The purpose of this quantitative study was to determine the relationship between the security management framework of organizations and the security condition of the virtualized environment.
Three kinds of vulnerabilities that may exist in some of current virtualization-based security monitoring systems were proposed： page mapping problem,lack of overall protection,and inherent limitations. Aiming at the...Three kinds of vulnerabilities that may exist in some of current virtualization-based security monitoring systems were proposed： page mapping problem,lack of overall protection,and inherent limitations. Aiming at these vulnerabilities,relative attack methods were presented in detail. Our experiments show that the attack methods,such as page mapping attack,data attack,and non-behavior detection attack,can attack simulated or original security monitors successfully. Defenders,who need to effectively strengthen their security monitors,can get an inspiration from these attack methods and find some appropriate solutions.展开更多
The data and applications in cloud computing reside in cyberspace, that allowing to users access data through any connection device, when you need to transfer information over the cloud, you will lose control of it. T...The data and applications in cloud computing reside in cyberspace, that allowing to users access data through any connection device, when you need to transfer information over the cloud, you will lose control of it. There are multi types of security challenge must be understood and countermeasures. One of the major security challenges is resources of the cloud computing infrastructures are provided as services over the Internet, and entire data in the cloud computing are reside over network resources, that enables the data to be access through VMs. In this work, we describe security techniques for securing a VCCI, VMMs such as Encryption and Key Management (EKM), Access Control Mechanisms (ACMs), Virtual Trusted Platform Module (vTPM), Virtual Firewall (VF), and Trusted Virtual Domains (TVDs). In this paper we focus on security of virtual resources in Virtualized Cloud Computing Infrastructure (VCCI), Virtual Machine Monitor (VMM) by describing types of attacks on VCCI, and vulnerabilities of VMMs and we describe the techniques for securing a VCCI.展开更多
Remote access is a means of accessing resources outside one’s immediate physical location. This has made employee mobility more effective and productive for most organizations. Remote access can be achieved via vario...Remote access is a means of accessing resources outside one’s immediate physical location. This has made employee mobility more effective and productive for most organizations. Remote access can be achieved via various channels of remote communication, the most common being Virtual Private Networks (VPNs). The demand for remote access is on the rise, especially during the Covid-19 pandemic, and will continue to increase as most organizations are re-structuring to make telecommuting a permanent part of their mode of operation. Employee mobility, while presenting organizations with some advantages, comes with the associated risk of exposing corporate cyber assets to attackers. The remote user and the remote connectivity technology present some vulnerabilities which can be exploited by any threat agent to violate the confidentiality, integrity and availability (CIA) dimensions of these cyber assets. So, how are users and remote devices authenticated? To what extent is the established connection secured? With employee mobility on the rise, it is necessary to analyze the user authentication role since the mobile employee is not under the monitoring radar of the organization, and the environment from which the mobile employee connects may be vulnerable. In this study, an experiment was setup to ascertain the user authentication roles. The experiment showed the process of 2FA in user authentication and it proved to be an effective means of improving user authentication during remote access. This was depicted via the use of what the user has (mobile phone/soft-token) as a second factor in addition to what the user knows, i.e. password. This authentication method overcomes the security weaknesses inherent in single-factor user authentication via the use of password only. However, the results also showed that though 2FA user authentication ensures security, the remote devices could exhibit further vulnerabilities and pose serious risks to the organization. Thus, a varied implementation was recommended to further enhance the security of remote access communication with regards to the remote user authentication.展开更多
Based on the analysis of developing target, function and constitution of research projects system for remote management, the virtual account system is established on 3 layers of B/S mode. The development process of vi...Based on the analysis of developing target, function and constitution of research projects system for remote management, the virtual account system is established on 3 layers of B/S mode. The development process of virtual account system is realized by JSP/Servlets development language and MySQL database under windows server 2003 platform. At the same time, network security module of the system has been realized to reduce the influence caused by network security incidents. The system is capable of updating the information of vertical and horizontal projects dynamically and assigning virtual funds on WWW. Also, it realizes the query, statistical analysis function and so on. Practical results show that the system is a successful system for analyzing the various projects index of different departments.展开更多
软件定义网络SDN(Software Defined Networking)的软件编程特性和开放性带来很多新的安全挑战,也给网络安全带来了挑战和机遇.本文提出了两种演进的SDN网络安全架构:虚拟化安全设备(Virtualized Security Appliance)和软件定义安全(Soft...软件定义网络SDN(Software Defined Networking)的软件编程特性和开放性带来很多新的安全挑战,也给网络安全带来了挑战和机遇.本文提出了两种演进的SDN网络安全架构:虚拟化安全设备(Virtualized Security Appliance)和软件定义安全(Software Defined Security),给出了两种架构的建设要点,并以常规网络入侵、拒绝服务攻击和高级持续威胁等三类典型攻击场景分析了相应的工作原理,以防火墙为例演示了两种架构下的实现,测试表明两种结构在云计算中心环境中性能上是可行的,并且SDN数据和控制分离的特性使防火墙可用更少的代码实现.展开更多
针对多旋转关节空间太阳能电站(Space Solar Power Station,SSPS),提出一种环形拓扑的电力系统架构。基于功率分层准则对SSPS电力拓扑架构进行设计,提出U1～U7共7个层级、母线电压5000V、功率等级为MW的太阳能电站电力系统。针对分层架...针对多旋转关节空间太阳能电站(Space Solar Power Station,SSPS),提出一种环形拓扑的电力系统架构。基于功率分层准则对SSPS电力拓扑架构进行设计,提出U1～U7共7个层级、母线电压5000V、功率等级为MW的太阳能电站电力系统。针对分层架构中多太阳电池阵子阵并联(U6层),提出分层功率平衡统一控制策略,对MPPT控制、MPPT控制+稳定直流母线电压混合控制、MPPT算法+下垂稳定直流母线电压混合控制三种控制方法开展仿真分析。结果表明,提出的基于虚拟阻抗的下垂控制策略可以有效调节、分配功率,解决了空间发电站母线电压无法稳定的问题。展开更多
文摘The purpose of this quantitative study was to determine the relationship between the security management framework of organizations and the security condition of the virtualized environment.
基金Supported by National 242 Plan Project(2005C48)the Technology Innovation Programme Major Projects of Beijing Institute of Technology(2011CX01015)
文摘Three kinds of vulnerabilities that may exist in some of current virtualization-based security monitoring systems were proposed： page mapping problem,lack of overall protection,and inherent limitations. Aiming at these vulnerabilities,relative attack methods were presented in detail. Our experiments show that the attack methods,such as page mapping attack,data attack,and non-behavior detection attack,can attack simulated or original security monitors successfully. Defenders,who need to effectively strengthen their security monitors,can get an inspiration from these attack methods and find some appropriate solutions.
文摘The data and applications in cloud computing reside in cyberspace, that allowing to users access data through any connection device, when you need to transfer information over the cloud, you will lose control of it. There are multi types of security challenge must be understood and countermeasures. One of the major security challenges is resources of the cloud computing infrastructures are provided as services over the Internet, and entire data in the cloud computing are reside over network resources, that enables the data to be access through VMs. In this work, we describe security techniques for securing a VCCI, VMMs such as Encryption and Key Management (EKM), Access Control Mechanisms (ACMs), Virtual Trusted Platform Module (vTPM), Virtual Firewall (VF), and Trusted Virtual Domains (TVDs). In this paper we focus on security of virtual resources in Virtualized Cloud Computing Infrastructure (VCCI), Virtual Machine Monitor (VMM) by describing types of attacks on VCCI, and vulnerabilities of VMMs and we describe the techniques for securing a VCCI.
文摘Remote access is a means of accessing resources outside one’s immediate physical location. This has made employee mobility more effective and productive for most organizations. Remote access can be achieved via various channels of remote communication, the most common being Virtual Private Networks (VPNs). The demand for remote access is on the rise, especially during the Covid-19 pandemic, and will continue to increase as most organizations are re-structuring to make telecommuting a permanent part of their mode of operation. Employee mobility, while presenting organizations with some advantages, comes with the associated risk of exposing corporate cyber assets to attackers. The remote user and the remote connectivity technology present some vulnerabilities which can be exploited by any threat agent to violate the confidentiality, integrity and availability (CIA) dimensions of these cyber assets. So, how are users and remote devices authenticated? To what extent is the established connection secured? With employee mobility on the rise, it is necessary to analyze the user authentication role since the mobile employee is not under the monitoring radar of the organization, and the environment from which the mobile employee connects may be vulnerable. In this study, an experiment was setup to ascertain the user authentication roles. The experiment showed the process of 2FA in user authentication and it proved to be an effective means of improving user authentication during remote access. This was depicted via the use of what the user has (mobile phone/soft-token) as a second factor in addition to what the user knows, i.e. password. This authentication method overcomes the security weaknesses inherent in single-factor user authentication via the use of password only. However, the results also showed that though 2FA user authentication ensures security, the remote devices could exhibit further vulnerabilities and pose serious risks to the organization. Thus, a varied implementation was recommended to further enhance the security of remote access communication with regards to the remote user authentication.
基金This work is supported by Liaoning Province Doctoral Startup Grant 20031069 and China National "863"CI MS Foundation ( NO2003AA412030 9 ,2004AA412020 08)
文摘Based on the analysis of developing target, function and constitution of research projects system for remote management, the virtual account system is established on 3 layers of B/S mode. The development process of virtual account system is realized by JSP/Servlets development language and MySQL database under windows server 2003 platform. At the same time, network security module of the system has been realized to reduce the influence caused by network security incidents. The system is capable of updating the information of vertical and horizontal projects dynamically and assigning virtual funds on WWW. Also, it realizes the query, statistical analysis function and so on. Practical results show that the system is a successful system for analyzing the various projects index of different departments.
文摘软件定义网络SDN(Software Defined Networking)的软件编程特性和开放性带来很多新的安全挑战,也给网络安全带来了挑战和机遇.本文提出了两种演进的SDN网络安全架构:虚拟化安全设备(Virtualized Security Appliance)和软件定义安全(Software Defined Security),给出了两种架构的建设要点,并以常规网络入侵、拒绝服务攻击和高级持续威胁等三类典型攻击场景分析了相应的工作原理,以防火墙为例演示了两种架构下的实现,测试表明两种结构在云计算中心环境中性能上是可行的,并且SDN数据和控制分离的特性使防火墙可用更少的代码实现.
文摘针对多旋转关节空间太阳能电站(Space Solar Power Station,SSPS),提出一种环形拓扑的电力系统架构。基于功率分层准则对SSPS电力拓扑架构进行设计,提出U1～U7共7个层级、母线电压5000V、功率等级为MW的太阳能电站电力系统。针对分层架构中多太阳电池阵子阵并联(U6层),提出分层功率平衡统一控制策略,对MPPT控制、MPPT控制+稳定直流母线电压混合控制、MPPT算法+下垂稳定直流母线电压混合控制三种控制方法开展仿真分析。结果表明,提出的基于虚拟阻抗的下垂控制策略可以有效调节、分配功率,解决了空间发电站母线电压无法稳定的问题。
