16results about How to "Reduce attack surface" patented technology

The invention relates to an equipment authority management method and device, a medium, electronic equipment and a program product, belongs to the field of equipment authority management, can meet equipment authority management requirements in various equipment use environments, and has universality and very high flexibility. The equipment authority management method comprises the steps that a target authority management strategy for target equipment is acquired from authority management strategies pre-configured by a server side, and the target equipment belongs to equipment subjected to authority management by the server side; the pre-configured authority management strategy is an authority management strategy pre-configured by the server for each device subjected to authority management; and according to the target authority management strategy, performing authority management on the administrator authority on the target equipment, and creating a customized token with the administrator authority to perform authority improvement of the target equipment.

The invention discloses a lightweight power Internet of Things secure communication method, system and device and a storage medium, and the method comprises the steps: carrying out the authentication of the identity of a first access entity through employing an SPA mechanism, carrying out the legal authorization of an access request if the authentication is passed, and forbidding the access request if the authentication is not passed; a BIC algorithm is introduced into the authorized access request, and credibility evaluation is performed on network nodes based on the BIC algorithm and a Bayesian network; determining the access authority of the network node according to the evaluation result; and continuously monitoring and recording the behaviors of the network node, determining the credibility of the current network node according to the recorded historical data and behavior mode of the network node and the credibility evaluation result, and dynamically adjusting the access permission of the network node according to the credibility. The method can provide more comprehensive and powerful security assurance, monitor and quickly respond to security events in real time, and reduce the security risk of the electric power Internet of Things to the greatest extent.

The invention relates to the technical field of steering systems, in particular to a tamper-proof safe starting control method. The invention relates to a tamper-proof safe start control method, which comprises software in an ECU (Electronic Control Unit), and is characterized by comprising the following specific steps: S1, firstly, classifying the software to be operated in the ECU, and distinguishing the software A in the ECU as required; s2, secondly, when the software A is flashed to the ECU each time, setting a security startup table and storing the security startup table in a nonvolatile memory; and S3, finally, after flashing is completed, when the ECU is powered on and started each time, data in the safe start table set in the step S2 needs to be randomly verified at first in a software operation stage. Compared with the prior art, the tamper-proof security startup control method provided by the invention has the advantages that fewer codes can be verified each time, the codes of different address fields can be dispersedly verified, and the verification range is expanded, so that the attack surface is reduced.

The invention provides an Internet of Things terminal dynamic access method and system in a network stealth environment, and relates to the technical field of network security, and the method comprises the steps: initializing a server, a terminal and a gateway; the business capabilities of different servers are re-aggregated and divided according to different systems, different businesses, different data security protection levels and different business access volumes, and are loaded to different BDP business gateways; when the Internet of Things terminal initiates service access, the BDP terminal network access control application takes over the service access process in a proxy mode, and establishes an access strategy and service connection to the BDP admission gateway and the BDP service gateway respectively to realize the access of the Internet of Things terminal; in the access process, user behavior scores are calculated through a multi-user behavior analysis model, safety level evaluation is continuously carried out on user behaviors, the access authority and strategy of the Internet of Things terminal are dynamically adjusted according to the user credit level, and dynamic control over risk behaviors is achieved.

The invention provides a sensitive data access method and system, electronic equipment and a computer program product, belongs to the technical field of computers, and aims to solve the problems of existing sensitive data in aspects of data protection, sharing and the like. The method is used for supporting a computing platform of a first execution mode and a second execution mode and comprises the following steps that trusted firmware is operated in the first execution mode, a user program is operated in the second execution mode, and a secure storage area where sensitive data are located is set to be inaccessible to the second execution mode through the trusted firmware; in response to a hardware exception triggered by an access instruction of the user program to the secure storage area, interrupting execution of the user program, entering an exception handling program in a first execution mode, and executing an access agent operation in the exception handling program through trusted firmware; and after the trusted firmware completes the proxy access operation, triggering an exception return instruction to recover the execution of the user program.

The invention relates to the field of system security software vulnerability defense, and discloses a code reuse attack defense method based on gadget quality real-time loading, which comprises the following steps: in a preprocessing stage, obtaining a program code segment, and performing static analysis on instructions of all functions in the code segment to obtain the total number of gadgets in the whole program; carrying out danger degree evaluation on the obtained gadget; in the initialization stage, initialization of a thread pool, initialization of a standby area and an execution area and storage of gadget information are carried out; in the real-time loading and unloading stage, the parent process is monitored, and the child process runs an executable program; loading is carried out when 0 * CC is found, and unloading is carried out when the parent process monitors that the total number of the gadgets in the execution area or the total danger degree score of the gadgets in the execution area exceeds a set threshold value. According to the method disclosed by the invention, loading and unloading in finer granularity can be realized, and the attack surface and the danger degree are greatly reduced.

The invention discloses a power distribution network terminal integrity verification method and device based on memory access control, and the method comprises the steps: modifying an HVC exception entry corresponding to an exception vector table in a power distribution network terminal processor, so as to execute a corresponding HVC exception handling program; controlling to start kernel integrity verification or control flow integrity verification by the HVC exception handling program; when kernel integrity verification on the power distribution network terminal system is started, comparing a hash value calculated when the power distribution network terminal system is started with a hash value calculated when the number of generation events of a kernel layer and an application layer exceeds a preset threshold value so as to verify kernel integrity; and starting to perform control flow integrity verification on the power distribution network terminal system, obtaining a legal jump white list of the target function, and matching the legal jump white list with a current jump source address value to verify the control flow integrity. The method has the advantages of being simple in implementation method, low in cost, high in safety, stability and reliability and the like.

The application provides a trusted virtual machine processing method and device based on a system call agent, and relates to the technical field of information security. The method comprises the following steps: obtaining an IO request, and identifying a system call corresponding to the IO request; performing security purification processing on parameters of the system call to generate an agent request after security purification; writing the agent request after security purification into a shared memory area established in advance, and monitoring a response message corresponding to the agent request after security purification and generated by the shared memory area; performing security verification on the response message according to a preset constraint condition, and returning the response message in the case of passing the verification. According to the embodiment of the application, interaction and response verification are performed through the shared memory area, so that the kernel of the customer operating system can complete IO operation without relying on a traditional virtual IO driver, the attack surface is effectively reduced, the efficiency of IO processing is maintained, and the safety and IO performance are considered.

The present invention relates to the field of system security software vulnerability defense, and discloses a code reuse attack defense method based on real-time loading of gadget quality, comprising the following steps: obtaining a program code segment in a preprocessing stage, and performing static analysis on the instructions of all functions in the code segment to obtain the total number of gadgets in the entire program; evaluating the danger level of the obtained gadgets; initializing the thread pool, the standby area and the execution area, and storing gadget information in the initialization stage; monitoring the parent process in the real-time loading and unloading stage, and running the executable program by the child process; loading when 0xCC is found, and unloading when the parent process monitors the total number of gadgets in the execution area or the total danger level score of gadgets in the execution area exceeds a set threshold. The method disclosed by the present invention can load and unload in a more fine-grained manner, greatly reducing the attack surface and danger level.

This application discloses a method, apparatus, and medium for implementing secure socket communication within the operating system kernel, belonging to the field of computer systems and network communication technology. This method registers a new secure socket type at the socket layer of the operating system kernel and associates it with a customized set of operation functions. Applications only need to create sockets of this type and inject cryptographic parameters through standard system calls to establish a connection, thereby obtaining transparent, end-to-end automatic encrypted communication capabilities. During transmission, data is encrypted in kernel mode by calling the native crypto subsystem API through a rewritten send function and an authentication tag is attached. During reception, the rewritten receive function automatically performs decryption and integrity verification. This scheme avoids reliance on large external security libraries, improves security and performance, and decentralizes encryption / decryption, resource management, and other processes to the kernel mode, providing upper-layer applications with easy-to-use, lightweight, high-performance, and highly secure kernel-level transparent secure communication.

The invention relates to a one-way secure content distribution and tamper-proof display method and system, and belongs to the field of information security. The method comprises the steps that terminal identity authentication is carried out, an identity label is generated for each terminal, and the identity label comprises a device fingerprint, a root key, a public key, a private key and a digital certificate; by establishing a one-way content pulling mechanism, one-way content pulling between a terminal and a platform is realized; the platform prepares to issue content and performs content integrity protection to obtain root hash, a ciphertext and a digital signature; the platform packs and issues the ciphertext, the root hash, the digital signature and the necessary Merkle hash tree branches to the terminal, and the terminal performs verification and decryption; a closed display environment is created on the terminal, and tamper-proof display is achieved. According to the method, the security and tamper-proof capability of content distribution are systematically improved through fusion of multiple technologies such as hardware feature fingerprints, chaos random pulling, dynamic environment key binding, closed display environment and the like.

The invention discloses a method and a system for supporting security monitoring and cloud synchronization of edge service equipment, and relates to the technical field of cloud computing. The method comprises the following steps: deploying a local monitoring module at an edge node to carry out index acquisition and temporary storage; a data transfer module is deployed to pull data from a federated interface of the local monitoring module; the data transfer module actively pushes the data to a cloud time sequence database through secure connection after preprocessing such as adding an identity tag to the data; and the cloud provides unified visualization and alarm based on the stored data. According to the method, cloud pulling is converted into edge pushing, the monitoring data collection problem caused by the fact that the cloud cannot directly access the edge nodes is solved, and reliable convergence and unified operation and maintenance management of the edge monitoring data are achieved on the premise that network safety is guaranteed.

The application discloses a signaling conversion method and system based on telephone interaction, which is applied between a service domain and an operator access domain, and the method comprises the following steps: on the service domain side, receiving original signaling messages from an internal service system, performing signaling desensitization mapping processing on the original signaling messages, generating abstract metadata containing only service logic identification, and transmitting the abstract metadata to the access domain side across the domain through a kernel-level communication interface; on the access domain side, converting the abstract metadata into an identifiable signaling format of an operator, and sending the abstract metadata to an operator network; establishing a media stream transmission tunnel at an operating system kernel layer, and monitoring transmission quality indexes of the media stream transmission tunnel in real time; continuously monitoring a signaling registration transaction log on the service domain side through an independent relay state maintenance module running independently of the internal service system, caching complete parameters of the latest successful registration to the operator network based on the log, and realizing high-safety, high-reliability and high-compatibility signaling conversion.

The present invention discloses a target detection method and system based on a cloud-edge collaborative hybrid architecture, which belongs to the field of cloud-edge collaborative technology. The technical problem to be solved is how to achieve target detection while ensuring edge security in edge scenarios with limited computing power or hardware. It includes a global manager and a cloud-side worker component deployed on a cloud node, and an edge controller and an edge-side worker component deployed on an edge node; the cloud-side worker component is used to perform cloud-side model training on the target detection model; the edge-side worker component is used to obtain samples from edge devices based on AI tasks, and is used to perform edge-side reasoning calculations through the target detection model specified by the AI ​​task, and display edge-side reasoning results; the cloud-side worker component is used to perform cloud-side reasoning on difficult samples, and the edge-side worker component is used to display cloud-side reasoning results.

The invention discloses a method and device for constructing a mirror image based on a containerized environment and a storage medium, and the method comprises the steps: starting to construct the mirror image; selecting a basic mirror image matched with the business language stack, checking a command line interpreter program in the basic mirror image and removing the command line interpreter program to obtain a command line-free interpreter basic mirror image; and constructing an initial production mirror image based on the basic mirror image of the command-line-free interpreter, checking a command-line interpreter program in the initial production mirror image, and removing the command-line interpreter program to obtain a final production mirror image. The invention aims to provide a method for constructing a command-line-free interpreter program mirror image in a containerized environment so as to reduce attack risks and improve the security of an application system. By providing the basic mirror image of the command line-free interpreter program and deleting the command line interpreter program in the production mirror image in the construction process of the production mirror image, the possibility that an attacker attacks by using the command line interpreter program can be effectively reduced, so that the security of an application system is improved.

The application discloses a virtual RDMA device based on DPDK and a use method thereof. The virtual RDMA device based on DPDK comprises a front-end virtio-rdma device, which is used for receiving an RDMA device operation request initiated by an application program in a virtual machine, encapsulating the request as an instruction conforming to a virtio protocol, and sending the instruction to a back-end vhost-user- rdma device through a vring; and the back-end vhost-user- rdma device is used for simulating the function of a real RDMA network card, the device can acquire and analyze the instruction conforming to the virtio protocol from a circular queue vring, execute corresponding RDMA device operations, and return the operation results to the front-end virtio-rdma device through the vring. The application can get rid of the dependence on the real RDMA device, and can improve the resource utilization, system flexibility and safety.