网格计算环境中的应用安全模型设计与实现

网格计算是近年来兴起的一个研究热点.它的出现和发展使得解决高性能计算领域的问题和挑战成为可能.而安全问题是网格计算成败的关键,因此,分析了当前网格计算环境的安全需求和网格安全基础设施(GSI)以及数字证书在GSI中的应用,并针对其存在的不足,设计了一种新型的网格应用安全模型,并基于网格计算环境实现了该模型.     

无损分享视觉密码研究

根据秘密图像分享过程中的信息损失,给出了无损分享视觉密码的概念,从而将视觉密码2个参数的优化问题简化为一个,并提出了矩阵转化算法和整数规划模型,实现了一种像素扩展度的优化算法。实验结果表明,该算法能够实现无损分享下的像素扩展度最优化,且适用于通用存取结构。     

基于价格时间Petri网的网格计算应用模型及分析

网格计算环境下资源管理和任务调度是当前研究的热点问题,OGSA体系结构提出了网格服务的概念,但缺乏应用对网格服务质量要求的形式化描述.本文对OGSA体系结构进行了必要的扩展,提出网格用户应用的价格时间Petri网模型,利用该模型可对网格应用的QoS需求进行定义,并可利用Petri网的工具分析用户应用模型的正确性和时间特性,给出了具体的分析算法.     

网格环境下一种改进的Gossip资源聚集算法

网格计算和对等计算有很多可以融合的特征.首先提出了一种集成P2P模式的网格资源管理模型,然后针对传统的Gossip资源聚集算法的弊端,利用小世界理论,提出了一种改进的Gossip资源聚集算法.理论分析和仿真证明了改进的Gossip算法能够有效地聚集资源信息,从而提高P2PGrid环境下的资源聚集性能.     

计算网格中动态负载平衡策略研究

负载平衡调度策略对于网格计算系统非常重要,有利于网格子任务和网格资源间作出更合理的匹配,起到优化总计算时间的目的.研究了通用的集中式动态负载平衡策略,基于Globus的网格信息获取和任务分配模型,网格节点硬件类、软件类及文件类信息的获取方法,设计并实现了网格动态负载平衡算法,继而应用该算法在网格中进行了地震波正演模拟实验.实验结果表明:该算法充分利用了网格中每个节点的资源,有效地减少计算密集型任务的求解时闻.     

网格计算中一种启发式数据分配算法的讨论

网格是在高速网络环境下解决大区域、高性能、并行计算问题的一种新技术.高性能调度技术是网格核心管理的重要技术之一,它要做的第一步就是在空间上对计算和数据进行分配.本文针对一个简化了的网格计算环境,考虑待处理的数据单元在各聚集中出现的不同频率,提出了一种启发式数据分配算法(HDDA),可以使数据分配在多项式时间内完成并获取较小的通信费用,然后对算法的进行了性能分析,最后对该算法在实际网格中的应用进行了探讨.     

一类热流密码体制非线性模型的有限元算法

讨论了一类热流密码体制非线性模型的数值计算问题,设计了一种适合热流码体制的有限元算法,证明了算法解的存在唯一性,并利用计算机模拟实现加、解密过程,得到了一些结论。为进一步探索热流密码体制加、解密问题的有效算法乃至实际应用提供了思路。     

树形网格自适应调度模型研究

提出一种基于树形计算网格的自适应调度模型,实现对小粒度独立任务和用户大作业的自适应最优调度.通过对网格环境的实时检测,给出了基于节点负载状况、节点任务执行时间和任务特性的自适应调度算法.实验证明该任务调度模型在负载平衡和容错方面具有良好的性能.     

基于移动代理的网格计算环境下的资源管理的研究

根据网格计算环境的各种特点,分析比较了网格计算环境下各种资源调度模型,得出采用分布式资源调度的体系结构和基于移动代理的资源管理策略的可行性和必要性.论述了在网格计算环境下引入移动代理技术对于解决网格计算问题的作用和优点,提出了基于移动代理的资源管理模型,并分析了在此系统中采用的资源发现算法及资源调度策略.     

基于倾斜相位的CPM信号调制解调设计

连续相位调制(CPM)信号是一种具有高频谱效率和功率效率的恒包络调制技术,但基于传统相位网格的CPM信号调制解调算法复杂度高、计算量大。提出了一种基于倾斜相位网格的CPM调制解调算法,通过分析CPM相位网络图和分解模型,给出了CPM信号倾斜相位网格设计、状态存储、初始化及译码的实现方法,相比传统相位,该算法更加简洁、计算量更小,并通过仿真验证了设计方案的正确性。     

PVHArray:一种流水可伸缩的层次化可重构密码逻辑阵列结构

针对密码算法的高效能实现问题,该文提出了一种基于数据流的粗粒度可重构密码逻辑阵列结构PVHArray.通过研究密码算法运算及控制结构特征,基于可重构阵列结构设计方法,提出了以流水可伸缩的粗粒度可重构运算单元、层次化互连网络和面向周期级的分布式控制网络为主体的粗粒度可重构密码逻辑阵列结构及其参数化模型.为了提升可重构密码逻辑阵列的算法实现效能,该文结合密码算法映射结果,确定模型参数,构建了规模为4×4的高效能PVHArray结构.基于55nm CMOS工艺进行流片验证,芯片面积为12.25mm²,同时,针对该阵列芯片进行密码算法映射.实验结果表明,该文提出高效能PVHArray结构能够有效支持分组、序列以及杂凑密码算法的映射,在密文分组链接（CBC）模式下,相较于可重构密码逻辑阵列REMUS_LPP结构,其单位面积性能提升了约12.9%,单位功耗性能提升了约13.9%.     

可信计算密码支撑平台完整性度量和密码机制的研究

国家密码管理局发布可信计算密码支撑平台功能与接口规范,用于指导我国可信计算平台的研究与应用。研究可信计算密码支撑平台和TCM（可信密码模块）的组成结构,分析密码算法的支撑作用和可信计算密码支撑平台的完整性度量机制。从而发现可信计算密码支撑平台和TCG（可信计算组织）的可信计算平台在完整性度量和密码机制方面的差异,得出可信计算密码支撑平台的优越性。     

High-Speed Prefix-Preserving IP Address Anonymization for Passive Measurement Systems

Passive network measurement and packet header trace collection are vital tools for network operation and research. To protect a user's privacy, it is necessary to anonymize header fields, particularly IP addresses. To preserve the correlation between IP addresses, prefix-preserving anonymization has been proposed. The limitations of this approach for a high-performance measurement system are the need for complex cryptographic computations and potentially large amounts of memory. We propose a new prefix-preserving anonymization algorithm, top-hash subtree-replicated anonymization (TSA), that features three novel improvements: precomputation, replicated subtrees, and top hashing. TSA makes anonymization practical to be implemented on network processors or dedicated logic at Gigabit rates. The performance of TSA is compared with a conventional cryptography based prefix-preserving anonymization scheme which utilizes caching. TSA performs better as it requires no online cryptographic computation and a small number of memory lookups per packet. Our analytic comparison of the susceptibility to attacks between conventional anonymization and our approach shows that TSA performs better for small scale attacks and comparably for medium scale attacks. The processing cost for TSA is reduced by two orders of magnitude and the memory requirements are a few Megabytes. The ability to tune the memory requirements and security level makes TSA ideal for a broad range of network systems with different capabilities     

云环境数据服务的可信安全模型

针对云服务提供商的可信状态和云环境数据服务的安全需求,提出了云环境数据服务的可信重加密安全模型,即在云环境下的数据安全需要云服务提供商满足一定的可信程度,再结合有效的重加密算法才能得以保证。通过对重加密模型进行安全分析,并用密码算法对重加密模型进行验证,得到实现重加密算法的约束条件,同时提出可信评价模型,对云服务提供商的可信状态进行动态评价,为建立云环境数据服务的可信安全提供理论基础和实现依据。     

一种密码专用可编程逻辑阵列的分组密码能效模型及其映射算法

密码专用可编程逻辑阵列(CSPLA)是一种数据流驱动的密码处理结构，该文针对不同规模的阵列结构和密码算法映射实现能效关系的问题，首先以CSPLA的特定硬件结构为基础，以分组密码的高能效实现为切入点，建立基于该结构的分组密码算法映射能效模型并分析影响能效的相关因素，然后进一步根据阵列结构上算法映射的基本过程提出映射算法，最后选取几种典型的分组密码算法分别在不同规模的阵列进行映射实验。结果表明越大的规模并不一定能够带来越高的能效，为取得映射的最佳能效，阵列的规模参数应当与具体的硬件资源限制和密码算法运算需求相匹配，CSPLA规模为4×4～4×6时映射取得最优能效，AES算法最优能效为33.68 Mbps/mW，对比其它密码处理结构，CSPLA具有较优的能效特性。     

Integrity checking protocol with identity-based proxy signature in mobile cloud computing

Based on provable data possession(PDP)model,a more perfect data integrity checking model for mobile cloud computing was proposed,in which there was an additional proxy party with stronger computing power to help the mobile users to calculate the block tags.Furthermore,for the proposed model,an identity-based proxy signature PDP(IBPS-PDP)protocol was presented.By using identity-based signatures,the system did not need to manage public key certificates and further the users did not need to take the additional computations to verify the other’s certificates yet.Finally,the security of the proposed IBPS-PDP protocol is proved in the random oracle model.     

An O(n·(log2(n))2) algorithm forcomputing the reliability of k-out-of-n:G and k-to-l-out-of-n:G systems

This paper presents the RAFFT-GFP (Recursively Applied Fast Fourier Transform for Generator Function Products) algorithm as a computationally superior algorithm for expressing and computing the reliability of k-out-of-n:G and k-to-l-out-of-n:G systems using the fast Fourier transform. Originally suggested by Barlow and Heidtmann (1984), generating functions provide a clear, concise method for computing the reliabilities of such systems. By recursively applying the FFT to computing generator function products, the RAFFT-GFP achieves an overall asymptotic computational complexity of O(n·(log₂(n)) ²) for computing system reliability. Algebraic manipulations suggested by Upadhyaya and Pham (1993) are reformulated in the context of generator functions to reduce the number of computations. The number of computations and the CPU time are used to compare the performance of the RAFFT-GFP algorithm to the best found in the literature. Due to larger overheads required, the RAFFT-GFP algorithm is superior for problem sizes larger than about 4000 components, in terms of both computation and CPU time for the examples studied in this paper. Lastly, studies of very large systems with unequal reliabilities indicate that the binomial distribution gives a good approximation for generating function coefficients, allowing algebraic solutions for system reliability     

列表译码在密码中的应用综述

列表译码自上世纪50年代提出以来,不仅在通信与编码等方面得到了广泛应用,也在计算复杂性理论和密码学领域有着广泛的应用。近年来,随着量子计算的发展,基于整数分解等传统困难问题设计的密码方案受到了巨大的威胁。由于编码理论中一些计算问题的NP困难性被广泛认为是量子概率多项式时间不可攻克的,建立在其上的基于纠错码的密码体制得到了越来越多的重视,列表译码也越来越引起人们的关注。该文系统梳理了列表译码在密码学中的应用,包括早期在证明任何单向函数都存在硬核谓词、设计叛徒追踪方案、以多项式重建作为密码原语设计公钥方案、改进传统基于纠错码的密码方案和求解离散对数问题(DLP)等方面的应用,以及近期,列表译码在设计安全通信协议、求解椭圆曲线离散对数问题、设计新的基于纠错码的密码方案等方面的应用。该文对列表译码的算法改进及其在密码协议设计和密码分析中的应用、新应用场景探索等方面的发展趋势进行了探讨。     

密码协议的一种基于组合推理的模型验证

将密码协议与协议中用到的密码算法视为一个系统，基于组合推理技术建立了密码协议系统的形式化模型。采用基于假设／保证的组合推理技术提出了新的假设／保证推理规则和假设／保证推理算法，证明了该规则的正确性，实现了密码协议系统的模型验证，并重点解决了系统分解问题、假设函数的设定问题等难题。以kerberos v5密码协议系统为例，利用该组合推理技术对密码协议系统进行了安全验证。     

Designs for efficient low power cardinality and similarity sketches by Two-Step Hashing (TSH)

In many computing applications, there is a need to estimate different features of large data sets, such as the number of distinct elements or the similarity with other data sets. This can be efficiently implemented using probabilistic data structures known as sketches; for example, Hyperloglog is widely used for cardinality estimate and Minhash for similarity estimate. Many of these sketches rely on computing hash functions on the elements and counting the number of consecutive leading zeros (or ones) to identify the minimum (or maximum) hash value for data updating. This functionality usually accounts for the most demanding part of the sketch implementation; an efficient and low power hash computation and leading zero counting are therefore required for high performance. A novel but important observation is exploited in this paper; namely the trailing hash bits are rarely used in these sketches (e.g., the leading zeros counting stops once the first one is found, which usually occurs after a few bits). Based on this feature, a so-called Two-Step Hashing (TSH) scheme is proposed in this paper to significantly reduce the power consumption. Therefore rather than computing all hash bits (as in the traditional scheme), TSH computes a few leading hash bits in a first step and the trailing hash bits in the second step, that is only required when the leading bits are all zeros (or ones). Hence, in most cases only a fraction of the hash bits is computed, so significantly reducing the power dissipation of hash computations when they are used to check the number of consecutive leading zeros, or the minimum value. The use of TSH for sketches with both single and multiple pipeline implementations are considered; evaluation results based on HyperLogLog (HLL) as a sketch with a Cyclic Redundancy Check hash function show that TSH saves up to 75.9 % (78.7 %) power dissipation in a single (multiple) pipeline implementation.