Privacy and security are the most important issues to the popularity of cloud computing service. In recent years, there are many research schemes of cloud computing privacy protection based on access control, attribute-based encryption (ABE), trust and reputation, but they are scattered and lack unified logic. In this paper, we systematically review and analyze relevant research achievements. First, we discuss the architecture, concepts and several shortcomings of cloud computing, and propose a framework of privacy protection; second, we discuss and analyze basic ABE, KP-ABE (key policy attribute-based encryption), CP-ABE (ciphertext policy attribute-based encryption), access structure, revocation mechanism, multi-authority, fine-grained, trace mechanism, proxy re-encryption (PRE), hierarchical encryption, searchable encryption (SE), trust, reputation, extension of tradition access control and hierarchical key; third, we propose the research challenge and future direction of the privacy protection in the cloud computing; finally, we point out corresponding privacy protection laws to make up for the technical deficiencies.

/pdf/privacy-protection-and-data-security-in-cloud-computing-a-4621g4f9au.pdf

Privacy Protection and Data Security in Cloud Computing: A Survey, Challenges, and Solutions

https://onlinelibrary.wiley.com/doi/epdf/10.1002/spy2.93

Recent trends in applying TPM to cloud computing

The invention discloses a credibility authorization method, a system, a credibility security management center and a server. The credibility authorization method comprises the followings steps: receiving platform metrizable information and user metrizable information transmitted by the server; judging whether the platform metrizable information is credible or not, and judging whether the user metrizable information is credible or not; if the platform metrizable information is credible and the user metrizable information is credible according to judgment, generating authorization success information; transmitting the authorization success information to the server. The server can only access storage equipment after receiving the authorization success information successfully, and an intruder can be prevented from accessing the storage equipment directly after the server is intruded, so that data in the storage equipment are effectively prevented from being accessed illegally.

Credibility authorization method, system, credibility security management center and server

The invention relates to a digital family equipment trusted access platform and an authentication method. The digital family equipment trusted access platform comprises family equipment, a family registration center, an equipment manufacturer server and an authentication center. The digital family equipment trusted access authentication method is designed based on the trusted access platform and comprises equipment registration and equipment access authentication. At the equipment registration stage, the equipment manufacturer server and the family registration center are used for verifying the authenticity and legality of the family equipment; at the equipment access stage, a trusted module in the family equipment is used for measuring the integrity of the equipment to achieve verification on the integrity of the equipment. Based on the platform and the method, the authenticity, legality and integrity verification of the equipment access process in a digital family is guaranteed.

Digital family equipment trusted access platform and authentication method

The invention discloses a secure and credible access method in a software defined network. A credible access technique is imported into an access process in the SDN (Software-Defined Network). Through combination of a credible computing technique, the access behavior of an unsecure device carried out on the network can be effectively prevented. Moreover, a rapid access authentication mode and an access mode of grading users according to credible values are provided specific to the flexibility and originality of the SDN. Through adoption of the technical scheme provided by the invention, shortages existing in access authentication of the SDN can be effectively covered, and the security of the SDN can be improved.

Secure and credible access method in software defined network

The invention belongs to the field of computer safety and relates to an authentication method for access of trusted network devices to a trusted network. Platform start eigenvalue provided by a trusted module and other messages are subjected to platform authentication at an authentication server, and then identity information and platform information are bound prior to next identity authentication so as to ensure trust of platform and identity. The method includes: firstly, a filter is started at a port to only allow for passage of authentication frames of the method when a trusted device, provided with an addressing mechanism for the authentication frames, accesses the trusted network; secondly, authenticating the platform and then performing second authentication by identity and platform binding; and thirdly, ensuring network device platform and identity authentication by two-stage authentication so as to allow the network device to access the network in a trusted way. The platform authentication and identity authentication are respectively performed under the existing protocols, man-in-the-middle attack easily occurs, and accordingly untrusted users access the network on the trusted platform or trusted users access the network on the untrusted platform. The above problem is solved by the use of the method.

Authentication method for access of trusted network devices to trusted network

A method for detecting abnormities and attacks aiming at an OSPF protocol in a trusted router belongs to the field of information safety. Firstly, dynamic measurement is carried out on the router through the utilization a TPM module embedded in the router and an internal dynamic measurement module to prevent the router from invasion from an operating system level, so that system configuration and even protocol codes are prevented from being tampered after the invasion. Secondly, an external attack detection module is utilized to carry out detection on three common OSPF attack means to prevent external attacks initiated by an intermediary after the intermediary intercepts protocol messages and tampers with message fields. Finally, an internal monitor module is utilized to convert abnormal states due to the router itself and carry out real-time monitoring, so that frequent abnormal states due to a self protocol loophole or human operation can be timely discovered, and the dynamic measurement module is triggered by the emission of measurement requests in order to detect whether the router is invaded.

A method for detecting abnormities and attacks of an OSPF protocol in a trusted router

Attacks executed on Spanning Tree Protocol (STP) expose the weakness of link layer protocols and put the higher layers in jeopardy. Although the problems have been studied for many years and various solutions have been proposed, many security issues remain. To enhance the security and credibility of layer-2 network, we propose a trust-based spanning tree protocol aiming at achieving a higher credibility of LAN switch with a simple and lightweight authentication mechanism. If correctly implemented in each trusted switch, the authentication of trust-based STP can guarantee the credibility of topology information that is announced to other switch in the LAN. To verify the enforcement of the trusted protocol, we present a new trust evaluation method of the STP using a specification-based state model. We implement a prototype of trust-based STP to investigate its practicality. Experiment shows that the trusted protocol can achieve security goals and effectively avoid STP attacks with a lower computation overhead and good convergence performance.

Study on Cloud Security Based on Trust Spanning Tree Protocol

The invention discloses an attack detection method of a spanning tree protocol based on a credible switchboard. An interior monitoring module is utilized to conduct monitoring for an attack behavior which is generated by the switchboard, an exterior protection module is utilized to conduct detecting for an attack threat from the exterior of the switchboard, and therefore, full attach detection of the spanning tree protocol is achieved. The method includes that firstly, according to the condition that in different stages, the switchboard waits different bridge protocol data units (BPDU), a state image is drawn, according to a state transfer condition, whole operation behavior of the switchboard is monitored so as to detect an attach behavior generated by the equipment, then the BPDU from the exterior is classified, a timer and a counting method are adopted to detect flooding attack, finally, when received BID is less than the BPDU of a current root BID, an explorer packet is sent to conduct validity checking on a target switchboard, and if the BPDU is a root bridge, whether the root bridge needs changing is decided after self-assessment so as to detect whether a root connection pipe is attached.

Attack detection method of spanning tree protocol based on credible switchboard

Attacks executed on Spanning Tree Protocol (STP) expose the weakness of link layer protocols and put the higher layers in jeopardy. Although the problems have been studied for many years and various solutions have been proposed, many security issues remain. To enhance the security and credibility of layer-2 network, we propose a trust-based spanning tree protocol aiming at achieving a higher credibility of LAN switch with a simple and lightweight authentication mechanism. If correctly implemented in each trusted switch, the authentication of trust-based STP can guarantee the credibility of topology information that is announced to other switch in the LAN. To verify the enforcement of the trusted protocol, we present a new credible evaluation method of the STP using a specification-based state model. We implement a prototype of trust-based STP to investigate its practicality. Experiment shows that the trusted protocol can achieve security goals and effectively avoid STP attacks with a lower computation overhead and good convergence performance.

Pan Qiuyue

Papers

Authentication method for access of trusted network devices to trusted network

A method for detecting abnormities and attacks of an OSPF protocol in a trusted router

Study on Cloud Security Based on Trust Spanning Tree Protocol

Attack detection method of spanning tree protocol based on credible switchboard

Trust-Based Security for the Spanning Tree Protocol