51 results about "Cloud computing security" patented technology

The invention discloses a risk management system and method based on multi-source data perception, and relates to the technical field of cloud computing security, and the method comprises the steps: collecting historical multi-source data of a cloud host; constructing a cloud host risk portrait based on historical multi-source data of the cloud host; the method comprises the following steps: dividing a cloud host network into a plurality of security domains according to service functions and security requirements, and configuring a basic access control strategy; sensing the resource use condition of the cloud host in real time, and identifying the current service state of the cloud host in combination with the service log; and matching a preset security policy according to the current service state of the cloud host and the risk portrait of the cloud host, and dynamically adjusting a network segmentation policy and an access control policy in a security domain based on a micro-isolation technology. According to the method, a micro-isolation technology is used, a network segmentation strategy and an access control strategy in a security domain are dynamically adjusted according to the real-time service state and the risk portrait of the cloud host, and the security and the stability of the cloud host in different service scenes are improved.

The invention discloses a trusted cloud security confidential privacy level product service method, and relates to the technical field of design of cloud computing security. The method comprises the following steps: acquiring a trusted cloud privacy security level and a hierarchical core security mechanism, establishing a binding relationship with a product, extracting technical features and performing quantitative scoring, and constructing a three-dimensional security matrix; obtaining a privacy grading service demand of the user, and establishing a demand matching model to screen a security preference grade product; obtaining different-dimension technical grade improvement times of the user security preference grade product, and carrying out synergistic effect analysis; if significant positive correlation exists, correlation analysis is carried out to obtain a dynamic correlation coefficient, a product optimization strategy is made, a three-dimensional security matrix is dynamically updated, and the trusted cloud security confidential privacy level product service system comprises a feature classification module, a product optimization module, a collaborative analysis module and an optimization updating module. According to the method, more accurate security product recommendation can be provided for the user, and the trusted cloud security service level is improved.

The invention relates to the technical field of cloud computing and identity authentication security, and discloses a cloud environment intelligent identity authentication cross-domain docking method and system.The cloud environment intelligent identity authentication cross-domain docking method comprises the steps that heterogeneous identity data of multiple cloud platforms is collected and preprocessed, and a standardized identity data set is obtained; constructing a unified identity semantic model based on the standardized identity data set and generating a feature embedding vector; performing identity mapping conversion on the feature embedding vector by using a deep neural network to obtain a mapped identity feature vector; performing multi-factor adaptive trust evaluation in combination with the mapped identity feature vector and the real-time behavior data to obtain a dynamic trust evaluation result; generating an adaptive security token based on the dynamic credibility evaluation result; according to the method, the problems of cross-domain isomerism and dynamic trust evaluation of identity authentication in a cloud environment can be solved, and an effective solution is provided for cloud computing security.

The invention belongs to the technical field of cloud computing security, and discloses a multi-cloud security management center system and method based on AI. Aiming at the problems of difficulty in asset management, low safety operation efficiency, high labor cost and the like in a multi-cloud environment, the system lightens AI Agent through a data acquisition layer, acquires core resource data in real time by a differentiation strategy, and constructs a three-dimensional dynamic knowledge graph after standardization of a cross-cloud data conversion engine; the intelligent analysis layer integrates five-dimensional data such as logs and traffic by using a multi-modal fusion engine, and realizes attack link dynamic deduction (the accuracy rate reaches 98%) and intelligent alarm noise reduction (the false alarm rate is reduced to below 10%) based on a graph neural network; the strategy management layer generates a cross-cloud unified strategy in combination with domestic and overseas large-scale boards and a natural language processing technology; and the automatic execution layer realizes automatic vulnerability repair (the success rate is not lower than 90%) and AKSK authority dynamic management. The method comprises the whole process of data acquisition, knowledge graph construction, risk analysis, strategy generation and automatic disposal. According to the method, the asset management time can be shortened to 1 minute, the vulnerability repair period is shortened to 30 minutes from 48 hours, the safety operation labor cost is reduced by 70%, and an efficient, intelligent and low-cost safety management scheme is provided for the enterprise multi-cloud environment.

The invention provides a cloud computing security management system based on artificial intelligence, and relates to the technical field of computers, a data acquisition module of the system acquires network behavior information, system operation information, threat intelligence information, data outward transmission amount and authority change monitoring information of a cloud computing platform; the model calculation module processes the network behavior information, the system operation information and the threat intelligence information by using an anomaly detection model to obtain an anomaly detection result; the anomaly detection result represents the risk probability that the cloud computing platform suffers from different types of attacks; inputting the anomaly detection result, the data outward transmission amount and the authority change monitoring information into a context sensing evaluator to obtain a comprehensive risk score and an attack type classification result of the cloud computing platform; and the management execution module executes security control operation according to the comprehensive risk score and the attack type classification result. By applying the method provided by the invention, the attack risk detection precision in a complex attack scene can be improved.

The invention discloses a multi-tenant cloud policy conflict adaptive adjustment method and system, and relates to the technical field of cloud computing security. The method comprises the following steps: converting access control policies of different levels in a multi-tenant cloud computing environment into a standardized policy description model; based on the standardized strategy description model, constructing an incremental strategy graph with a dependency relationship and a condition overlapping relationship; performing real-time analysis on the incremental policy graph based on a policy change event obtained by an event monitoring mechanism, identifying a potential conflict relationship between access control policies, and generating an access conflict event record; performing quantitative analysis and grading evaluation based on the access conflict event record, and generating a conflict risk evaluation record; based on the conflict risk assessment record and a predefined access conflict processing rule, adaptively generating an access conflict adjustment strategy and automatically executing the access conflict adjustment strategy; according to the method, the real-time detection and the self-adaptive correction of the access conflict strategy in the multi-tenant cloud environment are realized, and the consistency and the security of access permission authorization are ensured.

The invention discloses a security computing channel dynamic combination method based on a cloud platform, a medium and equipment. The method is used for generating a cloud computing security platform. Comprising the following steps: constructing an IaaS layer by adopting a plurality of server clusters; setting each processor core of each server in each server cluster as a computing channel, and acquiring physical attributes of all computing channels; according to the physical attributes of all the computing channels, constructing a security cloud channel physical attribute structural body which is composed of the computing channels and comprises a plurality of computing channel sets of different physical attributes; constructing security middleware of the physical attribute structural body of the security cloud channel in the PaaS layer according to requirements, and correspondingly linking computing channels of different physical attributes in the physical attribute structural body of the security cloud channel through the security middleware to generate a final scheme; and generating the cloud computing security platform according to the final scheme. The method has the advantage of ensuring that the channels with different security function levels are simultaneously operated on the security cloud platform.

A computer implemented method of automatic provisioning of cloud-specific security services on computing clouds, comprising: analyzing datasets collected by code sensors monitoring cloud-specific security services and / or security resources running in computing clouds of a common entity, generating a technical architecture to implement across the security services and / or security resources on computing clouds according to the analysis, computing architectural adaptations to the cloud-specific security services and / or security resources for normalizing current architectures to generate the technical architecture in each of the cloud-specific security services and / or security resources of the cloud-specific computing clouds, and generating code-scripts according to the architectural adaptations for installation at corresponding cloud-specific security service and / or security resource running on each corresponding computing cloud for implementing the technical architecture across the computing clouds of the common entity.

AI based Computing Device for Cloud Computing Security

The invention discloses an outsourcing decryption method for protecting revocable user attributes based on cloud environment data, and belongs to the technical field of cloud computing security. The method comprises an initialization algorithm, an encryption algorithm, a key generation algorithm, an outsourcing decryption algorithm and an attribute revocation algorithm. The method is based on the cloud environment, public parameters are composed of a fixed number of group elements, an attribute set used for encryption is not limited, user revocation can be executed at each attribute level instead of a system level, and finer-grained user access control is achieved. In addition, user information is not leaked when whether the user is revoked or not and outsourcing decryption is judged, the scheme is proved to be safe under the complexity hypothesis of a composite number order group, and the result shows that the scheme is more efficient and more flexible under the scene of user management in the cloud environment through comparative analysis of the performance of similar schemes.

MACHINE LEARNING BASED SECURITY DEVICE FOR CLOUD COMPUTING

This invention relates to the intersection of cloud computing security, trusted computing, and hardware acceleration technologies, and discloses a virtual machine trusted state verification method and system based on TIPU. The method includes: configuring a measurement task on the host side of the TIPU, the measurement task containing the memory address information of the target virtual machine and its corresponding expected hash value; the TIPU directly reading the memory data of the target virtual machine via DMA based on the memory address information to generate an actual hash value; the TIPU comparing the actual hash value with the expected hash value to determine whether the target virtual machine is in a trusted state; when the virtual machine is determined to be in an untrusted state, the TIPU calls a built-in root of trust to sign the verification result and generate a remote proof report. This invention obtains the mapping table from the client's physical address to the host's physical address through the virtualization platform interface via a host agent and pre-configures it to the TIPU. The TIPU only accesses the target virtual machine's memory, achieving virtual machine context awareness and effectively avoiding cross-virtual machine information leakage.

The present disclosure provides a cloud host security reinforcement method and device, a storage medium and an electronic device; and relates to the technical field of cloud computing security. The method comprises the following steps: obtaining application information of a cloud host resource, and publishing a to-be-reinforced cloud host according to the application information; scanning the to-be-reinforced cloud host to obtain a security scanning report of the to-be-reinforced cloud host; reinforcing the to-be-reinforced cloud host according to the application information and the security scanning report to obtain a security reinforcement result; verifying the security reinforcement result and outputting corresponding reinforced cloud host resources. In the process of starting the cloud host, the cloud host is scanned, reinforced, verified and delivered, so that the allocation and security reinforcement of the cloud host are integrated, the security of the cloud host is improved, and the security reinforcement efficiency of the cloud host is improved.

This invention relates to the fields of cloud computing and identity authentication security technology, and discloses a method and system for cross-domain intelligent identity authentication in a cloud environment. The method includes: collecting and preprocessing heterogeneous identity data from multiple cloud platforms to obtain a standardized identity dataset; constructing a unified identity semantic model based on the standardized identity dataset and generating feature embedding vectors; performing identity mapping transformation on the feature embedding vectors using a deep neural network to obtain mapped identity feature vectors; performing multi-factor adaptive trust assessment by combining the mapped identity feature vectors with real-time behavioral data to obtain dynamic trust assessment results; generating an adaptive security token based on the dynamic trust assessment results; and converting the adaptive security token into the protocol format required by the target system. This invention can solve the problems of heterogeneity and dynamic trust assessment in cross-domain identity authentication in a cloud environment, providing an effective solution for cloud computing security.

The invention discloses a container data safe use method and system based on a decentralized identity, and relates to the technical field of cloud computing security, and the method comprises the steps: generating a decentralized identity bound with a container life cycle; initiating a data use request based on the decentralized identity; identity verification is executed, and data resources are distributed based on dynamic authorization and encryption of a runtime context; and decrypting and using the data resources in the protected memory of the container. According to the method, the decentralized identity is generated on the basis of the identifier during dynamic operation of the container, and an access control mechanism in the memory is combined, so that the technical defects that the identity is unhooked from the life cycle and the plaintext is exposed in the memory during operation of the data in an existing container data security scheme are overcome.

A system is provided for cloud computing security using a quantum encryption algorithm. In particular, the system may comprise a quantum computing system that receives target data that has been encrypted using a first encryption algorithm. The quantum computing system may encrypt the target data using a second encryption algorithm, which may include a quantum encryption algorithm. Once the target data has been encrypted using the second encryption algorithm, the target data may be stored on a cloud server. Upon receiving a request for the target data, the quantum computing system may perform a decryption of the encrypted target data through the second encryption algorithm such that the target data may then be decrypted using the first encryption algorithm before being served to the requesting endpoint device.

The invention relates to the technical field of cloud computing security, in particular to a bare metal console implementation device and method with endogenous security capability, and the device comprises a user side agent module which is used for receiving a bare metal VNC console access request initiated by a user and distributing the request to three heterogeneous service agent nodes; operating systems and CPU (Central Processing Unit) frameworks of the three service agent nodes are different from one another, and service agent components corresponding to different bare metal VNC console access modes are respectively deployed on the nodes; the feedback control module is used for collecting running state data of the service agent node, generating judgment parameters and sending the judgment parameters to the strategy judgment module, and is used for executing release or link reset operation according to a judgment result of the strategy judgment module; and the strategy judgment module is used for carrying out consistency judgment on output results of the three service agent nodes based on the judgment parameters and feeding back a judgment result to the feedback control module. According to the invention, high security and high availability of bare metal VNC console access are realized.

CLOUD COMPUTING SECURITY DEVICE TO ENHANCE NETWORK PERFORMANCE

The present invention discloses a weighted access control attribute-based searchable encryption method based on alliance chain, which belongs to the field of blockchain cloud computing security technology. The present invention includes global settings, user attribute private key generation, data encryption, trapdoor generation, keyword ciphertext retrieval, and data ciphertext decryption steps. The method of the present invention is based on alliance chain and attribute-based searchable encryption technology to construct a weighted access policy tree, and realize flexible access control by setting node weights. At the same time, the attribute authority is used as the alliance chain consensus node, which is responsible for system parameter generation and key management. The method has the functions of privacy protection, multi-keyword encryption, fine-grained access, anti-tampering, etc., and the user only needs lightweight encryption and decryption calculations. Through security and experimental analysis, the method proves its security under the decision bilinear Diffie-Hellman (DBDH) assumption.

The application discloses a multi-tenant cloud policy conflict adaptive adjustment method and system, and relates to the technical field of cloud computing security; the method comprises the following steps: converting access control policies of different levels in a multi-tenant cloud computing environment into a standardized policy description model; based on the standardized policy description model, an incremental policy graph with dependency relationships and conditional overlapping relationships is constructed; based on a policy change event obtained by an event listening mechanism, the incremental policy graph is analyzed in real time, potential conflict relationships between access control policies are identified, and an access conflict event record is generated; based on the access conflict event record, quantitative analysis and hierarchical evaluation are carried out, and a conflict risk evaluation record is generated; based on the conflict risk evaluation record and a pre-defined access conflict processing rule, an access conflict adjustment policy is adaptively generated and automatically executed; the application realizes real-time detection and adaptive correction of access conflict policies in a multi-tenant cloud environment, and guarantees the consistency and security of access permission authorization.

The application discloses an outsourcing decryption method for revoking user attributes based on cloud environment data protection and belongs to the technical field of cloud computing security. The application comprises an initialization algorithm, an encryption algorithm, a key generation algorithm, an outsourcing decryption algorithm and an attribute revocation algorithm. The method of the application is based on a cloud environment, public parameters are composed of a fixed number of group elements, there is no limitation on an attribute set used for encryption, user revocation can be performed at each attribute level instead of at a system level, and more fine-grained user access control is realized. Moreover, user information is not leaked in judgment of whether a user is revoked and outsourcing decryption. The scheme is proved to be safe under the complexity assumption of a composite order group. Through comparative analysis on the performance of similar schemes, the result shows that the scheme is more efficient and more flexible in the scene of user management in a cloud environment.

The invention relates to the technical field of cloud computing security, and discloses a big data attack processing system for cloud services, which comprises a feature matrix construction module, an abnormal behavior prediction module, a behavior chain construction module, a behavior chain optimization module and a malicious behavior chain graph generation module. Compared with an attack detection method depending on single log analysis or in-session behavior characteristics in the prior art, the technical problem that cross-dimension and cross-session behavior association analysis cannot be realized especially under the condition that an attack chain may cross logs and multiple sessions and has strong time and behavior association in a complex attack scene is solved. According to the method, cross-log tracking of malicious behavior chains in large-scale log data is realized by introducing a behavior chain optimization technology of a graph convolutional network, so that the problems of insufficient complex behavior chain detection capability and inaccurate association analysis in the traditional technology are avoided; the accuracy of attack detection, the integrity of attack chain tracking and the overall security protection capability of the cloud service are improved.

The invention discloses a host and guest message tunnel communication method and system based on virtualized black box escape. The method comprises the following steps: firstly, detecting a key function address or symbol information of a host machine by using a QEMU vulnerability; secondly, capturing a command input by a user, and monitoring command execution result data returned by the host machine at the same time; and according to vulnerability detection and monitoring results, dynamically analyzing and generating a shellcode character string capable of triggering command execution of a host machine, and outputting the shellcode character string to a terminal. And finally, covering and writing the shellcode into a corresponding file reserved area, compiling, and when the virtual machine end runs, triggering host machine command execution through a QEMU vulnerability attack surface, and returning an execution result to the virtual machine end in real time by utilizing a message tunnel constructed by the vulnerability. The method is suitable for a typical cloud computing security scene in which a host machine is strictly isolated from a network and a user cannot directly interact with the host machine, and the visibility and troubleshooting efficiency of security problems in a virtual environment are improved.

The invention discloses a label constraint K-step reachability query method for privacy protection on a label graph, which belongs to the field of cloud computing security and comprises a key generation stage, a graph encryption stage, a trap door query stage, a query stage and a decryption stage. The key generation center generates various keys and distributes the keys to the system models; the user constructs a security index based on the directed tag graph and outsources the security index to the cloud platform; a user can generate a query trap door and send the query trap door to the cloud platform; the cloud platform collaboratively computes a service provider to complete label constraint K-step reachability query; and the user decrypts the query result returned by the cloud platform to realize higher requirements on data security and privacy protection.

Machine Learning based Security device for Cloud Computing

The application belongs to the field of cloud computing security, and discloses a trajectory data-based outsourcing cloud environment privacy protection infection mode mining method, which is divided into two stages: the first stage: trajectory data preprocessing, encryption and outsourcing, first, the data owner pre-processes the trajectory data set to be uploaded, generates a corresponding encoding matrix for the trajectory data of each object, then generates a secure index matrix for the encoding matrix through a strong anti-collision one-way hash function, and finally uploads the encrypted trajectory data and the generated secure index matrix to a cloud server, and shares the key with authorized users; the second stage: a privacy protection infection mode mining method, first, the authorized user sends the infected object number to the cloud server, the cloud server performs infection mode mining after receiving the infected object number, and returns the mining result to the authorized user. The application can ensure high accuracy of the mining result, improve the mining efficiency, and is easy to implement.

The present invention discloses a method for preventing communication data leakage in a cloud computing environment, which relates to the field of cloud computing security technology. The method comprises: obtaining a communication instruction containing a communication task to be executed and a corresponding communication link from a cloud computing platform, performing a data leakage risk test according to the task, collecting real-time protection parameters of the link to establish a protection mechanism if the test passes, introducing a risk prediction channel and combining the mechanism to predict the communication data leakage risk coefficient of the task to be executed, then optimizing and adjusting the protection mechanism based on the risk coefficient, threshold value and different constraint step sizes to construct an optimization mechanism, finally optimizing the communication link protection to obtain an optimized link, and executing the task in combination with the cloud computing platform. The method solves the technical problem in the prior art that the communication link in a cloud computing environment is poorly protected, resulting in communication data being vulnerable to leakage threats, and achieves the technical effect of improving the protection performance of the communication link in a cloud computing environment and reducing the risk of data leakage.

The present application relates to the field of machine learning technology and cloud computing security. Disclosed are a software security detection method, a system and an electronic device. The method comprises: monitoring an access operation executed on a storage device by software to be subjected to detection, and acquiring behavioral data generated during the process of said software executing the access operation; inputting the behavioral data into a security detection model for detection, so as to obtain a detection result, the security detection model being obtained by means of training at least using an abnormal behavior sample, and the abnormal behavior sample being data generated by a software sample under an abnormal access operation; in response to the detection result being that the behavioral data is identified as abnormal behavioral data, determining that said software is in an abnormal access state; and, in response to the detection result being that the behavioral data is identified as normal behavioral data, determining that said software is in a normal access state. The present application solves the technical problem of low accuracy of software security detection.

Computer Device for Cloud Computing Security