Zero trust architecture(ZTA)is a paradigm shift in how we protect data,stay connected and access resources.ZTA is non-perimeter-based defence,which has been emerging as a promising revolution in the cyber security fie...Zero trust architecture(ZTA)is a paradigm shift in how we protect data,stay connected and access resources.ZTA is non-perimeter-based defence,which has been emerging as a promising revolution in the cyber security field.It can be used to continuously maintain security by safeguarding against attacks both from inside and outside of the network system.However,ZTA automation and orchestration,towards seamless deployment on real-world networks,has been limited to be reviewed in the existing literature.In this paper,we first identify the bottlenecks,discuss the background of ZTA and compare it with traditional perimeter-based security architectures.More importantly,we provide an in-depth analysis of state-of-the-art AI techniques that have the potential in the automation and orchestration of ZTA.Overall,in this review paper,we develop a foundational view on the challenges and potential enablers for the automation and orchestration of ZTA.展开更多
This paper deals with the security of stock market transactions within financial markets, particularly that of the West African Economic and Monetary Union (UEMOA). The confidentiality and integrity of sensitive data ...This paper deals with the security of stock market transactions within financial markets, particularly that of the West African Economic and Monetary Union (UEMOA). The confidentiality and integrity of sensitive data in the stock market being crucial, the implementation of robust systems which guarantee trust between the different actors is essential. We therefore proposed, after analyzing the limits of several security approaches in the literature, an architecture based on blockchain technology making it possible to both identify and reduce the vulnerabilities linked to the design, implementation work or the use of web applications used for transactions. Our proposal makes it possible, thanks to two-factor authentication via the Blockchain, to strengthen the security of investors’ accounts and the automated recording of transactions in the Blockchain while guaranteeing the integrity of stock market operations. It also provides an application vulnerability report. To validate our approach, we compared our results to those of three other security tools, at the level of different metrics. Our approach achieved the best performance in each case.展开更多
The reputation-based trust mechanism is a way to assess the trustworthiness of offered services, based on the feedback obtained from their users. In the absence of appropriate safeguards, service users can still manip...The reputation-based trust mechanism is a way to assess the trustworthiness of offered services, based on the feedback obtained from their users. In the absence of appropriate safeguards, service users can still manipulate this feedback. Auction mechanisms have already addressed the problem of manipulation by market- trading participants. When auction mechanisms are applied to trust systems, their interaction with the trust systems and associated overhead need to be quantitatively evaluated. This paper proposes two distributed architectures based on centralized and hybrid computing for integrating an auction mechanism with the trust systems. The empirical evaluation demonstrates how the architectures help to discourage users from giving untruthful feedback and reduce the overhead costs of the auction mechanisms.展开更多
Emerging with open environments, the software paradigms, such as open resource coalition and Internetware, present several novel characteristics including user-centric, non-central control, and continual evolution. Th...Emerging with open environments, the software paradigms, such as open resource coalition and Internetware, present several novel characteristics including user-centric, non-central control, and continual evolution. The goal of obtaining high confidence on such systems is more difficult to achieve. The general developer-oriented metrics and testing-based methods which are adopted in the traditional measurement for high confidence software seem to be infeasible in the new situation. Firstly, the software development is changed from the developer-centric to user-centric, while user＇s opinions are usually subjective, and cannot be generalized in one objective metric. Secondly, there is non-central control to guarantee the testing on components which formed the software system, and continual evolution makes it impossible to test on the whole software system. Therefore, this paper proposes a trust-based approach that consists of three sequential sub-stages： 1） describing metrics for confidence estimation from users; 2） estimating the confidence of the components based on the quantitative information from the trusted recommenders; 3） estimating the confidence of the whole software system based on the component confidences and their interactions, as well as attempts to make a step toward a reasonable and effective method for confidence estimation of the software system in open environments.展开更多
Zero-trust security is a novel concept to cope with intricate access,which can not be handled by the conventional perimeter-based architecture anymore.The device-to-device continuous authentication protocol is one of ...Zero-trust security is a novel concept to cope with intricate access,which can not be handled by the conventional perimeter-based architecture anymore.The device-to-device continuous authentication protocol is one of the most crucial cornerstones,especially in the IoT scenario.In the zero-trust architecture,trust does not rely on any position,person or device.However,to the best of our knowledge,almost all existing device-to-device continuous authentication relies on a trust authority or a node to generate secret keys or secret values.This is betrayed by the principle of zero-trust architecture.In this paper,we employ the blockchain to eliminate the trusted node.One node is chosen to produce the public parameter and secret keys for two entities through the practical Byzantine fault tolerance consensus mechanism.Additionally,the devices are categorized into three folds:trusted device,suspected device and untrusted device.Only the first two can participate in authentication,and they have different lengths of security parameters and intervals to reach a better balance between security and efficiency.Then we prove the security of the initial authentication part in the eCK model and give an informal analysis of the continuous authentication part.Finally,we implement the proposed protocol on simulated devices.The result illustrates that our scheme is highly efficient,and the continuous authentication only costs around 0.1ms.展开更多
基金Supported by the National Basic Research Program of China under Grant No.2002CB312002(国家重点基础研究发展计划(973))the National High-Tech Research and Development Plan of China under Grant Nos.2006AA01Z159,2007AA01Z140(国家高技术研究发展计划(863))+1 种基金the National Natural Science Foundation of China under Grant Nos.60233010,60403014,60603034 6060303(国家自然科学基金)the Natural Science Foundation of Jiangsu Province of China under Grant No.BK2006712(江苏省自然科学基金)
文摘Zero trust architecture(ZTA)is a paradigm shift in how we protect data,stay connected and access resources.ZTA is non-perimeter-based defence,which has been emerging as a promising revolution in the cyber security field.It can be used to continuously maintain security by safeguarding against attacks both from inside and outside of the network system.However,ZTA automation and orchestration,towards seamless deployment on real-world networks,has been limited to be reviewed in the existing literature.In this paper,we first identify the bottlenecks,discuss the background of ZTA and compare it with traditional perimeter-based security architectures.More importantly,we provide an in-depth analysis of state-of-the-art AI techniques that have the potential in the automation and orchestration of ZTA.Overall,in this review paper,we develop a foundational view on the challenges and potential enablers for the automation and orchestration of ZTA.
文摘This paper deals with the security of stock market transactions within financial markets, particularly that of the West African Economic and Monetary Union (UEMOA). The confidentiality and integrity of sensitive data in the stock market being crucial, the implementation of robust systems which guarantee trust between the different actors is essential. We therefore proposed, after analyzing the limits of several security approaches in the literature, an architecture based on blockchain technology making it possible to both identify and reduce the vulnerabilities linked to the design, implementation work or the use of web applications used for transactions. Our proposal makes it possible, thanks to two-factor authentication via the Blockchain, to strengthen the security of investors’ accounts and the automated recording of transactions in the Blockchain while guaranteeing the integrity of stock market operations. It also provides an application vulnerability report. To validate our approach, we compared our results to those of three other security tools, at the level of different metrics. Our approach achieved the best performance in each case.
文摘The reputation-based trust mechanism is a way to assess the trustworthiness of offered services, based on the feedback obtained from their users. In the absence of appropriate safeguards, service users can still manipulate this feedback. Auction mechanisms have already addressed the problem of manipulation by market- trading participants. When auction mechanisms are applied to trust systems, their interaction with the trust systems and associated overhead need to be quantitatively evaluated. This paper proposes two distributed architectures based on centralized and hybrid computing for integrating an auction mechanism with the trust systems. The empirical evaluation demonstrates how the architectures help to discourage users from giving untruthful feedback and reduce the overhead costs of the auction mechanisms.
基金Supported by the National Basic Research 973 Program of China under Grant No.2009CB320702the National Hi-Tech Research and Development 863 Program of China under Grant Nos. 2007AA01Z178 and 2007AA01Z140+1 种基金the National Natural Science Foundation of China under Grant Nos. 60603034, 60721002 and 60736015the Jiang Su Natural Science Foundation under Grant No.BK2008017
文摘Emerging with open environments, the software paradigms, such as open resource coalition and Internetware, present several novel characteristics including user-centric, non-central control, and continual evolution. The goal of obtaining high confidence on such systems is more difficult to achieve. The general developer-oriented metrics and testing-based methods which are adopted in the traditional measurement for high confidence software seem to be infeasible in the new situation. Firstly, the software development is changed from the developer-centric to user-centric, while user＇s opinions are usually subjective, and cannot be generalized in one objective metric. Secondly, there is non-central control to guarantee the testing on components which formed the software system, and continual evolution makes it impossible to test on the whole software system. Therefore, this paper proposes a trust-based approach that consists of three sequential sub-stages： 1） describing metrics for confidence estimation from users; 2） estimating the confidence of the components based on the quantitative information from the trusted recommenders; 3） estimating the confidence of the whole software system based on the component confidences and their interactions, as well as attempts to make a step toward a reasonable and effective method for confidence estimation of the software system in open environments.
基金supported in part by the National Science Foundation Project of China(No.61931001)the Scientific and Technological Innovation Foundation of Foshan,USTB(No.BK20AF003).
文摘Zero-trust security is a novel concept to cope with intricate access,which can not be handled by the conventional perimeter-based architecture anymore.The device-to-device continuous authentication protocol is one of the most crucial cornerstones,especially in the IoT scenario.In the zero-trust architecture,trust does not rely on any position,person or device.However,to the best of our knowledge,almost all existing device-to-device continuous authentication relies on a trust authority or a node to generate secret keys or secret values.This is betrayed by the principle of zero-trust architecture.In this paper,we employ the blockchain to eliminate the trusted node.One node is chosen to produce the public parameter and secret keys for two entities through the practical Byzantine fault tolerance consensus mechanism.Additionally,the devices are categorized into three folds:trusted device,suspected device and untrusted device.Only the first two can participate in authentication,and they have different lengths of security parameters and intervals to reach a better balance between security and efficiency.Then we prove the security of the initial authentication part in the eCK model and give an informal analysis of the continuous authentication part.Finally,we implement the proposed protocol on simulated devices.The result illustrates that our scheme is highly efficient,and the continuous authentication only costs around 0.1ms.
