Protecting Terminals by Security Domain Mechanism Based on Trusted Computing

Networks are composed with servers and rather larger amounts of terminals and most menace of attack and virus come from terminals. Eliminating malicious code and ac cess or breaking the conditions only under witch attack or virus can be invoked in those terminals would be the most effec tive way to protect information systems. The concept of trusted computing was first introduced into terminal virus immunity. Then a model of security domain mechanism based on trusted computing to protect computers from proposed from abstracting the general information systems. The principle of attack resistant and venture limitation of the model was demonstrated by means of mathematical analysis, and the realization of the model was proposed.

基于Spring Security框架的前后端分离软件平台构建的研究

随着日新月异的互联网技术的发展,软件技术衍生出新的开发模式,将逻辑层和视图层进行分离,从而减少前端和后端代码的耦合性,使用安全框架对系统进行认证和授权,防止数据,接口泄露等问题。结合甘肃省外籍高层人才平台建设为例,介绍该开发模式,为以后开发提供思路,样例。

Orthogonal experiment design of EMI of security monitoring system in coal mines

Security monitoring system of coal mines is indispensable to ensure the safe and efficient production of colliery. Due to the special and narrow underground field of the coal mine, the electromagnetic interference can cause a series of misstatements and false positives on the monitoring system, which will severely hamper the safe production of coal industry. In this paper, first, the frequency characteristics of the interference source on the power line are extracted when equipment runs normally. Then the finite difference time domain method is introduced to analyze the effects of the electromagnetic interference parameters on the security monitoring signal line. And the interference voltage of the two terminal sides on the single line is taken as evaluating indexes. Finally, the electromagnetic interference parameters are optimized by orthogonal experimental design based on the MATLAB simulation on the normal operation of equipment.

Practical Security Approaches against Border Gateway Protocol (BGP) Session Hijacking Attacks between Autonomous Systems

The border gateway protocol (BGP) is the default inter domain routing protocol used on the internet for exchanging information between autonomous systems. Available literature suggests that BGP is vulnerable to session hijacking attacks. There are a number of proposals aimed at improving BGP security which have not been fully implemented. This paper examines a number of approaches for securing BGP through a comparative study and identifies the reasons why these proposals have not been implemented commercially. This paper analyses the architecture of internet routing and the design of BGP while focusing on the problem of BGP session hijacking attacks. Using Graphical Network Simulator 3 (GNS-3), a session hijack is demonstrated and a solution which involves the implementation of route filtering, policy-maps and route-maps on CISCO routers representing ASes is carried out. In the end, a workable industry standard framework for securing and protecting BGP sessions and border routers from exploitation with little or no modification to the existing routing infrastructure is demonstrated.

BOUNDARY INTEGRAL FORMULAS FOR ELASTIC PLANE PROBLEM OF EXTERIOR CIRCULAR DOMAIN

After the stress function and the normal derivative on the boundary for the plane problem of exterior circular domain are expanded into Laurent series, comparing them with the Laurent series of the complex stress function and making use of some formulas in Fourier series and the convolutions, the boundary integral formula of the stress function is derived further. Then the stress function can be obtained directly by the integration of the stress function and its normal derivative on the boundary. Some examples are given. It shows that the boundary integral formula of the stress function is convenient to be used for solving the elastic plane problem of exterior circular domain.

Self-Certificating Root:A Root Zone Security Enhancement Mechanism for DNS

As a critical Internet infrastructure,domain name system(DNS)protects the authenticity and integrity of domain resource records with the introduction of security extensions(DNSSEC).DNSSEC builds a single-center and hierarchical resource authentication architecture,which brings management convenience but places the DNS at risk from a single point of failure.When the root key suffers a leak or misconfiguration,top level domain(TLD)authority cannot independently protect the authenticity of TLD data in the root zone.In this paper,we propose self-certificating root,a lightweight security enhancement mechanism of root zone compatible with DNS/DNSSEC protocol.By adding the TLD public key and signature of the glue records to the root zone,this mechanism enables the TLD authority to certify the self-submitted data in the root zone and protects the TLD authority from the risk of root key failure.This mechanism is implemented on an open-source software,namely,Berkeley Internet Name Domain(BIND),and evaluated in terms of performance,compatibility,and effectiveness.Evaluation results show that the proposed mechanism enables the resolver that only supports DNS/DNSSEC to authenticate the root zone TLD data effectively with minimal performance difference.

CALCULATION FOR PATH-DOMAIN INDEPENDENT J INTEGRAL WITH ELASTO-VISCOPLASTIC CONSISTENT TANGENT OPERATOR CONCEPT-BASED BOUNDARY ELEMENT METHODS

This paper presents an elasto-viscoplastic consistent tangent operator (CTO) based boundary element formulation, and application for calculation of path-domain independentJ integrals (extension of the classicalJ integrals) in nonlinear crack analysis. When viscoplastic deformation happens, the effective stresses around the crack tip in the nonlinear region is allowed to exceed the loading surface, and the pure plastic theory is not suitable for this situation. The concept of consistency employed in the solution of increment viscoplastic problem, plays a crucial role in preserving the quadratic rate asymptotic convergence of iteractive schemes based on Newton's method. Therefore, this paper investigates the viscoplastic crack problem, and presents an implicit viscoplastic algorithm using the CTO concept in a boundary element framework for path-domain independentJ integrals. Applications are presented with two numerical examples for viscoplastic crack problems andJ integrals.

ANALYTIC BOUNDARY VALUE PROBLEMS ON CLASSICAL DOMAINS

In this paper analytic boundary value problems for some classical domains in Cn are developed by using the harmonic analysis due to L.K. Hua. First it is discussed for the version of one variable in order to induce the relation between the analytic boundary value problem and the decomposition of function space L2 on the boundary manifold. Then an easy example of several variables, the version of torus in C2, is stated. For the noncommutative classical group L1, the characteristic boundary of a kind of bounded symmetric domain in C4, the boundary behaviors of the Cauchy integral are obtained by using both the harmonic expansion and polar coordinate transformation. At last we obtain the conditions of solvability of Schwarz problem on L1, if so, the solution is given explicitly.

Numerical Discrete-Domain Integral Formulations for Generalized Burger-Fisher Equation

In this study we use a boundary integral element-based numerical technique to solve the generalized Burger-Fisher equation. The essential feature of this method is the fundamental integral representation of the solution inside the problem domain by means of both the boundary and domain values. The occurrences of domain integrals within the problem arising from nonlinearity as well as the temporal derivative are not avoided or transferred to the boundary. However, unlike the classical boundary element approach, they are resolved within a finite-element-type discrete domain. The utility and correctness of this formulation are proved by comparing the results obtained herein with closed form solutions.

Stability conditions of explicit integration algorithms when using 3D viscoelastic artificial boundaries

Viscoelastic artificial boundaries are widely adopted in numerical simulations of wave propagation problems.When explicit time-domain integration algorithms are used,the stability condition of the boundary domain is stricter than that of the internal region due to the influence of the damping and stiffness of an viscoelastic artificial boundary.The lack of a clear and practical stability criterion for this problem,however,affects the reasonable selection of an integral time step when using viscoelastic artificial boundaries.In this study,we investigate the stability conditions of explicit integration algorithms when using three-dimensional(3D)viscoelastic artificial boundaries through an analysis method based on a local subsystem.Several boundary subsystems that can represent localized characteristics of a complete numerical model are established,and their analytical stability conditions are derived from and further compared to one another.The stability of the complete model is controlled by the corner regions,and thus,the global stability criterion for the numerical model with viscoelastic artificial boundaries is obtained.Next,by analyzing the impact of different factors on stability conditions,we recommend a stability coefficient for practically estimating the maximum stable integral time step in the dynamic analysis when using 3D viscoelastic artificial boundaries.

Integrating IPsec within OpenFlow Architecture for Secure Group Communication

Network security protocols such as IPsec have been used for many years to ensure robust end-to-end communication and are important in the context of SDN. Despite the widespread installation of IPsec to date, per-packet protection offered by the protocol is not very compatible with OpenFlow and tlow-like behavior. OpenFlow architecture cannot aggregate IPsee-ESP flows in transport mode or tunnel mode because layer-3 information is encrypted and therefore unreadable. In this paper, we propose using the Security Parameter Index （SPI） of IPsec within the OpenFlow architecture to identify and direct IPsec flows. This enables IPsec to conform to the packet-based behavior of OpenFlow architecture. In addition, by distinguishing between IPsec flows, the architecture is particularly suited to secure group communication.

A Novel Direct Anonymous Attestation Protocol Based on Zero Knowledge Proof for Different Trusted Domains

In order to solve the issue that existing direct anonymous attestation (DAA) scheme can not operate effectively in different domains,based on the original DAA scheme,a novel direct anonymous attestation protocol used in multi domains environment is proposed and designed,in which,the certificate issuer located in outside of domain can be considered as a proxy server to issue the DAA certificate for valid member nodes directly.Our designed mechanism accords with present trusted computing group (TCG) international specification,and can solve the problems of practical authentication and privacy information protection between different trusted domains efficiently.Compared with present DAA scheme,in our protocol,the anonymity,unforgeability can be guaranteed,and the replay-attack also can be avoided.It has important referenced and practical application value in trusted computing field.

A Direct Implementation of a Modified Boundary Integral Formulation for the Extended Fisher-Kolmogorov Equation

This study is concerned with the numerical approximation of the extended Fisher-Kolmogorov equation with a modified boundary integral method. A key aspect of this formulation is that it relaxes the domain-driven approach of a typical boundary element (BEM) technique. While its discretization keeps faith with the second order accurate BEM formulation, its implementation is element-based. This leads to a local solution of all integral equation and their final assembly into a slender and banded coefficient matrix which is far easier to manipulate numerically. This outcome is much better than working with BEM’s fully populated coefficient matrices resulting from a numerical encounter with the problem domain especially for nonlinear, transient, and heterogeneous problems. Faithful results of high accuracy are achieved when the results obtained herein are compared with those available in literature.

NETWORK MANAGEMENT WITH SECURED MOBILE AGENT

Network management scheme must consider security challenges for the Mobile Agent paradigm to be accepted in the Internet computing world. Techniques to provide security solutions have been proposed and some have achieved good results. For example, it is possible to launch a code with a guarantee that it cannot attack the hosting sites. The main problem remaining, however, is protecting the mobile code against malicious service providers, the host problem. This paper proposed a Mobile Agent management scheme in a hierarchical level that provides to user a reliable and flexible global access to internet/network information services. We further described a protection mechanism to Mobile Agents against malicious hosts. As an effort to address host problems we first identify the kinds of attack that may be performed by malicious hosts, and propose a mechanism to prevent these attacks. At each agent host we introduce a trusted third party entity on each server called Secure Service Station (SSS) to carry out security actions.

Speech Encryption in Linear Canonical Transform Domain Based on Chaotic Dynamic Modulation

In order to transmit the speech information safely in the channel,a new speech encryp-tion algorithm in linear canonical transform(LCT)domain based on dynamic modulation of chaot-ic system is proposed.The algorithm first uses a chaotic system to obtain the number of sampling points of the grouped encrypted signal.Then three chaotic systems are used to modulate the corres-ponding parameters of the LCT,and each group of transform parameters corresponds to a group of encrypted signals.Thus,each group of signals is transformed by LCT with different parameters.Fi-nally,chaotic encryption is performed on the LCT domain spectrum of each group of signals,to realize the overall encryption of the speech signal.The experimental results show that the proposed algorithm is extremely sensitive to the keys and has a larger key space.Compared with the original signal,the waveform and LCT domain spectrum of obtained encrypted signal are distributed more uniformly and have less correlation,which can realize the safe transmission of speech signals.

Practical Approaches to Securing an IT Environment

There are a number of IT Security journals available in the literature but none of these research papers have practically specified approaches to secure the IT environment at large. In this paper, more emphases will be laid on the practical ways to secure our IT environments and with some useful real-life scenarios. In today, securing our IT environment has become the key factor in the industry due to an increasing number of attackers invading and stealing the intellectual properties;thereby, rendering most IT industries to go out of businesses. They may find that understanding and translating IT security recommendations to implementable practices can be overwhelming. While this is a worthwhile and important task, there are also more practical ways to ensure you are using IT security best practices in your business. Therefore, the need to properly secure our IT environments in order to mitigate those attacks by using the right tools in all IT domains will be fully discussed in this research. This paper will focus more on protection of LAN-WAN Domain as a use case.

相干衰落抑制Φ-OTDR的分布式光纤周界安防技术

基于相位敏感光时域反射计(Φ-OTDR)的分布式光纤振动传感系统在铁路周界安防中有着重要的应用前景.为降低Φ-OTDR中固有的相干衰落对相位解调的影响,提高扰动信号识别率,提出一种基于矢量旋转滑动平均(MVRA)的相干衰落抑制方法.首先,对探测信号复矢量化,并对各位置的复矢量信号按初相角进行旋转对齐;然后,采用滑动平均的方法缓和信号幅度起伏以及减小噪声功率,提高信噪比,进而抑制相干衰落;其次,从衰落抑制信号解调出扰动信号,将MVRA与频谱提取重组(SERM)、数字向移变换(DPST)方法进行对比,通过差分相位标准差验证抗衰落效果;最后,通过搭建分布式光纤周界入侵检测实验平台,模拟环境噪声、应力破坏、攀爬、剪网4种防护扰动信号,以解调的相位灰度图作为特征图像,使用卷积神经网络进行模式识别.实验结果表明:相比SERM、DPST,MVRA能更高效地抑制衰落,当滑动窗长50 ns时,MVRA提高11.2 dB信噪比;扰动信号的识别率由衰落抑制前的88%提高到衰落抑制后的92%.

数字时代的认知域安全:理论解构、风险生成及治理路径

“认知域”是大国博弈的关键领域,在数字时代认知域安全已成为影响全球安全的重要议题。认知域安全研究经历了科学化、军事化、战略化再到国家安全化的四重演进,其理念被逐渐重塑。国家安全视角下的认知域安全,是指国家内部和外部的意识形态、思想文化、战略决策、价值观念、思维方式等不被内外势力操纵和改造,从而使认知的过程及其结果保持稳定有序的状态,并持续保障这种安全状态的能力。在要素特征方面,数字时代认知域安全呈现出主体多元、对象精准、智能驱动、战略隐蔽和全局领域的特点;在风险生成方面,内外势力往往通过观察-导向-决策-行动(OODA)循环模型进行精准操控,涵盖观察阶段的精准识别、导向阶段的信息加工、决策阶段的信息集成、行动阶段的主体协同以及评估阶段的信息反馈,形成了一个完整的操控链条,对认知域安全构成了严重威胁。中国必须双管齐下,积极有效应对认知域的安全风险。在顶层战略层面,国家需要制定全面而前瞻的战略政策框架;在务实策略层面,需在风险识别、风险评估、风险防控、风险应对等方面开展协同创新治理,进一步有效降低认知域操纵带来的安全风险。

基于知识图谱的跨项目安全缺陷报告预测方法

安全缺陷报告可以描述软件产品中的安全关键漏洞.为了消除软件产品的安全攻击风险,安全缺陷报告(security bug report,SBR)预测越来越受到研究人员的关注.但在实际软件开发场景中,需要进行软件安全漏洞预测的项目可能是来自新公司或属于新启动的项目,没有足够的已标记安全缺陷报告供在实践中构建此软件安全漏洞预测模型.一种简单的解决方案就是使用迁移模型,即利用其他项目已经标记过的数据来构建预测模型.受到该领域最近的两项研究工作的启发,以安全关键字过滤为思路提出一种融合知识图谱的跨项目安全缺陷报告预测方法KG-SBRP(knowledge graph of security bug report prediction).使用安全缺陷报告中的文本信息域结合CWE(common weakness enumeration)与CVE Details(common vulnerabilities and exposures)共同构建三元组规则实体,以三元组规则实体构建安全漏洞知识图谱,在图谱中结合实体及其关系识别安全缺陷报告.将数据分为训练集和测试集进行模型拟合和性能评估.所构建的模型在7个不同规模的安全缺陷报告数据集上展开实证研究,研究结果表明,所提方法与当前主流方法FARSEC和Keyword matrix相比,在跨项目安全缺陷报告预测场景下,性能指标F1-score值可以平均提高11%,除此之外,在项目内安全缺陷报告预测场景下,F1-score值同样可以平均提高30%.

基于光学的物理域对抗攻防综述

对抗攻击是指通过在原始输入中植入人眼无法察觉的微小扰动,误导深度学习模型做出错误预测的攻击。与数字域对抗攻击相比,物理域对抗攻击可实现对抗性输入被采集设备捕获并转换为视觉系统内的二值图像之前,将扰动引入输入,对基于深度学习的计算机视觉系统构成了实际安全威胁。基于光学的物理域对抗攻击技术(如使用投影照射)作为一种典型的非侵入性攻击,由于其扰动与现实世界中自然环境产生的影响非常相似,更容易被忽略,从而疏于防护。鉴于它们具有高度的不可见性和可执行性,可对实际系统构成重大甚至致命的威胁。基于现有研究工作,重点介绍和讨论了计算机视觉系统中基于光学的物理域对抗攻击技术,并对现有技术在攻击场景、攻击手段、攻击目标、攻击效果等方面展开详细分析,最后探讨了基于光学的物理域对抗攻击未来潜在研究方向。