263results about "Data taking prevention" patented technology

An in-vehicle device is an in-vehicle device connected to an in-vehicle ECU mounted on a vehicle such that communication is available, and includes a control unit performing processing relevant to transmission data transmitted from the in-vehicle ECU, in which the control unit receives transmission data transmitted from the in-vehicle ECU, registers the received transmission data in association with a reception time point of the transmission data in a chronological database, specifies abnormal transmission data from the transmission data registered in the chronological database, and registers information relevant to the specified abnormal transmission data in an abnormality history database.

To provide a multicast content distribution system capable of reducing an amount of packet communication in a multicast content distribution based on network coding.SOLUTION: A relay server 2 of a multicast content distribution system is reported by a requesting node of the number of request packets, a transmission capacity with the requesting node, and a total transmission capacity with nodes from which the requesting node can collect encoded packets, and includes a request packet number calculation unit 22 that calculates, as a new number of request packets, a maximum value among minimum numbers of request packets for each requesting node obtained by multiplying the reported number of request packets by a value obtained by increasing a ratio of the transmission capacity with the requesting node to the total transmission capacity by a predetermined premium rate.SELECTED DRAWING: Figure 5

To provide a network management method using microsegmentation for zero trust security.SOLUTION: A method includes (a) obtaining a source MAC address of a packet by a specific access switch when a first forwarding is performed on the packet, registering the source MAC address when the source MAC address is not registered in a MAC address table, and performing a second forwarding when the source MAC address satisfies a specific user security policy, (b) obtaining a source IP address of the packet by the specific access switch, registering the source IP address when the source IP address is not registered in a routing table, and performing a third forwarding, obtaining a destination IP address or service port of the packet, and filtering the packet for which the third forwarding is performed by checking whether the destination IP address or service port of the packet satisfies a specific service security policy.SELECTED DRAWING: Figure 2

Provides a network management method using microsegmentation for zero trust security. [Solution] The method involves (a) a specific access switch, when a first forwarding is performed on a packet, obtaining the source MAC address of the packet, registering the source MAC address in a MAC address table if it is not registered therein, and performing a second forwarding if the source MAC address satisfies a specific user security policy; (b) a specific access switch, when a third forwarding is performed on a packet, obtaining the destination IP address or service port of the packet, and filtering the packet for which the third forwarding is performed by checking whether they satisfy a specific service security policy.

An information processing apparatus according to an example embodiment of the present disclosure includes at least one memory configured to store instructions; and at least one processor configured to execute the instructions to: acquire a data set in which a plurality of combinations of a pattern of a plurality of elements indicating an access attribute and an access control action associated with the pattern of the elements are defined and request a user to input an action associated with a pattern of an element not covered by the data set in a case in which the data set does not cover an action associated with one or more assumed patterns of an element.

The present disclosure relates to a method for establishing a secure remote access (SRA) connection between a cloud computing system (CCS) and an industrial automation system (IAS), the method comprising: receiving, by an SRA server component of the CSS, a first SRA connection establishment message from a first SRA client component of the CSS or from a second SRA client component of a user device connected to the CSS;Receiving, by a connection orchestrator component of the CCS, an instruction to establish the SRA connection between the CSS and the IAS; sending, by the connection orchestrator component and based at least in part on the instruction, a machine-to-machine network protocol message to a third SRA client of the IAS, containing information to establish the SRA connection between the IAS and the CSS; receiving, by the SRA server component of the CSS, a second SRA connection establishment message from the second SRA client of the IAS; and establishing, via the SRA server component, the secure SRA connection between the first SRA client of the CSS and the third SRA client of the IAS, or between the second SRA client of the user device and the third SRA client of the IAS. The present disclosure also relates to a corresponding computer system and a computer program.

This vehicle-mounted device is connected to a vehicle-mounted network mounted on a vehicle, and is provided with a processing unit that performs a process relating to a determination of whether or not data flowing through the vehicle-mounted network is normal, receives periodic data periodically transmitted through the vehicle-mounted network, and transmits the periodic data to the vehicle-mounted network. When event data of the same type as the periodic data is received between the reception time points of two pieces of continuously received periodic data, a determination is made as to whether or not the event data is normal on the basis of the value of the payload of the event data and the value of the payload of at least one of the two pieces of periodic data.

A route selection system (10) according to one embodiment of the present disclosure comprises: an acquisition means (11) that acquires access information that at least includes information regarding access purposes, security information that indicates communication route security regarding a usable communication route from an access source to an access destination, and route characteristic information that at least includes performance information indicating the performance of a communication route; and a selection means (12) that selects, using the access information and route characteristic information, one or more communication routes that are used for communication between the access source and the access destination.

To provide a communication control system for easily setting a RADIUS client and provide a method.SOLUTION: A communication control system 1 contains: an access point 10 that includes a function as a RADIUS server for determining whether or not a network communication of a terminal is identified or a first RADIUS client corresponded to the RADIUS server, and stores identification information and a secret key for identifying the RADIUS server; and a layer 2(L2) switch 20 directly connected in a network segment similar to the access point. The access point 10 contains a transmission part that transmits the stored identification information and the secret key to the L2 switch in a first time period. The layer L2 switch contains: a reception part that receives the identification information and the secret key transmitted from the access point; and a setting part that performs a setting so that the L2 switch is operated as a second RADIUS client corresponded to the RADIUS server on the basis of the received identification information and the secret key.SELECTED DRAWING: Figure 1

A processing device (10) includes a collector (132) configured to collect communication data of an OT (Operational Technology) network; a receiver (131) configured to information presenting a business type and a scale of a business facility in which the OT network is built; a specifying unit (133) configured to specify a communication environment of the OT network based on the communication data; an evaluator (135) configured to make an evaluation; and a generator (136) configured to generate a report presenting a result of the evaluation made by the evaluator (135).

The present disclosure provides a method of managing an interaction with a large language model (LLM). Further, the method may include receiving a prompt data from a user device associated with an organization. Further, the method may include receiving a policy data from an organization device associated with the organization. Further, the policy data may be associated with the organization. Further, the method may include analyzing the prompt data based on the policy data. Further, the method may include generating an output data based on the analyzing. Further, the generating may be based on the LLM. Further, the method may include storing each of the prompt data, the output data, and an identifier associated with one or more of the user device, the organization device, and the organization. Further, the method may include transmitting the output data to the user device.

A system is provided. The system includes a plurality of wireless access points (WAPs) corresponding to a plurality of wireless communication protocols. The system includes a wireless local network server coupled to the plurality of WAPs via a communication bus. The wireless local network server is configured to convert data under the plurality of wireless communication protocols to data under a local protocol. The system includes a data diode communicatively coupled to the communication bus. The system includes a processor configured to control the data diode to exchange the data under the local protocol between the plurality of WAPs. Also provided is a method and an apparatus.

A communication analysis system includes: an information obtainer (2501) that obtains past communication information indicating communication performed by a monitoring target (10); a prediction target link extractor (2502) that extracts, based on the past communication information obtained, an unestablished communication link of communication that has not been established in the past communication information, the unestablished communication link being at least one communication link that is a prediction target; a link confidence level calculator (2504) that calculates a confidence level indicating the likelihood that the unestablished communication link extracted will be established as a normal communication link in the future; and a NW graph creator (2506) that creates a NW graph, in which the unestablished communication link and information regarding the unestablished communication link are mapped, as graph information for determining whether to add the communication link to a whitelist (22), using the unestablished communication link extracted, the confidence level calculated, and the past communication information obtained.

To provide a security center capable of constantly reducing the risk of hacking and virus infection by making a connection to a public Internet network only for a limited time, and a method for controlling the security center.SOLUTION: A client computer sends connection destination information of a desired Internet service on a public Internet network to cause the sandbox computer to make a connection and acquire a domain and an IP address of the Internet service due to prescribed operation, the sandbox computer sends the acquired domain or the like of the Internet to the client computer, and the client computer makes a connection the Internet service to use it by using the domain or the like of the Internet service acquired by making a connection to the public Internet network only for a period of using the Internet service, and cannot make a connection to the public Internet service again after ending the use.SELECTED DRAWING: Figure 2

A communication analysis system includes: an information obtainer that obtains past communication information indicating communication performed by a monitoring target; a prediction target link extractor that extracts, based on the past communication information obtained, an unestablished communication link of communication that has not been established in the past communication information, the unestablished communication link being at least one communication link that is a prediction target; a link confidence level calculator that calculates a confidence level indicating the likelihood that the unestablished communication link extracted will be established as a normal communication link in the future; and a NW graph creator that creates a NW graph, in which the unestablished communication link and information regarding the unestablished communication link are mapped, as graph information for determining whether to add the communication link to a whitelist, using the unestablished communication link extracted, the confidence level calculated, and the past communication information obtained.

According to an embodiment, a communication system includes a first communication control apparatus connected between a network connection apparatus and a first client apparatus, a second communication control apparatus connected between the network connection apparatus and a second client apparatus, and a communication control management apparatus that is connected to the network connection apparatus and manages communication by the first communication control apparatus and second communication control apparatus. The communication control management apparatus monitors communication based on management information defining regular communication between the first client apparatus and the second client apparatus as communication by the first packet including the first virtual tag, and defining regular communication between the communication control management apparatus and the first communication control apparatus or second communication control apparatus as communication by the second packet including the second virtual tag.

To provide a method for filtering and qualifying a security event of an intrusion detection system.SOLUTION: A method for filtering a security event of an intrusion detection system (10) of a computer system (2) having plural calculation units (6, 7) connected for data communication includes: a step (100) of initializing a counter unique to each event type, in which the intrusion detection system (10) is configured to detect the security event and categorize it according to plural event types; a step (120) of increasing the counter unique to the type corresponding to the detected security event until it reaches a threshold in response to the detection (110) of the security event by the intrusion detection system; and a step (140) of cancelling the detected security event when the counter unique to the type corresponding to the detected security event reaches the threshold.SELECTED DRAWING: Figure 2

The extension provides a network of computers operating over connected channels including the Internet and within intranets, specifically designed to host data and code without detection and share encrypted messages, including messages with embedded encryption algorithms and keys, without concern for public interception of the transmission. Users can generate new algorithms and keys as frequently as desired, without fear of detection or interception. The extension includes computers referred to as "shadow computers" within the design that are known to be inaccessible except to "whitelisted" and other authentication technology paired companions.

A communication analysis system includes: an information receiver (2101) that receives information indicating analysis target communication performed by a monitoring target (10); an information obtainer (2105) that obtains past communication information indicating communication by the monitoring target (10); a WL determiner (2102) that determines, using the obtained analysis target communication and a whitelist, that non-WL communication has been established in the analysis target communication; a similar terminal extractor (2103) that extracts one or more terminals similar to destination and source terminals included in a non-WL communication link determined; a primary similar communication link extractor (2107) that extracts a past communication link similar to the non-WL communication link as a primary similar communication link from the obtained past communication information using the extracted similar terminals; and a NW graph creator (2109) that creates a NW graph for analysis as graph information for analyzing the non-whitelist communication using the extracted primary similar communication link and the obtained past communication information.

Vehicle communication system, comprehensive: an on-board device (130); and one or more vehicle controllers (120) connected to a vehicle network (NW1, NW2) wherein the on-board device (130) is configured to perform the following steps: Transmitting an encrypted message (MS), encrypted outside of a vehicle, to one or more vehicle controllers (120) connected to the vehicle network (NW1, NW2); and if the encrypted message (MS) is an individual message to one of the vehicle controllers (120), transmission of the encrypted message (MS) to one of the vehicle controllers (120) via the vehicle network (NW1, NW2); and if the encrypted message (MS) is a common message to the one or more vehicle controllers (120), decrypt the encrypted message (MS) using an encryption key (K2, K5) belonging to the on-board device (130), and then transmit the decrypted message to the one or more vehicle controllers (120) via the vehicle network (NW1, NW2).

A dual-mode communication device adapted for communication over a public network, wherein the dual-mode communication device is adapted to be operated in a normal mode and in an obfuscated mode. The dual-mode communication device includes a processor and a network interface device. The processor develops a frame from a payload received by the dual-communication device and, if the dual-mode communication device is operating in the obfuscated mode, an obfuscated frame from the frame. The frame and the obfuscated frame comprise a preamble that conforms with protocols associated with the public network and the processor. A network interface transmits one of the frame or the obfuscated frame using the public network. The payload may be extracted from the frame by any receiving device operating in the normal mode in the public network and the payload may be extracted from the obfuscated frame only by another communication device also operating in the obfuscated mode in the public network.

Methods, apparatuses, and systems for handling end-to-end encryption are described. A user device may send encrypted data to a server via a proxy using an encryption key shared with multiple network nodes across multiple layers.

The present invention discloses a virtual instance creation method based on cloud computing technology and a cloud management platform. The method includes: a cloud management platform acquiring a virtual instance creation request input by a tenant, the creation request including specification information of the virtual instance to be created, site information, and information about a cloud-native application to which the virtual instance to be created belongs. Based on the acquired information, the cloud management platform selects a computing node whose specification matches the specification information to create the virtual instance; the computing node is configured in a cloud data center that matches the site information; and the virtual instance is configured to run one or more microservices in the cloud-native application. Based on the acquired information about the cloud-native application, the cloud management platform configures a virtual instance manager in the computing node to mark service packets sent by the virtual instance with an identifier of the cloud-native application to implement identification and recognition of service packets of the virtual instance, thereby simplifying access permission configuration operations and improving security policy configuration efficiency.

To provide communication equipment and a communication device capable of achieving favorable communication control.SOLUTION: Communication equipment has: a first port group 21 that can establish connections using a first communication standard; a second port group 22 that can establish connections using a second communication standard that is more secure than the first communication standard; and a controller 210 that, after the connections using the first communication standard and the connections using the second communication standard are established, performs control of receiving from the first port group 21 first data sent by using the first communication standard and transmitting the first data from the second port group 22 by using the second communication standard, and of receiving from the second port group 22 second data sent by using the second communication standard and transmitting the second data from the first port group 21 by using the first communication standard.SELECTED DRAWING: Figure 1

The present disclosure relates to a method for establishing a secure remote access (SRA) connection between a cloud computing system (CCS) and an industrial automation system (IAS), the method comprising: receiving, by an SRA server component of the CCS, a first SRA connection establishment message from a first SRA client of the CCS or from a second SRA client of a user device connected to the CCS;Receiving, by a connection orchestrator component of the CCS, a specification for establishing the SRA connection between the CCS and the IAS; sending, by the connection orchestrator component and based at least in part on the specification, a machine-to-machine network protocol message to a third SRA client of the IAS, which includes information for establishing the SRA connection between the IAS and the CCS; receiving, by the SRA server component of the CCS, a second SRA connection establishment message from the second SRA client of the IAS; and establishing, via the SRA server component, the secure SRA connection between the first SRA client of the CCS and the third SRA client of the IAS, or between the second SRA client of the user device and the third SRA client of the IAS. The present disclosure also relates to a corresponding computer system and a computer program.

Method for encrypting a plaintext with a block cipher E of block size L E using a symmetric key K, characterized in that a fingerprint function (FP u ) is used, which satisfies the two requirements that from two unequal bit sequences (BF1 ≠ BF2) with a sufficiently high probability for the application, it follows that the results of the application of the fingerprint function (FP u ) on these bit sequences are unequal (FP u (BF1) ≠ FP u (BF2)), and that to the fingerprint function (FP u ) a fingerprint reversal function (FP u -1 ) exists, so that the following always applies: FP u -1 (FP u (BF) || BF[u+1..L(BF)]) = BF[1..u], where u and L Edo not necessarily have to be equal, and a general cipher EGen is used by applying the fingerprint function to the concatenation of the complete first u bits PB u 1 of the plaintext and selected or all bits FPlnput of the remaining plaintext, and then the first block of the ciphertext CB 1 by EGen encryption of the u-bit long result FP u (PB u 1 || FPInput), i.e. CB 1 := EGen(FP u (PB u 1 || FPlnput)), and the resulting encryption of the first u bits of the plaintext CB 1 as initialization vector IV := CB 1 for the encryption of parts of the or of the remaining plaintext with the block cipher E, using any operating mode requiring an initialization vector (IV).

Device and method for routing communications streams for nomadic user equipment, selectively and automatically via a remote core equipment or a local core equipment The device routes a data stream from a first nomadic user equipment, UE (10) to a second nomadic UE (20; 30) within a communication network comprising a remote core equipment, EPC (EPC-D) and a local EPC (EPC-L). The device comprises means (140) for coupling the local EPC (EPC-L) to the remote EPC (EPC-D) and for determining whether or not the second UE (20; 30) is attached to the local EPC (EPC-L). It further comprises means for redirecting the flow by: routing to the second UE (20) via the local EPC (EPC-L) when the second UE (30) is attached to the local EPC (EPC-L), and to the second UE via the remote EPC (EPC-D) otherwise. The invention is advantageously implemented with a dedicated application, integrated into the UEs.(Figure to be published with the abstract: Figure 1).

To maintain high responsiveness of vehicle control while instantaneously detecting and appropriately defending illegal communication from attackers on a vehicle control system.SOLUTION: A vehicle control system includes: two control device groups respectively constituting two different communication networks; a communication management device communicably connected to the two control device groups; and a routing device that routes communication between the two communication networks. When a message is received from one of the control devices, the communication management device performs authentication processing for the one of the control devices, and includes a communication address of one control device as a transmission source address in a relay message for relaying the message received from the one control device to a control device of the other of the control device groups. The control device of the other of the control device groups performs communication with the one control device by using the communication address of the one control device included in the relay message without interposition of the communication management device.SELECTED DRAWING: Figure 1

To prevent normal data frames from being discarded when a communication device establishes a connection via multiple frequency channels.SOLUTION: In a state in which a communication device 102 and a communication device 103 have established a connection via a first frequency channel on a first link 104, it is determined whether the communication device 103 has established a connection via a second frequency channel on a second link 105, and if it is determined that the communication device 103 has established a connection via the second frequency channel, a cryptographic key common to communication via the first frequency channel and communication via the second frequency channel is set.SELECTED DRAWING: Figure 1