CN104735063A - A Security Evaluation Method for Cloud Infrastructure - Google Patents

Abstract

The invention relates to the technical field of information security, in particular to a security evaluation method for cloud infrastructure. The method is completed by a device consisting of a scheduling module, an evaluation software library, an evaluation mirror image, an evaluation configuration library, an evaluation result library, an analysis module, an evaluation requirement book, an evaluation report and the like; before evaluation, a user carries out configuration work of an evaluation software library in advance; firstly, uploading existing safety evaluation software aiming at cloud infrastructure and an independently written evaluation software program in the market to an evaluation software library; then according to the usual classification: the software is classified into different 'evaluation software lists', such as system safety, network safety, data safety, behavior safety and the like; the evaluation software library can be continuously updated, so that the advancement and maturity of the evaluation software are ensured. The invention solves the problem that the information security evaluation method is adaptive to cloud computing; the method can be used for security evaluation of cloud infrastructure.

Description

A Security Evaluation Method for Cloud Infrastructure

technical field

The invention relates to the technical field of information security, in particular to a security evaluation method for cloud infrastructure.

Background technique

Cloud infrastructure: refers to the general term for the software and hardware systems built to support various cloud computing services, including physical infrastructure resources and virtual infrastructure resources. Virtual infrastructure resources are virtual resources built using virtualization technology on the basis of physical infrastructure resources, involving a series of hardware and software resources such as operating systems, storage, networks, and CPUs.

Information security subjects: According to the different fields involved in information system security, it is divided into subjects such as system security, behavioral security, data security, network security, and terminal security.

Information security evaluation: Using manual, semi-automated and automated tools to conduct security testing and evaluation of computer systems, the purpose is to verify whether the security requirements are met and to clarify the difference between the expected results and the actual test results, so as to discover the security problems existing in the system.

Resource unit: When evaluating cloud infrastructure, abstract a collection of physical resources such as computing and storage with quantifiable quotas into an entity that can run independently. Specifically, it is realized through virtualization technology.

Evaluation image: package resource units, evaluation software programs, etc. into a virtual machine image.

Evaluation activity: The security evaluation process from installing the evaluation image to recording the evaluation results for the specified range or all resources in the cloud infrastructure.

Evaluation requirements document: a document, which records the key technical points of this evaluation activity, such as the evaluation of the cloud infrastructure implementation equipment within the boundaries of the physical network, the evaluation personnel, the evaluation time and other relevant requirements.

Evaluation report: By analyzing the evaluation data, it evaluates the different information security fields and the overall security status of the cloud infrastructure, and provides a document with rectification suggestions.

Round Robin Scheduling Algorithm: The principle of the algorithm is to assign requests from users to requesters in turn each time, starting from 1 until N (the number of requesters), and then restart the cycle. The advantage of the algorithm is its simplicity and fairness. It does not need to record the status of all current connections, so it is a stateless scheduling.

As a new type of information technology that can provide resource sharing and on-demand services, cloud computing has been popularized in a wide range of e-government, education, and medical care. Large-scale cloud infrastructures led by the government and enterprises are increasing day by day. However, while enjoying the convenience and easy-to-expand computing and storage capabilities brought by cloud computing, because cloud computing is very different from traditional computer systems in terms of network topology and usage patterns, many traditional security protection measures cannot be used in cloud computing environments. Failure, the security of cloud infrastructure itself is facing a huge challenge. In recent years, relevant information security incidents have occurred frequently.

Assessing the security of the system is an important means and premise of researching the security state of the system. Like the information security assessment of traditional computer systems, the security assessment of cloud infrastructure requires a security assessment. Existing security issues.

After searching, the inventor found that the documents most relevant to the application include:

1. The Chinese patent application CN2012101308311 (name: a cloud computing environment security quantitative evaluation system) discloses a cloud computing environment security quantitative evaluation system. The system is divided into three parts, namely: an information collection module, a management analysis module and a Web query module, and the three functional modules can be connected by means of hooks. Based on the cloud computing environment security quantitative evaluation index model, the invention adopts a combination of automation, semi-automation, and manual interviews to conduct quantitative evaluation of information security for various cloud computing environments.

2. "Research on Access Control Evaluation Technology of Cloud Computing Platform" (Li Wenxue, Harbin Institute of Technology, 2013, master's degree thesis) designed and implemented a system that can automatically evaluate the system's access control security. By embedding the access control test interface into the system under test, the system realizes the remote evaluation of the access control security of the system under test. The evaluation system adopts C/S architecture and is mainly divided into two parts: the evaluation tool client and the system to be tested. The functional sub-modules of the evaluation tool client include: interface, test library, test analysis module, test case generation module, test execution module, test result collection module, test result processing module and the test interface deployed in the system under test.

3. The Chinese patent application CN201110316666.4 (name: a cloud computing-oriented network security early warning method) discloses a network security early warning method. In order to ensure the security and reliability of network communication in the cloud computing environment, dynamically identify and monitor various attack attempts and behaviors in the cloud computing environment in real time, and provide real-time early warning and security protection methods for various network attacks in the cloud computing environment. It mainly consists of a security event collector, a security event processor, a security status analyzer, and a network security early warning operation core. Through Agent technology and Apriori association rule algorithm to solve the network security early warning problem in the cloud computing environment.

Looking at the prior art, it is found that there are problems in the following aspects:

1. Most of the existing public information is that users write evaluation scripts to test the security status of cloud infrastructure, but limited by the technical level, it may not be possible to fully and deeply understand the security status of cloud infrastructure. There are already many open source evaluation software with comprehensive functions and good performance on the market, such as Nessus for vulnerability scanning and Snort for intrusion detection. Security posture assessment.

2. The idea basically followed by the existing technical means is: install an agent agent on different hosts in the cloud infrastructure to collect data, and return the data to the management analysis module through the network for analysis and processing. This is still a traditional concept of information security protection, which has the disadvantage of insufficient scalability of resource allocation. The specific discussion is as follows:

If the amount of information data collected by multiple Agents is large, operations such as deduplication, conversion, and merging of information will bring a high workload to the analysis and processing module. However, the existing public information rarely discusses the architecture of the test analysis module, that is, whether it is processed by a single node, and if it is processed by a single node, it will fall into the problem of "C/S" architecture, that is, a single node is easy to fall into the load overload high situation. If multiple servers or clusters are used, it will be more troublesome to deal with the import and storage of massive evaluation data between the collection end and the background storage system. Moreover, it is difficult to estimate the demand for computing and storage resources in advance, which may lead to the discovery that the existing resources cannot keep up with the actual needs during the evaluation process, and it is difficult to allocate for a while, which affects the evaluation process; at the same time, allocating too many resources is likely to cause waste. is not flexible enough.

3. Deploying agents in the cloud infrastructure to collect evaluation data, and self-reporting data to the background may easily cause conflicts between information, which will interfere with the analysis and processing work of the background and affect the evaluation conclusions.

Generally speaking, there is still a lack of information security evaluation devices and methods that adapt to the characteristics of cloud computing.

Contents of the invention

The technical problem solved by the present invention is to provide a security evaluation method for cloud infrastructure; it can be applied to the characteristics of cloud computing and evaluate information security status.

The technical scheme that the present invention solves the problems of the technologies described above is:

The method is completed by a device composed of a scheduling module, an evaluation software library, an evaluation image, an evaluation configuration library, an evaluation result library, an analysis module, an evaluation requirement book, and an evaluation report;

Before the evaluation, the user configures the evaluation software library; then,

The dispatching module reads the evaluation requirement book of this evaluation activity; determines the software required for this evaluation, and then starts a certain evaluation image, starts the safety evaluation of a certain security subject, and writes the data into the evaluation result database;

During the execution of the evaluation activity, record the required resource configuration, evaluation time and other parameters; after the end of the evaluation activity, write it into the evaluation configuration library to provide configuration and execution reference for the next evaluation activity;

The analysis module synthesizes all the evaluation results, adopts comprehensive evaluation methods such as fuzzy comprehensive evaluation method, AHP evaluation method, gray theory, neural network method, etc., to give an overall evaluation of the security status of the tested cloud infrastructure, and issue a user-downloadable evaluation report;

Each working evaluation image periodically returns its resource consumption status; the scheduling module judges the working status of the evaluation image based on this information; the working status set includes: "task failure" and "task execution";

Reclaim virtual machine resources for the evaluation image at the end of the task;

Wake up the evaluation image that is in the invalid state; if it fails to wake up within the set time, migrate the virtual machine; Assigned to images that are still executing tasks.

Before the evaluation, the user pre-configures the evaluation software library; first uploads the existing security evaluation software for cloud infrastructure on the market and the evaluation software program written by himself to the evaluation software library; then according to the usual classification: system security , network security, data security, behavioral security, etc., these software are classified and divided into different "evaluation software lists"; the evaluation software library can be continuously updated to ensure the advancement and maturity of the evaluation software.

Allocate the required virtual machine resources for each evaluation software, that is, resource units; each evaluation software is installed in a virtual machine, and is packaged together with computing, storage, network and other resources to form an evaluation image; start the evaluation image and perform evaluation activities, and finally analyze and process the data to form evaluation conclusions.

The specific evaluation process is:

(1) Access the evaluation configuration library module, which records the basic configuration information of previous evaluation activities; obtain the resource unit configuration status of related evaluation activities in the previous network security domain evaluation for the same cloud infrastructure; for example: for this evaluation activity How many resources such as CPU and memory are allocated;

(2), the dispatching module reads the evaluation requirement book of this evaluation activity, and accesses the evaluation software list in the evaluation software library according to the different safety subjects of evaluation, and determines the software required for this evaluation;

(3) According to the physical boundaries of the cloud infrastructure in this evaluation, appropriate resource units are allocated for this evaluation activity; this is a self-learning process, such as the security evaluation of 100 servers in the last evaluation activity , this time, 60 servers need to be evaluated for security. Considering the redundancy of resources to deal with emergencies during the evaluation process, the allocated resources for this time can take 60-70% of the physical resources required last time;

(4) Package the software and programs required for this evaluation with the allocated resource units to form a runnable evaluation image;

(5) The scheduling module starts a certain evaluation image, initializes and obtains relevant control authority, collects data, and starts to perform security evaluation on a certain field;

(6) Execute evaluation activities in the evaluation mirror image; perform operations such as conversion and cleaning on the original data; after the evaluation activity is over, write the processed evaluation result data into the evaluation result database;

(7) After all evaluation images are completed, the analysis module synthesizes all evaluation results;

(8) If it is the first time to evaluate the cloud infrastructure, the reference configuration status cannot be obtained from the evaluation history database;

If you visit the evaluation configuration library and do not read the relevant evaluation configuration information, or if it is the first time to implement evaluation activities for the cloud infrastructure, there is no historical data to learn from; The resource configuration of the virtual machine is used as a reference for allocating physical resources as a resource unit.

For the evaluation image that is in the process of task execution, more resources can be allocated to it according to the actual situation to speed up the completion of the evaluation task; the specific process is as follows:

There is an evaluation mirror C _i that executes the task. The current evaluation activity of C _i has consumed time T _C , and the estimated time for C _i to complete the evaluation activity is T _F . New resources can be used for evaluation after joining C _i The preparation time is T _P , if T _F -T _C <T _P , then reallocate the resources recovered from the evaluation mirror that has completed the evaluation activity; otherwise, no operation is performed.

The specific allocation process is:

Each evaluation image that is still working returns its resource consumption status periodically, and the scheduling module generates these evaluation images into a "resource consumption queue of evaluation images" in the order of their consumption of physical resources from high to low; assuming that R have been recycled resource unit. According to the principle of "more consumption, more allocation", these R resource units are allocated to the evaluation image in the resource consumption queue according to the round-robin scheduling algorithm (Round-Robin Scheduling).

The information security evaluation device mentioned in the present invention is deployed in the cloud infrastructure, runs in a virtual machine state, and uses various resources of the cloud infrastructure itself to evaluate its own security status. The deployment is relatively flexible, and different security evaluation software can be combined on demand, with good computing and storage scalability, and can meet various needs centered on customers. Specifically, the present invention has the following beneficial effects:

1. With self-learning function, resource utilization efficiency is higher. According to the requirements of each evaluation, visit the evaluation configuration library module to obtain the basic configuration information of previous evaluation activities, so as to calculate the resource units required for this evaluation activity, which reduces the extension of evaluation time caused by insufficient resource allocation, and also reduces the need for redundancy. Unnecessary use of resources.

2. According to the usual classification of security subjects, upload the existing security evaluation software for cloud infrastructure on the market and self-written evaluation software programs to the evaluation software library, and classify these software into different "evaluation programs" Software List". The evaluation software library has the ability to update the evaluation software stored in it, which ensures the advancement and maturity of the evaluation software.

3. The evaluation work of each security subject, including data collection, preprocessing, and analysis, is transferred to the evaluation image instead of being concentrated in the background analysis module, which reduces its workload.

4. The scheduling module schedules and allocates the required resources in the evaluation activities, and adopts a round-robin scheduling algorithm, so that the load among the evaluation images in each job is relatively balanced, and the execution of evaluation activities can be accelerated.

5. It is possible to build a security evaluation mirror specifically for a certain security subject on demand, or it can be combined and matched in a variety of ways. The evaluation mirror can independently complete the evaluation activities for a certain security subject.

6. Professional security evaluation software can be integrated into the evaluation image, and each software can complete professional work, making the evaluation results more accurate, comprehensive and in-depth.

Description of drawings

Below in conjunction with accompanying drawing, the present invention is further described:

Fig. 1 is a schematic diagram of the functional modules of the evaluation device of the present invention;

Fig. 2 is the configuration flowchart of the evaluation software library of the present invention;

Fig. 3 is a schematic diagram of the flow chart of the evaluation activity of the present invention;

Fig. 4 is a flow chart of resource recovery after the end of the evaluation image task of the present invention;

Fig. 5 is the processing flow diagram after the evaluation mirror image work fails in the present invention;

Fig. 6 is a flow chart of the reclaimed resource scheduling in the present invention.

Detailed ways

As shown in Figure 1, the device for security evaluation of cloud infrastructure in the present invention is composed of scheduling module, evaluation software library, evaluation image, evaluation configuration library, evaluation result library, analysis module, evaluation requirement book, evaluation report and other modules.

Before the evaluation, the user must configure the evaluation software library in advance; the specific process is shown in Figure 2. Upload the existing cloud infrastructure security evaluation software and self-written evaluation software programs to the evaluation software library. According to the usual classification: system security, network security, data security, behavioral security, etc., these software are classified and divided into different "evaluation software lists". The evaluation software library can be continuously updated to ensure the advancement and maturity of the evaluation software.

The complete process of an evaluation activity includes the following: according to the requirements of each evaluation (such as which servers within the cloud infrastructure to be evaluated in this evaluation), allocate the required virtual machine resources for each evaluation software, that is, resource unit. Each evaluation software is installed in a virtual machine, and is packaged together with computing, storage, network and other resources to form an evaluation image. Start the evaluation image, carry out the evaluation activities, and finally analyze and process the data to form the evaluation conclusion.

In order to better illustrate the problem, the following is an example of a complete evaluation activity; see Figure 3 for details. Assume that it is currently necessary to evaluate the network security subjects in the entire cloud infrastructure, so as to know the security status of the cloud infrastructure in this respect.

1. Access the evaluation configuration library module, which records the basic configuration information of previous evaluation activities. Obtain the configuration status of resource units related to evaluation activities in previous network security domain evaluations for the same cloud infrastructure. For example: How many resources such as CPU and memory are allocated for the evaluation activity.

2. After obtaining these configurations, the dispatching module reads the evaluation requirement document of this evaluation activity, and according to the different security subjects of the evaluation, accesses the evaluation software list in the evaluation software library to determine the software required for this evaluation.

3. According to the physical boundaries of the cloud infrastructure for this evaluation, allocate appropriate resource units for this evaluation activity. This is a process of self-learning. For example, the last evaluation activity implemented security evaluation on 100 servers. This time, it is necessary to conduct security evaluation on 60 servers. Considering the redundancy of resources, it is necessary to deal with sudden changes in the evaluation process. If an event occurs, the resources allocated this time can take 60-70% of the physical resources required last time.

4. Package the software and programs required for this evaluation with the allocated resource units to form a runnable evaluation image.

5. The scheduling module starts a certain evaluation image, initializes and obtains relevant control authority, collects data, and starts to conduct security evaluation on a certain field.

6. The evaluation mirror performs evaluation activities. Perform operations such as conversion and cleaning on the original data; after the evaluation activity is over, write the processed evaluation result data into the evaluation result database.

7. After all evaluation images are completed, the analysis module will synthesize all evaluation results.

Since the security status of cloud infrastructure involves the assessment of multiple security subjects, it is restricted by various factors. In order to make an overall and more accurate evaluation, comprehensive evaluation methods can be used, including fuzzy comprehensive evaluation method, Analytic Hierarchy Process (AHP, Analytic Hierarchy Process), gray theory, neural network method, etc. Give an overall evaluation of the security status of the tested cloud infrastructure, and issue an evaluation report for users to download.

8. If it is the first time to evaluate the cloud infrastructure, the reference configuration status cannot be obtained from the evaluation history database.

If you access the evaluation configuration library and do not read relevant evaluation configuration information, or it is the first time to implement evaluation activities for this cloud infrastructure, then there is no historical data for reference. In view of this situation, a simple method can be adopted: take the most common virtual machine resource configuration in the daily operation of the cloud infrastructure as a reference for a resource unit to allocate physical resources.

During the execution of this evaluation activity, record the required resource configuration, evaluation time and other parameters. After this evaluation activity is over, it will be written into the evaluation configuration library to provide configuration and execution reference for the next evaluation activity.

Since the workload of each evaluation image is different, there is a sequence in which the evaluation activities are completed between each evaluation image; at the same time, there may be hardware or software failures that may cause the evaluation image to fail. For these situations, the scheduling module can be used to reallocate resources and adjust tasks.

As shown in Figure 4 and 5, the specific working process is as follows:

Each working measurement image periodically returns its resource consumption status. The scheduling module judges the working status of the evaluation image based on these information. The working status set includes two statuses: "task failure" and "task execution".

When the task of evaluating the image ends, the scheduling module is notified, and the scheduling module performs the recovery work of the virtual machine resources.

Perform a wake-up operation on the evaluation image that is in an invalid state. If it fails to wake up within the set time, the virtual machine will be migrated.

For the evaluation image that is in the process of task execution, more resources can be allocated to it according to the actual situation to speed up the completion of the evaluation task. The specific process is as follows:

There is an evaluation mirror C _i that executes the task. The current evaluation activity of C _i has consumed time T _C , and the estimated time for C _i to complete the evaluation activity is T _F . New resources can be used for evaluation after joining C _i The preparation time is T _P , if T _F -T _C <T _P , then reallocate the resources recovered from the evaluation mirror that has completed the evaluation activity; otherwise, no operation is performed.

As shown in Figure 6, an example is given below to illustrate the specific allocation process.

Each evaluation image that is still working returns its resource consumption status periodically, and the scheduling module generates these evaluation images into a "resource consumption queue of evaluation images" in the order of their consumption of physical resources from high to low. Assume R resource units have been reclaimed. According to the principle of "more consumption, more allocation", these R resource units are allocated to the evaluation image in the resource consumption queue according to the round-robin scheduling algorithm (Round-Robin Scheduling).

Claims (7)

1. for a safe evaluating method for cloud infrastructure, it is characterized in that: described method is completed by the device of the module composition such as scheduler module, test and evaluation software storehouse, test and appraisal mirror image, test and appraisal repository, evaluating result storehouse, analysis module, test and appraisal demand book, test and evaluation report;

Before test and appraisal, by user, test and evaluation software storehouse is configured; Then, scheduler module reads the test and appraisal demand book of this test and appraisal activity; Determine this test and appraisal required for software, restart a certain test and appraisal mirror image, start to carry out security evaluation to a certain safe subject, data are write in evaluating result storehouse;

In test and appraisal activity implementation, the parameters such as the resource distribution needed for record, test and appraisal time; After this test and appraisal activity end, in write test and appraisal repository, provide the references such as configuration and execution for test and appraisal activity next time;

The comprehensive all evaluating results of analysis module, adopt the integrated evaluating methods such as Field Using Fuzzy Comprehensive Assessment, AHP evaluation assessment, gray theory, neural network, the overall evaluation is provided to the safe condition of measured cloud infrastructure, and provides the test and evaluation report can downloaded for user;

Test and appraisal mirror image in each work regularly returns its resource consumption situation; Scheduler module judges the operating state of this test and appraisal mirror image according to these information; Comprise in operating state set: " task inefficacy ", " in tasks carrying " 2 kinds of states;

To the test and appraisal mirror image that task terminates, carry out the recovery operation of resources of virtual machine;

To the test and appraisal mirror image being in failure state, carry out wake operation; If fail to wake up within the time of setting, then carry out virtual machine (vm) migration; To the test and appraisal mirror image be in tasks carrying, according to according to polling dispatching algorithm, the resource of recovery is reassigned to the mirror image of still executing the task.

2. safe evaluating method according to claim 1, is characterized in that: before test and appraisal, user is beforehand with the configuration effort in test and evaluation software storehouse; First the security evaluation software for cloud infrastructure existing on market, the test and evaluation software program of independently writing are uploaded in test and evaluation software storehouse; Then according to common classification: system safety, network security, data security, behavior safety etc., these softwares are classified, is divided into different " test and evaluation software list "; Test and evaluation software storehouse can constantly upgrade, and guarantees the advance of test and evaluation software, maturity.

3. safe evaluating method according to claim 1, is characterized in that: according to the requirement of each test and appraisal, for often kind of test and evaluation software distributes the resources of virtual machine needed for it, i.e. resource units; Each test and evaluation software is installed in virtual machine, with calculate, store, the formation one of packing in the lump of the resource such as network tests and assesses mirror image; Start test and appraisal mirror image, carry out test and appraisal activity, finally analyzing and processing is carried out to data, form test and appraisal conclusion.

4. safe evaluating method according to claim 2, is characterized in that: according to the requirement of each test and appraisal, for often kind of test and evaluation software distributes the resources of virtual machine needed for it, i.e. resource units; Each test and evaluation software is installed in virtual machine, with calculate, store, the formation one of packing in the lump of the resource such as network tests and assesses mirror image; Start test and appraisal mirror image, carry out test and appraisal activity, finally analyzing and processing is carried out to data, form test and appraisal conclusion.

5. the safe evaluating method according to any one of Claims 1-4, is characterized in that: concrete process is:

(1), test and appraisal repository module is accessed, the configurations information of test and appraisal activity before this module records; About the resource units configuration status of test and appraisal activity when obtaining the network security territory test and appraisal in the past for same cloud infrastructure; Such as: for this test and appraisal activity is assigned with the resource situation such as how many CPU, internal memory;

(2), scheduler module reads the test and appraisal demand book of this test and appraisal activity, and according to the safe subject of difference of test and appraisal, the test and evaluation software list in access test and evaluation software storehouse, determines this software required for test and appraisal;

(3), according to the physical boundary scope of cloud infrastructure of these test and appraisal, thus suitable resource units is distributed for this test and appraisal activity; This is a kind of process of autonomous learning, for example last test and appraisal activity implements security evaluation to 100 station servers, this needs to carry out security evaluation to 60 station servers, consider that the redundancy of resource deals with the accident in assessment process, then the 60-70% of physical resource quantity needed for this Resources allocation desirable last time;

(4), by the required software of these test and appraisal, program pack with for its resource units distributed, the test and appraisal mirror image that formation can run;

(5), scheduler module starts a certain test and appraisal mirror image, and initialization also obtains relevant control authority, image data, starts to carry out security evaluation to a certain field;

(6) mirror image of, testing and assessing performs test and appraisal activity; Initial data is changed, the operation such as cleaning; After this test and appraisal activity end, by processed evaluating result data write evaluating result storehouse;

(7), after all test and appraisal mirror images are finished the work, the comprehensive all evaluating results of analysis module;

(8) if first time tests and assesses to this cloud infrastructure, then configuration status that can be for reference cannot be obtained from test and appraisal history library;

If access test and appraisal repository, do not read relevant test and appraisal configuration information, or first time implements test and appraisal activity for this cloud infrastructure, then do not have historical data to use for reference; For this situation, the resources of virtual machine configuring condition that this cloud infrastructure day-to-day operation desirable is the most general, distributes the reference of physical resource as a resource units.

6. safe evaluating method according to claim 5, is characterized in that: for the test and appraisal mirror image be in tasks carrying, according to actual conditions for it distributes more multiple resource, can accelerate it and complete test and appraisal task; Detailed process is as follows:

Be provided with a test and appraisal mirror image C executed the task _i, current C _itest and appraisal activity elapsed time be T _c; C _iestimate that the time of test and appraisal activity is T _f, new resource is from adding C _ithe time that can be used in required for testing and assessing is T _pif, T _f-T _c< T _p, then the redistribute resources reclaimed in the test and appraisal mirror image of test and appraisal activity will be terminated; Otherwise do not operate.

7. safe evaluating method according to claim 6, it is characterized in that: concrete assigning process is: eachly still regularly return its resource consumption situation at the test and appraisal mirror image of work, these test and appraisal mirror images are consumed physical resource order from high to low according to them by scheduler module, are generated to one " the resource consumption queue of test and appraisal mirror image "; Suppose to reclaim R resource units.According to the principle of " consume more, distribute more ", by this R resource units according to polling dispatching algorithm assigns to resource consumption queue " in test and appraisal mirror image.