A trust chain security and trusted computing and data transmission method and device based on an intelligent computing platform and a storage medium

Abstract

A trust chain security trusted computing and data transmission method and device based on an intelligent computing platform and a storage medium, the method comprising intercepting and analyzing transmission data in a virtual machine and a platform system data transmission link, transferring safe data to a target link, and transferring unknown safe data to a designated platform system confusion area for confusion safe processing; using a log layered mining method to analyze the transmission data in the transmission link to analyze the association view formed by the association relationship of the virtual machine; according to the association view, the influence of the sensitive operation of any virtual machine on other virtual machines is used to realize dynamic maintenance of the trust chain between different virtual machines on the cloud; the system uses a benefit and cost ratio index to sort the trust relationship of different virtual machines, and the virtual machine with a larger benefit and cost ratio is given priority to establish a trust relationship. The method can realize dynamic maintenance of the trust chain of the virtual machine on the cloud, solve the problem of dynamic calculation of the priority of the trustworthiness of the virtual machine, and improve the operation efficiency of the cloud service network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud services, and particularly relates to a trust chain secure and trusted computing and data transmission method based on an intelligent computing platform, equipment and a storage medium. BACKGROUND

[0002] Cloud computing is different from the traditional computing mode, and provides cloud services for users by fusing virtualization technology and modern network technology. Due to the rapid development of virtualization technology and Internet technology, cloud computing has become a research hotspot. A cloud platform encapsulates underlying computing, network and storage resources by using virtualization technology, and then provides powerful scalable network service resources in the form of a virtual machine for users. While the virtual machine is widely used, it also becomes an attack object of unscrupulous tenants. Trusted computing technology is an important measure to ensure the trustworthiness of cloud computing. However, directly applying the traditional trust chain transmission method to the cloud computing virtual machine environment cannot effectively solve the real-time and sustainable dynamic trust problems faced by the open environment of cloud computing. SUMMARY

[0003] The present application aims to solve the problems in the prior art, and provides a trust chain secure and trusted computing and data transmission method based on an intelligent computing platform, equipment and a storage medium, which aims to ensure the security of the virtual machine interaction process by taking dynamic maintenance measures for the trust chain.

[0004] To achieve the above object, the present application adopts the following technical solutions:

[0005] In a first aspect, the present application provides a trust chain secure and trusted computing and data transmission method based on an intelligent computing platform, comprising:

[0006] The transmission data in the data transmission link between the virtual machine and the platform system is intercepted and analyzed, the secure data is transmitted to the target link, and the unknown secure data is transferred to the confusion area of the specified platform system for confusion security processing;

[0007] The transmission data in the transmission link is analyzed by using a log layer mining method to form an association view of the virtual machine association relationship;

[0008] According to the association view, the influence of the sensitive operation of any virtual machine on other virtual machines is utilized to realize dynamic maintenance of the trust chain on the cloud between different virtual machines.

[0009] Optionally, the method for confusion security processing of the unknown secure data in the data transmission link is as follows:

[0010] The transmission data is identified by using a mobile target defense method MTD, and the unknown secure data packet is subjected to confusion processing with a probability P0, and the probability P0 satisfies:

[0011]

[0012] In the formula, n is the number of data packets sent by the hacker in a host operating system and web application fingerprint identification; m is the maximum value of the number of data packets allowed to be confused in order to obtain accurate results; P min refers to the minimum probability that the number of confused data packets when the hacker identifies the fingerprint information is less than m; k is the number of data packets subjected to confusion processing.

[0013] Optionally, the method for constructing the association view of any virtual machine is as follows:

[0014] The system view of any virtual machine u, which includes the collection of all observed objects of the virtual machine under the system state S, is specifically represented as follows:

[0015] domview(u, s) = <v1, …, v1, …, v N1 >

[0016] Among them,

[0017]

[0018] In the formula, observe(u, s) represents the collection of object objects that can be read under the system state S.

[0019] Optionally, the method for analyzing the virtual machine collection by using the log hierarchical mining method is as follows:

[0020] According to any network node in the networking to find network nodes having a business data transmission relationship with other network nodes, and then extracting all associated network nodes having a business data transmission relationship with the associated network nodes from the log;

[0021] After extracting the service relationship between all associated nodes, the virtual machines included by each node are obtained;

[0022] The virtual machines included by each node are associated and the system view is constructed.

[0023] Optionally, the specific method for dynamically maintaining the trust chain between any two virtual machines Dom1 and Dom2 on the cloud is as follows:

[0024] Step S1, after Dom1 executes a sensitive operation a, it queries whether Dom2 maintains integrity, and the sensitive operation a is modifying and sharing object n2 to virtual machine Dom2;

[0025] Step S2, when Dom2 maintains integrity, the state transition between Dom1 and Dom2 is verified, and the specific method is as follows:

[0026] Let virtual machines Dom1 and Dom2 be denoted as u and v respectively, when Dom1 performs sensitive operation a, described as: dom(a)=u, domview(u,s1)=<v2,v3,v5,···>, domview(u,s2)=<v2',v3,v5,···>, and

[0027] When v1=v2, and Dom2 has read permission on object n2, a trust relationship between Dom1 and Dom2 is established;

[0028] Step S3, when v1≠v2, the output of operation a only depends on the system view of Dom1, and the influence of operation a on the system state only relates to the system view of the previous state of Dom1; under the premise, Dom2 has read permission on object n2, a trust relationship between Dom1 and Dom2 is established.

[0029] Optionally, when the trust chain of any two virtual machines Dom1 and Dom2 is dynamically maintained, the platform system controls the information flow in the running process.

[0030] Optionally, the system sorts the trust relationships of different virtual machines according to the benefit-cost ratio index, and the virtual machine with a larger benefit-cost ratio is given priority to establish a trust relationship.

[0031] Optionally, the virtual machine benefit-cost ratio index is calculated as follows:

[0032] The benefit of a virtual machine is reflected by the resource demand of the virtual machine, including node resource demand and link resource demand, which is defined as follows:

[0033]

[0034] In the formula, I(G v ) is the benefit index of the virtual machine, is the computing power demand value of virtual node i, is the computing power demand value of virtual link j, and a is a weight factor;

[0035] The cost of a virtual machine is the sum of the actual resources allocated to the virtual machine by the system, which is defined as follows:

[0036]

[0037] In the formula, C(G v ) is the cost index of the virtual machine, represents the actual path length of the virtual link j on the system after being mapped;

[0038] The calculation formula of the benefit-cost ratio of the virtual machine is as follows:

[0039] P = I(G v ) / C(G v )

[0040] In the formula, P is a virtual machine revenue overhead ratio, I(G v ) is a revenue index of the virtual machine, and C(G v ) is an overhead index of the virtual machine.

[0041] In a second aspect, the present application provides a computer readable storage medium storing a computer program, which causes a computer to execute the trust chain secure and trusted computing and data transmission method based on the intelligent computing platform.

[0042] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the trust chain secure and trusted computing and data transmission method based on the intelligent computing platform is implemented.

[0043] The present application has the following beneficial effects: firstly, the correlation view of the virtual machine can be used to dynamically maintain the trust chain on the cloud between different virtual machines, and the real-time and sustainable dynamic trust problem faced by the cloud computing open environment cannot be effectively solved by applying the traditional trust chain transmission mode to the cloud computing virtual machine environment. In addition, the present application also uses the revenue overhead ratio index to sort the trust relationship of different virtual machines, and the virtual machine with a larger revenue overhead ratio is preferentially established in the trust relationship, thereby solving the priority problem of real-time and sustainable dynamic trusted computing faced by the cloud computing open environment, reducing resource consumption, and preventing concurrent cloud service network or thread blocking. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 is a workflow diagram of the trust chain secure and trusted computing and data transmission method based on the intelligent computing platform of the present application;

[0045] Figure 2 is a trust chain dynamic maintenance workflow diagram of the trust chain secure and trusted computing and data transmission method based on the intelligent computing platform of the present application. DETAILED DESCRIPTION

[0046] The technical solutions in the embodiments of the present application will be described in detail below with reference to the drawings in the embodiments of the present application.

[0047] Cloud computing is different from traditional computing mode, through the fusion of virtualization technology and modern network technology to provide cloud services for users. Because of the rapid development of virtualization technology and Internet technology, cloud computing has become a research hotspot. Cloud platform uses virtualization technology to realize the encapsulation of underlying computing, network and storage resources, and then provides powerful scalable network service resources in the form of virtual machines for users. While virtual machines are widely used, they also become the target of attacks by bad tenants. Trusted computing technology is an important measure to ensure the trustworthiness of cloud computing, but directly applying the traditional trust chain transmission method to the cloud computing virtual machine environment cannot effectively solve the real-time and sustainable dynamic trust problems faced by the open environment of cloud computing.

[0048] In order to realize the dynamic maintenance of the trust chain in the cloud computing virtual machine environment and effectively ensure the security of the cloud customer virtual machine interaction process, the embodiment provides a trust chain security and trusted computing and data transmission method based on an intelligent computing platform.

[0049] The embodiment discloses a trust chain security and trusted computing and data transmission method based on an intelligent computing platform, as shown in Figure 1 The specific steps include:

[0050] The transmission data in the data transmission link between the virtual machine and the platform system is intercepted and analyzed, the safe data is transmitted to the target link, and the unknown safe data is transferred to the confusion area of the specified platform system for confusion security processing.

[0051] The transmission data in the transmission link is analyzed by using a log hierarchical mining method to analyze the association view composed of the association relationship of the virtual machine.

[0052] According to the association view, the influence of the sensitive operation of any virtual machine on other virtual machines is used to realize the dynamic maintenance of the trust chain on the cloud between different virtual machines.

[0053] In the embodiment, a dynamic trust chain model DTM is first constructed, including a system platform and a virtual machine set, wherein each virtual machine is denoted as DomN, a subject in each virtual machine issues an operation action to the system and interacts with the system, and can observe the corresponding result. By using the dynamic trust chain model DTM, the information flow between the system platform and the virtual machine and between the virtual machines can be limited.

[0054] In the embodiment, a mobile target defense method MTD is used to identify the transmission data, and abnormal cloud data is sent to the confusion area. The working principle is that for any data packet sent to the server, there is a P a probability of confusion processing for the data packet. If other mechanisms of the network are not considered, when n data packets are sent, the following must be satisfied:

[0055] P (all sent to the target host) = (1-Pa n

[0056] Therefore, in order to obtain accurate target host fingerprint information, the attacker must receive a certain number of reply packets from the target host. In order to deal with the above situation, the following model is established: for unknown secure packets, the packet is confused with a probability of P0. It is assumed that the number of packets sent by the hacker in one host operating system (OS) and web application fingerprint identification is n, and in order to obtain accurate results, the number of packets allowed to be confused by the hacker is at most m, at this time the formula can be:

[0057]

[0058] Where, P min refers to the minimum probability of normal transmission of data packets (the number of confused data packets is less than m) when the hacker identifies the fingerprint information. Only when the probability of normal transmission of data packets is greater than this probability, can the attacker accurately identify the correct fingerprint information of the target host.

[0059] In order to achieve the goal of not allowing the attacker to accurately identify the correct fingerprint information of the target host, the flow table and the group table are added to manipulate the data packets at the packet granularity, so that different data packets are sent to different areas, that is, part of them are sent to the real server and the other part are sent to the confusion area. In this embodiment, the flow table is used to query whether there is a rule matching the data packet, and the group table is used to define the mapping relationship between the system and different virtual machines.

[0060] In this embodiment, a log hierarchical mining method is used to analyze the association relationship of virtual machines to form an association view, and the specific method is as follows:

[0061] First, according to any network node, find the nodes that have a business data transmission relationship with other nodes in the network. Then extract all the associated nodes of the business data from the log.

[0062] Second, extract the service relationship between all associated nodes. Extract the application data related to the business data, and perform the application according to a business in different associated nodes. These data records the resource information and running health status of the server, database, middleware, server CPU, memory, disk, and process in different time dimensions.

[0063] Finally, the virtual machines protected by each node and the associated system view are constructed.

[0064] In this embodiment, the network node with a small SSD value can be used to find the nodes that have a business data transmission relationship with other nodes in the network.

[0065] ​In this embodiment, the system view of any virtual machine u, including the set of all observed objects of the virtual machine in the system state S, is specifically represented as follows:

[0066] domview(u, s) = <v1,..., v1,..., v N1 >:

[0067] wherein,

[0068]

[0069] In the formula, observe(u, s) represents the set of object objects that can be read in the system state S.

[0070] Further, the data that is not sent to the confusion area can be defined as a set of states S of the system, denoted as {s1, s2,...}. The system state at a certain moment can be represented by a set of object objects and their values.

[0071] At this time, N represents a set of countable names, and the set of objects visible to the virtual machine Dom U in the state S1 is represented as N1 = {n1, n2,...}, and V represents a set of countable values, V1 = {v1, v2,...}. In order to describe the system view, the function content: S x N -> V represents the value of the object with the name n in the system state S; the function altor: U x S -> P(N) represents the set of object objects that can be written by the virtual machine Dom U in the system state S; and the function observe: U x S -> P(N) represents the set of object objects that can be read by the virtual machine Dom U in the system state S.

[0072] In this embodiment, the generated virtual machine association view is used to dynamically maintain the trust chain of the virtual machine on the whole cloud, and the cloud trust chain dynamic maintenance method between any two virtual machines Dom1 and Dom2 is taken as an example, as shown in Figure 2 The specific steps are as follows:

[0073] Step S1, after Dom1 executes the sensitive operation a, the sensitive operation a is intercepted by the ICC, and it is inquired whether Dom2 maintains integrity, the sensitive operation a is to modify and share the object n2 to the virtual machine Dom2; if Dom2 cannot maintain integrity, an error message is thrown and the operation is terminated, and the operation information is updated to the IDB database;

[0074] Step S2, when Dom2 maintains integrity, the state transition between Dom1 and Dom2 is verified, and the specific steps are as follows:

[0075] Let virtual machines Dom1 and Dom2 be denoted as u and v respectively, when Dom1 executes sensitive operation a, described as: dom(a)=u, domview(u,s1)=<v2,v3,v5,···>, domview(u,s2)=<v2',v3,v5,···>, and

[0076] When v1=v2, the IDB database is queried by using the MC, if Dom2 has the read permission for object n2, the trust relationship between Dom1 and Dom2 is established, and the operation information is updated to the IDB database;

[0077] Step S3, when v1≠v2, the system view of Dom1 is read by using the MC and the IDB database is queried, whether the output of operation a only depends on the system view of Dom1 is judged, the IDB database is queried again, whether the influence of operation a on the system state only relates to the system view of the previous state of Dom1 is judged, if any of the above conditions is not met, an error message is thrown and the operation is terminated, and the operation information is updated to the IDB database;

[0078] Step S4, if the output of operation a only depends on the system view of Dom1 and the influence of operation a on the system state only relates to the system view of the previous state of Dom1, the ADB is queried by using the MC to determine whether Dom2 has the read permission for object n2, if Dom2 has the read permission for object n2, the trust relationship between Dom1 and Dom2 is established, and the operation information is updated to the IDB database; if Dom2 does not have the read permission for object n2, an error message is thrown and the operation is terminated, and the operation information is updated to the IDB database.

[0079] Through the dynamic maintenance of the trust chain between any two virtual machines Dom1 and Dom2 on the cloud, the security of the interaction process of the cloud customer virtual machine in the overall cloud system is effectively ensured.

[0080] In the embodiment, in order to reduce resource consumption and prevent the cloud service network or thread from being blocked due to concurrency, the priority of how to establish the trust relationship in the case that there are many trust relationships between multiple application or threads of different communication virtual machines needs to be solved, taking the communication virtual machines Dom1 and Dom2 as an example, the benefit-cost ratio index is used for sorting, and the specific method is as follows:

[0081] The benefit of the virtual machine is reflected by the resource demand of the virtual machine, including node resource demand and link resource demand, and is defined as follows:

[0082]

[0083] In the formula, I(G v ) is a benefit index of the virtual machine, is a computing capability requirement value of the virtual node i, is a computing capability requirement value of the virtual link j, and a is a weight factor;

[0084] The overhead of the virtual machine is the sum of the actual resources allocated by the system to the virtual machine, and is defined as follows:

[0085]

[0086] In the formula, C(G v ) is an overhead index of the virtual machine, represents the actual path length occupied by the virtual link j on the system after being mapped;

[0087] The virtual machine benefit overhead ratio calculation formula is as follows:

[0088] P = I(G v ) / C(G v )

[0089] In the formula, P is a virtual machine benefit overhead ratio, I(G v ) is a benefit index of the virtual machine, and C(G v ) is an overhead index of the virtual machine.

[0090] In the entire system, the priority of establishing a trust relationship is higher for a greater benefit overhead ratio. The priority problem of real-time and sustainable dynamic trust calculation faced by the cloud computing open environment is solved through the above index calculation, and the efficiency of cloud service network or thread running is improved.

[0091] In the embodiment, a trust chain security and trusted computing and data transmission device based on an intelligent computing platform is also provided, which includes a processor, a memory, and a communication interface connected with a system bus. The processor is configured to provide control computing capability. The memory stores a computer program, and the computer program is executed by the processor to implement the trust chain security and trusted computing and data transmission method based on the intelligent computing platform. The memory includes a computer storage medium and an internal memory. The computer storage medium is a non-volatile storage medium, and the non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running of the operating system and the computer program. The communication interface of the computer device is configured to perform wired or wireless communication with an external terminal. The wireless communication can be performed through WIFI, a mobile cellular network, or the like.

[0092] In some embodiments, the processor executes the computer program instructions to implement the following steps:

[0093] A1, intercept and analyze the transmission data in the virtual machine and the platform system data transmission link, and transfer the security data to the target link, and transfer the unknown security data to the specified platform system confusion area for confusion security processing;

[0094] A2, the transmission data in the transmission link is analyzed by using the log layer mining method to analyze the association view composed of the association relationship of the virtual machine;

[0095] A3, according to the association view, the influence of the sensitive operation of any virtual machine on other virtual machines is used to realize the dynamic maintenance of the trust chain between different virtual machines on the cloud;

[0096] A4, the system uses the benefit cost ratio index to sort the trust relationship of different virtual machines, and the virtual machine with greater benefit cost ratio is preferentially established.

[0097] In the embodiments disclosed in the present application, the computer storage medium can be a tangible medium which can contain or store programs for use by or in conjunction with an instruction execution system, device or equipment. The computer storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the above. More specific examples of computer storage medium can include one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

[0098] Those skilled in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in the present application can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0099] The above is only the preferred embodiment of the present application, and the protection scope of the present application is not limited to the above-mentioned embodiments. Any technical solution falling within the scope of the present application shall be considered as falling within the protection scope of the present application. It should be noted that for ordinary skilled in the art, some improvements and refinements without departing from the principles of the present application shall be considered as falling within the protection scope of the present application.

Claims

1. A trust chain security trusted computing and data transmission method based on an intelligent computing platform, characterized in that, The method comprises the following steps: Intercept and analyze the transmission data in the transmission data link of the virtual machine and the platform system, and transfer the security data to the target link, and transfer the unknown security data to the confusion area of the designated platform system for confusion security processing; The transmission data in the transmission link is analyzed by using a log hierarchical mining method to analyze the association view of the virtual machine; the construction method of the association view of any virtual machine is as follows: The system view of any virtual machine u is constructed, which includes the collection of all observed objects of the virtual machine under the system state S, and is specifically represented as follows: domview(u, s) = {vi,..., vi,..., v N1 > Wherein, In the formula, observe (u, s) represents the collection of object objects that can be read under the system state S; According to the association view, the influence of the sensitive operation of any virtual machine on other virtual machines is used to realize the dynamic maintenance of the trust chain on the cloud between different virtual machines; the specific method of the dynamic maintenance of the trust chain on the cloud between any two virtual machines Dom1 and Dom2 is as follows: Step S1, after Dom1 executes the sensitive operation a, it is queried whether Dom2 maintains integrity, and the sensitive operation a is to modify and share the object n2 to the virtual machine Dom2; Step S2, when Dom2 maintains integrity, the state transition between Dom1 and Dom2 is verified, and the specific method is as follows: Virtual machines Dom1 and Dom2 are respectively denoted as u and v, when Dom1 executes the sensitive operation a, it is described as: dom (a) = u, domview (u, s1) = <v2, v3, v5, …>, domview (u, s2) = <v2', v3, v5, …>, and When v1=v2, and Dom2 has read permission for object n2, a trust relationship between Dom1 and Dom2 is established; Step S3, when v1≠v2, the output of operation a only depends on the system view of Dom1, and the influence of operation a on the system state is only related to the system view of the previous state of Dom1; under the premise, Dom2 has read permission for object n2, and a trust relationship between Dom1 and Dom2 is established.

2. The trust chain secure and credible computing and data transmission method based on the intelligent computing platform according to claim 1, characterized in that, The method for confusion security processing of unknown security data in the data transmission link is as follows: The transmission data is identified by using the mobile target defense method MTD, and the unknown security data packet is subjected to confusion processing with a probability P0, and the probability P0 satisfies: In the formula, n is the number of data packets sent by the hacker in one host operating system and web application fingerprint identification; m is the maximum number of data packets allowed to be confused by the hacker to get accurate results; P min Refers to the minimum probability that the number of confused data packets when the hacker identifies the fingerprint information is less than m; k is the number of data packets for confusion processing. 3.The trust chain secure and credible computing and data transmission method based on the intelligent computing platform of claim 1, wherein, The method for analyzing the virtual machine set by using the log hierarchical mining method is as follows: According to any network node in the networking, find the network nodes having a business data transmission relationship with other network nodes, and then extract all the associated network nodes having a business data transmission relationship with the associated network nodes from the log; After extracting the service relationship between all the associated nodes, the virtual machines included in each node are obtained; The virtual machines included in each node are associated and a system view is constructed.

4. The trust chain secure and credible computing and data transmission method based on the intelligent computing platform according to claim 1, characterized in that, When the trust chain of any two virtual machines Dom1 and Dom2 is dynamically maintained, the information flow of the running process is controlled by the platform system.

5. The trust chain secure and reliable computing and data transmission method based on the intelligent computing platform according to claim 1, characterized in that, The system uses the benefit cost ratio index to sort the trust relationship of different virtual machines, and the virtual machine with a larger benefit cost ratio is preferentially established in the trust relationship.

6. The trust chain secure and reliable computing and data transmission method based on the intelligent computing platform according to claim 5, characterized in that, The virtual machine benefit-to-overhead ratio index is calculated as follows: The benefit of a virtual machine is reflected by the resource requirement of the virtual machine, including node resource requirement and link resource requirement, and is defined as follows: In the formula, I(G v ) is a benefit index of the virtual machine, is a computing capability requirement value of the virtual node i, is a computing capability requirement value of the virtual link j, and a is a weight factor. The overhead of a virtual machine is the sum of the actual resources allocated to the virtual machine by the system, and is defined as follows: In the formula, C(G v ) is the overhead index of the virtual machine, represents the actual path length occupied by the virtual link j on the system after mapping. The benefit-to-overhead ratio of a virtual machine is calculated as follows: P = I(G v ) / C(G v ) In the formula, P is a virtual machine benefit cost ratio, I(G v ) is a benefit index of the virtual machine, and C(G v ) is a cost index of the virtual machine.

7. A computer readable storage medium storing a computer program, wherein the computer program comprises program instructions configured to cause a processor to perform the method according to any one of claims 1 to 6. The computer program enables a computer to execute the trust chain security and trusted computing and data transmission method based on the intelligent computing platform according to any one of claims 1-6.

8. An electronic device, comprising: The computer program enables a computer to execute the trust chain security and trusted computing and data transmission method based on the intelligent computing platform according to any one of claims 1-6. The computer program enables a computer to execute the trust chain security and trusted computing and data transmission method based on the intelligent computing platform according to any one of claims 1-6.

Images