(Downloads - 0)
For more info about our services contact : help@bestpfe.com
Table of contents
1 Introduction
1.1 Research Context
1.1.1 Involvement of Virtualization in Cloud Computing
1.1.2 Distribution of Resources over Cloud Environments
1.1.3 Exposure to Security Attacks
1.2 Problem Statement
1.3 Contributions
1.3.1 Analysis of Virtualization Models for Cloud Security
1.3.2 Software-Defined Security Architecture for Distributed Clouds
1.3.3 Generation of Protected Unikernel Resources
1.3.4 Extensions of a Cloud Orchestration Language
1.4 Outline of the Dissertation
2 System Virtualization: from Threats to Cloud Protection Opportunities
2.1 Introduction
2.2 System Virtualization Models
2.2.1 Context
2.2.2 System Virtualization
2.2.3 OS-Level Virtualization
2.2.4 Unikernel Virtualization
2.2.5 Synthesis
2.3 Security Analysis based on the Reference Architecture
2.3.1 Identification of Vulnerabilities
2.3.2 Considered Threats and Attacks
2.3.3 Compromise-Free Attacks
2.3.4 Compromising Attacks
2.3.5 Compromise-Based Attacks
2.4 Counter-Measures
2.4.1 Integration of security mechanisms at design time
2.4.2 Minimization of the attack surface
2.4.3 Adaptation based on security programmability
2.5 Conclusions
3 SDSec Architecture for Distributed Clouds
3.1 Introduction
3.2 Related Work
3.3 Software-Defined Security Overview
3.3.1 Objectives
3.3.2 Design principles
3.4 Software-Defined Security Architecture
3.4.1 Security Orchestrator
3.4.2 Policy Decision Points
3.4.3 Policy Enforcement Points
3.4.4 Interactions Amongst Components
3.5 Architecture Evaluation
3.5.1 Validation Scenarios
3.5.2 Practical Considerations
3.6 Summary
4 On-the-Fly Protected Unikernel Generation
4.1 Introduction
4.2 Related Work
4.3 Background on Unikernels
4.4 Software-defined Security Framework Based on Unikernels
4.4.1 On-the-fly Unikernel Generation
4.4.2 Benefits of Unikernels for Software-defined Security
4.4.3 Reactivity Improvement through Image Pooling
4.4.4 Integration with the SDSec Architecture for Distributed Clouds
4.5 Performance Evaluation
4.5.1 Prototype Implementation
4.5.2 Qualitative and Quantitative Evaluations
4.6 Summary
5 Topology and Orchestration Specification for SDSec
5.1 Introduction
5.2 Related Work
5.3 TOSCA-Oriented Software-defined Security Approach
5.4 Extensions of the TOSCA Language
5.4.1 The TOSCA Language
5.4.2 Describing Unikernels
5.4.3 Specifying Security Requirements
5.4.4 An Illustrative Case
5.5 Underlying Security Framework
5.5.1 Main Components
5.5.2 Interpreting SecTOSCA Specifications
5.5.3 Building and Orchestrating Unikernel Resources
5.5.4 Adapting to Contextual Changes
5.6 Summary
6 Prototyping and Evaluation
6.1 Introduction
6.2 Implementation Prototypes
6.2.1 Young Unikernel Generator
6.2.2 Moon Framework
6.2.3 HTTP Authentication and Authorization for MirageOS Unikernels
6.2.4 Application Firewalling for Mirage OS Unikernels
6.3 Evaluation Scenarios
6.3.1 Experimental testbed
6.3.2 Performance of the three approaches
6.3.3 Performance with a pool of protected unikernels
6.3.4 Security policy propagation and enforcement
6.4 Summary
7 Conclusions
7.1 Summary of Contributions
7.1.1 Analyzing Virtualization Models for Cloud Security
7.1.2 Designing a Software-defined Security Architecture
7.1.3 Generating Protected Unikernel Resources on The Fly
7.1.4 Extending the TOSCA Cloud Orchestration Language
7.1.5 Prototyping and Evaluating the Solution
7.2 Discussions
7.3 Research Perspectives
7.3.1 Exploiting Infrastructure-As-Code for Security Programmability
7.3.2 Supporting the Security of IoT Devices
7.3.3 Checking the Consistency of Security Policies
7.3.4 Contributing to Cloud Resilience
7.4 List of Publications
8 Appendix
8.1 Linux Features for OS-level Virtualization Support
8.2 Glibc System Calls Invokation Implementation
9 Résumé détaillé en français du mémoire
9.1 Introduction
9.1.1 Contexte des travaux
9.1.2 Identification des problématiques
9.1.3 Approche proposée
9.2 Contributions
9.2.1 État de l’art des modèles de virtualisation pour le cloud et analyse de leur sécurité
9.2.2 Architecture pour la programmabilité de la sécurité dans le cloud distribué
9.2.3 Génération à la volée d’images unikernels protégées
9.2.4 Spécification de l’orchestration pour la programmabilité de la sécurité
9.3 Conclusion
9.3.1 Analyse critique
9.3.2 Perspectives de recherche
Bibliography
