Reliable and accurate cooperative positioning is vital to intelligent connected vehicles(ICVs),in which vehicle-vehicle relative measurements are integrated to provide stable locationaware services.However,in zero-tru...Reliable and accurate cooperative positioning is vital to intelligent connected vehicles(ICVs),in which vehicle-vehicle relative measurements are integrated to provide stable locationaware services.However,in zero-trust autonomous driving environments,the possibility of measurement failures and malicious communication attacks tends to reduce positioning performance.With this in mind,this paper presents an ultra-wide bandwidth(UWB)based cooperative positioning system with the specific objective of ICV localization in zero-trust driving environments.Firstly,to overcome measurement degradation under non-line-ofsight(NLOS)propagation conditions,this study proposes a decentralized 3D cooperative positioning method based on a distributed Kalman filter(DKF)by integrating relative rangeazimuth-elevation measurements,unlike the state-of-the-art methods that rely on only one single relative range information to update motion states.More specifically,in contrast to pioneering studies that mainly focus on the positioning problem arising from only one single type of communication attack(either false data injection(FDI)or denial of service(DoS)),we consider a more challenging case of secure cooperative state estimation under mixed FDI and DoS attacks.To this end,a singular-value decomposition(SVD)-assisted decoupled DKF algorithm is proposed in this work,in which a novel update-triggered inter-vehicular communication mechanism is introduced to ensure robust positioning performance against communication attacks while maintaining low transmission load between individuals.To verify the effectiveness in practical 3D NLOS scenarios,we design an intelligent connected multi-robot platform based on a robot operating system(ROS)and UWB technology.Consequently,extensive experimental results demonstrate its superiority and feasibility by achieving a high positioning accuracy of 0.68 m under adverse attacks,especially in the case of hybrid FDI and DoS attacks.In addition,several critical discussions,including the impact of attack parameters,resilience assessment,and a comparison with event-triggered methods,are provided in this work.Moreover,a demo video has been uploaded in the supplementary materials for a detailed presentation.展开更多
With the rapid development of Internet technology,the network access control has received much attention,especially for zero-trust architecture(ZTA).In this paper,an analytic hierarchy process(AHP)based access control...With the rapid development of Internet technology,the network access control has received much attention,especially for zero-trust architecture(ZTA).In this paper,an analytic hierarchy process(AHP)based access control algorithm using machine learning and Bayesian probability is proposed.Firstly,the actual access control problem is formulated as the AHP model which decomposes the decision-related elements into the goal layer,the criterion layer and the alternative layer.To obtain more accurate feature weights,the XGBoost model is introduced to compute the importance score of each feature.And the pairwise comparison matrix is constructed.Then,by calculating the maximum eigenvalue and corresponding eigenvector of the matrix,the single hierarchy sorting is achieved.Moreover,the consistency verification is proposed to ensure the matrix consistency.Next,a Bayesian probability method is used to calculate the conditional weights of allowed access and denied access for the attribute values of each feature.And the total hierarchy sorting is achieved.Last,the optimal threshold is determined by the Youden index.Compared with the threshold,the access control is estimated.Experimental results illustrated that the proposed algorithm performs better than some existing methods.展开更多
The sixth-generation(6G)wireless communication system is envisioned be cable of providing highly dependable services by integrating with native reliable and trustworthy functionalities.Zero-trust vehicular networks is...The sixth-generation(6G)wireless communication system is envisioned be cable of providing highly dependable services by integrating with native reliable and trustworthy functionalities.Zero-trust vehicular networks is one of the typical scenarios for 6G dependable services.Under the technical framework of vehicle-and-roadside collaboration,more and more on-board devices and roadside infrastructures will communicate for information exchange.The reliability and security of the vehicle-and-roadside collaboration will directly affect the transportation safety.Considering a zero-trust vehicular environment,to prevent malicious vehicles from uploading false or invalid information,we propose a malicious vehicle identity disclosure approach based on the Shamir secret sharing scheme.Meanwhile,a two-layer consortium blockchain architecture and smart contracts are designed to protect the identity and privacy of benign vehicles as well as the security of their private data.After that,in order to improve the efficiency of vehicle identity disclosure,we present an inspection policy based on zero-sum game theory and a roadside unit incentive mechanism jointly using contract theory and subjective logic model.We verify the performance of the entire zero-trust solution through extensive simulation experiments.On the premise of protecting the vehicle privacy,our solution is demonstrated to significantly improve the reliability and security of 6G vehicular networks.展开更多
等级保护2.0(以下简称“等保2.0”)对数据中心信息安全架构提出了合规与技术要求。文章构建四层联动架构模型,涵盖网络安全、计算环境、应用数据与安全运营4个层面,通过引入零信任访问控制、虚拟化隔离机制、数据全生命周期防护及安全...等级保护2.0(以下简称“等保2.0”)对数据中心信息安全架构提出了合规与技术要求。文章构建四层联动架构模型,涵盖网络安全、计算环境、应用数据与安全运营4个层面,通过引入零信任访问控制、虚拟化隔离机制、数据全生命周期防护及安全编排自动化响应(Security Orchestration Automation and Response,SOAR)机制,提出了一套面向等保2.0的优化实施方案。实验结果表明,优化架构在检测率、响应效率、资源占用等关键指标上相较传统架构均有显著提升。因此,优化架构具备良好的工程适配性与合规落地能力。展开更多
随着LTE-R(Long Term Evolution for Railways)网络的发展,传统安全架构难以应对日益复杂的安全威胁,特别是针对网络边界逐渐模糊、“非法用户”越权访问等问题。文章结合“永不信任,始终验证”的零信任理念,提出一种基于软件定义边界(S...随着LTE-R(Long Term Evolution for Railways)网络的发展,传统安全架构难以应对日益复杂的安全威胁,特别是针对网络边界逐渐模糊、“非法用户”越权访问等问题。文章结合“永不信任,始终验证”的零信任理念,提出一种基于软件定义边界(SDP,Software Defined Perimeter)的LTE-R网络零信任架构。该架构融合单包授权(SPA,Single Packet Authorization)、持续认证机制和行为审计策略,实现服务端口隐身、最小权限控制及动态权限管理,有效防御横向渗透、中间人攻击和端口扫描,为保障LTE-R核心调度系统安全和铁路通信网络的零信任转型提供了可行路径。展开更多
基金supported in part by the National Natural Science Foundation of China(62273065,62003064,62303386)the Natural Science Foundation of Chongqing(CSTB2023NSCQ-LZX0014)+1 种基金the Science and Technology Research Program of Chongqing Municipal Education Commission(KJZDK201800701,KJQN202000717)Sichuan Science and Technology Program(2024NSFSC0525).
文摘Reliable and accurate cooperative positioning is vital to intelligent connected vehicles(ICVs),in which vehicle-vehicle relative measurements are integrated to provide stable locationaware services.However,in zero-trust autonomous driving environments,the possibility of measurement failures and malicious communication attacks tends to reduce positioning performance.With this in mind,this paper presents an ultra-wide bandwidth(UWB)based cooperative positioning system with the specific objective of ICV localization in zero-trust driving environments.Firstly,to overcome measurement degradation under non-line-ofsight(NLOS)propagation conditions,this study proposes a decentralized 3D cooperative positioning method based on a distributed Kalman filter(DKF)by integrating relative rangeazimuth-elevation measurements,unlike the state-of-the-art methods that rely on only one single relative range information to update motion states.More specifically,in contrast to pioneering studies that mainly focus on the positioning problem arising from only one single type of communication attack(either false data injection(FDI)or denial of service(DoS)),we consider a more challenging case of secure cooperative state estimation under mixed FDI and DoS attacks.To this end,a singular-value decomposition(SVD)-assisted decoupled DKF algorithm is proposed in this work,in which a novel update-triggered inter-vehicular communication mechanism is introduced to ensure robust positioning performance against communication attacks while maintaining low transmission load between individuals.To verify the effectiveness in practical 3D NLOS scenarios,we design an intelligent connected multi-robot platform based on a robot operating system(ROS)and UWB technology.Consequently,extensive experimental results demonstrate its superiority and feasibility by achieving a high positioning accuracy of 0.68 m under adverse attacks,especially in the case of hybrid FDI and DoS attacks.In addition,several critical discussions,including the impact of attack parameters,resilience assessment,and a comparison with event-triggered methods,are provided in this work.Moreover,a demo video has been uploaded in the supplementary materials for a detailed presentation.
基金supported by the National Key Research and Development Program of China under Grant 2020YFA0711400.
文摘With the rapid development of Internet technology,the network access control has received much attention,especially for zero-trust architecture(ZTA).In this paper,an analytic hierarchy process(AHP)based access control algorithm using machine learning and Bayesian probability is proposed.Firstly,the actual access control problem is formulated as the AHP model which decomposes the decision-related elements into the goal layer,the criterion layer and the alternative layer.To obtain more accurate feature weights,the XGBoost model is introduced to compute the importance score of each feature.And the pairwise comparison matrix is constructed.Then,by calculating the maximum eigenvalue and corresponding eigenvector of the matrix,the single hierarchy sorting is achieved.Moreover,the consistency verification is proposed to ensure the matrix consistency.Next,a Bayesian probability method is used to calculate the conditional weights of allowed access and denied access for the attribute values of each feature.And the total hierarchy sorting is achieved.Last,the optimal threshold is determined by the Youden index.Compared with the threshold,the access control is estimated.Experimental results illustrated that the proposed algorithm performs better than some existing methods.
基金supported in part by the National Key R&D Program of China (No.2020YFB1807802)the National Natural Science Foundation of China (Grant Nos.61971148,U22A2054).
文摘The sixth-generation(6G)wireless communication system is envisioned be cable of providing highly dependable services by integrating with native reliable and trustworthy functionalities.Zero-trust vehicular networks is one of the typical scenarios for 6G dependable services.Under the technical framework of vehicle-and-roadside collaboration,more and more on-board devices and roadside infrastructures will communicate for information exchange.The reliability and security of the vehicle-and-roadside collaboration will directly affect the transportation safety.Considering a zero-trust vehicular environment,to prevent malicious vehicles from uploading false or invalid information,we propose a malicious vehicle identity disclosure approach based on the Shamir secret sharing scheme.Meanwhile,a two-layer consortium blockchain architecture and smart contracts are designed to protect the identity and privacy of benign vehicles as well as the security of their private data.After that,in order to improve the efficiency of vehicle identity disclosure,we present an inspection policy based on zero-sum game theory and a roadside unit incentive mechanism jointly using contract theory and subjective logic model.We verify the performance of the entire zero-trust solution through extensive simulation experiments.On the premise of protecting the vehicle privacy,our solution is demonstrated to significantly improve the reliability and security of 6G vehicular networks.
文摘等级保护2.0(以下简称“等保2.0”)对数据中心信息安全架构提出了合规与技术要求。文章构建四层联动架构模型,涵盖网络安全、计算环境、应用数据与安全运营4个层面,通过引入零信任访问控制、虚拟化隔离机制、数据全生命周期防护及安全编排自动化响应(Security Orchestration Automation and Response,SOAR)机制,提出了一套面向等保2.0的优化实施方案。实验结果表明,优化架构在检测率、响应效率、资源占用等关键指标上相较传统架构均有显著提升。因此,优化架构具备良好的工程适配性与合规落地能力。
文摘随着LTE-R(Long Term Evolution for Railways)网络的发展,传统安全架构难以应对日益复杂的安全威胁,特别是针对网络边界逐渐模糊、“非法用户”越权访问等问题。文章结合“永不信任,始终验证”的零信任理念,提出一种基于软件定义边界(SDP,Software Defined Perimeter)的LTE-R网络零信任架构。该架构融合单包授权(SPA,Single Packet Authorization)、持续认证机制和行为审计策略,实现服务端口隐身、最小权限控制及动态权限管理,有效防御横向渗透、中间人攻击和端口扫描,为保障LTE-R核心调度系统安全和铁路通信网络的零信任转型提供了可行路径。
