Code dissemination is one of the important services of wireless sensor networks (WSNs). Securing the process of code dissemination is essential in some certain WSNs applications, state-of-the-art secure code dissemina...Code dissemination is one of the important services of wireless sensor networks (WSNs). Securing the process of code dissemination is essential in some certain WSNs applications, state-of-the-art secure code dissemination protocols for WSNs aim for the efficient source authentication and integrity verification of code image, however, due to the resource constrains of WSNs and the epidemic behavior of the code dissemination system, existing secure code dissemination protocols are vulnerable to Denial of Service (DoS) attacks when sensor nodes can be compromised (insider DoS attacks). In this paper, we identify five different basic types of DoS attacks exploiting the epidemic propagation strategies used by Deluge. They are (1) Higher-version Advertisement attack, (2) False Request attack, (3) Larger-numbered Page attack, (4) Lower-version Adv attack, and (5) Same-version Adv attack. Simulation shows these susceptibilities caused by above insider DoS attacks. Some simple models are also proposed which promote understanding the problem of insider DoS attacks and attempt to quantify the severity of these attacks in the course of code dissemination in WSNs.展开更多
By allowing routers to combine the received packets before forwarding them,network coding-based applications are susceptible to possible malicious pollution attacks.Existing solutions for counteracting this issue eith...By allowing routers to combine the received packets before forwarding them,network coding-based applications are susceptible to possible malicious pollution attacks.Existing solutions for counteracting this issue either incur inter-generation pollution attacks(among multiple generations)or suffer high computation/bandwidth overhead.Using a dynamic public key technique,we propose a novel homomorphic signature scheme for network coding for each generation authentication without updating the initial secret key used.As per this idea,the secret key is scrambled for each generation by using the generation identifier,and each packet can be fast signed using the scrambled secret key for the generation to which the packet belongs.The scheme not only can resist intra-generation pollution attacks effectively but also can efficiently prevent inter-generation pollution attacks.Further,the communication overhead of the scheme is small and independent of the size of the transmitting files.展开更多
With the explosive growth of network applications, the threat of the malicious code against network security becomes increasingly serious. In this paper we explore the mechanism of the malicious code by giving an atta...With the explosive growth of network applications, the threat of the malicious code against network security becomes increasingly serious. In this paper we explore the mechanism of the malicious code by giving an attack model of the malicious code, and discuss the critical techniques of implementation and prevention against the malicious code. The remaining problems and emerging trends in this area are also addressed in the paper.展开更多
By researching into the attack to present block cipher, we find an essential reason leading to the assailable encryption strength, set up a new block cipher idea and put forward a block cipher encryption concept path ...By researching into the attack to present block cipher, we find an essential reason leading to the assailable encryption strength, set up a new block cipher idea and put forward a block cipher encryption concept path encryption. We present permutation code encryption which is based on path encryption. Now permutation code encryption is a patent of Chinese invention. In Permutation Code Encryption, we use a pseudo-random sequence of the keys to control the paths. The simulation result shows that for n-bit block the encryption strength is novel higher than 2^n and the algorithm can finish the encryption of one block in 7.5 ns, which is unrelated with the block length.展开更多
针对影子栈难以兼顾安全性和性能,软件实现的前向CFI(control-flow integrity)技术性能开销过大、难以进行实际部署,提出基于软硬件结合的CFI(control-flow integrity based on the combination of software and hardware,SHCFI)技术。...针对影子栈难以兼顾安全性和性能,软件实现的前向CFI(control-flow integrity)技术性能开销过大、难以进行实际部署,提出基于软硬件结合的CFI(control-flow integrity based on the combination of software and hardware,SHCFI)技术。通过二进制重写器对程序反编译,生成中间语言,并判断转移指令类型。对于后向控制流的保护,提出基于返回地址加密的平行影子栈方案,使用随机数对栈上的返回地址进行异或加密,将加密结果备份到原始栈固定偏移处的影子栈中,在函数返回时对影子栈中的地址异或解密,将解密结果作为实际的返回地址。对于前向控制流的保护,使用硬件ENDBRANCH状态机指令标记间接转移指令的目标地址,在运行时对目标地址进行合法性检查,以降低性能开销。实验结果表明,SHCFI加固后的程序能够有效地防御代码重用攻击,且具有良好的运行开销。展开更多
文摘Code dissemination is one of the important services of wireless sensor networks (WSNs). Securing the process of code dissemination is essential in some certain WSNs applications, state-of-the-art secure code dissemination protocols for WSNs aim for the efficient source authentication and integrity verification of code image, however, due to the resource constrains of WSNs and the epidemic behavior of the code dissemination system, existing secure code dissemination protocols are vulnerable to Denial of Service (DoS) attacks when sensor nodes can be compromised (insider DoS attacks). In this paper, we identify five different basic types of DoS attacks exploiting the epidemic propagation strategies used by Deluge. They are (1) Higher-version Advertisement attack, (2) False Request attack, (3) Larger-numbered Page attack, (4) Lower-version Adv attack, and (5) Same-version Adv attack. Simulation shows these susceptibilities caused by above insider DoS attacks. Some simple models are also proposed which promote understanding the problem of insider DoS attacks and attempt to quantify the severity of these attacks in the course of code dissemination in WSNs.
基金supported by the National Natural Science Foundation of China under Grant No. 61271174
文摘By allowing routers to combine the received packets before forwarding them,network coding-based applications are susceptible to possible malicious pollution attacks.Existing solutions for counteracting this issue either incur inter-generation pollution attacks(among multiple generations)or suffer high computation/bandwidth overhead.Using a dynamic public key technique,we propose a novel homomorphic signature scheme for network coding for each generation authentication without updating the initial secret key used.As per this idea,the secret key is scrambled for each generation by using the generation identifier,and each packet can be fast signed using the scrambled secret key for the generation to which the packet belongs.The scheme not only can resist intra-generation pollution attacks effectively but also can efficiently prevent inter-generation pollution attacks.Further,the communication overhead of the scheme is small and independent of the size of the transmitting files.
文摘With the explosive growth of network applications, the threat of the malicious code against network security becomes increasingly serious. In this paper we explore the mechanism of the malicious code by giving an attack model of the malicious code, and discuss the critical techniques of implementation and prevention against the malicious code. The remaining problems and emerging trends in this area are also addressed in the paper.
文摘By researching into the attack to present block cipher, we find an essential reason leading to the assailable encryption strength, set up a new block cipher idea and put forward a block cipher encryption concept path encryption. We present permutation code encryption which is based on path encryption. Now permutation code encryption is a patent of Chinese invention. In Permutation Code Encryption, we use a pseudo-random sequence of the keys to control the paths. The simulation result shows that for n-bit block the encryption strength is novel higher than 2^n and the algorithm can finish the encryption of one block in 7.5 ns, which is unrelated with the block length.
文摘针对影子栈难以兼顾安全性和性能,软件实现的前向CFI(control-flow integrity)技术性能开销过大、难以进行实际部署,提出基于软硬件结合的CFI(control-flow integrity based on the combination of software and hardware,SHCFI)技术。通过二进制重写器对程序反编译,生成中间语言,并判断转移指令类型。对于后向控制流的保护,提出基于返回地址加密的平行影子栈方案,使用随机数对栈上的返回地址进行异或加密,将加密结果备份到原始栈固定偏移处的影子栈中,在函数返回时对影子栈中的地址异或解密,将解密结果作为实际的返回地址。对于前向控制流的保护,使用硬件ENDBRANCH状态机指令标记间接转移指令的目标地址,在运行时对目标地址进行合法性检查,以降低性能开销。实验结果表明,SHCFI加固后的程序能够有效地防御代码重用攻击,且具有良好的运行开销。
