针对云计算环境的安全性分析方法

With the rapid adoption of the concepts of cloud computing, an increasing trend for organizations and enterprises to realize sophisticated business processes and tasks by composing distributed service components offered by different service providers in the cloud. But cloud services are often built on diverse hardware and software platforms. Therefore, the types of vulnerabilities faced by composed services are also much more diverse than in traditional distributed systems. Today ，the methods prevalently adopted to assess cloud security cannot cope with the new characteristics of composite service in cloud, and the result of evaluation is less effective. Moreover it needs so much expert's experience to complete the assessment that it's impossible to be automatic. Relying on the existing efforts on network security assessment and cloud computing, the research plans to dive into cloud security issues and analyze the relationship of vulnerabilities. And we intend to propose a service-oriented approach to quantitatively analyze and evaluate the vulnerabilities in cloud and to assess cloud security. The approach will integrate vulnerability -based and model-based method to improve the effectiveness and to be automatic. Combining with cloud computing environment features, the research is of theoretical and practical significance to improve the effectiveness and automation degree of cloud assessment approaches.

云计算概念的迅速普及，越来越多的组织和企业采用组合服务模式，组合云环境中不同供应商提供的分布式服务组件，实现复杂的业务流程。与传统 IT环境相比， 服务面临的弱点属性发生很大变化，弱点种类和攻击方式也更加多样化。目前普遍采用的云安全评估方法，无法应对云环境组合服务新特性，评估结果准确性较低；需要依赖大量专家 经验，无法自动化评估。本项目拟依托项目组已有的网络安全领域评估技术和研究平台，以及基础设施云的设计实现技术和运维、应用经验，深入云计算环境安全问题，在此基础上分 析云环境弱点关联性，提出一种针对云计算环境的弱点量化评估方法和面向组合服务的安全评估方法，综合基于弱点和攻击模型的安全评估方法，在保证评估结果准确性基础上，实现 评估过程自动化。项目研究对于充分结合云计算环境服务特性，提高安全评估算法的准确性和自动化程度具有重要理论和实践意义。

研究表明，与传统IT环境相比，云计算服务模式的弱点种类和弱点攻击方式更为复杂。目前普遍采用的云安全评估方法，无法应对云环境组合服务新特性，评估结果准确性较低；需要依赖大量专家经验，无法自动化评估。针对以上问题，本项目从四个方面进行了深入研究：（1）面向云服务的弱点特性分析；（2）基于服务依赖关系的攻击图生成方法；（3）面向云服务的弱点量化评估方法；（4）云环境下用户虚拟网络安全评估方法。而后本项目基于上述理论研究构建实验系统并进行评估，分析了理论模型的可行性，并加以优化。本项目研究对于充分结合云计算环境服务特性，提高安全评估算法的准确性和自动化程度具有重要理论和实践意义。