物联网安全威胁及其应对措施

传感器技术和网络技术的不断发展促进了新一代信息技术物联网的发展。物联网给当今社会带来前所未有的发展机遇和挑战,和其他技术一样,物联网的安全威胁制约着物联网的健康发展和广泛应用。为解决物联网安全问题,文章首先从物联网的体系结构出发,分析物联网各个层次所面临的安全威胁;然后针对各层存在的安全威胁给出相应的应对措施,最后对物联网安全的研究方向进行阐述。     

IoT/CPS的安全体系结构及关键技术

物联网（IoT）和信息物理融合系统（CPS）作为下一代网络的核心技术,被业界广泛关注。与传统网络不同,IoT/CPS异构融合、协同自治、开放互连的网络特性带来了巨大的系统安全方面的挑战。挑战包括安全协议的无缝衔接、用户隐私保护等。研发新的安全模型、关键安全技术和方法是IoT/CPS发展中的重点。文章基于IoT/CPS安全需求和威胁模型,提出了一种层次化的安全体系结构,并针对隐私保护、跨网认证和安全控制等IoT/CPS的关键安全技术展开讨论。     

银行卡防伪方法的研究

近年来,银行卡诈骗案件屡见不鲜,给用户造成了财产损失。文章以银行卡防伪为基础,结合物联网与RFID技术,对银行卡安全认证方法进行了研究。基于一种物联网三方认证方法,同时与传统的口令认证相结合,设计出了一种银行卡三方认证方案。     

云计算环境下基于无证书的匿名用户认证协议

云计算的安全问题是云计算技术的核心问题之一。近年来,针对云计算中用户访问的安全问题提出了多个安全认证方案。但是,这些方案大都存在安全漏洞、流程复杂等缺陷,因此不适用于云计算环境。文章首先对一个高效的基于身份云计算认证协议进行分析,指出其算法的错误,并对其进行修正。其次提出一个适用于云计算环境下安全的用户认证方案。方案基于无对运算的无证书密码体系,避免基于身份认证方案的密钥泄露问题。在尽可能简化运算的前提下,提升了安全性。同时,方案使用临时身份代替用户真实身份,从而实现了用户匿名性。为了避免重放攻击,在方案中使用时戳以进一步增强了安全性。与现有相关协议相比,提出的方案有更高的安全级别和尽可能小的认证时延,因此更适合于云计算环境。     

移动云计算应用安全问题研究

在移动云计算中,由于数据访问和存储是在移动设备外部完成的,且由远程云服务器进行处理,因而用户无法对其进行控制。因此,安全和隐私是网络安全管理人员面临的重大挑战。随着社交媒体和移动互联网用户的快速增长,恶意威胁也随之增加。这些威胁大多是移动设备威胁、通信威胁和云环境威胁的组合体。文章从移动设备/终端、无线通信信道和云基础设施3个级别分析移动云计算的安全需求,讨论移动云计算应用面临的安全威胁,最后给出移动云计算应用安全的几种解决方案。     

物联网安全系统架构研究

介绍了物联网的基本概念和组成,分析了物联网当前所面临的安全问题和安全需求。为了降低物联网使用的安全风险,在给出物联网传统系统架构的基础上,通过在用户、物品和信息中心之间采取有效的安全防护措施,构建了一种物联网安全系统架构,并详细说明了其组成结构以及认证、加密和访问控制机制的实现原理。通过部署安全系统架构,能对物联网的信息传输和信息访问提供有效的安全防护,有效提升物联网整体安全。     

物联网安全初探

首先介绍了物联网的基本概念和物联网的三层体系结构,概括了物联网安全的新挑战和物联网安全大众化、轻量级、非对称、复杂性等主要特点,然后分别从感知层、网络层和应用层分析了物联网的安全威胁,最后提出了物联网安全体系结构。物联网安全需要对物联网感知层、网络层和应用层进行有效的安全保障,以应对其面临的安全威胁,并且还要能够对各个层次的安全防护手段进行统一的管理。     

物联网的安全威胁与应对策略

物联网被称为第三次信息革命,随着物联网技术的发展和应用的不断扩展,物联网的安全隐患受到人们的日益关注,安全问题已经成为制约其发展的重要因素。从剖析物联网的三层体系结构出发,分析了物联网受到的种种安全威胁,最后给出相应的安全策略。     

大数据中心云存储安全需求研究

由于大数据中心采用了云计算服务,因而用户的业务、应用和数据从客户端或本地数据中心转移到信息服务平台上,大量数据高度集中,使得大数据中心面临新的安全威胁和风险。文章设计大数据中心云应用服务平台架构,提出大数据中心云存储安全模型以及采用云计算服务期间用户和大数据中心应当遵循的基本原则,归纳大数据中心面临的6种主要安全威胁,给出大数据中心应当具备的10类云计算服务安全能力。     

基于指纹识别的云安全认证技术

在云计算环境中,作为云安全的第一道防线,用户身份认证有着至关重要的作用。分析了当前云服务系统的认证需求,考虑到指纹识别技术在云安全认证中的应用优势,提出了一种基于指纹识别的云安全认证系统。并对其系统架构、工作流程进行了深入研究,以通过更加安全的认证方式防止恶意用户的非法访问,保证云环境下用户数据的访问安全。     

云计算时代的开放安全服务体系分析

针对移动互联网时代日益发展带来的安全性问题,在既要满足服务的多样性,又要满足服务安全性的双重使命下,如何构建移动互联网云计算时代开放安全的云服务,文中提出了一种开放的安全服务体系。同时,基于开发安全服务体系的各种技术特征,设计并构建了一个云服务平台架构,可以提供能力开放应用云、企业安全私有应用云和认证鉴权公共应用云。     

An efficient authentication system of smart device using multi factors in mobile cloud service architecture

Mobile cloud computing environments have overcome the performance limitation of mobile devices and provide use environments not restricted by places. However, user information protection mechanisms are required because of both the security vulnerability of mobile devices and the security vulnerability of cloud computing. In this paper, a multifactor mobile device authentication system is proposed to provide safety, efficiency, and user convenience for mobile device use in cloud service architectures. This system improves security by reinforcing the user authentication required before using cloud computing services. Furthermore, to reinforce user convenience, the system proposed increases the strength of authentication keys by establishing multiple factors for authentication. For efficient entries in mobile device use environments, this system combines mobile device identification number entries, basic ID/password type authentication methods, and the authentication of diverse user bio‐information. This system also enhances authentication efficiency by processing the authentication factors of a user's authentication attempt in a lump instead of one by one in the cloud computing service environment. These authentication factors can be continuously added, and this authentication system provides authentication efficiency even when authentication factors are added. The main contribution is to improve high security level by through authentication of mobile devices with multifactors simultaneously and to use the mobile cloud service architecture for its efficient processing with respect to execution time of it. Copyright © 2013 John Wiley & Sons, Ltd.     

Authenticated key agreement scheme for fog-driven IoT healthcare system

The convergence of cloud computing and Internet of Things (IoT) is partially due to the pragmatic need for delivering extended services to a broader user base in diverse situations. However, cloud computing has its limitation for applications requiring low-latency and high mobility, particularly in adversarial settings (e.g. battlefields). To some extent, such limitations can be mitigated in a fog computing paradigm since the latter bridges the gap between remote cloud data center and the end devices (via some fog nodes). However, fog nodes are often deployed in remote and unprotected places. This necessitates the design of security solutions for a fog-based environment. In this paper, we investigate the fog-driven IoT healthcare system, focusing only on authentication and key agreement. Specifically, we propose a three-party authenticated key agreement protocol from bilinear pairings. We introduce the security model and present the formal security proof, as well as security analysis against common attacks. We then evaluate its performance, in terms of communication and computation costs.

     

DTLS based security and two-way authentication for the Internet of Things

In this paper, we introduce the first fully implemented two-way authentication security scheme for the Internet of Things (IoT) based on existing Internet standards, specifically the Datagram Transport Layer Security (DTLS) protocol. By relying on an established standard, existing implementations, engineering techniques and security infrastructure can be reused, which enables easy security uptake. Our proposed security scheme is therefore based on RSA, the most widely used public key cryptography algorithm. It is designed to work over standard communication stacks that offer UDP/IPv6 networking for Low power Wireless Personal Area Networks (6LoWPANs). Our implementation of DTLS is presented in the context of a system architecture and the scheme’s feasibility (low overheads and high interoperability) is further demonstrated through extensive evaluation on a hardware platform suitable for the Internet of Things.     

移动互联网环境下的云计算安全技术体系架构

文章在研究分析云计算安全风险和安全技术体系架构的基础上,结合移动互联网的特点,设计了一个多层次、多级别、弹性、跨平台和统一用户接口的移动互联网通用云计算安全技术体系架构。该架构可实现不同等级的差异化云安全服务,其中跨层的云安全管理平台可对整个系统的运维安全情况进行跨安全域和跨安全级别的监控。     

Survey on data security and privacy-preserving for the research of edge computing

With the rapid development and extensive application of the Internet of things (IoT),big data and 5G network architecture,the massive data generated by the edge equipment of the network and the real-time service requirements are far beyond the capacity if the traditional cloud computing.To solve such dilemma,the edge computing which deploys the cloud services in the edge network has envisioned to be the dominant cloud service paradigm in the era of IoT.Meanwhile,the unique features of edge computing,such as content perception,real-time computing,parallel processing and etc.,has also introduced new security problems especially the data security and privacy issues.Firstly,the background and challenges of data security and privacy-preserving in edge computing were described,and then the research architecture of data security and privacy-preserving was presented.Secondly,the key technologies of data security,access control,identity authentication and privacy-preserving were summarized.Thirdly,the recent research advancements on the data security and privacy issues that may be applied to edge computing were described in detail.Finally,some potential research points of edge computing data security and privacy-preserving were given,and the direction of future research work was pointed out.     

Security Architecture on the Trusting Internet of Things

By analyzing existed Internet of Things' system security vulnerabilities, a security architecture on trusting one is constructed. In the infrastructure, an off-line identity authentication based on the combined public key (CPK) mechanism is proposed, which solves the problems about a mass amount of authentications and the cross-domain authentication by integrating nodes' validity of identity authentication and uniqueness of identification. Moreover, the proposal of constructing nodes' authentic identification, valid authentication and credible communication connection at the application layer through the perception layer impels the formation of trust chain and relationship among perceptional nodes. Consequently, a trusting environment of the Internet of Things is built, by which a guidance of designing the trusted one would be provided.     

Secure communication in CloudIoT through design of a lightweight authentication and session key agreement scheme

Internet of Things (IoT) is a newly emerged paradigm where multiple embedded devices, known as things, are connected via the Internet to collect, share, and analyze data from the environment. In order to overcome the limited storage and processing capacity constraint of IoT devices, it is now possible to integrate them with cloud servers as large resource pools. Such integration, though bringing applicability of IoT in many domains, raises concerns regarding the authentication of these devices while establishing secure communications to cloud servers. Recently, Kumari et al proposed an authentication scheme based on elliptic curve cryptography (ECC) for IoT and cloud servers and claimed that it satisfies all security requirements and is secure against various attacks. In this paper, we first prove that the scheme of Kumari et al is susceptible to various attacks, including the replay attack and stolen-verifier attack. We then propose a lightweight authentication protocol for secure communication of IoT embedded devices and cloud servers. The proposed scheme is proved to provide essential security requirements such as mutual authentication, device anonymity, and perfect forward secrecy and is robust against security attacks. We also formally verify the security of the proposed protocol using BAN logic and also the Scyther tool. We also evaluate the computation and communication costs of the proposed scheme and demonstrate that the proposed scheme incurs minimum computation and communication overhead, compared to related schemes, making it suitable for IoT environments with low processing and storage capacity.     

UCAP:a PCL secure user authentication protocol in cloud computing

As the combine of cloud computing and Internet breeds many flexible IT services,cloud computing becomes more and more significant.In cloud computing,a user should be authenticated by a trusted third party or a certification authority before using cloud applications and services.Based on this,a protocol composition logic (PCL) secure user authentication protocol named UCAP for cloud computing was proposed.The protocol used a symmetric encryption symmetric encryption based on a trusted third party to achieve the authentication and confidentiality of the protocol session,which comprised the initial authentication phase and the re-authentication phase.In the initial authentication phase,the trusted third party generated a root communication session key.In the re-authentication phase,communication users negotiated a sub session key without the trusted third party.To verify the security properties of the protocol,a sequential compositional proof method was used under the protocol composition logic model.Compared with certain related works,the proposed protocol satisfies the PCL security.The performance of the initial authentication phase in the proposed scheme is slightly better than that of the existing schemes,while the performance of the re-authentication phase is better than that of other protocols due to the absence of the trusted third party.Through the analysis results,the proposed protocol is suitable for the mutual authentication in cloud computing.