Windows NT/2000 口令文件安全

一、Windows NT/2000口令文件的存放位置 口令文件是系统安全的基础。每个操作系统都维护一个口令文件(或称为口令数据库),用以鉴别用户的登录身份。在Windows NT/2000系统中,安全账号管理器SAM(Security Accounts Manager)就是口令文件,它一般存放在％systemroot％\system32\config目录下,此目录在操作系统运行过程中是上锁的。SAM含有本地系统或所在控制域(假设该主机是一台域控制器)上所有用户的用户名和用户口令的单向散列(Hash)函数值,也就是说并没有存放实际的用户口令或加密的口令。     

抗凭证泄露攻击的图形口令认证方案

图形口令既可以减轻用户记忆传统文本口令的负担, 又可以简化用户输入口令的步骤, 近年来, 广泛应用于移动设备的用户认证. 现有的图形口令认证方案面临严峻的安全问题. 首先, 图形口令容易遭受肩窥攻击: 用户的登录过程被攻击者通过眼睛或者摄像头等方式偷窥导致图形口令泄露. 更为严重的是, 这类认证方案不能抵抗凭证泄露攻击: 服务器存储与用户图形口令有关的认证凭证并利用其验证用户身份, 攻击者如果得到服务器保存的凭证就可以通过离线口令猜测攻击恢复用户图形口令. 为了解决上述问题, 提出了一个安全的图形口令认证方案(GADL). GADL方案通过将随机的挑战值嵌入到用户的图形口令来抵御肩窥攻击, 因此攻击者即使捕获了用户的登录信息也无法得到用户图形口令. 为了解决服务器凭证数据库泄露问题, GADL方案采用了一种确定性的门限盲签名技术来保护用户图形口令. 该技术利用多个密钥服务器来协助用户生成凭证, 使得攻击者即使获得凭证也无法实施离线猜测攻击来获得用户口令. 给出的安全性分析证明了GADL方案可以抵抗上述攻击. 此外, 给出了全面的性能分析表明GADL方案在计算、存储和通信开销这3个方面性能较高, 且在移动设备上易于部署.     

ORACLE数据库用户口令和角色管理策略及改进

用户口令的保密性不高，造成口令的泄露以及在MIS系统中存在的应用系统和数据库系统用户权限管理不统一的问题．都给数据库的安奎带来安全隐患。通过存储过程、函数、程序包和RBAC技术实现了ORACLE数据库用户口令的安全和前后台用户权限的统一。     

解密ACCESS数据库保护口令

用过ACCESS的用户都知道,为了保护数据库不被别人打开,可以在菜单的工具栏中安全一项设置数据库密码,在下次打开该数据库时就会询问口令,只有正确输入口令才能打开该数据库,否则拒绝打开,这样可以防止数据库被修改、浏览等。但是如果我们忘记了口令,就连创建数据库的用户本人也不能打开该数据库,将自己拒之门外,     

基于短信的动态口令系统方案

通过研究基于口令的身份认证系统,设计了基于手机短信平台的一次一用动态口令系统方案.系统由控制中心、用户数据库、口令生成模块、短信模块和应用服务模块等5个部分构成.论述了方案的组成原理、工作流程,分析了系统的安全性.分析表明,方案具有安全性高、适用面广、用户使用方便和实现成本低的特点.     

sybase数据库“sa”口令遗忘处理办法

我们都知道“sa”是sybase数据库的超级用户,许多数据库的管理工作都需要以“sa”登录,同时对整个数据库拥有最大的特权,因而“sa”的口令对于数据库管理员来说非常重要。但是有时我们忘记了“sa”的口令,那该怎么办?实际的工作中我积累了以下几个处理方法,特拿出来与大家一起研讨。 1.数据库中有另外一个特权用户,并拥有sso角色。则可用以下命令修改(我们设该用户为“operater”,口令为“operater_password”,“sa”     

UNIFY数据库忘掉口令后的处理

UNIFY/ACCELL数据库口令密码(尤其系统级的口令密码)的维护,往往只是一个人。当掌握数据库密码的人遗忘口令密码或出现意外,会造成UNIFY数据库无法打开,将给工作带来麻烦和损失。针对此问题,笔者通过对UNIFY数据库系统文件进行分析,发现可以用下述一些方法解除UNIFY数据库的口令密码。 方法一 一般UNIFY数据库应用系统,在运用UNIFY数据库系统设计与生成数据库结束后,数据结构和密码都存在数据库系统的当前目录下的unify.db文件中,应用数据则存放在file.db文件中。这样我     

Oracle 10g数据库安全策略研究

本文对Oracle 10g数据库的安全机制进行了研究,深入分析了用户认证、用户安全域设置、用户资源限制、权限分配、角色管理、口令管理策略、审计策略、标签安全等数据安全技术.     

删除“SA”口令

使用SYBASE数据库的人士都知道,SYBASE SQL SERVER 10以后的版本中的‘SA’户的口令在系统安装成功后默认为空的。如果系统管理员给‘SA’用户(或一般用户)设置了口令,那么从此后系统管理员只能修改此口令而不能删除。但是,用户的     

建立动态安全的用户口令的一种方法

在我们使用数据库语言(如xbase,FoxPro等)开发应用软件时,常因该应用系统安全性的需要而须为用户设置操作口令。简单的方法是将用户的键入与程序中一特定的字符串相比较,作口令真伪的鉴别,如此的口令被程序员在程序中建立,不宜根椐用户的需要而变更,而且因其固定静态而缺乏安全性,因此在实践应用中并不可取。为此笔者考虑采用加密的方法由用户自行将口令建立在一个数据库中,又利用随     

Only connect: teaching, technology and telesis

Abstract This paper describes an approach to the design of interactive multimedia materials being developed in a European Community project. The developmental process is seen as a dialogue between technologists and teachers. This dialogue is often problematic because of the differences in training, experience and culture between them. Conditions needed for fruitful dialogue are described and the generic model for learning design used in the project is explained.     

European Community policy and the market

Abstract This paper starts with some reflections on the policy considerations and priorities which are shaping European Commission (EC) research programmes. Then it attempts to position the current projects which seek to capitalise on information and communications technologies for learning in relation to these priorities and the apparent realities of the marketplace. It concludes that while there are grounds to be optimistic about the contribution EC programmes can make to the efficiency and standard of education and training, they are still too technology driven.     

一种自适应子融合集成多分类器方法

融合集成方法已经广泛应用在模式识别领域,然而一些基分类器实时性能稳定性较差,导致多分类器融合性能差,针对上述问题本文提出了一种新的基于多分类器的子融合集成分类器系统。该方法考虑在度量层融合层次之上通过对各类基多分类器进行动态选择,票数最多的类别作为融合系统中对特征向量识别的类别,构成一种新的自适应子融合集成分类器方法。实验表明,该方法比传统的分类器以及分类融合方法识别准确率明显更高,具有更好的鲁棒性。     

Avoiding semantic and temporal gaps in developing software intensive systems

Development of software intensive systems (systems) in practice involves a series of self-contained phases for the lifecycle of a system. Semantic and temporal gaps, which occur among phases and among developer disciplines within and across phases, hinder the ongoing development of a system because of the interdependencies among phases and among disciplines. Such gaps are magnified among systems that are developed at different times by different development teams, which may limit reuse of artifacts of systems development and interoperability among the systems. This article discusses such gaps and a systems development process for avoiding them.     

Designing economic np control charts: A programmed simulation approach

This paper presents control charts models and the necessary simulation software for the location of economic values of the control parameters. The simulation program is written in FORTRAN, requires only 10K of main storage, and can run on most mini and micro computers. Two models are presented - one describes the process when it is operating at full capacity and the other when the process is operating under capacity. The models allow the product quality to deteriorate to a further level before an existing out-of-control state is detected, and they can also be used in situations where no prior knowledge exists of the out-of-control causes and the resulting proportion defectives.     

The development of robot art

Going through a few examples of robot artists who are recognized worldwide, we try to analyze the deepest meaning of what is called “robot art” and the related art field definition. We also try to highlight its well-marked borders, such as kinetic sculptures, kinetic art, cyber art, and cyberpunk. A brief excursion into the importance of the context, the message, and its semiotics is also provided, case by case, together with a few hints on the history of this discipline in the light of an artistic perspective. Therefore, the aim of this article is to try to summarize the main characteristics that might classify robot art as a unique and innovative discipline, and to track down some of the principles by which a robotic artifact can or cannot be considered an art piece in terms of social, cultural, and strictly artistic interest. This work was presented in part at the 13th International Symposium on Artificial Life and Robotics, Oita, Japan, January 31–February 2, 2008     

Explanation and prediction: an architecture for default and abductive reasoning

Although there are many arguments that logic is an appropriate tool for artificial intelligence, there has been a perceived problem with the monotonicity of classical logic. This paper elaborates on the idea that reasoning should be viewed as theory formation where logic tells us the consequences of our assumptions. The two activities of predicting what is expected to be true and explaining observations are considered in a simple theory formation framework. Properties of each activity are discussed, along with a number of proposals as to what should be predicted or accepted as reasonable explanations. An architecture is proposed to combine explanation and prediction into one coherent framework. Algorithms used to implement the system as well as examples from a running implementation are given.     

Three Process Perspectives: Organizations, Teams, and People

This paper provides the author's personal views and perspectives on software process improvement. Starting with his first work on technology assessment in IBM over 20 years ago, Watts Humphrey describes the process improvement work he has been directly involved in. This includes the development of the early process assessment methods, the original design of the CMM, and the introduction of the Personal Software Process (PSP)^SM and Team Software Process (TSP){^SM}. In addition to describing the original motivation for this work, the author also reviews many of the problems he and his associates encountered and why they solved them the way they did. He also comments on the outstanding issues and likely directions for future work. Finally, this work has built on the experiences and contributions of many people. Mr. Humphrey only describes work that he was personally involved in and he names many of the key contributors. However, so many people have been involved in this work that a full list of the important participants would be impractical.     

基于复小波噪声方差显著修正的SAR图像去噪

提出了一种基于复小波域统计建模与噪声方差估计显著性修正相结合的合成孔径雷达(Synthetic Aperture Radar,SAR)图像斑点噪声滤波方法。该方法首先通过对数变换将乘性噪声模型转化为加性噪声模型,然后对变换后的图像进行双树复小波变换(Dualtree Complex Wavelet Transform,DCWT),并对复数小波系数的统计分布进行建模。在此先验分布的基础上,通过运用贝叶斯估计方法从含噪系数中恢复原始系数,达到滤除噪声的目的。实验结果表明该方法在去除噪声的同时保留了图像的细节信息,取得了很好的降噪效果。     

How do children do mathematics with LOGO?

Abstract  This paper considers some results of a study designed to investigate the kinds of mathematical activity undertaken by children (aged between 8 and 11) as they learned to program in LOGO. A model of learning modes is proposed, which attempts to describe the ways in which children used and acquired understanding of the programming/mathematical concepts involved. The remainder of the paper is concerned with discussing the validity and limitations of the model, and its implications for further research and curriculum development.