BC-BLPM:A Multi-Level Security Access Control Model Based on Blockchain Technology

Traditional multi-level security(MLS)systems have the defect of centralizing authorized facilities,which is difficult to meet the security requirements of modern distributed peer-to-peer network architecture.Blockchain is widely used in the field of access control with its decentralization,traceability and non-defective modification.Combining the blockchain technology and the Bell-LaPadula model,we propose a new access control model,named BCBLPM,for MLS environment.The“multi-chain”blockchain architecture is used for dividing resources into isolated access domains,providing a fine-grained data protection mechanism.The access control policies are implemented by smart contracts deployed in each access domain,so that the side chains of different access domains storage access records from outside and maintain the integrity of the records.Finally,we implement the BC-BLPM prototype system using the Hyperledger Fabric.The experimental and analytical results show that the model can adapt well to the needs of multi-level security environment,and it has the feasibility of application in actual scenarios.

A Mandatory Access Control Framework in Virtual Machine System with Respect to Multi-level Security Ⅱ:Implementation

This paper is a continuation of our last paper [1] which describes the theory of Virt-BLP model. Based on Virt-BLP model,this paper implements a mandatory access control(MAC) framework applicable to multi-level security(MLS) in Xen. The Virt-BLP model is the theoretical basis of this MAC framework,and this MAC framework is the implementation of Virt-BLP model. Our last paper focuses on Virt-BLP model,while this paper concentrates on the design and implementation of MAC framework. For there is no MAC framework applicable to MLS in virtual machine system at present,our MAC framework fills the blank by applying Virt-BLP model to Xen,which is better than current researches to guarantee the security of communication between virtual machines(VMs) . The experimental results show that our MAC framework is effective to manage the communication between VMs.

A Mandatory Access Control Framework in Virtual Machine System with Respect to Multi-level Security I： Theory

At present,there are few security models which control the communication between virtual machines (VMs).Moreover,these models are not applicable to multi-level security (MLS).In order to implement mandatory access control (MAC) and MLS in virtual machine system,this paper designs Virt-BLP model,which is based on BLP model.For the distinction between virtual machine system and non-virtualized system,we build elements and security axioms of Virt-BLP model by modifying those of BLP.Moreover,comparing with BLP,the number of state transition rules of Virt-BLP is reduced accordingly and some rules can only be enforced by trusted subject.As a result,Virt-BLP model supports MAC and partial discretionary access control (DAC),well satisfying the requirement of MLS in virtual machine system.As space is limited,the implementation of our MAC framework will be shown in a continuation.

Literature Review of Multi-illar Multi-level Old-age Security System

Since the 1970s, according to the international pension system reform trend for old-age social security system, no single institutional arrangement can ensure the functions of endowment security system to achieve the optimal.Therefore,how to based on the present situation of development, and to accurately, thus promote the resources integration, comprehensive build multi-level old-age security system, has important policy and practice significance.

应用WEMLS的安全数据集成模型

针对现有的安全域存在许多异构安全数据需要集成的问题,引入多级安全策略(MLS)的思想,提出一种应用扩展权值MLS策略(WEMLS)的安全数据集成模型。定义可信权值的概念,建立进程授权机制和信任计算机制。应用结果表明,该模型能使可信进程更灵活地访问客体。

MLS评价法在安全评价中的应用

在化工领域常用的安全评价方法有很多,采用MLS评价法对化工厂进行安全评价,建立具体模型,并对某一化工厂单元安全现状进行了评价。

MLS评价法在安全评价中的应用

在化工领域常用的安全评价方法有很多,在本文中用MLS评价法对化工厂进行安全评价,建立具体模型,并对某一化工厂单元安全现状进行了评价。

MLS评价法在安全评价中的应用

在化工领域常用的安全评价方法有很多,在本文中用MLS评价法对化工厂进行安全评价,建立具体模型,并对某一化工厂单元安全现状进行了评价。

基于XML的数据客体与安全标记绑定方法

安全标记与数据客体的绑定,是制约多级安全真正走向网络实用化的关键问题。针对这一问题,在深入分析XML的基础上,描述了XML客体安全标记及其约束规则,提出了安全标记与数据客体的绑定方法,讨论了安全标记查询、客体内容裂解等相关操作,给出了基于XML安全标记的安全通信实施机制。该绑定方法不仅能够满足多级信息系统间安全通信的需要,而且能够实施粒度更细的访问控制,提高信息客体的利用率。

Multi-level access control model for tree-like hierarchical organizations

An access control model is proposed based on the famous Bell-LaPadula （BLP） model.In the proposed model,hierarchical relationships among departments are built,a new concept named post is proposed,and assigning security tags to subjects and objects is greatly simplified.The interoperation among different departments is implemented through assigning multiple security tags to one post, and the more departments are closed on the organization tree,the more secret objects can be exchanged by the staff of the departments.The access control matrices of the department,post and staff are defined.By using the three access control matrices,a multi granularity and flexible discretionary access control policy is implemented.The outstanding merit of the BLP model is inherited,and the new model can guarantee that all the information flow is under control.Finally,our study shows that compared to the BLP model,the proposed model is more flexible.

A QoS Mobicast-based dynamic clustering secure multicast scheme for large-scale tracking sensornets

Most of the existing security Mobicast routing protocols are not suitable for the monitoring applications with higher quality of service （QoS） requirement. A QoS dynamic clustering secure multicast scheme （QoS-DCSMS） based on Mobicast and multi-level IxTESLA protocol for large-scale tracking sensornets is presented in this paper. The multicast clusters are dynamically formed according to the real-time status of nodes, and the cluster-head node is responsible for status review and certificating management of cluster nodes to ensure the most optimized QoS and security of multicast in this scheme. Another contribution of this paper is the optimal QoS security authentication algorithm, which analyzes the relationship between the QoS and the level Mofmulti-level oTESLA. Based on the analysis and simulation results, it shows that the influence to the network survival cycle （＇NSC） and real-time communication caused by energy consumption and latency in authentication is acceptable when the optimal QoS security authentication algorithm is satisfied.

A Multi-Level Authorization Based Tenant Separation Mechanism in Cloud Computing Environment

Separation issue is one of the most important problems about cloud computing security. Tenants should be separated from each other based on cloud infrastructure and different users from one tenant should be separated from each other with the constraint of security policies. Learning from the notion of trusted cloud computing and trustworthiness in cloud, in this paper, a multi-level authorization separation model is formally described, and a series of rules are proposed to summarize the separation property of this model. The correctness of the rules is proved. Furthermore, based on this model, a tenant separation mechanism is deployed in a real world mixed-critical information system. Performance benchmarks have shown the availability and efficiency of this mechanism.

Enhanced IDS with Deep Learning for IoT-Based Smart Cities Security

Cyberattacks against highly integrated Internet of Things (IoT) servers, apps, and telecoms infrastructure are rapidly increasing when issues produced by IoT networks go unnoticed for an extended period. IoT interface attacks must be evaluated in real-time for effective safety and security measures. This study implements a smart intrusion detection system (IDS) designed for IoT threats, and interoperability with IoT connectivity standards is offered by the identity solution. An IDS is a common type of network security technology that has recently received increasing interest in the research community. The system has already piqued the curiosity of scientific and industrial communities to identify intrusions. Several IDSs based on machine learning (ML) and deep learning (DL) have been proposed. This study introduces IDS-SIoDL, a novel IDS for IoT-based smart cities that integrates long shortterm memory (LSTM) and feature engineering. This model is tested using tensor processing unit (TPU) on the enhanced BoT-IoT, Edge-IIoT, and NSL-KDD datasets. Compared with current IDSs, the obtained results provide good assessment features, such as accuracy, recall, and precision, with approximately 0.9990 recording time and calculating times of approximately 600 and 6 ms for training and classification, respectively.

基于数据包头序列的物联网恶意流量检测

现有的基于机器学习(ML)的恶意流量检测方法,通常以高维的流量特征作为输入,并采用复杂模型,在实践中产生高误报率且资源占用较高。更重要的是,加密协议的广泛使用,使得数据包有效载荷特征很难被访问。幸运的是,物联网(IoT)设备的网络行为通常是有规律和周期性的,该特征反映在通信数据包序列上,每个数据包一定程度上描述了一次网络事件。基于此,本文提出了基于数据包头序列的恶意流量检测方法。它将流量序列转换为网络事件序列,并计算一组特征(即序列性、频率性、周期性和爆发性)来描述网络行为。实验环境包含一组真实的物联网设备,并将提出的方法部署在树莓派模拟的网关上。实验结果表明,与最新的检测方法相比,本文提出的方法能够在复杂网络环境下保持高准确性和低误报率,并提升了处理速率。

An Online Fake Review Detection Approach Using Famous Machine Learning Algorithms

Online review platforms are becoming increasingly popular,encouraging dishonest merchants and service providers to deceive customers by creating fake reviews for their goods or services.Using Sybil accounts,bot farms,and real account purchases,immoral actors demonize rivals and advertise their goods.Most academic and industry efforts have been aimed at detecting fake/fraudulent product or service evaluations for years.The primary hurdle to identifying fraudulent reviews is the lack of a reliable means to distinguish fraudulent reviews from real ones.This paper adopts a semi-supervised machine learning method to detect fake reviews on any website,among other things.Online reviews are classified using a semi-supervised approach(PU-learning)since there is a shortage of labeled data,and they are dynamic.Then,classification is performed using the machine learning techniques Support Vector Machine(SVM)and Nave Bayes.The performance of the suggested system has been compared with standard works,and experimental findings are assessed using several assessment metrics.

动态多级安全级模型及其应用

针对采用传统MLS模型实现的系统可用性和灵活性较低的问题,提出了一种基于动态安全级的MLS模型Dynamic MLS。模型使用由流入信息最高安全级和流出信息最低安全级组成的动态安全级代替传统BLP模型中的当前安全级,并依此对主体访问客体的行为进行更灵活的控制。模型在BLP模型11条规则的基础上对其中的5条规则进行了改进,并通过形式化方法证明了改进模型的正确性。最后给出了模型在增加linux系统安全性方面的应用。

基于信息客体统一化描述的安全标记绑定研究

安全标记与信息客体绑定,一直是制约多级安全走向网络实用化的关键问题。针对这一问题,提出了一种基于信息客体统一化描述的安全标记绑定方法。通过分析客体类型,给出了基于数据树的多类型客体的统一表示模型,据此基于数据树遍历给出了客体与安全标记绑定算法,并讨论了客体的相关操作及其访问控制机制的实施。该方法不仅可提高安全标记绑定的灵活性,实现多类型信息客体与安全标记绑定的统一,而且可实施更为细粒度的访问控制,解决系统间异构数据交换控制难的问题。

基于多级安全和属性证书实施网络基于角色访问控制策略

RBAC(Role-Based Access Control)通过变更用户的访问权限,能够灵活地改变主体和客体的访问关系,修改安全策略。提出了基于MLS的安全策略构建RBAC的思想及解决方案,可以提高系统的开发效率,并通过属性证书在网络中给用户授权,提高信息管理系统的安全性和管理效率。

基于属性关联的客体聚合信息级别推演方法

为解决客体关联性引起的泄密问题,本文对客体关联性进行了深入分析,提出了基于属性关联的客体聚合信息级别推演方法.该方法根据客体属性依赖关系,挖掘出高关联度的客体,通过客体关联属性级别模糊集可能性测度,推演出关联客体推导出更高级别信息的可能性,以此指导多级安全网络访问控制策略的制定,控制主体对关联客体的访问,降低系统失泄密的风险.

一个多级安全通道建立协议及安全性分析

在研究等级化信息系统特点的基础之上,给出了一个等级化网络环境下安全通道建立协议LTEP,该协议通过联合机制确立了不同等级、不同敏感级的信息系统间通信关系,依据虚拟主体转换以及安全标记映射规则,实现了不同等级信息系统内通信主体的授权,克服了安全标记的异构性问题,而且协议所构建的多级安全通道能够有效地实现不同敏感级别信息传输的相互隔离。拓展了基于串空间的安全协议分析方法,从认证性、机密性、完整性等几个方面对LTEP协议进行了安全性分析。