建構雲端環境資料安全存取模型暨績效評估

由於在雲端環境中越權存取的威脅日益嚴重，使網路服務的風險與日遽增，雲端服務提供者本身是否具有足夠能力確保客戶的資料安全、防範非授權使用者對資料的存取或破壞，已成為雲端使用者最關切的議題。為確保雲端用戶資料的機密性和完整性，在提升大量資料存取效率的同時，強化用戶資料傳輸和儲存的安全是極其重要的，本研究提出了一個新的作法，能夠使分散式資料庫存取更安全、更有效率的主動驗證與排程方法，內容包括「主動式身分驗證」、「安全隔離與資料交換」、「優先權多級排程控制」、「分散式存取方法」及「RC4加解密技術」等。用戶作業必須透過私有雲主動驗證才能取得授權碼，其資料必須經過加密處理之後，再進入獨立通道透過安全隔離與資料交換，才能進入私有雲取得存取權限進行交易。為提升交易效率，我們建議結合優先權多級安全排程，進行分散式資料安全存取。經由實驗顯示，利他鎖定（Altruistic Locking, AL）排程原則能使分散式資料庫存取更有效率。經由檢視表將優先權及多級安全相互結合模擬，達到資料安全存取的目的。研究結果顯示，要做好存取控制，必先做好「讀」的控管，即可解決大部分不當存取的威脅，本研究並發現，做好「寫」的排程序列化，即可有效避免死結發生。研究顯示此一雲端資料安全存取架構能有效的遏止越權存取，也可提高交易並行性，增進資料存取效能性，透由實驗結果顯示，私有雲以優先權多級安全及分散式資料庫存取方式，AL能更快更有效的完成交易，能盡快的將費時較短的交易完成（Commit），減少交易重新執行（Rollback），避免死結發生。經由兩組實驗比較，驗證私有雲分散式資料庫中「優先權多級安全及鎖定」AL優於傳統的二階段鎖定（2-Phase Locking, 2PL），以AL 作為排程的機制確實能獲得更佳的效能，說明了本研究架構之可用性。

關鍵字

雲端運算；資訊安全；主動驗證；優先權多級安全；分散式資料存取

並列摘要

Purpose－Due to the growing intelligent attacks, internet service providers are facing more and more risks. It has become a big concern, especially in the emerging cloud computing environment, whether the service providers have the capability to properly protect users’ data from attacks and prevent unauthorized access. Design/methodology/approach － In order to meet the information security requirements of confidentiality, integrity and availability with consideration of access efficiency in the presence of huge amount of data, we proposed an efficient and secure data access model covering active authentication, encryption/decryption, and access to databases. Findings－Through experiments, we found that the control of ＂read＂ will solve most unauthorized access problems and serialization of ＂write＂ will avoid deadlocks. Research limitations/implications－We designed a multi-layered, distributed database system and proposed a secure access model in which only two locking mechanisms, two-phase locking and altruistic locking, are compared. Other mechanisms are not considered in this study. Practical implications－A prototype was implemented to test the applicability of the proposed model. The system first authenticates a user and then assigns him a ticket. This process accomplishes fined-grained access control. After analyzing the data obtained from the experiments, we found that the proposed data access model is well suited for the cloud computing environment in terms of security and efficiency. Originality/value－This study proposes a new approach to system security, permitting distributed database access and efficient scheduling. The system allows active identity verification, secure data isolation and information exchange, multi-level scheduling based on priorities, distributed access control and use of encryption technology.