Search

Along with the developing of information technology, Java platform a plays more and more important role in building enterprise information system. Especially after the cloud computing emerged, Java applications are used as kinds of services to provide the users some function. Users use these services remotely, and the applications should give the users some trust evidence. Control-flow integrity endows the software the ability to show the applications' behaviors conform to the users' expectations. But the Java virtual machine's memory organization is different from physical machine and hinders the application of CFI. This paper gives out the a novel way to enforce the control flow integrity to the Java applications based on the memory organization of the Java virtual machine. The method presented in this paper can provide the user information about an applications behavior, and significantly improve the security of a Java application.

With the rapid development of computer networks, invasion and attack becomes more and more frequent in network environment. Therefore, insuring the information system continuously and correctly working has become an urgent problem in the information security field. And continuous data protection (CDP) supporting service recovery provides us a good idea to resolve it. In this article, we have designed and implemented a continuous data protection system supporting service recovery, which is named SSR-CDPS. The basic design idea of the SSR-CDPS architecture is dividing the whole protection process into three stages: monitoring, protecting and recovery. Meanwhile, we propose a multi versioning data backup mechanism for the protecting process and a novel file failure recovery mechanism. Especially, we transfer the full copy operation of file contents into the merely slight modification operation on the FAT table, MFT table or other similar data structures; so that we achieve the aim of greatly reducing the direct disks read and write overhead. The test toward the SSR-CDPS prototype system shows that the system can significantly improve the efficiency of data protection within limited change to the existing file system; thus, it can meet the high real-time and the continuity requirements of the information system recovery applications.

The security usage and management of removable storage devices has become a vital problem for enterprises and individuals. However, the required strict security policies for preventing unauthorized access to sensitive data raise the decrease of usability and flexibility. The main problem rests on the binding between security and application domains which stifles the initiative of the devices on themselves. This paper presents TRS, an efficient active architecture that binds a feather-weight virtual machine (FVM) to the removable storage device. It is designed based on an inside-bound smart card as well as the chip operation system (COS) which builds a trust channel between the FVM and the device. The FVM is set up by a trust chain and provides isolated usage environment for process accessing the device which prevents the obtained data from leakage. Finally, we implement a USB flash disk we call as UTrustDisk based on the hardware structure of Amordisk which is a security product of Nationz Technologies Inc. The results show the average overhead of read and write is 7.5% and 11.5%.

In this paper we present the research and implementation of TRFD, a Trusted Removable USB Flash Device which can resist various attacks. TRFD is an independent system which would authenticate the user and host before data access. All the data secure processing of TRFD, such as encrypting, signing, are performed inside the device, so TRFD can protect the data against host hacking. The evaluation of our prototype shows that TRFD can solve some security issues of removable storages indeed.

The existence of trusted subjects is a major complication in implementing multilevel secure (MLS) systems. In MLS, trusted subjects are granted with privileges to perform operations possibly violating mandatory access control policies. It is difficult to prevent them from data leakage with out too strict confinement. This paper reconsiders the privilege from the view of sensitive data and presents a dynamic trusted domain (DTD) mechanism for trusted subjects. In DTD, a domain is associated with a special label structure (LabelVector) distinguishing security policies and builds an isolated environment based on virtualization for a certain trusted subject. The channel for the trusted subject to communicate with outsider is controlled by a trusted request decision maker (TRDM). Only the request satisfies the rules on domain label and security levels can be passed through.