cloud users' data when the virtual machine monitor (VMM) and the management virtual machine may be vulnerable. The Java application isolation scheme of the platform can control the behavior of cloud platform program flexibly and finely, and reduce the work cost of migrating user program from local to cloud platform as far as possible. The protection system can effectively collect the running logs of platform services and user services, correctly concatenate into log call chains, provide information support for security audit of user operations, intrusion detection of cloud platform services, fault location and performance analysis. The main contributions and innovations of this paper include: 1. This paper studies the main security problems of cloud computing, analyzes the main security challenges of cloud platform from cloud threat sources and cloud platform architecture, and summarizes the main problems of current enterprise security schemes and research results in cloud computing scenarios. 2. Xen adds support for mirror encryption and decryption operations, separating key transfer, key management, and decryption from Xen management virtual machines, virtual machine monitor VMM, and other cloud platform services. Ensuring platform security still protects the privacy and integrity of cloud users' mirrored data in the event of possible vulnerabilities in VMM and management virtual machines. 3. In the isolation sandbox of Java application, the dynamic cross-section injection technology is used to monitor the operation of Java API, which enhances the control ability of user code on the basis of Java security model. The problem of fine-grained API monitoring and security authorization of third-party library is solved. The security isolation is guaranteed and the cost of migrating user's service program from local to PaaS platform is reduced at the same time. In this paper, the design idea of multi-level cloud security protection system is described in detail, and the concrete frame structure and function are designed and realized. Finally, the effectiveness of the system is tested by experiments and the results of performance impact are given.
【学位授予单位】：南京大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】