A Method for Trust Management in Cloud Computing: Data Coloring by Cloud Watermarking

With the development of Internet technology and human computing, the computing environment has changed dramatically over the last three decades. Cloud computing emerges as a paradigm of Internet computing in which dynamical, scalable and often virtuMized resources are provided as services. With virtualization technology, cloud computing offers diverse services （such as virtual computing, virtual storage, virtual bandwidth, etc.） for the public by means of multi-tenancy mode. Although users are enjoying the capabilities of super-computing and mass storage supplied by cloud computing, cloud security still remains as a hot spot problem, which is in essence the trust management between data owners and storage service providers. In this paper, we propose a data coloring method based on cloud watermarking to recognize and ensure mutual reputations. The experimental results show that the robustness of reverse cloud generator can guarantee users＇ embedded social reputation identifications. Hence, our work provides a reference solution to the critical problem of cloud security.

An Evaluation Approach of Subjective Trust Based on Cloud Model

As online trade and interactions on the internet are on the rise, a key issue is how to use simple and effective evaluation methods to accomplish trust decision-making for customers. It is well known that subjective trust holds uncertainty like randomness and fuzziness. However, existing approaches which are commonly based on probability or fuzzy set theory can not attach enough importance to uncertainty. To remedy this problem, a new quantifiable subjective trust evaluation approach is proposed based on the cloud model. Subjective trust is modeled with cloud model in the evaluation approach, and expected value and hyper-entropy of the subjective cloud is used to evaluate the reputation of trust objects. Our experimental data shows that the method can effectively support subjective trust decisions and provide a helpful exploitation for subjective trust evaluation.

MTBAC： A Mutual Trust Based Access Control Model in Cloud Computing

As a new computing mode,cloud computing can provide users with virtualized and scalable web services,which faced with serious security challenges,however.Access control is one of the most important measures to ensure the security of cloud computing.But applying traditional access control model into the Cloud directly could not solve the uncertainty and vulnerability caused by the open conditions of cloud computing.In cloud computing environment,only when the security and reliability of both interaction parties are ensured,data security can be effectively guaranteed during interactions between users and the Cloud.Therefore,building a mutual trust relationship between users and cloud platform is the key to implement new kinds of access control method in cloud computing environment.Combining with Trust Management(TM),a mutual trust based access control(MTBAC) model is proposed in this paper.MTBAC model take both user's behavior trust and cloud services node's credibility into consideration.Trust relationships between users and cloud service nodes are established by mutual trust mechanism.Security problems of access control are solved by implementing MTBAC model into cloud computing environment.Simulation experiments show that MTBAC model can guarantee the interaction between users and cloud service nodes.

Trusted Heartbeat Framework for Cloud Computing

In cloud computing environment, as the infrastructure not owned by users, it is desirable that its security and integrity must be protected and verified time to time. In Hadoop based scalable computing setup, malfunctioning nodes generate wrong output during the run time. To detect such nodes, we create collaborative network between worker node (i.e. data node of Hadoop) and Master node (i.e. name node of Hadoop) with the help of trusted heartbeat framework (THF). We propose procedures to register node and to alter status of node based on reputation provided by other co-worker nodes.

Research on Mobile Internet Mobile Agent System Dynamic Trust Model for Cloud Computing

This paper analyzes the reasons for the formation of security problems in mobile agent systems, and analyzes and compares the security mechanisms and security technologies of existing mobile agent systems from the perspective of blocking attacks. On this basis, the host protection mobile agent protection technology is selected, and a method to enhance the security protection of mobile agents (referred to as IEOP method) is proposed. The method first encrypts the mobile agent code using the encryption function, and then encapsulates the encrypted mobile agent with the improved EOP protocol IEOP, and then traces the suspicious execution result. Experiments show that using this method can block most malicious attacks on mobile agents, and can protect the integrity and confidentiality of mobile agents, but the increment of mobile agent tour time is not large.

Multiway Dynamic Trust Chain Model on Virtual Machine for Cloud Computing

This paper sums up four security factors after analyzing co-residency threats caused by the special multitenant environment in the cloud.To secure the factors,a multiway dynamic trust chain transfer model was proposed on the basis of a measurement interactive virtual machine and current behavior to protect the integrity of the system.A trust chain construction module is designed in a virtual machine monitor.Through dynamic monitoring,it achieves the purpose of transferring integrity between virtual machine.A cloud system with a trust authentication function is implemented on the basis of the model,and its practicability is shown.

Trust Assessment Model Based on a Zero Trust Strategy in a Community Cloud Environment

The adoption of Cloud Computing services in everyday business life has grown rapidly in recent years due to the many benefits of this paradigm. The various collaboration tools offered by Cloud Computing have eliminated or reduced the notion of distance between entities of the same company or between different organizations. This has led to an increase in the need to share resources (data and services). Community Cloud environments have thus emerged to facilitate interactions between organizations with identical needs and with specific and high security requirements. However, establishing trust and secure resource sharing relationships is a major challenge in this type of complex and heterogeneous environment. This paper proposes a trust assessment model (SeComTrust) based on the Zero Trust cybersecurity strategy. First, the paper introduces a community cloud architecture subdivided into different security domains. Second, it presents a process for selecting a trusted organization for an exchange based on direct or recommended trust value and reputation. Finally, a system for promoting or relegating organizations in the different security domains is applied. Experimental results show that our model guarantees the scalability of a community cloud with a high success rate of secure and quality resource sharing.

Trustworthy Assurance of Service Interoperation in Cloud Environment

Cloud computing can be realized by service interoperation and its essence is to provide cloud services through network. The development of effective methods to assure the trustworthiness of service interoperation in cloud environment is a very important problem. The essence of cloud security is trust and trust management. Combining quality of service （QoS） with trust model, this paper constructs a QoS-aware and quantitative trust-model that consists of initial trust value, direct trust value, and recommendatory trust value of service, making the provision, discovery, and aggregation of cloud services trustworthy. Hence, it can assure trustworthiness of service interoperation between users and services or among services in cloud environment. At the same time, based on this model, service discovery method based on QoS-aware and quantitative trust-model （TQoS-WSD） is proposed, which makes a solid trust relationship among service requestor, service provider and service recommender, and users can find trustworthy service whose total evaluation value is higher. Corapared to QoS-based service discovery （QoS-WSD） method, it is proved by the experiment for TQoS-WSD method that more accurate result of service discovery will be achieved by service requestor, while reasonable time cost is increased. Meanwhile, TQoS-WSD method strongly resists the effect of service discovery by untrustworthy QoS values and improves service invocation success-rate and thus assures trustworthiness of services interoperation.

Shared Resource Quality Monitoring and Dynamic Trust Management in a Community Cloud

The collaboration tools offered by Cloud Computing have increased the need to share data and services within companies or between autonomous organizations. This has led to the deployment of community cloud infrastructures. However, several challenges will arise from this grouping of heterogeneous organizations. One of the main challenges is the management of trust between the actors of the community. Trust issues arise from the uncertainty about the quality of the resources and entities involved. The quality of a resource can be examined from a security or functional perspective. Therefore, ensuring security and monitoring the quality of resources is to ensure a high level of trust. Therefore, we propose in this paper a technique for dynamic trust management and quality monitoring of resources shared between organizations. Our approach consists, on the one hand, in evaluating the quality of resources based on quality of service measurement attributes and, on the other hand, in updating the trust values according to the information deduced from these measurements. The proposed framework is evaluated in terms of resource sharing success rate and execution time. Experimental results and comparison with TNA-SL and InterTrust models show that the framework can identify and track the behavior of malicious organizations with relatively low execution time.

Trust Based Meta-Heuristics Workflow Scheduling in Cloud Service Environment

Cloud computing has emerged as a new style of computing in distributed environment. An efficient and dependable Workflow Scheduling is crucial for achieving high performance and incorporating with enterprise systems. As an effective security services aggregation methodology, Trust Work-flow Technology (TWT) has been used to construct composite services. However, in cloud environment, the existing closed network services are maintained and functioned by third-party organizations or enterprises. Therefore service-oriented trust strategies must be considered in workflow scheduling. TWFS related algorithms consist of trust policies and strategies to overcome the threats of the application with heuristic workflow scheduling. As a significance of this work, trust based Meta heuristic workflow scheduling (TMWS) is proposed. The TMWS algorithm will improve the efficiency and reliability of the operation in the cloud system and the results show that the TMWS approach is effective and feasible.

可信赖云计算的通信防火墙攻击捕获系统设计

为提高通信防火墙攻击捕获的有效性,提出基于可信赖云计算的通信防火墙攻击捕获系统。系统硬件设计过滤器、内核防火墙和捕获器,过滤器执行数据分流过滤,内核防火墙执行iptables命令和ebtables命令完成信息匹配,捕获器对5种虚拟路径进行分析,完成信息捕获。可信赖云计算软件设计,构建不同数据包的概率密度函数,判读数据是否为攻击信息。实验结果表明,所设计系统能够保证计算密集型任务的执行成功率达到90%以上,降低计算过程的收敛程度。

面向城轨云平台边界安全防护的动态信任管理方法

针对城轨云平台边界数量多、边界安全防护薄弱的问题,分析了城轨云与工业控制网络协同交互过程,提出了一种面向城轨云平台边界安全防护的动态信任管理方法,包括异常行为识别、信任评估、信任更新、基于信任值的动态访问控制。根据城轨云的综合监控系统网络拓扑,分析了未经授权控制指令、违规控制指令、干扰正常控制指令三类异常行为。结果表明,所提出的动态信任管理方法能够有效抵御恶意节点发起的异常行为;对于不同节点、不同异常行为的信任值变化不同;符合“缓升快降”的规则,能够保障城轨云平台细粒度的边界安全防护。

投保抑或认证下云平台的安全信息披露策略研究

针对一个由云应用开发商和云平台运营商构成的云服务供应链,构建信号博弈和信息共享模型,对比分析云平台运营商在仅投保、仅认证和既投保又认证3种情境下的最优安全信息披露策略,并讨论云认证对消费者剩余和社会福利的影响。研究发现:基于投保水平的信号传递可以实现分离均衡,但当运营成本小于其阈值时,云平台运营商需承担信号成本;当云认证带给用户的效用足够高时,云平台运营商进行云认证是有利可图的;无论云认证效用水平如何,云平台运营商会选择既投保又认证的双策略;政府对云认证的补贴能有效提升消费者剩余和社会总福利。

2023年网络安全热点技术领域全景扫描

网络安全离不开防火墙、通信加密和身份识别等技术的支撑,而网络安全技术的每一次迭代升级,都可能因技术优势易手而引起全球网络格局的重新洗牌。正因如此,近年来各国都在积极开发和运用与网络安全有关的新兴技术,以利用先进的网络技术来为军事、经济和舆论等领域的竞争提供助力。对此,分别阐述了人工智能、零信任、云环境、太空网络和量子信息技术这5个网络安全热点技术领域在2023年的发展态势,并分析研判了新兴技术在网络安全应用领域的未来趋势。

基于TrustZone的可信移动终端云服务安全接入方案

可信云架构为云计算用户提供了安全可信的云服务执行环境,保护了用户私有数据的计算与存储安全.然而在移动云计算高速发展的今天,仍然没有移动终端接入可信云服务的安全解决方案.针对上述问题,提出了一种可信移动终端云服务安全接入方案.方案充分考虑了移动云计算应用背景,利用ARM Trust Zone硬件隔离技术构建可信移动终端,保护云服务客户端及安全敏感操作在移动终端的安全执行.结合物理不可克隆函数技术,给出了移动终端密钥与敏感数据管理机制.在此基础上,借鉴可信计算技术思想设计了云服务安全接入协议.协议兼容可信云架构,提供云服务端与移动客户端间的端到端认证.分析了方案具备的6种安全属性,给出了基于方案的移动云存储应用实例,实现了方案的原型系统.实验结果表明:可信移动终端TCB较小,方案具有良好的可扩展性和安全可控性,整体运行效率较高.

基于改进蚁群算法的网络缓存资源寻址仿真

网络信息呈海量增加,资源数据传输频率逐渐加快,且所有用户在同样的时间占用不同的带宽资源,因此网络资源寻址难度较大。为了提高数据传输的准确度,确保集中访问的安全性,提出基于改进蚁群算法的网络缓存资源寻址方法。利用编码技术设计出编码策略,锁定寻址目标。通过改进蚁群算法制定出约束条件下的路由路径。结合约束条件、云信任度评估准则构建云信任度寻址模型,对路由路径中的节点完成表达、连接、管理和识别等处理,完成网络缓存资源的寻址。仿真结果表明,所提方法应用下网络数据存储开销不超过500MB,网络缓存资源寻址耗时平均为36.07ms,路径长度在10bit之内,测试所得数据均说明与现在方法相比,研究方法具有明显的应用优势。

无线局域网内多安全域间的密钥异地共享仿真

密钥在多个安全域之间传输时,会面临窃听、中间人攻击等多种安全风险。为了保障网络信息的安全传输,提出一种无线局域网多安全域间的密钥异地共享方法。基于局域网跨域访问形式的分析,结合云计算方法与信任机制概念,对跨域访问申请者的访问可信期望值展开计算,实现用户跨域访问行为的危险性判断。引入密钥共享策略,对重要信息展开初始化处理、子密钥生成、许可凭证生成以及密钥重构四个阶段的相关操作;在完成信息加密处理的同时,对信息共享群组内成员实施重组密钥分发,进而实现群组成员密钥的异地共享。实验证明,利用所提方法对重要信息展开加密处理后,信息的隐藏程度高,且具备优秀的抗攻击能力,对信息的存储及传输安全具有重大意义。

基于零信任的“一机多网”云桌面设计

企事业单位内通常使用传统PC作为办公桌面终端,安全性难以保证,容易发生文件泄露、网络攻击等安全事件,同时,系统间被要求网络隔离,导致办公桌需要放置多台PC,严重占用办公桌空间,浪费成本。针对上述问题,以云桌面作为桌面终端,融合零信任的安全理念,提出一种基于零信任的“一机多网”云桌面架构,此架构在传统云桌面的基础上,使用网络隔离切换器保证网络的传输安全以及强逻辑隔离,并将公网访问端口匿名化,进一步提升桌面终端安全性,同时有效减少传统办公PC的冗余。

基于可信隐式第三方的机载软件审计方法

分布式云存储技术为数量日益庞大的机载软件提供了新的分发与存储方式,这意味着航空公司失去了对软件的直接控制,因此机载软件安全成为了航空公司十分关注的问题。为了提高云存储环境下机载软件的安全性,提出了一种基于可信隐式第三方(Trusted Implicit Third Party,TITP)的机载软件审计方法对云上机载软件进行监控与管理,以确保机载软件的完整性。此外,由部署在云端的可信硬件代替用户进行审计工作,解决了可公开验证审计机制中第三方审计者不完全可信的问题,并以日志的方式记录审计结果以供用户查询。运用可信硬件进行完整性验证不仅降低了用户计算成本,而且缩短了用户在线时间。与其他可信隐式第三方审计方法进行实验对比,所提方法在审计计算过程中节省了10%的时间消耗。

基于零信任的广域网办公云桌面设计

随着全球化和信息化的发展,许多企业采用“总部-多网点”的广域网分散型模式部署办公桌面,以实现分布式、灵活的办公方式,但该部署模式通常节点较为分散且距离很远,存在无法保证数据安全,跨地域数据共享困难,IT运维人员运维效率低和IT资源难以统一管控等问题。该文针对上述问题,提出了一种基于零信任的广域网办公云桌面架构,采用云桌面的办公桌面部署技术,引入零信任安全模型,通过建立安全访问通道、优化可信认证方案、应用细粒度访问控制等措施,使“总部-多网点”的广域网办公桌面环境在安全、稳定和高效性方面得到有效保障。