Wireless body area networks(WBANs)are an emerging technology for the real-time monitoring of physiological signals.WBANs provide a mechanism for collecting,storing,and transmitting physiological data to healthcare pro...Wireless body area networks(WBANs)are an emerging technology for the real-time monitoring of physiological signals.WBANs provide a mechanism for collecting,storing,and transmitting physiological data to healthcare providers.However,the open wireless channel and limited resources of sensors bring security challenges.To ensure physiological data security,this paper provides an efficient Certificateless Public Key Infrastructure Heterogeneous Ring Signcryption(CP-HRSC)scheme,in which sensors are in a certificateless cryptosystem(CLC)environment,and the server is in a public key infrastructure(PKI)environment.CLC could solve the limitations of key escrow in identity-based cryptography(IBC)and certificate management for public keys in PKI.While PKI is suited for the server because it is widely used on the Internet.Furthermore,this paper designs a ring signcryption method that allows the controller to anonymously encrypt physiological data on behalf of a set of sensors,but the server does not exactly know who the sensor is.The construction of this paper can achieve anonymity,confidentiality,authentication,non-repudiation,and integrity in a logically single step.Under the computational Diffie-Hellman(CDH)problem,the formal security proof is provided in the random oracle model(ROM).This paper demonstrates that this scheme has indistinguishability against adaptive chosen ciphertext attacks(IND-CCA2)and existential unforgeability against adaptive chosen message attacks(EUF-CMA).In terms of computational cost and energy usage,a comprehensive performance analysis demonstrates that the proposed scheme is the most effective.Compared to the three existing schemes,the computational cost of this paper’s scheme is reduced by about 49.5%,4.1%,and 8.4%,and the energy usage of our scheme is reduced by about 49.4%,3.7%,and 14.2%,respectively.展开更多
Security has recently become a major concern in distributed geo-infrastructures for spatial data provision.Thus,a lightweight approach for securing distributed low-power environments such as geo-sensor networks is nee...Security has recently become a major concern in distributed geo-infrastructures for spatial data provision.Thus,a lightweight approach for securing distributed low-power environments such as geo-sensor networks is needed.The first part of this article presents a survey of current security mechanisms for authentication and authorisation.Based on this survey,a lightweight and scalable token-based security infrastructure was developed,which is tailored for use in distributed geo-web service infrastructures.The developed security framework comprises dedicated components for authentication,rule-based authorisation and optimised storage and administration of access rules.For validation purposes,a prototypical implementation of the approach has been created.展开更多
针对虚拟化IaaS(Infrastructure as a Service)环境下的安全隔离及访问控制问题进行了研究,通过系统地研究IaaS环境下的安全隔离与访问控制需求,以安全域划分原则为指导,从网络基础设施、域边界管控、安全支撑性基础设施方面综合考虑,...针对虚拟化IaaS(Infrastructure as a Service)环境下的安全隔离及访问控制问题进行了研究,通过系统地研究IaaS环境下的安全隔离与访问控制需求,以安全域划分原则为指导,从网络基础设施、域边界管控、安全支撑性基础设施方面综合考虑,系统地构建了IaaS平台网络安全域模型;并重点针对IaaS平台特有的共享多租户环境,抽象了租户域要素并构建了租户域模型.进一步地,在所构建的安全域模型的基础上,结合云计算环境下资源动态性、云资源具有时效性等因素,从用户业务会话访问控制的角度出发,基于RBAC(Role-Based Access Control)模型及UCON(Usage CONtrol)模型构建了包括用户、角色、权限、资源、授权规则等元素的云资源访问控制模型CloudAC,从而保障虚拟化IaaS环境下用户对云资源访问的安全性.实践表明,依据提出的安全域模型构建的云计算IaaS环境,可以有效地保障不同业务功能网络的安全隔离;利用基于租户域或租户子域构建的隔离网络环境,可以在较小的管理与资源开销下为租户提供灵活的域划分能力,让租户可以依据业务安全需求自主构建隔离与边界可控的网络环境,消除了传统方式下进行网络分段时对物理网络或物理防火墙的配置需求;并使业务环境具有纵深防御能力.同时,依据所构建的云资源访问控制模型,可以灵活构建具有权限分离、用户属性与云资源属性约束、云资源租赁时间约束、虚拟机资源隔离性增强特性的云资源访问控制系统,且相关属性与约束元素可结合业务需求按需扩充,从而能够更好地满足云环境下具有多租户共享、动态特性的云资源访问控制需求.展开更多
ARP-based Distributed Denial of Service (DDoS) attacks due to ARP-storms can happen in local area networks where many computer systems are infected by worms such as Code Red or by DDoS agents. In ARP attack, the DDoS ...ARP-based Distributed Denial of Service (DDoS) attacks due to ARP-storms can happen in local area networks where many computer systems are infected by worms such as Code Red or by DDoS agents. In ARP attack, the DDoS agents constantly send a barrage of ARP requests to the gateway, or to a victim computer within the same sub-network, and tie up the resource of attacked gateway or host. In this paper, we set to measure the impact of ARP-attack on resource exhaustion of computers in a local area network. Based on attack experiments, we measure the exhaustion of processing and memory resources of a victim computer and also other computers, which are located on the same network as the victim computer. Interestingly enough, it is observed that an ARP-attack not only exhausts resource of the victim computer but also significantly exhausts processing resource of other non-victim computers, which happen to be located on the same local area network as the victim computer.展开更多
基金supported by the Postgraduate Research&Practice Innovation Program of Jiangsu Province (Grant No.SJCX22_1677).
文摘Wireless body area networks(WBANs)are an emerging technology for the real-time monitoring of physiological signals.WBANs provide a mechanism for collecting,storing,and transmitting physiological data to healthcare providers.However,the open wireless channel and limited resources of sensors bring security challenges.To ensure physiological data security,this paper provides an efficient Certificateless Public Key Infrastructure Heterogeneous Ring Signcryption(CP-HRSC)scheme,in which sensors are in a certificateless cryptosystem(CLC)environment,and the server is in a public key infrastructure(PKI)environment.CLC could solve the limitations of key escrow in identity-based cryptography(IBC)and certificate management for public keys in PKI.While PKI is suited for the server because it is widely used on the Internet.Furthermore,this paper designs a ring signcryption method that allows the controller to anonymously encrypt physiological data on behalf of a set of sensors,but the server does not exactly know who the sensor is.The construction of this paper can achieve anonymity,confidentiality,authentication,non-repudiation,and integrity in a logically single step.Under the computational Diffie-Hellman(CDH)problem,the formal security proof is provided in the random oracle model(ROM).This paper demonstrates that this scheme has indistinguishability against adaptive chosen ciphertext attacks(IND-CCA2)and existential unforgeability against adaptive chosen message attacks(EUF-CMA).In terms of computational cost and energy usage,a comprehensive performance analysis demonstrates that the proposed scheme is the most effective.Compared to the three existing schemes,the computational cost of this paper’s scheme is reduced by about 49.5%,4.1%,and 8.4%,and the energy usage of our scheme is reduced by about 49.4%,3.7%,and 14.2%,respectively.
基金This work has been funded by the European Commission(FP7 project GENESIS,reference No.223996)the Austrian Federal Ministry for Science and ResearchThe au。
文摘Security has recently become a major concern in distributed geo-infrastructures for spatial data provision.Thus,a lightweight approach for securing distributed low-power environments such as geo-sensor networks is needed.The first part of this article presents a survey of current security mechanisms for authentication and authorisation.Based on this survey,a lightweight and scalable token-based security infrastructure was developed,which is tailored for use in distributed geo-web service infrastructures.The developed security framework comprises dedicated components for authentication,rule-based authorisation and optimised storage and administration of access rules.For validation purposes,a prototypical implementation of the approach has been created.
文摘针对虚拟化IaaS(Infrastructure as a Service)环境下的安全隔离及访问控制问题进行了研究,通过系统地研究IaaS环境下的安全隔离与访问控制需求,以安全域划分原则为指导,从网络基础设施、域边界管控、安全支撑性基础设施方面综合考虑,系统地构建了IaaS平台网络安全域模型;并重点针对IaaS平台特有的共享多租户环境,抽象了租户域要素并构建了租户域模型.进一步地,在所构建的安全域模型的基础上,结合云计算环境下资源动态性、云资源具有时效性等因素,从用户业务会话访问控制的角度出发,基于RBAC(Role-Based Access Control)模型及UCON(Usage CONtrol)模型构建了包括用户、角色、权限、资源、授权规则等元素的云资源访问控制模型CloudAC,从而保障虚拟化IaaS环境下用户对云资源访问的安全性.实践表明,依据提出的安全域模型构建的云计算IaaS环境,可以有效地保障不同业务功能网络的安全隔离;利用基于租户域或租户子域构建的隔离网络环境,可以在较小的管理与资源开销下为租户提供灵活的域划分能力,让租户可以依据业务安全需求自主构建隔离与边界可控的网络环境,消除了传统方式下进行网络分段时对物理网络或物理防火墙的配置需求;并使业务环境具有纵深防御能力.同时,依据所构建的云资源访问控制模型,可以灵活构建具有权限分离、用户属性与云资源属性约束、云资源租赁时间约束、虚拟机资源隔离性增强特性的云资源访问控制系统,且相关属性与约束元素可结合业务需求按需扩充,从而能够更好地满足云环境下具有多租户共享、动态特性的云资源访问控制需求.
文摘ARP-based Distributed Denial of Service (DDoS) attacks due to ARP-storms can happen in local area networks where many computer systems are infected by worms such as Code Red or by DDoS agents. In ARP attack, the DDoS agents constantly send a barrage of ARP requests to the gateway, or to a victim computer within the same sub-network, and tie up the resource of attacked gateway or host. In this paper, we set to measure the impact of ARP-attack on resource exhaustion of computers in a local area network. Based on attack experiments, we measure the exhaustion of processing and memory resources of a victim computer and also other computers, which are located on the same network as the victim computer. Interestingly enough, it is observed that an ARP-attack not only exhausts resource of the victim computer but also significantly exhausts processing resource of other non-victim computers, which happen to be located on the same local area network as the victim computer.
