基于X.509证书测量的隐私泄露分析

SSL协议由于易于部署以及集成在Web浏览器中的天然属性,被广泛应用于保障网页浏览、电子邮件、文件传输等应用服务的信息传输安全,其中最典型的应用是HTTPS.然而,实践中往往由于HTTPS服务的部署存在问题,比如服务器采用自签名X.509证书等,给用户带来严重的安全威胁,包括信息遭窃取、用户身份和行为隐私泄露等.本文从标识服务器身份的X.509证书出发,通过对真实环境HTTPS服务端证书的大范围测量和分析来揭示采用自签名证书的HTTPS服务存在的应用服务类型泄露问题,以及由此引起的用户网络行为隐私泄露威胁.针对大规模真实环境中用户网络行为的测量分析和海量日志挖掘结果表明,X.509自签名证书提供了较强区分服务器加密应用类型的身份信息,加密HTTPS应用服务器的身份隐藏手段在很大程度上可以通过统计行为分析来识破,提供相同或相似的特定应用服务的服务器的被正确分类的准确率最高可达95%.

双HTTPS反向代理模型研究

针对目前HTTP后端流量存在被窃听和被篡改的风险,提出了一种双HTTPS反向代理模型,其后端流量使用HTTPS加密方法。该方法表明双HTTPS反向代理模型可有效提高后端数据的安全性,同时与HTTPS+HTTP模型相比,其性能损失也较小。

Automatically Mining Application Signatures for Lightweight Deep Packet Inspection

Automatic signature generation approaches have been widely applied in recent traffic classification.However,they are not suitable for LightWeight Deep Packet Inspection(LW_DPI) since their generated signatures are matched through a search of the entire application data.On the basis of LW_DPI schemes,we present two Hierarchical Clustering(HC) algorithms:HC_TCP and HC_UDP,which can generate byte signatures from TCP and UDP packet payloads respectively.In particular,HC_TCP and HC_ UDP can extract the positions of byte signatures in packet payloads.Further,in order to deal with the case in which byte signatures cannot be derived,we develop an algorithm for generating bit signatures.Compared with the LASER algorithm and Suffix Tree(ST)-based algorithm,the proposed algorithms are better in terms of both classification accuracy and speed.Moreover,the experimental results indicate that,as long as the application-protocol header exists,it is possible to automatically derive reliable and accurate signatures combined with their positions in packet payloads.

Network Traffic Signature Generation Mechanism Using Principal Component Analysis

The Deep Packet Inspection(DPI)method is a popular method that can accurately identify the flow data and its corresponding application.Currently,the DPI method is widely used in common network management systems.However,the major limitation of DPI systems is that their signature library is mainly extracted manually,which makes it hard to efficiently obtain the signature of new applications.Hence,in this paper,we propose an automatic signature extraction mechanism using Principal Component Analysis(PCA)technology,which is able to extract the signature automatically.In the proposed method,the signatures are expressed in the form of serial consistent sequences constructed by principal components instead of normally separated substrings in the original data extracted from the traditional methods.Extensive experiments based on numerous sets of data have been carried out to evaluate the performance of the proposed scheme,and the results prove that the newly proposed method can achieve good performance in terms of accuracy and efficiency.

Self-certified multi-proxy signature schemes with message recovery

Multi-proxy signature schemes allow the original signer to delegate his/her signing power to n proxy signers such that all proxy signers must corporately generate a valid proxy signature on behalf of the original signer. We first propose a multi-proxy signature scheme based on discrete logarithms and then adapt it to the elliptic curve cryptosystem. With the integration of self-certified public-key systems and the message recovery signature schemes,our proposed schemes have the following advan-tages:(1) They do not require the signing message to be transmitted,since the verifier can recover it from the signature;(2) The authentication of the public keys,verification of the signature,and recovery of the message can be simultaneously carried out in a single logical step;(3) No certificate is needed for validating the public keys. Further,the elliptic curve variant with short key lengths especially suits the cryptographic applications with limited computing power and storage space,e.g.,smart cards. As compared with the previous work that was implemented with the certificate-based public-key systems,the proposed schemes give better performance in terms of communication bandwidth and computation efforts.

Thermal Spin Squeezing as a Signature of Thermal Global Entanglement in Heisenberg Models

We study thermal spin squeezing (TSS) and thermal global entanglement (TGE) in a general Heisenberg spin chain, in the presence of Dzyaloshinskii-Moriya interaction and an external magnetic field. We derive an inequality associating the squeezing parameter and the global concurrence, which establishes (TSS) as a signature of (TGE). The inequality reduces to equality for particular symmetric chains which also associates TSS with bipartite entanglement in such systems. We also check the results by presenting two numerical examples.