16 results about "Mandatory access control" patented technology

The invention discloses a mandatory access control method and device based on a process function context, and the method comprises the steps: collecting a security context associated with a system call initiated by a target process, so as to generate a standardized object description; mapping the object description into a target function classification identifier, so as to obtain a process function context view of the target process according to the target function classification identifier; constructing a target decision key for access decision based on the current policy era, the qualifier, the function classification identifier, the view identifier of the process function context view and the isolation domain abstract; and querying the multi-level cache according to the target decision key to determine a matched target access decision. Therefore, context-sensitive judgment and cross-component consistency taking the functional context as the center are realized.

The invention discloses a path mark-based mandatory access control method and system during container operation. The method comprises the following steps of: generating a security mark for a container process and a file; executing dynamic access control, and dynamically starting a security model according to the file marking field; dynamic mark adjustment is implemented, the file access frequency is counted in real time through a kernel layer, and when overrun access is detected, if the process confidentiality level is higher than the lowest level, the confidentiality level is degraded; if the process is the lowest level, the BLP model verification permission of the process is temporarily forbidden; all strategy updating and audit log recording are completed locally, and it is ensured that the operation track is traceable; the system comprises a path marking module, an access control module, a dynamic regulation and control module, a strategy management module and a log auditing module. According to the method, error interception is reduced, millisecond-level real-time blocking of high-frequency abnormal access is realized, and the safety protection capability and the operation and maintenance efficiency of the container platform are remarkably improved.

This application discloses an asynchronous video submission and review method and system. The method includes: storing a video submission rule set; distributing the rule set to user computing devices and caching it locally; when a user accesses a specific activity, performing a multi-stage evaluation based on the locally cached rule set, sequentially performing activity matching checks, time window checks, and quota count checks, and generating a submission permission determination only when all stages pass; selectively presenting or restricting video submission entry points in the activity practice interface based on the determination result; the user calling the device's camera through the submission entry point to instantly capture video recordings and transmits them along with identification data to the storage component, while simultaneously incrementing the submitted count; and administrators asynchronously viewing submitted recordings and providing feedback through the review interface. This achieves client-side mandatory access control based on a multi-dimensional rule set, effectively avoiding the problem of excessive workload for administrators of open submission systems.

The invention particularly relates to a mandatory access control method based on a distributed database. The mandatory access control method based on the distributed database comprises the following steps: creating a security level (Level), a compartment (Compartment) and a security label (label); granting the security label to a subject user through a grant statement, or granting the security label to an object library and a table; in order to ensure the integrity of the data, an up-writing and down-reading mode is selected, that is, a subject user can only write data into an object with a higher security level than the own authority, and meanwhile, the subject user can only read data of an object with a lower security level than the own authority. According to the mandatory access control method based on the distributed database, the system security is enhanced, potential security threats are greatly reduced, the data confidentiality is improved, the risks of sensitive information leakage and permission abuse of internal personnel can be effectively prevented, and unified security management is realized.

The application discloses a dynamic security protection method and system based on behavior workflow and Kalman filtering, and relates to the technical field of network security management and control.The application comprises the following steps: collecting multi-source heterogeneous original logs and performing standardized processing to obtain a standardized event stream; mapping the standardized event stream into an attack stage sequence, constructing and incrementally updating an attack semantic graph, and extracting attack progress observation values; establishing a state space model including attack progress and attack speed based on Kalman filtering, performing attack state estimation and trend prediction, and obtaining attack progress estimation and attack speed estimation; calculating threat urgency, and adjusting a two-way mandatory access control strategy based on the threat urgency classification. A dynamic security protection system capable of realizing real-time perception of attack process evolution, dynamic adjustment of access control strategy, high interpretability and strong adaptability is constructed, and deep coupling of attack semantic understanding, attack state estimation and access control strategy adjustment at the system level is realized.

The application discloses a method and device for enforcing access control based on process function context, wherein the method comprises: collecting a security context associated with a system call initiated by a target process to generate a standardized object description; mapping the object description to a target function classification identifier to obtain a process function context view of the target process according to the target function classification identifier; constructing a target decision key for an access decision based on a current policy epoch, a qualifier, a function classification identifier, a view identifier of the process function context view and an isolation domain digest; and querying a multi-level cache according to the target decision key to determine a matching target access decision. Thus, context-sensitive decision based on a function context is realized, and cross-component consistency is achieved.

The invention provides a strategy file generation method and device, a storage medium and an electronic device, and the method comprises the steps: constructing a sample strategy material; performing data cleaning on the sample strategy material to obtain training sample data; carrying out transfer learning on the open source model by adopting the training sample data to obtain an initial strategy generation model; performing reinforcement learning on the initial strategy generation model to obtain a target strategy generation model; software research and development materials of the target vehicle type are obtained, the software research and development materials are input into the target strategy generation model, a mandatory access control (MAC) strategy file of the target vehicle type is generated, the MAC strategy file comprises the mapping relation between the multiple sets of resource objects and the operation authority, and the software research and development materials comprise software codes and environment information of the software codes. Through the embodiment of the invention, the technical problem of low efficiency of editing the MAC strategy file in the prior art is solved, and the compilation difficulty of the mandatory access mode strategy is reduced.

The application provides a strategy file generation method and device, a storage medium and an electronic device, and the method comprises the following steps: constructing a sample strategy material; performing data cleaning on the sample strategy material to obtain training sample data; performing transfer learning on an open source model by using the training sample data to obtain an initial strategy generation model; performing reinforcement learning on the initial strategy generation model to obtain a target strategy generation model; obtaining software research and development materials of a target vehicle model, inputting the software research and development materials into the target strategy generation model, and generating a mandatory access control (MAC) strategy file of the target vehicle model, wherein the MAC strategy file comprises a mapping relationship between a plurality of groups of resource objects and operation permissions, and the software research and development materials comprise software code and environment information of the software code. Through the embodiment, the technical problem of low efficiency of editing a MAC strategy file in the prior art is solved, and the difficulty of mandatory access mode policy writing is reduced.

The invention relates to the technical field of network security level evaluation, discloses an automatic evaluation method and system for network security level protection compliance, and aims to improve the efficiency and result accuracy of compliance automatic evaluation. The method comprises the following steps: acquiring an original configuration strategy of a tested object, and segmenting the original configuration strategy into atomic configuration entries corresponding to single access authorization behaviors according to access control evaluation indexes; a semantic mark triple is separated out from the atomic configuration entry, and a strategy node hierarchy graph of the mandatory access control strategy is constructed; mapping the triple elements into a graph to generate an initial path mapping table, extracting a strategy effective action range and a coverage relation to complete redundancy elimination, and obtaining an effective path mapping chain; and comparing the strategy path with a standard strategy path node by node to generate a compliance evaluation result. According to the method, standardization and automation of the evaluation process are realized, the evaluation generation efficiency is greatly improved, the accuracy and objectivity of the evaluation result are guaranteed, and the method can adapt to large-scale and cross-environment grade protection compliance evaluation requirements.

The application relates to the technical field of network security level evaluation, and discloses a network security level protection compliance automatic evaluation method and system, which aims to improve the efficiency and result accuracy of compliance automatic evaluation. The method comprises the following steps: obtaining original configuration strategies of a measured object, dividing the original configuration strategies into atomic configuration entries corresponding to single access authorization behaviors according to access control evaluation indexes; extracting semantic label triples from the atomic configuration entries to construct a policy node hierarchical graph of a mandatory access control strategy; mapping the triple elements to the graph to generate an initial path mapping table, extracting a policy effective scope and a covering relationship to complete redundancy elimination, and obtaining an effective path mapping chain; and comparing the effective path mapping chain with a standard policy path node by node to generate a compliance evaluation result. The application realizes the standardization and automation of the evaluation process, greatly improves the evaluation generation efficiency, guarantees the accuracy and objectivity of the evaluation result, and can adapt to large-scale, cross-environment and level protection compliance evaluation requirements.

The invention discloses an online document co-processing method, device, medium and system in a secret-related environment, and belongs to the field of computer application. Comprising the steps of document security level detection based on information semantics, assisted control combining a mandatory access control method MAC and an autonomous access control method DAC, file encryption processing of multi-thread IDEA-ECB, and a mixed auditing chain architecture of zero knowledge proof ZKP, a hash chain and Merkle Tree. According to the method, the confidentiality, the integrity and the traceability of the confidential document in the collaboration process are effectively guaranteed.

The invention discloses an industrial real-time task grading isolation scheduling method and system based on an LXC container, and relates to the technical field of industrial real-time operating systems, and the method comprises the following steps: S1, carrying out NUMA perception resource division on physical hardware, isolating a CPU core according to a task key level, reserving a memory bandwidth channel, and carrying out direct connection control on real-time equipment; and S2, creating a customized LXC runtime environment, constructing a real-time namespace, establishing a security isolation domain through mandatory access control, and optimizing container context switching overhead. According to the industrial real-time task hierarchical isolation scheduling method and system provided by the invention, through an innovative resource division and management mechanism, the efficiency and reliability of industrial real-time task scheduling are remarkably improved, task resources of different key levels are effectively isolated, resource competition is reduced, the real-time response capability of high-priority tasks is ensured, and the scheduling efficiency of the industrial real-time tasks is improved. The resource utilization rate is improved, and the adaptability and stability of the system are enhanced.

The application discloses an access control method and related device, and belongs to the technical field of computers. The access control method is applied to an access control system, and the access control system at least comprises a first subject and a first object. The access control method comprises the following steps: obtaining a first request, wherein the first request comprises a request of the first subject to access the first object; and determining an access permission and an access path of the first subject to access the first object based on the first request. The method supports real-time output of access path information of the subject and the object in mandatory access control, and complete access path information meets real-time requirements of mandatory access control on development and debugging and problem positioning, thereby assisting development and debugging and problem positioning of the mandatory access control, especially development and debugging and problem positioning of an access control system with high integration and complex component dependence, and solving the problem that development and debugging and problem positioning are difficult.

The invention discloses a distributed mandatory access control method and system based on a chained proxy, and the control method comprises the steps: intercepting a security access event of a subject to an object through an LSM proxy module of a Linux kernel of a terminal host, collecting a security context to generate a first security request packet of a unique chained ID, and transmitting the first security request packet to a local proxy process; and the local agent process queries the cached security decision set, directly returns a decision result if the matching is hit, encapsulates a second security request packet and sends the second security request packet to the remote decision server if the matching is not hit, and the remote server generates a final decision and returns and executes the final decision. According to the embodiment provided by the invention, complete decoupling of the mandatory access control decision logic and the operating system kernel can be realized; through the remote decision server supporting cross hosts and cross security domains, the technical limitation that an existing mandatory access control scheme can only realize local decision is effectively broken through, the kernel mode processing overhead is reduced, and the security and availability are improved.

The application discloses a kind of database row level access control method and system supporting security category, belong to database access control technical field, for solving the problems of existing database row level mandatory access control scheme, control dimension single, storage inflation, low performance, insufficient force, cannot simultaneously support the technical problems of security level and security category double-dimension control.The method comprises the following steps: receiving the database operation request of user, and identifying the target data table corresponding to the database operation request;Judge whether the target data table has enabled mandatory access control rule;If mandatory access control rule is enabled, the user security mark of the user is obtained;Wherein, user security mark includes security level and security category set;According to the database operation type corresponding to database operation request, access control filtering and mark assignment are executed on the target data table, and corresponding database operation is executed on the data row after filtering and user has right to access.