因特网密钥交换协议研究

密钥交换协议是密码协议中主要的一类协议，安全可靠的密钥交换是通信安全性的基础，因特网密钥交换协议IKE作为IPSEC协议族的关键组成部分，在因特网的安全通信和安全服务中发挥着非常重要的作用，成为密码协议分析和研究的一个热点。该文首先介绍IKE协议，然后对协议中一种具体的密钥交换模式的安全性使用逻辑方法进行证明，并得出关于协议正确性的结论。     

基于IP的端到端安全传输模型的设计与实现

该文针对TCP/IP协议的特点,提出了一种基于IP的端到端加密传输机制。通过修改操作系统的IP协议软件,应用对称密码技术对IP数据报进行加密/解密处理,使得网络中传输的IP数据报只有通信双方能够识别,可以为互联网络上两台主机之间提供加密的安全通信。安全管理工作由独立的安全服务器完成,采用公钥密码技术向安全客户端传输安全通信所使用的对称密钥。与现有的安全通信技术相比,这种机制具有思想简单、易于实现,对IP以上层协议软件和应用程序完全透明等优点。     

DeTRACT: a decentralized,transparent, immutable and open PKI certificate framework

International Journal of Information Security - Public key infrastructure (PKI) is widely used over the Internet to secure and to encrypt communication among parties. PKI involves digital...     

Security flaws of remote user access over insecure networks

Remote user authentication based on passwords over untrusted networks is the conventional method of authentication in the Internet and mobile communication environments. Typical secure remote user access solutions rely on pre-established secure cryptographic keys, public-key infrastructure, or secure hardware. Recently, Peyravian and Jeffries proposed password-based protocols for remote user authentication, password change, and session key establishment over insecure networks without requiring any additional private- or public-key infrastructure. In this paper we point out security flaws of Peyravian–Jeffries’s protocols against off-line password guessing attacks and Denial-of-Service attacks.     

模糊控制在网络安全协议中的应用

随着目前网上商务的发展，安全已变得越来越重要。网景公司开发出的安全套接字协议(Secure Sockets Layer Protocol，SSL)很好地实现了这一点，同时它也是在电子商务及网络安全通讯中使用的最为广泛的安全协议。然而，SSL协议本身还有一些不足和有待改进的地方，本文深入地研究分析了SSL协议的原理和存在的问题，给出了相应改进方案，并用模糊控制算法将这些改进方案应用于SSL协议中，模拟试验表明，改进的SSL协议具有明显的优点。     

Network smart card review and analysis

Smart cards are secure tokens that have provided security services to a wide range of applications for over thirty years. Along with other technology advances, smart card technology has changed dramatically as well. However, its communication standards, largely unchanged, do not match with those of mainstream computing, which has limited its success in the Internet age. For nearly a decade, researchers have sought to connect smart cards to the Internet. The benefits are plentiful, including providing services over the Internet and eliminating smart card specific infrastructure. A key to this quest is to equip smart cards with a secure and effective networking capability. Various approaches have been taken to find this key. There is still much work to do. This paper reviews years of research in this area, looks at the state of the art, and analyzes and compares various networking options for smart cards. Furthermore, the paper outlines remaining technical challenges for making smart cards a part of the Internet world.     

Keycorp scoops Norwegian lottery contract

The Norwegian State Lottery, Norsk Tipping, is to issue 2.1 million multi-application smart cards to all its users as part of a major national e-commerce project. The scheme will allow the purchase of lottery tickets and betting on sporting events through Norsk Tipping's network of agents or over the Internet. In addition, the cards will enable secure access to a number of online public services, as well as allowing secure identification and payment to other e-commerce providers.     

基于S/MIME的安全电子邮件系统的设计与实现

Internet电子邮件的广泛使用使得电子邮件的安全成为值得关注的问题,分析了一种基于S/MIME的安全电子邮件系统的原理和结构,最后结合作者搭建的PKI安全平台,提出和实现了PKI与S/MIME的安全邮件解决方案,有效地解决了邮件的安全问题.     

Toward a more secure Internet

Lack of widely available Internet security has discouraged some commercial users. The author describes efforts to make cryptographic security more widely available and looks at efforts to secure the Internet infrastructure. Security capabilities must continue to evolve to meet increasingly sophisticated threats. The Internet community is now more aware of the importance of security. This awareness, coupled with new technology, should produce a much more secure Internet that is appropriate for widespread commercial use     

Applying military grade security to the Internet

The explosive growth witnessed in the Internet over the last few years has encouraged companies to connect to it and to offer services to their customers over it. Concerns about security are holding them back from all but the most restrictive connectivity.This paper explores the use of a military development, the Compartmented Mode Workstation in a commercial setting, as a platform that is secure enough to implement services that are accessed over the Internet. Two applications have been investigated in detail, a firewalled Domain Name System and a World Wide Web service with enhanced authentication. Finally, there is discussion of how other Internet-based services might benefit from the application of CMW technology.     

基于IPv6的Internet存储服务模型

针对用户对远程数据存储与异地数据备份的需求增加,提出一种基于IPv6协议的Internet存储服务模型。设计应用层的Internet存储访问协议,结合IPv6协议的安全性特点设计安全存储模型,为下一代互联网提供一种标准、安全的远程存储服务。     

基于XML实现安全数据交换服务

针对目前日益增长的互联网环境下多应用协同工作的系统运行模式,本文基于XML技术,采用PKI安全体系并结合SOAP技术的运用,设计并实现了一种安全、灵活的数据交换机制,能够为多个业务应用系统协同工作提供统一、安全的数据交换服务。     

SIP的VoWLAN通信平台设计与实现

如何将会话初始化协议（SIP）与现有的通信网络有机结合,提供安全可靠的数据及通信服务已成为当今的热点问题。VoIP应用也受到业界的持续关注。安全问题一直都是企业实施VoIP的一个阻碍。提出了一个基于SIP的VoWLAN通信平台,将各种语音服务构建于无线局域网之上。利用虚拟专用网(VPN)、数据加密技术、VLAN和防火墙等必要安全技术和策略,应对在系统中的安全威胁,实现了通话质量可靠、安全性高的企业级VoIP无线网络架构。描述了该系统的设计和实现过程,讨论了其中的关键技术。     

透明的版权原子

针对有价值的数字内容不出现在互联网上的问题给出了一个完整的解决方案,并将它应用在联网电子图书出版上.互联网电子图书出版是一个重要的互联网应用,其中的关键问题是数字权利管理,先探讨了透明的版权原子的必要性,并提供了基于透明版权原子的集成的安全图书出版和网络发行的应用框架.分析了互联网电子图书技术生态系统的安全需求,同时给出了对于数字权利管理技术的DRM-C安全协议和透明的版权原子的设计,最后讨论了互联网电子图书出版中主要安全因素.     

Trusted Directory Services for Secure Internet Connectivity: Transport Layer Security using DNSSEC

The Internet today is a highly dynamic environment which frequently requires secure communication between peers that do not have a direct trust relationship. Current solutions for establishing trust often require static and application-specific Public Key Infrastructures (PKIs). This paper presents trusted directory services as a key infrastructural technology for setting up secure Internet connections, providing an alternative to application-specific PKIs. The directory securely binds public keys to peers through their names in a flexible way that matches the dynamic nature of the Internet. We elaborate on this concept by showing how the Domain Name System (DNS) and its security extensions (DNSSEC) can be leveraged for establishing secure Transport Layer Security (TLS) connections in a dynamic way. A simple enhancement of the TLS protocol, called Extended TLS (E-TLS), required for this purpose, is proposed. We describe our E-TLS implementation and we conclude with an evaluation of our results.     

一种安全通用的“互联网+电气自动化”工业互联网应用方法

如何将安全性要求高的电气自动化系统与开放性程度高的互联网实现深度融合,创造出“开放发展、安全可靠”的“互联网+电气自动化”工业互联网,一直是电气自动化工业发展的目标之一。介绍了一种通用、安全、开放的“互联网+电气自动化”工业互联网应用方法,该方法使用KEPServerEX软件与电气自动化设备通信并发布成通用OPC服务,然后通过软件和隔离装置实现自动化设备信息与互联网的正向隔离传输,最后开发移动APP实现开放安全的电气自动化工业互联网应用。     

Robust smart card secured authentication scheme on SIP using Elliptic Curve Cryptography

Recently, Voice over Internet Protocol (VoIP) has been one of the more popular applications in Internet technology. For VoIP and other IP applications, issues surrounding Session Initiation Protocol (SIP) have received significant attention. SIP is a widely used signaling protocol and is capable of operating on Internet Telephony, typically using Hyper Text Transport Protocol (HTTP) digest authentication protocol. Authentication is becoming increasingly crucial because it accesses the server when a user asks to use SIP services. In this paper, we concentrate on the security flaws in the current SIP authentication procedure. We propose a secure ECC-based authentication mechanism to conquer many forms of attacks in previous schemes. By a sophisticated analysis of the security of the ECC-based protocol, we show that it is suitable for applications with higher security requirements.     

PKI services for IPv6

A public key infrastructure (PKI) is a key component for most of the current and future secure communications architectures and distributed application environments. Thus, the process of migrating UMU-PKI to IPv6 is important for the successful deployment of IPv6 as a basic component of the future Internet. A recent European research project provides an ideal opportunity to migrate the Java-based UMU-PKI to IPv6 and build new security services over it.     

End-to-End Security Across Wired-Wireless Networks for Mobile Users

ABSTRACT

Recent advances in mobile computing and wireless communication technologies are enabling high mobility and flexibility of anytime, anywhere service access for mobile users. As a result, network connections of such users often span over heterogeneous networking environments consisting of wired and wireless networking technologies. Both network heterogeneity and user mobility make the securing of data transmission over heterogeneous networks challenging and complex. In this paper, we focus on the challenge of providing secure end-to-end network transmissions to wireless mobile users. To minimize service interruption during ongoing secure sessions of mobile users, we present the design and implementation of an approach based on the well-known Internet Protocol Security (IPSec) standard. We conducted a performance evaluation of our implementation using a Voice over IP (VoIP) application over an actual network testbed. Our empirical performance results demonstrate a packet loss improvement of 17% to 34% (for various VoIP packet sizes) and a handoff delay improvement of almost 24% validating the high efficiency of our proposed approach.     

移动智能终端安全即时通信方法

针对移动智能终端即时通信安全问题,提出了一种不可信互联网条件下移动智能终端安全通信方法。该方法设计并实现了一种在服务器和通信信道均不可信情况下的可信密钥协商协议。理论分析表明,所提出的密钥协商协议可以确保通信双方所协商会话密钥的真实性、新鲜性和机密性等诸多安全特性。密钥协商完成之后,基于透明加解密技术即可以确保即时通信双方语音/视频通信信息的机密性和完整性。真实移动互联网环境下的测试也表明该方法是高效和安全的,密钥协商可以在1~2 s完成,攻击者无法获取即时通信的明文信息。