恶意主机上Mobile Agent安全解决方案

根据非对称加密原理提出了恶意主机上Mobile Agents（MA）的安全解决方案。在该方案中，只有得到许可的主机才能执行MA的代码，交换的数据也要求加密。当MA返回源主机后可根据MA执行过程中的信息判断是否有目标主机对其有恶意行为。分析了恶意主机上MA所受到的安全威胁，并用所提出的方案逐一分析解决了MA所受到的安全威胁。     

A Solution Model to Protect Mobile Agents Against Malicious Host Attack

Within an agent server, the model introduces a trusted third party entity called Secure Service Station(SSS). The SSS is a non-hardware component and is intended to prevent most attacks performed by malicioushosts, by providing mechanisms that ensure attack detection and provide integrity to mobile agents. This noble technique involves encapsulating partial results obtained on each intermediate host and binding these results together using a hash function, thus forming a strong bonded chain that cannot be compromised. An analytical model to explore the system performance was also developed.     

一种新的远端移动代理的安全保护机制

在目前的移动代理系统中，保护主机免受恶意代理攻击的研究已经取得了很大的进展，而对于远端移动代理免受恶意主机攻击的问题，尚没有很好的解决方案，文中提出了一种利用JavaCard为远端移动代理，提供安全的执行环境的保护机制，并在此基础上引入了基于布尔代数运算的代码分割算法以提高本方案的安全性．实验结果证明该方案具有较好的安全性和健壮性．     

Some remarks on the TKIP key mixing function of IEEE 802.11i

Temporal key integrity protocol (TKIP) is a sub-protocol of IEEE 802.11i. TKIP remedies some security flaws in wired equivalent privacy (WEP) protocol. TKIP adds four new algorithms to WEP: a message integrity code (MIC) called Michael, an initialization vector (IV) sequencing discipline, a key mixing function and a re-keying mechanism. The key mixing function, also called temporal key hash, de-correlates the IVs from weak keys. Some cryptographic properties of the substitution box (S-box) used in the key mixing function are investigated in this paper, such as regularity, avalanche effect, differ uniform and linear structure. Moen et al pointed out that there existed a temporal key recovery attack in TKIP key mixing function. In this paper a method is proposed to defend against the attack, and the resulting effect on performance is discussed.     

基于ECC的移动自组网成员控制方案

基于Pederson分布式密钥产生方案,采用椭圆曲线密码体制提出一个分布式密钥产生协议,该方案高效且能抵制内外恶意节点的攻击,并采用门限数字签名方案给出一个安全的移动自组网的成员控制方案.通过方案的性能和安全性分析得出结论,该成员控制策略非常适合于资源受限的移动自组网.     

Reputation-based collaborative spectrum sensing scheme in cognitive radio networks

Collaborative spectrum sensing is proposed to improve the detection performance in cognitive radio (CR) networks. However, most of the current collaborative sensing schemes are vulnerable to the interference of the malicious secondary users (SUs). In this paper we propose a reputation-based collaborative spectrum sensing scheme to improve the security of cooperative sensing by mitigating the impacts of misbehaviors. The fusion center calculates the reputation rating of each SU according to their history reports to weight their sensing results in the proposed scheme. We analyze and evaluate the performance of the proposed scheme and its advantages over previous schemes in expansibility and integrity. Simulation results show that the proposed scheme can minimize the harmful influence from malicious SUs.     

An identity-based encryption scheme with compact ciphertexts

This paper proposes an identity-based encryption scheme with the help of bilinear pairings, where the identity information of a user functions as the user's public key. The advantage of an identity-based public key system is that it can avoid public key certificates and certificate management. Our identity-based encryption scheme enjoys short ciphertexts and provable security against chosen-ciphertext attack (CCA).     

广义椭圆曲线数字签名链口令认证方案

一次性口令是身份认证的重要技术。文章构造了一个基于椭圆曲线数字签名链的一次性口令认证和密钥协商方案。该方案使用了具有消息恢复功能、无须求逆的椭圆曲线数字签名算法,椭圆曲线认证密钥协商协议,密钥进化算法和椭圆曲线数字签名链等。方案有以下优点:服务器无需维护口令和验证列表;允许用户自主选择和更改口令,实现了双向认证;无需系统时钟同步和传输时延限制;能够抵抗重放攻击、离线字典攻击、中间人攻击和内部人攻击;具备口令错误敏感性和强安全修复性;生成的会话密钥具有新鲜性、机密性、已知密钥安全性和前向安全性。经对比,该方案具有更好的安全性能,适合强安全性需求的场合。     

一种复杂诊断系统的多智能体协同求解算法

为适应故障诊断中动态变化的环境和满足求解复杂系统全部任务的要求,研究一种基于MAS的分布式智能监控系统.以诊断决策问题的结构及建模过程的层次性为基本思想,基于诊断任务的多层次混合分解策略,提出了融合不同表达方式和推理机制的多Agent并行诊断结构,分析了管理Agent,诊断Agent和决策Agent的基本职能.探讨了实时Agent的组织和演化机制,给出了并行推理过程中的冲突消解算法,建立了具有公共属性的智能体模块化层次结构,实现了基于MAS多层分布式黑板模型的智能监控系统.工程应用效果验证了该求解的可行性和有效性.     

基于自动信任协商的可信移动代码验证方法

移动代码具有智能型和移动性,对目标主机平台构成安全威胁.现有对移动代码的授权和认证方法多是以可信第三方的直接授权为基础.本文针对目前开放网络的特点,提出一种基于自动信任协商（ATN）的移动代码保护方法（ATMCVM）,该模型通过逐步披露证书的方法能够解决两个陌生的代码生产者和消费者间动态建立信任关系的问题.     

基于工作流与Agent技术的设施管理系统研究

介绍了工作流技术、工作流管理系统、Agent以及多Agent系统的特点,在此基础上将工作流和Agent技术应用到设施管理系统的构建中,给出了工作流与Agent协同管理的方法和框架,并提出了设施管理系统的三层分布式体系结构,即:用户界面层;应用逻辑层及数据服务层.可为后续设施管理系统的开发提供技术上的参考和借鉴.     

Distributed certificateless key encapsulation mechanism secure against the adaptive adversary

This paper proposes an adaptively secure solution to certificateless distributed key encapsulation mechanism from pairings by using Canetti's adaptive secure key generation scheme based on discrete logarithm. The proposed scheme can withstand adaptive attackers that can choose players for corruption at any time during the run of the protocol, and this kind of attack is powerful and realistic. In contrast, all previously presented threshold certificateless public key cryptosystems are proven secure against the more idealized static adversaries only. They choose and fix the subset of target players before running the protocol. We also prove security of this scheme in the random oracle model.     

Robust password and smart card based authentication scheme with smart card revocation

User authentication scheme allows user and server to authenticate each other, and generates a session key for the subsequent communication. How to resist the password guessing attacks and smart card stolen attacks are two key problems for designing smart cart and password based user authentication scheme. In 2011, Li and Lee proposed a new smart cart and password based user authentication scheme with smart card revocation, and claimed that their scheme could be immunity to these attacks. In this paper, we show that Li and Lee＇s sctleme is vulnerable to off-line password guessing attack once the information stored in smart card is extracted, and it does not provide perfect forward secrecy. A robust user authentication scheme with smart card revocation is then proposed. We use a most popular and widely used formal verification tool ProVerif, which is based on applied pi calculus, to prove that the proposed scheme achieves security and authentication.     

A Multi-homed VPN Architecture Based on Extended SOCKS＋TLS Protocols

IntroductionThe security and performance of corporatenetwork system (end system) is becoming increas-ingly important, so VPN systems are often de-ployed to enhance the security of end systems.AVPN is provisioned over public or a third networkinfrastructure through different security protocols,to provide dedicated connectivity to a closed groupof users. The current tunneled VPNs are morelightweight but without over-provisioning by thenetwork provider give no assured quality of serviceand th…     

ID-Based Threshold Decryption Secure Against Chosen Plaintext Attack

Introduction Inthresholddecryptioncryptosystems,the powertodecryptissharedamongasetofdecryp-tionservers.In2001,D.BonehandM.Franklin proposedapracticalidentity-basedencryption(IBE)schemefromtheweilpairing.Combining thetwoconceptstogether,some“ID-basedthresh-olddecryption”schemeshavebeenconstructed.In suchschemes,anentity'spublickeyisderiveddi-rectlyfromitsidentity.Atrustedthirdparty calledtheprivatekeygenerator(PKG)usesthe masterkeytogenerateprivatekeysforallentities.Eachdecryptionserve…     

ID-Based Authenticated Dynamic Group Key Agreement

IntroductionIn many modern collaborative and distributedapplications such as multicast communication, au-dio-video conference and collaborative tools, scal-able and reliable group communication is one of thecritical problems. A group key agreement (GKA)protocol allows a group of users to share a key,which may later be used to achieve some crypto-graphic goals. In addition to this basic tool an au-thentication mechanism provides an assurance ofkey shared with intended users. A protocol achiev…     

Research on High Power Inter-Channel Crosstalk Attack in Optical Networks

While all-optical networks become more and more popular as the basis of the next generation Internet(NGI)infrastructure,such networks raise many critical security issues.High power inter-channel crosstalk attack is one of the security issues which have negative effect on information security in optical networks.Optical fiber in optical networks has some nonlinear characteristics,such as self phase modulation(SPM),cross phase modulation(XPM),four-wave mixing(FWM)and stimulated Raman scattering(SRS).They can be used to implement high power inter-channel crosstalk attack by malicious attackers.The mechanism of high power inter-channel crosstalk attack is analyzed.When an attack occurs,attack signal power and fiber nonlinear refractive index are the main factors which affect quality of legitimate signals.The effect of high power inter-channel crosstalk attack on quality of legitimate signals is investigated by building simulation system in VPI software.The results show that interchannel crosstalk caused by high power attack signal leads to quality deterioration of legitimate signals propagated in the same fiber.The higher the power of attack signal is,the greater the fiber nonlinear refractive index is.The closer the channel spacing away from the attack signal is,the more seriously the legitimate signals are affected by attack.We also find that when attack position and power of attack signal are constant,attack signal cannot infinitely spread,while its attack ability shows a fading trend with the extension of propagation distance.     

移动通信企业"物流-资产"一体化信息系统建设设想

为有效解决传统库存管理模式中物流、信息流、资金流相互脱节和信息传递不对称的的问题,提出在移动通信企业内部建设“物流-资产”一体化信息系统的设想.通过对一体化系统的整体框架设想的描述,对系统信息数据的编码体系与系统流程作了一定的规划与设计,并建立不同属性实物的一体化管理模型,以提高移动通信企业物流管理的信息化和自动化管理水平.     

利用SOAP扩展实现Web服务中SOAP消息的安全

在利用SOAP消息与Web服务进行通信时,消息本身受到来自网络的各种安全性威胁.虽然SOAP的规范不涉及安全问题,但是允许安全问题作为扩展而被处理.文中通过对.NET framework的SOAP扩展机制的分析,提出了一种利用SOAP扩展加密Web服务中SOAP消息的方法.在对称加密和非对称加密的原理及Web服务技术的基础上,给出了一个具体的实施方案,使SOAP消息在进入公共网络前实现稳健加密.     

On constructing certificateless proxy signature from certificateless signature

In proxy signature schemes, an original signer A delegates its signing capability to a proxy signer B, in such a way that B can sign message on behalf of A.The recipient of the final message verifies at the same time that B computes the signature and that A has delegated its signing capability to B.Recently many identity-based(ID-based) proxy signature schemes have been proposed, however, the problem of key escrow is inherent in this setting.Certificateless cryptography can overcome the key escrow problem.In this paper, we present a general security model for certificateless proxy signature scheme.Then, we give a method to construct a secure certificateless proxy scheme from a secure certificateless signature scheme, and prove that the security of the construction can be reduced to the security of the original certificateless signature scheme.