云计算客户虚拟机间的安全机制研究与实现  

Research and Implementation of Security Mechanism Among Guest Virtual Machine in Cloud Computing

作　　者：乔然[1] 胡俊[1] 荣星[1] 

机构地区：[1]北京工业大学计算机学院,北京100124

出　　处：《计算机工程》2014年第12期26-32,共7页Computer Engineering

基　　金：国家科技重大专项基金资助项目(2012ZX03002003)

摘　　要：云计算提供的弹性服务依赖于虚拟化技术的支持,然而虚拟化技术存在的安全问题也严重威胁着云计算的安全。针对目前云计算虚拟化技术中客户机操作系统面临的安全风险,在分析云计算虚拟化技术需求及特点的基础上,设计适用于云计算环境的集中管理、分布式实施的强制访问控制以及基于云资源控制的隔离机制,使其相互配合。保证云计算中客户机操作系统的安全,并在使用XEN作为虚拟化软件的OPENSTACK平台上实现这些安全机制。实验结果表明,该安全机制能够较好地防护针对客户机操作系统的攻击,对客户机操作系统的安全起到有效的保护作用。The elastic cloud computing service relies on virtualization technology. However, security problems of virtualization technology are also posing threats to cloud computing. This paper focuses on the risks confronted by guest virtual machine in cloud computing. Some mechanisms,including a centralized-managing and distributed-executing access control and a cloud resource controlling based separation,are designed to protect the safety of guest virtual machine based on an analysis about the security requirements of guest virtual machine. After that,these mechanisms are implemented in a XEN based OPENSTACK cloud environment. Some experiments are designed as well to test these mechanisms, which show improvement is made in protecting guest virtual machine in cloud environment and prove the validity of these mechanisms.

关 键 词：云计算 虚拟化安全 客户虚拟机 强制访问控制 隔离机制 中国墙策略 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]