ResearchonsecureaccessmechanismininternetofthingsbasedonTePA

以椭圆曲线密码算法和三元对等鉴别架构为基础，通过对物联网的基本概念、体系结构的分析，提出了一种基于椭圆曲线签名、三元鉴别的物联网安全接入机制。该机制强化了对物联网中无线传感器节点的鉴别，要求通信的任何一方在通信前必须通过其它两方的身份验证。从性能和安全等方面分析了该机制的可行性和可靠性，增强了物联网下对接入访问的安全控制，从而对物联网的建设发展起到了一定的建言作用。

An Efficient and Secure Multi-Secret Sharing Scheme with General Access Structures

A multiple secret sharing scheme can share a group of secrets in each sharing session, which is very useful especially in sharing large secrets. However, most of the existing multiple secret sharing schemes are （t, n） threshold schemes, so they are fit for only threshold applications and unfit for the applications of general access structures. Due to the fact that a （t, n） threshold scheme could only handle a small fraction of the secret sharing idea, a novel multi-secret sharing scheme is proposed, which is designed based on general access structures. The security of this scheme is the same as that of Shamir＇s threshold secret sharing scheme. Compared with the existing multiple secret sharing schemes, the proposed scheme can provide greater capabilities for many applications because it is able to deal with applications of general access structures.

Remote Access Communications Security: Analysis of User Authentication Roles in Organizations

Remote access is a means of accessing resources outside one’s immediate physical location. This has made employee mobility more effective and productive for most organizations. Remote access can be achieved via various channels of remote communication, the most common being Virtual Private Networks (VPNs). The demand for remote access is on the rise, especially during the Covid-19 pandemic, and will continue to increase as most organizations are re-structuring to make telecommuting a permanent part of their mode of operation. Employee mobility, while presenting organizations with some advantages, comes with the associated risk of exposing corporate cyber assets to attackers. The remote user and the remote connectivity technology present some vulnerabilities which can be exploited by any threat agent to violate the confidentiality, integrity and availability (CIA) dimensions of these cyber assets. So, how are users and remote devices authenticated? To what extent is the established connection secured? With employee mobility on the rise, it is necessary to analyze the user authentication role since the mobile employee is not under the monitoring radar of the organization, and the environment from which the mobile employee connects may be vulnerable. In this study, an experiment was setup to ascertain the user authentication roles. The experiment showed the process of 2FA in user authentication and it proved to be an effective means of improving user authentication during remote access. This was depicted via the use of what the user has (mobile phone/soft-token) as a second factor in addition to what the user knows, i.e. password. This authentication method overcomes the security weaknesses inherent in single-factor user authentication via the use of password only. However, the results also showed that though 2FA user authentication ensures security, the remote devices could exhibit further vulnerabilities and pose serious risks to the organization. Thus, a varied implementation was recommended to further enhance the security of remote access communication with regards to the remote user authentication.

A Mandatory Access Control Framework in Virtual Machine System with Respect to Multi-level Security I： Theory

At present,there are few security models which control the communication between virtual machines (VMs).Moreover,these models are not applicable to multi-level security (MLS).In order to implement mandatory access control (MAC) and MLS in virtual machine system,this paper designs Virt-BLP model,which is based on BLP model.For the distinction between virtual machine system and non-virtualized system,we build elements and security axioms of Virt-BLP model by modifying those of BLP.Moreover,comparing with BLP,the number of state transition rules of Virt-BLP is reduced accordingly and some rules can only be enforced by trusted subject.As a result,Virt-BLP model supports MAC and partial discretionary access control (DAC),well satisfying the requirement of MLS in virtual machine system.As space is limited,the implementation of our MAC framework will be shown in a continuation.

Security of Broadband Access Network

Due to the rapid development of broadband access technologies, the broadband access networks have wider and wider application. However, with the development, the security issue became a public concern. Under the environment of access network, customers, access equipment and networks all face various threats, especially those from the user side. Such technologies and solutions as port positioning, fraud prevention on Medium Access Control (MAC) addresses and monitoring of illegal services might be the solution to the security problem existing in the current networks.

Security analysis of access control model in hybrid cloud based on security entropy

To resolve the problem of quantitative analysis in hybrid cloud,a quantitative analysis method,which is based on the security entropy,is proposed.Firstly,according to the information theory,the security entropy is put forward to calculate the uncertainty of the system' s determinations on the irregular access behaviors.Secondly,based on the security entropy,security theorems of hybrid cloud are defined.Finally,typical access control models are analyzed by the method,the method's practicability is validated,and security and applicability of these models are compared.Simulation results prove that the proposed method is suitable for the security quantitative analysis of the access control model and evaluation to access control capability in hybrid cloud.

The Design of an Intelligent Security Access Control System Based on Fingerprint Sensor FPC1011C

This paper deals with the design of an intelligent access control system based on the fingerprint sensor FPC- 1011C. The design uses the S3C2410 and TMS320VC5510A as the system processor. A fingerprint acquisition module and a wireless alarm module were designed by using the fingerprint sensor FPC1011C and GPRS module SIM100 respectively. The whole system was implemented wireless alarm through messages and GPRS-Internet in the GSM/GPRS web. In order to achieve the simple and high Real-time system, the μC-Linux system migration was also implemented.

Intelligent Security Auditing Based on Access Control of Devices in Ad Hoc Network

Security in Ad Hoc network is an important issue under the opening circumstance of application service. Some protocols and models of security auditing have been proposed to ensure rationality of contracting strategy and operating regulation and used to identify abnormal operation. Model of security auditing based on access control of devices will be advanced to register sign of devices and property of event of access control and to audit those actions. In the end, the model is analyzed and simulated.

A Method of Auxiliary Planning for Intelligent Substation Access System Based on Security Region

This paper presents an auxiliary planning method for intelligent substation access system based on security region. Firstly, the method of resolving the static voltage security region is proposed. Secondly, the method of constructing the optimal index of substation accession is given, which is used to describe the priority of the node into the substation. Finally, a complete set of intelligent substation access system auxiliary planning strategy is given, which takes into account the constraints of the normal operation of the grid on the voltage amplitude.

Food Access and Experience of Food Insecurity in Nigerian Households during the COVID-19 Lockdown

The food insecurity experiences and related behaviors of Nigerian households during the COVID-19 lockdown have not been fully discussed. This study was conducted to elicit information on the impact of COVID-19 lockdown on economic and behavioral patterns related to food access. An online-based semi-structured questionnaire distributed through messaging platforms was used to collect information on characteristics, food purchasing behaviour before and during COVID-19 lockdown among respondents. Experience of food insecurity was assessed using Food Insecurity Experience Scale (FIES). A total of 883 responses were received and analyzed using SPSS Version 20.0. Most of the respondents (90.5%) were at home or had stopped going to work due to COVID-19 restrictions. Even though smaller households had higher food expenditure claims than larger households (p = 0.012), the larger the household, the more acute the challenge of economic access to food (p = 0.050). Location (p = 0.000), age (p = 0.003), occupation (p = 0.014) and income level (p = 0.000) were associated with experience of food insecurity. In conclusion, lockdown restrictions increased food expenditure and experience of food insecurity among the respondents and thus we recommend the probe of long-term consequences of deviations from usual food access on undernutrition or overnutrition in Nigerian households.

Hadoop Distributed File System Security Challenges and Examination of Unauthorized Access Issue

Hadoop technology is followed by some security issues. At its beginnings, developers paid attention to the development of basic functionalities mostly, and proposal of security components was not of prime interest. Because of that, the technology remained vulnerable to malicious activities of unauthorized users whose purpose is to endanger system functionalities or to compromise private user data. Researchers and developers are continuously trying to solve these issues by upgrading Hadoop’s security mechanisms and preventing undesirable malicious activities. In this paper, the most common HDFS security problems and a review of unauthorized access issues are presented. First, Hadoop mechanism and its main components are described as the introduction part of the leading research problem. Then, HDFS architecture is given, and all including components and functionalities are introduced. Further, all possible types of users are listed with an accent on unauthorized users, which are of great importance for the paper. One part of the research is dedicated to the consideration of Hadoop security levels, environment and user assessments. The review also includes an explanation of Log Monitoring and Audit features, and detail consideration of authorization and authentication issues. Possible consequences of unauthorized access to a system are covered, and a few recommendations for solving problems of unauthorized access are offered. Honeypot nodes, security mechanisms for collecting valuable information about malicious parties, are presented in the last part of the paper. Finally, the idea for developing a new type of Intrusion Detector, which will be based on using an artificial neural network, is presented. The detector will be an integral part of a new kind of virtual honeypot mechanism and represents the initial base for future scientific work of authors.

Research on Physical Layer Security in Cognitive Wireless Networks with Multiple Eavesdroppers Based on Resource Allocation Algorithm

With the rapid development of the Internet of Things (IoT), non-Orthogonal Multiple Access (NOMA) technology and cognitive wireless network are two promising technologies to improve the spectral efficiency of the system, which have been widely concerned in the field of wireless communication. However, due to the importance of ownership and privacy protection, the IoT system must provide corresponding security mechanisms. From the perspective of improving the transmission security of CR-NOMA system based on cognitive wireless network, and considering the shortcomings of traditional relay cooperative NOMA system, this paper mainly analyzes the eavesdropping channel model of multi-user CR-NOMA system and derives the expressions of system security and rate to improve the security performance of CR-NOMA system. The basic idea of DC planning algorithm and the scheme of sub-carrier power allocation to improve the transmission security of the system were introduced. An algorithm for DC-CR-NOMA was proposed to maximize the SSR of the system and minimize the energy loss. The simulation results show that under the same complexity, the security and speed of the system can be greatly improved compared with the traditional scheme.

面向云存储的属性基双边访问控制方案

针对目前云存储中细粒度双边访问控制机制安全模型较弱且外包解密结果缺乏验证的问题,提出了一种面向云存储数据的属性基双边访问控制方案。首先,提出了自适应安全可验证外包双边CP-ABE的形式化定义和安全模型;其次,以此为基础并结合批量可验证技术在合数阶群上设计了双边访问控制方案,支持数据拥有者与数据使用者同时为对方定义访问策略;最后,安全性分析表明,所提方案在自适应安全模型下针对选择明文攻击与选择消息攻击是不可区分的和存在性不可伪造的。实验结果显示,所提方案减轻了用户端的匹配、解密以及验证阶段的计算开销。

Ensuring Security, Confidentiality and Fine-Grained Data Access Control of Cloud Data Storage Implementation Environment

With the development of cloud computing, the mutual understandability among distributed data access control has become an important issue in the security field of cloud computing. To ensure security, confidentiality and fine-grained data access control of Cloud Data Storage (CDS) environment, we proposed Multi-Agent System (MAS) architecture. This architecture consists of two agents: Cloud Service Provider Agent (CSPA) and Cloud Data Confidentiality Agent (CDConA). CSPA provides a graphical interface to the cloud user that facilitates the access to the services offered by the system. CDConA provides each cloud user by definition and enforcement expressive and flexible access structure as a logic formula over cloud data file attributes. This new access control is named as Formula-Based Cloud Data Access Control (FCDAC). Our proposed FCDAC based on MAS architecture consists of four layers: interface layer, existing access control layer, proposed FCDAC layer and CDS layer as well as four types of entities of Cloud Service Provider (CSP), cloud users, knowledge base and confidentiality policy roles. FCDAC, it’s an access policy determined by our MAS architecture, not by the CSPs. A prototype of our proposed FCDAC scheme is implemented using the Java Agent Development Framework Security (JADE-S). Our results in the practical scenario defined formally in this paper, show the Round Trip Time (RTT) for an agent to travel in our system and measured by the times required for an agent to travel around different number of cloud users before and after implementing FCDAC.

生育支持政策的权利之维——发达国家的实践及启示

关于发达国家的生育支持政策,从生育权利保障角度进行考察可知,这一政策体系具有“国家—个体”关系维度、以“国家—社会—个体”关系为基础的共同体维度的二维构造。前者以保障国民生存福祉为原则,以生育保障获得权和性别平等权为核心构造;后者以作为生育保障获得权补强机制的多元主体共同负担原则、婴幼儿的保育权为主要内容。生育支持政策鼓励生育的功能性目标,需通过上述权利的保障得以实现。从权利保障视域研究发达国家的生育支持政策,可以在基本理念、体系结构以及保障措施等方面为中国生育支持政策的建构提供借鉴与参考。

云计算环境下的拟态IAM系统设计实现方法

随着云计算的快速发展及其普及,企业的传统数据安全边界被打破,出现云资产管理混乱、越权、误操作等现象,对用户的信息安全产生巨大威胁。基于此,对目前云计算环境下身份认证和访问管理(identity and access management,IAM)的安全问题进行研究,提出结合内生安全思想,采取拟态防御手段构建出一种具有内生安全效应的拟态身份认证和访问管理(mimicry identity and access management,MIAM)体系架构方案,并对其进行详细描述。将该方案分别进行稳定性测试、系统性能测试以及系统安全性评估,实验数据表明,该方案具有可行性和安全性。

气象部门终端入网控制系统的设计与实现

气象信息网络的快速发展,促进气象内部网络的设备种类和数量不断增加,对传统的入网管理方式提出新的挑战。现阶段,气象内网办公区网络接入设备数量超过7000台,在网设备的种类和数量难以梳理,违规占用网络资源的现象时有发生。由于接入设备的合法性难以确定,在违规接入设备后无法第一时间发现和阻断,对业务系统和气象数据安全带来威胁。在网设备可能存在恶意程序运行,接入气象网络后可能对其它设备的安全产生重大影响。传统控制技术需要维护本地的数据信息,存在数据准确性滞后和泄露风险。该文以解决以上问题为出发点,设计和实现适应气象网络需求的无客户端模式终端入网控制系统,通过与统一信任服务系统和终端安全管理系统数据共享,实现身份认证信息的自动更新和维护,同时促进终端安全管理软件在气象园区的广泛应用,及时发现和阻断违规设备的接入,消除潜在的安全隐患。

MEC-NOMA系统的物理层安全性能评估

面向移动边缘计算(mobile edge computing,MEC)场景,建立了一个存在主动攻击者的非正交多址协议(nonorthogonal multile access,NOMA)网络传输模型,并设计一种卷积神经网络(convolutional neural network,CNN)模型来评估该传输模型的安全中断概率(security outage probability,SOP)。研究结果表明:所提出的MEC-NOMA系统不仅提高了SOP,而且能够对抗主动窃听者的攻击;此外,通过CNN模型评估的SOP与其他方法(蒙特卡洛方法和数学解析表达式)非常接近,且执行时间更短。

全双工主动窃听非正交多址接入系统智能超表面辅助物理层安全传输技术

针对全双工被动窃听和主动干扰攻击下的多用户非正交多址接入(NOMA)系统,该文提出一种智能超表面(RIS)辅助的鲁棒波束赋形方案以实现物理层安全通信。考虑在仅已知窃听者统计信道状态信息的条件下,以系统传输中断概率和保密中断概率作为约束,通过联合优化基站发射波束赋形、RIS相移矩阵、传输速率和冗余速率,来最大化系统的保密速率。为解决上述多变量耦合非凸优化问题,提出一种有效的交替优化算法得到联合优化问题的次优解。仿真结果表明,所提方案可实现较高的保密速率,且通过增加RIS反射单元数,系统保密性能更佳。