41 results about "Embedded security" patented technology

A system for real-time detection and mitigation of morphing malware in high-density edge networks, consisting of: a data acquisition unit configured to receive, normalize, and encode multimodal telemetry data streams originating from at least one of the following domains: network traffic, process behavior, system call sequences, binary instruction traces, and control flow graphs; the data acquisition unit is further configured to compute feature embeddings over sliding time windows and apply privacy-preserving redactions prior to storage; a generative neural processor that is operationally coupled to the data acquisition unit and configured to generate synthetic morphing malware variants by learning probabilistic transformations of previously observed malicious data representations, maintaining semantic functionality while varying structural and behavioral features; a discriminative neural processor trained adversarially with the generative neural processor, wherein the discriminative neural processor is configured to detect morphing malware by evaluating a probability distribution over multimodal telemetry embeddings and classifying anomalous process and flow behaviors in real time; a coordination processor that is communicatively connected to both the generative neural processor and the discriminative neural processor and is configured to orchestrate adversarial co-training, regulate detection thresholds, calculate reinforcement-based penalties for false negative results, and trigger countermeasures as soon as a detection confidence level exceeds a predefined adaptive threshold; a secure, system-integrated inference and enforcement unit configured to perform low-latency countermeasures at the network edge, including selective packet filtering, flow isolation, process interruption, or system microsegmentation, based on instructions from the coordinating processor; and a hardware-embedded security enclave that is embedded in the system and configured to store cryptographic keys, neural model parameters, and integrity affirmation data to ensure the confidentiality, authenticity, and immutability of model artifacts and policy configurations.

A method performed by a computer-implemented controller is provided. The method includes receiving a request for managing one or more user equipments (UEs); obtaining a user-specific security profile from a first service provider; obtaining a subscriber identity module (SIM) profile from a network node or a second service provider; obtaining a set of secure access service edge (SASE) instances from the network node; building one or more UE-specific bootstrap configurations based on the user-specific security profile, the SIM profile, and the set of SASE instances; and sending the one or more UE-specific bootstrap configurations to a third service provider. The one or more UE-specific bootstrap configurations are obtainable by the one or more UEs to establish a secured wireless communication channel through a zero-trusted network.

The invention discloses an AI technology and media industry data element-based fusion media topic selection planning method, which comprises the following steps of: acquiring fusion media data from a fusion media platform in real time through an API (Application Program Interface) and a distributed crawler, performing data cleaning, alignment and multi-modal data standardization, then extracting key features and constructing a dynamic knowledge graph; a user inputs keywords and selects question types, semantic features of the keywords are extracted, and fusion media data are retrieved according to the semantic features and the question types to generate a selected question recommendation scheme; constructing a propagation value prediction model to analyze and predict the generated topic recommendation scheme, constructing a topic recommendation scheme auditing model, and auditing the generated topic recommendation scheme by adopting an embedded security mechanism; and sending the selected topic recommendation scheme passing the selected topic recommendation scheme auditing and the corresponding propagation value prediction result to the user. According to the invention, the efficiency and accuracy of topic selection planning are improved, and the method has high practicability and popularization value.

The invention relates to an embedded safety management method based on digital RMB industrial control equipment, and belongs to the technical field of industrial control system safety. The method comprises the following steps: during first deployment, carrying out information binding on an asymmetric key pair of the industrial control equipment and an equipment identity identifier to generate an equipment digital certificate; the digital signature is verified step by step from a private key of the asymmetric key pair during power-on starting through a safe starting process; when communication is established, performing digital signature on a communication key by calling a signature function of the hardware security module based on a challenge-response mechanism; when a digital RMB transaction is carried out, the trusted execution environment and the digital RMB hardware wallet module carry out secure interaction, and a transaction instruction is analyzed; during the operation period of the equipment, key data streams are continuously collected and analyzed by deploying an exception monitoring module. Reading, querying and related business transactions of the digital RMB on the industrial control equipment are achieved, and it is ensured that the identity is not forged and the instruction is not tampered.

This application relates to an identification card authentication system and methods for authenticating the identification card. The identification card authentication system includes an identification card insert slot to insert the identification card, a roller to detect the insertion of the identification card, a height detector to detect the height of the identification card, a full mark detector to detect a security mark printed on a surface of the identification card, an embossed mark detector to detect an embossed mark printed on the identification card, and a controller (e.g., included in a computing device) to store embedded security features associated with the identification card and authenticate the detected heigh, full mark, and embossed mark of the identification card by comparing them with the respective security feature from the embedded security features.

The invention discloses a lightweight security protection method for file permission access in a localization scene, and belongs to the technical field of information security and localization system security. According to the method, the attack process is effectively delayed and automatic attacks are blocked through three aspects of technologies, including file access interception and underlying authority control, virtual Shell hiding and induction, and external command hiding and path migration. Meanwhile, a set of user-oriented file permission access and Shell obtaining and approving system is formulated, a set of file permission access management and control mechanism is formed, and safety energizing and force applying are carried out on a localized system. According to the lightweight security protection method, the limitation of a traditional method is broken through, a security policy is embedded into a file system and a command path, the lightweight security protection method is suitable for a domestic system in a specific scene, and on the premise that normal users and operation and maintenance process availability are guaranteed, attack chain execution can be effectively delayed, automatic attacks are prevented, and system security is enhanced.

The invention relates to the technical field of embedded system network security, and provides a relay protection embedded security gateway device, which comprises a proxy server module for analyzing a downlink message to perform user login authentication, authority auditing and routing addressing, and performing auditing log recording and transparent forwarding on an uplink message, realizing one-to-many proxy communication based on the frame head addressing information; the authority auditing module is linked with the proxy server module and the auditing log module and is used for directly disconnecting the request which does not pass the authority verification; the audit log module is used for recording user operation events, permission change and system security events, supporting multi-format log storage and management and realizing log rolling recording and roll file exporting through a database; and the user management module is used for realizing full-life-cycle management of user identities and supporting password strength strategy configuration and a continuous wrong login locking mechanism. The method is suitable for network security protection of the power embedded device, and has the advantages of low invasiveness and high maintainability.

An embedded secure element (eSE) includes an input configured to receive a first data signal and an output configured to deliver a second signal. The eSE further includes a circuit configured to implement an embedded SIM card. The output is intended to be coupled to an external SIM card. A selector within the eSE receives the first signal from the input is controlled in a first selection to deliver the first signal to the embedded SIM card. The selector is further controlled in a second selection to deliver the first signal to a voltage level converter which level shifts the first signal to generate the second signal at the output.

An apparatus comprises a computing device including one or more processors, multiple peripheral communication devices of different communication protocol types operably connected to the one or more processors, and a memory to store processor-executable instructions comprising an application layer protocol stack. The processor-executable instructions are such that, when executed by the one or more processors, cause the one or more processors to perform operations for respective ones of messages to be communicated to and from the computing device via respective ones of the multiple peripheral communication devices. The operations comprise communicating the respective ones of messages via the respective ones of the multiple peripheral communication devices according to a unified messaging protocol that is common to the multiple peripheral communication devices.

Systems and methods for generating digital documents with embedded security features are provided. Methods may include receiving a first dataset comprising content data that was manually inputted by a system user, receiving a second dataset comprising an identifier associated with the system user, receiving a third dataset comprising a location associated with the system user, and cryptographically embedding, via a machine-learning (ML) module, the second and the third datasets into the first dataset to create a fourth dataset. In the fourth dataset, the first dataset may be visible to a human viewer while the second and the third datasets are invisible, and the second and third datasets may be extractable by a trusted system in possession of a cryptographic key. Methods may include generating an output document displaying the fourth dataset.

This application relates to an embedded Linux secure boot method and system based on RK3568. The method includes: verifying the signature of the SPL firmware using the root key stored in OTP; if the SPL firmware verification passes, verifying the signature information of the Uboot firmware using the OTP key; if the Uboot firmware verification passes, verifying the signature information of the Boot firmware using the OTP key via the OP-TEE system call, and loading the Kernel image, DTB device tree, and Ramdisk file system; triggering SMC instructions through the Ramdisk file system client program to call a trusted application, obtaining key data from the RPMB partition, and decrypting the Rootfs encrypted container using the key data; after the Rootfs encrypted container is decrypted, booting the Linux system, and completing communication isolation between the secure area and the normal area through the OP-TEE system. This application solves the problems of high firmware tampering risk and insufficient file system flexibility in the prior art, which is beneficial to improving system security.

The invention relates to the technical field of embedded security, and discloses an installation system of an eSIM configuration file, which is applied to terminal equipment, and the installation system comprises a communication interface configured to receive an instruction data packet sent by an SM-DP + server, the instruction data packet comprises a security load and an execution bill, the security load is an eSIM configuration file encrypted based on a public key of an eSE asymmetric key pair; the fusion security domain comprises an eSE and an embedded universal integrated circuit card (eUICC), and the eSE is in secure communication with the eUICC; the routing logic unit is configured to route the instruction data packet to the eSE by hardware; wherein the eSE is configured to verify the execution bill, decrypt the security load based on a private key of the asymmetric key pair of the eSE after the verification is passed, so as to obtain an eSIM configuration file, and transmit the eSIM configuration file to the eUICC in a streaming manner; the eUICC is configured to perform an installation of the eSIM profile. According to the method, the security, reliability and anti-attack capability of eSIM configuration file installation can be improved. The invention further discloses an eSIM configuration file installation method and device and terminal equipment.

An apparatus comprises a computing device including one or more processors, multiple peripheral communication devices of different communication protocol types operably connected to the one or more processors, and a memory to store processor-executable instructions comprising an application layer protocol stack. The processor-executable instructions are such that, when executed by the one or more processors, cause the one or more processors to perform operations for respective ones of messages to be communicated to and from the computing device via respective ones of the multiple peripheral communication devices. The operations comprise communicating the respective ones of messages via the respective ones of the multiple peripheral communication devices according to a unified messaging protocol that is common to the multiple peripheral communication devices.

The invention provides an electronic equipment dynamic management method and system based on risk grading, and relates to the technical field of data identification, and the method comprises the steps: configuring a risk grade for electronic equipment, constructing a life cycle management chain, and identifying a security number and a layout position. And setting an identity recognition code, embedding security quantity and layout position information, and establishing a mapping relation. And according to the life cycle node risk demand, setting an identification strategy, and carrying out identification verification. And executing management measures according to the verification result. The method can solve the problems that in the prior art, due to the fact that data are not updated in time and cannot be monitored in real time, the equipment management efficiency is low, potential safety hazards are increased, and the overall efficiency and safety of police affairs or security and protection work are further affected, the electronic equipment with risks is comprehensively recognized and verified through the mapping relation, and the safety of the police affairs or the security and protection work is improved. And the safety, the compliance and the performance of the equipment in the whole life cycle can be ensured to reach the standard.

This application provides a blockchain-based cross-domain distributed digital identity trusted management method, relating to the field of embedded security technology. By combining centralized and traceable blockchain technology with the needs of multi-domain embedded device node certificate management, a multi-domain node authentication architecture is studied. Based on lightweight remote identity authentication node trusted access technology, trusted digital identity authentication for multi-domain users in a distributed environment is realized, achieving the goal of supporting fully controllable distributed digital identity secure access.

The embodiment of the invention provides a firmware updating method and device for embedded equipment, equipment and a storage medium. The method comprises the following steps: after acquiring a firmware micro-service pack for performing firmware updating on target firmware in embedded equipment, the embedded security element acquires and stores firmware state data of the target firmware, performs firmware updating on the target firmware based on the firmware micro-service pack in response to the storage of the firmware state data, and if the updating fails, performs firmware updating on the target firmware based on the firmware micro-service pack. And performing data recovery on the target firmware based on the firmware state data. The embodiment of the invention is used for realizing atomization updating of the target firmware in the embedded equipment.

The application discloses a random peripheral mapping device and method of a microcontroller, wherein the device comprises a data loading module, an advanced encryption module and a mapping table generating module connected in sequence; the data loading module is used for providing random data with a user identifier and transmitting the random data to the advanced encryption module; the advanced encryption module is used for generating a mapping table primitive based on the random data and transmitting the mapping table primitive to the mapping table generating module; and the mapping table generating module is used for generating a peripheral mapping table based on the mapping table primitive to provide a random peripheral address for the microcontroller to run software or access software. The device provides a random peripheral address for the microcontroller to run software or access software through the mapping table generating module, so that the operation of the software on the peripheral is no longer limited to fixed addresses, and the difficulty of attacking and cracking the product of the microcontroller and the running software in embedded security application is greatly increased.

The application discloses a high-speed encryption and decryption embedded security subsystem and method. The system comprises an SPI interface, a DMA module, an arithmetic core array, a CPU and a system bus; the SPI interface is additionally provided with a transmission ready TR and a receiving ready RR special handshake signal line; the DMA module is divided into a sending DMA and a receiving DMA; the arithmetic core array comprises at least three parallel arranged arithmetic cores. The sending DMA responds to the TR signal to move data into an idle arithmetic core and starts operation; the receiving DMA moves the result to the SPI interface after the operation of the arithmetic core is completed and triggers the RR signal. Through the double DMA cooperation and the multi-arithmetic core pipeline scheduling, the SPI interface realizes the full-duplex parallel transmission of the command issuing and the response uploading, the CPU is only responsible for the initialization and does not participate in the real-time data processing, so that the interface bandwidth utilization and the encryption and decryption throughput are greatly improved, and the system is suitable for high-bandwidth real-time security application scenarios.

An input / output (I / O) module (300, 400) includes multiple input ports (310, 410) configured to receive input signals (312, 412), wherein each input signal (312, 412) comprises an input state, and an internal evaluation component (350, 450) configured to receive and evaluate the input states and to execute an embedded safety function (360, 460). Further, an input / output (I / O) control system (200) includes a central controller (210) and a plurality of input / output (I / O) modules (300, 400), wherein an I / O module (300, 400) is configured as described herein.

An apparatus includes a computing device including one or more processors, a plurality of peripheral communication devices having different communication protocol types operably connected to the one or more processors, and a memory to store processor executable instructions including an application layer protocol stack. The processor executable instructions cause, when executed by the one or more processors, the one or more processors to perform operations for respective ones of the messages communicated to and from the computing device via respective ones of the plurality of peripheral communication devices. The operation includes communicating, via the respective one of the plurality of peripheral communication devices, the respective one of the messages according to a unified messaging protocol common to the plurality of peripheral communication devices.

The invention relates to communication within an electronic device. An embedded secure element (eSE) includes an input configured to receive a first data signal and an output configured to deliver a second signal. The eSE also includes circuitry configured to implement an embedded SIM card. The output is intended to be coupled to an external SIM card. A selector within the eSE is controlled in a first selection to receive a first signal from an input to deliver the first signal to the embedded SIM card. In the second selection, the selector is further controlled to deliver the first signal to a voltage level shifter that level shifts the first signal to generate a second signal at an output.

The present invention provides an NFC-based transaction method, apparatus, user identification device, and terminal, relating to the field of communications technology. The method comprises: receiving a first message from a terminal, the first message used for application verification; sending a first response message to the terminal based on the first message and a currently stored routing table; the first response information instructing the terminal to send a second message to a target user identification device or embedded secure element (eSE). The solution of the present invention solves the problem of traditional CLEs being unable to forward NFC contactless transactions, resulting in service conflicts.

A unified content delivery network system (UCDN) system formed by one or more networks of interoperable peer-to-peer networks. A hierarchical hybrid adaptive secure peer-assisted network system (referred to as SPAN-AI) using a hierarchical AI-driven approach under a unified secure content addressable architecture, the system is based on five key SPAN-AI subsystems: unified naming; unified discovery; hybrid adaptive routing; scalable publish subscribe; and embedded security; all five key SPAN-AI subsystems are securely integrated and jointly optimized via a hierarchical pluggable AI framework with associated simulation, training, and development pipelines embedded in AI agents with varying degrees of awareness and optimization capabilities at the peer-to-peer, edge, core, or other network levels (hierarchy).

The embodiment of the invention discloses an on-chain and off-chain collaborative data sharing method and device based on digital watermarking. A specific embodiment of the method comprises the steps of obtaining shared text data; the data sharing end constructs a security label and a security policy according to the shared text data; according to the security label, performing chain watermark embedding processing on the shared text data to obtain embedded text data; storing the embedded text data to a target file system to obtain a data storage address; according to the security policy, the security label and the data storage address, constructing an implicit data capsule tuple, and uploading the implicit data capsule tuple to a target data domain of the block chain to obtain a data capsule identifier; and sending the on-chain capsule application to the block chain, generating analyzed data based on the on-chain capsule application, and sending the analyzed data to a data use end. According to the embodiment, the data capsule can be constructed on the chain, and the security label can be embedded under the chain, so that the data sharing security is improved.

A device comprises a computing device, including one or more processors, several peripheral communication devices of different communication protocol types, operationally connected to the one or more processors, and a memory for storing processor-executable instructions of an application-layer protocol stack. The processor-executable instructions are adapted so that, when executed by the one or more processors, they cause the one or more processors to perform operations for the respective secure communication sessions to be established with the respective target devices via the respective of the several peripheral communication devices.The processes involve establishing the respective secure communication sessions with the respective target devices via the respective of the multiple peripheral communication devices according to a message exchange of a mutual authentication and key exchange protocol common to the multiple peripheral communication devices.

The invention provides a lightweight embedded security file system, which relates to an embedded system and an information security technology, and is used for improving data reliability through multi-dimensional wear fine calculation, dynamic partition adjustment of physical block attribution and hierarchical redundancy. The storage reliability and efficiency, the space utilization rate, the data security and the service life of the storage medium can be improved. Specifically, storage areas are divided through the partition management module according to encryption grades, the parameter acquisition module acquires multi-dimensional parameters such as read-write times and temperature in real time, the wear calculation module calculates real-time wear in combination with parameter coefficients, and the dynamic regulation and control module migrates physical blocks for capacity expansion and performs visual early warning when the area utilization rate exceeds a threshold value.

A flexible security tag includes: an elongated inlay portion; a loop antenna mounted on the elongated inlay portion; an electrically-conductive member longitudinally extending across the elongated inlay portion, spaced apart from and inductively coupled to the loop antenna; and a radio frequency identifier (RFID) circuit mounted to the loop antenna. The flexible security tag is encapsulated within an elongated textile protective sleeve.

A system comprises a computing device with one or more processors, several peripheral communication devices of different communication protocol types operationally connected to the one or more processors, and a memory for storing processor-executable instructions comprising an application-layer protocol stack. The processor-executable instructions are such that, when executed by the one or more processors, they cause the one or more processors to perform operations for each of the messages to be communicated to and from the computing device via each of the several peripheral communication devices.The processes involve communicating the respective messages via the respective of the several peripheral communication devices according to a uniform messaging protocol common to the several peripheral communication devices.

The invention relates to an embedded Linux safe starting method and system based on RK3568. The method comprises the steps that signature verification is conducted on SPL firmware through a root key stored by OTP; if the verification of the SPL firmware is passed, the OTP key is used to verify the signature information of the Uboot firmware; if the verification of the Uboot firmware is passed, calling an OTP secret key through an OP-TEE system to verify the signature information of the Boot firmware, and loading a Kernel mirror image, a DTB device tree and a Ramdisk file system; triggering an SMC instruction through a client program of the Ramdisk file system to call a trusted application program, obtaining key data from the RPMB partition, and decrypting the Rootfs encryption container through the key data; and after decryption of the Rootfs encryption container is completed, starting the Linux system, and completing communication isolation between the security area and the common area through the OP-TEE system. According to the method, the problems of high firmware tampering risk and insufficient file system flexibility in the prior art are solved, and the system security is improved.

An apparatus comprises a computing device including one or more processors, multiple peripheral communication devices of different communication protocol types operably connected to the one or more processors, and a memory to store processor-executable instructions of an application layer protocol stack. The processor-executable instructions are adapted such that, when executed by the one or more processors, cause the one or more processors to perform operations for respective ones of secure communication sessions to be established with respective destination devices via respective ones of the multiple peripheral communication devices. The operations comprise establishing the respective ones of secure communication sessions with the respective destination devices via the respective ones of the multiple peripheral communication devices according to an exchange of messages of a mutual authentication and key exchange protocol that is common to the multiple peripheral communication devices.