区块链辅助的未公开IIoT漏洞动态令牌可信共享保护
Blockchain-assisted Undisclosed IIoT Vulnerabilities Trusted Sharing Protection with Dynamic Token
摘要：
随着工业物联网（IIoT）设备的大规模部署，威胁IIoT安全的漏洞数量也在急剧增加，其中包括大量未公开的IIoT漏洞，这些漏洞缺乏缓解措施。协同漏洞披露（CVD）是最流行的漏洞共享解决方案之一，其中一些安全工作者（SW）可以共同开发未公开的漏洞补丁。然而，CVD假设共享参与者（SW）都是诚实的，因此为不诚实的SW提供了泄露未公开的IIoT漏洞的机会。为了应对这些威胁，我们提出了一个具有动态令牌的未公开IIoT漏洞可信共享保护（UIV-TSP）方案。在本文中，动态令牌是一种隐式的访问凭证，供软件获取未公开的漏洞信息，仅由系统持有，并随着软件访问而不断更新。同时，可以将最新更新的令牌作为可追溯性令牌悄悄地潜入所获取的信息中。一旦未公开的漏洞信息离开软件主机，嵌入式自毁程序将自动触发，以防止泄漏，因为可追溯性令牌中的目的MAC地址已更改。为了快速区分不诚实的软件，信任机制被用来评估软件的信任值。此外，我们设计了一种区块链辅助的连续日志存储方法，以实现动态令牌的防篡改和未公开的IIoT漏洞共享的透明性。仿真结果表明，我们提出的方案是弹性的，以抑制不诚实的SW和保护物联网未公开的漏洞有效。
英文摘要：
With the large-scale deployment of industrial internet of things (IIoT) devices, the number of vulnerabilities that threaten IIoT security is also growing dramatically, including a mass of undisclosed IIoT vulnerabilities that lack mitigation measures. Coordination Vulnerabilities Disclosure (CVD) is one of the most popular vulnerabilities sharing solutions, in which some security workers (SWs) can develop undisclosed vulnerabilities patches together. However, CVD assumes that sharing participants (SWs) are all honest, and thus offering chances for dishonest SWs to leak undisclosed IIoT vulnerabilities. To combat such threats, we propose an Undisclosed IIoT Vulnerabilities Trusted Sharing Protection (UIV-TSP) scheme with dynamic token. In this article, a dynamic token is an implicit access credential for an SW to acquire an undisclosed vulnerability information, which is only held by the system and constantly updated as the SW access. Meanwhile, the latest updated token can be stealthily sneaked into the acquired information as the traceability token. Once the undisclosed vulnerability information leaves the SW host, the embedded self-destruct program will be automatically triggered to prevent leaks since the destination MAC address in the traceability token has changed. To quickly distinguish dishonest SWs, trust mechanism is adopted to evaluate the trust value of SWs. Moreover, we design a blockchain-assisted continuous logs storage method to achieve the tamper-proofing of dynamic token and the transparency of undisclosed IIoT vulnerabilities sharing. The simulation results indicate that our proposed scheme is resilient to suppress dishonest SWs and protect the IoT undisclosed vulnerabilities effectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
