云计算安全体系设计与实现综述

云计算的安全性既要面对传统信息技术带来的安全威胁，又要面对云计算核心技术，如虚拟化带来的新风险。根据经典的以安全策略(policy)、保护(protection)、检测(detection)和响应(response)为核心的安全模型—PPDR模型，结合笔者在云服务商工作积累的多年安全实践，论述了云计算安全体系设计与实现的关键技术，包括网络、主机、应用、数据和运维运营5个层面的安全设计与实现，并对云计算安全相关的技术趋势进行了展望。提出一种经实战检验的云计算安全体系的设计与实现，特别是数据安全体系的设计与实现。该体系上线3年来，已消减针对云平台99.99%以上的安全攻击，经受住了现网大规模安全实战的考验。

Overview of design and implementation of cloud computing security system

The security of cloud computing is faced with both security threats brought by traditional information technologies and new risks brought by cloud computing technologies, such as virtualization. Based on the PPDR model, a typical security model centered on security policies, protection, detection, and response, and the security practices accumulated by the author in cloud service providers, the key technologies for the design and implementation of the cloud computing security system are described. This paper describes the security design and implementation of the network, host, application, data, and O&M, and forecasts the technical trends related to cloud computing security. This paper presents the design and implementation of a proven cloud computing security architecture, especially the design and implementation of data security architecture. In the past three years, the system has been able to mitigate over 99.99% of security attacks on the cloud platform and withstand large-scale security practices on the live network.