面向云环境的可信连接技术的研究

发布时间：2018-11-12 13:03

【摘要】：随着云计算技术的飞速发展,云计算服务已经广泛的应用于商业、金融、国家电子政务等各个领域,日趋显著的影响着人们生活和生产活动。云计算普遍采用虚拟化、资源池化、外包化等技术来提高资源的利用率并节省用户支出,但是,这些技术弱化了用户对自身数据的控制,弱化了云边界控制,使得云环境中的安全性问题日益突出。针对云环境中出现的问题,论文根据三元三层网络连接架构TNCA提出了一个基于网络行为安全属性度量的可信网络连接架构TNCA-AM。论文依据网络行为的敏感度进行多重安全属性度量的方法,进而提出了一个云租户属性模型。论文在TNCA-AM框架指导下,设计了一套适用于云环境的可信网络连接协议。论文的主要创新点主要包括下面几个方面。首先,论文对传统网络连接架构进行了分析,针对于传统可信网络连接架构缺乏持续性度量和缺乏细粒度的访问控制两方面展现出来的局限性,根据我国提出的三元三层网络连接架构TNCA,提出了依据网络行为的敏感度进行多重安全属性度量的度量方法,提出了一种支持属性度量的可信网络连接架构TNCA-AM,给出了框架的架构、实体、功能部件的描述,给出了框架连接过程的步骤,最后分析传统网络连接框架和提出框架的优缺点。其次,根据TNCA-AM框架体系,论文设计了一套适用于云环境的可信网络连接协议。为了实现连接协议的属性收集、动态度量、个人证书码的验证等功能,论文提出了一个可信终端辅助模块TTAM,辅助远程证明过程,在此基础上,论文描述了可信网络连接协议的具体步骤,并给出了详细的三方通信交互过程图。除此之外,论文应用BAN逻辑对提出的协议进行形式化证明,查找协议漏洞,确保协议的正确性和安全性。最后,论文对提出的适用于云环境的可信连接框架和可信连接协议进行了原型系统的设计,给出了系统结构设计图,并对可信连接的接入阶段进行了代码实现和测试。
[Abstract]:With the rapid development of cloud computing technology, cloud computing services have been widely used in business, finance, national e-government and other fields, increasingly significantly affecting people's lives and production activities. Virtualization, resource pooling, outsourcing and other technologies are widely used in cloud computing to improve the utilization of resources and save user expenses. However, these technologies weaken users' control of their own data and cloud boundary control. The security problem in cloud environment is becoming more and more prominent. Aiming at the problems in cloud environment, this paper proposes a trusted network connection architecture (TNCA-AM.) based on network behavior security attribute metric according to three-layer network connection architecture (TNCA). Based on the sensitivity of network behavior, this paper proposes a cloud tenant attribute model. Under the guidance of TNCA-AM framework, this paper designs a set of trusted network connection protocols for cloud environment. The main innovation of this paper includes the following aspects. First of all, the paper analyzes the traditional network connection architecture, aiming at the limitations of the traditional trusted network connection architecture in terms of the lack of sustainability measurement and the lack of fine-grained access control. According to the three-layer network connection architecture (TNCA,) proposed by our country, this paper proposes a method to measure multiple security attributes according to the sensitivity of network behavior, and proposes a trusted network connection architecture (TNCA-AM,), which supports attribute measurement. The architecture, entity and functional components of the framework are described, and the steps of the frame connection process are given. Finally, the advantages and disadvantages of the traditional network connection framework and the proposed framework are analyzed. Secondly, according to TNCA-AM framework, this paper designs a set of trusted network connection protocol for cloud environment. In order to realize the functions of attribute collection, dynamic measurement, personal certificate code verification and so on, a trusted terminal assistant module (TTAM,) is proposed to assist the remote certification process. This paper describes the specific steps of trusted network connection protocol, and gives a detailed three-party communication process diagram. In addition, the paper uses BAN logic to formalize the proposed protocol to find the protocol vulnerabilities to ensure the correctness and security of the protocol. Finally, a prototype system of trusted join framework and trusted join protocol for cloud environment is designed, and the architecture of the system is given, and the access phase of trusted connection is implemented and tested.
【学位授予单位】：中国地质大学(北京)
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP309

【相似文献】