195results about "Data taking prevention" patented technology

To provide a network management method using microsegmentation for zero trust security.SOLUTION: A method includes (a) obtaining a source MAC address of a packet by a specific access switch when a first forwarding is performed on the packet, registering the source MAC address when the source MAC address is not registered in a MAC address table, and performing a second forwarding when the source MAC address satisfies a specific user security policy, (b) obtaining a source IP address of the packet by the specific access switch, registering the source IP address when the source IP address is not registered in a routing table, and performing a third forwarding, obtaining a destination IP address or service port of the packet, and filtering the packet for which the third forwarding is performed by checking whether the destination IP address or service port of the packet satisfies a specific service security policy.SELECTED DRAWING: Figure 2

The present disclosure relates to a method for establishing a secure remote access (SRA) connection between a cloud computing system (CCS) and an industrial automation system (IAS), the method comprising: receiving, by an SRA server component of the CSS, a first SRA connection establishment message from a first SRA client component of the CSS or from a second SRA client component of a user device connected to the CSS;Receiving, by a connection orchestrator component of the CCS, an instruction to establish the SRA connection between the CSS and the IAS; sending, by the connection orchestrator component and based at least in part on the instruction, a machine-to-machine network protocol message to a third SRA client of the IAS, containing information to establish the SRA connection between the IAS and the CSS; receiving, by the SRA server component of the CSS, a second SRA connection establishment message from the second SRA client of the IAS; and establishing, via the SRA server component, the secure SRA connection between the first SRA client of the CSS and the third SRA client of the IAS, or between the second SRA client of the user device and the third SRA client of the IAS. The present disclosure also relates to a corresponding computer system and a computer program.

This vehicle-mounted device is connected to a vehicle-mounted network mounted on a vehicle, and is provided with a processing unit that performs a process relating to a determination of whether or not data flowing through the vehicle-mounted network is normal, receives periodic data periodically transmitted through the vehicle-mounted network, and transmits the periodic data to the vehicle-mounted network. When event data of the same type as the periodic data is received between the reception time points of two pieces of continuously received periodic data, a determination is made as to whether or not the event data is normal on the basis of the value of the payload of the event data and the value of the payload of at least one of the two pieces of periodic data.

A route selection system (10) according to one embodiment of the present disclosure comprises: an acquisition means (11) that acquires access information that at least includes information regarding access purposes, security information that indicates communication route security regarding a usable communication route from an access source to an access destination, and route characteristic information that at least includes performance information indicating the performance of a communication route; and a selection means (12) that selects, using the access information and route characteristic information, one or more communication routes that are used for communication between the access source and the access destination.

To provide a communication control system for easily setting a RADIUS client and provide a method.SOLUTION: A communication control system 1 contains: an access point 10 that includes a function as a RADIUS server for determining whether or not a network communication of a terminal is identified or a first RADIUS client corresponded to the RADIUS server, and stores identification information and a secret key for identifying the RADIUS server; and a layer 2(L2) switch 20 directly connected in a network segment similar to the access point. The access point 10 contains a transmission part that transmits the stored identification information and the secret key to the L2 switch in a first time period. The layer L2 switch contains: a reception part that receives the identification information and the secret key transmitted from the access point; and a setting part that performs a setting so that the L2 switch is operated as a second RADIUS client corresponded to the RADIUS server on the basis of the received identification information and the secret key.SELECTED DRAWING: Figure 1

A system is provided. The system includes a plurality of wireless access points (WAPs) corresponding to a plurality of wireless communication protocols. The system includes a wireless local network server coupled to the plurality of WAPs via a communication bus. The wireless local network server is configured to convert data under the plurality of wireless communication protocols to data under a local protocol. The system includes a data diode communicatively coupled to the communication bus. The system includes a processor configured to control the data diode to exchange the data under the local protocol between the plurality of WAPs. Also provided is a method and an apparatus.

A communication analysis system includes: an information obtainer (2501) that obtains past communication information indicating communication performed by a monitoring target (10); a prediction target link extractor (2502) that extracts, based on the past communication information obtained, an unestablished communication link of communication that has not been established in the past communication information, the unestablished communication link being at least one communication link that is a prediction target; a link confidence level calculator (2504) that calculates a confidence level indicating the likelihood that the unestablished communication link extracted will be established as a normal communication link in the future; and a NW graph creator (2506) that creates a NW graph, in which the unestablished communication link and information regarding the unestablished communication link are mapped, as graph information for determining whether to add the communication link to a whitelist (22), using the unestablished communication link extracted, the confidence level calculated, and the past communication information obtained.

To provide a security center capable of constantly reducing the risk of hacking and virus infection by making a connection to a public Internet network only for a limited time, and a method for controlling the security center.SOLUTION: A client computer sends connection destination information of a desired Internet service on a public Internet network to cause the sandbox computer to make a connection and acquire a domain and an IP address of the Internet service due to prescribed operation, the sandbox computer sends the acquired domain or the like of the Internet to the client computer, and the client computer makes a connection the Internet service to use it by using the domain or the like of the Internet service acquired by making a connection to the public Internet network only for a period of using the Internet service, and cannot make a connection to the public Internet service again after ending the use.SELECTED DRAWING: Figure 2

A communication analysis system includes: an information obtainer that obtains past communication information indicating communication performed by a monitoring target; a prediction target link extractor that extracts, based on the past communication information obtained, an unestablished communication link of communication that has not been established in the past communication information, the unestablished communication link being at least one communication link that is a prediction target; a link confidence level calculator that calculates a confidence level indicating the likelihood that the unestablished communication link extracted will be established as a normal communication link in the future; and a NW graph creator that creates a NW graph, in which the unestablished communication link and information regarding the unestablished communication link are mapped, as graph information for determining whether to add the communication link to a whitelist, using the unestablished communication link extracted, the confidence level calculated, and the past communication information obtained.

The extension provides a network of computers operating over connected channels including the Internet and within intranets, specifically designed to host data and code without detection and share encrypted messages, including messages with embedded encryption algorithms and keys, without concern for public interception of the transmission. Users can generate new algorithms and keys as frequently as desired, without fear of detection or interception. The extension includes computers referred to as "shadow computers" within the design that are known to be inaccessible except to "whitelisted" and other authentication technology paired companions.

Vehicle communication system, comprehensive: an on-board device (130); and one or more vehicle controllers (120) connected to a vehicle network (NW1, NW2) wherein the on-board device (130) is configured to perform the following steps: Transmitting an encrypted message (MS), encrypted outside of a vehicle, to one or more vehicle controllers (120) connected to the vehicle network (NW1, NW2); and if the encrypted message (MS) is an individual message to one of the vehicle controllers (120), transmission of the encrypted message (MS) to one of the vehicle controllers (120) via the vehicle network (NW1, NW2); and if the encrypted message (MS) is a common message to the one or more vehicle controllers (120), decrypt the encrypted message (MS) using an encryption key (K2, K5) belonging to the on-board device (130), and then transmit the decrypted message to the one or more vehicle controllers (120) via the vehicle network (NW1, NW2).

A dual-mode communication device adapted for communication over a public network, wherein the dual-mode communication device is adapted to be operated in a normal mode and in an obfuscated mode. The dual-mode communication device includes a processor and a network interface device. The processor develops a frame from a payload received by the dual-communication device and, if the dual-mode communication device is operating in the obfuscated mode, an obfuscated frame from the frame. The frame and the obfuscated frame comprise a preamble that conforms with protocols associated with the public network and the processor. A network interface transmits one of the frame or the obfuscated frame using the public network. The payload may be extracted from the frame by any receiving device operating in the normal mode in the public network and the payload may be extracted from the obfuscated frame only by another communication device also operating in the obfuscated mode in the public network.

Methods, apparatuses, and systems for handling end-to-end encryption are described. A user device may send encrypted data to a server via a proxy using an encryption key shared with multiple network nodes across multiple layers.

The present invention discloses a virtual instance creation method based on cloud computing technology and a cloud management platform. The method includes: a cloud management platform acquiring a virtual instance creation request input by a tenant, the creation request including specification information of the virtual instance to be created, site information, and information about a cloud-native application to which the virtual instance to be created belongs. Based on the acquired information, the cloud management platform selects a computing node whose specification matches the specification information to create the virtual instance; the computing node is configured in a cloud data center that matches the site information; and the virtual instance is configured to run one or more microservices in the cloud-native application. Based on the acquired information about the cloud-native application, the cloud management platform configures a virtual instance manager in the computing node to mark service packets sent by the virtual instance with an identifier of the cloud-native application to implement identification and recognition of service packets of the virtual instance, thereby simplifying access permission configuration operations and improving security policy configuration efficiency.

The present disclosure relates to a method for establishing a secure remote access (SRA) connection between a cloud computing system (CCS) and an industrial automation system (IAS), the method comprising: receiving, by an SRA server component of the CCS, a first SRA connection establishment message from a first SRA client of the CCS or from a second SRA client of a user device connected to the CCS;Receiving, by a connection orchestrator component of the CCS, a specification for establishing the SRA connection between the CCS and the IAS; sending, by the connection orchestrator component and based at least in part on the specification, a machine-to-machine network protocol message to a third SRA client of the IAS, which includes information for establishing the SRA connection between the IAS and the CCS; receiving, by the SRA server component of the CCS, a second SRA connection establishment message from the second SRA client of the IAS; and establishing, via the SRA server component, the secure SRA connection between the first SRA client of the CCS and the third SRA client of the IAS, or between the second SRA client of the user device and the third SRA client of the IAS. The present disclosure also relates to a corresponding computer system and a computer program.

Method for encrypting a plaintext with a block cipher E of block size L E using a symmetric key K, characterized in that a fingerprint function (FP u ) is used, which satisfies the two requirements that from two unequal bit sequences (BF1 ≠ BF2) with a sufficiently high probability for the application, it follows that the results of the application of the fingerprint function (FP u ) on these bit sequences are unequal (FP u (BF1) ≠ FP u (BF2)), and that to the fingerprint function (FP u ) a fingerprint reversal function (FP u -1 ) exists, so that the following always applies: FP u -1 (FP u (BF) || BF[u+1..L(BF)]) = BF[1..u], where u and L Edo not necessarily have to be equal, and a general cipher EGen is used by applying the fingerprint function to the concatenation of the complete first u bits PB u 1 of the plaintext and selected or all bits FPlnput of the remaining plaintext, and then the first block of the ciphertext CB 1 by EGen encryption of the u-bit long result FP u (PB u 1 || FPInput), i.e. CB 1 := EGen(FP u (PB u 1 || FPlnput)), and the resulting encryption of the first u bits of the plaintext CB 1 as initialization vector IV := CB 1 for the encryption of parts of the or of the remaining plaintext with the block cipher E, using any operating mode requiring an initialization vector (IV).

Device and method for routing communications streams for nomadic user equipment, selectively and automatically via a remote core equipment or a local core equipment The device routes a data stream from a first nomadic user equipment, UE (10) to a second nomadic UE (20; 30) within a communication network comprising a remote core equipment, EPC (EPC-D) and a local EPC (EPC-L). The device comprises means (140) for coupling the local EPC (EPC-L) to the remote EPC (EPC-D) and for determining whether or not the second UE (20; 30) is attached to the local EPC (EPC-L). It further comprises means for redirecting the flow by: routing to the second UE (20) via the local EPC (EPC-L) when the second UE (30) is attached to the local EPC (EPC-L), and to the second UE via the remote EPC (EPC-D) otherwise. The invention is advantageously implemented with a dedicated application, integrated into the UEs.(Figure to be published with the abstract: Figure 1).

To prevent normal data frames from being discarded when a communication device establishes a connection via multiple frequency channels.SOLUTION: In a state in which a communication device 102 and a communication device 103 have established a connection via a first frequency channel on a first link 104, it is determined whether the communication device 103 has established a connection via a second frequency channel on a second link 105, and if it is determined that the communication device 103 has established a connection via the second frequency channel, a cryptographic key common to communication via the first frequency channel and communication via the second frequency channel is set.SELECTED DRAWING: Figure 1

To provide an in-vehicle device that simulates a legitimate device and detects an unauthorized device connected to an in-vehicle network.SOLUTION: An in-vehicle device according to an embodiment of the present disclosure installed in a vehicle and communicating with an in-vehicle device connected to an in-vehicle network of the vehicle includes a control unit that performs control regarding the communication, and the control unit acquires a transmission time point and a reception time point of transmitted and received communication data when performing the communication with the in-vehicle device, and determines whether the in-vehicle device that has performed the communication is an unauthorized device on the basis of the acquired transmission time point and reception time point.SELECTED DRAWING: Figure 1

To provide a communication device capable of determining that an unauthorized device is connected by the communication device as a single unit.SOLUTION: A communication device includes a transceiver 10 and a controller 20. The controller outputs a transmission signal including identification information as a communication signal to be transmitted through a communication wire, and receives a reception signal including the identification information as a communication signal received through the communication wire. The transceiver is connected to the communication wire, transmits the transmission signal inputted from the controller from the communication wire, and outputs the reception signal received from the communication wire to the controller. The transceiver includes a storage part 132 for storing the identification information included in the transmission signal, and a processing part 131 for determining that an unauthorized device is connected to the communication wire in the case that the same identification information as the identification information included in the reception signal is stored in the storage part.SELECTED DRAWING: Figure 2

To detect unauthorized intrusion more reliably.SOLUTION: An on-vehicle device connected to an ECU equipped on a vehicle with a communication line includes: a PHY part for converting a reception signal received from the communication line to a digital signal; an oscillation circuit for outputting a first oscillation signal based on oscillation of a first oscillator; a detection circuit for outputting a detection value according to the difference between the frequency of the first oscillation signal and the frequency of a second oscillation signal included in the reception signal; a switch part for switching between a first state in which at least a part of signal in the reception signal is not inputted to the PHY part and a second state in which the reception signal is inputted to the PHY part; and a control part for controlling the switch part, the control part makes the switch part to the first state if the detection value represent a difference exceeding a predetermined value from a normal value according to the difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on the oscillation of a second oscillator included in the ECU, and makes the switch part to the second state if the detection value is within the predetermined value from the normal value.SELECTED DRAWING: Figure 3

A security policy analysis is disclosed. Configuration information containing at least one policy is received. A model is built using the received configuration information, which includes normalizing the policy. A policy analysis is performed using the policy, which includes performing a pre-change analysis associated with the proposed policy change. The results of the policy analysis are provided as output.

The information management system includes a firewall connected to a network camera (i.e., a device) having an image capturing function and a sound collecting function and a management server performing an authentication process for authenticating a user using the user terminal between the management server and the user terminal and allowing the user terminal to connect to the network camera via the firewall. The information management system is configured to acquire, via the firewall, media data including an image captured by the network camera and an audio collected by the network camera from the network camera to which the user terminal is allowed to connect based on a connection permission condition defined in the management server.

To suppress an increase in a load required for the determination compared to when an electronic certificate is used to determine whether to permit access, and to prevent unnecessary prohibition of access to the system to be accessed compared to when the permission of access is determined only on the basis of information indicating the destination.SOLUTION: In a case in which a user specifies a system to be accessed and an operation to be performed on that system, when the information indicating the destination of the system specified by a user and the information indicating the operation specified by the user are not linked and stored in memory, a processor requests the system to perform name resolution based on the information indicating the destination of the system specified by the user, and accesses the system according to the address obtained in response to the request.SELECTED DRAWING: Figure 1

To provide a fraudulent signal detection device and a fraudulent signal detection method for detecting that a fraudulent signal is input to a communication network where signals are expected to be input at a predetermined period.SOLUTION: In a vehicle, a fraudulent signal detection device (ECU 110) includes a measurement unit that measures a time interval between a plurality of consecutive signals input to a communication network in chronological order, and a determination unit that determines that a conflict has occurred when a second signal is transmitted, and determines that the second signal is a mediated normal signal if a time interval between a first signal and the second signal that should be transmitted at the time interval is longer than the time interval, and a signal interval between the second signal and a signal input immediately before is equal to or less than a predetermined interval.SELECTED DRAWING: Figure 2

The present invention provides a security entry maintenance method, device, network device, and storage medium, which relate to the field of communication technology. The method includes: when a protocol connection with a second network device is interrupted, obtaining a valid lifetime value included in each remote MAC-IP entry, where the valid lifetime value indicates the valid lifetime of an IP address included in the remote MAC-IP entry; and deleting at least one remote MAC-IP entry when the duration of the protocol connection interruption reaches the valid lifetime value. This can deny unauthorized packets from entering the network and improve network security.

The information processing apparatus (100) includes: an acquirer (121) configured to acquire a security log including information regarding unauthorized communication stored in the upper NW device being a device constituting an overlay network, an authentication log stored in the cloud server, and a communication log stored in the lower NW device being a device constituting an underlay network; a specifier (123) configured to specify information such that, when the authentication log includes a connection source IP address that does not exist in the communication log acquired by the acquirer (121) and the security log includes information regarding an access not permitted to be used from the connection source IP address, the specifier (123) specifies the information regarding the access as unauthorized communication; and a blocking instructor (124) configured to give an instruction for blocking of the unauthorized communication specified by the specifier (123).