基于多层次区块链的医疗数据共享模型

基于区块链的医疗数据共享能够有效地提升医疗数据的可信性,但是面临着链上存储容量有限、缺乏数据隐私保护等问题。针对这些问题,提出一个基于多层次区块链的医疗数据共享模型。对个人医疗数据进行加密后上传到链下的分布式存储中,并将数据索引信息上传到链上,利用多层次区块链协同技术和链上链下混合存储方式提高存储效率;引入差分隐私保护联邦学习中模型参数,提升数据的隐私安全。实验结果表明,相对于以太坊而言,该方案机构存储开销平均下降了60%左右,用户存储开销平均下降30%左右。     

SAN异构存储共享系统实现技术研究

以SAN异构存储共享系统的实现技术为核心,提出了一个基于SAN的用户级应用型存储共享系统模型,无需改变开放系统内核,可利用开放系统的系统调用来优化磁盘I／O性能,易于实现、维护和移植。详细描述了系统的设计思想和实现方法,并重点对动态库模块进行了研究。在与日本某大公司的合作项目中已实现了该系统,性能评测表明其具有接近于本地存储系统的性能。     

基于区块链技术的航班协同运行保障系统架构设计

在民航领域的航班协同运行保障过程中,传统的信息共享方式存在数据外泄、记录篡改、数据难追溯、数据难监管、隐私难保护等问题,提出一种由机场、航空公司、空管以及地服公司协同参与的区块链架构——航班信息共享链架构。根据航班运行过程中的实际流程与需求,从层次结构、网络结构、访问事件监管机制与多通道设计四个方面设计该架构,进而形成一种新型航班协同运行保障系统架构。实验结果表明,该架构不仅能够满足航班协同运行保障系统需求,还减少了单节点存储容量,更好地实现了航班协同保障参与方之间的动态信息共享。     

Elastic Smart Contracts in Blockchains

In this paper, we deal with questions related to blockchains in complex Internet of Things (IoT)-based ecosystems. Such ecosystems are typically composed of IoT devices, edge devices, cloud computing software services, as well as people, who are decision makers in scenarios such as smart cities. Many decisions related to analytics can be based on data coming from IoT sensors, software services, and people. However, they are typically based on different levels of abstraction and granularity. This poses a number of challenges when multiple blockchains are used together with smart contracts. This work proposes to apply our concept of elasticity to smart contracts and thereby enabling analytics in and between multiple blockchains in the context of IoT. We propose a reference architecture for Elastic Smart Contracts and evaluate the approach in a smart city scenario, discussing the benefits in terms of performance and self-adaptability of our solution.      

ITS虚拟共用信息平台的数据集成包装器

针对ITS虚拟共用信息平台各子系统数据异构、分布存储的特点,采用异构数据集成模型,探讨了ITS虚拟共用信息平台的数据集成方案,并结合ITS虚拟共用信息平台的体系结构,设计了ITS虚拟共用信息平台的数据集成包装器,并对包装器时间中的关键技术以及包装器的具体实现过程进行了详细说明。     

新一代“生态网络云”大数据平台的设计与实现

【目的】构建高效的信息化云平台,是实现多源异构生态大数据仓储与开放共享的重要支撑手段。【方法】结合生态大数据的演变、国家科学数据政策的影响,按照科学数据全生命周期管理过程,分析了国家生态科学数据中心现有信息化平台面临的问题和挑战,尝试采用领域驱动设计方法,开展生态科学数据汇聚微服务拆分。【结果】基于“开放汇聚、协同管理、智慧服务”理念,提出了新一代“生态网络云”大数据平台（Eco-Cloud）的总体架构设计,结合当前需求从多源数据汇交、统一存储管理、数据加工与挖掘分析、服务与展现四个层次给出了主要系统组成及其应用场景。【结论】新平台有助于推动生态科学数据多源开放汇聚、资产化管理,提升生态科学数据分析能力与共享服务水平。     

基于区块链的数据安全共享网络体系研究

针对能源互联网企业内部与外间的数据共享过程中,存在集中部署访问受限、标识不唯一、易被窃取或篡改隐患等问题,影响到数据作为资产进行统一安全共享的效率.为此,结合区块链的去中心化、自主对等、难以更改的技术特征,构建基于区块链的数据安全共享网络体系,主要包括去集中化数据统一命名技术及服务、授权数据分布式高效存储和支持自主对等的数据高效分发协议.其次,设计了开放式数据索引命名结构,含一级基础ODIN和多级扩展ODIN,且阐述了开放数据索引命名运行机制.再次,基于ODIN技术,设计了基于ODIN的去中心化DNS的域名协议模块,为数据间P2P安全可信共享奠定基础.最后,针对基于ODIN的去中心DNS的功能进行验证,为实现企业内部及企业间的数据安全共享构建了一种可信网络环境.     

A Framework for Method-Specific Knowledge Compilation from Databases

Generality and scale are important but difficult issues in knowledge engineering. At the root of the difficulty lie two challenging issues: how to accumulate huge volumes of knowledge and how to support heterogeneous knowledge and processing. One approach to the first issue is to reuse legacy knowledge systems, integrate knowledge systems with legacy databases, and enable sharing of the databases by multiple knowledge systems. We present an architecture called HIPED for realizing this approach. HIPED converts the second issue above into a new form: how to convert data accessed from a legacy database into a form appropriate to the processing method used in a legacy knowledge system. One approach to this reformed issue is to use method-specific compilation of data into knowledge. We describe an experiment in which a legacy knowledge system called INTERACTIVE KRITIK is integrated with an ORACLE database. The experiment indicates the computational feasibility of method-specific data-to-knowledge compilation.     

基于分区型区块链医疗电子病历共享方案

针对基于传统区块链进行医疗数据共享时可扩展性受限制的问题,提出一种基于分片技术的区块链扩容共享方案.首先,基于跳跃一致性哈希算法进行周期性网络分片,通过随机划分全网节点大幅度降低单分片内女巫攻击的风险;其次,分片内使用可扩展的去中心化信任基础设施区块链(SBFT)共识协议以降低实用拜占庭容错(PBFT)共识协议的高通信...     

基于区块链的可溯源政务大数据共享方法研究

政务服务跨域协作是政府数字化转型和跨域治理相结合所催生的新型治理模式,是政务服务治理的价值目标。由于政府各部门的具体业务和功能不同,各部门都有一套独立的数据管理系统,且各信息化系统存储多样、数据格式复杂、业务流程各异。如何安全可靠地实现各个部门之间的数据共享已成为一项研究难点。传统政务数据共享通常采用集中式共享模式,该模式容易引发数据隐私泄露、部门权限混乱、单点故障等一系列问题。为解决上述问题,该文提出了一种属性基加密与区块链结合的政务数据共享方案。首先,由数据拥有者制定访问控制策略,对数据请求者的属性进行限制;然后,利用子集覆盖技术,实现数据安全共享中的细粒度访问控制及密钥更新,结合线性秘密共享,以实现访问策略的完全隐藏,采用星际文件系统分布式网络存储对称加密后的密文,以缓解区块链系统的存储压力;最后,利用 Keccak 算法对检索数据密文的哈希值进行重加密,实现数据的完整性验证。通过安全性分析和相关实验可知,该文所提方案在安全性和效率方面均能满足政务数据安全共享的需求,可实现政务数据的高效、安全和可溯源共享。     

SOA架构的分布式网络监管系统的设计与实现

为加强企业信息系统安全性所研发的基于广域网的大型分布式监控管理系统,采用SOA架构、WCF、NDIS-HOOK等技术及多线程机制,解决了分布式系统中各管理中心、终端之间多种数据同步、存储及共享等问题。实现了远程数据包的实时截获及过滤控制、广域网络中任意网段的流量检测、在线主机的实时统计、任意主机的动态端口监控等功能。分析了系统运行的效率问题,构建系统的轻装运行环境,使其具有良好的可靠性、实用性、开放性和易维护性。     

融入区块链技术的大数据征信平台的设计与应用研究

信用是一笔无形资产,良好的信用记录不仅可以带来更高的借款成功率和更低的借款利率,还可以让人们享受信用服务带来的便利。未来信用红利将会突显,但也伴随着个人隐私泄露、信用数据篡改、大数据征信商业化的合法边界不明确等问题。为营造一个良性的互联网信用生态环境,首先总结了现有征信平台中存在的问题,探讨并分析了采用新兴技术解决这些问题的可行性;然后融入区块链技术设计了一种辅助未来征信系统的多源数据共享框架;接着以区块链的多源数据共享为基础,应用人工智能、数据挖掘、智能合约等方法建立了多源异构数据融合的大数据征信平台;最后以互联网借贷为例,设计了一款基于大数据征信平台的去中心化借贷应用。     

基于XQuery的异构数据源查询处理

异构数据源的集成问题是当前数据处理领域内研究的热点,它能更有效地利用信息资源,更好地实现数据共享。介绍一种基于Mediator-Wrapper中间层的异构数据源集成系统框架,对XQuery查询处理过程及其关键问题,如查询分解和优化技术进行深入研究,并结合实例进一步说明异构数据源中查询分解和优化的具体实现。     

存储区域网络技术在数据处理中心的应用

随着高性能计算技术的发展,实现对大规模数据的高效存取已成为行业中提高系统整体性能的关键。传统的NFS存储架构,由于其I/O存取带宽低,容易造成TCP/IP局域网络的瓶颈,因此制约了系统整体性能的发挥。为了有效地缓解TCP/IP网络瓶颈,提高海量数据的访问效率,实现网络中各服务器节点对地震数据的共享,我中心自2004年起先后两次进行了存储区域网络的构建,并安装了ADIC公司的SNFS存储共享软件。本文重点介绍了存储区域网的构建、整合方法,并对存储共享软件SNFS的安装与配置做了简单介绍,对其它数据处理中心的存储区域网络构建和应用具有一定的借鉴作用。     

Object Organization on a Single Broadcast Channel in the Mobile Computing Environment

Advances in computation and communication technologies allow users to access computer networks, using portable computing devices via a wireless connection, while mobile. Furthermore, multidatabases offer practical means of managing information sharing from multiple preexisting heterogeneous databases. By superimposing the mobile computing environment onto the multidatabase system, a new computing environment is attained.In this work, we concentrate on the effects of the mobile-computing environment on query processing in multidatabases. We show how broadcasting, as a possible solution, would respond to current challenges such as bandwidth and storage limitations. Organizing data objects along a single-dimension broadcast channel should follow the semantic links assumed within the multiple-dimension objects' structure. Learning from our past experiences in objects organization on conventional storage mediums (disks), we propose schemes for organizing objects along a single broadcast air channel. The proposed schemes are simulated and analyzed.     

ShadowEth: Private Smart Contract on Public Blockchain

Blockchain is becoming popular as a distributed and reliable ledger which allows distrustful parties to transact safely without trusting third parties. Emerging blockchain systems like Ethereum support smart contracts where miners can run arbitrary user-defined programs. However, one of the biggest concerns about the blockchain and the smart contract is privacy, since all the transactions on the chain are exposed to the public. In this paper, we present ShadowEth, a system that leverages hardware enclave to ensure the confidentiality of smart contracts while keeping the integrity and availability based on existing public blockchains like Ethereum. ShadowEth establishes a confidential and secure platform protected by trusted execution environment (TEE) off the public blockchain for the execution and storage of private contracts. It only puts the process of verification on the blockchain. We provide a design of our system including a protocol of the cryptographic communication and verification and show the applicability and feasibility of ShadowEth by various case studies. We implement a prototype using the Intel SGX on the Ethereum network and analyze the security and availability of the system.     

Specification and enforcement of flexible security policy for active cooperation

Interoperation and services sharing among different systems are becoming new paradigms for enterprise collaboration. To keep ahead in strong competition environments, an enterprise should provide flexible and comprehensive services to partners and support active collaborations with partners and customers. Achieving such goals requires enterprises to specify and enforce flexible security policies for their information systems. Although the area of access control has been widely investigated, current approaches still do not support flexible security policies able to account for different weighs that typically characterize the various attributes of the requesting parties and transactions and reflect the access control criteria that are relevant for the enterprise. In this paper we propose a novel approach that addresses such flexibility requirements while at the same time reducing the complexity of security management. To support flexible policy specification, we define the notion of restraint rules for authorization management processes and introduce the concept of impact weight for the conditions in these restraint rules. We also introduce a new data structure for the encoding of the condition tree as well as the corresponding algorithm for efficiently evaluating conditions. Furthermore, we present a system architecture that implements above approach and supports interoperation among heterogeneous platforms.     

Secure sharing of Personal Health Records in cloud computing: Ciphertext-Policy Attribute-Based Signcryption

The sharing of Personal Health Records (PHR) in cloud computing is a promising platform of health information exchange. However, the storage of personal medical and health information is usually outsourced to some third parties which may result in the exposure of patients’ privacy to unauthorized individuals or organizations. In order to address this security loophole, we suggest a promising solution. We propose a new approach for fine-grained access control and secure sharing of signcrypted (sign-then-encrypt) data. We call our new primitive Ciphertext-Policy Attribute-Based Signcryption (CP-ABSC) which satisfies the requirements of cloud computing scenarios for PHR. CP-ABSC combines the merits of digital signature and encryption to provide confidentiality, authenticity, unforgeability, anonymity and collusion resistance. The correctness, security and efficiency of this scheme are also proven.     

一种基于自主附网存储的集群视频服务器

本文首先分析了集群视频服务器的研究现状,接着提出了一种新的基于自主附网存储的集群视频服务器,然后重点介绍了该服务器的体系结构和设计思想,并给出了系统性能 的测试数据。实践表明,这种服务器具有实现简单且性能优良的特点。