基于串空间认证测试的DTLS协议认证性分析

网络通信的普及和发展使得对网络协议尤其是安全协议的需求日益增长,同时安全要求及攻击方式的多样化对网络安全协议的效率和准确性提出了更高的要求。通过对各种协议安全性分析方法进行研究,采用串空间方法对DTLS协议进行形式化建模,进而采用认证测试方法进行协议认证性证明,用简明清晰的方式验证DTLS协议的认证性,保障了数据传输的安全。     

一种用于多方通信的新的SMC安全协议*

对主流安全协议在多方通信环境下的应用进行分析,总结其各自优缺点。在综合各个协议优点的基础上,提出并介绍了一个用于多方通信环境下的SMC(securing multiparty communications)协议,该协议工作在传输层之上,具有更强的可部署性。SMC协议被设计用来取代当前用于多方通信环境的MSEC协议族。通过将SMC协议与MSEC协议族进行比较,证明SMC协议具有与MSEC协议族一致的安全性,并且具有更强的可部署性。     

基于改进无证书公钥密码的轻量级DTLS协议设计

物联网在快速发展的同时,其数据交互容易遭受各种攻击.为了保证物联网传输层协议UDP传输数据的安全,在TLS协议架构基础上扩展形成了支持UDP数据报安全传输的DTLS（DatagramTLS）协议.现行的DTLS协议基于公钥证书密码体制,证书管理复杂、网络通信开销大,难以满足物联网等资源受限型网络的安全通信需求.本文提出一种基于离散对数的改进无证书公钥密码方案,设计了适应资源受限网络的轻量级DTLS协议,并基于嵌入式SSL库wolfSSL进行了协议实现.从通信开销和握手连接时间两方面,将本文提出的基于改进无证书公钥密码的DTLS协议分别与基于传统公钥证书的DTLS协议及基于身份标识的DTLS协议进行了对比实验.实验结果表明,在保证安全性的前提下,基于无证书的DTLS协议在通信开销和握手连接时间方面均优于基于公钥证书的DTLS协议和基于身份标识的DTLS协议.     

SecureSense: End-to-end secure communication architecture for the cloud-connected Internet of Things

Constrained Application Protocol (CoAP) has become the de-facto web standard for the IoT. Unlike traditional wireless sensor networks, Internet-connected smart thing deployments require security. CoAP mandates the use of the Datagram TLS (DTLS) protocol as the underlying secure communication protocol. In this paper we implement DTLS-protected secure CoAP for both resource-constrained IoT devices and a cloud backend and evaluate all three security modes (pre-shared key, raw-public key, and certificate-based) of CoAP in a real cloud-connected IoT setup. We extend Sics^thSense– a cloud platform for the IoT– with secure CoAP capabilities, and compliment a DTLS implementation for resource-constrained IoT devices with raw-public key and certificate-based asymmetric cryptography. To the best of our knowledge, this is the first effort toward providing end-to-end secure communication between resource-constrained smart things and cloud back-ends which supports all three security modes of CoAP both on the client side and the server side. SecureSense– our End-to-End (E2E) secure communication architecture for the IoT– consists of all standard-based protocols, and implementation of these protocols are open source and BSD-licensed. The SecureSense evaluation benchmarks and open source and open license implementation make it possible for future IoT product and service providers to account for security overhead while using all standardized protocols and while ensuring interoperability among different vendors. The core contributions of this paper are: (i) a complete implementation for CoAP security modes for E2E IoT security,  (ii) IoT security and communication protocols for a cloud platform for the IoT, and (iii) detailed experimental evaluation and benchmarking of E2E security between a network of smart things and a cloud platform.     

运营商级SD-WAN组网NTP时钟同步方案

摘 要：SD-WAN 发展势头迅猛，电信运营商与互联网企业都在不断扩大布局。作为形态多样化的技术， SD-WAN 中并未对时钟同步做出明确规范。分析了时钟同步对 SD-WAN 技术实现和业务运行的重要性。简述了在SD-WAN被广泛采用的互联网公共NTP服务时钟同步方案的利弊，由此展开讨论在不同场景可实现的自建NTP服务时钟同步方案，并设计了基于自建NTP服务利用管理隧道加密传输NTP同步数据的时钟同步方法，使SD-WAN平台和设备在时间同步时获得更高的安全性与稳定性。     

一种基于DTLS协议的VPN方案设计

DTLS(Datagram Transport Layer Security)协议是TLS协议的变体,用于在不可靠传输网络上对应用层数据提供安全保护.文中介绍了DTLS协议,提出一种基于DTLS协议的应用层VPN解决方案,并进行了仿真.     

SSL VPN实现研究

该文给出了SSLVPN的大致实现思路。此SSLVPN支持Web化应用、C/S应用以及网络扩展。     

DTLS based security and two-way authentication for the Internet of Things

In this paper, we introduce the first fully implemented two-way authentication security scheme for the Internet of Things (IoT) based on existing Internet standards, specifically the Datagram Transport Layer Security (DTLS) protocol. By relying on an established standard, existing implementations, engineering techniques and security infrastructure can be reused, which enables easy security uptake. Our proposed security scheme is therefore based on RSA, the most widely used public key cryptography algorithm. It is designed to work over standard communication stacks that offer UDP/IPv6 networking for Low power Wireless Personal Area Networks (6LoWPANs). Our implementation of DTLS is presented in the context of a system architecture and the scheme’s feasibility (low overheads and high interoperability) is further demonstrated through extensive evaluation on a hardware platform suitable for the Internet of Things.