一种基于冗余跳变的虚拟机动态迁移方法

doi:10.19678/j.issn.1000-3428.0054337

摘要/Abstract

摘要： 在5G核心网虚拟化环境中，虚拟机共用同一物理服务器会带来一系列的安全问题，如发生侧信道攻击、虚拟节点溢出攻击等，造成用户隐私信息泄露。现有基于虚拟机动态迁移的防御方法是一种有效的主动防御技术，但虚拟机频繁迁移导致了迁移资源开销大和迁移安全性低的问题。为此，提出一种基于冗余跳变的虚拟机迁移方法，对不同虚拟机的迁移频率建立评估计算模型，在保证虚拟机隐私信息安全的前提下减小虚拟机迁移频率，对部分虚拟机采用冗余跳变的方法，以应对虚拟机频繁迁移带来的安全风险。实验结果表明，与现有虚拟机动态迁移方法相比，该方法在取得相同安全防护效果的同时，能够缩短平均迁移收敛时间并降低迁移开销。

关键词: 信息泄露, 虚拟机迁移, 迁移算法, 冗余跳变, 侧信道攻击, 虚拟节点溢出攻击

Abstract: In 5G core network virtualization environment, the virtual machines sharing the same physical server brings a series of problems,such as Side-Channel Attack(SCA),Virtual Node Escape Attack(VNEA) and so on,causing user private information disclosure.The existing defense method based on dynamic migration of virtual machines is an effective active defense technology,but the frequent migration of virtual machines leads to some problems,such as high resource cost and low migration security.Therefore,this paper proposes a virtual machine migration method based on redundant transition.With this method,an evaluation and calculation model is established for the migration frequency of different virtual machines.On the premise of ensuring the privacy information security of virtual machines,the migration frequency is reduced.The redundant transition method is applied to part of virtual machines to cope with the security risks brought by the frequent migration of virtual machines.Experimental results show that compared with the existing virtual machine dynamic migration method,the proposed method can reduce average migration convergence time and migration cost while maintaining the same security protection effect.

Key words: information leakage, virtual machine migration, migration algorithm, redundant transition, Side-Channel Attack(SCA), Virtual Node Escape Attack(VNEA)

中图分类号:

TN918.91

孙志勇, 季新生, 游伟, 李英乐. 一种基于冗余跳变的虚拟机动态迁移方法[J]. 计算机工程, 2020, 46(2): 21-27,34.

SUN Zhiyong, JI Xinsheng, YOU Wei, LI Yingle. A Virtual Machine Dynamic Migration Method Based on Redundant Transition[J]. Computer Engineering, 2020, 46(2): 21-27,34.

https://www.ecice06.com/CN/Y2020/V46/I2/21

图/表 9

20200218140600

20200218140603

20200218140606

20200218140610

20200218140613

20200218140615

20200218140618

20200218140621

20200218140625

参考文献

[1] HERRERA J G,BOTERO J F.Resource allocation in NFV:a comprehensive survey[J].IEEE Transactions on Network and Service Management,2016,13(3):518-532.
[2] ORDONEZ-LUCENA J,AMEIGEIRAS P,LOPEZ D,et al.Network slicing for 5G with SDN/NFV:concepts,architectures,and challenges[J].IEEE Communications Magazine,2017,55(5):80-87.
[3] LIU F F,YAROM Y,GE Q,et al.Last-level cache side-channel attacks are practical[C]//Proceedings of 2015 IEEE Symposium on Security and Privacy.Washington D.C.,USA:IEEE Press,2015:605-622.
[4] IRAZOQUI G,EISENBARTH T,SUNAR B.S$A:a shared cache attack that works across cores and defies VM sandboxing-and its application to AES[C]//Proceedings of 2015 IEEE Symposium on Security and Privacy.Washington D.C.,USA:IEEE Press,2015:591-604.
[5] KELLER E,SZEFER J,REXFORD J,et al.NoHype:virtualized cloud infrastructure without the virtualization[J].ACM SIGARCH Computer Architecture News,2010,38(3):350-361.
[6] PATTUK E,KANTARCIOGLU M,LIN Z Q,et al.Preventing cryptographic key leakage in cloud virtual machines[C]//Proceedings of USENIX Security Symposium.San Diego,USA:USENIX Association,2014:703-718.
[7] NAHAPETIAN A.Side-channel attacks on mobile and wearable systems[C]//Proceedings of the 13th IEEE Annual Consumer Communications and Networking Conference.Washington D.C.,USA:IEEE Press,2016:243-247.
[8] VATTIKONDA B C,DAS S,SHACHAM H.Eliminating fine grained timers in Xen[C]//Proceedings of the 3rd ACM Workshop on Cloud Computing Security.New York,USA:ACM Press,2011:41-46.
[9] WU Jingzheng,DING Liping,LIN Yuqi,et al.Xenpump:a new method to mitigate timing channel in cloud computing[C]//Proceedings of 2012 IEEE International Conference on Cloud Computing.Washington D.C.,USA:IEEE Press,2012:678-685.
[10] VARADARAJAN V,RISTENPART T,SWIFT M M.Scheduler-based defenses against cross-VM side-channels[C]//Proceedings of USENIX Security Symposium.San Diego,USA:USENIX Association,2014:687-702.
[11] HAN Y,CHAN J,ALPCAN T,et al.Using virtual machine allocation policies to defend against co-resident attacks in cloud computing[J].IEEE Transactions on Dependable and Secure Computing,2017,14(1):95-108.
[12] MOON S J,SEKAR V,REITER M K.Nomad:mitigating arbitrary cloud side channels via provider-assisted migration[C]//Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security.New York,USA:ACM Press,2015:1595-1606.
[13] ZHANG Yulong,LI Min,BAI Kun,et al.Incentive compatible moving target defense against VM-colocation attacks in clouds[C]//Proceedings of IFIP International Information Security Conference.Berlin,Germany:Springer,2012:388-399.
[14] EVANS D,NGUYEN-TUONG A,KNIGHT J.Effective-ness of moving target defenses[M].Berlin,Germany:Springer,2011:29-48.
[15] CHEN Yidan,LI Taoshen.Security problem analysis of virtual machine live migration in cloud computing environment[J].Computer Technology and Development,2015,25(12):114-117.(in Chinese) 陈怡丹,李陶深.云计算环境下虚拟机动态迁移的安全问题分析[J].计算机技术与发展,2015,25(12):114-117.
[16] NAVAMANI B,YUE C,ZHOU X B,et al.An analysis of the virtual machine migration incurred security problems in the cloud[J].Practical Radiation Oncology,2015(1):71-79.
[17] OBERHEIDE J,COOKE E,JAHANIAN F.Empirical exploitation of live virtual machine migration[EB/OL].[2019-03-02].http://www.orkspace.net/secdocs/Conferences/BlackHat/Federal/2008/Exploiting%20Live%20Virtual%20Machine%20Migration-paper.pdf.
[18] DUNCAN A,CREESE S,GOLDSMITH M,et al.Cloud computing:insider attacks on virtual machines during migration[C]//Proceedings of the 12th IEEE International Conference on Trust,Security and Privacy in Computing and Communications.Washington D.C.,USA:IEEE Press,2013:493-500.
[19] CHOYI V K,ABDEL-HAMID A,SHAH Y,et al.Network slice selection,assignment and routing within 5G networks[C]//Proceedings of 2016 IEEE Conference on Standards for Communications and Networking.Washington D.C.,USA:IEEE Press,2016:1-7.
[20] CHATRAS B,KWONG U S T,BIHANNIC N.NFV enabling network slicing for 5G[C]//Proceedings of IEEE Innovations in Clouds,Internet and Networks.Washington D.C.,USA:IEEE Press,2017:219-225.
[21] HAN B,GOPALAKRISHNAN V,JI L S,et al.Network function virtualization:challenges and opportunities for innovations[J].IEEE Communications Magazine,2015,53(2):90-97.
[22] BASTA A,KELLERER W,HOFFMANN M,et al.A virtual SDN-enabled LTE EPC architecture:a case study for S-/P-gateways functions[C]//Proceedings of 2013 IEEE SDN for Future Networks and Services.Washington D.C.,USA:IEEE Press,2013:1-7.
[23] WAN Yue,CHEN Xiuhong,HE Jiajia.Local spectral clustering mapping algorithm using sparse autoencoders[J].Transducer and Microsystem Technologies,2018,37(1):145-148,153.(in Chinese) 万月,陈秀宏,何佳佳.利用稀疏自编码的局部谱聚类映射算法[J].传感器与微系统,2018,37(1):145-148,153.
[24] ZHAO Shuo,JI Xinsheng,MAO Yuxing,et al.Research on dynamic migration of virtual machine based on security level[J].Journal on Communications,2017,38(7):165-174.(in Chinese) 赵硕,季新生,毛宇星,等.基于安全等级的虚拟机动态迁移方法[J].通信学报,2017,38(7):165-174.

选择文件类型/文献管理软件名称

选择包含的内容