Security in Distributed Systems
Distributed Systems
Distributed Systems / 6 - 10
1.1 Polylingual Applications
♦ Distributed computing frameworks, such as CORBA are not only used for the construction and a-priori integration of new components. They are probably more often used for the a-posteriori integration of applications from existing components. ♦ Polylingual applications have components in different programming languages. ♦ To achieve interoperability between these components, language bindings are needed that map different language concepts onto each other. ♦ Problem: with n different languages, n(n-1) different language bindings needed. ♦ Solution: One language (such as IDL) as a mediator. Requires only n bindings.
© City University London, Dept. of Computing
CISSPCBK主题和目标
of security architectures, designs, and
of:
solution elements
Security architectures, designs, and
Client-based (e.g., applets, local
solution elements
caches)
则
Vulnerabilities in embedded devices 了解安全模型的基本概念
and cyber-physical systems (e.g.,
选择基于信息系统安全标准的控制与对
networkenabled devices)
策
Cryptography Cryptographic lifecycle Cryptographic types (e.g., symmetric,
了解信息系统的安全保障能力 评估和降低的漏洞：
安全架构，设计和解决方案元 素
基于Web的系统 移动系统 嵌入式设备和网络物理系统 应用密码学 应用安全的原则设计站点及设施
Methods of cryptanalytic attacks (e.g., 设计和实施设施安全
brute force, cipher-text only, known
CISSP CBK 4.0 系列复习资料之二
Fraunhofer IDMT
Development of personalized hearing systems (e.g. individual hearing protection, personalized speech and audio rendition)
Devices and speaker measurement
Speech intelligibility Video quality Standardization and visual tests
Search technologies for multimedia data
Evaluation of semantic search methods Test and training data User friendliness and technical quality
© Fraunhofer IDMT
Fraunhofer IDMT
Foundation of the working group of the Fraunhofer IIS in Erlangen in 2000 Foundation of the Fraunhofer IDMT on January 1st, 2004 Director of the institute: Prof. Dr. Karlheinz Brandenburg 175 employees, apprentices, postgraduates, master thesis aspirants, trainees, academic and student assistants … Head office in Ilmenau, branch labs in Erfurt and Oldenburg (Lower Saxony)
计算机网络安全论文参考文献
计算机网络安全论文参考文献以下是一篇关于计算机网络安全的论文参考文献：[1] Stallings, W. (2013). Network security essentials: Applications and standards (Vol. 1). Pearson.这本书探讨了计算机网络安全的基本概念、原理和技术。
它提供了对各种网络安全协议、算法和策略的详细介绍，以及实际应用和标准的示例。
[2] Kurose, J. F., & Ross, K. W. (2010). Computer networking: a top-down approach. Pearson Education.这本书是计算机网络的经典教材，它详细介绍了计算机网络体系结构和协议的工作原理。
它还包括网络安全的基本原理和技术，如加密、身份验证和访问控制。
[3] Anderson, R. (2008). Security engineering: a guide to building dependable distributed systems. John Wiley & Sons.这本书通过分析实际系统的安全问题和解决方案，提供了构建安全分布式系统的指南。
它涵盖了许多关键安全概念和技术，如访问控制、防火墙、入侵检测和身份管理。
[4] Pfleeger, C. P., & Pfleeger, S. L. (2007). Security in computing. Prentice Hall.该书介绍了计算机安全的基本概念、原理和技术，如密码学、访问控制、网络安全和软件安全。
它还提供了关于安全策略和风险管理的实际指南。
[5] Schneier, B. (2015). Applied cryptography: protocols,algorithms, and source code in C. John Wiley & Sons.这本书是密码学的经典教材，它详细介绍了密码学的基本概念、原理和算法。
计算机科学与技术专业英语
计算机科学与技术专业英语Computer Science and Technology Major计算机科学与技术专业(jìsuànjī kēxué yǔ jìshù zhuānyè) - Computer Science and Technology Major计算机科学与技术（Computer Science and Technology）是计算机科学与技术学科的核心专业，主要培养学生具有计算机科学与技术专业的基本理论、基本知识和基本技能，能够在计算机科学与技术领域从事应用与开发、设计与实施、管理与服务等工作。
Computer Science and Technology is a core major in the field of computer science and technology. It mainly focuses on cultivating students with basic theories, knowledge, and skills in computer science and technology. Graduates will be able to engage in application development, design and implementation, management, and service in the field of computer science and technology.专业课程(zhuānyè kèchéng) - Major Courses计算机科学与技术专业的课程包括但不限于以下方面：The courses of the Computer Science and Technology major include but are not limited to the following aspects:1.基础课程(basic courses):- 计算机组成原理(Computer Organization and Architecture)- 数据结构与算法(Data Structures and Algorithms)- 操作系统(Operating Systems)- 离散数学(Discrete Mathematics)- 编译原理(Compiler Design)- 计算机网络(Computer Networks)2.核心课程(core courses):- 计算机图形学(Computer Graphics)- 数据库系统(Database Systems)- 人工智能(Artificial Intelligence)- 计算机安全(Computer Security)- 软件工程(Software Engineering)- 分布式系统(Distributed Systems)3.专业选修课程(major elective courses):- 数据挖掘(Data Mining)- 机器学习(Machine Learning)- 物联网技术(Internet of Things)- 云计算(Cloud Computing)- 嵌入式系统(Embedded Systems)就业方向(jiùyè fāngxiàng) - Career Paths计算机科学与技术专业的毕业生在以下领域有广泛的就业机会: Graduates of the Computer Science and Technology major have extensive job opportunities in the following fields:- 软件开发(Software Development)- 网络安全(Network Security)- 数据分析(Data Analysis)- 人工智能与机器学习(Artificial Intelligence and Machine Learning)- 云计算与大数据(Cloud Computing and Big Data)- 嵌入式系统开发(Embedded System Development)- 网站设计与开发(Website Design and Development)- IT管理与咨询(IT Management and Consulting)以上是关于计算机科学与技术专业的简单介绍。
可信度概念
可信度概念可信主要体现的是一种信任关系，信任关系存在于信任实体(即信任者和被信任者)之间，信任者信任被信任者，即“trustor trust trustee”，则被信任者被认为是可信的(trustworthy或者trusted)。
为了方便描述，本文将信任者实体记为trustor，被信任者实体记为trustee。
果trustee能够满足它所声明的或者trustor所期待的行为，trustor 认为truatee可信。
因此，trustor若要信任trustee，一方面trustee需要具有可信特性，包括安全性、可用性、可靠性、时效性等[28]；另一方面trustor需要对trustee所声称的可信特性进行度量，从而决定是否信任 trustee，进而确定是否采用trustee的服务等。
可信度的定义如下：定义2-2:可信度是对主体(trustee)可信特性的评估，判断主体是否具有作为可信主体应具有的可信特性，其用T表示，且T∈[O,l]，其值越大，可信度越高。
主体为具有可信特性，trustee需要保障机制进行支撑和维护，有了这些机制后，可以更方便地进行度量，如何保障和度量trustee具有某种可信特性，在某些研究领域己取得了卓有成效的研究成果，例如为保障安全的授权机制[29,30](包括从信任的角度研究授权问题的信任管理系统[31,32])，为保障可靠和可用的容错机制[33,34]，保障网上交易可信度的信誉管理系统[35]等，但从信任角度分析这些工作存在一定的局限性，主要有:(l)这些特性和机制基本上都是从各自的角度考虑问题，难以覆盖信任的内涵。
例如，维护可靠性的容错机制如何让trustee可信?如何让trustor信任trustee?此类问题少有提及；或者，它们只是针对单一的可信特性，将信任等同于某一种特性和机制，例如授权或容错，即使像文献[31]中的信任管理系统，也只针对授权。
(2)这些可信特性彼此独立，对于有多种特性需求的系统来说(例如，有些使用者只关注系统的安全特征，而忽略时效性；有些使用者只根据可靠程度或可用程度来判定可信度；而有些使用者却可能既要求可靠性，又要求时效性，而且需求的程度不一样)很难有一致的执行效果，也缺乏统一的管理框架。
软考高级架构师系统设计40题
软考高级架构师系统设计40题1. In a system design, which of the following is the most important consideration for scalability?A. Hardware performanceB. Software architectureC. Network bandwidthD. User interface design答案：B。
解析：软件架构对于系统的可扩展性至关重要。
硬件性能在一定程度上影响，但不是最关键的。
网络带宽主要影响数据传输，对可扩展性的直接影响较小。
用户界面设计与系统的可扩展性关系不大。
2. When designing a system, which principle should be followed to ensure high availability?A. RedundancyB. Minimization of componentsC. Simple architectureD. Low cost答案：A。
解析：冗余是确保高可用性的重要原则。
减少组件可能会降低复杂性，但不一定能保证高可用性。
简单架构有助于理解和维护，但不是保证高可用性的关键。
低成本通常不是高可用性设计的首要考虑因素。
3. Which of the following is a key factor in determining theperformance of a system?A. The number of usersB. The algorithm usedC. The color scheme of the interfaceD. The brand of the hardware答案：B。
解析：算法的优劣直接决定了系统的性能。
用户数量会影响系统负载，但不是决定性能的根本因素。
界面的颜色方案与性能无关。
硬件品牌对性能有一定影响，但算法的影响更为关键。
动态信任关系建模和管理技术研究
49.Gerck E Toward Real-World Models of Trust 1998
20.Chen R.W.Yeager Poblano:A Distributed Trust Model for Peer-to-Peer Networks.Sun Microsystems 2000
21.Winsborough W H.N Li Towards Practical Automated Trust Negotiation 2002
11.A.Abdul-Rahman.S.Halles A distributed trust model 1997
12.A.Abdul-Rahman.S.Hailes Using recommendations for managing trust in distributed systems 1997
34.F.Cornelli.E.Damiani.S.C.Vimercati.S.Paraboschi,P.Samarati A reputation-based approach for choosing reliable resources in peer-to-peer networks 2002
●由于PeerTrust和SecDWTrust都采用了社群信任查询的方法,因此在可信节点占大多数的情况下可以避免虚假的推荐,在~定程度上减轻了联合作弊的危害。而DwTrust 仪依赖直接经验进行判断,在缺乏赢接交互历史的情况下,无法识别联合欺骗行为。
云计算外文翻译参考文献
云计算外文翻译参考文献(文档含中英文对照即英文原文和中文翻译)原文:Technical Issues of Forensic Investigations in Cloud Computing EnvironmentsDominik BirkRuhr-University BochumHorst Goertz Institute for IT SecurityBochum, GermanyRuhr-University BochumHorst Goertz Institute for IT SecurityBochum, GermanyAbstract—Cloud Computing is arguably one of the most discussedinformation technologies today. It presents many promising technological and economical opportunities. However, many customers remain reluctant to move their business IT infrastructure completely to the cloud. One of their main concerns is Cloud Security and the threat of the unknown. Cloud Service Providers(CSP) encourage this perception by not letting their customers see what is behind their virtual curtain. A seldomly discussed, but in this regard highly relevant open issue is the ability to perform digital investigations. This continues to fuel insecurity on the sides of both providers and customers. Cloud Forensics constitutes a new and disruptive challenge for investigators. Due to the decentralized nature of data processing in the cloud, traditional approaches to evidence collection and recovery are no longer practical. This paper focuses on the technical aspects of digital forensics in distributed cloud environments. We contribute by assessing whether it is possible for the customer of cloud computing services to perform a traditional digital investigation from a technical point of view. Furthermore we discuss possible solutions and possible new methodologies helping customers to perform such investigations.I. INTRODUCTIONAlthough the cloud might appear attractive to small as well as to large companies, it does not come along without its own unique problems. Outsourcing sensitive corporate data into the cloud raises concerns regarding the privacy and security of data. Security policies, companies main pillar concerning security, cannot be easily deployed into distributed, virtualized cloud environments. This situation is further complicated by the unknown physical location of the companie’s assets. Normally,if a security incident occurs, the corporate security team wants to be able to perform their own investigation without dependency on third parties. In the cloud, this is not possible anymore: The CSP obtains all the power over the environmentand thus controls the sources of evidence. In the best case, a trusted third party acts as a trustee and guarantees for the trustworthiness of the CSP. Furthermore, the implementation of the technical architecture and circumstances within cloud computing environments bias the way an investigation may be processed. In detail, evidence data has to be interpreted by an investigator in a We would like to thank the reviewers for the helpful comments and Dennis Heinson (Center for Advanced Security Research Darmstadt - CASED) for the profound discussions regarding the legal aspects of cloud forensics. proper manner which is hardly be possible due to the lackof circumstantial information. For auditors, this situation does not change: Questions who accessed specific data and information cannot be answered by the customers, if no corresponding logs are available. With the increasing demand for using the power of the cloud for processing also sensible information and data, enterprises face the issue of Data and Process Provenance in the cloud [10]. Digital provenance, meaning meta-data that describes the ancestry or history of a digital object, is a crucial feature for forensic investigations. In combination with a suitable authentication scheme, it provides information about who created and who modified what kind of data in the cloud. These are crucial aspects for digital investigations in distributed environments such as the cloud. Unfortunately, the aspects of forensic investigations in distributed environment have so far been mostly neglected by the research community. Current discussion centers mostly around security, privacy and data protection issues [35], [9], [12]. The impact of forensic investigations on cloud environments was little noticed albeit mentioned by the authors of [1] in 2009: ”[...] to our knowledge, no research has been published on how cloud computing environments affect digital artifacts,and on acquisition logistics and legal issues related to cloud computing env ironments.” This statement is also confirmed by other authors [34], [36], [40] stressing that further research on incident handling, evidence tracking and accountability in cloud environments has to be done. At the same time, massive investments are being made in cloud technology. Combined with the fact that information technology increasingly transcendents peoples’ private and professional life, thus mirroring more and more of peoples’actions, it becomes apparent that evidence gathered from cloud environments will be of high significance to litigation or criminal proceedings in the future. Within this work, we focus the notion of cloud forensics by addressing the technical issues of forensics in all three major cloud service models and consider cross-disciplinary aspects. Moreover, we address the usability of various sources of evidence for investigative purposes and propose potential solutions to the issues from a practical standpoint. This work should be considered as a surveying discussion of an almost unexplored research area. The paper is organized as follows: We discuss the related work and the fundamental technical background information of digital forensics, cloud computing and the fault model in section II and III. In section IV, we focus on the technical issues of cloud forensics and discuss the potential sources and nature of digital evidence as well as investigations in XaaS environments including thecross-disciplinary aspects. We conclude in section V.II. RELATED WORKVarious works have been published in the field of cloud security and privacy [9], [35], [30] focussing on aspects for protecting data in multi-tenant, virtualized environments. Desired security characteristics for current cloud infrastructures mainly revolve around isolation of multi-tenant platforms [12], security of hypervisors in order to protect virtualized guest systems and secure network infrastructures [32]. Albeit digital provenance, describing the ancestry of digital objects, still remains a challenging issue for cloud environments, several works have already been published in this field [8], [10] contributing to the issues of cloud forensis. Within this context, cryptographic proofs for verifying data integrity mainly in cloud storage offers have been proposed,yet lacking of practical implementations [24], [37], [23]. Traditional computer forensics has already well researched methods for various fields of application [4], [5], [6], [11], [13]. Also the aspects of forensics in virtual systems have been addressed by several works [2], [3], [20] including the notionof virtual introspection [25]. In addition, the NIST already addressed Web Service Forensics [22] which has a huge impact on investigation processes in cloud computing environments. In contrast, the aspects of forensic investigations in cloud environments have mostly been neglected by both the industry and the research community. One of the first papers focusing on this topic was published by Wolthusen [40] after Bebee et al already introduced problems within cloud environments [1]. Wolthusen stressed that there is an inherent strong need for interdisciplinary work linking the requirements and concepts of evidence arising from the legal field to what can be feasibly reconstructed and inferred algorithmically or in an exploratory manner. In 2010, Grobauer et al [36] published a paper discussing the issues of incident response in cloud environments - unfortunately no specific issues and solutions of cloud forensics have been proposed which will be done within this work.III. TECHNICAL BACKGROUNDA. Traditional Digital ForensicsThe notion of Digital Forensics is widely known as the practice of identifying, extracting and considering evidence from digital media. Unfortunately, digital evidence is both fragile and volatile and therefore requires the attention of special personnel and methods in order to ensure that evidence data can be proper isolated and evaluated. Normally, the process of a digital investigation can be separated into three different steps each having its own specificpurpose:1) In the Securing Phase, the major intention is the preservation of evidence for analysis. The data has to be collected in a manner that maximizes its integrity. This is normally done by a bitwise copy of the original media. As can be imagined, this represents a huge problem in the field of cloud computing where you never know exactly where your data is and additionallydo not have access to any physical hardware. However, the snapshot technology, discussed in section IV-B3, provides a powerful tool to freeze system states and thus makes digital investigations, at least in IaaS scenarios, theoretically possible.2) We refer to the Analyzing Phase as the stage in which the data is sifted and combined. It is in this phase that the data from multiple systems or sources is pulled together to create as complete a picture and event reconstruction as possible. Especially in distributed system infrastructures, this means that bits and pieces of data are pulled together for deciphering the real story of what happened and for providing a deeper look into the data.3) Finally, at the end of the examination and analysis of the data, the results of the previous phases will be reprocessed in the Presentation Phase. The report, created in this phase, is a compilation of all the documentation and evidence from the analysis stage. The main intention of such a report is that it contains all results, it is complete and clear to understand. Apparently, the success of these three steps strongly depends on the first stage. If it is not possible to secure the complete set of evidence data, no exhaustive analysis will be possible. However, in real world scenarios often only a subset of the evidence data can be secured by the investigator. In addition, an important definition in the general context of forensics is the notion of a Chain of Custody. This chain clarifies how and where evidence is stored and who takes possession of it. Especially for cases which are brought to court it is crucial that the chain of custody is preserved.B. Cloud ComputingAccording to the NIST [16], cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal CSP interaction. The new raw definition of cloud computing brought several new characteristics such as multi-tenancy, elasticity, pay-as-you-go and reliability. Within this work, the following three models are used: In the Infrastructure asa Service (IaaS) model, the customer is using the virtual machine provided by the CSP for installing his own system on it. The system can be used like any other physical computer with a few limitations. However, the additive customer power over the system comes along with additional security obligations. Platform as a Service (PaaS) offerings provide the capability to deploy application packages created using the virtual development environment supported by the CSP. For the efficiency of software development process this service model can be propellent. In the Software as a Service (SaaS) model, the customer makes use of a service run by the CSP on a cloud infrastructure. In most of the cases this service can be accessed through an API for a thin client interface such as a web browser. Closed-source public SaaS offers such as Amazon S3 and GoogleMail can only be used in the public deployment model leading to further issues concerning security, privacy and the gathering of suitable evidences. Furthermore, two main deployment models, private and public cloud have to be distinguished. Common public clouds are made available to the general public. The corresponding infrastructure is owned by one organization acting as a CSP and offering services to its customers. In contrast, the private cloud is exclusively operated for an organization but may not provide the scalability and agility of public offers. The additional notions of community and hybrid cloud are not exclusively covered within this work. However, independently from the specific model used, the movement of applications and data to the cloud comes along with limited control for the customer about the application itself, the data pushed into the applications and also about the underlying technical infrastructure.C. Fault ModelBe it an account for a SaaS application, a development environment (PaaS) or a virtual image of an IaaS environment, systems in the cloud can be affected by inconsistencies. Hence, for both customer and CSP it is crucial to have the ability to assign faults to the causing party, even in the presence of Byzantine behavior [33]. Generally, inconsistencies can be caused by the following two reasons:1) Maliciously Intended FaultsInternal or external adversaries with specific malicious intentions can cause faults on cloud instances or applications. Economic rivals as well as former employees can be the reason for these faults and state a constant threat to customers and CSP. In this model, also a malicious CSP is included albeit he isassumed to be rare in real world scenarios. Additionally, from the technical point of view, the movement of computing power to a virtualized, multi-tenant environment can pose further threads and risks to the systems. One reason for this is that if a single system or service in the cloud is compromised, all other guest systems and even the host system are at risk. Hence, besides the need for further security measures, precautions for potential forensic investigations have to be taken into consideration.2) Unintentional FaultsInconsistencies in technical systems or processes in the cloud do not have implicitly to be caused by malicious intent. Internal communication errors or human failures can lead to issues in the services offered to the costumer(i.e. loss or modification of data). Although these failures are not caused intentionally, both the CSP and the customer have a strong intention to discover the reasons and deploy corresponding fixes.IV. TECHNICAL ISSUESDigital investigations are about control of forensic evidence data. From the technical standpoint, this data can be available in three different states: at rest, in motion or in execution. Data at rest is represented by allocated disk space. Whether the data is stored in a database or in a specific file format, it allocates disk space. Furthermore, if a file is deleted, the disk space is de-allocated for the operating system but the data is still accessible since the disk space has not been re-allocated and overwritten. This fact is often exploited by investigators which explore these de-allocated disk space on harddisks. In case the data is in motion, data is transferred from one entity to another e.g. a typical file transfer over a network can be seen as a data in motion scenario. Several encapsulated protocols contain the data each leaving specific traces on systems and network devices which can in return be used by investigators. Data can be loaded into memory and executed as a process. In this case, the data is neither at rest or in motion but in execution. On the executing system, process information, machine instruction and allocated/de-allocated data can be analyzed by creating a snapshot of the current system state. In the following sections, we point out the potential sources for evidential data in cloud environments and discuss the technical issues of digital investigations in XaaS environmentsas well as suggest several solutions to these problems.A. Sources and Nature of EvidenceConcerning the technical aspects of forensic investigations, the amount of potential evidence available to the investigator strongly diverges between thedifferent cloud service and deployment models. The virtual machine (VM), hosting in most of the cases the server application, provides several pieces of information that could be used by investigators. On the network level, network components can provide information about possible communication channels between different parties involved. The browser on the client, acting often as the user agent for communicating with the cloud, also contains a lot of information that could be used as evidence in a forensic investigation. Independently from the used model, the following three components could act as sources for potential evidential data.1) Virtual Cloud Instance: The VM within the cloud, where i.e. data is stored or processes are handled, contains potential evidence [2], [3]. In most of the cases, it is the place where an incident happened and hence provides a good starting point for a forensic investigation. The VM instance can be accessed by both, the CSP and the customer who is running the instance. Furthermore, virtual introspection techniques [25] provide access to the runtime state of the VM via the hypervisor and snapshot technology supplies a powerful technique for the customer to freeze specific states of the VM. Therefore, virtual instances can be still running during analysis which leads to the case of live investigations [41] or can be turned off leading to static image analysis. In SaaS and PaaS scenarios, the ability to access the virtual instance for gathering evidential information is highly limited or simply not possible.2) Network Layer: Traditional network forensics is knownas the analysis of network traffic logs for tracing events that have occurred in the past. Since the different ISO/OSI network layers provide several information on protocols and communication between instances within as well as with instances outside the cloud [4], [5], [6], network forensics is theoretically also feasible in cloud environments. However in practice, ordinary CSP currently do not provide any log data from the network components used by the customer’s instances or applications. For instance, in case of a malware infection of an IaaS VM, it will be difficult for the investigator to get any form of routing information and network log datain general which is crucial for further investigative steps. This situation gets even more complicated in case of PaaS or SaaS. So again, the situation of gathering forensic evidence is strongly affected by the support the investigator receives from the customer and the CSP.3) Client System: On the system layer of the client, it completely depends on the used model (IaaS, PaaS, SaaS) if and where potential evidence could beextracted. In most of the scenarios, the user agent (e.g. the web browser) on the client system is the only application that communicates with the service in the cloud. This especially holds for SaaS applications which are used and controlled by the web browser. But also in IaaS scenarios, the administration interface is often controlled via the browser. Hence, in an exhaustive forensic investigation, the evidence data gathered from the browser environment [7] should not be omitted.a) Browser Forensics: Generally, the circumstances leading to an investigation have to be differentiated: In ordinary scenarios, the main goal of an investigation of the web browser is to determine if a user has been victim of a crime. In complex SaaS scenarios with high client-server interaction, this constitutes a difficult task. Additionally, customers strongly make use of third-party extensions [17] which can be abused for malicious purposes. Hence, the investigator might want to look for malicious extensions, searches performed, websites visited, files downloaded, information entered in forms or stored in local HTML5 stores, web-based email contents and persistent browser cookies for gathering potential evidence data. Within this context, it is inevitable to investigate the appearance of malicious JavaScript [18] leading to e.g. unintended AJAX requests and hence modified usage of administration interfaces. Generally, the web browser contains a lot of electronic evidence data that could be used to give an answer to both of the above questions - even if the private mode is switched on [19].B. Investigations in XaaS EnvironmentsTraditional digital forensic methodologies permit investigators to seize equipment and perform detailed analysis on the media and data recovered [11]. In a distributed infrastructure organization like the cloud computing environment, investigators are confronted with an entirely different situation. They have no longer the option of seizing physical data storage. Data and processes of the customer are dispensed over an undisclosed amount of virtual instances, applications and network elements. Hence, it is in question whether preliminary findings of the computer forensic community in the field of digital forensics apparently have to be revised and adapted to the new environment. Within this section, specific issues of investigations in SaaS, PaaS and IaaS environments will be discussed. In addition, cross-disciplinary issues which affect several environments uniformly, will be taken into consideration. We also suggest potential solutions to the mentioned problems.1) SaaS Environments: Especially in the SaaS model, the customer does notobtain any control of the underlying operating infrastructure such as network, servers, operating systems or the application that is used. This means that no deeper view into the system and its underlying infrastructure is provided to the customer. Only limited userspecific application configuration settings can be controlled contributing to the evidences which can be extracted fromthe client (see section IV-A3). In a lot of cases this urges the investigator to rely on high-level logs which are eventually provided by the CSP. Given the case that the CSP does not run any logging application, the customer has no opportunity to create any useful evidence through the installation of any toolkit or logging tool. These circumstances do not allow a valid forensic investigation and lead to the assumption that customers of SaaS offers do not have any chance to analyze potential incidences.a) Data Provenance: The notion of Digital Provenance is known as meta-data that describes the ancestry or history of digital objects. Secure provenance that records ownership and process history of data objects is vital to the success of data forensics in cloud environments, yet it is still a challenging issue today [8]. Albeit data provenance is of high significance also for IaaS and PaaS, it states a huge problem specifically for SaaS-based applications: Current global acting public SaaS CSP offer Single Sign-On (SSO) access control to the set of their services. Unfortunately in case of an account compromise, most of the CSP do not offer any possibility for the customer to figure out which data and information has been accessed by the adversary. For the victim, this situation can have tremendous impact: If sensitive data has been compromised, it is unclear which data has been leaked and which has not been accessed by the adversary. Additionally, data could be modified or deleted by an external adversary or even by the CSP e.g. due to storage reasons. The customer has no ability to proof otherwise. Secure provenance mechanisms for distributed environments can improve this situation but have not been practically implemented by CSP [10]. Suggested Solution: In private SaaS scenarios this situation is improved by the fact that the customer and the CSP are probably under the same authority. Hence, logging and provenance mechanisms could be implemented which contribute to potential investigations. Additionally, the exact location of the servers and the data is known at any time. Public SaaS CSP should offer additional interfaces for the purpose of compliance, forensics, operations and security matters to their customers. Through an API, the customers should have the ability to receive specific information suchas access, error and event logs that could improve their situation in case of aninvestigation. Furthermore, due to the limited ability of receiving forensic information from the server and proofing integrity of stored data in SaaS scenarios, the client has to contribute to this process. This could be achieved by implementing Proofs of Retrievability (POR) in which a verifier (client) is enabled to determine that a prover (server) possesses a file or data object and it can be retrieved unmodified [24]. Provable Data Possession (PDP) techniques [37] could be used to verify that an untrusted server possesses the original data without the need for the client to retrieve it. Although these cryptographic proofs have not been implemented by any CSP, the authors of [23] introduced a new data integrity verification mechanism for SaaS scenarios which could also be used for forensic purposes.2) PaaS Environments: One of the main advantages of the PaaS model is that the developed software application is under the control of the customer and except for some CSP, the source code of the application does not have to leave the local development environment. Given these circumstances, the customer obtains theoretically the power to dictate how the application interacts with other dependencies such as databases, storage entities etc. CSP normally claim this transfer is encrypted but this statement can hardly be verified by the customer. Since the customer has the ability to interact with the platform over a prepared API, system states and specific application logs can be extracted. However potential adversaries, which can compromise the application during runtime, should not be able to alter these log files afterwards. Suggested Solution:Depending on the runtime environment, logging mechanisms could be implemented which automatically sign and encrypt the log information before its transfer to a central logging server under the control of the customer. Additional signing and encrypting could prevent potential eavesdroppers from being able to view and alter log data information on the way to the logging server. Runtime compromise of an PaaS application by adversaries could be monitored by push-only mechanisms for log data presupposing that the needed information to detect such an attack are logged. Increasingly, CSP offering PaaS solutions give developers the ability to collect and store a variety of diagnostics data in a highly configurable way with the help of runtime feature sets [38].3) IaaS Environments: As expected, even virtual instances in the cloud get compromised by adversaries. Hence, the ability to determine how defenses in the virtual environment failed and to what extent the affected systems havebeen compromised is crucial not only for recovering from an incident. Also forensic investigations gain leverage from such information and contribute to resilience against future attacks on the systems. From the forensic point of view, IaaS instances do provide much more evidence data usable for potential forensics than PaaS and SaaS models do. This fact is caused throughthe ability of the customer to install and set up the image for forensic purposes before an incident occurs. Hence, as proposed for PaaS environments, log data and other forensic evidence information could be signed and encrypted before itis transferred to third-party hosts mitigating the chance that a maliciously motivated shutdown process destroys the volatile data. Although, IaaS environments provide plenty of potential evidence, it has to be emphasized that the customer VM is in the end still under the control of the CSP. He controls the hypervisor which is e.g. responsible for enforcing hardware boundaries and routing hardware requests among different VM. Hence, besides the security responsibilities of the hypervisor, he exerts tremendous control over how customer’s VM communicate with the hardware and theoretically can intervene executed processes on the hosted virtual instance through virtual introspection [25]. This could also affect encryption or signing processes executed on the VM and therefore leading to the leakage of the secret key. Although this risk can be disregarded in most of the cases, the impact on the security of high security environments is tremendous.a) Snapshot Analysis: Traditional forensics expect target machines to be powered down to collect an image (dead virtual instance). This situation completely changed with the advent of the snapshot technology which is supported by all popular hypervisors such as Xen, VMware ESX and Hyper-V.A snapshot, also referred to as the forensic image of a VM, providesa powerful tool with which a virtual instance can be clonedby one click including also the running system’s mem ory. Due to the invention of the snapshot technology, systems hosting crucial business processes do not have to be powered down for forensic investigation purposes. The investigator simply creates and loads a snapshot of the target VM for analysis(live virtual instance). This behavior is especially important for scenarios in which a downtime of a system is not feasible or practical due to existing SLA. However the information whether the machine is running or has been properly powered down is crucial [3] for the investigation. Live investigations of running virtual instances become more common providing evidence data that。
DistributedSystemsPrinciplesandParadigms中文版书名分布
Marcus,Sten : Blueprints for High Availablity
Birman, Reliable Distributed Systems
Byzantine Failure问题：
Pease,M., “Reaching Agreement in the Presence of Faults” J.ACM,1980
Lamport,L.: “Byzantine Generals Problem. ” ACM T ng.syst. 1982
Shooman,M.L: Reliability of Computer Systems and Networks :Fault Tolerance, Analysis, and Design. 2002
Tanisch,P., “Atomic Commit in Concurrent Computing. ” IEEE Concurrency,2000
集中式体系结构：C/S
分布式体系结构：
点对点系统(peer-peer system):DHT(distributed hash table),例如Chord
随机图(random map)
混合体系结构：
协作分布式系统BitTorrent、Globule
自适应软件技术：
①要点分离
②计算映像
③基于组件的设计
Henning,M., “A New Approach to Object-Oriented Middleware”
第11章分布式文件系统
NFS (Network File System):远程访问模型
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
Lecture 22, page 2
Issues
Important issues:
• cryptography: secrecy of info being transmitted • authentication: proving who you are and having
correspondent prontercept ciphertext transmission • intercept plaintext/ciphertext pairs • obtain encryption decryption algorithms
Computer Science
Lecture 22, page 6
• passwords provide little protection
Computer Science
Lecture 22, page 4
Security Issues
Network resources:
• often completely unprotected from intruder eavesdropping, injection of false messages
RSA (continued)
to encrypt: • divide message into blocks, {b_i} of size j: 2^j < n • encrypt: encrypt(b_i) = b_I^e mod n
to decrypt: • b_i = encrypt(b_i)^d
• to send to receiver B, encrypt message M using B's publicly available key, EB
– send EB(M)
• to decrypt, B applies its private decrypt key DB to receiver message:
Computer Science
Lecture 22, page 3
Security in Computer Networks
User resources:
• login passwords often transmitted unencrypted in TCP packets between applications (e.g., telnet, ftp)
• users must take a more active role
Computer Science
Lecture 22, page 5
Encryption
plaintext: unencrypted message ciphertext: encrypted form of message
Intruder may
integer-remainder( (ed) / ((p-1)(q-1)) ) = 1, i.e., ed = k(p-1)(q-1) +1 • three numbers: – e, n made public – d kept secret
Computer Science
Lecture 22, page 17
– everyone knows how to do it
• substitution cipher over 64-bit chunks: 56-bit key determines which of 56! substitution ciphers used
– substitution: 19 stages of transformations, 16 involving functions of key
Computer Science
Lecture 22, page 14
Public Key Cryptography
• separate encryption/decryption keys
– receiver makes known (!) its encryption key – receiver keeps its decryption key secret
Symmetric Cryptosystems: DES (2)
• Details of per-round key generation in DES.
Computer Science
Lecture 22, page 12
Key Distribution Problem
Problem: how do communicant agree on symmetric key?
RSA example
• choose p=3, q=11, gives n=33, (p-1)(q1)=z=20
• choose d = 7 since 7 and 20 have no common factors
• compute e = 3, so that ed = k(p-1)(q-1)+1 (note: k=1 here)
– N communicants implies N keys
Trusted agent distribution:
– keys distributed by centralized trusted agent – any communicant need only know key to communicate with
• using mod pq arithmetic: (b^e)^d = b^{ed}
= b^{k(p-1)(q-1)+1} for some k
• only receiver can decrypt message
Question: good encryption/decryption algorithms
Computer Science
Lecture 22, page 16
RSA: public key encryption/decryption
Computer Science
Lecture 22, page 1
Network Security
Intruder may
• eavesdrop • remove, modify, and/or insert messages • read and playback messages
Computer Science
Computer Science
Lecture 22, page 9
DES: Data Encryption Standard
• encrypts data in 64-bit chunks
• encryption/decryption algorithm is a published standard
– computing DB( EB(M) ) gives M
Computer Science
Lecture 22, page 15
Public Key Cryptography
• knowing encryption key does not help with decryption; decryption is a non-trivial inverse of encryption
Encryption
• Intruders and eavesdroppers in communication.
Computer Science
Lecture 22, page 7
A simple encryption algorithm
Substitution cipher:
abcdefghijklmnopqrstuvwxyz
trusted agent – for communication between i and j, trusted agent will provide a
key
Computer Science
Lecture 22, page 13
Key Distribution
We will cover in more detail shortly
Security in Distributed Systems
• Introduction • Cryptography • Authentication • Key exchange • Readings: Tannenbaum, chapter 8
Ross/Kurose, Ch 7 (available online)
poiuytrewqasdfghjklmnbvczx • replace each plaintext character in message with
matching ciphertext character:
plaintext: Charlotte, my love
ciphertext: iepksgmmy, dz sgby
• mail spoofs, router updates, ICMP messages, network management messages
Bottom line:
• intruder attaching his/her machine (access to OS code, root privileges) onto network can override many systemprovided security measures
Computer Science
Lecture 22, page 19
Further notes on RSA
why does RSA work?
• crucial number theory result: if p, q prime then b_i^((p-1)(q-1)) mod pq = 1