Blockchain-Based Certificateless Cross-Domain Authentication Scheme in the Industrial Internet of Things

The Industrial Internet of Things(IIoT)consists of massive devices in different management domains,and the lack of trust among cross-domain entities leads to risks of data security and privacy leakage during information exchange.To address the above challenges,a viable solution that combines Certificateless Public Key Cryptography(CL-PKC)with blockchain technology can be utilized.However,as many existing schemes rely on a single Key Generation Center(KGC),they are prone to problems such as single points of failure and high computational overhead.In this case,this paper proposes a novel blockchain-based certificateless cross-domain authentication scheme,that integrates the threshold secret sharing mechanism without a trusted center,meanwhile,adopts blockchain technology to enable cross-domain entities to authenticate with each other and to negotiate session keys securely.This scheme also supports the dynamic joining and removing of multiple KGCs,ensuring secure and efficient cross-domain authentication and key negotiation.Comparative analysiswith other protocols demonstrates that the proposed cross-domain authentication protocol can achieve high security with relatively lowcomputational overhead.Moreover,this paper evaluates the scheme based on Hyperledger Fabric blockchain environment and simulates the performance of the certificateless scheme under different threshold parameters,and the simulation results show that the scheme has high performance.

A Blockchain-Based Efficient Cross-Domain Authentication Scheme for Internet of Vehicles

The Internet of Vehicles(IoV)is extensively deployed in outdoor and open environments to effectively address traffic efficiency and safety issues by connecting vehicles to the network.However,due to the open and variable nature of its network topology,vehicles frequently engage in cross-domain interactions.During such processes,directly uploading sensitive information to roadside units for interaction may expose it to malicious tampering or interception by attackers,thus compromising the security of the cross-domain authentication process.Additionally,IoV imposes high real-time requirements,and existing cross-domain authentication schemes for IoV often encounter efficiency issues.To mitigate these challenges,we propose CAIoV,a blockchain-based efficient cross-domain authentication scheme for IoV.This scheme comprehensively integrates technologies such as zero-knowledge proofs,smart contracts,and Merkle hash tree structures.It divides the cross-domain process into anonymous cross-domain authentication and safe cross-domain authentication phases to ensure efficiency while maintaining a balance between efficiency and security.Finally,we evaluate the performance of CAIoV.Experimental results demonstrate that our proposed scheme reduces computational overhead by approximately 20%,communication overhead by around 10%,and storage overhead by nearly 30%.

A Post-Quantum Cross-Domain Authentication Scheme Based on Multi-Chain Architecture

Due to the rapid advancements in network technology,blockchain is being employed for distributed data storage.In the Internet of Things(IoT)scenario,different participants manage multiple blockchains located in different trust domains,which has resulted in the extensive development of cross-domain authentication techniques.However,the emergence of many attackers equipped with quantum computers has the potential to launch quantum computing attacks against cross-domain authentication schemes based on traditional cryptography,posing a significant security threat.In response to the aforementioned challenges,our paper demonstrates a post-quantum cross-domain identity authentication scheme to negotiate the session key used in the cross-chain asset exchange process.Firstly,our paper designs the hiding and recovery process of user identity index based on lattice cryptography and introduces the identity-based signature from lattice to construct a post-quantum cross-domain authentication scheme.Secondly,our paper utilizes the hashed time-locked contract to achieves the cross-chain asset exchange of blockchain nodes in different trust domains.Furthermore,the security analysis reduces the security of the identity index and signature to Learning With Errors(LWE)and Short Integer Solution(SIS)assumption,respectively,indicating that our scheme has post-quantum security.Last but not least,through comparison analysis,we display that our scheme is efficient compared with the cross-domain authentication scheme based on traditional cryptography.

Cross-Domain Authentication Scheme Based on Blockchain and Consistent Hash Algorithm for System-Wide Information Management

System-wide information management(SWIM)is a complex distributed information transfer and sharing system for the next generation of Air Transportation System(ATS).In response to the growing volume of civil aviation air operations,users accessing different authentication domains in the SWIM system have problems with the validity,security,and privacy of SWIM-shared data.In order to solve these problems,this paper proposes a SWIM crossdomain authentication scheme based on a consistent hashing algorithm on consortium blockchain and designs a blockchain certificate format for SWIM cross-domain authentication.The scheme uses a consistent hash algorithm with virtual nodes in combination with a cluster of authentication centers in the SWIM consortium blockchain architecture to synchronize the user’s authentication mapping relationships between authentication domains.The virtual authentication nodes are mapped separately using different services provided by SWIM to guarantee the partitioning of the consistent hash ring on the consortium blockchain.According to the dynamic change of user’s authentication requests,the nodes of virtual service authentication can be added and deleted to realize the dynamic load balancing of cross-domain authentication of different services.Security analysis shows that this protocol can resist network attacks such as man-in-the-middle attacks,replay attacks,and Sybil attacks.Experiments show that this scheme can reduce the redundant authentication operations of identity information and solve the problems of traditional cross-domain authentication with single-point collapse,difficulty in expansion,and uneven load.At the same time,it has better security of information storage and can realize the cross-domain authentication requirements of SWIM users with low communication costs and system overhead.KEYWORDS System-wide information management(SWIM);consortium blockchain;consistent hash;cross-domain authentication;load balancing.

BLECA: A Blockchain-Based Lightweight and Efficient Cross-Domain Authentication Scheme for Smart Parks

Smart parks serve as integral components of smart cities,where they play a pivotal role in the process of urban modernization.The demand for cross-domain cooperation among smart devices from various parks has witnessed a significant increase.To ensure secure communication,device identities must undergo authentication.The existing cross-domain authentication schemes face issues such as complex authentication paths and high certificate management costs for devices,making it impractical for resource-constrained devices.This paper proposes a blockchain-based lightweight and efficient cross-domain authentication protocol for smart parks,which simplifies the authentication interaction and requires every device to maintain only one certificate.To enhance cross-domain cooperation flexibility,a comprehensive certificate revocation mechanism is presented,significantly reducing certificate management costs while ensuring efficient and secure identity authentication.When a park needs to revoke access permissions of several cooperative partners,the revocation of numerous cross-domain certificates can be accomplished with a single blockchain write operation.The security analysis and experimental results demonstrate the security and effectiveness of our scheme.

A Privacy Enabled Fast Dynamic Authentication and Authorization for B3G/4G Mobility

Mobile technologies make their headway by offering more flexibility to end-users and improve the productivities. Within the application of ubiquitous access and pervasive communication, security (or privacy) and QoS (Quality of Service) are two critical factors during global mobility, so how to get a smooth and fast handover based on a user privacy protected infrastructure is our focus. Based on a user-centric vir-tual identity defined by EU IST project Daidalos, this paper firstly proposes an effective infrastructure which protects the context-driven access policies for online services in order to avoid attacks by malicious eaves-droppers. In the proposed infrastructure, SMAL and Diameter are used to securely protect and deliver au-thenticated and authorized entities and XACML is used to authorize the user-level privacy policy. On the basis of it, a dynamic fast authentication and authorization handover mechanism is proposed which can save one trip communication time consummation between administrative domains.

Embedding Authentication &Authorization in Discovery Protocols for Standard Based Publish/Subscribe Middleware: A Performance Evaluation

Standard based Pub/Sub middleware, such as OMG Data Distribution Service (DDS), could assume a key role in supporting computer communications requiring continuous state information updating, deterministic deadline to data delivering and real time information adjourning. This kind of capability could be well ex-ploited by Peer-To-Peer (P2P) systems, Internet-wide as long as private ones, like in Public Safety or Civil Protection Communication Systems;but Pub/Sub specifications, and DDS/RTPS (Real Time Publish Sub-scribe) as well, usually do not provide Authentication & Authorization (AA) mechanisms. In the present work two important novelties are assessed: a possible scheme to implement AA in DDS/RTPS networks and a time performance evaluation study about embedded Authentication in RTPS.

TWO-STEP MOBILE AGENT BASED AUTHENTICATION ARCHITECTURE:TOWARDS EFFECTIVE GRID AUTHENTICATION

The grid technology is recognized as the next generation of Internet and becomcs the center of recent researches in the computer society. Security is one of the most crucial issues to address in Internet and is of the same importance in the application of grid technology. As a critical component of grid security, the secure authen- tication needs to be well studied. In this paper, a two-step mobile agent based（TSMAB） authentication architecture is proposed based on Globus security infrastructure （GSI）. By using mobile agent （MA） technology, the TSMAB authentication architecture is composed of the junior-authentication and the senior-authentication. Based on the design and the analysis of TSMAB model, the result shows that the efficiency of grid authentication is improved compared with the GSI authentication.

Design of Distributed Authentication Mechanism for Equipment Support Information Network

Considering the secure authentication problem for equipment support information network,a clustering method based on the business information flow is proposed. Based on the proposed method,a cluster-based distributed authentication mechanism and an optimal design method for distributed certificate authority( CA)are designed. Compared with some conventional clustering methods for network,the proposed clustering method considers the business information flow of the network and the task of the network nodes,which can decrease the communication spending between the clusters and improve the network efficiency effectively. The identity authentication protocols between the nodes in the same cluster and in different clusters are designed. From the perspective of the security of network and the availability of distributed authentication service,the definition of the secure service success rate of distributed CA is given and it is taken as the aim of the optimal design for distributed CA. The efficiency of providing the distributed certificate service successfully by the distributed CA is taken as the constraint condition of the optimal design for distributed CA. The determination method for the optimal value of the threshold is investigated. The proposed method can provide references for the optimal design for distributed CA.

Cross-heterogeneous Domain Authentication Scheme Based on Blockchain

With the rising popularity of the Internet and the development of big data technology,an increasing number of organizations are opting to cooperate across domains to maximize their benefits.Most organizations use public key infrastructure to ensure security in accessing their data and applications.However,with the continuous development of identity-based encryption(IBE)technology,small-and medium-sized enterprises are increasingly using IBE to deploy internal authentication systems.To solve the problems that arise when crossing heterogeneous authentication domains and to guarantee the security of the certification process,we propose using blockchain technology to establish a reliable cross-domain authentication scheme.Using the distributed and tamper-resistant characteristics of the blockchain,we design a cross-domain authentication model based on blockchain to guarantee the security of the heterogeneous authentication process and present a cross-domain authentication protocol based on blockchain.This model does not change the internal trust structure of each authentication domain and is highly scalable.Furthermore,on the premise of ensuring security,the process of verifying the signature of the root certificate in the traditional cross-domain authentication protocol is improved to verify the hash value of the root certificate,thereby improving the authentication efficiency.The developed prototype exhibits generality and simplicity compared to previous methods.

基于区块链的多源网络大数据安全访问权限认证仿真

多源网络大数据的频繁交互与存储打破了传统数据“孤岛”,实现了跨区域与跨组织的数据访问,为数据的安全和隐私保护带来巨大挑战。访问认证作为保护数据与资源安全的技术之一,在获取所有数据节点信任的同时,面临巨大的通信负载,会造成数据丢失和破坏,为此,提出一种基于区块链研究多源网络大数据安全访问权限认证方法。以相似关系度量数据在网络传输中的变化状态,根据相似矩阵计算多源网络数据访问概率。通过区块链技术建立数据安全访问合约,标定数据的访问属性以及交易密文,并将数据压缩在对应属性内。根据访问目的分析其访问信度,以信度作为标准对应安全等级,在不同信度下定制访问规则,认证数据安全访问的具体权限,实现方法设计。实验结果表明,以不同数据属性含量作为测试条件,在常规模式和攻击模式下对数据进行加密和解密处理,新方法可以实现较快的认证响应,实现网络数据的安全访问。

基于JWT的EAST实验数据用户身份和服务权限认证

用户身份和服务权限认证已成为身份验证和数据访问安全的重要手段。用户身份认证采用动态令牌技术JWT实现。针对JWT丢失和被截获的问题,提出加密存储、解密使用的策略和IP与JWT绑定机制。根据EAST实验数据和用户的现状,将用户资源划分为二级用户,将服务资源划分为三级资源,采用图数据库Neo4j存储用户和资源之间的权限关系,并提出位图法加速权限认证。实验结果表明,基于JWT的认证方法及其安全策略能够有效解决身份和权限认证的问题。相较于传统的关系数据库存储用户权限,图数据库Neo4j和位图法能有效地提高权限认证效率。

基于对称加密算法的企业电子邮件权限安全管理

进行企业电子邮件权限安全管理时,主要采用非对称加密算法,导致企业电子邮件权限的安全管理效果较差,权限安全管理的时间开销较大。为此,设计一种融合对称加密算法的企业电子邮件权限安全管理方法。根据电子邮件实际内容定义标签和标识,明确电子邮件的安全级别。基于邮件发送人在企业内充当的角色,设计一种对称加密算法对电子邮件内容进行加密。运用PMI+PKI技术,结合身份认证特性和权限分配特性,建立邮件权限控制机制。从发送者和接收者两方面入手,认证电子邮件安全访问权限,实现企业电子邮件安全管理。实验结果显示,所提方法的邮件权限安全管理效果较好,整体时间开销为0.38 s,相比基于区块链、基于差分隐私的方法,时间开销分别减少了68.07%、39.11%。

基于SM9的JWT强身份认证方案

随着网络信息技术的快速发展,身份认证的应用范围也在不断扩大。其中,JWT(JSON Web Token)作为基于Token的身份认证技术,被广泛应用于Web应用程序和API领域,以实现简单、可靠的身份验证和安全通信。然而,开发人员对于JWT标准和技术细节理解不够深入,导致该技术在实践中经常出现各种安全漏洞。文中分析了近年来出现的有关JWT技术的安全问题,包括“none”算法绕过、敏感信息泄露、算法混淆攻击和密钥穷举攻击等,并针对这些问题提出了一种基于国密SM9的JWT强身份认证方案。该方案使用SM9公钥密码算法对JWT进行签名和验证,结合基于时间戳和随机数的验证机制,以提高算法的安全性和可靠性。最后对该方案进行安全性分析,结果表明该方案实现方法相对简单,能够有效地防御各种常见的JWT安全漏洞,同时具有良好的安全性和易用性,为JWT技术的安全应用提供了一种高效可靠的解决方法。

A Trust Evaluation Mechanism Based on Autoencoder Clustering Algorithm for Edge Device Access of IoT

First,we propose a cross-domain authentication architecture based on trust evaluation mechanism,including registration,certificate issuance,and cross-domain authentication processes.A direct trust evaluation mechanism based on the time decay factor is proposed,taking into account the influence of historical interaction records.We weight the time attenuation factor to each historical interaction record for updating and got the new historical record data.We refer to the beta distribution to enhance the flexibility and adaptability of the direct trust assessment model to better capture time trends in the historical record.Then we propose an autoencoder-based trust clustering algorithm.We perform feature extraction based on autoencoders.Kullback leibler(KL)divergence is used to calculate the reconstruction error.When constructing a convolutional autoencoder,we introduce convolutional neural networks to improve training efficiency and introduce sparse constraints into the hidden layer of the autoencoder.The sparse penalty term in the loss function measures the difference through the KL divergence.Trust clustering is performed based on the density based spatial clustering of applications with noise(DBSCAN)clustering algorithm.During the clustering process,edge nodes have a variety of trustworthy attribute characteristics.We assign different attribute weights according to the relative importance of each attribute in the clustering process,and a larger weight means that the attribute occupies a greater weight in the calculation of distance.Finally,we introduced adaptive weights to calculate comprehensive trust evaluation.Simulation experiments prove that our trust evaluation mechanism has excellent reliability and accuracy.

GIS用户中台的设计与实现

为了解决每一个与地理信息相关的应用系统,均需建立一套用户管理、部门管理、地图服务管理、权限认证机制的问题,本文借鉴“大中台、小前台”的理念,基于微服务架构设计,开发了一个可自由伸缩的地理信息系统(GIS)用户中台。该中台采用服务生产者、消费者的模式构建,基于SpringBoot2.0框架整合Dubbo,实现地理信息应用系统的统一权限管理和应用授权。用户中台具有用户信息统一管理系统、角色权限统一管理系统、统一认证系统、统一授权系统、日志管理系统和监控分析系统等功能。

Cross-domain identity authentication scheme based on blockchain and PKI system

In vehicular ad hoc networks(VANET),the cross-domain identity authentication of users is very important for the development of VANET due to the large cross-domain mobility of vehicle users.The Public Key Infrastructure(PKI)system is often used to solve the identity authentication and security trust problems faced by VANET.However,the PKI system has challenges such as too centralized Authority of Certification Authority(CA),frequent cross-domain access to certificate interactions and high authentication volume,leading to high certificate management costs,complex cross-domain authentication paths,easy privacy leakage,and overburdened networks.To address these problems,this paper proposes a lightweight blockchain-based PKI identity management and authentication architecture that uses smart contracts to reduce the heavy burden caused by CAs directly managing the life cycle of digital certificates.On this basis,a trust chain based on smart contracts is designed to replace the traditional CA trust chain to meet the general cross-domain requirements,to effectively avoid the communication pressure caused by a mass of certificate transmissions.For the cross-domain scenario with higher privacy and security requirements the identity attribute authentication service is provided directly while protecting privacy by using the Merkle tree to anchor identity attribute data on and off the blockchain chain.Finally,the proposed scheme was comprehensively analyzed in terms of cost,time consumption and security.

基于SSM的求职招聘系统设计

针对企业招聘和毕业生求职的需要,设计一款在线求职管理系统。该系统基于SSM技术进行开发,设计用户信息模块、招聘信息模块、简历信息模块、院校信息模块、招聘公告模块和岗位信息模块等功能。用人单位可以使用系统发布招聘公告信息,求职者可以使用系统进行招聘信息的筛选并投递简历,管理员可以进行系统信息的维护。系统能够打通用人单位和求职者时间和空间之间的壁垒,让招聘和求职需求在平台中进行无缝对接,节约用人单位和求职者的时间成本和人力成本。同时,系统加入安全管理进行用户身份的验证和权限的管控,防止越权操作;数据库访问使用MyBatis作为对象关系映射(ORM)工具,采用参数化查询及最小化数据库操作权限防止SQL注入,确保系统的安全性。

Fortifying the Digital Bastion: Pioneering Cybersecurity with Dynamic Secrets Management and CMDB Fusion in the Enterprise

In the relentless quest for digital sovereignty, organizations face an unprecedented challenge in safeguarding sensitive information, protecting against cyber threats, and maintaining regulatory compliance. This manuscript unveils a revolutionary blueprint for cyber resilience, empowering organizations to transcend the limitations of traditional cybersecurity paradigms and forge ahead into uncharted territories of data security excellence and frictionless secrets management experience. Enter a new era of cybersecurity innovation and continued excellence. By seamlessly integrating secrets based on logical environments and applications (assets), dynamic secrets management orchestrates and automates the secrets lifecycle management with other platform cohesive integrations. Enterprises can enhance security, streamline operations, fasten development practices, avoid secrets sprawl, and improve overall compliance and DevSecOps practice. This enables the enterprises to enhance security, streamline operations, fasten development & deployment practices, avoid secrets spawls, and improve overall volume in shipping software with paved-road DevSecOps Practices, and improve developers’ productivity. By seamlessly integrating secrets based on logical environments and applications (assets), dynamic secrets management orchestrates and automates the application secrets lifecycle with other platform cohesive integrations. Organizations can enhance security, streamline operations, fasten development & deployment practices, avoid secrets sprawl, and improve overall volume in shipping software with paved-road DevSecOps practices. Most importantly, increases developer productivity.

区块链技术与电力大数据安全的深度融合

电网业态的变化,尤其是智能电网的快速布局,电力数据流实现倍增,服务对象的不确定性、服务形式的多样化,使数据安全形势愈发严峻。区块链技术在数据溯源、数据加密、去中心化方面存在天然优势,可以为电力大数据安全提供系统级的底层数据交互支撑。电力大数据的应用价值和潜在风险是并存的,本文基于区块链技术,从数字身份管理、数据交易平台构建、过程安全管控几个方面与电力大数据实现深度融合,旨在实现整体安全水平的快速提升。