为解决移动自组网(Mobile Ad Hoc Network,MANET)网络信道开放、节点灵活多变且资源受限以及难以部署复杂认证机制的问题,结合轻量级CA思想,构造出一种适用于生存周期短、拓扑结构高度动态变化的MANET的认证体系结构即轻量级可移交认证...为解决移动自组网(Mobile Ad Hoc Network,MANET)网络信道开放、节点灵活多变且资源受限以及难以部署复杂认证机制的问题,结合轻量级CA思想,构造出一种适用于生存周期短、拓扑结构高度动态变化的MANET的认证体系结构即轻量级可移交认证中心(Lightweight and Shifted Certification Authority,LSCA)。LSCA结构简化了传统基于证书CA机制的公钥产生及验证的复杂性,无需证书管理;同时以移交CA角色的方式工作,不需预先配置节点及预知网络拓扑结构,使系统在不采用门限机制的情况下具备一定的容侵能力。性能分析及仿真实验表明:LSCA对DoS攻击表现出较强的健壮性,在通信、计算及存储代价方面均优于分布式CA及门限机制CA,适用于动态多变、生存周期较短的MANET网络应用。展开更多
随着 Internet 的普及,Web 应用系统安全问题日益严重,而安全审计是保障信息系统安全的重要措施。可视化安全审计作为一种新的安全审计手段,有助于安全管理员充分理解主体行为,但在 Web 系统中却因运行效率等原因导致应用受到限制。本...随着 Internet 的普及,Web 应用系统安全问题日益严重,而安全审计是保障信息系统安全的重要措施。可视化安全审计作为一种新的安全审计手段,有助于安全管理员充分理解主体行为,但在 Web 系统中却因运行效率等原因导致应用受到限制。本文定义了多层用户行为模型,以此模型作为 Web 安全审计的基础,并针对该行为模型提出了基于 SOM 的可视化算法。该算法将 Web 审计数据转换为形象的可视化信息,并且允许安全管理员对可视信息进行交互操作,进一步探索 Web 审计数据的内在关联,从而在保证可视化效果的同时,还可大幅提高安全审计的效率。展开更多
With the large scale adoption of Internet of Things(IoT)applications in people’s lives and industrial manufacturing processes,IoT security has become an important problem today.IoT security significantly relies on th...With the large scale adoption of Internet of Things(IoT)applications in people’s lives and industrial manufacturing processes,IoT security has become an important problem today.IoT security significantly relies on the security of the underlying hardware chip,which often contains critical information,such as encryption key.To understand existing IoT chip security,this study analyzes the security of an IoT security chip that has obtained an Arm Platform Security Architecture(PSA)Level 2 certification.Our analysis shows that the chip leaks part of the encryption key and presents a considerable security risk.Specifically,we use commodity equipment to collect electromagnetic traces of the chip.Using a statistical T-test,we find that the target chip has physical leakage during the AES encryption process.We further use correlation analysis to locate the detailed encryption interval in the collected electromagnetic trace for the Advanced Encryption Standard(AES)encryption operation.On the basis of the intermediate value correlation analysis,we recover half of the 16-byte AES encryption key.We repeat the process for three different tests;in all the tests,we obtain the same result,and we recover around 8 bytes of the 16-byte AES encryption key.Therefore,experimental results indicate that despite the Arm PSA Level 2 certification,the target security chip still suffers from physical leakage.Upper layer application developers should impose strong security mechanisms in addition to those of the chip itself to ensure IoT application security.展开更多
文摘为解决移动自组网(Mobile Ad Hoc Network,MANET)网络信道开放、节点灵活多变且资源受限以及难以部署复杂认证机制的问题,结合轻量级CA思想,构造出一种适用于生存周期短、拓扑结构高度动态变化的MANET的认证体系结构即轻量级可移交认证中心(Lightweight and Shifted Certification Authority,LSCA)。LSCA结构简化了传统基于证书CA机制的公钥产生及验证的复杂性,无需证书管理;同时以移交CA角色的方式工作,不需预先配置节点及预知网络拓扑结构,使系统在不采用门限机制的情况下具备一定的容侵能力。性能分析及仿真实验表明:LSCA对DoS攻击表现出较强的健壮性,在通信、计算及存储代价方面均优于分布式CA及门限机制CA,适用于动态多变、生存周期较短的MANET网络应用。
文摘随着 Internet 的普及,Web 应用系统安全问题日益严重,而安全审计是保障信息系统安全的重要措施。可视化安全审计作为一种新的安全审计手段,有助于安全管理员充分理解主体行为,但在 Web 系统中却因运行效率等原因导致应用受到限制。本文定义了多层用户行为模型,以此模型作为 Web 安全审计的基础,并针对该行为模型提出了基于 SOM 的可视化算法。该算法将 Web 审计数据转换为形象的可视化信息,并且允许安全管理员对可视信息进行交互操作,进一步探索 Web 审计数据的内在关联,从而在保证可视化效果的同时,还可大幅提高安全审计的效率。
基金This work was partially supported by the National Natural Science Foundation of China(Nos.61872243 and U1713212)Guangdong Basic and Applied Basic Research Foundation(No.2020A1515011489)+1 种基金the Natural Science Foundation of Guangdong Province-Outstanding Youth Program(No.2019B151502018)Shenzhen Science and Technology Innovation Commission(No.R2020A045).
文摘With the large scale adoption of Internet of Things(IoT)applications in people’s lives and industrial manufacturing processes,IoT security has become an important problem today.IoT security significantly relies on the security of the underlying hardware chip,which often contains critical information,such as encryption key.To understand existing IoT chip security,this study analyzes the security of an IoT security chip that has obtained an Arm Platform Security Architecture(PSA)Level 2 certification.Our analysis shows that the chip leaks part of the encryption key and presents a considerable security risk.Specifically,we use commodity equipment to collect electromagnetic traces of the chip.Using a statistical T-test,we find that the target chip has physical leakage during the AES encryption process.We further use correlation analysis to locate the detailed encryption interval in the collected electromagnetic trace for the Advanced Encryption Standard(AES)encryption operation.On the basis of the intermediate value correlation analysis,we recover half of the 16-byte AES encryption key.We repeat the process for three different tests;in all the tests,we obtain the same result,and we recover around 8 bytes of the 16-byte AES encryption key.Therefore,experimental results indicate that despite the Arm PSA Level 2 certification,the target security chip still suffers from physical leakage.Upper layer application developers should impose strong security mechanisms in addition to those of the chip itself to ensure IoT application security.
