28 results about "Group Policy" patented technology

One embodiment provides a system and method for facilitating a dynamic policy engine with recursive key selection. During operation, the system may receive a user request at a network device for creating a policy table, the user request including multiple sets of policy fields and specifying an amount of hardware resources for the policy table. The system may, in response to determining that the amount of unallocated hardware resources is less than the amount of hardware resources specified in the user request, release a portion of the allocated hardware resources and allocate a specified amount of hardware resources for the policy table. The system may identify an optimized matching policy template that accommodates multiple sets of policy fields based on the user request. Thereafter, the system may configure one or more hardware template registers based on the optimized matching policy template and create a policy table.

Examples of the present disclosure describe systems and methods for implementing a software-based security abstraction engine in a one-way transfer (OWT) system. In examples, data is received at a first device in the OWT system. A first set of policies is identified based on a dataflow identifier associated with the transfer of the data. A policy engine associated with the first set of policies applies the first set of policies to the data to create digital signatures. The digital signatures are evaluated by the security abstraction engine to determine whether the set of digital signatures is valid. If the digital signatures are determined to be valid, a second set of policies is applied to the data. The data is then transmitted to a second device or destination in the OWT system based on the dataflow identifier.

A computer-implemented method for satisfying gateway proofs and an integrity check to retrieve decryption value sets for a ciphertext received by a recipient computing device may include performing four gateway proofs of determining whether: (1) a group policy of the ciphertext's header matches a group policy of the recipient computing device; (2) a USUP of the header matches a USUP of the recipient computing device; (3) a first unique identifier from a ciphertext policy of the header matches a unique identifier of the recipient computing device; and (4) a second unique identifier from the ciphertext policy of the header matches the ciphertext's length. An integrity check may be performed and the recipient computing device can retrieve the decryption value sets if the gateway proofs and integrity check are satisfied.

This disclosure describes a policy deduplication system that determines duplicates among a set of RBAC policies. For instance, the policy deduplication system determines whether a pair of RBAC policies within a cloud computing system are semantically equivalent, even if they are syntactically distinct. In addition, the policy deduplication system utilizes symbolic abstraction models and satisfiability solver models to identify duplicate policies that are semantically equal for all user inputs by searching for counterexamples that would prove a pair of policies to be semantically unequal. However, if no counterexamples are found, the policy deduplication system determines that the policies are duplicates.

The present application provides a method, system, device, product and medium for obtaining configuration information of an application, and relates to the field of cloud computing technology. The method includes: a service proxy component obtains a query request for configuration information of an application, and obtains the environment grouping strategy of the application from an application management and control platform; based on the environment grouping strategy, the environment tag corresponding to the application is determined; the environment tag is added to the query request, and the query request with the environment tag added is sent to the configuration center, so that the configuration center obtains the configuration information corresponding to the environment tag; the configuration information corresponding to the environment tag sent by the configuration center is received, and returned to the application. In this embodiment, the self-perception of the environment tag is realized through the service proxy component, which avoids manual parameter configuration of the application, reduces the complexity of different environment configurations of the application, and improves the efficiency of application configuration.

A method of operating a network node (1000) configured to provide a policy control function, PCF The method comprising receiving (610, 520, 530), from a user data repository, UDR, an indication of at least one updated value of a maximum group data rate, MGDR, receiving (620, 540, 570) group policy control information including at least one of at least one value of a provisioned MGDR and at least one value of a remaining MGDR, and in response to determining that the at least one updated value of the MGDR is different from the at least one value of the provisioned MGDR: adjusting (560) the at least one value of the provisioned MGDR in the group policy control information based on the updated value of MGDR and / or adjusting (560) the at least one value of the remaining MGDR in the group policy control information based on the updated value of MGDR.

A computer-executable procedure, comprising: Determining a first set of policies (152) defined for a switch (103) when handling a packet, wherein a policy includes at least one policy entry based on a target role and wherein the at least one policy entry includes a source role, a traffic attribute and an action to be performed for the packet; Receiving an incoming packet at the switch, where the destination of the incoming packet is unknown; Representing the first set of policies as a matrix, where a first entry in the matrix corresponds to the source role as a row and the destination role as a column, and specifies the traffic attribute and the action of the at least one policy entry; Replacing the action in the first entry with the target role if the action indicates that the packet should be allowed, and with a null value if the action indicates that the packet should be rejected, in order to obtain an initial data structure with entries that specify a multitude of traffic attributes for each source role and a corresponding set of allowed target roles for each traffic attribute; Resolving an overlapping pair comprising a first traffic attribute and a second traffic attribute to obtain a second data structure; Finding that a third traffic attribute for a source role in the second data structure does not comply with a policy; Removing the third traffic attribute from the second data structure to obtain a second set of synthesized policies (154), where a first decision model based on the first set of guidelines leads to the same result as a second decision model based on the second set of synthesized guidelines; Allowing or rejecting the forwarding of the incoming packet at the switch using the second decision model; in response to allowing the incoming packet to be forwarded to a local host; and as a reaction to the rejection, the dismissal of the incoming package.

Systems and methods support command content validation. During runtime of an application, a command content validator may intercept a first command directed to a first software component, wherein the application includes a plurality of software components; compare the first command to a stored set of policies, wherein the set of policies sets out either or both of allowed command content and disallowed command content; determine that the first command is allowed based on the set of policies; and allow or disallow a first requested action of the first command to be performed.

The present invention provides a task execution method and system based on dynamic class loading, belongs to the field of computer technology, includes creating a basic platform class loader, and building a connector index in the basic platform class loader; creating a task class loader group, a policy class loader group and a connector class loader group respectively, each group generates an independent and isolated class loader for each loaded JAR package; after the task and policy class loaders receive a class loading request, the class loading request is passed to the basic platform class loader according to a parent delegation mechanism delegation; it locates the connector class loader corresponding to the class loaded by the request through the connector index according to the class loading request, creates a class object according to the class loaded by the request, and returns the class object to the policy class loader and the task class loader according to the delegation path. It pre-allocates resources using the class loader by pre-deploying the running resources of the Java virtual machine, thereby reducing the startup time during task execution.

A method of controlling enforcement policies (220, 506) for multiple policy enforcement points, PEPs (208A-N, 310), in a distributed access control system (202) is provided. The system operates across various geographic locations, with each PEP positioned at a specific site. The method involves receiving declaration record messages (210, 302) from each PEP, which include identifiers, locations, protected resources, and enforceable actions (314, 404, 504). Execution record messages (212, 402, 508) specifying actions to enforce, dependencies (406) between actions, a report (408) on the action status (410), and conditions (414) determining which PEPs are responsible for enforcement are also received from each PEP. Each PEP uses these messages to dynamically adjust enforcement policies to ensure coordinated control over access to digital data resources. This method helps the system efficiently handle access requests, respect action dependencies, and maintain synchronization among PEPs, thereby improving security and consistency across distributed locations. A method of constraining the use of policies of an access control system (102) which governs an authorization related to a subject's (104) access to a digital data resource (106) is provided. The method includes establishing a hierarchy of policies including: (i) a first set of policies defined as governance policies (108, 202, 302), which are used to govern an authorization during the lifecycle of the authorization; (ii) a second set of policies defined as authorization policies (110, 204, 304), which manage access rights to the digital data resource by the subject in the access control system; and (iii) a third set of policies defined as enforcement policies (112, 206, 306), which specify how decisions and actions related to the access rights are to be enforced by the access control system. The method includes using the governance policies in the first set of policies in the hierarchy to set constraints on the authorization policies in the second set of policies and on the enforcement policies in the third set of policies, to orchestrate the authorization throughout the lifecycle of the authorization.

Disclosed herein are system, method, and computer program product aspects for implementing a security group policy. Some aspects of this disclosure relate to a method for applying a security group policy. The method includes receiving a first frame from a source device and assigning a source security group identifier (ID) to the first frame. The method further includes generating a second frame based on the first frame and the source security group ID and identifying a target security group ID for the second frame. The method also includes applying one or more forwarding decisions to the second frame based on the source security group ID and the target security group ID.

A method for processing a policy, performed by a first network element, includes: determining a policy for a UE in a UE group and an execution condition of the policy. A method for processing a policy includes: receiving, by a second network element, a group policy for a UE group and an execution condition of the group policy; and generating, by the second network element, a group QoS profile, a group PDR, or both the group QoS profile and the group PDR for the UE group according to the group policy and the execution condition of the group policy. The group QoS profile, the group PDR or both the group QoS profile and the group PDR are configured to allow the group policy to be executed, and the execution condition of the group policy is satisfied.

The application discloses a network migration method and system, electronic equipment, storage medium and program product, and relates to the technical field of Internet, which comprises the following steps: generating a migration plan according to a network migration request, network related information, first configuration information of a network to be migrated and second configuration information of a target network; establishing a transition tunnel to generate network traffic on a first network card of the target network; generating an initial security group policy according to the network traffic and deploying the initial security group policy to the first network card to obtain a performance index and a policy accuracy rate of the target network; if the performance index is within a preset baseline range and the policy accuracy rate reaches a gating threshold, adjusting the policy according to a preset weight to determine a traffic switching step, and switching network traffic corresponding to the network to be migrated to the target network. The application solves the problem that traffic switching during migration of a traditional network easily leads to service interruption, and the network after migration can only be verified after the migration is completed, and potential performance degradation defects in the traditional network cannot be found in time.

The present application provides a message processing method, device, system and storage medium, belonging to the field of communication technologies. The present application provides a method for implementing microsegmentation in an IPv6 network. By using the IPv6 extension header of an IPv6 message to carry EPG information, the EPG information is made visible to the receiving end of the IPv6 message, so that the receiving end of the IPv6 message can execute group policies according to the EPG information in the IPv6 extension header, thereby implementing the function of microsegmentation. Since the IPv6 extension header has stronger extensibility, the problem of weak extensibility existing in carrying EPG information through the VXLAN header is solved, which helps to continue to expand new functions. Moreover, since the encapsulation format of the message is more concise and the header occupies fewer bytes, the overhead caused by transmitting the message is saved.

Some embodiments provide a method for authorizing application programming interface (API) calls on a host computer in a local cluster of computers. The method is performed in some embodiments by an API-authorizing agent executing on the host computer in the local computer cluster. From a remote cluster of computers, the method receives (1) a set of API-authorizing policies to evaluate in order to determine whether API calls to an application executing on the host computer are authorized, and (2) a set of parameters needed for evaluating the policies. With the remote cluster of computers, the method registers for notifications regarding updates to the set of parameters. The method then receives notifications, from the remote cluster, regarding an update to the set of parameters, and modifies the set of parameters based on the update. In some embodiments, the notification includes the update, while in other embodiments the method directs the remote cluster to provide the update after receiving the notification regarding the update. In addition to the notifications, the method periodically polls the remote cluster to retrieve the set of parameters needed for the received set of policies, in order to supplement data received through the notifications.

The present disclosure relates to a method and a system for counters and KPIs policy management in a network The method comprises transmitting from a cron scheduler [304], a request for execution of one or more policies to an integrated performance management (IPM) [100a]. The method comprises receiving at the IPM [100a], a request for a report comprising a set of counters and KPIs. The method comprises identifying at the IPM [100a], a set of policies. The method comprises evaluating at the IPM [100a], the set of policies based on a set of severity breach thresholds. The method comprises identifying at the IPM [100a], a set of breach conditions based on the set of severity breach thresholds. The method comprises generating at the IPM [100a] one or more reports. The method comprises sending from the IPM [100a], the one or more reports to one or more users.

The invention belongs to the technical field of data processing, is suitable for financial scenes and medical scenes, and discloses a group insurance policy data processing method and device, equipment and a medium, and the method comprises the steps: obtaining to-be-processed group insurance policy data, and carrying out the multi-thread task decomposition, generating a plurality of to-be-processed sub-tasks corresponding to the to-be-processed group insurance policy data; based on a consistent Hash algorithm, distributing each to-be-processed sub-task to each computing node of a distributed cluster; the resource utilization rate of each computing node is monitored in real time based on a resource monitor, and the monitored resource utilization rate is synchronized to a load balancer; the load balancer evaluates the load condition of each computing node according to the response delay and the error rate, and dynamically adjusts the flow distribution of each computing node according to the evaluation result; and asynchronous processing is carried out on the sub-tasks in each computing node after the flow distribution is adjusted, and the asynchronously processed group insurance policy data is generated, so that the processing efficiency of the group insurance policy data is effectively improved.

A cloud network for automatically provisioning of user and group profiles using direct synchronization in multi-tenant systems. It involves a plurality of end-user devices, each equipped with a local application and user interface, and a mid-link server. The mid-link server facilitates the creation of configuration snippets for user directories via the user interface, receives threat information associated with an end-user, and identifies a high-risk user from the plurality of end-users based on the threat information. In response to identified high-risk users, the mid-link server remediates threat by dynamically adjusting user directory privileges, the remediation comprises restricting access of the high-risk user in accordance with policies and assigning them to a high-risk group with a lower set of privileges and removing them from the high-risk group when the threat is remediated. The user directory is deployed using the snippet based on the user policies and the group policies.

Systems and methods are disclosed herein that provide provisioning and management of AI / ML policies in application-layer AI / ML services. In the preferred embodiments, the AI / ML policies include AI / ML policies for AI / ML member participation and selection. Embodiments of the proposed solution define two groups of AI / ML policies, namely, (a) AI / ML member participation polices and (b) AI / ML member selection polices. The AI / ML member participation policies are provided by an individual AI / ML member (e.g., Federated Learning (FL) client, Distributed Machine Learning (DML) client). These policies identify the policies of the individual AI / ML member to participate in AI / ML operations. The AI / ML member selection polices are provided by an AI / ML operation invoker (e.g., application server, application client). These policies identify rules on selection of individual AI / ML members for an AI / ML operation.

The present disclosure provide a policy coordination method for a group of user equipment (UEs), the method includes receiving a policy request, where the policy request is related to a group policy for the group of UEs; and performing, according to the policy request and pre-stored group policy information, policy coordination on the group of UEs, where the pre-stored group policy information indicates a policy required to be adopted by each UE in the group of UEs for various group policies of the group of UEs.

The present invention proposes a traffic parallel distribution device based on policy control, which issues policies through a policy issuing component to forward designated traffic to a business process. The system includes a policy control component, and a deep message detection component and a policy issuing component respectively connected to the policy control component. The policy issuing component issues a policy group through an API interface provided by a system composed of a deep message detection component and a policy control component. The issued policy issuing component includes an interface group, a six-tuple policy, an action corresponding to the policy group, and a network card bound to the policy group. The present invention accurately identifies specific traffic through a traffic identification strategy, and distributes it to the business process in parallel with zero copy. Compared with serial processing, it can improve concurrent processing capabilities, and the in-and-out policy fusion decision execution processing is different from the traditional unidirectional policy processing method. The unidirectional policy only matches and filters the data message once, and then forwards it to the corresponding interface.

The invention discloses an insurance policy data processing method and device, electronic equipment and a medium, and the method comprises the steps: receiving an insurance policy change request from a user terminal, and obtaining a group insurance policy identifier and insured person change data in the insurance policy change request; obtaining a to-be-changed group insurance policy corresponding to the group insurance policy identifier from a preset group insurance policy library; inputting the insured person change data and the insurance policy data of the to-be-changed group insurance policy into a corresponding preset rate calculation model, and generating an insurance policy change amount of the to-be-changed group insurance policy; generating a first insurance policy interaction page based on the insurance policy change amount, and sending the first insurance policy interaction page to the user terminal; and in response to a change confirmation instruction triggered and generated by the user terminal based on the first insurance policy interaction page, updating a to-be-changed group insurance policy in a preset group insurance policy library. The method can be applied to the business fields of financial science and technology, medical health, old-age care and the like, and improves the insurance policy data processing efficiency and accuracy of group insurance policies through a dynamic rate calculation model and a multi-interaction mode.

The present application discloses a method and apparatus for establishing a session for an Internet of Things device, belonging to the field of wireless communication technology. A method for establishing a session for an Internet of Things device in an embodiment of the present application includes: a terminal obtaining an Internet of Things device group policy, wherein the Internet of Things device group policy instructs the terminal to establish a session channel based on an Internet of Things device group; and the terminal establishes a target session channel for a target Internet of Things device connected to the terminal based on the Internet of Things device group policy.

A cloud network for automatically provisioning of user and group profiles in multi-tenant systems. It involves a plurality of end-user devices, each equipped with a local application and user interface, and a mid-link server that orchestrates the provisioning process. The mid-link server facilitates the creation of configuration snippets for user directories via the user interface, retrieves user and group policies from a central policy store, and dynamically filters these policies based on threat information obtained from a threat identifier. In response to identified high-risk users, the system assigns them to high-risk groups with reduced privileges, ensuring enhanced security measures. The filtered policies, along with high-risk user identification, are then passed to a snippet generator for deployment. The system resolves conflicts between user and group policies by prioritizing end-user tasks and specific user / group requirements.

Disclosed herein are system, method, and computer program product aspects for implementing a security group policy. Some aspects of this disclosure relate to a method for applying a security group policy. The method includes receiving a first frame from a source device and assigning a source security group identifier (ID) to the first frame. The method further includes generating a second frame based on the first frame and the source security group ID and identifying a target security group ID for the second frame. The method also includes applying one or more forwarding decisions to the second frame based on the source security group ID and the target security group ID.

The present disclosure proposes a policy coordination method for a user equipment (UE) group, comprising: receiving a policy request related to a group policy for the UE group; and performing policy coordination for the UE group based on the policy request and pre-stored group policy information, wherein the pre-stored group policy information indicates, for various group policies of the UE group, the policies to be adopted by each UE in the UE group. This solution pre-stores the group policy information in each PCF network element in a PCF network element group serving the UE group, so that when any PCF network element in the PCF network element group receives a policy request, it can perform policy coordination for the UE group based on the policy request and the pre-stored group policy information.

Techniques for using a software bill of materials to determine whether an application is still in compliance with a set of policies after being updated, are disclosed. In response to a first version of an application being certified as compliant with a set of policies, a first software bill of materials (SBOM) associated with the first version of the application is generated. In response to determining that the first version of the application has been updated to a second version of the application, a second SBOM corresponding to the second version of the application is generated. The first SBOM and the second SBOM are compared to determine whether the second version of the application is still compliant with the set of policies.