Table of Content

    15 July 2018, Volume 4 Issue 7
    Secboot’s AI Technology Pushes Identif cation Security to the Cusp of a New Era
    2018, 4(7):  582-587. 
    Asbtract ( )   PDF (1248KB) ( )  
    Related Articles | Metrics
    Data Sharing Governance Path in GDPR Ear
    2018, 4(7):  589-592. 
    Asbtract ( )   PDF (805KB) ( )  
    Related Articles | Metrics
    Research on Legal Problems of Deep Web
    2018, 4(7):  593-601. 
    Asbtract ( )   PDF (1701KB) ( )  
    References | Related Articles | Metrics
    Many people believe that Google Search can identify most of the information on a given topic on the Internet. The entire online world is a huge network world that goes beyond Google or any other search engine. The size of the Internet dark network is even greater. As of 2015, because of the hidden services on the dark network, the “dark network” is often used interchangeably with the deep network.The number of nonindexed sites called Deep Web is estimated to be 400 to 500 times larger than that of indexed searchable websites. “Deep Web” represents the dark side of the Internet. Deep Web, known as Darknet, has become a paradise for evading supervision and committing crimes. This article outlines how Deep Web is accessed and why we should care about them. The continued growth of Deep Web and the accelerated expansion of Darknet have brought new policy challenges. The response to these challenges may have a profound impact on civil liberties, national security, and the global economy.
    A Study of the Terrorism Cyber Public Opinion
    2018, 4(7):  602-610. 
    Asbtract ( )   PDF (1772KB) ( )  
    References | Related Articles | Metrics
    The internet has accelerated the speed of the spreading of the message and news which creates a quite new ecological field of cyber opinion. Various terrorist groups have maximized the potentials of this means to carry out the cyber penetration, usage and attack. The cyber terrorism propaganda has become the priority strategy. The internet has equipped the terrorism with a perfect tool and space for its impact resistance, panic, publicity and “ideological struggle”. Therefore, the controlling and management of the cyber terrorism information is of great strategic significance. The construction of binary controlling and management system for cyber terrorism information based on legal regulation and technical regulation is a valuable choice for the benefit of the overall national security.
    Reflection on the Legislation Mode and Scope of Foreign Personal Information Protection
    2018, 4(7):  611-618. 
    Asbtract ( )   PDF (1392KB) ( )  
    References | Related Articles | Metrics
    The commercial value, management value, value of association and research value of personal information are becoming more and more important. In the process of information resource storage, dissemination and utilization of personal information security, there have been numerous instances of personal information security, which has aroused peoples anxiety and panic. Based on the perspective of comparative law, this paper introduces and comments on the legislation of personal information protection outside the region. In the legislative mode, the principle and solidification of comprehensive legislation should be prevented and the opportunism of departmental legislation should be avoided so as to respond to the practice demand of personal information protection in the legislative mode of safe harbor; the identification and connection of personal information must be clearly defined on the scope of protection, and the scope of protection should be properly qualified and the specific reasonable utilization should be tolerated.
    Breakthrough in the Dilemma of Citizens' Personal Information Protection in Criminal Law
    2018, 4(7):  619-625. 
    Asbtract ( )   PDF (1238KB) ( )  
    References | Related Articles | Metrics
    How to form a perfect protection of personal information under the criminal law system is a difficult problem. Even if Article 253 of the Criminal Law and the latest judicial interpretation further stipulate the crime of infringing citizens personal information, it does not play a better role in suppressing citizens personal information crime. The object of personal information criminal law protection is “citizen rights” or personal information itself is still inconclusive. Although personal information protection has been criminalized in criminal law, due to its own controversy and the impact of the era of big data under the rapid development of the Internet, the criminalization of personal information protection has entered a difficult situation. In view of the relevant provisions in this interpretation, combined with the controversial issues in theory and practice, it is necessary to consider the nature of the “personal information” to be protected, thus breaking through the predicament of personal information protection.
    Legal Analysis of Providing URL Detection Service
    2018, 4(7):  626-632. 
    Asbtract ( )   PDF (1206KB) ( )  
    References | Related Articles | Metrics
    URL detection is a service provided by cyber-security companies to for users current URL risks before browsing the web. It helps maintain cyber security, prevent cybercrime, and protect public interest and users' interests. Query for the infringement of the right of reputation, impeding the transaction, no right to exercise law enforcement cannot be established. In the referee of URL detection error cases, we should consider whether network security companies have subjective fault, whether language is neutral and objective, and whether complaint channels are set, and so on. From the perspective of encouraging innovation, giving website testing services certain tolerance can avoid cyber-security companies bear heavy legal obligations, resulting in the spread of malicious URL.
    The Application of Trusted Computing 3.0 in Classified Protection Standard System 2.0
    2018, 4(7):  633-638. 
    Asbtract ( )   PDF (1736KB) ( )  
    References | Related Articles | Metrics
    China's classified protection system has entered the 2.0 era, which is changed from the traditional protection of computer information system to the construction of network space active defense system under new computing environments such as cloud computing, mobile Internet, Internet of things, industrial control and big data. It focuses on securing critical information infrastructure. This paper outlines China's Independent and innovative trusted computing active immune architecture 3.0 and deeply analyzes its role in the hierarchical protection 2.0 standard system. The research results show that the technical architecture can achieve the different level of trust in the computing environment, regional boundary, the communication network of compute node, both comply with the principle of moderate security of level protection, and improve the practical engineering. In the end, it gives an application of the CCTV high-level information system. The practical results show that the trusted 3.0 computing architecture has active defense capability and can fundamentally guarantee the network security of high security level business system.
    Review of USB Device Security Technology
    2018, 4(7):  639-645. 
    Asbtract ( )   PDF (1779KB) ( )  
    References | Related Articles | Metrics
    The emergence of the USB (universal serial bus) interface has brought convenience to users. However, the convenience and the use of extensive make it one of the attackers targets. Common USB attacks include USB ferry attacks and USB HID attacks. This paper analyzes several common USB attacks, summarizes the detection and protection techniques for USB attacks at home and abroad. At the same time, this paper analyzes the advantages and disadvantages of each protection technique. In the end, combined with various protection techniques, we propose protection strategies against USB attacks and future development directions.
    Research on Cloud Data Encryption Scheme Based on Chinese Cryptographic Algorithms
    2018, 4(7):  646-651. 
    Asbtract ( )   PDF (1899KB) ( )  
    References | Related Articles | Metrics
    With the rapid development of cloud storage technology, more and more enterprises and individuals store in the cloud. However, data security has become a “nightmare” for its development. Based on this, a data encryption protection mechanism for cloud storage environment is proposed in this paper. This method adopts different encryption strategies according to different data types, and achieve efficient encryption and decryption of structured data and unstructured data. In order to ensure Chinas cyber security and public interest, this paper uses Chinese cryptographic algorithms SM2, SM3 and SM4 instead of foreign cryptographic algorithms. Finally, this paper uses Java language and BS architecture to design and implement a cloud storage encryption system. The simulation experiment demonstrates the correctness and rationality of the design, the design has a certain application value. The solution integrates the terminal data security, network transmission security and data storage security technologies to effectively ensure the integrity, confidentiality, and availability of the cloud data.
    DengLu1, A Multi-party Closed-loop Web Identity Authentication and Management Mechanism Based on Trusted User Agent
    2018, 4(7):  652-661. 
    Asbtract ( )   PDF (2554KB) ( )  
    References | Related Articles | Metrics
    The increasing scale of the Web gives rise to issues such as “password fatigue”, “phishing” and “brute force attack”, and brings great challenges to the currently dominant password-based web identity authentication mechanism. In this paper, we propose a new web identity authentication mechanism by introducing a module named “Trusted User Agent” in the authentication process, which is compatible with the current password-based mechanism. Specifically, the user account information is automatically generated, stored, and directly sent to the server of its destination website for authentication by its user agent. The server then authorizes the corresponding terminal after successful authentication. This forms a secure closed authentication loop. A system based on this mechanism has been developed on the platforms of Android, iOS, and Chrome. Analyses and user studies have proven that its security, usability, and deployablility are superior to the current password-based mechanism.
    Research on Security Protection of Typical Government Affairs Application Platform
    2018, 4(7):  662-667. 
    Asbtract ( )   PDF (1634KB) ( )  
    References | Related Articles | Metrics
    China, as the largest developing country in the world, is also the country with the largest number of Internet users in the world. Facing the increasingly complicated network security situation in the international community, it is urgent to maintain our cyberspace security. Among them, how to properly prevent malicious network attacks faced by a large number of government websites and effectively and ensure the safe operation of various government application platforms is even more important. We have legally authorized Infiltration of a provinciallevel GovernmentNetwork data exchange platform in both directions of entry and exit. Through the prevention issues found in the infiltration process, combined with our many years of network security work experience, we have proposed a closedloop security management and protection network technology in place. In order to be different from the general model of general cyber security type technical articles, we try to restore the actual penetration scenarios in the text, and from the point of view of the attacker, express important protection ideas in the most concise language and conclude 6 types of typical network protection work. I hope to be able to help network security attack and defense technology enthusiasts and government website administrators.
    Research on Safety Protection of SCADA System in Gas Industry
    2018, 4(7):  668-676. 
    Asbtract ( )   PDF (6397KB) ( )  
    References | Related Articles | Metrics
    In order to solve the safety problems faced by users of gas SCADA system, this paper gives a review of relevant literature of the current system security risks on the basis of the characteristics of SCADA system, and then carried out four aspects of security design which are, communication network, network boundary, computing environment, and unified supervision. Firstly, it can realize the compliance of SCADA system, meets the national legal requirements such as “The Peoples Republic of China Cyber Security Law”, and gradually meet the requirements of the “Guidelines for the Information Security Protection of Industrial Control Systems”; secondly, it meets the requirements for data transmission integrity and confidentiality of SCADA, and communication network monitoring needs, network boundary and core server access control to prevent intrusion needs, and at the same time enhance safety awareness of personnel through safety training for employees, systematically ensure the safety of SCADA system, and reduce the downtime and damage of SCADA system due to information security issues. The public interests and the probability of endangering public safety events effectively protect the operational safety of SCADA. The safety design of this program can be replicated and promoted in gas and other industries and has universal applicability.