云系统中多域安全策略规范与验证方法

为了有效管理云系统间跨域互操作中安全策略的实施,提出一种适用于云计算环境的多域安全策略验证管理技术。首先,研究了安全互操作环境的访问控制规则和安全属性,通过角色层次关系区分域内管理和域间管理,形式化定义了基于多域的角色访问控制（domRBAC）模型和基于计算树逻辑（CTL）的安全属性规范;其次,给出了基于有向图的角色关联映射算法,以实现domRBAC角色层次推理,进而构造出了云安全策略验证算法。性能实验表明,多域互操作系统的属性验证时间开销会随着系统规模的扩大而增加。技术采用多进程并行检测方式可将属性验证时间减少70.1%～88.5%,其模型优化检测模式相比正常模式的时间折线波动更小,且在大规模系统中的时间开销要明显低于正常模式。该技术在规模较大的云系统安全互操作中具有稳定和高效率的属性验证性能。     

云计算中基于信任的多域访问控制策略

在云计算环境中,访问控制策略是保障云用户与云资源/服务安全的有效手段。本文在分析云计算安全特点的基础上,将信任度的概念引入基于角色的访问控制策略,并结合云计算环境存在多个安全管理域的特点,给出了信任度在本地域以及跨域的计算方法,提出基于信任度的多域访问控制框架。本地域的访问控制策略在RBAC的基础上引入信任度进行实施,而跨域的访问控制会涉及到角色转换。文章在基于信任的RBAC模型中,提出一种灵活的通过角色关联和动态角色转换实现跨域访问控制的方法。     

Ontology-based access control model for security policy reasoning in cloud computing

There are many security issues in cloud computing service environments, including virtualization, distributed big-data processing, serviceability, traffic management, application security, access control, authentication, and cryptography, among others. In particular, data access using various resources requires an authentication and access control model for integrated management and control in cloud computing environments. Cloud computing services are differentiated according to security policies because of differences in the permitted access right between service providers and users. RBAC (Role-based access control) and C-RBAC (Context-aware RBAC) models do not suggest effective and practical solutions for managers and users based on dynamic access control methods, suggesting a need for a new model of dynamic access control that can address the limitations of cloud computing characteristics. This paper proposes Onto-ACM (ontology-based access control model), a semantic analysis model that can address the difference in the permitted access control between service providers and users. The proposed model is a model of intelligent context-aware access for proactively applying the access level of resource access based on ontology reasoning and semantic analysis method.     

一种面向多域云系统的扩展RBAC模型

提出一种扩展的基于角色的访问控制ERBAC模型,以解决RBAC在多域云系统的资源使用约束、策略管理和互操作安全性等方面存在的不足。首先,通过引入容器元素和两类角色基数约束,构建了基于容器元素+动态角色基数约束的资源使用策略;其次,深入研究了多域角色继承管理,提出基于先检测后建立角色关系的域间策略管理函数,并给出各类安全策略冲突检测算法。分析表明,ERBAC模型实现了资源使用约束、支持高效的安全策略管理,提高了跨域互操作的安全性,且性能测试说明了该模型在多域云系统中具有适应性和可行性。     

Contract RBAC in cloud computing

Cloud computing is a fast growing field, which is arguably a new computing paradigm. In cloud computing, computing resources are provided as services over the Internet and users can access resources based on their payments. The issue of access control is an important security scheme in the cloud computing. In this paper, a Contract RBAC model with continuous services for user to access various source services provided by different providers is proposed. The Contract RBAC model extending from the well-known RBAC model in cloud computing is shown. The extending definitions in the model could increase the ability to meet new challenges. The Contract RBAC model can provide continuous services with more flexible management in security to meet the application requirements including Intra-cross cloud service and Inter-cross cloud service. Finally, the performance analyses between the traditional manner and the scheme are given. Therefore, the proposed Contract RBAC model can achieve more efficient management for cloud computing environments.     

基于可信期望的跨域访问安全性研究

访问控制作为保护信息安全的主要手段,能够有效保证用户合法地访问网络资源。随着移动互联网的发展,跨域和跨系统等多域环境下的安全问题面临严峻挑战。为了满足云计算多域环境的访问需求,基于角色访问控制技术,提出一种适用于云计算多域环境的访问控制模型。该模型利用贝叶斯理论得出访问者的可信期望值,然后与预先设定的访问阈值进行比较,决定用户的访问请求是否被允许,且访问权限随着用户可信度动态变化而改变,避免了之前获得高信任值的用户因信任度变化而进行恶意攻击的风险。实验结果表明,提出模型不仅能减少高风险用户的访问请求量,且能满足为用户动态授权的需求。因此该模型可以有效解决云计算多域环境中的安全问题。     

A policy-oriented secured service for the e-commerce applications in cloud

The communication process is very easy today due to the rapid growth of information technology. In addition, the development of cloud computing technology makes it easier than earlier days by facilitating the large volume of data exchange anytime and from anywhere in the world. E-businesses are successfully running today due to the development of cloud computing technology. Specifically in cloud computing, cloud services are providing enormous support to share the resources and data in an efficient way with less cost expenses for businessmen. However, security is an essential issue for cloud users and services. For this purpose, many security policies have been introduced by various researchers for enhancing the security in e-commerce applications. However, the available security policies are also failing to provide the secured services in the society and e-commerce applications. To overcome this disadvantage, we propose a new policy-oriented secured service model for providing the security of the services in the cloud. The proposed model is the combination of a trust aware policy scheduling algorithm and an effective and intelligent re-encryption scheme. Here, the dynamic trust aware policy-oriented service for allocating the cloud user’s request by the cloud service provider and an effective and re-encryption scheme is used that uses intelligent agent for storing the data in the cloud database securely. The proposed model assures the scalability, reliability, and security for the stored e-commerce data and service access.     

Fuzzy User Access Trust Model for Cloud Access Control

Cloud computing belongs to a set of policies, protocols, technologies through which one can access shared resources such as storage, applications, networks, and services at relatively low cost. Despite the tremendous advantages of cloud computing, one big threat which must be taken care of is data security in the cloud. There are a dozen of threats that we are being exposed to while availing cloud services. Insufficient identity and access management, insecure interfaces and Applications interfaces (APIs), hijacking, advanced persistent threats, data threats, and many more are certain security issues with the cloud platform. APIs and service providers face a huge challenge to ensure the security and integrity of both network and data. To overcome these challenges access control mechanisms are employed. Traditional access control mechanisms fail to monitor the user operations on the cloud platform and are prone to attacks like IP spoofing and other attacks that impact the integrity of the data. For ensuring data integrity on cloud platforms, access control mechanisms should go beyond authentication, identification, and authorization. Thus, in this work, a trust-based access control mechanism is proposed that analyzes the data of the user behavior, network behavior, demand behavior, and security behavior for computing trust value before granting user access. The method that computes the final trust value makes use of the fuzzy logic algorithm. The trust value-based policies are defined for the access control mechanism and based on the trust value outcome the access control is granted or denied.     

Specification and enforcement of flexible security policy for active cooperation

Interoperation and services sharing among different systems are becoming new paradigms for enterprise collaboration. To keep ahead in strong competition environments, an enterprise should provide flexible and comprehensive services to partners and support active collaborations with partners and customers. Achieving such goals requires enterprises to specify and enforce flexible security policies for their information systems. Although the area of access control has been widely investigated, current approaches still do not support flexible security policies able to account for different weighs that typically characterize the various attributes of the requesting parties and transactions and reflect the access control criteria that are relevant for the enterprise. In this paper we propose a novel approach that addresses such flexibility requirements while at the same time reducing the complexity of security management. To support flexible policy specification, we define the notion of restraint rules for authorization management processes and introduce the concept of impact weight for the conditions in these restraint rules. We also introduce a new data structure for the encoding of the condition tree as well as the corresponding algorithm for efficiently evaluating conditions. Furthermore, we present a system architecture that implements above approach and supports interoperation among heterogeneous platforms.     

云环境下组合电子健康记录访问控制框架

针对云环境下电子健康记录信息安全共享的需求提出云环境下组合电子健康记录访问控制框架.在该框架中基于多个CDA文档的逻辑关系,提出并构建组合电子健康记录结构,应用基于属性的多级安全访问控制策略实现组合电子健康记录的安全管理,应用基于XLINK技术的XML Web服务实现组合电子健康记录的下载和查看.通过对比分析可说明,与已有方案相比,本方案提出的框架更加适合云环境下的电子健康信息安全共享.     

分布式云的研究进展综述

云计算作为全新的计算模式,将数据中心的资源包括计算、存储等基础设施资源通过虚拟化技术以服务的形式交付给用户,使得用户可以通过互联网按需访问云内计算资源来运行应用.为面向用户提供更好的服务,分布式云跨区域联合多个云站点,创建巨大的资源池,同时利用地理分布优势改善服务质量.近年来分布式云的研究逐渐成为学术界和工业界的热点.文中围绕分布式云系统中研究的基本问题,介绍了国际国内的研究现状,包括分布式云系统的架构设计、资源调度与性能优化策略和云安全方案等,并展望分布式云的发展趋势.     

面向移动云计算弹性应用的安全模型

根据云计算资源建立了资源受限设备弹性应用的安全模型。首先介绍了由一个或多个Weblet组成的一个弹性应用程序,每个Weblet可在移动设备端或云端启动,Weblet之间可根据所处的计算环境的动态变化或用户的配置进行迁移。分析了该模式的安全性,提出建立弹性应用程序的安全设计模型,包括实现Weblet运行所在的移动设备端和云端之间的身份验证、安全会话管理和通过外部网络的访问服务。该模型解决了Weblet之间的安全迁移和授权云Weblet通过外部Web网络去访问敏感用户数据的问题。该方案能应用在云计算场景,如在企业应用环境下的私有云和公有云之间的应用集成。     

A specification model for context-based collaborative applications

This paper presents a model for building context-based systems in pervasive computing environments from high level specifications. A pervasive computing environment is viewed as a collaboration space consisting of mobile users, system services, and sensors and resources embedded in the physical environment. The approach presented here is developed for building collaborative activities in which users and environment services cooperate towards some shared objectives and tasks. The specification model allows expression of policies related to context-based discovery and secure access of resources, and role-based interactions among users and environmental services. Using several examples we illustrate the capabilities of our specification model for expressing various kinds of context-based requirements for resource access and user interactions.     

Safeguarding Cloud Computing Infrastructure: A Security Analysis

Cloud computing is the provision of hosted resources, comprising software, hardware and processing over the World Wide Web. The advantages of rapid deployment, versatility, low expenses and scalability have led to the widespread use of cloud computing across organizations of all sizes, mostly as a component of the combination/multi-cloud infrastructure structure. While cloud storage offers significant benefits as well as cost-effective alternatives for IT management and expansion, new opportunities and challenges in the context of security vulnerabilities are emerging in this domain. Cloud security, also recognized as cloud computing security, refers to a collection of policies, regulations, systematic processes that function together to secure cloud infrastructure systems. These security procedures are designed to safeguard cloud data, to facilitate regulatory enforcement and to preserve the confidentiality of consumers, as well as to lay down encryption rules for specific devices and applications. This study presents an overview of the innovative cloud computing and security challenges that exist at different levels of cloud infrastructure. In this league, the present research work would be a significant contribution in reducing the security attacks on cloud computing so as to provide sustainable and secure services.     

A survey on security challenges in cloud computing: issues,threats, and solutions

Cloud computing has gained huge attention over the past decades because of continuously increasing demands. There are several advantages to organizations moving toward cloud-based data storage solutions. These include simplified IT infrastructure and management, remote access from effectively anywhere in the world with a stable Internet connection and the cost efficiencies that cloud computing can bring. The associated security and privacy challenges in cloud require further exploration. Researchers from academia, industry, and standards organizations have provided potential solutions to these challenges in the previously published studies. The narrative review presented in this survey provides cloud security issues and requirements, identified threats, and known vulnerabilities. In fact, this work aims to analyze the different components of cloud computing as well as present security and privacy problems that these systems face. Moreover, this work presents new classification of recent security solutions that exist in this area. Additionally, this survey introduced various types of security threats which are threatening cloud computing services and also discussed open issues and propose future directions. This paper will focus and explore a detailed knowledge about the security challenges that are faced by cloud entities such as cloud service provider, the data owner, and cloud user.

     

基于云计算的数据安全风险及防范策略探讨

云计算依托计算机网络系统,目前已经成为人们生活的重要部分,随着网络化、虚拟化生活的加速发展,诸如Google、Microsoft、Apple、Amazon、IBM等互联网IT和手机、网络运营商巨头开始重新定位企业发展的战略核心.云计算作为IT商业计算模型,它将计算任务分布在各种类型的广域网络和局域网络组成计算机网络系统,使用户能够借助网络按需获取计算力、存储空间和信息服务.云计算的用户通过PC、手机以及其他终端连接到网络使用云资源;随着云计算的广泛应用,云计算的环境安全环境、数据安全成为突出问题,如何保障云计算的安全成为当前急需解决的问题.本文介绍了云计算相关概念,以及对云计算数据安全风险进行分析,并提出了防范策略.     

云环境下自动信任协商机制研究

针对云计算环境带来的安全性问题,在目前云安全模型研究的基础上,对分层的云服务框架模型进行了安全性分析.综合考虑云计算环境特点,在不影响云服务质量的前提下保证数据安全,建立了一个云安全访问控制模型ACCP.该模型利用自动信任协商机制可以不依靠数据中心第三方安全服务,通过双方信任证集的交互和策略的控制自适应地建立组合安全域.通过在用户-服务以及组合服务之间两个场景下信任协商建立过程,表明了模型可行性和有效性.     

A formal role-based access control model for security policies in multi-domain mobile networks

Mobile users present challenges for security in multi-domain mobile networks. The actions of mobile users moving across security domains need to be specified and checked against domain and inter-domain policies. We propose a new formal security policy model for multi-domain mobile networks, called FPM-RBAC, Formal Policy Model for Mobility with Role Based Access Control. FPM-RBAC supports the specification of mobility and location constraints, role hierarchy mapping, inter-domain services, inter-domain access rights and separation of duty. Associated with FPM-RBAC, we also present a formal security policy constraint specification language for domain and inter-domain security policies. Formal policy constraint specifications are based on ambient logic and predicate logic. We also use ambient calculus to specify the current state of a mobile network and actions within security policies for evaluation of access requests according to security policies. A novel aspect of the proposed policy model is the support for formal and automated analysis of security policies related to mobility within multiple security domains.     

Security and Control in the Cloud

ABSTRACT

Cloud computing is a new IT delivery paradigm that offers computing resources as on-demand services over the Internet. Like all forms of outsourcing, cloud computing raises serious concerns about the security of the data assets that are outsourced to providers of cloud services. To address these security concerns, we show how today's generation of information security management systems (ISMSs), as specified in the ISO/IEC 27001:2005, must be extended to address the transfer of security controls into cloud environments. The resulting virtual ISMS is a standards-compliant management approach for developing a sound control environment while supporting the various modalities of cloud computing.

This article addresses chief security and/or information officers of cloud client and cloud provider organizations. Cloud clients will benefit from our exposition of how to manage risk when corporate assets are outsourced to cloud providers. Providers of cloud services will learn what processes and controls they can offer in order to provide superior security that differentiates their offerings in the market.     

云计算访问控制技术研究综述

随着云计算规模化和集约化的发展,云安全问题成为云计算领域亟待突破的重要问题.访问控制技术是安全问题的重中之重,其任务是通过限制用户对数据信息的访问能力及范围,保证信息资源不被非法使用和访问.主要对目前云计算环境下的访问控制问题进行研究,首先介绍访问控制理论;然后分析了云计算环境下的访问控制技术体系框架,重点从云计算访问控制模型、基于ABE(attribute-based encryption)密码体制的云计算访问控制、云中多租户及虚拟化访问控制这3个方面对云计算环境下的访问控制问题进行综述,并且调研了工业界云服务提供商和开源云平台的访问控制机制;最后对未来的研究趋势进行了展望.