Communication access control method based on software defined networking for virtual machines in IaaS platforms

doi:10.11772/j.issn.1001-9081.2015.05.1262

Journal of Computer Applications ›› 2015, Vol. 35 ›› Issue (5): 1262-1266.DOI: 10.11772/j.issn.1001-9081.2015.05.1262

Previous Articles Next Articles

Communication access control method based on software defined networking for virtual machines in IaaS platforms

HAN Zhenyang, CHEN Xingshu, HU Liang, CHEN Lin

College of Computer Science, Sichuan University, Chengdu Sichuan 610065, China

Received:2014-11-24 Revised:2015-01-08 Online:2015-05-10 Published:2015-05-14

基于软件定义网络的IaaS虚拟机通信访问控制方法

韩贞阳, 陈兴蜀, 胡亮, 陈林

四川大学计算机学院, 成都 610065

通讯作者: 陈兴蜀
作者简介:韩贞阳(1988-),男,河南商丘人,硕士研究生,主要研究方向:云计算网络; 陈兴蜀(1968-),女,四川成都人,教授,博士生导师,博士,主要研究方向:信息安全、计算机网络、云计算; 胡亮(1990-),男,四川成都人,硕士研究生,主要研究方向:云计算安全; 陈林(1983-),男,四川宜宾人,博士研究生,主要研究方向:云计算安全.
基金资助:
国家科技支撑计划项目(2012BAH18B05).

Abstract

Abstract:

Concerning the problem that the network access control of Virtual Machines (VM) in the cloud computing Infrastructure as a Service (IaaS) platforms, a method of communication access control for VM in IaaS platforms was proposed. The method based on Software Defined Networking (SDN) was realized to customize the communication access control rules from Layer 2 to Layer 4. The experimental results show that the method can manage communication access permissions of tenants' VM flexibly, and ensure the security of tenants' network.

Key words: Software Defined Networking (SDN), access control, cloud computing, Infrastructure as a Service (IaaS), firewall

摘要：

针对云计算基础设施即服务(IaaS)平台所面临的虚拟机网络通信访问控制问题,提出了一种可适于IaaS平台的虚拟机通信访问控制方法.该通信访问控制方法基于软件定义网络(SDN),实现针对虚拟机通信的L2~L4层访问控制.实验结果表明:该通信访问控制方法能够有效实现对租户虚拟机通信的灵活访问控制,保障IaaS平台中租户网络的安全.

关键词: 软件定义网络, 访问控制, 云计算, 基础设施即服务, 防火墙

CLC Number:

TP393.02

HAN Zhenyang, CHEN Xingshu, HU Liang, CHEN Lin. Communication access control method based on software defined networking for virtual machines in IaaS platforms[J]. Journal of Computer Applications, 2015, 35(5): 1262-1266.

韩贞阳, 陈兴蜀, 胡亮, 陈林. 基于软件定义网络的IaaS虚拟机通信访问控制方法[J]. 计算机应用, 2015, 35(5): 1262-1266.

References

[1] MELL P, GRANCE T. The NIST definition of cloud computing, NIST SP 800-145[R]. Gaithersburg: National Institute of Standards and Technology, 2011: 1-7.
[2] ONF Market Education Committee. Software-defined networking: the new norm for networks[M]. Palo Alto, California: Open Networking Foundation, 2012:1-12.
[3] ETSI. Network function virtualization introductory white paper [EB/OL]. [2014-08-10]. http://portal.etsi.org/nfv/nfv_white_paper.pdf.
[4] JANSEN W, GRANCE T. Guidelines on security and privacy in public cloud computing, NIST SP 800-144[J]. Gaithersburg: National Institute of Standards and Technology, 2011:23-24.
[5] ARCHER J, BOEHM A. Security guidance for critical areas of focus in cloud computing v3.0[R/OL].[2014-06-20].https://cloudsecurityalliance.org/csaguide.pdf.
[6] CATTEDDU D, HOGBEN G. Cloud computing: information assurance framework[C/OL] .[2014-06-20].http://www.enisa.europa.eu/act/rm/files/deliverables/cloud-computing-information-assurance-framework.
[7] VMware, Inc. Next generation security with VMware NSX and Palo Alto networks VM-series [EB/OL]. [2014-09-20]. http://www.vmware.com/files/pdf/products/nsx/NSX-Palo-Alto-Networks-WP.pdf.
[8] Internetworking task groups of IEEE 802.1. 802.1Qbg-edge virtual bridging [EB/OL]. [2014-12-31].http://www.ieee802.org/1/pages/ 802.1bg.html.
[9] Internetworking task groups of IEEE 802.1. 802. 1BR-bridge port extension [EB/OL]. [2014-12-31].http://www.ieee802.org/1/ pages/802.1br.html.
[10] TANG H, WANG J. Access control method: China, 103701822A[P] . 2014-04-02.(唐焕焕, 王军林. 访问控制方法: 中国, 103701822A[P] . 2014-04-02) .
[11] Open Netwroking Foundation. OpenFlow switch specification 1.3.1[EB/OL]. [2014-08-01].https://www.opennetworking.org/images/stories/downloads/specification/openflow-spec-v1.3.1.pdf.
[12] MAHALINGAM M, DUTT D, DUDA K, et al. VxLAN: a framework for overlaying virtualized layer 2 networks over layer 3 networks[EB/OL]. [2014-08-01]. http://tools.ietf.org/html/draft-mahalingam-dutt-dcops-vxlan-04.
[13] SRIDHARAN M, WANG Y, GRAG P, et al. NVGRE: network virtualization using generic routing encapsulation [EB/OL]. [2014-08-01]. http://tools.ietf.org/html/draft-sridharan-virtualization-nvgre-03.
[14] DAVIE B. STT: a stateless transport tunneling protocol for network virtualization[EB/OL]. [2014-08-15]. http://tools.ietf.org/html/draft-davie-stt-03.
[15] CHEN L, CHEN X, JIANG J, et al. The research and practice of dynamic network security architecture for IaaS platform[J]. Tsinghua Science and Technology, 2014, 19(5):496-507.
[16] THAMES J L, ABLER R, KEELING D. A distributed firewall and active response architecture providing preemptive protection[C]// Proceedings of the 46th Annual Southeast Regional Conference on XX. New York: ACM, 2008: 220-225.

Communication access control method based on software defined networking for virtual machines in IaaS platforms

基于软件定义网络的IaaS虚拟机通信访问控制方法

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	GE Jihong, SHEN Tao. Energy data access control method based on blockchain [J]. Journal of Computer Applications, 2021, 41(9): 2615-2622.
[2]	DU Xinyu, WANG Huaqun. Dynamic group based effective identity authentication and key agreement scheme in LTE-A networks [J]. Journal of Computer Applications, 2021, 41(6): 1715-1722.
[3]	CHEN Jiahao, YIN Xinchun. Traceable and revocable ciphertext-policy attribute-based encryption scheme based on cloud-fog computing [J]. Journal of Computer Applications, 2021, 41(6): 1611-1620.
[4]	GE Lina, HU Yugu, ZHANG Guifen, CHEN Yuanyuan. Reverse hybrid access control scheme based on object attribute matching in cloud computing environment [J]. Journal of Computer Applications, 2021, 41(6): 1604-1610.
[5]	BAO Yulong, ZHU Xueyang, ZHANG Wenhui, SUN Pengfei, ZHAO Yingqi. Formal verification of smart contract for access control in IoT applications [J]. Journal of Computer Applications, 2021, 41(4): 930-938.
[6]	YANG Ling, JIANG Chunmao. Strategy of energy-aware virtual machine migration based on three-way decision [J]. Journal of Computer Applications, 2021, 41(4): 990-998.
[7]	Xiaoling SUN, Guang YANG, Yanping SHEN, Qiuge YANG, Tao CHEN. Searchable encryption scheme based on splittable inverted index [J]. Journal of Computer Applications, 2021, 41(11): 3288-3294.
[8]	Li LI, Hongfei YANG, Xiuze DONG. Hierarchical file access control scheme with identity-based multi-conditional proxy re-encryption [J]. Journal of Computer Applications, 2021, 41(11): 3251-3256.
[9]	LYU Jiayu, ZHU Zhirong, YAO Zhiqiang. Two-channel dynamic data encryption strategy in cloud computing environment [J]. Journal of Computer Applications, 2020, 40(8): 2268-2273.
[10]	WANG Haiyong, PAN Qiqing, GUO Kaixuan. Access control model based on blockchain and user credit [J]. Journal of Computer Applications, 2020, 40(6): 1674-1679.
[11]	CHEN Chengjun, MAO Yingchi, WANG Yichao. CNN model compression based on activation-entropy based layer-wise iterative pruning strategy [J]. Journal of Computer Applications, 2020, 40(5): 1260-1265.
[12]	GUO Shujie, LI Zhihua, LIN Kaiqing. Fuzzy membership degree based virtual machine placement algorithmin cloud environment [J]. Journal of Computer Applications, 2020, 40(5): 1374-1381.
[13]	SHI Jinshan, LI Ru, SONG Tingting. Blockchain-based access control framework for Internet of things [J]. Journal of Computer Applications, 2020, 40(4): 931-941.
[14]	XU Yingxin, SUN Lei, ZHAO Jiancheng, GUO Songhui. Virtual field programmable gate array placement strategy based on ant colony optimization algorithm [J]. Journal of Computer Applications, 2020, 40(3): 747-752.
[15]	WANG Qingyong, MAO Yingchi, WANG Yichao, WANG Longbao. Computing task offloading based on multi-cloudlet collaboration [J]. Journal of Computer Applications, 2020, 40(2): 328-334.