|
|
|
题名
|
作者
|
年代
|
出处
|
被引量
|
| 1 | A Survey: Typical Security Issues of Software-Defined Networking显示文摘Software-Defined Networking (SDN) has been a hot topic for future network development, which implements the different layers of control plane and data plane respectively. Despite providing high openness and programmability, the “three-layer two-interface” architecture of SDN changes the traditional network and increases the network attack nodes, which results in new security issues. In this paper, we firstly introduced the background, architecture and working process of SDN. Secondly, we summarized and analyzed the typical security issues from north to south: application layer, northbound interface, control layer, southbound interface and data layer. Another contribution is to review and analyze the existing solutions and latest research progress of each layer, mainly including: authorized authentication module, application isolation, DoS/DDoS defense, multi-controller deployment and flow rule consistency detection. Finally, a conclusion about the future works of SDN security and an idealized global security architecture is proposed. | Yifan Liu Bo Zhao Pengyuan Zhao Peiru Fan Hui Liu | 2019 | China Communications2019，16，7： | 11 |
| 2 | Lattice-Based Double-Authentication-Preventing Ring Signature for Security and Privacy in Vehicular Ad-Hoc Networks显示文摘Amidst the rapid development of the Internet of Things (loT), Vehicular Ad-Hoc NETwork (VANET), a typical loT application, are bringing an ever-larger number of intelligent and convenient services to the daily lives of individuals. However, there remain challenges for VANETs in preserving privacy and security. In this paper, we propose the first lattice-based Double-Authentication-Preventing Ring Signature (DAPRS) and adopt it to propose a novel privacy-preserving authentication scheme for VANETs, offering the potential for security against quantum computers. The new construction is proven secure against chosen message attacks. Our scheme is more efficient than other ring signature in terms of the time cost of the message signing phase and verification phase, and also in terms of signature length. Analyses of security and efficiency demonstrate that our proposed scheme is provably secure and efficient in the application. | Jinhui Liu Yong Yu Jianwei Jia Shijia Wang Peiru Fan Houzhen Wang Huanguo Zhang | 2019 | Tsinghua Science and Technology2019，24，5： | 10 |
| 3 | An Improved vTPM-VM Live Migration Protocol显示文摘To prevent malicious virtual machine from harming the security of vTPM-VM live migration process, we propose an improved vTPM-VM live migration protocol which uses a TPM-based integrity verification policy and a specific encryption scheme to enhance security. The TPM-based integrity verification policy is presented to ensure that all participating entities in this process are trustworthy. In data transfer phase, the specific encryption scheme is designed to associate the decipher process with one certain platform status so that only the destination platform can gain the key data of the migrated VM and vTPM instance. The security of this new protocol is analyzed. The results show that this protocol can effectively resist most of the attacks in the process of vTPM-VM live migration. | FAN Peiru ZHAO Bo SHI Yuan CHEN Zhihong NI Mingtao | 2015 | Wuhan University Journal of Natural Sciences2015，20，6： | 5 |
| 4 | Powermitter:Data Exfiltration from Air-Gapped Computer through Switching Power Supply显示文摘Air-gapped computers are isolated both logically and physically from all kinds of existing common communication channel, such as USB ports, wireless and wired networks. Although the feasibility of infiltrating an air-gapped computer has been proved in recent years, data exfiltration from such systems is still considered to be a challenging task. In this paper we present Powermitter, a novel approach that can exfiltrate data through an air-gapped computer via its power adapter. Our method utilizes the switched-mode power supply, which exists in all of the laptops, desktop computers and servers nowadays. We demonstrate that a malware can indirectly control the electromagnetic emission frequency of the power supply by leveraging the CPU utilization. Furthermore, we show that the emitted signals can be received and demodulated by a dedicated device. We present the proof of concept design of the power covert channel and implement a prototype of Powermitter consisting of a transmitter and a receiver. The transmitter leaks out data by using a variant binary frequency shift keying modulation, and the emitted signal can be captured and decoded by software based virtual oscilloscope through such covert channel. We tested Powermitter on three different computers. The experiment re-sults show the feasibility of this power covert channel. We show that our method can also be used to leak data from different types of embedded systems which use switching power supply. | Bo Zhao Mingtao Ni Peiru Fan | 2018 | China Communications2018，15，2： | 4 |
| 5 | SIV:A Structural Integrity Verification Approach of Cloud Components with Enhanced Privacy显示文摘Private data leakage is a threat to current integrity verification schemes of cloud components. To address this issue, this work proposes a privacy-enhancing Structural Integrity Verification (SIV) approach. It is made up of three processes: proof organization, proof transformation, and integrity judgement. By introducing a Merkle tree technique, the integrity of a constituent part of a cloud component on a node is represented by a root value. The value is then masked to cipher texts in proof transformation. With the masked proofs, a structural feature is extracted and validated in an integrity judgement by a third-party verification provider. The integrity of the cloud component is visually displayed in the output result matrix. If there are abnormities, the corrupted constituent parts can be located. Integrity is verified through the encrypted masked proofs. All raw proofs containing sensitive information stay on their original nodes, thus minimizing the attack surface of the proof data, and eliminating the risk of leaking private data at the source. Although some computations are added, the experimental results show that the time overhead is within acceptable bounds. | Bo Zhao Peiru Fan Pengyuan Zhao Mingtao Ni Jinhui Liu | 2019 | Tsinghua Science and Technology2019，24，5： | 0 |
| 6 | ePUF: A Lightweight Double Identity Verification in IoT显示文摘Remote authentication is a safe and verifiable mechanism.In the Internet of Things (loT),remote hosts need to verify the legitimacy of identity of terminal devices.However,embedded devices can hardly afford sufficient resources for the necessary trusted hardware components.Software authentication with no hardware guarantee is generally vulnerable to various network attacks.In this paper,we propose a lightweight remote verification protocol.The protocol utilizes the unique response returned by Physical Unclonable Function (PUF) as legitimate identity basis of the terminal devices and uses quadratic residues to encrypt the PUF authentication process to perform a double identity verification scheme.Our scheme is secure against middleman attacks on the attestation response by preventing conspiracy attacks from forgery authentication. | Bo Zhao Pengyuan Zhao Peiru Fan | 2020 | Tsinghua Science and Technology2020，25，5： | 0 |
您所在的机构暂未开通此部分的功能，请联系管理员