22 results about "Mandatory access control" patented technology

The invention discloses a mandatory access control method and device based on a process function context, and the method comprises the steps: collecting a security context associated with a system call initiated by a target process, so as to generate a standardized object description; mapping the object description into a target function classification identifier, so as to obtain a process function context view of the target process according to the target function classification identifier; constructing a target decision key for access decision based on the current policy era, the qualifier, the function classification identifier, the view identifier of the process function context view and the isolation domain abstract; and querying the multi-level cache according to the target decision key to determine a matched target access decision. Therefore, context-sensitive judgment and cross-component consistency taking the functional context as the center are realized.

Methods, systems, and computer-readable media for generating a secured hierarchical document are described herein. A hierarchical document is obtained and is processed to generate a secured hierarchical document. A security label is applied to each node in the hierarchical document. The secured hierarchical document is generated by cryptographically segregating the nodes according to the security label of each node. The secured hierarchical document comprises a plurality of encrypted layers. Each encrypted layer comprises at least a subset nodes associated with a respective security label and encrypted with a respective encryption key. The secured hierarchical document is stored to computer-readable memory. Methods, systems, and computer-readable media for searching a corpus of secured hierarchical documents indexed in an index as sensitive information by a computing entity trusted to have access to the sensitive information in the index are also described herein.

The invention discloses a path mark-based mandatory access control method and system during container operation. The method comprises the following steps of: generating a security mark for a container process and a file; executing dynamic access control, and dynamically starting a security model according to the file marking field; dynamic mark adjustment is implemented, the file access frequency is counted in real time through a kernel layer, and when overrun access is detected, if the process confidentiality level is higher than the lowest level, the confidentiality level is degraded; if the process is the lowest level, the BLP model verification permission of the process is temporarily forbidden; all strategy updating and audit log recording are completed locally, and it is ensured that the operation track is traceable; the system comprises a path marking module, an access control module, a dynamic regulation and control module, a strategy management module and a log auditing module. According to the method, error interception is reduced, millisecond-level real-time blocking of high-frequency abnormal access is realized, and the safety protection capability and the operation and maintenance efficiency of the container platform are remarkably improved.

This application discloses an asynchronous video submission and review method and system. The method includes: storing a video submission rule set; distributing the rule set to user computing devices and caching it locally; when a user accesses a specific activity, performing a multi-stage evaluation based on the locally cached rule set, sequentially performing activity matching checks, time window checks, and quota count checks, and generating a submission permission determination only when all stages pass; selectively presenting or restricting video submission entry points in the activity practice interface based on the determination result; the user calling the device's camera through the submission entry point to instantly capture video recordings and transmits them along with identification data to the storage component, while simultaneously incrementing the submitted count; and administrators asynchronously viewing submitted recordings and providing feedback through the review interface. This achieves client-side mandatory access control based on a multi-dimensional rule set, effectively avoiding the problem of excessive workload for administrators of open submission systems.

The invention particularly relates to a mandatory access control method based on a distributed database. The mandatory access control method based on the distributed database comprises the following steps: creating a security level (Level), a compartment (Compartment) and a security label (label); granting the security label to a subject user through a grant statement, or granting the security label to an object library and a table; in order to ensure the integrity of the data, an up-writing and down-reading mode is selected, that is, a subject user can only write data into an object with a higher security level than the own authority, and meanwhile, the subject user can only read data of an object with a lower security level than the own authority. According to the mandatory access control method based on the distributed database, the system security is enhanced, potential security threats are greatly reduced, the data confidentiality is improved, the risks of sensitive information leakage and permission abuse of internal personnel can be effectively prevented, and unified security management is realized.

The application discloses a dynamic security protection method and system based on behavior workflow and Kalman filtering, and relates to the technical field of network security management and control.The application comprises the following steps: collecting multi-source heterogeneous original logs and performing standardized processing to obtain a standardized event stream; mapping the standardized event stream into an attack stage sequence, constructing and incrementally updating an attack semantic graph, and extracting attack progress observation values; establishing a state space model including attack progress and attack speed based on Kalman filtering, performing attack state estimation and trend prediction, and obtaining attack progress estimation and attack speed estimation; calculating threat urgency, and adjusting a two-way mandatory access control strategy based on the threat urgency classification. A dynamic security protection system capable of realizing real-time perception of attack process evolution, dynamic adjustment of access control strategy, high interpretability and strong adaptability is constructed, and deep coupling of attack semantic understanding, attack state estimation and access control strategy adjustment at the system level is realized.

The invention discloses a pre-boot execution environment mirror image file processing method and device, equipment and a storage medium, and relates to the technical field of computers, which comprises the steps of installing a virtual machine and closing mandatory access control of the virtual machine to avoid the situation that services such as a DHCP (Dynamic Host Configuration Protocol) and a TFTP (Trivial File Transfer Protocol) which are installed subsequently cannot run due to insufficient authority, so that the security of the virtual machine is improved. A DHCP service is installed to ensure that equipment obtains correct network configuration through a DHCP, then subsequent TFTP and HTTP services are accessed, hardware initialization, correct operation system loading and kickstart file generation are achieved by installing a boot loader when the equipment or a to-be-installed terminal is started so that the requirements of a user can be met when the system is installed, a virtual machine is packaged into a mirror image file, and the virtual machine is stored in the mirror image file. The terminal to be installed can be directly used in actual use, a server does not need to be occupied independently, additional setting is not needed, and the cost of remote installation is reduced.

The application discloses a method and device for enforcing access control based on process function context, wherein the method comprises: collecting a security context associated with a system call initiated by a target process to generate a standardized object description; mapping the object description to a target function classification identifier to obtain a process function context view of the target process according to the target function classification identifier; constructing a target decision key for an access decision based on a current policy epoch, a qualifier, a function classification identifier, a view identifier of the process function context view and an isolation domain digest; and querying a multi-level cache according to the target decision key to determine a matching target access decision. Thus, context-sensitive decision based on a function context is realized, and cross-component consistency is achieved.

Methods, systems, and computer-readable media for generating a secured hierarchical document are described herein. A hierarchical document is obtained and is processed to generate a secured hierarchical document. A security label is applied to each node in the hierarchical document. The secured hierarchical document is generated by cryptographically segregating the nodes according to the security label of each node. The secured hierarchical document comprises a plurality of encrypted layers. Each encrypted layer comprises at least a subset nodes associated with a respective security label and encrypted with a respective encryption key. The secured hierarchical document is stored to computer-readable memory. Methods, systems, and computer-readable media for searching a corpus of secured hierarchical documents indexed in an index as sensitive information by a computing entity trusted to have access to the sensitive information in the index are also described.

This invention relates to the field of computer technology and discloses a method for secure management of hidden sectors, a hidden sector file system, a device, and a medium. The method, used in a hidden sector file system, includes: receiving a target user's request for a target operation on the hidden sector; verifying the target user's permissions, or permissions and password, according to a preset security policy in the security layer; the preset security policy in the security layer is mapped based on the mandatory access control policy of the security layer; and executing the target operation request when the verification passes. The technical solution of this invention uses a customized file system formatted with hidden sectors, employs an operation interface independent of ordinary file systems, and incorporates a security layer permission verification mechanism, providing an additional specific storage option compared to ordinary file systems and user permission mechanisms. This effectively prevents network attacks on user systems and effectively prevents internal privilege escalation attacks that compromise data security of critical information within the system through the file system.

The invention provides a strategy file generation method and device, a storage medium and an electronic device, and the method comprises the steps: constructing a sample strategy material; performing data cleaning on the sample strategy material to obtain training sample data; carrying out transfer learning on the open source model by adopting the training sample data to obtain an initial strategy generation model; performing reinforcement learning on the initial strategy generation model to obtain a target strategy generation model; software research and development materials of the target vehicle type are obtained, the software research and development materials are input into the target strategy generation model, a mandatory access control (MAC) strategy file of the target vehicle type is generated, the MAC strategy file comprises the mapping relation between the multiple sets of resource objects and the operation authority, and the software research and development materials comprise software codes and environment information of the software codes. Through the embodiment of the invention, the technical problem of low efficiency of editing the MAC strategy file in the prior art is solved, and the compilation difficulty of the mandatory access mode strategy is reduced.

The application provides a strategy file generation method and device, a storage medium and an electronic device, and the method comprises the following steps: constructing a sample strategy material; performing data cleaning on the sample strategy material to obtain training sample data; performing transfer learning on an open source model by using the training sample data to obtain an initial strategy generation model; performing reinforcement learning on the initial strategy generation model to obtain a target strategy generation model; obtaining software research and development materials of a target vehicle model, inputting the software research and development materials into the target strategy generation model, and generating a mandatory access control (MAC) strategy file of the target vehicle model, wherein the MAC strategy file comprises a mapping relationship between a plurality of groups of resource objects and operation permissions, and the software research and development materials comprise software code and environment information of the software code. Through the embodiment, the technical problem of low efficiency of editing a MAC strategy file in the prior art is solved, and the difficulty of mandatory access mode policy writing is reduced.

The invention relates to the technical field of network security level evaluation, discloses an automatic evaluation method and system for network security level protection compliance, and aims to improve the efficiency and result accuracy of compliance automatic evaluation. The method comprises the following steps: acquiring an original configuration strategy of a tested object, and segmenting the original configuration strategy into atomic configuration entries corresponding to single access authorization behaviors according to access control evaluation indexes; a semantic mark triple is separated out from the atomic configuration entry, and a strategy node hierarchy graph of the mandatory access control strategy is constructed; mapping the triple elements into a graph to generate an initial path mapping table, extracting a strategy effective action range and a coverage relation to complete redundancy elimination, and obtaining an effective path mapping chain; and comparing the strategy path with a standard strategy path node by node to generate a compliance evaluation result. According to the method, standardization and automation of the evaluation process are realized, the evaluation generation efficiency is greatly improved, the accuracy and objectivity of the evaluation result are guaranteed, and the method can adapt to large-scale and cross-environment grade protection compliance evaluation requirements.

The application relates to the technical field of network security level evaluation, and discloses a network security level protection compliance automatic evaluation method and system, which aims to improve the efficiency and result accuracy of compliance automatic evaluation. The method comprises the following steps: obtaining original configuration strategies of a measured object, dividing the original configuration strategies into atomic configuration entries corresponding to single access authorization behaviors according to access control evaluation indexes; extracting semantic label triples from the atomic configuration entries to construct a policy node hierarchical graph of a mandatory access control strategy; mapping the triple elements to the graph to generate an initial path mapping table, extracting a policy effective scope and a covering relationship to complete redundancy elimination, and obtaining an effective path mapping chain; and comparing the effective path mapping chain with a standard policy path node by node to generate a compliance evaluation result. The application realizes the standardization and automation of the evaluation process, greatly improves the evaluation generation efficiency, guarantees the accuracy and objectivity of the evaluation result, and can adapt to large-scale, cross-environment and level protection compliance evaluation requirements.

The invention discloses an online document co-processing method, device, medium and system in a secret-related environment, and belongs to the field of computer application. Comprising the steps of document security level detection based on information semantics, assisted control combining a mandatory access control method MAC and an autonomous access control method DAC, file encryption processing of multi-thread IDEA-ECB, and a mixed auditing chain architecture of zero knowledge proof ZKP, a hash chain and Merkle Tree. According to the method, the confidentiality, the integrity and the traceability of the confidential document in the collaboration process are effectively guaranteed.

The application discloses a method for quick matching of file paths, which comprises the following steps: setting mandatory access control, marking the security attributes of users and files; creating a state machine dictionary tree by using an AC algorithm, dividing a one-dimensional array into a two-dimensional sparse matrix type array, and including multiple continuous state nodes in each state machine node dictionary, and dividing each state node into multiple block pointer arrays; when it is found that all state items in a certain block pointer array are NULL, setting the pointer corresponding to the block pointer array as NULL, and directly exiting the AC algorithm when a node with NULL state is encountered; after the AC automatic machine scans the file path, determining whether the current file is an object configuration item in the mandatory access control according to the confidentiality level of the file path. The AC algorithm is optimized, a part of data is scanned only, and the object configuration item of the mandatory access control can be accurately found, so that the purpose of being loaded into the kernel context and stably and quickly running can be achieved.

The invention discloses an industrial real-time task grading isolation scheduling method and system based on an LXC container, and relates to the technical field of industrial real-time operating systems, and the method comprises the following steps: S1, carrying out NUMA perception resource division on physical hardware, isolating a CPU core according to a task key level, reserving a memory bandwidth channel, and carrying out direct connection control on real-time equipment; and S2, creating a customized LXC runtime environment, constructing a real-time namespace, establishing a security isolation domain through mandatory access control, and optimizing container context switching overhead. According to the industrial real-time task hierarchical isolation scheduling method and system provided by the invention, through an innovative resource division and management mechanism, the efficiency and reliability of industrial real-time task scheduling are remarkably improved, task resources of different key levels are effectively isolated, resource competition is reduced, the real-time response capability of high-priority tasks is ensured, and the scheduling efficiency of the industrial real-time tasks is improved. The resource utilization rate is improved, and the adaptability and stability of the system are enhanced.

The application discloses an access control method and related device, and belongs to the technical field of computers. The access control method is applied to an access control system, and the access control system at least comprises a first subject and a first object. The access control method comprises the following steps: obtaining a first request, wherein the first request comprises a request of the first subject to access the first object; and determining an access permission and an access path of the first subject to access the first object based on the first request. The method supports real-time output of access path information of the subject and the object in mandatory access control, and complete access path information meets real-time requirements of mandatory access control on development and debugging and problem positioning, thereby assisting development and debugging and problem positioning of the mandatory access control, especially development and debugging and problem positioning of an access control system with high integration and complex component dependence, and solving the problem that development and debugging and problem positioning are difficult.

The invention discloses a distributed mandatory access control method and system based on a chained proxy, and the control method comprises the steps: intercepting a security access event of a subject to an object through an LSM proxy module of a Linux kernel of a terminal host, collecting a security context to generate a first security request packet of a unique chained ID, and transmitting the first security request packet to a local proxy process; and the local agent process queries the cached security decision set, directly returns a decision result if the matching is hit, encapsulates a second security request packet and sends the second security request packet to the remote decision server if the matching is not hit, and the remote server generates a final decision and returns and executes the final decision. According to the embodiment provided by the invention, complete decoupling of the mandatory access control decision logic and the operating system kernel can be realized; through the remote decision server supporting cross hosts and cross security domains, the technical limitation that an existing mandatory access control scheme can only realize local decision is effectively broken through, the kernel mode processing overhead is reduced, and the security and availability are improved.

This invention provides a method and system for intelligently generating and checking mandatory access control policies. It intelligently generates mandatory access control policies based on blocking attack paths, analyzes system vulnerabilities, takes the corresponding attack paths as input, and outputs mandatory access control policies that block these attack paths. Alternatively, it checks the security of manually written policies based on a security model, inputting manually written policies into the system, analyzing the policies according to the security model, and outputting policies that violate the security model. This improves the efficiency and effectiveness of writing mandatory access control policies. By intelligently generating mandatory access control policies that effectively protect the system, it avoids developers from writing policies that violate access control principles due to insufficient knowledge or experience.

The application discloses a kind of database row level access control method and system supporting security category, belong to database access control technical field, for solving the problems of existing database row level mandatory access control scheme, control dimension single, storage inflation, low performance, insufficient force, cannot simultaneously support the technical problems of security level and security category double-dimension control.The method comprises the following steps: receiving the database operation request of user, and identifying the target data table corresponding to the database operation request;Judge whether the target data table has enabled mandatory access control rule;If mandatory access control rule is enabled, the user security mark of the user is obtained;Wherein, user security mark includes security level and security category set;According to the database operation type corresponding to database operation request, access control filtering and mark assignment are executed on the target data table, and corresponding database operation is executed on the data row after filtering and user has right to access.