Content sensitivity based access control framework for Hadoop

Big data technologies have seen tremendous growth in recent years. They are widely used in both industry and academia. In spite of such exponential growth, these technologies lack adequate measures to protect data from misnse/abuse. Corporations that collect data from multiple sources are at risk of liabilities due to the exposure of sensitive information. In the current implementation of Hadoop, only file-level access control is feasible. Providing users with the ability to access data based on the attlibutes in a dataset or the user＇s role is complicated because of the sheer volume and multiple formats （structured, unstructured and semi-structured） of data. In this paper, we propose an access control framework, which enforces access control policies dynamically based on the sensitivity of the data. This framework enforces access control policies by harnessing the data context, usage patterns and informat/on sensitivity. Information sensitivity changes over time with the addition and removal of datasets, which can lead to modifications in access control decisions. The proposed framework accommodates these changes. The proposed framework is automated to a large extent as the data itself determines the sensitivity with minimal user intervention. Our experimental results show that the proposed framework is capable of enforcing access control policies on non-multimedia datasets with minimal overhead.

Implementing Discretionary Access Control with Time Character in Linux and Performance Analysis

DAC （Discretionary Access Control Policy） is access control based on ownership relations between subject and object, the subject can discretionarily decide on that who, by what methods, can access his owns object. In this paper, the system time is looked as a basic secure element. The DAC_T （Discretionary Access Control Policy with Time Character） is presented and formalized. The DAC_T resolves that the subject can discretionarily decide that who, on when, can access his owns objects. And then the DAC_T is implemented on Linux based on GFAC （General Framework for Access Control）, and the algorithm is put forward. Finally, the performance analysis for the DAC T Linux is carried out. It is proved that the DAC T Linux not only can realize time constraints between subject and object but also can still be accepted by us though its performance have been decreased.

基于OpenFlow的SDN终端接入控制研究

为了解决基于Open Flow的SDN终端安全接入问题,通过对现有SDN中针对终端安全接入解决方案的深入研究,文章提出一种基于Open Flow的SDN终端接入控制系统。该系统将传统终端接入控制技术与基于Open Flow的SDN新型网络相结合,主要实现了SDN环境下的用户身份认证、终端安全状态评估、用户服务授权和Qo S控制等功能,并且对系统的安全性进行了详细分析。文章在Mininet中结合二次开发的RYU控制器进行网络仿真,完成了接入控制功能和通信时延性能的实验。实验结果表明,基于Open Flow的SDN终端接入控制系统具有灵活的接入控制安全策略,能够检测SDN中不安全终端接入带来的威胁,不仅实现了用户的身份认证,而且能够保证接入终端的安全,实现不同安全状态终端的访问授权。性能测试结果表明,基于Open Flow的SDN终端接入控制系统在身份认证时延、平台评估时延和通信时延等方面都能满足实际需要。

Dynamic Event-Triggered Scheduling and Platooning Control Co-Design for Automated Vehicles Over Vehicular Ad-Hoc Networks

This paper deals with the co-design problem of event-triggered communication scheduling and platooning control over vehicular ad-hoc networks(VANETs)subject to finite communication resource.First,a unified model is presented to describe the coordinated platoon behavior of leader-follower vehicles in the simultaneous presence of unknown external disturbances and an unknown leader control input.Under such a platoon model,the central aim is to achieve robust platoon formation tracking with desired inter-vehicle spacing and same velocities and accelerations guided by the leader,while attaining improved communication efficiency.Toward this aim,a novel bandwidth-aware dynamic event-triggered scheduling mechanism is developed.One salient feature of the scheduling mechanism is that the threshold parameter in the triggering law is dynamically adjusted over time based on both vehicular state variations and bandwidth status.Then,a sufficient condition for platoon control system stability and performance analysis as well as a co-design criterion of the admissible event-triggered platooning control law and the desired scheduling mechanism are derived.Finally,simulation results are provided to substantiate the effectiveness and merits of the proposed co-design approach for guaranteeing a trade-off between robust platooning control performance and communication efficiency.

Effect:An Operational View Mechanism for Decentralized Information Flow Control

Flume, which implements decentralized information flow control （DIFC）, allows a high security level process to ＂pre-create＂ secret files in a low security level directory. However, the pre-create mechanism makes some normal system calls unavailable, and moreover, it needs priori knowledge to create a large quantity of objects, which is difficult to estimate in practical operating systems. In this paper, we present an extended Flume file access control mechanism, named Effect, to substitute the mechanism of pre-create, which permits write operations （create, delete, and rename a file） on directories and creates a file access virtual layer that allocates operational views for each process with noninterference properties. In the end, we further present an analysis on the security of Effect. Our work makes it easier for multi-user to share confidential information in decentralized information flow control systems.

Key issues of multiple access technique for LEO satellite communication systems

The large carrier frequency shift caused by the high-speed movement of satellite (Doppler effects) and the propagation delay on the up-down link are very critical issues in an LEO satellite communication system, which affects both the selection and the implementation of a suitable access method. A Doppler based multiple access technique is used here to control the flow and an MPRMA-HS protocol is proposed for the application in LEO satellite communication systems. The extended simulation trials prove that the proposed scheme seems to be a very promising access method.

电力信息物理系统中信息系统物理化的建模及分析方法

该文基于信息系统物理化的设想提出电力信息物理系统(cyber-physical power system,CPPS)中的信息流建模和计算分析方法。采用连续时间函数来刻画信息流的特征,并定义信息网络运行参数为流量累积函数、信息流速和时延。首先,基于遍历法搜索出信息流路径,建立信息流速矩阵的范式;然后利用改进的网络演算(network calculus,NC)特性赋值流速矩阵的元素;进一步采用流量累积函数表征信源数据发送规律,从而显式求解时延上界。最后将提出的信息流建模方法应用于智能变电站自动化系统的时延计算,通过与OPNET的仿真结果相比较,验证所提出模型的有效性,而且该方法可以提供定量分析指标以优化变电站组网方案设计中的信息流分布。

隐式信息流重组粒度与污点传播能力判别

污点分析中的隐式信息流由于其通过控制流传播污点的特性导致许多基于数据流的污点分析技术无效或分析效率低.本文提出了一种简洁有效的基于重组粒度的隐式信息流污点传播能力判别方法.通过预定义重组链构建规则,并基于程序切片和控制依赖关系给出了隐式信息重组链构建算法,在重组链各端点的信息重组粒度计算的基础上,获得隐式信息流的重组粒度及重组比值,能判别其污点传播能力.此外,实验开发了一个包含15个隐式信息流代码段的隐式信息流测试集IIF-Bench,并用来验证了判别方法的有效性和良好独立性,使其易于作为扩展添加至其它静态污点分析方法中从而实现隐式信息流分析的能力.

基于6LoWPAN的智慧校园公共安全异常监控系统设计

在智慧校园网络中,监控系统无法准确捕获异常人员信息,是造成公共安全事件的主要原因;为提高智慧校园公共安全性,设计基于6LoWPAN的智慧校园公共安全异常监控系统;建立6LoWPAN网络,并在其中规范协议栈堆叠形式,完成基于6LoWPAN的智慧校园监控协议栈开发;利用6LoWPAN协议栈,划分功能性模块,以此为基础,建立人员信息采集模块、环境监测模块、门禁控制模块之间的连接关系,实现异常监控系统的应用部件设计;采用监控系统上位机节点,设置各级部件结构的模块运行条件,并联合相关应用部件,实现基于6LoWPAN的智慧校园公共安全异常监控系统设计;实验结果表明,在同一帧图像中,设计系统可以全部提取异常人员信息,且不会出现错误提取的情况,监控准确率高达100%,能够有效提高智慧校园公共安全性和异常监控准确性。

数据通信领域国内外标准研究

为了更好推动数据通信产业高质量发展,提升数据通信领域标准化水平,介绍了数据通信技术体系的范畴及数据通信标准架构,梳理了ISO/IEC JTC1/SC6、ITU-T SG17、IEEE、IETF互联网工程任务组等国际数据通信领域标准化组织工作范围及其重点标准,分析了全国信标委数据通信分技术委员会、全国通信标准化技术委员会等我国数据通信标准化组织及标准化工作,通过分析技术、产业发展情况和专家资源参与情况以及技术组织情况,给出了未来数据通信领域标准化工作重点。

RFID技术在服装单件流生产流水线的应用研究

在全球化和信息化快速发展的背景下,服装制造业正面临效率提升和智能化管理的双重挑战。RFID技术以其在实时数据采集、自动化管理等方面的显著优势,逐渐成为服装单件流生产流水线的关键应用技术。本文探讨RFID技术在服装单件流生产中的应用,分析其在提升生产效率、质量控制和信息化管理方面的具体作用,并提出解决实际应用中遇到技术挑战的策略,为行业提供科学依据和实践指导。

含网关节点的高时隙复用率TDMA协议

针对网络收敛慢、拓扑表不完整时导致的信道冲突以及空闲时隙浪费问题,提出一种提高节点时隙利用率和网络可靠性的多跳时分多址接入协议。该协议提出3种新机制,使用时隙请求时期快速收敛机制,加快时隙请求时期的收敛;使用空闲时隙公平重用机制,消除中心节点调度时隙碰撞问题,提高空闲时隙利用率;使用一跳邻居多层次调度机制,降低数据重传的时延。仿真结果表明,在时隙请求时期收敛时间、数据传输平均时延及数据传输成功率方面,该协议较现有协议性能更优。

一种基于风险代码抽取的控制流保护方法

代码复用攻击是控制流安全面临的主要威胁之一.虽然地址分布随机化能够缓解该攻击,但它们很容易被代码探测技术绕过.相比之下,控制流完整性方法具有更好的保护效果.但是,现有的方法要么依赖于源码分析,要么采用无差别跟踪的方式追踪所有的控制流转移.前者无法摆脱对源码的依赖性,后者则会引入巨大的运行时开销.针对上述问题,本文提出一种新的控制流保护方法MCE(Micro Code Extraction).MCE的保护目标是源码不可用的闭源对象.与现有的方法相比,MCE并不会盲目地追踪所有的控制流转移活动.它实时地检测代码探测活动,并仅将被探测的代码作为保护目标.之后,MCE抽取具有潜在风险的代码片段,以进一步缩小目标对象的大小.最后,所有跳转到风险代码中的控制流都会被追踪和检测,以保护它的合法性.实验和分析表明,MCE对代码探测和代码复用攻击具有良好的保护效果,并在一般场景下仅对CPU引入2%的开销.

无人机集群空中博弈对抗体系指挥控制模型

针对无人机集群空中博弈对抗体系的指挥控制问题,系统阐述了无人机集群协同空战典型场景的作战过程模型,分析设计了空中无人机集群博弈对抗体系的作战任务剖面,构建了空中无人机集群协同作战体系信息流程模型。研究结论能够为空中无人作战体系构建、无人集群协同空战指挥控制架构以及协同作战规划设计方法等研究提供理论支撑。

铁路运行环境下ERT可信根实体的软件化技术研究

为保障铁路系统的信息安全,文章提出一种铁路运行环境下可信根实体(Entity of Root of Trust,ERT)的软件化技术,在内核中实现强制访问控制功能,通过操作系统内核的修改或扩展,实现更为细粒度和强大的权限管理。同时考虑到轻量级场景下部分设备存在计算能力弱、存储空间有限和电源供应不稳定等问题,提出一种轻量级可信计算体系,最大程度满足可信计算要求。通过实施内核级的强制访问控制和轻量级的可信计算体系改造,缓解未知风险对关键信息基础设施的威胁,为铁路系统的安全性提供保障。

高比例光伏接入的分布式储能容量自适应协调控制方法

光伏发电具有一定的波动性和不确定性,天气、季节等因素会导致光伏功率的变化,需要储能系统实时跟踪、预测和调整以保持供需平衡,但波动性和不确定性增加了控制的复杂性。为此,提出一种新的分布式储能容量自适应协调控制方法。计算接入高比例光伏电能后储能无功损耗,设置功率约束条件,确保功率的稳定性。基于此,以电压条件最优、接入负荷和净功率最低、高比例光伏接入处的功率可调节范围最优为调控目标,实现高比例光伏接入的分布式储能容量自适应协调控制。实验数据证明,所提方法在控制效果方面具有显著优势,能够实现高效的分布式储能控制,并确保光伏的高效出力。

通信网络中的信息安全与隐私保护技术

随着计算机和网络技术在各个行业的普遍应用,保密安全和隐私维护问题越来越突出。本文论述网络保护领域的核心难题与潜在威胁,进而评估众多防御手段的实际功效。网络信息安全的威胁主要表现在隐藏性和扩张性,这使得安全漏洞和攻击具有难以预测和快速蔓延的特点。为应对这些挑战,文章提出的解决方案涵盖构筑防火墙、数据加密、网络访问控制等一系列安全措施。实施这些策略有利于有效提升网络的安全性和加密效果,确保数据完整性及通讯的安全性。

Review of the development of power system out-of-step splitting control and some thoughts on the impact of large-scale access of renewable energy

Out-of-step oscillation is a very destructive physical phenomenon in power system, which could directly cause big blackout accompanied by serious sociology-economic impacts. Out-of-step splitting control is an indispensable means, which could protect the system from major shocks of out-of-step oscillation. After years of development, it has achieved certain amount of research results. Have the existing methods been able to meet the requirements of out-of-step splitting? What improvements are needed? Under this background, this review is written. It combs the development of out-of-step splitting control technologies and analyzes the technical routes and characteristics of different methods. It points out the contradiction between rapidity and optimality is the biggest technical problem, existing in both the traditional local measurement based out-of-step splitting protection and the wide-area information based out-of-step splitting protection. It further points out that the advantages of the two types of protections can be combined with the unique physical characteristics of the out-of-step center to form a more advantageous splitting strategy. Besides, facing the fact of large-scale renewable energy access to power grid in recent years, this review also analyzes the challenges brought by it and provides some corresponding suggestions. It is hoped to provide some guidance for the subsequent research work.

基于局域网的人工智能安全信息访问控制系统设计

近年来,受到网络环境复杂化、多元化变革的影响,局域网系统的运行安全性与稳定性遭受了严重威胁。为解决局域网安全隐患问题,文章以人工智能技术中的克隆选择模糊聚类算法为切入点,设计了一种适配于大部分局域网应用场景的信息安全访问控制系统。最终测试结果表明,在局域网环境中应用该系统能够有效检测出各类风险隐患,其中系统对内部用户的违规行为的捕捉精准度更是能够达到90%以上,并且对各类信息的检测与处理效率较高,最高每秒可以处理2 500条消息,具备持续研究与应用、推广的价值。

电子化背景下医院档案信息安全及保密问题探讨

随着医疗信息电子化进程的加快,如何保障医院档案信息系统的安全性和信息保密性成为一个亟需解决的重要课题。医疗信息系统面临来自内部人员、外部黑客、自然灾害等多方面的安全威胁,一旦发生信息泄露、篡改或丢失,将给医疗质量和患者隐私权益带来严重损害。文章全面分析医疗信息安全所面临的主要威胁,阐述相关法律、法规对医疗信息保密的明确要求,并从技术和管理两个层面提出加强医疗信息系统安全防护的对策措施。只有从多方位、全方位入手,才能全面提高医疗信息系统的安全性和保密性,促进医疗事业的健康发展。