【作者】 李爽；

【导师】 林莉；

【作者基本信息】 北京工业大学 ， 计算机科学与技术， 2018， 硕士

【摘要】 随着云计算技术逐步成熟,越来越多的企业和个人通过租用IaaS云服务来降低IT资源的管理和维护成本。IaaS云环境下用户数据多以虚拟机镜像和外部挂载磁盘文件的形式存放于云端,云服务的透明性使用户失去对私有数据的绝对控制,云服务提供商控制着用户数据的管理接口,由于云服务商可信性不易评估,恶意的云管理员或者内部运维人员可能会利用其特权去侵害用户数据安全和隐私。例如,可直接对用户数据进行读写、可通过非授权调用云服务对用户数据进行间接操作等。因此,如何在IaaS云环境下对抗内部人员攻击以实现对用户虚拟机数据的安全保护已成为当前云计算亟待解决的关键问题。目前已有研究提出用户可控的数据加密、基于嵌套虚拟化的虚拟机监控以及单节点安全审计等方案去阻止或检测上述内部威胁,然而由于与现有公有云平台不兼容、实施会引入新的计算开销对云服务性能影响较大、同时仅关注单个节点行为无法判断行为操作来源的合法性,这些方案难以直接应用于IaaS环境,仍需要解决低开销的用户数据保护以及适用于当前主流云平台的数据访问多节点行为追溯等重要问题。针对上述问题,本文深入分析IaaS环境下的云服务行为特征和内部威胁特点,提出了一种面向内部威胁的数据安全保护框架(TVGuarder),重点研究了其中的虚拟机镜像访问控制、用户行为树构建和基于行为追溯的内部威胁发现方法。主要研究结果如下:1.提出了一种基于进程监控的虚拟机镜像访问控制方法。首先,利用Linux内核钩子对IaaS云环境的云服务进程进行监控,以确定访问用户虚拟机镜像文件的合法进程;其次,基于合法进程信息构建用户镜像文件的访问控制策略,并利用内核访问控制模块实现对进程直接访问镜像文件非法行为的阻断;最后,在真实云平台下实现并检验提出方法的效果,实验结果表明提出方法能阻断非法进程对镜像文件的恶意访问,并且对云服务的响应时间影响较小。2.提出了一种基于多层API关联分析的行为树构建方法。首先,分析IaaS云环境的计算服务、远程调用、管理实施、虚拟化管理等服务调用接口,凝练云用户行为的完整流程;其次,采用基于源码分析的多层API关联思想,对开源Openstack云平台下虚拟化相关源码进行行为关联分析;最后,借鉴基于树的行为建模技术,提出行为树构建算法,用于构建可描述云用户各种合法操作的正常行为树。由于当前大多数IaaS云基于Openstack架构,因此提出方法具有较为广泛的适用性。3.提出了一种基于行为追溯的内部威胁发现方法。首先,在计算服务接口、远程调用接口、管理实施接口、虚拟化管理接口、虚拟化进程等多层API上设置云服务行为追溯点,跨多节点采集各个接口被调用的行为信息;其次,基于各追溯点采集的信息,采用底层虚拟化行为关键字匹配技术,与前面构建的用户正常行为树进行行为追溯匹配,通过基于树的完整性分析识别出恶意内部威胁;最后,通过实验验证提出方法能够发现恶意内部人员非授权调用云服务,并且具有较高的检测准确率。4.实现了TVGuarder原型。首先,基于提出的虚拟机镜像访问控制方法、行为树构建方法以及基于行为追溯的内部威胁发现方法,给出了TVGuarder的设计思想、体系结构和执行流程;其次,在真实基于Openstack的IaaS云环境中部署了TVGuarder原型;最后对部署TVGuarder前后的云服务性能以及云服务节点操作系统的性能进行比较,实验结果表明TVGuarder具有较高的实用性和较好的性能。更多还原

【Abstract】 With the development of cloud computing technology,more and more enterprises and individuals rent IaaS services to reduce the management and maintenance costs of IT resources.In the IaaS(Infrastructure as a Service)service model,tenants host data and applications to the cloud.The transparency of the cloud service leaves them with no absolute control over private data.The cloud service provider controls the management interface of user data.Because cloud providers’ credibility is not assessed easily,malicious cloud administrators or internal operations staff may use their privileges to infringe on user data security and privacy.For example,the data can be read and written directly,and the data can be operated indirectly through nonauthorization calling cloud service.Therefore,it has become a key issue in IaaS environment how to protect tenants’ virtual machine data against internal personnel attacks.Currently,it has been proposed to prevent or detect the above internal threats by means of user-controllable data encryption,virtual machine monitoring based on nested virtualization,and single node security audit.However,due to the incompatibility of the existing public cloud platform,the introduction of new computing costs and the invalidation of the judgment of legality of operation source,these solutions are difficult to apply to IaaS cloud environment directly.And it need to address the important issues such as low-cost user data protection and multi-node behavior tracking for data access on current mainstream cloud platforms.In order to solve the above problems,this paper analyzes cloud service behavior and internal threat characteristics in IaaS cloud environment,proposes a data protection framework called TVGuarder,and focuses on access control of virtual machine image,users behavior tree construction and internal threats discovery based on behavior traceability.The main research findings are as follows:1.We have proposed an access control method of virtual machine image based on process monitoring.First,all cloud service processes are monitored by using the Linux kernel hook to determine the legal process of accessing user virtual machine image files.Secondly,the access control strategy of the user image file is constructed based on the legal process information,and the kernel access control module is used to block the illegal behavior of the direct access image file.Finally,we have implemented and tested the proposed method under the real cloud platform.The experimental results show that the proposed method can prevent illegal process to access the image file maliciously,and has a small impact on the response time of cloud services.2.We have proposed a behavior-tree construction method based on multilayer API association analysis.First,we analyze the service invocation interfaces of IaaS cloud environment,such as computing service,remote call,management implementation,and virtualization management,and condense the complete process of cloud user behavior.Secondly,adopting the multi-level API association idea based on the source code analysis,we achieve the behavioral correlation analysis of the related source code under open source Openstack cloud platform.Finally,using the tree-based behavior modeling technique,a behavior-tree construction algorithm is proposed to construct the normal behavior tree that can describe various legal operations of cloud users.Since most IaaS clouds adopt the Openstack architecture,the proposed approach has a wide range of applicability.3.We have proposed an internal threat detection method based on behavioral trace.First,we set up trace points of cloud service behavior on multi-layer APIs such as computing service interfaces,remote call interfaces,management implementation interfaces,virtualization management interfaces,and virtualization processes,then we trace cloud service behavior across multiple nodes.Secondly,based on keyword matching technology,the behavior traced is matched with the user’s normal behavior tree and the malicious internal threat is identified through tree-based integrity analysis.Finally,we verify the proposed method through experimental evaluation.The experimental results show that the proposed method can detect malicious internal staff call cloud services unauthorizedly and have high detection accuracy.4.We have implemented TVGuarder prototype.First,based on the above three proposed methods,the design idea,architecture and execution flow of TVGuarder are given.Secondly,we have deployed TVGuarder prototype in the real Openstack-based cloud environment.Finally,we compared the cloud service performance before and after the deployment of TVGuarder and the corresponding performance of the operating system in cloud service node.The experimental results show that TVGuarder has higher practicality and better performance.更多还原