可信物联网架构模型

物联网已经在世界范围内得到了广泛的关注和发展,其安全性也面临严重威胁。然而由于物联网本身的特性,很多在互联网领域的安全措施不能直接照搬过来。目前的安全策略主要是针对物联网受到的威胁逐一寻找解决方案,协同机制分散。面对日益智能化、系统化、综合化的安全威胁,提出一种三元两层的可信物联网架构,根据物联网的功能设计一种全程可信安全机制,从传感器设备的软件及硬件的完整性和安全性检查开始,将可信链依次传递,直到应用层,并在应用层根据行为可信实现数据的处理和应用。同时将控制功能和数据功能分开,不同的安全策略之间相互协作、相互检验,从而有效提高物联网应对安全威胁的能力。     

可证明安全的可信网络存储协议

提出了一种高效的可信网络存储协议,协议只需两轮交互就实现了服务器与用户间的身份认证和密钥协商,同时在协议的第一轮交互中实现了对客户端平台身份的认证和平台完整性校验,改进了原来系统服务器遭受攻击易导致整个系统瘫痪的缺点,提高了系统的可靠性和协议的执行效率,在此基础上建立了用户与智能磁盘间的安全信道。最后利用CK模型证明了协议是SK安全的,用户与磁盘间的信道是安全信道,提高了系统数据的保密性、完整性和不可抵赖性。     

跨平台的可信执行环境模块方案研究

针对现有TPM、MTM等可信计算模块不能跨平台使用,未考虑算法、协议、功能更新等问题,提出一种基于硬件的可信执行环境模块（TEEM, trusted execution environment module）架构,该架构利用ARM TrustZone技术构建一个运行在硬件安全隔离环境中的可信计算模块。该模块能够为多种平台提供可信计算功能,具备较强的移动性和便携性,并且允许用户根据需要灵活地配置、升级模块的功能和算法。设计并实现了基于TEEM架构的原型系统,原型系统的安全性分析和性能测试结果表明,TEEM能够为用户提供一个安全、稳定、高效的可信执行环境。     

基于TCM的国产可信计算机的设计

当前可信计算机研究大多是基于国外TCG的TPM技术,使用国产关键软硬件研制自主可信计算机成为必要.提出基于国产可信芯片、采用龙芯处理器、支持中标麒麟操作系统的可信计算机的设计,并从软件、硬件和BIOS设计三个方面具体阐述了设计方法.IC卡密钥加载、基于USB-Key的用户身份认证以及系统的完整性度量,共同保证了系统资源的安全可信.     

无可信中心的门限追踪ad hoc网络匿名认证

为解决ad hoc网络中的匿名认证问题,将民主签名与无中心的秘密分享方案相结合,提出一种无可信中心的门限追踪ad hoc网络匿名认证方案。方案的无中心性、自组织性很好地满足了ad hoc网络的特征,从而解决了传统网络中匿名认证方案由于需要可信中心而不适合ad hoc网络的问题;方案中认证者的匿名性、可追踪性和完备性(不可冒充性)满足了匿名认证的安全需求。     

Efficient ID-based TPM key loading scheme for trusted platform

One important function in trusted computing is protected storage,which can protect unlimited amount of data and keys.In the existing trusted platform module(TPM)key loading scheme for trusted platform,a computing platform with TPM as its trusted anchor,the total times of loading operation is the same as the number of the loaded target object's ancestors,resulting in low efficiency of loading a TPM key which has many ancestors.To improve efficiency,an identity-based TPM key loading scheme is proposed.In this scheme,the times of loading operation is only two when any TPM key is loaded into TPM.Therefore,the required time cost for loading a TPM key can be reduced,especially for complex TPM key storage hierarchy.By analyzing the correctness,security,efficiency and feasibility,the proposed scheme has the better theoretical and application value.     

基于区块链的社会物联网可信服务管理框架

针对当前社会物联网可信服务管理中存在的中心化程度高、交易不透明和易受攻击等问题,提出了一种基于区块链的社会物联网可信服务管理框架。该框架通过区块链的去中心化特性在服务请求者和服务提供者之间直接建立信任关系,利用智能合约产生并管理新的交易,实现交易过程透明化并减少管理维护成本。同时,区块链的共识机制可用于交易验证并防范恶意攻击和篡改,减少网络攻击和恶意节点的欺骗。最后,分析了该框架在实际构建中面临的主要挑战。     

没有SDC的(t，n)门限秘密共享方案

利用椭圆曲线离散问题对数问题的难解性,给出了基于椭圆曲线密码体制的(t,n)门限秘密共享方案。基于门限秘密共享方案一般分为需要SDC和不需要SDC两类,在分布式环境下,一个被所有成员信任的SDC并不存在,不需要SDC的门限秘密共享方案的安全性得到很大的提高,该方案中由组成员共同生成群公钥和私有密钥。并给出了当新成员加入时,无SDC下的周期密钥分片的更新方案。还给出了一个本方案数据实例,最后对本方案的安全性进行了分析。     

高校课程资源网络共享平台的构建

高校的课程资源主要包括课程教学录像、演示文稿等基本资源,以及案例库、专题讲座库等拓展资源,资源数量大,管理困难,因此实现课程资源共享的关键,是设计一种合理的资源共享模型与资源共享方式,构建一个统一的高校课程资源网络共享平台,以实现课程资源的管理与共享。     

受信根证书管理中的安全漏洞与解决方法

对目前PKI体系中的证书信任模型和受信根证书的管理机制进行了分析,指出了受信根证书管理中存在的漏洞,并进一步详细分析了由于证书替换问题而引起的错误受信和信息泄漏。最后提出采用基于二进制签名树的受信根证书管理树来管理受信的根证书,并给出了受信根证书管理树生成和受信根证书验证的算法过程,这样受信根证书管理树不仅防止了受信根证书的替换问题,而且具有较小的存储量和根证书受信验证计算量。     

基于信誉积分的路况信息共享中共谋攻击节点检测方法

针对车联网中共谋节点可能协同发布虚假路况信息,导致路况信息共享过程中消息真实性无法保证的问题,提出了一种基于信誉积分的路况信息共享中共谋攻击节点检测方法.在路况信息聚合过程中,设计了恶意信息检测算法,能够检测到共谋节点发布的虚假消息,保证系统中传递消息的真实准确.安全性评估和实验表明,相比于现有方案,该方法对共谋节点的...     

An intelligent and privacy-enhanced data sharing strategy for blockchain-empowered Internet of Things

With the development of the Internet of Things (IoT), the massive data sharing between IoT devices improves the Quality of Service (QoS) and user experience in various IoT applications. However, data sharing may cause serious privacy leakages to data providers. To address this problem, in this study, data sharing is realized through model sharing, based on which a secure data sharing mechanism, called BP2P-FL, is proposed using peer-to-peer federated learning with the privacy protection of data providers. In addition, by introducing the blockchain to the data sharing, every training process is recorded to ensure that data providers offer high-quality data. For further privacy protection, the differential privacy technology is used to disturb the global data sharing model. The experimental results show that BP2P-FL has high accuracy and feasibility in the data sharing of various IoT applications.     

无人机协作通信系统中基于区块链的频谱共享机制

为解决无人机与蜂窝网络在协作频谱共享中的激励与安全问题,提出了一种基于区块链的频谱共享机制。首先,为保证无人机在协作过程中的可靠性和真实性,采用基于信誉的赢家判决方法和维克里（Vickery）拍卖的付款规则,在保证无人机通信最小速率前提下提出最大化蜂窝网络传输容量的优化方案。其次,为避免集中机构带来隐私泄露等危险,提出基于区块链的拍卖框架,使用区块链存储并更新无人机的信誉值,并使用智能合约功能来验证和执行拍卖。最后,通过仿真验证区块链的防篡改性,表明所提机制具有激励兼容性并能提升蜂窝网络的传输容量,且与其他方案相比具有较低的协作中断百分比和较好的公平性。     

四网协同下的多频共用一体化天馈设计

本文通过超宽带天线振子、馈电网络的研究,结合差分进化与遗传退火优化算法,提出了GSM、TD-SCDMA和LTE的一体化天馈系统综合解决方案,实现了四网协同下的多频共用一体化天馈设计,可节约大量的支撑设备、传输设备投入,为运营商多网络天馈建设提供了有效的设计方法。     

Endogenous security architecture of Ethernet switch based on mimic defense

Aiming at the unknown vulnerabilities and unknown backdoor security threats faced by Ethernet switches,a switch endogenous security architecture based on mimicry defense theory was proposed.The theoretical basis,construction mode and security mechanism of the architecture ware introduced,the algorithm strategy and security improvement effect of TAMA algorithm were proposed and analyzed,a prototype of mimic switch was designed and implemented,and the security tests of white box stuffing and attack chain were carried out.Theoretical analysis and test results show that the architecture has good unknown vulnerabilities and unknown backdoor defense capabilities in various attack scenarios.     

面向6G的雾无线接入网内生安全数据共享机制研究

为解决6G移动通信系统中雾无线接入网中数据共享的数据安全问题,提出了一种实现本地差分隐私和动态批量审计的内生安全数据共享机制.首先,用户本地对数据运行RAPPOR算法保护数据隐私;其次,雾接入点对数据进行缓存和预处理;再次,大功率节点对雾接入点上的数据进行基于BLS签名和Merkle哈希树的数据完整性审计;最后,BBU...     

Learning an attention-aware parallel sharing network for facial attribute recognition

Existing multi-task learning based facial attribute recognition (FAR) methods usually employ the serial sharing network, where the high-level global features are used for attribute prediction. However, the shared low-level features with valuable spatial information are not well exploited for multiple tasks. This paper proposes a novel Attention-aware Parallel Sharing network termed APS for effective FAR. To make full use of the shared low-level features, the task-specific sub-networks can adaptively extract important features from each block of the shared sub-network. Furthermore, an effective attention mechanism with multi-feature soft-alignment modules is employed to evaluate the compatibility of the local and global features from the different network levels for discriminating attributes. In addition, an adaptive Focal loss penalty scheme is developed to automatically assign weights to handle the problems of class imbalance and hard example mining for FAR. Experiments demonstrate that the proposed method achieves better performance than the state-of-the-art FAR methods.     

6G oriented blockchain based Internet of things data sharing and storage mechanism

Considering the heterogeneity of various IoT system and the single point failure of centralized data-processing platform,a decentralized IoT data sharing and storage method based on blockchain technology was proposed.The block consensus and decentralized storage of shared data were realized through the PoS consensus mechanism.A block layered propagation mechanism between consensus node and verified node was proposed based on the Gossip protocol.The block propagation delay model and decentralization evaluation model of blockchain networks were derived.The trade-off between the block propagation delay and the decentralization degree of networks was analyzed.The simulation results demonstrate that the block propagation delay and degree of network decentralization decrease with the increase of minimal capabilities of consensus nodes.As an application example,in the trajectory data sharing scenario of confirmed patients,the data sharing smart contract is implemented and tested based on the Ethereum development platform.     

An integrated network/storage architecture for sharing high-quality broadcast TV contents

With the advent of personal video recorders (PVRs), the way people watch TV is rapidly changing. By recording or time-shifting live TV programs into the embedded-disk storage of a PVR, people can watch what they want independent of the broadcasting schedule. Furthermore, peer-to-peer networking technology provides an additional TV content distribution channel to unidirectional broadcasting. However, due to the current limited broadband bandwidth, it is difficult to support high-quality TV content streaming between PVRs on the Internet. In this article we propose novel integrated network/storage architecture to provide the streaming of high-quality broadcast TV contents over fast network connections. To take full advantage of our system resources, we also develop efficient sharing schemes such as matching of a communication pair and channel assignment for extensive time-shifting.     

5G网络共建共享模式

随着5G 的大规模部署,5G网络设备单价高、建设投资大,设备功耗大、运营成本高的问题日益突出,在高质量建设的同时,提升 5G 网络的运行效率和效益,共建共享成为运营商探索网络建设和运营的新模式。从网络架构、频率使用等方面,对5G网络共建共享进行了深入分析,提出了独立载波、共享载波、异网漫游3种网络共建共享技术方案,针对各方案进行了优缺点对比和适用场景分析,并指出当前面临的挑战,总结如何选择合理的部署方式推进共建共享。