240 results about "Access control list" patented technology

The invention relates to the technical field of intelligent control, in particular to a dynamic encryption-based data link security management and control system and method.The dynamic encryption-based data link security management and control system comprises a dynamic encryption engine, a key management cluster, a link monitoring unit and a security policy execution array, the switching between the SM9 cryptographic algorithm and the quantum resistance NTRU algorithm is supported; the key management cluster realizes distributed key negotiation and storage through a block chain smart contract, and establishes a bidirectional authentication channel with the dynamic encryption engine; the link monitoring unit is integrated with a multi-dimensional flow probe, and continuously collects link delay jitter, data packet entropy characteristics and protocol compliance indexes; the security policy execution array is deployed at a boundary node of a data link, and is configured with a dynamic access control list and a hardware-level data purification module. Therefore, the problems of insufficient encryption algorithm resistance, significant key update delay, multi-dimensional threat sensing blind areas, dynamic strategy response delay and the like in the prior art are solved.

The invention relates to the technical field of network management, in particular to an Internet of Things gateway control method and system based on AI computing power, and the method comprises the following steps: obtaining channel real-time signal intensity, noise level and occupancy proportion, monitoring protocol type and transmission condition, analyzing the relationship between retransmission times and interference, deducing protocol combination interference and throughput, and obtaining a real-time channel signal intensity, noise level and occupancy proportion. And configuring an optimal scheduling scheme, evaluating resource consumption and load states, packaging and requesting permission entrustment, and judging permission information in combination with an interaction record and an access control list. According to the method, different protocol distribution combinations are simulated and deduced, the data throughput of the whole network is further estimated and optimized, potential protocol conflicts are reduced, the use efficiency and the overall performance of network resources are effectively improved, consumption of a local computing unit and network bandwidth is comprehensively considered, packaging processing of request information is optimized, and the network performance is improved. And the real-time response capability and manageability of the network state are obviously improved.

The invention relates to the technical field of block chains, in particular to a supply chain data security sharing method based on a block chain. The method comprises the following steps: firstly, defining user roles and corresponding permissions in a supply chain system to generate an access control list; and then, collecting historical behavior data, access records and current system states of the requesting users, and adjusting roles and permissions of the users in real time by using predefined rules and a machine learning model. And then, based on the hybrid access control strategy, matching an access request of a user, generating an access decision, then generating an access operation instruction, executing an operation of data decryption or data encryption maintenance, and after the operation is completed, carrying out integrity check and consistency verification. And finally, collecting all record data generated in the access control process to optimize an updating mechanism of the access control list and realize continuous improvement and optimization. According to the invention, through dynamic adjustment of the access authority, the flexibility and efficiency of access control of the supply chain system are improved.

The invention relates to the technical field of microcontrollers, and provides an MCU information protection method and device, electronic equipment and a readable storage medium, and the method comprises the steps: checking a storage access request according to an access control list; wherein the access control list comprises an authorized storage area and an authorized operation type corresponding to the authorized storage area; the storage access request is used for accessing a target storage area of the MCU; according to the debugging secret key, an interface debugging request is checked, and the interface debugging request is used for debugging a target debugging interface of the MCU; identifying a target code instruction of the MCU, and performing pre-execution verification and dynamic monitoring on the target code instruction; adjusting the clock frequency and the clock phase of the MCU according to the load change information and the power consumption change information of the MCU; and implementing encryption measures on the target data transmission channel of the MCU by using the encryption algorithm. According to the technical scheme provided by one or more embodiments of the invention, the data security and the anti-attack capability of the MCU can be improved.

An illustrative method includes an access control list (ACL) management system generating an ACL file containing an ACL that describes one or more access permissions in a file system, storing the ACL file within an ACL directory structure, the ACL file uniquely representing the ACL in the ACL directory structure, generating an ACL identifier for the ACL file, and mapping, using the ACL identifier, the ACL file to one or more data files in the file system to apply the ACL in the ACL file to the one or more data files.

The invention relates to the technical field of identity authentication and authority management, and discloses an offline identity authentication and authority management method and system. The method comprises the following steps: receiving an operation request of a target user on a target terminal; if the identity authentication client is in the offline state, verifying the digital certificate of the target user through a first authentication center of the identity authentication client to obtain a validity verification result of the target user; if the target user is judged to be a legal user according to the legality verification result of the target user, determining the operation authority of the target user to the target terminal by using an access control list of the target user in the USB key; determining a target operation authority required by the operation instruction; and if the operation authority of the target user on the target terminal contains the target operation authority, judging that the target user has the authority of executing the operation request on the target terminal. According to the invention, the authentication of the user identity and the management of the authority in an offline environment can be realized.

A server system for a map-based social media platform maintains user location information to enable the rendering of friend icons on a map at a corresponding display locations. The system maintains a per user access control list (ACL) that lists all users whose icons can be viewed by a requesting user. The ACL can include a designation of respective display granularity levels for different friend users.

Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Access control list (ACL) information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface.

The invention provides a request parameter value authority authentication method and system, and relates to the technical field of network security, and the method comprises the steps: creating an access control list configuration and binding a service when a gateway registers the service, building the association mapping of a consumer and the service, and setting a parameter authority list; encrypting the sensitive field by adopting an advanced encryption standard algorithm and synchronizing the sensitive field to a distributed cache; and verifying the validity of the token when the service request is received, verifying the authority of the consumer, and verifying the parameter value. According to the invention, unauthorized access can be effectively prevented, the system security is improved, and the authentication efficiency is improved through the distributed cache.

Systems and methods of interface-based ACLs in a virtual Layer-2 network. The method can include sending a packet from source compute instance in a virtual network to a destination compute instance via a destination virtual network interface card (destination VNIC) within a first virtual layer 2 network and evaluating an access control list (ACL) for the packet with a source virtual network interface card (source VNIC). ACL information relevant to the packet can be embedded in the packet. The VSRS can receive the packet and can identify the destination VNIC within the first virtual layer 2 network for delivery of the packet based on information received with the packet and mapping information contained within a mapping table. The VSRS can access ACL information from the packet and can apply the ACL information to the packet.

A computer-implemented method for management of an application on an enterprise network which accesses external networks via a web proxy. The method comprises obtaining enriched metadata concerning an application executed on the enterprise network, the enriched metadata including at least source code information and ownership information, identifying application traffic on the enterprise network based on proxy log data, source IP and destination URL, generating an access control list (ACL) based on the enriched metadata and identified application traffic, the ACL including a source address of the application and a list of allowed destination addresses, converting the ACL into a proxy policy that can be processed by a web proxy to permit access by the application to the destination addresses in the ACL, and establishing data communication between the application and an external network based on the proxy policy.

The invention is suitable for the technical field of document access, and provides a document content access authority control method and system, and the method comprises the steps: carrying out the semantic learning of a to-be-accessed document when the to-be-accessed document uploaded by a document owner is received, and generating a plurality of document elements; determining a hierarchical relationship and a sequence of a plurality of document elements, and constructing an access control list; when an access instruction of a to-be-accessed document is received, obtaining identification information of an access user; judging whether the identification information of the access user exists in the access control list or not, and if yes, determining a target document element which can be accessed by the access user through the access control list; generating a target access document according to the target document element; and when the access user successfully decrypts the target access document, outputting the target access document, so that the access user can edit the target access document. According to the invention, the access authority is set for the elements of the document, so that the document is finely managed.

Systems and methods for managing resource access permissions for users with unknown credentials are disclosed herein. A resource access request may be received. A measure of risk may be determined. In response to determining that a first access level is permitted, the first user identifier may be inserted in a first access control list. Based on information regarding resources accessed by the first user, an updated measure of risk may be determined. In response to determining that a second access level is permitted, the first user identifier may be inserted in a second access control list.

The invention discloses a method, a device and equipment for realizing a large-scale hybrid strategy. The method comprises the following steps of: receiving a message and analyzing the message to extract a field representing a data stream feature; generating intermediate state information according to an entry number, a port attribute and the field obtained through analysis, and obtaining a label through table look-up operation; fields, intermediate state information and labels of the messages are combined according to strategy rules defined by different storage blocks and compared with strategy entries in the storage blocks; and implementing a corresponding processing behavior on the message according to a comparison result. According to the method, parallel searching and processing behaviors of large-scale mixed policies can be realized, the method is suitable for more than hundreds of thousands of policy routing deployment and access control lists of various matching field combinations, and high-power-consumption and high-cost TCAM (Ternary Content Addressable Memory) storage can be avoided.

The invention provides an on-off control method and device for a gateway port and a medium. The on-off control method comprises the steps of obtaining historical access log data and threat intelligence data of a target port in a gateway; based on the historical access log data and the threat intelligence data, performing time sequence analysis by using a pre-trained long-short-term memory network model to obtain a predicted security access time period of the target port in a future preset time period; generating a temporary port exposure preset rule of the target port according to the predicted security access time period; determining a traffic feature vector of the real-time traffic data packet of the target port; using a preset deep reinforcement learning agent to determine an on-off control instruction for the target port based on the traffic feature vector and a temporary port exposure preset rule; and executing the on-off control instruction to modify an access control list state of the gateway firewall to the target port. According to the method and the device, dynamic and refined gateway port on-off control can be realized, so that the service flexibility and security are considered.

Examples described herein relate to a switch configured to allocate packet processing resources, from a pool of packet processing resources, to multiple applications, wherein the pool of packet processing resources comprise configurable packet processing pipelines of one or more network devices and packet processing resources of one or more servers. In some examples, the configurable packet processing pipelines and the packet processing resources are to perform one or more of: network switch operations, microservice communications, and / or block storage operations. In some examples, the network switch operations comprise one or more of: application of at least one access control list (ACL), packet forwarding, packet routing, and / or Virtual Extensible LAN (VXLAN) or GENEVE termination. In some examples, the microservice communications comprise one or more of: packet routing between microservices and / or load balancing of utilized microservices.

Presented herein are techniques to implement end-to-end encryption. A method includes, encrypting content C with an encryption key EK to obtain encrypted content C′, generating a key encrypting key KEK based on a password, encrypting the encryption key EK with the key encrypting key KEK to obtain an encrypted encryption key EK′, storing the encrypted content C′ and the encrypted encryption key EK′ such that the encrypted content C′ and the encrypted encryption key EK′ are accessible to a content consumer via a link, sending the link and the password to the content consumer, and in response to a request, received via the link, for the encrypted content C′ and the encrypted encryption key EK′, sending the encrypted content C′ and the encrypted encryption key EK′ to the consumer based on the content consumer being on an access control list.

The invention discloses a data access method and device, equipment, a storage medium and a program product, and relates to the technical field of data security. The method comprises the following steps: classifying stored data according to ownership and sensitivity of the data to obtain data of multiple levels; according to the access control list and a role-based access control method, determining the access authority of each level of data; determining a data use control strategy according to the access authority of the data of each level and the parameter information of the user; determining a target data use control strategy of the second equipment according to a received data access request of the second equipment and the data use control strategy; and sending the target data use control strategy to a second device, so that the second device accesses and / or uses target data corresponding to the data access request according to the target data use control strategy. According to the scheme, the problem that in an existing data encryption method, a data owner cannot accurately control the use mode of data is solved.

In one aspect, a method includes generating, using a User Plane Function (UPF) of a core element of a network, a query to retrieve information associated with one or more Data Network Names (DNNs) configured in at least one other UPF in the network; transmitting the query to a Network Repository Function (NRF); receiving a response from the NRF, the response including IP address subnets of the at least one other UPF associated with the one or more DNNs; dynamically generating an Access Control List (ACL) to block mobile-to-mobile communication between User Equipment (UEs) in the network, using the IP address subnets received as part of the response, wherein each of the UEs is assigned an IP address from among the IP address subnets; and blocking M2M communication using the ACL dynamically generated.

The invention relates to the technical field of MRP looped networks, and discloses an MRP looped network and a message processing method thereof, terminal equipment and a readable storage medium, the MRP looped network comprises a medium redundancy management end and a plurality of medium redundancy clients which form the looped network, and the message processing method of the MRP looped network is applied to the medium redundancy clients. Comprising the following steps: receiving an MRP protocol message sent by a previous medium redundancy client or a medium redundancy management end; matching the first target message or the second target message based on the access control list; and carrying out hardware forwarding on the matched first target message or the second target message to a next medium redundancy client or a medium redundancy management end, and emptying a self filtering database according to the matched first target message. According to the message processing method of the MRP looped network, the switch of the whole MRP looped network can quickly forward the target message to the adjacent equipment, and the convergence performance of an MRP loop is improved.

A method of managing digital entities in data repositories comprises storing one or more data objects in a non-graph data repository into one or more nodes and edges of a graph, comprising transforming an access control list (ACL) of a first data object into an ACL node and transforming a version of a second data object into a version node in a graph data repository; electronically receiving a search query associated with a user account for a shortest path between two specified nodes of the graph; executing the search query against the graph data repository to generate a result set of nodes including only nodes corresponding to most recent versions of the one or more data objects that are visible to the user account under applicable ACLs.

The invention provides an access control list configuration method and device, electronic equipment and a storage medium, and relates to the technical field of servers, and the method comprises the steps: collecting subnet information in a target containerization cluster, a configured access control list rule and security threat features in network traffic; the information is subjected to fusion analysis based on a predefined security policy so as to generate an access control list rule set containing different priorities, and then the rules are synchronized to a cluster virtual switch kernel according to the priorities so as to realize hierarchical control and dynamic protection of network traffic. The problems that a large-scale dynamic network environment is difficult to deal with, the automation level is low and malicious traffic cannot be efficiently intercepted due to the fact that manual configuration and static rule maintenance are relied on and deep integration of a containerized cluster network structure is lacked can be solved. The technical effects of improving the automation level of containerized cluster network management, enhancing the adaptability to a dynamic network environment, and realizing efficient interception of malicious traffic to guarantee network security are achieved.

An access control method, an access control end, and a cluster. The method comprises: receiving a target data packet, wherein the target data packet comprises a value to be matched; acquiring a target code of at least one rule from an access control list (ACL), the target code comprising a matching logic instruction and a matching item that correspond to each rule, wherein the matching item is used for determining whether said value matches the rule corresponding to the matching item; on the basis of the matching item and said value, executing the matching logic instruction to obtain a matching result of said value and the rule corresponding to the matching item; and on the basis of the matching result, allowing or blocking the passage of the target data packet. The method can improve access control efficiency.

Novel tools and techniques for packet filtering in a network. A networking device might feature an access control list (ACL) with filter rules, each having a field to identify, for example, a possible state of a vehicle. Based on this field, rules inapplicable to that state can be disregarded when evaluating packets against the rules in the ACL.

Aspects of the present disclosure are directed to systems and methods for preventing spam communications. Implementations can implement an access control list that a communicator (e.g., a user device sending a text message, making a phone call, etc.) must be on in order to complete the communication with a recipient. If they are not on the access control list, the communicator can be prevented from sending the communication to the recipient, redirected to a registration process, or the communication can be tagged with an unverified status flag. In some implementations, the access control list can include a recipient's contacts, contacts of the recipient's contacts, authenticated entities (e.g., users and / or companies), previously verified entities, etc. In some implementations, a recipient can give out a temporary extension that a communicator can enter to complete communications with the recipient for a certain amount of time or for a certain number of uses.

Aspects of the disclosure provide various methods relating to enclaves. For instance, a method of authentication for an enclave entity with a second entity may include receiving, by one or more processors of a host computing device of the enclave entity, a request and an assertion of identity for the second entity, the assertion including identity information for the second identity; using an assertion verifier of the enclave entity to determine whether the assertion is valid; when the assertion is valid, extracting the identity information; authenticating the second entity using an access control list for the enclave entity to determine whether the identity information meets expectations of the access control list; when the identity information meets the expectations of the access control list, completing the request.

A method for authorizing an entity (9) in a computerized system to access an object (12) includes the following steps: providing (S1) an access control list (ACL) that specifies access permissions for each object (12) to the object (12) in the computerized system; assigning (S2) capability requirement information to at least one of the objects in the access control list (ACL); assigning the capability information to at least one entity (9) in the computerized system; requesting (S11) access to the object (12) by the entity (9); checking whether the requesting entity (9) has access permissions according to the ACL; and authorizing (S5) access to the requested object (12) by the requesting entity (9) only if the capability information assigned to the requesting entity (9) matches the capability requirement information assigned to the requested object (12). The combination of ACL-based access to files and capabilities enhances the security of the system.

Systems and methods for auditing access control lists (ACLs) of a network infrastructure are provided. A plurality of network interfaces associated with a specified entity is identified. A plurality of access control lists (ACLs) is received. Each ACL of the plurality of ACL includes a plurality of rules associated with a respective network interface of the plurality of network interfaces. Network traffic metadata associated with the plurality of network interfaces is received. A corresponding set of rule utilization parameters is identified for each rule of the plurality of rules by matching the network traffic metadata to the plurality of rules.

The invention discloses a block chain cross-chain migration-based data processing system and a use method thereof, and the method comprises the steps: responding to a permission configuration instruction of a management object through a permission configuration module, and carrying out the permission setting of specific data through an access control list; determining a data migration mode through a data migration module according to the data type of the to-be-migrated target data; the data migration mode comprises a full migration mode or an incremental migration mode; determining a segmentation strategy of the target data according to the data migration mode through a data segmentation module, and segmenting the target data into data fragments based on the segmentation strategy; and storing the data fragments to nodes on the target chain through a data storage module. According to the method, flexible segmentation is realized through permission configuration, intelligent migration and adaptive determination of the migration mode, refinement, automation and high efficiency of data management are realized, the operation and maintenance cost is reduced, the data security and availability are improved, and the method can be widely applied to the technical field of data processing.

The invention discloses a virtual card abnormity repairing method and device, equipment and a computer program product, and the method comprises the steps: obtaining real-time monitoring data of a first virtual card, and determining a real-time monitoring result of the first virtual card based on the real-time monitoring data; creating a second security domain corresponding to the first virtual card under the condition that the real-time monitoring result is that the security domain is in false death and a first security domain corresponding to the first virtual card meets a migration condition; and migrating the access control list and the key index of the first security domain to the second security domain.