77 results about "Access control list" patented technology

The invention provides an on-off control method and device for a gateway port and a medium. The on-off control method comprises the steps of obtaining historical access log data and threat intelligence data of a target port in a gateway; based on the historical access log data and the threat intelligence data, performing time sequence analysis by using a pre-trained long-short-term memory network model to obtain a predicted security access time period of the target port in a future preset time period; generating a temporary port exposure preset rule of the target port according to the predicted security access time period; determining a traffic feature vector of the real-time traffic data packet of the target port; using a preset deep reinforcement learning agent to determine an on-off control instruction for the target port based on the traffic feature vector and a temporary port exposure preset rule; and executing the on-off control instruction to modify an access control list state of the gateway firewall to the target port. According to the method and the device, dynamic and refined gateway port on-off control can be realized, so that the service flexibility and security are considered.

The invention provides an access control list configuration method and device, electronic equipment and a storage medium, and relates to the technical field of servers, and the method comprises the steps: collecting subnet information in a target containerization cluster, a configured access control list rule and security threat features in network traffic; the information is subjected to fusion analysis based on a predefined security policy so as to generate an access control list rule set containing different priorities, and then the rules are synchronized to a cluster virtual switch kernel according to the priorities so as to realize hierarchical control and dynamic protection of network traffic. The problems that a large-scale dynamic network environment is difficult to deal with, the automation level is low and malicious traffic cannot be efficiently intercepted due to the fact that manual configuration and static rule maintenance are relied on and deep integration of a containerized cluster network structure is lacked can be solved. The technical effects of improving the automation level of containerized cluster network management, enhancing the adaptability to a dynamic network environment, and realizing efficient interception of malicious traffic to guarantee network security are achieved.

Systems and methods for auditing access control lists (ACLs) of a network infrastructure are provided. A plurality of network interfaces associated with a specified entity is identified. A plurality of access control lists (ACLs) is received. Each ACL of the plurality of ACL includes a plurality of rules associated with a respective network interface of the plurality of network interfaces. Network traffic metadata associated with the plurality of network interfaces is received. A corresponding set of rule utilization parameters is identified for each rule of the plurality of rules by matching the network traffic metadata to the plurality of rules.

The application provides a method and device for dynamically expanding an access control list. The method comprises the following steps: obtaining a first number of software ACL table entries of a first service module currently triggering a hardware access control list (ACL) configuration; obtaining a second number of software ACL table entries of a second service module of a current ACL dynamic expansion object; calculating a difference between the first number of software ACL table entries and the second number of software ACL table entries; when the difference exceeds a preset difference threshold, entering a hardware ACL resource overflow pre-check; and when the difference is less than the preset difference threshold, keeping the second service module as the ACL dynamic expansion object.

A computer-implemented method for determining access to resources using a knowledge graph includes obtaining a knowledge graph with multiple nodes connected by edges and receiving a request for a requestor to access a resource. The requestor is associated with a first node, and the resource is associated with a second node within the knowledge graph. The method includes determining a path between the first and second nodes and evaluating each node along the path. For each node, the method determines an access control list (ACL) stored separately from the knowledge graph and verifies the requestor's access based on the ACL. Based on determining that the requestor has access to all nodes along the path, the method includes determining that the requestor has access to the second node. The method includes returning, to the requestor, a response indicating access to the resource.

The invention provides a network access control list adjusting method based on flow analysis and optimization, which comprises the following steps of: firstly, acquiring total flow information, and then dynamically constructing a network digital twinborn model based on the total flow information; constructing a causal derivation model based on a simulation result of the network digital twin model; analyzing and processing the real-time traffic by using a causal derivation model, and generating a plurality of network access control list change rules and corresponding deployment strategies; and then simulating the network access control list change rules and the deployment strategy thereof in the network digital twin model, and determining a target network access control list from each network access control list change rule based on a simulation result. According to the invention, a self-learning, dynamic risk quantification and strategy automatic generation and verification ACL tuning system is constructed, and the ACL tuning system is not only an optimization rule, but fundamentally changes the generation and management normal form of the ACL.

This invention discloses a network control and scheduling method based on traffic awareness and path optimization. It collects real-time traffic from network devices, extracts key features, and analyzes traffic pattern trends. Using these trends, the rule set is clustered according to the similarity of matching frequencies to form rule clusters. Within each cluster, rules are sorted based on matching frequency. The rule arrangement is analyzed to identify conflicting rule pairs. By assessing the severity of the conflicts, a conflict list with clear objectives is generated. This conflict list is then processed using a genetic algorithm to obtain an optimized rule sequence. Rigorous testing using simulated traffic yields a final rule set version. This final rule set version, passing all tests, is securely pushed to network devices, enabling real-time optimized access control list configuration. Network devices immediately operate based on the latest and optimal policies, thereby improving overall network security and data processing efficiency.

The application provides a network table query method and data packet processing method of a switch and related devices. A plurality of binary classifiers are set in the on-chip memory of a switch processor. According to the output values of the exact match table, the longest prefix match table and the access control list, the pre-operation results corresponding to the output values are generated through hash operation, and the pre-operation results are pre-stored in the plurality of binary classifiers corresponding to the exact match table, the longest prefix match table and the access control list. When the network table query of the switch is performed, the plurality of binary classifiers can be used to output the output values of the switch network table in parallel based on the pre-operation results. The scheme realizes the isomorphism of the storage structures of the exact match table, the longest prefix match table and the access control list, and can dynamically allocate the storage resources of the on-chip memory when the network table query is performed, so as to adapt to the network table query in different time and different scenes.

The present application provides a memory access control list-based software security protection method and apparatus. The method comprises: acquiring a current memory operation generated by a memory access instruction at a runtime of a target program; based on a pre-stored memory access control list, performing matching on the current memory operation to obtain a memory operation matching result; and, based on the memory operation matching result, determining whether to execute the current memory operation or prevent the current memory operation. According to the method, the memory access instruction is monitored in real time by using the memory access control list for filtering the current memory operation, the hardware implementation is relatively lightweight, no additional overhead of runtime performance is introduced during monitoring, and range matching support needs to be provided only for certain less significant bits, thereby greatly reducing the hardware overhead, and also alleviating different types of vulnerabilities.

Systems and methods for data migration are provided. A method for migrating bulk data from a first data platform to a second data platform includes: providing a virtual machine (VM) on a cloud service provider subscription, migrating access control list (ACL) information, one or more legal tags, and reference data from the first data platform to the second data platform, using the VM, analyzing data types of the bulk data, generating a file-generic data migration pipeline from the first data platform to the second data platform, using the VM, fetching storage records for the bulk data from the first data platform using the VM, migrating the bulk data from the first data platform to the second data platform, using the VM, validating the migrated bulk data in the second data platform, and synchronizing the migrated bulk data in the second data platform with changes made since the migrating began.

The present application belongs to the technical field of computer data security, and particularly relates to a method for protecting specified paths and files from tampering, which comprises the following steps: registering a relevant main function code callback routine in a Windows file system filtering driver framework, and constructing an interception layer for intercepting I / O requests; constructing an access control list with PID and file object path as key values in a kernel non-paging memory; synchronously extracting PID and target file complete path in the callback routine, and judging according to system processes, exemption lists, and protection paths / types, and rejecting the request if it does not meet the conditions; and achieving dynamic management of strategies by establishing a control channel. The present application solves the problem of strategy failure caused by volume path changes by hiding file persistent volume IDs in the system; adopts hierarchical data structures and concurrent synchronization mechanisms to ensure efficient queries and little impact on disk IO performance; and supports multi-dimensional fine control with the help of multi-layer control switches and scenario-based templates.

An incremental micro-segmentation system includes a shared network and a network control device. The network control device is configured to perform operations of: retrieving multiple key values from a network flow; adding the multiple key values to be a policy rule of a temporary policy group based on an interested attribute of the temporary policy group of a candidate policy group set; computing a group score of each temporary policy group according to a recommended factor; when determining that the group score is greater than a threshold, generating a recommendation set including the temporary policy groups; and deploying the recommendation set to an access control list to make the temporary policy groups be enforced.

In one aspect, a method includes generating, using a User Plane Function (UPF) of a core element of a network, a query to retrieve information associated with one or more Data Network Names (DNNs) configured in at least one other UPF in the network; transmitting the query to a Network Repository Function (NRF); receiving a response from the NRF, the response including IP address subnets of the at least one other UPF associated with the one or more DNNs; dynamically generating an Access Control List (ACL) to block mobile-to-mobile communication between User Equipment (UEs) in the network, using the IP address subnets received as part of the response, wherein each of the UEs is assigned an IP address from among the IP address subnets; and blocking M2M communication using the ACL dynamically generated.

This invention provides a method, apparatus, computer-readable storage medium, and computer program product for configuring parameters of a vehicle access control list. The method includes: invoking the access control list when the vehicle starts, the access control list storing initial values ​​for each parameter; during data transmission based on the initial values, the transmission priority of driving-related control command data is higher than that of non-driving-related data; acquiring the current vehicle speed in real time, determining whether the current speed is lower than a preset speed threshold; if so, updating each parameter in the access control list to obtain optimized values, with the transmission priority of driving-related control command data and non-driving-related data being the same during data transmission; if not, maintaining each parameter at the initial value; and updating each parameter in the access control list to the initial value when the vehicle is turned off. This embodiment can improve the user experience when using non-driving-related services in the vehicle.

This invention discloses a user trust measurement method and system in a zero-trust network environment. It pre-collects user information, token information, device information, and system information, and generates an access control list. When a device sends a request, a risk assessment is performed on the request, followed by authentication. Based on historical access data, the request status is determined. Based on the authentication result and request status, it is determined whether authorization is allowed. If authorization is not allowed, the request is marked as a device anomaly. Based on the device's abnormal behavior, it is determined whether the device belongs to the category of remote control anomalies. If so, the access permissions of devices connected to and interacting with this device in the access control list are updated. This reduces the risk of network attack risk propagation in a zero-trust network environment.

Systems, methods, and software described herein manage permissions in association with a query to a graph. In one example, a method of managing the permissions includes identifying a request for a query operation. In response to the request, the method further provides for identifying an access control list (ACL) in association with the query operation and identifying whether the query operation is permitted based on the ACL. The method further includes, in response to determining that the query operation is permitted, initiating the query operation.

A node isolation method, a switching device, and an Ethernet storage system implement node isolation between zones in the Ethernet storage system. A first switching device in the Ethernet storage system determines a first access control list ACL rule between a first node and a second node, where the first switching device is an access device of the first node, the first node and the second node are located in the Ethernet storage system, and the first node and the second node correspond to a first zone; and if a packet whose source is the first node or a packet whose destination is the first node matches the first ACL rule, forwards the packet.

The application provides a request parameter value authority authentication method and system, relates to the network security technical field, and comprises the following steps: creating an access control list configuration and binding a service when registering the service in a gateway, establishing an associated mapping of a consumer and the service, and setting a parameter authority list; using an advanced encryption standard algorithm to encrypt sensitive fields and synchronizing to a distributed cache; verifying the validity of a token when receiving a service request, checking the authority of the consumer, and checking parameter values. The application can effectively prevent unauthorized access, improve system security, and improve authentication efficiency through the distributed cache.

Aspects of the disclosure are directed to dynamic verification of user consent for data access. Each piece of data stored in a database includes information associated with a user and which applications that user consented to accessing the respective piece of data. As part of online access or offline access, an application may request access to a piece of data associated with a user. In response to the access request, the database verifies whether that application has consent to access the piece of data using the information associated with which applications a user consented to accessing the piece of data. If the information includes a consent, the database allows access. If the information includes a denial or does not include a consent, the database denies access. The dynamic verification allows for access enforcement with lower process cost and memory usage, as consent information is added to the data itself and an access control list is no longer needed.

Embodiments of the present disclosure include techniques for controlling access to electronic content. In one embodiment, a user generates content in an electronic document. The system retrieves the content and a profile for the user. A predictive engine determines an access control list comprising a plurality of entries based on the content and the profile. The access control list may be presented to the user, and the system receives a verification from the user of the plurality of entries in the access control list.

The invention relates to a flow control method and device, communication equipment and a computer readable storage medium. The method comprises the following steps: establishing a drainage tunnel with the standby node; and under the condition of detecting that the clock synchronization is abnormal, draining the node service of the main node to the standby node through the drainage tunnel so as to perform flow control on the node service through the standby node. By adopting the method, when the master node and the NTP clock source are out of synchronization and flow control cannot be carried out at the correct time, the node service is guided to the standby node through the drainage tunnel, and as the standby node is configured with the same access control list as the master node, effective flow control on the node service can be realized through the standby node.

Creating dynamic host access control lists (‘ACLs’) during data transfer redirection, including: receiving, by a first storage networking interface of a storage system, a login request; creating an access control list (ACL) for an initiator of the login request; redirecting the initiator of the login request to a second storage networking interface of the storage system; and completing the login request via the second storage networking interface of the storage system.

The invention discloses an access method, device and equipment for a supply chain digital financing platform and a storage medium, and relates to the technical field of digital information transmission and network communication, and the method comprises the steps: firstly executing dynamic field mapping for a non-standard service request sent by an institution according to a preset template, and generating standard format data; extracting characteristic values in a handshake stage of a transport layer security protocol, injecting the characteristic values into an access control list of the message-oriented middleware, and constructing an identity mapping relation; then, socket and message middleware channels are synchronously opened based on the access token, and a dual-channel coupling architecture is obtained; taking the service serial number as an index, and matching the synchronous signaling and the asynchronous message in a preset time window to obtain logic binding data; and finally, pushing binding data to the platform, and completing service access according to a receipt synchronization mechanism system state. According to the invention, safe and efficient access of the supply chain financing service and the digital financing platform can be realized on the premise of not transforming the existing service system of the financial institution.

The invention discloses a zero-knowledge proof identity authentication system and method based on an RISC-V trusted execution environment. The zero-knowledge proof identity authentication system comprises a Keystone-Enclave trusted execution environment system running on an RISC-V architecture; the Keystone-Enclave trusted execution environment system comprises two isolated Enclaves, namely, a ProverEnclave and a VerifierEnclave, and further comprises a Host application program which is operated in a common operating system, and the Host application program is used for executing the Host application program in the common operating system. The ProverEnclave is used for generating a zero-knowledge proof to prove that the ProverEnclave masters a legal user identity, the VerifierEnclave is internally provided with an access control list (ACL) and is responsible for verifying the proof and authority, and the Host application program is only used as a message relay for communication between the two Enclaves; the ProverEnclave and the VerifierEnclave cooperate with each other, so that all sensitive operations of processing the private identity information user, generating and verifying the zero-knowledge proof, checking the ACL and managing the challenge value are limited to be completed in the trusted execution environment. The method has the advantages that whole-course secret-state calculation is achieved, secret keys and identity information never come out of Enclave, verifiability is high, replay and permission bypassing are resisted, and comprehensive safety and performance advantages can be achieved by efficient deployment on a lightweight RISC-V platform.

The invention provides an automatic terminal access method and device, equipment, a storage medium and a program product, and relates to the field of secure communication. Comprising the steps that terminal equipment reads credible storage information; the access gateway equipment sends the encrypted data packet and the equipment related information to the gateway equipment; generating synchronous data to assist in completing shared key synchronization operation; and generating update data to assist in completing shared key update operation. The gateway equipment responds to an access request sent by the terminal equipment, obtains a shared key data set according to the received equipment related information and the encrypted data packet, and receives an equipment access control list; performing shared key synchronization operation with the terminal equipment, and generating synchronization information after shared key synchronization is completed; and performing shared key updating operation with the terminal equipment, and generating updating information after the shared key is updated. The problem that the efficiency of terminal automatic access is low due to the fact that a traditional security authentication scheme is limited in computing resources and difficult to operate a complex authentication protocol is solved.

The disclosure provides a method for storing ACL entries, a method for matching ACL entries, and a network apparatus. The method for storing ACL entries includes: obtaining an ACL entry to be stored, splitting the ACL entry into a first section and a second section, where the first section includes a source address and a destination address stored in the ACL entry, and the second section includes some or all of a transport layer source port, a transport layer destination port, a transport layer protocol type, a packet priority, and a port of the ACL entry; storing the first section in a TCAM, and storing the second section in an SRAM.

The application discloses a cluster data storage method and device, equipment and medium, and relates to the technical field of massive distributed storage automation. The application is applied to a distributed storage system, and comprises the following steps: creating a target bucket in a master cluster of the distributed storage system, and creating a target namespace in a slave cluster; uploading a target object to be synchronized into the target bucket, and setting an access control list of the target object as private based on a first permission state; creating a corresponding target file snapshot for the target bucket; establishing a synchronization relationship between the target object and a directory of the target namespace, and triggering a first data synchronization operation, so as to synchronize the target object in the target bucket to the target namespace of the slave cluster; and after the first data synchronization operation ends, performing a rollback operation on the target bucket of the master cluster by using the target file snapshot, so as to detect whether the rollback function is normal. Through the technical scheme of the application, the creation of a file snapshot in a bucket and the synchronization of object permissions of master-slave clusters in a fusion interworking scene are supported.

The invention belongs to the technical field of computer data security, and particularly relates to a method for protecting a specified path and a file from being tampered, which comprises the following steps of: registering a related main function code callback routine in a Windows file system filter drive framework, and constructing an interception layer for intercepting an I / O (Input / Output) request; constructing an access control list taking PID and file object paths as key values in a kernel non-paging memory; pID and a complete path of a target file are synchronously extracted in a callback routine, hierarchical judgment is performed according to a system process, an exemption list and a protection path / type, and a request is rejected if a condition is not met; through establishing a control channel, strategy dynamic management is realized. According to the method, the file persistence volume ID is hidden through the system, so that the problem of strategy failure caused by volume path change is solved; a hierarchical data structure and a concurrent synchronization mechanism are adopted to ensure efficient query and small influence on disk IO performance; by means of a multi-layer control switch and a scenarized template, multi-dimensional fine control is supported.

This invention provides a remote image feature extraction and retrieval method based on SGX, relating to the field of encrypted image retrieval technology. This method utilizes trusted hardware SGX to offload computational operations such as image feature extraction and index construction to a trusted execution environment (enclave) on a cloud server. Within this trusted execution environment, a secret sharing scheme is used for key distribution, and access control lists are implemented to control access for third-party users. Compared to traditional encrypted image retrieval schemes, this invention effectively reduces the computational power requirements for data owners and enables precise access control for third-party users during the retrieval process.

This application discloses a method, device, system, and medium for implementing overspeed alarms for specific packets, to solve the following technical problem: how to achieve timely detection of specific packet traffic without wasting CPU computing resources. The method includes: the CPU generating an ACL (Access Control List) issuance command based on user configuration instructions and issuing the ACL issuance command to the switching chip; upon receiving packet traffic, the switching chip, based on the Access Control List (ACL) determined by the ACL issuance command, determines whether the packet traffic is overspeeding, and redirects the overspeeding packet traffic to a preset internal loopback interface; the internal loopback interface triggers an interrupt based on the overspeeding packet traffic and uploads the generated interrupt information to the CPU, enabling the CPU to issue an overspeed alarm based on the interrupt information. This application achieves timely detection of overspeeding of specific packet traffic without wasting CPU computing resources through the above method.