一种基于系统安全性差距分析的风险评估尺度和方法

本文提出一种基于信息系统安全性分析来定量计算信息安全风险的度量尺度，差距分析方法及相应的评估流程．通过差距分析法，可以定量地度量信息安全目的和安全现状的在安全保障控制措施和安全保障能力两方面差距，从而改进对信息安全的分析和设计以及如何提升信息安全保障能力．通过本文定义并计算整体信息安全风险度量尺度，还可以计算不同安全控制措施的产生的安全边际效益，进行安全投入产出效益分析．这种可计算的信息安全风险评估尺度和方法的有效性在实际工程中得到应用与检验．     

Simplifying network administration using policy-based management

The management of network infrastructure in an enterprise is a complex and. daunting affair. In an era of increasing technical cornplexity, it is becoming difficult to find trained personnel who can manage the new features introduced into the various servers, routers, and switches. Policy-based network management provides a means by which the administration process can be simplified and largely automated. In this article we look at a general policy-based architecture that can be used to simplify several new technologies emerging in the context of IP networks. We explain how network administration can be simplified by defining two levels of policies, a business level and a technology level. We discuss how business-level policies are validated and transformed into technology-level policies, and present some algorithms that can be used to check for policy conflicts and unreachable policies. We then show how to apply this architecture to two areas: managing performance service level agreements, and supporting enterprise extranets using IPSec communication     

基于可视化的安全态势感知

可视化技术为安全态势感知、大规模网络安全预警提供了十分现实的解决方法.人作为信息保障的一个重要环节,可视化技术提供了让人有效参与安全态势分析并做出正确决策的有效途经.文章重点研究了基于业务影响度进行安全态势评估的方法,并提出多种3D可视化模型进行相关数据的分析和展现,从不同的角度加强人对安全态势的感知能力.最后给出构建安全感知系统所经常采用的体系结构和数据流程.     

大型煤业集团信息安全体系设计

大型煤业集团信息系统是由众多子系统所组成的大规模、跨地域、异构和多业务的复杂大系统,它的安全是多因素和动态的。本文根据信息保障技术框架和信息安全风险管理的流程、方法,同时结合煤业集团的实际情况,以“纵深防御”的思想为出发点,通过构建信息安全管理体系和技术体系来保障系统的安全。     

Workflow-enabled distributed component-based information architecture for digital medical imaging enterprises

Few information systems today offer a flexible means to define and manage the automated part of radiology processes, which provide clinical imaging services for the entire healthcare organization. Even fewer of them provide a coherent architecture that can easily cope with heterogeneity and inevitable local adaptation of applications and can integrate clinical and administrative information to aid better clinical, operational, and business decisions. We describe an innovative enterprise architecture of image information management systems to fill the needs. Such a system is based on the interplay of production workflow management, distributed object computing, Java and Web techniques, and in-depth domain knowledge in radiology operations. Our design adapts the approach of "4+1" architectural view. In this new architecture, PACS and RIS become one while the user interaction can be automated by customized workflow process. Clinical service applications are implemented as active components. They can be reasonably substituted by applications of local adaptations and can be multiplied for fault tolerance and load balancing. Furthermore, the workflow-enabled digital radiology system would provide powerful query and statistical functions for managing resources and improving productivity. This paper will potentially lead to a new direction of image information management. We illustrate the innovative design with examples taken from an implemented system.     

RASSP Enterprise Technologies for Signal Processor Life-Cycle Support

Enterprise integration technologies are a key contributor to improving time-to-market, cost, and design quality by a factor, which is the goal of the DARPA Rapid Prototyping of Application-Specific Signal Processors (RASSP) program [1]. The Lockheed Martin Advanced Technology Laboratories (ATL) RASSP team developed a productivity improvement model, shown in Fig. 1, that indicates the relative contributions of various RASSP technologies to the overall improvement. Enterprise technologies address the entire 17% enterprise partition, and more than half of the 30% reuse and model-year architecture partition, thus accounting for at least 35% of the overall RASSP productivity improvement.The ATL RASSP approach to implement enterprise systems is to extend commercial technologies so the results are available to a broad base of potential users. Unlike current automation concepts which start at later stages of the development cycle, the RASSP enterprise system supports the entire signal processor life cycle. Core concepts of the enterprise system include:Tools and tool frameworks integrated into an enterprise environmentProgram execution control through workflowsIntegrated data management functionsDesign reuseConcurrent engineering team supportIntegrated design engineering and manufacturing.The model-year architecture, which enables users to rapidly, efficiently upgrade systems with new technology, is supported in the enterprise system by a robust reuse management system. Manufacturing interface and communication services elements of the enterprise system provide improved concurrent engineering support for distributed product teams. The enterprise system will be provided to commercial and aerospace users as products, including a reusable set of workflows for electronics design, commercial tools supporting the enterprise system environment, and utilities to enable users to customize the RASSP enterprise system for a particular organization or project.The enterprise system development cycle includes four build cycles with increasing capabilities. The ATL team completed the Build 2 implementation in May'96. This implementation supports the processes associated with detailed hardware/software design, architecture design, and trade-off analyses. It is being used at Lockheed Martin and multiple government sites for benchmarking and evaluation. Results to date indicate >5:1 productivity improvements in the manufacturing interface, and 5–10% improvements in design engineering, which is growing with increasing level of utilization.     

全球信息网格体系结构与企业级服务分析

作为网格计算发展的延伸，DoD提出的全球信息网格(GIG)是实现网络中心战的技术手段。GIG的体系结构可以通过其五层体系框架和作战视图、系统视图以及技术视图3个视图来描述。GIG通过企业级服务来支持网络中心战，企业级服务的领域功能都建立在发现、安全、中介、协作、存储、消息传送、企业级服务、应用以及帮助等核心企业级服务基础之上。介绍了网格以及全球信息网格的概念，分析了GIG的体系结构与企业级服务，最后指出了GIG的意义和面临解决的问题。     

电磁频谱管理仿真系统体系结构设计研究

体系结构对指导系统建设,保证系统满足应用需求,降低系统研制风险有着重大意义。在首次系统提出在建立电磁频谱管理仿真系统的基础上,针对仿真系统的多功能化和复杂化要求,创造性地提出运用体系结构设计方法完成电磁频谱管理仿真系统的顶层设计。进而在全面比较分析各国体系结构设计方法后,提出运用全视图、作战视图、系统视图、信息视图和技术标准视图五大视图的体系结构设计方法,完成了电磁频谱管理仿真系统的体系结构设计与描绘,为仿真系统的实现提供了参考。     

Information-centric assessment of software metrics practices

This paper presents an approach to enhance managerial usage of software metrics programs. The approach combines an organizational problem-solving process with a view on metrics programs as information media. A number of information-centric views are developed to engage key stakeholders in debating current metrics practices and identifying possible improvements. We present our experiences and results of using the approach at Software Inc., we offer comparisons to related approaches to software metrics, and we discuss how to use the information-centric approach for improvement purposes.     

Dealing with history and time in a distributed enterprise manager

A family of integrated systems has been developed within Digital's enterprise management architecture (EMA). The product called DECmcc is part of a larger EMA implementation, which consists of both an enterprise management director and a framework for developing consistent and integrated management solutions with EMA. An object-based framework provides time-oriented dispatching of operations and serves as a foundation for modules supporting past, present, and future time views of managed objects. Fully integrated modules implement a conceptual diachronic object-base that allows time-oriented, object-based modeling of resources. To maintain the historical part of this diachronic object base, DECmcc provides comprehensive facilities for collecting, processing, purging, archiving, and exporting historical attribute data. The managed object instances, for the existing objects that need to be globally and directly accessible, are stored using DECdns, i.e., essentially DCE/CDS. The historical data are stored on the domain basis locally. Recorded historical data and `live' enterprise data can be exported to a relational database in a uniform fashion for any combination of past time, current, and future data     

Assuring quality and reliability of complex electronic systems:hardware and software

Some of the most recent trends in expanding the scope of traditional quality-assurance techniques to include all phases of design, development, manufacture, and deployment, considering both hardware and software, are discussed. Emerging views on quality management are discussed. The life cycle of a product, beginning with the setting of requirements, and including assuring parts reliability, evaluating a fault-tolerant architecture, avoiding physical design hazards, enforcing software development methodology, measuring conformance to requirements in manufacture, and tracking performance in the field is considered. The author's goal is to review in a general way, what can be accomplished through use of the various assurance techniques with references given to examples from the literature, which gives historical background as well as teaches the technical methods in detail     

A new service provisioning method in the multimedia/B-ISDN era

In the coming multimedia/B-ISDN era, customers must be able to design, define, and manage communication services based on their own concepts and knowledge of communications. This article proposes a new concept, intelligent dynamic service provisioning (IDSP), offering customers this capability. Service views of customers and carriers for multimedia services are presented. Based on these views, we propose an architecture for the IDSP system. Finally, the basic mechanism of the IDSP system and the technical issues related to this system are examined     

Bringing Technological Frames to Work: How Previous Experience with Social Media Shapes the Technology's Meaning in an Organization

This study examines the expectations that workers have regarding enterprise social media (ESM). Using interviews with 58 employees at an organization implementing an ESM platform, we compare workers' views of the technology with those of existing workplace communication technologies and publicly available social media. We find individuals' frames regarding expectations and assumptions of social media are established through activities outside work settings and influence employees' views about the usefulness of ESM. Differences in technological frames regarding ESM were related to workers' age and level of personal social media use, but in directions contrary to expectations expressed in the literature. Findings emphasize how interpretations of technology may shift over time and across contexts in unique ways for different individuals.     

Trend of system level design and an approach to C-based design

System level design study group in EDA technical committee of JEITA has researched the trends of system level design technologies from various aspects of views so as to define an ideal design flow and methodology. The results of the investigations consist of (1) problems and requirements from system level designers (needs), (2) current status of system level design tools (seeds), (3) standardization activities for system level design languages, and so on. They also proposed a desirable system level design flow taking account of the needs and the seeds.In this paper, we introduce the summary of their works. After that, I describe an approach to a C-based architecture design, called Bach, which we have developed. The features of the Bach system are (1) C-based user language with untimed semantics which is suitable for large-scale circuit design, (2) a fast bit-accurate simulator at the C level, (3) a high level synthesizer which can compile a program describing the untimed behavior of hardware into RTL VHDL. Using the example of an MPEG-4 video codec design, we summarize its design flow and effects.     

AT&T's MPLS OAM architecture, experience, and evolution

This article provides an overview of AT&T's MPLS OAM architecture, and gives examples of operational experience. Hallmarks of the architecture are a single, converged, and integrated MPLS/optical network, and the evolution to fully automated, zero-touch network operation. The concept of one converged IP/MPLS architecture will reduce operations, development, and capital costs. The concept of zero aims to bring full automation for every human-to-computer interaction currently required for setting up and maintaining network services, delivering services to customers in real time with zero defects and cycle time, and supporting both a network as well as an operational environment with six nines reliability. This approach effectively opens the network to the customer, enabling new levels of customer network management, service creation, and ordering, and empowering enterprise customers with the tools to create their own network services as they transform their own internal networks. In the article we describe AT&T's MPLS-enabled services, the corresponding MPLS operations architecture (including MPLS MIBs), our MPLS OAM operational experience, and MPLS OAM evolution needs for MPLS MIB enhancements and new network capabilities. By applying technologies such as artificial intelligence, self-healing/self-identifying network elements, expert systems, rules-based processes, and automatic speech recognition, the architecture will migrate from a predictive network that monitors, correlates, and recommends action; to an adaptive network that monitors, correlates, and takes action; to a cybernated network that has integrated components that dynamically manage by business rules and policies. We give several examples of how AT&T is already investing in and implementing this future vision, and conclude by challenging network researchers, developers, and key industry players to apply new technologies in fully realizing the operational vision.     

XML-based data model and architecture for a knowledge-based grid-enabled problem-solving environment for high-throughput biological imaging.

High-throughput biological imaging uses automated imaging devices to collect a large number of microscopic images for analysis of biological systems and validation of scientific hypotheses. Efficient manipulation of these datasets for knowledge discovery requires high-performance computational resources, efficient storage, and automated tools for extracting and sharing such knowledge among different research sites. Newly emerging grid technologies provide powerful means for exploiting the full potential of these imaging techniques. Efficient utilization of grid resources requires the development of knowledge-based tools and services that combine domain knowledge with analysis algorithms. In this paper, we first investigate how grid infrastructure can facilitate high-throughput biological imaging research, and present an architecture for providing knowledge-based grid services for this field. We identify two levels of knowledge-based services. The first level provides tools for extracting spatiotemporal knowledge from image sets and the second level provides high-level knowledge management and reasoning services. We then present cellular imaging markup language, an extensible markup language-based language for modeling of biological images and representation of spatiotemporal knowledge. This scheme can be used for spatiotemporal event composition, matching, and automated knowledge extraction and representation for large biological imaging datasets. We demonstrate the expressive power of this formalism by means of different examples and extensive experimental results.     

Rethinking Enterprise Architecture for Sustainable Energy System Development

The development of a sustainable energy system throughout an enterprise is a complex task, which requires an agile holistic approach. Such an approach needs to include a variety of objectives including energy strategy formation and strategic decision-making, which are directly related to the analysis and management of the main areas of sustainable development:The economic, technological, environmental, and social. These multidimensional requirements of sustainability are often difficult to achieve within the enterprise, because these aspects are interrelated and influenced by various internal and external environment factors. This paper first reviews the main challenges for an energy system, and then demonstrates how a strategic agile enterprise architecture driven approach could effectively guide the sustainable energy system development. The study presented in this paper provides a holistic approach that contributes to the advancement and usage of literature dealing with issues of sustainable energy system development and agile enterprise architecture, which has not been discussed before to any great extent.     

Vertical integration of enterprise industrial systems utilizing web services

The need for interoperability is prominent in the industrial enterprise environment. Different applications and systems that cover the overall range of the industrial infrastructure from the field to the enterprise level need to interoperate. This quest is driven by the enterprise need for greater flexibility and for the wider possible integration of the enterprise systems. This paper presents a distributed system architecture that utilizes dominant state-of-the-art standard technologies, such as workflows, ontologies, and web services, in order to address the above quest in an efficient way.     

Implementing integrated and differentiated services for theInternet with ATM networks: a practical approach

This article reports on design, implementation, and preliminary experimentation of a network architecture that supports quality of service for Internet applications. It gives an overview of the various approaches toward communication networks that support application-specific degrees of QoS. Special emphasis is put on the integrated and differentiated services approaches and on combinations of them. A new architecture is described which aims to bring these concepts closer to practical realization in wide-area networks. The new architecture supports the integrated as well as differentiated services approaches in a smoothly integrated way, and uses the capabilities of an underlying ATM network to realize QoS. The enhancements to the existing network infrastructure are deliberately limited to the integration of a single new type of network element called an edge device. The potential benefits of such an architecture for various stakeholders are explained, and how the new architecture could be introduced smoothly in existing networks by small migration steps, also covering networks based on technologies other than ATM. It is shown that the approach can be scaled up to a very large QoS-aware overlay network for the Internet     

企业主机端口与服务监控及基线管理技术分析

本文详细阐述了企业主机实现端口与服务监控及基线管理的技术原理、逻辑结构、功能需求分析等内容,以提高对企业IT系统的安全保障水平和保障效率。