A blockchain based integrity monitoring method for cloud images

• 1:华北水利水电大学信息工程学院

• 2:重庆理工大学两江人工智能学院

摘要(Abstract)：

针对云环境中镜像文件遭到篡改攻击这一问题，结合区块链技术提出了一种云镜像完整性监测方法.首先，每隔一段时间计算所有云镜像的哈希信息，并将哈希信息记录在Merkel树数据结构中；然后，将这一Merkel树打包成为区块并构成区块链；最后，周期性地对当前区块中Merkel树根节点的验证以实现对全部云镜像的完整性验证，并在发现篡改后定位被篡改的镜像文件.经过实验验证，所提出的方法相比之前的方法有3%的效率提升，同时经过理论分析，方法具有安全性、可追溯性以及可扩展性等特点.
Aiming at the problem of the image files being tampered with in cloud environment, an integrity monitoring method based on blockchain technology for cloud images is proposed. Firstly, hash values of all cloud images are calculated periodically and recorded in a Merkel Tree data structure. Next, the Merkel Tree is packed in a block and then a blockchain would be constructed. And finally, the root node of Merkel Tree in the current block is verified periodically to implement the overall verification for the integrity of all cloud images, and the tampered image file would be located when tampering attack is detected. According to experiments, the method proposed in this paper outperforms former methods for about 3%, and the theoretical analysis indicate that the method in this paper is secure, traceable, and expandable.

关键词(KeyWords)：云计算;完整性监测;区块链
cloud computing;integrity monitoring;blockchain

基金项目(Foundation):国家自然科学基金青年基金(62107014);; 河南省科技攻关项目(212102210100);; 河南省高等学校重点科研项目(20A413008;21B520022;20B520040);; 河南省高等教育教学改革研究与实践项目(2021SJGLX581)

作者(Authors):马威;曹刘洋;菅朋朋;
Ma Wei;Cao Liuyang;Jian Pengpeng;School of Information Engineering, North China University of Water Resources and Electric Power;School of Artificial Intelligence, Chongqing University of Technology;

DOI:10.16366/j.cnki.1000-2367.2023.04.012

参考文献(References)：

• [1] 罗军舟，金嘉晖，宋爱波，等.云计算：体系架构与关键技术[J].通信学报，2011,32(7):3-21.LUO J Z,JIN J H,SONG A B,et al.Cloud computing:architecture and key technologies[J].Journal on Communications,2011,32(7):3-21.

• [2] KUMAR R,GOYAL R.On cloud security requirements,threats,vulnerabilities and countermeasures:A survey[J].Computer Science Review,2019,33:1-48.

• [3] 郭涛，刘菲军，杜垚，等.云计算环境下虚拟机部署策略的优化[J].计算机应用研究，2012,29(9):3425-3427.GUO T,LIU F J,DU Y,et al.Virtual machine deployment optimization in cloud[J].Application Research of Computers,2012,29(9):3425-3427.

• [4] MA W,LI X,SHI Y,et al.A virtual machine cloning approach based on trusted computing[J].Telkomnika Indonesian Journal of Electrical Engineering,2013,11(11):6935-6942.

• [5] VRABLE M,MA J,CHEN J,et al.Scalability,fidelity,and containment in the potemkin virtual honeyfarm[C]//Proceedings of the twentieth ACM symposium on Operating systems principles.[s.l.:s.n.],2005:148-162.

• [6] LAGAR-CAVILLA H A,WHITNEY J A,BRYANT R,et al.Snowflock:Virtual machine cloning as a first-class cloud primitive[J].ACM Transactions on Computer Systems(TOCS),2011,29(1):1-45.

• [7] 李俊涛，吴小开.基于布朗指数法的虚拟机动态整合方法[J].计算机工程与应用，2016,52(7):56-61.LI J T,WU X K.Dynamic consolidation of virtual machines based on Brown’s exponential smoothing[J].Computer Engineering and Applications,2016,52(7):56-61.

• [8] 郑婷婷，武延军，贺也平.云计算环境下的虚拟机快速克隆技术[J].计算机工程与应用，2011,47(13):63-67.ZHENG T T,WU Y J,HE Y P.Rapid virtual machine cloning in cloud computing environment[J].Computer Engineering and Applications,2011,47(13):63-67.

• [9] DU D,YU T Y,XIA Y B,et al.Catalyzer:sub-millisecond startup for serverless computing with initialization-less booting[C]//Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems.New York:ACM,2020:467-481.

• [10] NICOLAE B,BRESNAHAN J,KEAHEY K,et al.Going back and forth:efficient multideployment and multisnapshotting on clouds[C]//Proceedings of the 20th international symposium on High performance distributed computing.New York:ACM,2011:147-158.

• [11] USTIUGOV D,PETROV P,KOGIAS M,et al.Benchmarking,analysis,and optimization of serverless function snapshots[C]//Proceedings of the 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems.New York:ACM,2021:559-572.

• [12] 成淑萍，袁小艳，廖小平，等.基于云计算安全环境的僵尸网络传播模型[J].计算机与数字工程，2018,46(9):1830-1833.CHENG S P,YUAN X Y,LIAO X P,et al.Botnet propagation modeling in cloud computing security environment[J].Computer & Digital Engineering,2018,46(9):1830-1833.

• [13] Palo Alto Unit 42.20 Million Miners:Finding Malicious Crypto jacking Images in Docker Hub[EB/OL].[2022-03-26].https://unit42.paloaltonetworks.com/malicious-cryptojacking-images/.

• [14] YAVUZ A A,NING P.BAF:an efficient publicly verifiable secure audit logging scheme for distributed systems[C]//2009 Annual Computer Security Applications Conference.[s.l.:s.n.],2010:219-228.

• [15] YAVUZ A A,NING P,REITER M K.BAF and FI-BAF:efficient and publicly verifiable cryptographic schemes for secure logging in resource-constrained systems[J].ACM Transactions on Information and System Security,2012,15(2):1-28.

• [16] WANG Q,WANG C,LI J,et al.Enabling public verifiability and data dynamics for storage security in cloud computing[C]//European Symposium on Research in Computer Security.Berlin:Springer,2009:355-370.

• [17] XU Y,ZHANG C,WANG G J,et al.A blockchain-enabled deduplicatable data auditing mechanism for network storage services[J].IEEE Transactions on Emerging Topics in Computing,2021,9(3):1421-1432.

• [18] WANG Q,WANG C,REN K,et al.Enabling public auditability and data dynamics for storage security in cloud computing[J].IEEE Transactions on Parallel and Distributed Systems,2011,22(5):847-859.

• [19] DILLIBABU M,KUMARI S,SARANYA T,et al.Assured protection & veracity for cloud data using merkle hash tree algorithm[J].Indian Journal of Applied Research,2011,3(3):124-126.

• [20] YU M C,SAHRAEI S,LI S Z,et al.Coded merkle tree:solving data availability attacks in blockchains[C]//BONNEAU J,HENINGER N.International Conference on Financial Cryptography and Data Security.Cham:Springer,2020:114-134.

• [21] 袁勇，王飞跃.区块链技术发展现状与展望[J].自动化学报，2016,42(4):481-494.YUAN Y,WANG F Y.Blockchain:the state of the art and future trends[J].Acta Automatica Sinica,2016,42(4):481-494.

• [22] 刘明达，陈左宁，拾以娟，等.区块链在数据安全领域的研究进展[J].计算机学报，2021,44(1):1-27.LIU M D,CHEN Z N,SHI Y J,et al.Research progress of blockchain in data security[J].Chinese Journal of Computers,2021,44(1):1-27.

一种基于区块链的云镜像完整性监测方法.pdf