Abstract
The cloud computing is one of the most popular issues in recent years. Many ser- vice providers have provided the cloud solution using virtualization such as Amazon EC2, Rackspace, Hinet hicloud, etc. However, we are facing the new threats in the virtual environment when we use the cloud service. The virtual machine technique has used to monitor malicious software behavior in recent years. However, all the isolation environments are based on the assumption that the host operation system can not be attacked by guest operation system. In the real world, there exist some vulnerability in each virtual machines such as QEMU, Xen and VMware. The net- work interface in the cloud environment is difference from the physical environment. We have to face new threats that did not exist in normal network environment. The attacker could attack the virtual network environment by exploiting the software vulnerability. There have been existed some researches focus on the cloud security issue. However, some of them are limited by the special hardware or architecture. Few of them discuss with the network environment security in the data center. In the cloud environments, an attacker can occupy a VM to launch network attacks. It is easier for an attacker to launch attack than in the physical network environments. In this thesis, we provide a solution Virtual Network Guard System (VNGS) to solve the problems in virtual network that we face in the virtual environ- ment. The virtual machine in the data center is not similar as the physical machine. We can modify the network interface controller in the virtual environment to limit the guest operation system access rights. In this way, we can prevent the attacker to launch some of the network attacks in our virtual environment by using filtering process to filter illegal network packets in the virtual network interface controller. We also provide a centralize management server to deploy filtering processes and browse the alert infomation. In the end, we analyze the performance of our system with normal network interface controller. The result shows our systen does not in- crease many overhead and we can drop the illegal packets by our filtering process successfully. Finally, VNGS is a solution we provide to protect the network inside a cloud environment.