面向多租户的属性标签分层方案

Saa S模式中租户与服务商之间一直存在信任问题,将服务商与租户分开管理,借助标签跨域访问则存在效率瓶颈和标签安全的问题。利用属性特征结合标签,设计出一个针对多租户跨域访问的方法,将标签根据属性分类管理,再把跨域访问的权限赋予各属性标签,实现平台内通过属性标签的跨域访问。最后,通过实验和分析验证了该属性标签保护方法的高效性。     

面向服务的多租户访问控制模型研究

传统访问控制模型在多租户环境下无法满足租户之间的隔离访问以及对各租户的访问请求实行有效的统一管理的需求。为了在多租户环境下实现一套快速的、访问控制可配置的实施方案, 提出了一个面向服务的多租户访问控制模型。根据对多视图业务模型之间的关联进行分析, 识别出组织模型及其相关的资源模型。通过映射和转换将组织模型转换为面向服务的多租户访问控制模型, 并构建访问控制模块以配置和运行访问控制模型。最后以某交通物流信息平台为范例验证了该模型的可行性和有效性。验证结果表明, 模型能够在多租户环境下提供兼备快速配置与访问控制的实现支持。     

SaaS平台访问控制研究

Saas平台软件交付模式将应用软件以服务的形式提供给客户,可缩减硬件采购、系统管理上的开销。由于租户数据统一存储于服务提供商处,如何在维持较高资源利用率的同时保障租户的数据安全是一个挑战性问题。针对租户角色复杂、各租户数据共存而又独立访问的要求,结合基于角色的访问控制模型,构建了支持多租户、多角色、方便租户权限管理的SaaS平台的访问控制模型。和传统基于角色的访问控制模型相比,该模型增加了租户的概念,以租户为基本单元实施平台的访问控制,提高了SaaS平台访问控制的安全性和可管理性。分析了用户访问SaaS平台的具体流程,给出了模型的形式语言描述,实现了SaaS餐饮管理平台访问控制的数据库的物理模型,为SaaS平台开发提供参考。     

一种多租户授权管理访问控制模型

针对云服务中多租户应用面临越权访问和联合恶意攻击问题,综合聚类思想和基于密文策略的属性加密（CP-ABE）提出一种多租户授权管理访问控制模型（MTACM）。该模型根据多租户的业务特点将角色任务聚类为任务组,并采用匹配因子标记任务组,进而通过任务组授权管理角色属性,以实现角色的细粒度授权访问控制管理,减少系统计算量开销,降低系统的复杂度。在虚拟环境下实现了该模型算法,且通过逻辑推理证明了模型的安全性和系统访问的高效性。     

基于DIFC的租户自主授权SaaS层数据隔离与共享模型*

SaaS服务提供者对租户间提供数据共享服务时,容易造成租户数据的泄露,并且在租户未经许可的情况下,可以非法获取租户的隐私数据。针对上述SaaS服务的缺陷,本文引入了分布式信息流控制(DIFC)安全防护机制,提出了基于DIFC的租户自主授权SaaS层数据隔离与共享模型。该模型强制SaaS服务提供者执行标签比对机制,各租户可以自主划分用户信息级别,定制全球唯一标记。并通过第三方可信标签管理授权服务(AS),细粒度地限制租户间的数据共享操作,并必须经用户授权标签才能访问相应数据。最终本文证明了此模型可以满足租户数据隔离与共享的安全。     

一种基于Kerberos和HDFS的数据存储平台访问控制策略

重点关注云存储在访问安全性和隐私安全性上的两个问题,设计面向多租户的安全数据存储机制和用户访问控制机制,并结合企业实际需求,向租户提供安全、按需、实时和可扩展的存储服务。基于Kerberos的多租户访问控制策略将提升云存储平台的安全性,简化HDFS权限管理的复杂度,提高云存储平台权限管理的交互性能。     

基于角色映射和PBNM的多域安全访问控制模型

在分析多安全域间基于RBAC角色映射和PBNM模型的基础上,提出了多域用户之间的安全访问策略配置模型.该模型通过域间角色映射信息来配置域间访问控制策略,在域内则采用基于PBNM的模型机制配置域内用户安全策略,最终解决了在多域间资源访问控制的安全问题.     

支持SaaS的安全权限管理系统

SaaS作为一种通过互联网向公众特别是中小企业提供应用软件的模式,其突出特点就是可扩展性、多用户、高效性、可配置性。文章基于SaaS第四级成熟度＂可扩展的多实例可配置级＂要求,设计和实现了一个可以支持多租户、多服务的SaaS系统架构和一个统一的安全认证与权限管理系统。其中所采用的存储模型和安全管理模型可适应于大规模租户的需要,可在满足系统性能要求下的架构灵活性和可扩展性,并满足多租户的定制化需求。     

多域环境下具有动态适应性的多级安全模型

针对BLP模型在实施灵活性方面的不足以及不能满足多域分层系统访问控制需求的实际,提出了BLP的扩展模型——DMDBLP模型。模型中引入了域概念,将访问控制区分为域内和域间两种情况,适应了多域环境的需求。同时,在模型中增加了敏感标记的动态调整机制,提高了访问控制的灵活性。对模型的分析表明,模型的访问控制不仅是灵活的,也是安全的。     

新的基于角色的跨信任域授权管理模型

多信任域间的安全访问是一项重要的研究内容。结合基于角色访问控制机制（RBAC）的优势及现有的跨域认证技术构建了一种适用于大规模分布式网络环境的跨信任域授权管理CTDPM（Crossing the Trusted-domain Privilege Management）模型。模型中提出角色推荐和单向角色映射策略,支持分布式环境下任意两个信任域之间的安全访问。运用集合论和谓词逻辑对CTDPM模型进行了系统的形式化描述,提出了一套合理的授权与安全规则,并进行了特性分析,最后给出该模型在访问控制系统中的安全应用。     

Only connect: teaching, technology and telesis

Abstract This paper describes an approach to the design of interactive multimedia materials being developed in a European Community project. The developmental process is seen as a dialogue between technologists and teachers. This dialogue is often problematic because of the differences in training, experience and culture between them. Conditions needed for fruitful dialogue are described and the generic model for learning design used in the project is explained.     

European Community policy and the market

Abstract This paper starts with some reflections on the policy considerations and priorities which are shaping European Commission (EC) research programmes. Then it attempts to position the current projects which seek to capitalise on information and communications technologies for learning in relation to these priorities and the apparent realities of the marketplace. It concludes that while there are grounds to be optimistic about the contribution EC programmes can make to the efficiency and standard of education and training, they are still too technology driven.     

一种自适应子融合集成多分类器方法

融合集成方法已经广泛应用在模式识别领域,然而一些基分类器实时性能稳定性较差,导致多分类器融合性能差,针对上述问题本文提出了一种新的基于多分类器的子融合集成分类器系统。该方法考虑在度量层融合层次之上通过对各类基多分类器进行动态选择,票数最多的类别作为融合系统中对特征向量识别的类别,构成一种新的自适应子融合集成分类器方法。实验表明,该方法比传统的分类器以及分类融合方法识别准确率明显更高,具有更好的鲁棒性。     

Avoiding semantic and temporal gaps in developing software intensive systems

Development of software intensive systems (systems) in practice involves a series of self-contained phases for the lifecycle of a system. Semantic and temporal gaps, which occur among phases and among developer disciplines within and across phases, hinder the ongoing development of a system because of the interdependencies among phases and among disciplines. Such gaps are magnified among systems that are developed at different times by different development teams, which may limit reuse of artifacts of systems development and interoperability among the systems. This article discusses such gaps and a systems development process for avoiding them.     

Designing economic np control charts: A programmed simulation approach

This paper presents control charts models and the necessary simulation software for the location of economic values of the control parameters. The simulation program is written in FORTRAN, requires only 10K of main storage, and can run on most mini and micro computers. Two models are presented - one describes the process when it is operating at full capacity and the other when the process is operating under capacity. The models allow the product quality to deteriorate to a further level before an existing out-of-control state is detected, and they can also be used in situations where no prior knowledge exists of the out-of-control causes and the resulting proportion defectives.     

The development of robot art

Going through a few examples of robot artists who are recognized worldwide, we try to analyze the deepest meaning of what is called “robot art” and the related art field definition. We also try to highlight its well-marked borders, such as kinetic sculptures, kinetic art, cyber art, and cyberpunk. A brief excursion into the importance of the context, the message, and its semiotics is also provided, case by case, together with a few hints on the history of this discipline in the light of an artistic perspective. Therefore, the aim of this article is to try to summarize the main characteristics that might classify robot art as a unique and innovative discipline, and to track down some of the principles by which a robotic artifact can or cannot be considered an art piece in terms of social, cultural, and strictly artistic interest. This work was presented in part at the 13th International Symposium on Artificial Life and Robotics, Oita, Japan, January 31–February 2, 2008     

Explanation and prediction: an architecture for default and abductive reasoning

Although there are many arguments that logic is an appropriate tool for artificial intelligence, there has been a perceived problem with the monotonicity of classical logic. This paper elaborates on the idea that reasoning should be viewed as theory formation where logic tells us the consequences of our assumptions. The two activities of predicting what is expected to be true and explaining observations are considered in a simple theory formation framework. Properties of each activity are discussed, along with a number of proposals as to what should be predicted or accepted as reasonable explanations. An architecture is proposed to combine explanation and prediction into one coherent framework. Algorithms used to implement the system as well as examples from a running implementation are given.     

Three Process Perspectives: Organizations, Teams, and People

This paper provides the author's personal views and perspectives on software process improvement. Starting with his first work on technology assessment in IBM over 20 years ago, Watts Humphrey describes the process improvement work he has been directly involved in. This includes the development of the early process assessment methods, the original design of the CMM, and the introduction of the Personal Software Process (PSP)^SM and Team Software Process (TSP){^SM}. In addition to describing the original motivation for this work, the author also reviews many of the problems he and his associates encountered and why they solved them the way they did. He also comments on the outstanding issues and likely directions for future work. Finally, this work has built on the experiences and contributions of many people. Mr. Humphrey only describes work that he was personally involved in and he names many of the key contributors. However, so many people have been involved in this work that a full list of the important participants would be impractical.     

基于复小波噪声方差显著修正的SAR图像去噪

提出了一种基于复小波域统计建模与噪声方差估计显著性修正相结合的合成孔径雷达(Synthetic Aperture Radar,SAR)图像斑点噪声滤波方法。该方法首先通过对数变换将乘性噪声模型转化为加性噪声模型,然后对变换后的图像进行双树复小波变换(Dualtree Complex Wavelet Transform,DCWT),并对复数小波系数的统计分布进行建模。在此先验分布的基础上,通过运用贝叶斯估计方法从含噪系数中恢复原始系数,达到滤除噪声的目的。实验结果表明该方法在去除噪声的同时保留了图像的细节信息,取得了很好的降噪效果。     

How do children do mathematics with LOGO?

Abstract  This paper considers some results of a study designed to investigate the kinds of mathematical activity undertaken by children (aged between 8 and 11) as they learned to program in LOGO. A model of learning modes is proposed, which attempts to describe the ways in which children used and acquired understanding of the programming/mathematical concepts involved. The remainder of the paper is concerned with discussing the validity and limitations of the model, and its implications for further research and curriculum development.