Internet环境下“分布式智能决策支持系统生成器”Browser/Multi-Server结构的研究

针对当前的Internet环境，文章提出了一种新的分布式智能决策支持系统生成器的结构，并着重阐述了IDSSG的这种结构如何在Internet环境下实现。

An efficient hash-based authenticated key agreement scheme for multi-server architecture resilient to key compromise impersonation

During the past decade,rapid advances in wireless communication technologies have made it possible for users to access desired services using hand-held devices.Service providers have hosted multiple servers to ensure seamless online services to end-users.To ensure the security of this online communication,researchers have proposed several multi-server authentication schemes incorporating various cryptographic primitives.Due to the low power and computational capacities of mobile devices,the hash-based multi-server authenticated key agreement schemes with offline Registration Server(RS)are the most efficient choice.Recently,Kumar-Om presented such a scheme and proved its security against all renowned attacks.However,we find that their scheme bears an incorrect login phase,and is unsafe to the trace attack,the Session-Specific Temporary Information Attack(SSTIA),and the Key Compromise Impersonation Attack(KCIA).In fact,all of the existing multi-server authentication schemes(hash-based with offline RS)do not withstand KCLA.To deal with this situation,we propose an improved hash-based multi-server authentication scheme(with offline RS).We analyze the security of the proposed scheme under the random oracle model and use the t4Automated Validation of Internet Security Protocols and Applications''(AVISPA)tool.The comparative analysis of communication overhead and computational complexity metrics shows the efficiency of the proposed scheme.

A Secure Three-Factor Authenticated Key Agreement Scheme for Multi-Server Environment

Multi-server authenticated key agreement schemes have attracted great attention to both academia and industry in recent years.However,traditional authenticated key agreement schemes in the single-server environment are not suitable for the multi-server environment because the user has to register on each server when he/she wishes to log in various servers for different service.Moreover,it is unreasonable to consider all servers are trusted since the server in a multi-server environment may be a semi-trusted party.In order to overcome these difficulties,we designed a secure three-factor multi-server authenticated key agreement protocol based on elliptic curve cryptography,which needs the user to register only once at the registration center in order to access all semi-trusted servers.The proposed scheme can not only against various known attacks but also provides high computational efficiency.Besides,we have proved our scheme fulfills mutual authentication by using the authentication test method.

Cryptanalysis of Two Dynamic Identity Based Authentication Schemes for Multi-Server Architecture

Since network services are provided cooperatively by multiple servers in the lnternet, the authentication protocols for multiserver architecture are required by Internetbased services, such as online game, online trade and so on. Recently, Li et al. analyzed Lee et al.＇s protocol and proposed an improved dynamic identity based authentication protocol for multi-server architecture. They claimed that their protocol provides user＇s anonymity, mutual authentication and the session key agreement against several kinds of attacks. In this paper, a cryptanalysis on Lee et al.＇s scheme shows that Lee et al＇s protocol is also vulnerable to malicious server attack, stolen smart card attack and leak-of-verifier attack. Moreover, Li e/ al.＇s improved protocol is also vulnerable to all these attacks. Further cryptanalysis reveals that Li et al.＇s improved protocol is susceptible to collusion attack.

Efficient Hierarchical Multi-Server Authentication Protocol for Mobile Cloud Computing

With the development of communication technologies,various mobile devices and different types of mobile services became available.The emergence of these services has brought great convenience to our lives.The multi-server architecture authentication protocols for mobile cloud computing were proposed to ensure the security and availability between mobile devices and mobile services.However,most of the protocols did not consider the case of hierarchical authentication.In the existing protocol,when a mobile user once registered at the registration center,he/she can successfully authenticate with all mobile service providers that are registered at the registration center,but real application scenarios are not like this.For some specific scenarios,some mobile service providers want to provide service only for particular users.For this reason,we propose a new hierarchical multi-server authentication protocol for mobile cloud computing.The proposed protocol ensures only particular types of users can successfully authenticate with certain types of mobile service providers.The proposed protocol reduces computing and communication costs by up to 42.6%and 54.2%compared to two superior protocols.The proposed protocol can also resist the attacks known so far.

Weaknesses of a Dynamic ID Based Remote User Authentication Protocol for Multi-Server Environment

Currently, smart card based remote user authentication schemes have been widely adopted due to their low cost and convenient portability. With the purpose of using various different internet services with single registration and to protect the users from being tracked, various dynamic ID based multi-server authentication protocols have been proposed. Recently, Li et al. proposed an efficient and secure dynamic ID based authentication protocol using smart cards. They claimed that their protocol provides strong security. In this paper, we have demonstrated that Li et al.’s protocol is vulnerable to replay attack, denial of service attack, smart card lost attack, eavesdropping attack and server spoofing attacks.

Analysis and Improvement on a Hash-Based Authentication Scheme for Multi-Server Architecture

In order to meet people’s demand for various types of network services,researchers have conducted extensive research on authentication schemes for multi-server architecture.Although various schemes have been proposed,most of them still have safety defects and fail to meet safety requirements.Recently,Haq et al presented an efficient Hash-based authenticated key agreement scheme for multi-server scheme and claimed that their scheme can withstand all well-known attacks.However,we find that their scheme is vulnerable to replay attack,tracking attack and malicious server impersonation user attack.Then we propose an improved scheme.We also analyze the security of the improved scheme and compare with Haq et al’s scheme in security and computational efficiency.Furthermore,we use the AVISPA(Automated Validation of Internet Security Protocols and Applications)tool to verify the security of the improved scheme.

建行信用卡系统全栈国产化改造研究

信用卡业务是业务逻辑最复杂的银行业务之一,其对可用性、可靠性、处理性能要求较高。从技术发展角度来看,多技术栈融合的新型IT架构,符合云计算资源池化的趋势。从业务角度来看,为满足不同的业务需求,同样存在多技术栈融合架构的诉求。然而,多计算架构并非简单实现一个全新的技术栈即可,需要解决架构改造与设计、系统验证、兼容性以及故障切换等一系列问题。面对上述挑战,该文面向金融IT系统高并发、高性能以及高可用需求,介绍了建行面向金融行业的高性能、高可用和高安全可靠的x86、ARM双平台混合架构系统中的设计与思考。通过一系列的代码迁移、应用迁移以及系统垂直优化技术,实现高性能、高可用和高安全的诉求,并在建行得到了大规模、长时间的真实系统验证。

面向动态边缘网络的数字孪生自适应联合优化部署

在数字孪生赋能的移动边缘计算(Mobile Edge Computing,MEC)网络中,如何实现数字孪生服务器的高效部署是确保数字孪生实时交互性的瓶颈问题。针对该问题,提出一种面向动态边缘网络的数字孪生自适应联合优化部署机制。首先,该机制构建面向动态边缘网络的双层数字孪生模型以实时捕捉MEC网络状态和UE资源利用情况等特征。然后,联合数字孪生交互时延模型、负载均衡模型和能源消耗模型建立数字孪生服务器自适应动态更新部署问题。最后,提出多阶段自适应动态联合部署优化算法,将数字孪生服务器自适应动态更新部署问题分解为数字孪生服务器初始化部署和自适应动态更新部署两阶段优化求解,以实现部署策略随MEC网络的即时系统状态进行自适应动态调整。仿真分析验证了所提出算法在预测精度、交互时延、工作负载和能耗方面的有效性。

一种多控制器的网络服务器集群负载均衡调度策略

为提高网络服务器集群中心宽带利用率、降低网络访问及传输时延,文章提出一种基于SDN的多控制器负载均衡调度策略。首先,构建多控制器的网络服务器集群负载均衡调度的总体框架,通过转发层采集网络交换设备的状态信息;然后,在多控制器单元生成全局网络视图,采用自适应网络大小流进行调度,以提高网络及传输时延为目标构建网络服务器集群负载均衡调度策略模型。最后,控制器单元更新流量表并对OpenFlow交换层设备进行更新,以实现网络服务器集群中心的网络负载均衡。

身份加密多云多副本完整性审计协议

为解决现有可证明数据持有(PDP)协议只适用于单云存储服务器且过度依赖公钥基础设施的问题,提出一种新的基于身份的多云多副本PDP协议。该协议采用身份加密来简化证书管理,并设计双层默克尔哈希树作为新的安全数据结构,以维护多副本的新鲜性和一致性。安全性分析和实验结果均验证了该协议具备安全性和高效性,能够在多个云存储服务器上实现多副本完整性审计,并在标签生成、证据生成和证据验证3个阶段的效率上明显优于对比算法。

多服务器环境下基于椭圆曲线密码的认证协议

本文研究了多服务器环境下的认证密钥协商协议.通过对Andola等人方案的分析,利用椭圆曲线密码和随机数设计了一种改进的认证密钥协商协议.使用BAN逻辑和非形式化分析方法,对协议进行安全性分析.实验结果表明,所提协议具有更好的安全性和实用性.

面向利润优化的软实时云服务调度与多服务器系统配置方法研究

在云计算中,由于多核技术的不断革新,近年来有许多工作研究了基于多核处理器的多服务器系统。云服务提供商通过建立多服务器系统给用户提供云服务并优化云服务利润是目前云计算领域的一个热点问题,对这些问题的研究推动着云计算技术的不断发展。然而,现有的关于多服务器系统的研究要么局限于通过对多服务器计算资源的配置来优化云服务利润而忽视了云服务请求本身的可调度性,要么局限于开发服务请求调度策略来提升云服务利润而忽视了多服务器系统的动态扩展性。但若使用云服务请求调度与多服务器配置协同优化来提升云服务利润,则会使问题规模的复杂性呈指数增长。因此,为云服务提供商设计一个面向软实时云服务请求的云服务调度与多服务器配置方法是十分必要的。此外,现有的研究在配置多服务器系统时大多忽略了处理云服务请求会遭受瞬时故障的情况。而许多研究表明,软实时任务在遭受瞬时故障时会影响服务请求的执行结果从而影响云服务利润。本研究面向软实时云服务请求,针对云环境中普遍存在的计算性能异构的服务器资源,开发了一个基于深度搜索的灰狼算法来协同优化云服务请求调度和多服务器配置以最大化云服务利润。最后,为了验证所提方法的有效性,进行了大量实验,实证结果表明,与现有的基准方法相比,所提方法得到的云服务利润平均增加了6.83%。

移动边缘计算中基于混合人工蜂群算法的计算卸载策略

计算卸载是移动边缘计算(Mobile Edge Computing,MEC)中的关键技术.针对多用户多MEC服务器场景中计算卸载策略的不足,本文提出一种混合人工蜂群算法(Artificial Reverse Sine-Cosine,ARSC).首先,使用反向学习策略初始化种群,优化种群的初始解;然后,在雇佣蜂阶段利用正余弦算法的全局最优引导信息,提升算法的局部搜索能力;最后,为了平衡算法的全局搜索能力和局部搜索能力,引入动态感知因子对算法的步长因子进行改进.仿真实验结果表明,相比基于粒子群算法的卸载策略、基于人工蜂群算法的卸载策略,ARSC策略在系统时延、系统能耗、收敛性等指标上均有所改善.

基于深度强化学习的隐私保护任务卸载策略

针对多移动边缘计算(MEC)服务器网络中计算卸载任务特征隐私泄露的问题,提出了一种基于深度强化学习(DQL)的隐私保护的在线计算卸载新方法.该方法首先通过对计算卸载特征任务的隐私泄露进行度量,设定隐私泄露约束阈值,保护用户卸载的隐私信息;然后以最小化系统能耗为目标,将该优化问题转变为马尔可夫决策过程;最后利用深度Q网络(DQN)算法求解出满足隐私约束和最小化能耗目标的接近最优的卸载决策.实验结果表明,该算法能够在有效降低用户设备平均能耗的同时,使任务卸载频率始终满足隐私约束.

一种联合边缘服务器部署与服务放置的方法

边缘计算(EC)在靠近用户的网络边缘部署边缘服务器(ES),并将服务放置在ES上,从而可以满足用户的服务需求。独立研究ES部署和服务放置问题的成果已有很多,但两者存在高度耦合关系。考虑到EC系统的收益,有必要提供付费服务,使得EC系统处理用户服务请求时会获得相应收入。同时,EC系统处理用户服务请求时会产生时延和能耗成本,为了最大化EC系统的收益,在用户服务请求和服务价格不同的约束下,需要合适的服务放置方案来提高EC系统的收益。为此,在ES与基站之间的位置关系、ES部署和服务放置之间的耦合关系、服务副本数和服务价格等约束下,提出一种包括改进的k-means算法和多智能体强化学习算法的两步方法,使EC系统的收益最大化。首先,构建一个联合ES部署和服务放置模型,其中ES部署明确考虑了基站之间的位置关系,服务放置明确考虑了ES部署的位置,以及不同的服务请求和价格;然后,基于基站的位置关系和基站的服务请求负载,通过带约束的k-means算法,在不同约束条件下分别确定最佳的ES部署位置以及ES的协作域;最后,以最大化EC系统收益为目标,通过多智能体强化学习算法在ES上放置服务。实验结果表明,与对比方法相比,所提方法能够提高收益7%~23%。

基于用户密度和平均访问时间的边缘服务器放置方法

为解决边缘服务器放置过程中资源浪费和延迟增加的问题,对边缘服务器放置方案的用户密度和平均访问时间进行分析建模,将其描述为多目标优化问题。设计了一种基于用户密度和平均访问时间的边缘服务器放置方案,并提出了一种多目标海马遗传算法(MOSGA)解决该问题。MOSGA首先使用多目标优化算法的思想对海马优化(sea horse optimizer,SHO)算法进行改进,使SHO算法能够适用于多目标优化问题,并在此基础上使用遗传算法改进SHO算法的繁殖操作,使MOSGA能更好地跳出局部最优解,加速问题的求解。该算法在上海电信数据集上进行了实验验证,仿真实验结果表明,MOSGA明显优于RA、K-means、NSGA、LMM,不仅有效解决了服务器资源浪费的问题,同时大大降低终端设备访问服务器的时间。

多线程多核服务器功耗模型及性能监控

针对现有服务器的CPU功耗准确性不足和多线程处理功耗负载不平衡问题,本文提出了一种多线程和多核服务器CPU功耗模型。该模型采用前后端分离的整体架构思想,根据服务器功耗模型实时获取CPU的线程数、频率及利用率。通过日志文件进行反馈多线程和多核功耗模型,达到最佳服务器负载平衡。仿真测试的结果表明,改进的服务器功耗模型在CPU利用率方面比传统服务器提高了6%,内存以及I/O通信方面也有明显改善,为多线程和多核服务器提供了一种新的功耗模型思路。

路径规划及信号灯控制的智能优化

由于全智能化的交通控制系统尚未得到完全普及,道路交通资源占用时空二维不够均衡、城市交通规划策略与通行车辆规模不够匹配,导致城市交通拥塞、车辆准点率低等问题。针对上述问题,首先构建了基于服务员休假的多队列多服务员排队模型和级联队列的多跳排队模型,分析了在十字路口处及一般道路情况下车辆流量、信号灯时长与通勤时延的理论关系;然后提出了基于近端策略优化的路径规划及信号灯控制的智能优化方法,通过动态感知城市实时交通拥塞状态,联合规划车辆最优路径和控制信号灯最优时长,从而最大化车辆准点率。仿真结果表明,所提方法比于自适应高效联邦对比方法在时延性能方面提升了3倍以上,在车辆准点率方面提升了18%左右。

零信任架构下多服务器自动加密算法设计

设计一种零信任架构,针对多服务器提出一种自动加密算法。基于零信任架构构建多服务器可搜索加密模型。对模型进行形式化定义,明确各参与方之间的交互和操作流程;为了证明模型的安全性,以游戏方式定义安全模型,通过设计攻击策略和游戏规则,评估加密模型的不可区分性。结合不可区分概率设计加密算法。将多服务器自动加密算法与其他算法展开比较实验测试,结果表明,该算法支持多服务器和多关键字,可在保证最高计算效率的前提下完成安全性最高的数据加密和解密。