Security Middleware Based on Windows CE

肖洋,李之棠

DOI: https://doi.org/10.3969/j.issn.1007-130x.2004.07.010

2004-01-01

Abstract:Windows CE is a popular 32bit embedded operating system which is adopted in many fields. Because of the inherent security flaws in the TCP/IP protocol family, the network security about Windows CE must be taken into consideration. A VPN kernel module and relevant analysis are introduced in this paper.

What problem does this paper attempt to address?

Research on security extensions based on Java 2 security architecture

TIAN Yu-hong,WANG Ze-bing,FENG Yan

DOI: https://doi.org/10.3969/j.issn.1000-7024.2006.24.029

2006-01-01

Abstract:The Java virtual machine(JVM)is used more frequently as the basic engine behind dynamic web services.With the proliferation of network attacks on these network resources,much work are done to provide security for the network environment.Little effort has been placed on securing a Java web server where the attacker has a valid login to the host machine.After describing the vulnerabilities in Java's security mechanisms,an extended security system based on Java 2 security architecture is introduced.It also explains the runtime status of system.The increased assurance of correct system operation and the integrity of Java application server are provided.
Solution to VPN and Authentication System

LI Jian-jun,XU Duan-qing,GUO Wei-qing

DOI: https://doi.org/10.3969/j.issn.1000-7024.2005.09.068

2005-01-01

Abstract:Combining with living examples and based on IPSEC,the realization of the VPN system was approached in many internet circumstances of remote access(such as gateway,broadband,xDSL etc.),and in view of the deficiency and the hidden troubles of the traditional static password,introduces a working mechanism was introduced which took into consideration both the tokencard two factor authentication and Windows AD,and proveds to be flexible and liable for the single-sign on clients.
Design of Secure Operating System

MAO Weifeng,PING Lingdi,JIANG Li,CHEN Xiaoping

DOI: https://doi.org/10.3969/j.issn.1000-3428.2006.12.068

2006-01-01

Abstract:SECOS is a secure operating system with independent intellectual property right,which accords with the requirements of level 4 secure operation system technology.This paper illustrates some key issues of the system,including design method for enchancement of security,improved model from the Bell-La Padula MAC(mandatory access control) implementation,the realization of the model,formal method during the system development,conversiion channel analysis and its prevention,and secure deletion.The performance evaluation shows the design and implementation of SECOS is effective.
Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

Xiaoguang Wang,Yong Qi,Zhi Wang,Yue Chen,Yajin Zhou

DOI: https://doi.org/10.1109/tdsc.2017.2675991

2019-01-01

Abstract:The OS kernel is critical to the security of a computer system. Many systems have been proposed to improve its security. A fundamental weakness of those systems is that page tables, the data structures that control the memory protection, are not isolated from the vulnerable kernel, and thus subject to tampering. To address that, researchers have relied on virtualization for reliable kernel memory protection. Unfortunately, such memory protection requires to monitor every update to the guest's page tables. This fundamentally conflicts with the recent advances in the hardware virtualization support. In this paper, we propose SecPod, an extensible framework for virtualization-based security systems that can provide both strong isolation and the compatibility with modern hardware. SecPod has two key techniques: paging delegation delegates and audits the kernel's paging operations to a secure space; execution trapping intercepts the (compromised) kernel's attempts to subvert SecPod by misusing privileged instructions. We have implemented a prototype of SecPod based on KVM. Our experiments show that SecPod is both effective and efficient.
Research on Information Security Model and Security System Design

黄益民,平玲娣,潘雪增

DOI: https://doi.org/10.3785/j.issn.1008-973x.2001.06.005

2001-01-01

Abstract:After study of existing security models; analysis of information flow model, Bell-LaPadula(BLP) access control model and Biba access control model; and collation and comparison of their advantages and disadvantages, an improved model is put forward that satisfies the actual demands of information security. An implementation strategy is put forward that ensures information security, reliability, practicality and compatibility in the designed security system. An implementation scheme of this security system and its components and functions is provided. This system combines the following functions: mandatory access contro1, privilege separation, security audit, identity authentication and self-protection. It achieves the level 3 of national information security standard and level B1 of TCSEC standard. It was implemented in the Windows NT and Linux operating system and has yielded good resultsin application.
Research and Realization of Embedded Security Operating System

CHEN Zhiping,LEI Hang,YANG Xia,LI Huan

DOI: https://doi.org/10.3969/j.issn.1000-3428.2007.01.028

2007-01-01

Abstract:Based on research and analysis of traditional embedded operating system security theories and technologies, combining with characteristics of embedded operating system, this paper puts forward a security kernel frame fit for embedded operating system: ESK(embedded security kernel). It has the characteristics as follows: self-determination configuring security attributions, mandatory access control, security signs and multi-strategy determinant. Through the reconstruction of Win CE operating system, the validity of the security kernel frame is validated.
Research on Network Driver Dual-Core-Based Secure Windows

WANG Pingli,ZHANG Gongxuan,WANG Nanlin

DOI: https://doi.org/10.3778/j.issn.1673-9418.2008.05.009

2008-01-01

Abstract:This paper proposes a secure solution which is based on a Dual-Core framework. The research and implementation of the communication mechanism is mainly discussed between primary-subordinate core and the Windows network driver of subordinate core. Dual-Core-Based Secure Windows terminal runs network security protection module on an embedded system, which can prevent hackers from attacking Windows system using system bugs. For development of Windows driver program, some developing tools are used which are Visual C++6.0, Windows Driver Development Kit and DriverStudio3.2. The experimentation indicates that this network secure solution can analyze network packages and achieve the aim of network security protection.
Cerberus: A Novel Hypervisor to Provide Trusted and Isolated Code Execution

Wen-Zhi Chen,Zhi-Peng Zhang,Jian-Hua Yang,Qin-Ming He

DOI: https://doi.org/10.1109/ISME.2010.172

2010-01-01

Abstract:Cerberus is a tiny x86 virtual machine monitor. It allows security sensitive codes to be executed in an isolated circumstance. The codes could attest their integrity to a remote party by a two-step attestation provided by Cerberus. Cerberus does not require the security sensitive applications to be modified or recompiled to run on it. These applications are packaged with the operating systems as virtual appliances (VA). The on-disk VA files are read-only to simplify the attestation process. Any storage file is sealed to the corresponding secure domain. Cerberus leveraged the nested paging technology to isolate the memory regions efficiently. And it also introduced a novel secure display sharing technology. It can guarantee the security property even when the attackers get control of everything but the core hardware infrastructures. Our performance experiment results show that the overhead introduced by Cerberus is less than 5%.
SeVMM: VMM-Based Security Control Model

Chen Wen-Zhi,Zhu Hong-Wei,Huang Wei

DOI: https://doi.org/10.1109/CW.2008.110

2008-01-01

Abstract:The security problem became more severe since the security requirement of different applications may conflict with the others in distributed application or grid computing. Virtualization technology can improvethe system's security, but did not satisfy the requirement of virtual resource sharing and inner-domain communication in distributed services and grid computing. By dividing the virtual resources into sharing virtual resources and normal ones, SeVMM provided secure mechanism for inter-domain communication control, which formed the base of multi-level security control model for virtual machine monitors, operating systems and applications. Case study and application showed that SeVMM improved the system's security without causing significant performance penalty.
Security Improvement Scheme of RDP Protocol

YU Sheng-Sheng,CAI Long-zheng,Zhou Jing-li,OuYang Kai,MA Duo-duo,ZENG Hai-peng

DOI: https://doi.org/10.3969/j.issn.1000-1220.2005.09.002

2005-01-01

Abstract:Windows server is one kind of the most widely used servers nowadays. And there are plenty of scenarios that people needs to access it from remote locations, especially through Internet. To satisfy these needs, Microsoft defined Remote Desktop Protocol (RDP). In this paper, the security characteristics of RDP and some of its implementations are analyzed. Based on that, a security-enhanced approach, which integrating the implementation of SSL (TLS) and RDP, is proposed and implemented.
The Implementation of Virtual Private Network on Windows NT Platform

WEN Gang,Yu Zhidong,ZHANG Shensheng

DOI: https://doi.org/10.3969/j.issn.1000-3428.2001.01.011

2001-01-01

Abstract:To establish an enterprise virtual private network is a necessary requirement of an enterprise which is facing the global competition. This article presents a kind of VPN implementation on Windows NT platform whieh is based on IPSec and combined with Network Address Translating (NAT) technology and having the advantage of IP packet compressing. Meanwhile, this article discusses the problems during the implementation.
The design and implementation of security analysis terminal for WLAN

Neng Cao,Yu QU,Bao ZHAO

DOI: https://doi.org/10.3969/j.issn.0258-7998.2009.02.046

2009-01-01

Abstract:Security mechanism of WLAN is weak,so it is very important to use security analysis system to manage it.Based on PowerPC processor and Linux OS,this paper implements the security analysis terminal of this system.This terminal succeeds to capture or send WLAN packets,and to implement interface modules for supporting active and passive analysis modules of this system.
Mobile security access system based on IPSec VPN

Jian Wang,Haihang Wang,Chengxiang Tan

2009-01-01

Journal of Computational Information Systems

Abstract:The wireless way that terminal devices connected to mobile networks communicate with fixed-IP networks brings serious hidden trouble to security. To ensure the security of mobile access, a mobile security access system (SMAS) based on IPSec VPN is designed and implemented. This system adopts multi-factor authentication mechanism based on both smart card and X. 509 certificates to meet security requirement, and adaptive VPN dial-up policy and hardware encryption card to improve system efficiency. Test results show that the system can ensure the communications security between mobile devices and fixed-IP networks perfectly with a high efficiency. Copyright © 2009 Binary Information Press.
Research & Implementation of Security Communication Mechanism for Virtual Private Network

吴越,疏朝明,卜勇华,胡爱群,毕光国

DOI: https://doi.org/10.3321/j.issn:1000-436x.2003.08.025

2003-01-01

Abstract:This paper has an overall research on security communication mechanism for IPSec based Virtual Private Network,discusses fundamental principles of various security service such as data origin authentication,integrity protection,anti-replay protection and their software implementation,illustrates the details of the security key exchange mechanism on non-secure public IP based network through a set of parameters negotiation,then presents a software implementation of Client/Server model WN key exchange upon LINUX operation system ,at last it gives IPSec security analysis and prospective view of the future research.
ANALYSIS OF INTERCONNECTION BETWEEN WINDOWS CE.NET AND WINDOWS PC AND ITS DESIGN

Shen Xiaozhao,Huang Xiaoyin,Jia Wei,Weng Zhengxin

DOI: https://doi.org/10.3969/j.issn.1000-386X.2009.12.066

2009-01-01

Abstract:This paper analyses the main difference of interconnection between the embedded operation system Windows CE.Net and the desktop Windows operation system.A serial port communication protocol is designed,it has the function of sending or receiving messages and control commands and can carry out the transmission of the files with breakpoint resume function.Finally,the interconnection between two systems is realized by programming in the environments of Microsoft Visual C++and Microsoft eMbedded Visual C++4.0 respectively.It is proved through experiments and uses that this method can accurately and reliably accomplish data transfer such as messages and files between the systems.
Implementation and Performance Analysis of Multilevel Security System in Pervasive Computing Environment

Zhiyong Tan,Duo Liu,Xuejun Zhuo,Yiqi Dai,Laurence T. Yang

DOI: https://doi.org/10.1007/s11227-011-0732-z

IF: 3.3

2013-01-01

The Journal of Supercomputing

Abstract:This paper presents the design and implementation features of Centralized Pervasive Computing Environment/Multilevel Security (CPCE/MLS), a multilevel security (MLS) system in pervasive computing environment deployed in Local area network (LAN) with a Mandatory Access Control (MAC) mechanism. By introducing the server-storage terminals and implementing the multilevel security access control mechanism based on the Bell---LaPadula model, process creation supervision, and an auditing mechanism, the CPCE/MLS system is able to provide the security guarantee of the whole computing environment. As such, each terminal is controlled under an integrated security policy. The performance test results show that the CPCE/MLS system, without optimization, generates great overhead but achieves significantly better performance after the cache mechanism is added in the monitor agent and in the hook driver. The system with the hook driver cache mechanism is able to achieve the 95.9% throughput of the native system with 8 K and 16 K requested data blocksize.
Embedded Peer-to-Peer file sharing system

Wei-ning QI,Jin-lin WANG

DOI: https://doi.org/10.3778/j.issn.1002-8331.2008.15.024

2008-01-01

Abstract:A file sharing system based on Windows CE embedded platform have been realizes.The author optimized the system according to the characteristics of the specific embedded platform and proposed two kinds of optimization.The problem of slow-speed I/O operation in the embedded platform is solved by efficient utilization of the memory resource.And the problem of limited Socket numbers is solved by improving the queue algorithm.Test results show that the performances of the system have been effectively improved by using these two optimization methods.And the downloading speed of files is enhanced in the improved system.
Windows CE and Its Developing Toolkit

过晓冰,伍卫国,刘敏

DOI: https://doi.org/10.3969/j.issn.1000-3428.2000.09.014

2000-01-01

Abstract:This paper introduces the technical properties of Windows CE,analyses its applied circumstance,and describes the difference between H/PC and P/PC. Based on Visual C++.this paper also introduces the developing toolkit and the developing platform for Windows CE Chinese edition, which is named Orion,and discusses how to install them.Finally,it presents some solutions to the problems in developing.
Construction of Security Wireless LAN Based on VPN

吴丽华,史烈

DOI: https://doi.org/10.3969/j.issn.1000-3428.2005.04.061

2005-01-01

Abstract:Security is a crucial problem in design and deployment of wireless LAN. The security technology used in nowadays 802.11 equipment WEP and 802.11x, has security flaws in design and can't protect the security of WLAN. This paper presents a network deployment scenario using VPN technology in WLAN, and discusses the design of VPN gateway in it.
TEEI - A Mobile Security Infrastructure for TEE Integration

Hongfeng Chai,Zhijun Lu,Qingyang Meng,Jun Wang,Xiubang Zhang,Zhijian Zhang

DOI: https://doi.org/10.1109/TrustCom.2014.121

2014-01-01

Abstract:Mobile security becomes a hot topic recently, especially in mobile payment and privacy data fields. Traditional solution can't keep a good balance between convenience and security. Against this background, a dual OS security solution named Trusted Execution Environment (TEE) is proposed and implemented by many institutions and companies. However, it raised TEE fragmentation and control problem. Addressing this issue, a mobile security infrastructure named Trusted Execution Environment Integration (TEEI) is presented to integrate multiple different TEEs. By using Trusted Virtual Machine (TVM) tech-nology, TEEI allows multiple TEEs running on one secure world on one mobile device at the same time and isolates them safely. Furthermore, a Virtual Network protocol is proposed to enable communication and cooperation among TEEs which includes TEE on TVM and TEE on SE. At last, a SOA-like Internal Trusted Service (ITS) framework is given to facilitate the development and maintenance of TEEs.

Security Middleware Based on Windows CE

Research on security extensions based on Java 2 security architecture

Solution to VPN and Authentication System

Design of Secure Operating System

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

Research on Information Security Model and Security System Design

Research and Realization of Embedded Security Operating System

Research on Network Driver Dual-Core-Based Secure Windows

Cerberus: A Novel Hypervisor to Provide Trusted and Isolated Code Execution

SeVMM: VMM-Based Security Control Model

Security Improvement Scheme of RDP Protocol

The Implementation of Virtual Private Network on Windows NT Platform

The design and implementation of security analysis terminal for WLAN

Mobile security access system based on IPSec VPN

Research & Implementation of Security Communication Mechanism for Virtual Private Network

ANALYSIS OF INTERCONNECTION BETWEEN WINDOWS CE.NET AND WINDOWS PC AND ITS DESIGN

Implementation and Performance Analysis of Multilevel Security System in Pervasive Computing Environment

Embedded Peer-to-Peer file sharing system

Windows CE and Its Developing Toolkit

Construction of Security Wireless LAN Based on VPN

TEEI - A Mobile Security Infrastructure for TEE Integration