Communication access control method based on software defined networking for virtual machines in IaaS platforms

doi:10.11772/j.issn.1001-9081.2015.05.1262

Journal of Computer Applications ›› 2015, Vol. 35 ›› Issue (5): 1262-1266.DOI: 10.11772/j.issn.1001-9081.2015.05.1262

Previous Articles Next Articles

Communication access control method based on software defined networking for virtual machines in IaaS platforms

HAN Zhenyang, CHEN Xingshu, HU Liang, CHEN Lin

College of Computer Science, Sichuan University, Chengdu Sichuan 610065, China

Received:2014-11-24 Revised:2015-01-08 Online:2015-05-14 Published:2015-05-10

基于软件定义网络的IaaS虚拟机通信访问控制方法

韩贞阳, 陈兴蜀, 胡亮, 陈林

四川大学计算机学院, 成都 610065

通讯作者: 陈兴蜀
作者简介:韩贞阳(1988-),男,河南商丘人,硕士研究生,主要研究方向:云计算网络; 陈兴蜀(1968-),女,四川成都人,教授,博士生导师,博士,主要研究方向:信息安全、计算机网络、云计算; 胡亮(1990-),男,四川成都人,硕士研究生,主要研究方向:云计算安全; 陈林(1983-),男,四川宜宾人,博士研究生,主要研究方向:云计算安全.
基金资助:
国家科技支撑计划项目(2012BAH18B05).

Abstract

Abstract:

Concerning the problem that the network access control of Virtual Machines (VM) in the cloud computing Infrastructure as a Service (IaaS) platforms, a method of communication access control for VM in IaaS platforms was proposed. The method based on Software Defined Networking (SDN) was realized to customize the communication access control rules from Layer 2 to Layer 4. The experimental results show that the method can manage communication access permissions of tenants' VM flexibly, and ensure the security of tenants' network.

Key words: Software Defined Networking (SDN), access control, cloud computing, Infrastructure as a Service (IaaS), firewall

摘要：

针对云计算基础设施即服务(IaaS)平台所面临的虚拟机网络通信访问控制问题,提出了一种可适于IaaS平台的虚拟机通信访问控制方法.该通信访问控制方法基于软件定义网络(SDN),实现针对虚拟机通信的L2~L4层访问控制.实验结果表明:该通信访问控制方法能够有效实现对租户虚拟机通信的灵活访问控制,保障IaaS平台中租户网络的安全.

关键词: 软件定义网络, 访问控制, 云计算, 基础设施即服务, 防火墙

CLC Number:

TP393.02

HAN Zhenyang, CHEN Xingshu, HU Liang, CHEN Lin. Communication access control method based on software defined networking for virtual machines in IaaS platforms[J]. Journal of Computer Applications, 2015, 35(5): 1262-1266.

韩贞阳, 陈兴蜀, 胡亮, 陈林. 基于软件定义网络的IaaS虚拟机通信访问控制方法[J]. 计算机应用, 2015, 35(5): 1262-1266.

References

[1] MELL P, GRANCE T. The NIST definition of cloud computing, NIST SP 800-145[R]. Gaithersburg: National Institute of Standards and Technology, 2011: 1-7.
[2] ONF Market Education Committee. Software-defined networking: the new norm for networks[M]. Palo Alto, California: Open Networking Foundation, 2012:1-12.
[3] ETSI. Network function virtualization introductory white paper [EB/OL]. [2014-08-10]. http://portal.etsi.org/nfv/nfv_white_paper.pdf.
[4] JANSEN W, GRANCE T. Guidelines on security and privacy in public cloud computing, NIST SP 800-144[J]. Gaithersburg: National Institute of Standards and Technology, 2011:23-24.
[5] ARCHER J, BOEHM A. Security guidance for critical areas of focus in cloud computing v3.0[R/OL].[2014-06-20].https://cloudsecurityalliance.org/csaguide.pdf.
[6] CATTEDDU D, HOGBEN G. Cloud computing: information assurance framework[C/OL] .[2014-06-20].http://www.enisa.europa.eu/act/rm/files/deliverables/cloud-computing-information-assurance-framework.
[7] VMware, Inc. Next generation security with VMware NSX and Palo Alto networks VM-series [EB/OL]. [2014-09-20]. http://www.vmware.com/files/pdf/products/nsx/NSX-Palo-Alto-Networks-WP.pdf.
[8] Internetworking task groups of IEEE 802.1. 802.1Qbg-edge virtual bridging [EB/OL]. [2014-12-31].http://www.ieee802.org/1/pages/ 802.1bg.html.
[9] Internetworking task groups of IEEE 802.1. 802. 1BR-bridge port extension [EB/OL]. [2014-12-31].http://www.ieee802.org/1/ pages/802.1br.html.
[10] TANG H, WANG J. Access control method: China, 103701822A[P] . 2014-04-02.(唐焕焕, 王军林. 访问控制方法: 中国, 103701822A[P] . 2014-04-02) .
[11] Open Netwroking Foundation. OpenFlow switch specification 1.3.1[EB/OL]. [2014-08-01].https://www.opennetworking.org/images/stories/downloads/specification/openflow-spec-v1.3.1.pdf.
[12] MAHALINGAM M, DUTT D, DUDA K, et al. VxLAN: a framework for overlaying virtualized layer 2 networks over layer 3 networks[EB/OL]. [2014-08-01]. http://tools.ietf.org/html/draft-mahalingam-dutt-dcops-vxlan-04.
[13] SRIDHARAN M, WANG Y, GRAG P, et al. NVGRE: network virtualization using generic routing encapsulation [EB/OL]. [2014-08-01]. http://tools.ietf.org/html/draft-sridharan-virtualization-nvgre-03.
[14] DAVIE B. STT: a stateless transport tunneling protocol for network virtualization[EB/OL]. [2014-08-15]. http://tools.ietf.org/html/draft-davie-stt-03.
[15] CHEN L, CHEN X, JIANG J, et al. The research and practice of dynamic network security architecture for IaaS platform[J]. Tsinghua Science and Technology, 2014, 19(5):496-507.
[16] THAMES J L, ABLER R, KEELING D. A distributed firewall and active response architecture providing preemptive protection[C]// Proceedings of the 46th Annual Southeast Regional Conference on XX. New York: ACM, 2008: 220-225.

Communication access control method based on software defined networking for virtual machines in IaaS platforms

基于软件定义网络的IaaS虚拟机通信访问控制方法

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	Meihong CHEN, Lingyun YUAN, Tong XIA. Data classified and graded access control model based on master-slave multi-chain [J]. Journal of Computer Applications, 2024, 44(4): 1148-1157.
[2]	Xin LI, Liyong BAO, Hongwei DING, Zheng GUAN. MAC layer scheduling strategy of roadside units based on MEC server priority service [J]. Journal of Computer Applications, 2024, 44(4): 1227-1235.
[3]	Gaimei GAO, Mingbo DUAN, Yaling XUN, Chunxia LIU, Weichao DANG. SM9-based attribute-based searchable encryption scheme with cryptographic reverse firewall [J]. Journal of Computer Applications, 2024, 44(11): 3495-3502.
[4]	Huan ZHANG, Jingyu WANG, Lixin LIU, Xiaoyu JIANG. Multi-organization collaborative data sharing scheme with dual authorization [J]. Journal of Computer Applications, 2024, 44(10): 3307-3314.
[5]	Haiying MA, Jinzhou LI, Jikun YANG. Blockchain-based decentralized attribute-based encryption scheme for revocable attributes [J]. Journal of Computer Applications, 2023, 43(9): 2789-2797.
[6]	Jiaxing LU, Hua DAI, Yuanlong LIU, Qian ZHOU, Geng YANG. Dictionary partition vector space model for ciphertext ranked search in cloud environment [J]. Journal of Computer Applications, 2023, 43(7): 1994-2000.
[7]	Meng CAO, Sunjie YU, Hui ZENG, Hongzhou SHI. Hierarchical access control and sharing system of medical data based on blockchain [J]. Journal of Computer Applications, 2023, 43(5): 1518-1526.
[8]	Kun YOU, Qinhui WANG, Xin LI. General multi-unit false-name-proof auction mechanism for cloud computing [J]. Journal of Computer Applications, 2023, 43(11): 3351-3357.
[9]	Jingyu SUN, Jiayu ZHU, Ziqiang TIAN, Guozhen SHI, Chuanjiang GUAN. Attribute based encryption scheme based on elliptic curve cryptography and supporting revocation [J]. Journal of Computer Applications, 2022, 42(7): 2094-2103.
[10]	Jie ZHANG, Shanshan XU, Lingyun YUAN. Internet of things access control model based on blockchain and edge computing [J]. Journal of Computer Applications, 2022, 42(7): 2104-2111.
[11]	Yang LI, Long XU, Yanqiang LI, Shaopeng LI. Smart contract-based access control architecture and verification for internet of things [J]. Journal of Computer Applications, 2022, 42(6): 1922-1931.
[12]	Jinquan ZHANG, Shouwei XU, Xincheng LI, Chongyang WANG, Jingzhi XU. Cloud computing task scheduling based on orthogonal adaptive whale optimization [J]. Journal of Computer Applications, 2022, 42(5): 1516-1523.
[13]	GE Jihong, SHEN Tao. Energy data access control method based on blockchain [J]. Journal of Computer Applications, 2021, 41(9): 2615-2622.
[14]	CHEN Jiahao, YIN Xinchun. Traceable and revocable ciphertext-policy attribute-based encryption scheme based on cloud-fog computing [J]. Journal of Computer Applications, 2021, 41(6): 1611-1620.
[15]	GE Lina, HU Yugu, ZHANG Guifen, CHEN Yuanyuan. Reverse hybrid access control scheme based on object attribute matching in cloud computing environment [J]. Journal of Computer Applications, 2021, 41(6): 1604-1610.