警惕“Google Earth”带来的信息安全隐患

Google Earth以其强大而诱人的虚拟地球信息服务功能吸引着众多用户的同时,也不可避免地对传统信息安全观带来了巨大冲击,应当引起高度关注.本文对Google Earth的使用与信息安全防范问题进行了初步思考.     

Google Earth不再“水土不服”

由于可以看到卫星地图,可以看到地球上的真实建筑,Google Earth倍受用户们的喜爱,很多朋友都喜欢用它周游世界,甚至是在Google Earth上面查找自家房屋的位置。不过,到目前为止,Google Earth只显示英文地名或是中文汉语拼音地名,给中国用户带来诸多不便。现在,如果你想在Google     

Google Earth还是中文看得顺眼

Google Earth以实物图的形式显示地图,用户可以直观地看到目标地点的概况,对于一些重要的位置,分辨率更高,甚至连路上的行人都可以看得一清二楚,现在喜欢Google Earth的人非常多。到目前为止,Google Earth上面的地点都被标注成英文和汉语拼音,看起来总显得不顺眼。现在好了,有了EEmap的中文导航的帮助,我们可以看到“中文版”的Google Earth,而且此版本的Google Earth最小能看到乡镇,甚至是村庄。为Google Earth添加EEmap中文导航首先,打开http://www.eemap.org/,在“首页”标签中右击eemap.kml的下载链接下载到本地,然后再使用Googl…     

国际新闻

Google Earth点燃了搜索引擎的竞赛Google Earth是将卫星影像,三维建筑物和地形数据与Google的定位搜索信息结合,可以可视化地动态飞行。它包括:美国38个主要城市的三维建筑物;三维显示的世界地形包括山脉、河谷、峡谷;对地形的显示能够倾斜和旋转。而且,可以从不同透视角度显示建筑物;创建和共享用户标注的工具。这些新的功能是构建在Google最近发布的几种地理空间信息服务之上的。他们是:位置搜索服务(local.google.com)、在线制图服务(maps.google.com)、针对手机的位置搜索服务(mobile.google.com/local)。Google Earth使用了宽带流…     

Google Earth的中国导游

Google Earth对欧美地区的卫星地图提供了本地搜索和驾车导航服务,用户可以直观地了解这些地区的商业网点和交通路线,相当实用。其实在中国卫星地图上也可以使用这两项服务,有了GooDT这款中国地区专用的"导游"小工具,照样可以在Google Earth上使用本地搜索和驾车导航服务。目前支持国内68个大中城市。     

用Google Earth遨游宇宙

一直以来,Google Earth都像它的名字一样,只能用来浏览地球上的内容,但现在Google Earth的新版本(版本号:4.2.0181.2634 beta)加入了宇宙浏览模式,正式冲出地球!我们可以利用Google Earth直接观看遥远星系,探索星群,看行星运动,甚至看超新星的爆发,就像拥有了一架虚拟的太空望远镜。新版的Google Earth还加入了繁体中文的支持,在语言上也更贴近了用户。     

基于Google Earth的增值服务研究

介绍基于Google Earth应用系统开发的基础知识和模式,分析了Google Earth增值业务架构,提出了基于J2EE的KMLServer增值服务器框架,并给出了一个KML Server应用范例。     

追踪“越狱”，玩转Google Earth剧情地标

如今最火的一部美剧无疑就是《越狱》，在最新的第二季剧情中，剧中的主人公们已经逃出了监狱，踏上了更加惊险的逃亡之旅。目前有人专门根据故事情节制作了Google Earth剧情地标，使我们可以跟随每一集的剧情，通过卫星地图实地探查主人公们的逃亡路线，相当有意思。如果你想了解Google Earth剧情地标的制作和使用方法，就一起来看看吧。[编者按]     

Google Earth在旅游景点展示中的应用

在旅游信息网站中,利用虚拟现实技术进行景点展示取得的效果比使用文字和图片更生动。目前利用虚拟现实技术进行场景展示的3种主要方式为单机仿真软件、Web3D和全景图。该文提出一种利用Google Earth技术进行在线场景展示的方法,综合上述方式的优点,实现对大场景的加载、Internet对接以及与全景图的组合。该方法利用Servlet返回动态KML,激发Google Earth启动并显示场景。利用KML控制地标显示、地标说明图文和3D模型加载。通过说明图文中的超链接,让地标链接到全景图网页或Servlet,以返回3D模型数据。     

基于Google Earth的无人机任务规划设计

针对无人机任务规划要求,提出了一种利用Google Earth二次开发能力实现的无人机任务规划方法。首先应用任务规划算法得到规划信息,然后将威胁数据、规划数据、飞机数据等信息通过Google Earth提供的接口引入到Google Earth中,得到无人机在Google Earth上的规划航迹。结果表明,该方法不仅省去了地形建模,而且能快速地生成一条逼真性相当高的满足无人机性能要求的规避威胁航路。     

抗关键词猜测攻击的可搜索属性基加密方案

可搜索属性基加密能够让属性满足访问控制策略(或用来加密关键词的属性满足用户私钥指定的访问控制策略)的用户搜索加密文件。但是,现有的方案不能抵抗关键词猜测攻击。外部攻击者可以生成若干关键词密文上传到云服务器,侦测云服务器将这些密文返回给哪些用户,进而获取这些用户的搜索信息。因此,提出一种可以抵抗关键词猜测攻击的可搜索属性基加密方案。基于DBDH困难问题,该方案在选择安全模型中被证明是选择明文攻击安全的。     

Oblivious access control policies for cloud based data sharing systems

Conventional procedures to ensure authorized data access by using access control policies are not suitable for cloud storage systems as these procedures can reveal valid access parameters to a cloud service provider. In this paper, we have proposed oblivious access control policy evaluation (O-ACE); a data sharing system, which obliviously evaluates access control policy on a cloud server and provisions access to the outsourced data. O-ACE reveals no useful information about the access control policy neither to the cloud service provider nor to the unauthorized users. Through the security analysis of O-ACE it has been observed that computational complexity to compromise privacy of the outsourced data is same as reverting asymmetric encryption without valid key pair. We have realized O-ACE for Google Cloud. Our evaluation results show the fact that O-ACE CPU utilization cost is 0.01–0.30 dollar per 1,000 requests.     

A practical privacy-preserving targeted advertising scheme for IPTV users

In this work, we present a privacy-preserving scheme for targeted advertising via the Internet Protocol TV (IPTV). The scheme uses a communication model involving a collection of subscribers, a content provider (IPTV), advertisers and a semi-trusted server. To target potential customers, the advertiser can utilize not only demographic information of subscribers, but also their watching habits. The latter includes watching history, preferences for IPTV content and watching rate, which are periodically (e.g., weekly) published on a semi-trusted server (e.g., cloud server) along with anonymized demographics. Since the published data may leak sensitive information about subscribers, it is safeguarded using cryptographic techniques in addition to the anonymization of demographics. The techniques used by the advertiser, which can be manifested in its queries to the server, are considered (trade) secrets and therefore are protected as well. The server is oblivious to the published data and the queries of the advertiser as well as its own responses to these queries. Only a legitimate advertiser, endorsed with so-called trapdoors by the IPTV, can query the cloud server and access the query results. Even when some background information about users is available, query responses do not leak sensitive information about the IPTV users. The performance of the proposed scheme is evaluated with experiments, which show that the scheme is practical. The algorithms demonstrate both weak and strong scaling property and take advantage of high level of parallelism. The scheme can also be applied as a recommendation system.     

基于区块链的多关键字属性基可搜索加密方案

云存储服务的出现可将文件上传至云服务器,节约了本地的信息存储空间以及管理开销。文件以明文的形式存储显然无法满足隐私保护和安全需求,但若将加密后的文件上传至云服务器,将失去搜索原文件的能力。因此,可搜索加密技术的出现解决了用户如何在文件不解密的情况下搜索加密数据。目前现有的单关键字可搜索加密方案会产生许多与检索内容不符合的信息,没有考虑数据用户细粒度搜索权限和搜索效率,以及因云存储的集中化带来的数据安全和隐私保护等问题。针对以上问题,该文提出了基于区块链的多关键字属性基可搜索加密方案。该方案使用多关键字可搜索加密技术实现了加密数据的有效搜索;利用基于属性的加密技术实现加密数据的细粒度访问控制;结合区块链的智能合约技术,经过多笔交易获得搜索结果。并且利用区块链的不可篡改性,满足了方案中相关性质的公平性,保证了在方案中三方的公平性和安全性并进行了相关分析。在随机预言机模型下,基于困难问题假设证明了方案的关键字安全及陷门安全,即所提方案满足在选择关键字攻击下的关键字密文不可区分性安全和陷门不可区分性安全。最后通过数值分析表明该方案在关键字密文生成阶段和关键字搜索阶段具有较高的效率。并展望了在未...     

基于属性代理重加密技术与可容错机制相结合的数据检索方案

针对云服务器上用户信息的隐私问题,提出一种基于属性代理重加密技术与容错机制相结合的方案。该方案将用户存储的数据分为文件和文件的安全索引,将其分别进行加密后存储在不同的云服务器上。首先,利用倒排序结构构造文件的安全索引,并使用模糊提取器对关键字进行预处理,用户可以通过该安全索引进行容错的多关键字搜索;其次,设置访问控制树对解密密钥重加密,实现权限管理,即实现数据在云端的有效共享;最后,通过Complex Triple Diffle-Hellman难题证明该方案生成的系统主密钥是安全的,因此该方案在云环境下也是安全的。与已有的方案的对比分析表明,该方案可减少密钥重加密、解密 等的计算量,同时通过加入容错处理机制提高了数据检索的效率。     

基于GlusterFS的分布式数据完整性验证系统

云存储为用户提供了弹性而可靠的数据存储方案,使得用户可以在任何时刻通过网络访问云服务器存取数据,大大降低了用户自己维护数据的成本,但也引发了一系列安全问题.对于云存储而言,采取审计措施用于检查数据的完整性至关重要,但已有的大多数云数据完整性审计机制只是通过模拟实验证明了方案具有高效性,并未结合具体云存储场景进行分析实验...     

云环境下基于属性的多关键字可搜索加密方案

可搜索加密技术可在不解密数据密文的同时实现密文关键字的检索,很好地保护了数据存储方的隐私.针对目前大多数可搜索加密方案无法支持用户自定义搜索策略的问题,提出了一种安全、高效、可支持任意表达的基于属性可搜索加密方案.该方案首先基于LSSS搜索结构,支持任意合取、析取或单调布尔表达式的多关键字搜索策略,用户使用私钥为LSS...     

Secure multi-server-aided data deduplication in cloud computing

Cloud computing enables on-demand and ubiquitous access to a centralized pool of configurable resources such as networks, applications, and services. This makes that huge of enterprises and individual users outsource their data into the cloud server. As a result, the data volume in the cloud server is growing extremely fast. How to efficiently manage the ever-increasing datum is a new security challenge in cloud computing. Recently, secure deduplication techniques have attracted considerable interests in the both academic and industrial communities. It can not only provide the optimal usage of the storage and network bandwidth resources of cloud storage providers, but also reduce the storage cost of users. Although convergent encryption has been extensively adopted for secure deduplication, it inevitably suffers from the off-line brute-force dictionary attacks since the message usually can be predictable in practice. In order to address the above weakness, the notion of DupLESS was proposed in which the user can generate the convergent key with the help of a key server. We argue that the DupLESS does not work when the key server is corrupted by the cloud server. In this paper, we propose a new multi-server-aided deduplication scheme based on the threshold blind signature, which can effectively resist the collusion attack between the cloud server and multiple key servers. Furthermore, we prove that our construction can achieve the desired security properties.     

基于Google云计算的Web应用与开发

云计算作为一种以互联网为中心的新兴计算技术,将会越来越多地推动Web服务模式的变革和发展.针对云计算应用技术问题,在讨论Google云计算服务体系架构、实现机制和算法流程的基础上,以Google App Engine开发平台为例,给出了如何利用集成环境设计、部署一个Web应用服务,并通过一个web应用服务实例,提出了G...     

Privacy preserving and transactional advertising for mobile services

The many sensors embedded in phones nowadays provide advanced sensing capabilities that make it possible to capture real-time information about the user and his surroundings. There are already examples of apps/services that use this information to provide highly useful and contextual advertisements to the users. However, users are still reluctant to share their personal data with advertisers due to their privacy implications (if misused). In this work, we provide protocols that allow users to store their sensor data on third party (untrusted) cloud servers. The data is stored in encrypted form, hence protected from the cloud provider. The advertisements are also stored on the server. They are customized to potential users. The server selects the advertisements appropriate to the users, based on their sensor values, and forwards them to the users. We consider two cases: (i) appropriate advertisements are sent to individual users automatically; and (ii) advertisements are sent to groups of users after getting permission from the group members. In both cases, the concurrency control protocols performed by the cloud provider ensure that the data and advertisements are ‘fresh and consistent’. This is to avoid situations where served advertisements are not in sync with the user’s current context or the advertisements have already expired. The above is achieved by integrating transactional and cryptographic primitives, such as atomic uploads, optimistic concurrency control, searchable encryption and homomorphic encryption. Finally, experimental results are given to illustrate the practical feasibility and scalability of the proposed protocols.