Research Of Intrusion Tolerance Systems Based On Virtualized Recovery

Intrusion tolerance technology based on survival in the field of information security is a hot topic and paid more and more attention over the past10years. Compared with traditional security policy, intrusion tolerance pays close attention to the fact that there may be some vulnerabilities in a system, some attacks may invade the system, the core idea is to apply the redundant technique to tolerate some faults of server duplicates. But with the passage of time, increasing of the number of the servers damaged by malicious attacks will reduce the system redundancy. Research shows that a proactive recovery technique regularly making the server duplicates back to the initial state can reduce the invasion influence. It improves the availability, confidentiality and integrity. Intrusion tolerance applying for recovery mechanism need more duplicates, high cost makes the design difficult to actual application.According to the deficiency of the current system recovery method, in this paper virtualization technology methods to enhance the system recovery efficiency and security are studied and discussed, an intrusion tolerance recovery mechanism and its system architecture model based on virtual environments are proposed. The model uses virtual machine as a server duplicate, in a single physical environment backup multiple different operating system images, then run the instances generated from multiple different operating system images to provide services outside. With a periodic and event driven recovery method the mechanism continuously uses a clean server duplicate to replace the online server. It can reduce online exposure time of servers, so as to improve the resilience of the system, strengthen the security of the system and greatly reduce the hardware cost of the system. For virtualization recovery mechanism, this paper proposes the virtual machine rotation services and rotation control scheduling algorithm and optimizes the performance of the system. As the deficiency of the traditional state transfer model to describe the dynamic and detail behavior of the system, the stochastic activity network and random process theory are adopted to establish the safety analysis model, the method perfectly describes the change of the system state and the response to the attack, and than ever before, the safety analysis method greatly simplifies the parameter. Finally, this paper presents the intrusion tolerance model based on the virtualization recovery technology and quantitative analysis method. The experimental results show that reasonably arranging the server online exposure time can not only guarantee the system to tolerate the ability of invasion, but also maintain the system availability.