A Method for Trust Management in Cloud Computing: Data Coloring by Cloud Watermarking

With the development of Internet technology and human computing, the computing environment has changed dramatically over the last three decades. Cloud computing emerges as a paradigm of Internet computing in which dynamical, scalable and often virtuMized resources are provided as services. With virtualization technology, cloud computing offers diverse services （such as virtual computing, virtual storage, virtual bandwidth, etc.） for the public by means of multi-tenancy mode. Although users are enjoying the capabilities of super-computing and mass storage supplied by cloud computing, cloud security still remains as a hot spot problem, which is in essence the trust management between data owners and storage service providers. In this paper, we propose a data coloring method based on cloud watermarking to recognize and ensure mutual reputations. The experimental results show that the robustness of reverse cloud generator can guarantee users＇ embedded social reputation identifications. Hence, our work provides a reference solution to the critical problem of cloud security.

An Evaluation Approach of Subjective Trust Based on Cloud Model

As online trade and interactions on the internet are on the rise, a key issue is how to use simple and effective evaluation methods to accomplish trust decision-making for customers. It is well known that subjective trust holds uncertainty like randomness and fuzziness. However, existing approaches which are commonly based on probability or fuzzy set theory can not attach enough importance to uncertainty. To remedy this problem, a new quantifiable subjective trust evaluation approach is proposed based on the cloud model. Subjective trust is modeled with cloud model in the evaluation approach, and expected value and hyper-entropy of the subjective cloud is used to evaluate the reputation of trust objects. Our experimental data shows that the method can effectively support subjective trust decisions and provide a helpful exploitation for subjective trust evaluation.

Trusted Data Acquisition Mechanism for Cloud Resource Scheduling Based on Distributed Agents

Goud computing is a new paradigm in which dynamic and virtualized computing resources are provided as services over the Internet. However, because cloud resource is open and dynamically configured, resource allocation and scheduling are extremely important challenges in cloud infrastructure. Based on distributed agents, this paper presents trusted data acquisition mechanism for efficient scheduling cloud resources to satisfy various user requests. Our mechanism defines, collects and analyzes multiple key trust targets of cloud service resources based on historical information of servers in a cloud data center. As a result, using our trust computing mechanism, cloud providers can utilize their resources efficiently and also provide highly trusted resources and services to many users.

Multiway Dynamic Trust Chain Model on Virtual Machine for Cloud Computing

This paper sums up four security factors after analyzing co-residency threats caused by the special multitenant environment in the cloud.To secure the factors,a multiway dynamic trust chain transfer model was proposed on the basis of a measurement interactive virtual machine and current behavior to protect the integrity of the system.A trust chain construction module is designed in a virtual machine monitor.Through dynamic monitoring,it achieves the purpose of transferring integrity between virtual machine.A cloud system with a trust authentication function is implemented on the basis of the model,and its practicability is shown.

Trusted Heartbeat Framework for Cloud Computing

In cloud computing environment, as the infrastructure not owned by users, it is desirable that its security and integrity must be protected and verified time to time. In Hadoop based scalable computing setup, malfunctioning nodes generate wrong output during the run time. To detect such nodes, we create collaborative network between worker node (i.e. data node of Hadoop) and Master node (i.e. name node of Hadoop) with the help of trusted heartbeat framework (THF). We propose procedures to register node and to alter status of node based on reputation provided by other co-worker nodes.

Research on Mobile Internet Mobile Agent System Dynamic Trust Model for Cloud Computing

This paper analyzes the reasons for the formation of security problems in mobile agent systems, and analyzes and compares the security mechanisms and security technologies of existing mobile agent systems from the perspective of blocking attacks. On this basis, the host protection mobile agent protection technology is selected, and a method to enhance the security protection of mobile agents (referred to as IEOP method) is proposed. The method first encrypts the mobile agent code using the encryption function, and then encapsulates the encrypted mobile agent with the improved EOP protocol IEOP, and then traces the suspicious execution result. Experiments show that using this method can block most malicious attacks on mobile agents, and can protect the integrity and confidentiality of mobile agents, but the increment of mobile agent tour time is not large.

Trust Assessment Model Based on a Zero Trust Strategy in a Community Cloud Environment

The adoption of Cloud Computing services in everyday business life has grown rapidly in recent years due to the many benefits of this paradigm. The various collaboration tools offered by Cloud Computing have eliminated or reduced the notion of distance between entities of the same company or between different organizations. This has led to an increase in the need to share resources (data and services). Community Cloud environments have thus emerged to facilitate interactions between organizations with identical needs and with specific and high security requirements. However, establishing trust and secure resource sharing relationships is a major challenge in this type of complex and heterogeneous environment. This paper proposes a trust assessment model (SeComTrust) based on the Zero Trust cybersecurity strategy. First, the paper introduces a community cloud architecture subdivided into different security domains. Second, it presents a process for selecting a trusted organization for an exchange based on direct or recommended trust value and reputation. Finally, a system for promoting or relegating organizations in the different security domains is applied. Experimental results show that our model guarantees the scalability of a community cloud with a high success rate of secure and quality resource sharing.

Trustworthy Assurance of Service Interoperation in Cloud Environment

Cloud computing can be realized by service interoperation and its essence is to provide cloud services through network. The development of effective methods to assure the trustworthiness of service interoperation in cloud environment is a very important problem. The essence of cloud security is trust and trust management. Combining quality of service （QoS） with trust model, this paper constructs a QoS-aware and quantitative trust-model that consists of initial trust value, direct trust value, and recommendatory trust value of service, making the provision, discovery, and aggregation of cloud services trustworthy. Hence, it can assure trustworthiness of service interoperation between users and services or among services in cloud environment. At the same time, based on this model, service discovery method based on QoS-aware and quantitative trust-model （TQoS-WSD） is proposed, which makes a solid trust relationship among service requestor, service provider and service recommender, and users can find trustworthy service whose total evaluation value is higher. Corapared to QoS-based service discovery （QoS-WSD） method, it is proved by the experiment for TQoS-WSD method that more accurate result of service discovery will be achieved by service requestor, while reasonable time cost is increased. Meanwhile, TQoS-WSD method strongly resists the effect of service discovery by untrustworthy QoS values and improves service invocation success-rate and thus assures trustworthiness of services interoperation.

Shared Resource Quality Monitoring and Dynamic Trust Management in a Community Cloud

The collaboration tools offered by Cloud Computing have increased the need to share data and services within companies or between autonomous organizations. This has led to the deployment of community cloud infrastructures. However, several challenges will arise from this grouping of heterogeneous organizations. One of the main challenges is the management of trust between the actors of the community. Trust issues arise from the uncertainty about the quality of the resources and entities involved. The quality of a resource can be examined from a security or functional perspective. Therefore, ensuring security and monitoring the quality of resources is to ensure a high level of trust. Therefore, we propose in this paper a technique for dynamic trust management and quality monitoring of resources shared between organizations. Our approach consists, on the one hand, in evaluating the quality of resources based on quality of service measurement attributes and, on the other hand, in updating the trust values according to the information deduced from these measurements. The proposed framework is evaluated in terms of resource sharing success rate and execution time. Experimental results and comparison with TNA-SL and InterTrust models show that the framework can identify and track the behavior of malicious organizations with relatively low execution time.

Trust Based Meta-Heuristics Workflow Scheduling in Cloud Service Environment

Cloud computing has emerged as a new style of computing in distributed environment. An efficient and dependable Workflow Scheduling is crucial for achieving high performance and incorporating with enterprise systems. As an effective security services aggregation methodology, Trust Work-flow Technology (TWT) has been used to construct composite services. However, in cloud environment, the existing closed network services are maintained and functioned by third-party organizations or enterprises. Therefore service-oriented trust strategies must be considered in workflow scheduling. TWFS related algorithms consist of trust policies and strategies to overcome the threats of the application with heuristic workflow scheduling. As a significance of this work, trust based Meta heuristic workflow scheduling (TMWS) is proposed. The TMWS algorithm will improve the efficiency and reliability of the operation in the cloud system and the results show that the TMWS approach is effective and feasible.

基于TrustZone的可信移动终端云服务安全接入方案

可信云架构为云计算用户提供了安全可信的云服务执行环境,保护了用户私有数据的计算与存储安全.然而在移动云计算高速发展的今天,仍然没有移动终端接入可信云服务的安全解决方案.针对上述问题,提出了一种可信移动终端云服务安全接入方案.方案充分考虑了移动云计算应用背景,利用ARM Trust Zone硬件隔离技术构建可信移动终端,保护云服务客户端及安全敏感操作在移动终端的安全执行.结合物理不可克隆函数技术,给出了移动终端密钥与敏感数据管理机制.在此基础上,借鉴可信计算技术思想设计了云服务安全接入协议.协议兼容可信云架构,提供云服务端与移动客户端间的端到端认证.分析了方案具备的6种安全属性,给出了基于方案的移动云存储应用实例,实现了方案的原型系统.实验结果表明:可信移动终端TCB较小,方案具有良好的可扩展性和安全可控性,整体运行效率较高.

基于TrustZone的移动云环境指纹认证终端APP的设计和实现

针对指纹等生物特征在云环境下存在泄露的安全隐患,以及已有的生物特征认证方案安全性或便利性不足的问题,设计并实现了基于正交分解和TrustZone的可信指纹认证终端APP。利用TrustZone的硬件隔离机制,在可信执行环境中完成指纹特征提取、指纹模板生成等敏感操作,与普通执行环境中的应用隔离,从而抵挡恶意程序的攻击,保证认证过程的安全性。基于正交分解算法生成的指纹模板在保证可匹配性的同时融合了随机噪声,可以在一定程度上抵挡针对特征模板的攻击,使得指纹模板可以在云环境下存储和传输,解除用户与设备的绑定,提升了生物认证的便利性。实验和理论分析表明,指纹模板的相关性和随机性比原始特征和随机映射算法更高,有更强的安全性;另外时间和存储开销、识别的准确性的实验结果表明,所设计APP兼顾便利性和安全性,满足移动云环境下安全认证的需求。

Formal Protection Architecture for Cloud Computing System

Cloud computing systems play a vital role in national security. This paper describes a conceptual framework called dualsystem architecture for protecting computing environments. While attempting to be logical and rigorous, formalism method is avoided and this paper chooses algebra Communication Sequential Process.

A New Kind of Subjective Trust Model

Based on the outstanding characteristics of Cloud Model on the process of transforming a qualitative concept to a set of quantitative numerical values, a formalized model of subjective trust is introduced by which we can transform between qualitative reputation and quantitative voting data. The present paper brings forward algorithms to compute direct trust and recommender trust. Further more, an effective similarity measuring method used to distinguish two users＇ reputation on knowledge level is also proposed. The given model properly settles the uncertainty and fuzziness properties of subjective trust which is always the weakness of traditional subjective trust model, and provides a step in the direction of proper understanding and definition of human trust.

可信赖云计算的通信防火墙攻击捕获系统设计

为提高通信防火墙攻击捕获的有效性,提出基于可信赖云计算的通信防火墙攻击捕获系统。系统硬件设计过滤器、内核防火墙和捕获器,过滤器执行数据分流过滤,内核防火墙执行iptables命令和ebtables命令完成信息匹配,捕获器对5种虚拟路径进行分析,完成信息捕获。可信赖云计算软件设计,构建不同数据包的概率密度函数,判读数据是否为攻击信息。实验结果表明,所设计系统能够保证计算密集型任务的执行成功率达到90%以上,降低计算过程的收敛程度。

基于云计算的计算机网络安全防御系统设计

针对云计算环境下日益严峻的网络安全威胁,设计一种基于云计算技术的计算机网络安全防御系统。该系统采用分层架构设计,集成了虚拟化、可信计算及大数据分析等关键技术,实现对云环境中计算、存储、网络及数据等资源的全方位安全防护。通过搭建实验环境进行安全性、性能及可用性测试,结果表明该系统在入侵检测、漏洞防护、性能优化及高可用保障等方面具有良好的效果,为云计算环境下网络安全防御提供了有效的解决方案。

零信任架构的回望与未来发展研究

随着互联网、大数据和云计算的快速发展,为了应对现代数字化的挑战,零信任架构作为一种新的安全范式被提出.该安全模型建立在从不默认信任任何内部或外部请求的原则上,强调必须通过持续的验证和监控授予访问权限.零信任的核心原则包括全面身份验证、访问控制、最小权限、普遍加密和持续的风险评估与应对.主要通过对零信任架构的发展历史进行回顾,以及对零信任机制的基本概念进行阐述,最后对零信任架构未来的发展进行总结.

投保抑或认证下云平台的安全信息披露策略研究

针对一个由云应用开发商和云平台运营商构成的云服务供应链,构建信号博弈和信息共享模型,对比分析云平台运营商在仅投保、仅认证和既投保又认证3种情境下的最优安全信息披露策略,并讨论云认证对消费者剩余和社会福利的影响。研究发现:基于投保水平的信号传递可以实现分离均衡,但当运营成本小于其阈值时,云平台运营商需承担信号成本;当云认证带给用户的效用足够高时,云平台运营商进行云认证是有利可图的;无论云认证效用水平如何,云平台运营商会选择既投保又认证的双策略;政府对云认证的补贴能有效提升消费者剩余和社会总福利。

面向城轨云平台边界安全防护的动态信任管理方法

针对城轨云平台边界数量多、边界安全防护薄弱的问题,分析了城轨云与工业控制网络协同交互过程,提出了一种面向城轨云平台边界安全防护的动态信任管理方法,包括异常行为识别、信任评估、信任更新、基于信任值的动态访问控制。根据城轨云的综合监控系统网络拓扑,分析了未经授权控制指令、违规控制指令、干扰正常控制指令三类异常行为。结果表明,所提出的动态信任管理方法能够有效抵御恶意节点发起的异常行为;对于不同节点、不同异常行为的信任值变化不同;符合“缓升快降”的规则,能够保障城轨云平台细粒度的边界安全防护。