10results about How to "Reduce attack surface" patented technology

The invention provides a sensitive data access method and system, electronic equipment and a computer program product, belongs to the technical field of computers, and aims to solve the problems of existing sensitive data in aspects of data protection, sharing and the like. The method is used for supporting a computing platform of a first execution mode and a second execution mode and comprises the following steps that trusted firmware is operated in the first execution mode, a user program is operated in the second execution mode, and a secure storage area where sensitive data are located is set to be inaccessible to the second execution mode through the trusted firmware; in response to a hardware exception triggered by an access instruction of the user program to the secure storage area, interrupting execution of the user program, entering an exception handling program in a first execution mode, and executing an access agent operation in the exception handling program through trusted firmware; and after the trusted firmware completes the proxy access operation, triggering an exception return instruction to recover the execution of the user program.

The invention discloses a power distribution network terminal integrity verification method and device based on memory access control, and the method comprises the steps: modifying an HVC exception entry corresponding to an exception vector table in a power distribution network terminal processor, so as to execute a corresponding HVC exception handling program; controlling to start kernel integrity verification or control flow integrity verification by the HVC exception handling program; when kernel integrity verification on the power distribution network terminal system is started, comparing a hash value calculated when the power distribution network terminal system is started with a hash value calculated when the number of generation events of a kernel layer and an application layer exceeds a preset threshold value so as to verify kernel integrity; and starting to perform control flow integrity verification on the power distribution network terminal system, obtaining a legal jump white list of the target function, and matching the legal jump white list with a current jump source address value to verify the control flow integrity. The method has the advantages of being simple in implementation method, low in cost, high in safety, stability and reliability and the like.

The application provides a trusted virtual machine processing method and device based on a system call agent, and relates to the technical field of information security. The method comprises the following steps: obtaining an IO request, and identifying a system call corresponding to the IO request; performing security purification processing on parameters of the system call to generate an agent request after security purification; writing the agent request after security purification into a shared memory area established in advance, and monitoring a response message corresponding to the agent request after security purification and generated by the shared memory area; performing security verification on the response message according to a preset constraint condition, and returning the response message in the case of passing the verification. According to the embodiment of the application, interaction and response verification are performed through the shared memory area, so that the kernel of the customer operating system can complete IO operation without relying on a traditional virtual IO driver, the attack surface is effectively reduced, the efficiency of IO processing is maintained, and the safety and IO performance are considered.

The present invention relates to the field of system security software vulnerability defense, and discloses a code reuse attack defense method based on real-time loading of gadget quality, comprising the following steps: obtaining a program code segment in a preprocessing stage, and performing static analysis on the instructions of all functions in the code segment to obtain the total number of gadgets in the entire program; evaluating the danger level of the obtained gadgets; initializing the thread pool, the standby area and the execution area, and storing gadget information in the initialization stage; monitoring the parent process in the real-time loading and unloading stage, and running the executable program by the child process; loading when 0xCC is found, and unloading when the parent process monitors the total number of gadgets in the execution area or the total danger level score of gadgets in the execution area exceeds a set threshold. The method disclosed by the present invention can load and unload in a more fine-grained manner, greatly reducing the attack surface and danger level.

This application discloses a method, apparatus, and medium for implementing secure socket communication within the operating system kernel, belonging to the field of computer systems and network communication technology. This method registers a new secure socket type at the socket layer of the operating system kernel and associates it with a customized set of operation functions. Applications only need to create sockets of this type and inject cryptographic parameters through standard system calls to establish a connection, thereby obtaining transparent, end-to-end automatic encrypted communication capabilities. During transmission, data is encrypted in kernel mode by calling the native crypto subsystem API through a rewritten send function and an authentication tag is attached. During reception, the rewritten receive function automatically performs decryption and integrity verification. This scheme avoids reliance on large external security libraries, improves security and performance, and decentralizes encryption / decryption, resource management, and other processes to the kernel mode, providing upper-layer applications with easy-to-use, lightweight, high-performance, and highly secure kernel-level transparent secure communication.

The invention relates to a one-way secure content distribution and tamper-proof display method and system, and belongs to the field of information security. The method comprises the steps that terminal identity authentication is carried out, an identity label is generated for each terminal, and the identity label comprises a device fingerprint, a root key, a public key, a private key and a digital certificate; by establishing a one-way content pulling mechanism, one-way content pulling between a terminal and a platform is realized; the platform prepares to issue content and performs content integrity protection to obtain root hash, a ciphertext and a digital signature; the platform packs and issues the ciphertext, the root hash, the digital signature and the necessary Merkle hash tree branches to the terminal, and the terminal performs verification and decryption; a closed display environment is created on the terminal, and tamper-proof display is achieved. According to the method, the security and tamper-proof capability of content distribution are systematically improved through fusion of multiple technologies such as hardware feature fingerprints, chaos random pulling, dynamic environment key binding, closed display environment and the like.

The invention discloses a method and a system for supporting security monitoring and cloud synchronization of edge service equipment, and relates to the technical field of cloud computing. The method comprises the following steps: deploying a local monitoring module at an edge node to carry out index acquisition and temporary storage; a data transfer module is deployed to pull data from a federated interface of the local monitoring module; the data transfer module actively pushes the data to a cloud time sequence database through secure connection after preprocessing such as adding an identity tag to the data; and the cloud provides unified visualization and alarm based on the stored data. According to the method, cloud pulling is converted into edge pushing, the monitoring data collection problem caused by the fact that the cloud cannot directly access the edge nodes is solved, and reliable convergence and unified operation and maintenance management of the edge monitoring data are achieved on the premise that network safety is guaranteed.

The application discloses a signaling conversion method and system based on telephone interaction, which is applied between a service domain and an operator access domain, and the method comprises the following steps: on the service domain side, receiving original signaling messages from an internal service system, performing signaling desensitization mapping processing on the original signaling messages, generating abstract metadata containing only service logic identification, and transmitting the abstract metadata to the access domain side across the domain through a kernel-level communication interface; on the access domain side, converting the abstract metadata into an identifiable signaling format of an operator, and sending the abstract metadata to an operator network; establishing a media stream transmission tunnel at an operating system kernel layer, and monitoring transmission quality indexes of the media stream transmission tunnel in real time; continuously monitoring a signaling registration transaction log on the service domain side through an independent relay state maintenance module running independently of the internal service system, caching complete parameters of the latest successful registration to the operator network based on the log, and realizing high-safety, high-reliability and high-compatibility signaling conversion.

The present invention discloses a target detection method and system based on a cloud-edge collaborative hybrid architecture, which belongs to the field of cloud-edge collaborative technology. The technical problem to be solved is how to achieve target detection while ensuring edge security in edge scenarios with limited computing power or hardware. It includes a global manager and a cloud-side worker component deployed on a cloud node, and an edge controller and an edge-side worker component deployed on an edge node; the cloud-side worker component is used to perform cloud-side model training on the target detection model; the edge-side worker component is used to obtain samples from edge devices based on AI tasks, and is used to perform edge-side reasoning calculations through the target detection model specified by the AI ​​task, and display edge-side reasoning results; the cloud-side worker component is used to perform cloud-side reasoning on difficult samples, and the edge-side worker component is used to display cloud-side reasoning results.

The application discloses a virtual RDMA device based on DPDK and a use method thereof. The virtual RDMA device based on DPDK comprises a front-end virtio-rdma device, which is used for receiving an RDMA device operation request initiated by an application program in a virtual machine, encapsulating the request as an instruction conforming to a virtio protocol, and sending the instruction to a back-end vhost-user- rdma device through a vring; and the back-end vhost-user- rdma device is used for simulating the function of a real RDMA network card, the device can acquire and analyze the instruction conforming to the virtio protocol from a circular queue vring, execute corresponding RDMA device operations, and return the operation results to the front-end virtio-rdma device through the vring. The application can get rid of the dependence on the real RDMA device, and can improve the resource utilization, system flexibility and safety.