49 results about "Operating system security" patented technology

The invention provides an automatic vulnerability identification and repair method for an intelligent universal domestic operating system, and belongs to the field of operating system security technology and artificial intelligence. EBPF (extended Burkley data packet filter), TEE (trusted execution environment) and bidirectional GNN-lite (simplified graph neural network) technologies are utilized to automatically identify and repair vulnerabilities of the operating system; an efficient, AI intelligent and safe vulnerability real-time identification and dynamic repair system is constructed, a closed loop of real-time monitoring, credible analysis, automatic patching and effect evaluation is established, and kernel defects are efficiently repaired on the premise of not interrupting services.

The invention belongs to the technical field of multi-modal learning, and discloses an operating system security evaluation system and method based on multi-modal learning and deep learning technology, the system uses the multi-modal learning technology, integrates vulnerability description, code structure and runtime data, extracts cross-modal features through a deep learning model, and constructs a unified evaluation framework. The system firstly collects vulnerability data from databases such as CVE, NVD and the like, and forms multi-dimensional input in combination with a calling path generated by static analysis and a running log of dynamic test. Secondly, predicting the availability and risk degree of the vulnerabilities through a multi-modal fusion network, and generating a comprehensive risk score; and finally, outputting a visual report by the system, and clearly displaying risk distribution and priority. Potential and actual security threats of the operating system are comprehensively evaluated, and the accuracy and reliability of evaluation are improved.

The invention relates to an industrial Internet operating system security risk prediction method based on a knowledge graph, and the method comprises the steps: collecting the security risk data of an industrial Internet operating system, and carrying out the preprocessing of the data; based on the preprocessed security risk data, constructing a security risk knowledge graph of the industrial internet operating system; constructing and training an industrial internet security risk prediction model based on the knowledge graph; and predicting real-time data of an industrial internet operating system by using the trained industrial internet security risk prediction model based on the knowledge graph, judging whether the system has a risk of occurrence of a security event, and generating a security risk prediction report according to a prediction result. Compared with the prior art, the method has the advantages that multi-source heterogeneous data such as equipment, users, application programs, vulnerabilities and security event response strategies are integrated, complex relations of the multi-source heterogeneous data are fully mined, and the security situation of the system can be more comprehensively and deeply grasped.

The invention discloses an operating system security control method and system, and the method comprises the steps: capturing all host behaviors in real time in an operating system kernel layer, carrying out the analysis and learning, and constructing a host behavior model through employing the analysis and learning result of the host behaviors; if a program is started or operated at the current moment, capturing a corresponding host behavior at a kernel layer of an operating system, verifying the host behavior at the current moment by using a host behavior model, if the verification is passed, allowing the host behavior at the current moment, and if the verification is not passed, stopping the host behavior at the current moment so as to realize mandatory access control on the host behavior; and if the blocked host behavior meets the preset judgment condition, updating the host behavior model by using the blocked host behavior. According to the method, the host behavior model is used as the security baseline of the host system, zero-trust mandatory access control is performed on all host behaviors in the kernel layer of the operating system, a zero-trust security kernel of the operating system is formed, and all-around protection is provided for the security of the host system.

Techniques are disclosed relating to improving key management on devices. In various embodiments, a device receives, from a browser via a key-management API supported by the device, a request for a browser session to receive access to a cryptographic key managed by the device. The key-management API of the device determines whether to grant the browser session access to the cryptographic key based on verification of a signed attestation from a server corresponding to the browser session and using metadata stored about the cryptographic key. Based on the determination, the device provides access to the cryptographic key via the key-management API. In some embodiments, providing access to the cryptographic key includes performing a requested cryptographic operation using the cryptographic key and without providing the cryptographic key to the browser. In some embodiments, the cryptographic key is managed by an operating system, a secure element, or another application of the device.

The invention provides a security policy recommendation method and device, electronic equipment and a storage medium, and belongs to the technical field of operating system security, and the method comprises the following steps: obtaining context sensing information of SELinux; constructing a subject domain feature matrix and an object type feature matrix based on the context sensing information; the subject domain feature matrix comprises permission similarity between any two subjects, and the object type feature matrix comprises permission similarity between any two objects; clustering subjects with similar permissions according to the subject domain feature matrix to obtain a first recommendation rule; clustering objects with similar permissions according to the object type feature matrix to obtain a second recommendation rule; and intersecting the first recommendation rule with the second recommendation rule to obtain a recommended security policy. According to the method, the SELinux security policy can be effectively recommended based on the context-aware information, and the method is suitable for a new type without policy rules.

The invention discloses a symbolic link file anti-deletion method and device, equipment and a storage medium, and relates to the technical field of operating system security. The method comprises the steps that when a kernel layer detects a deletion operation for a first symbolic link file, the first symbolic link file is deleted according to file path information of the first symbolic link file; judging whether a second symbolic link file matched with the first symbolic link file is found in an anti-deletion rule set or not; and when the second symbol link file is found, executing a forced interception operation aiming at the first symbol link file, and when the second symbol link file is not found, executing a deletion processing operation aiming at the first symbol link file. According to the method and the device, dynamic, real-time and efficient protection of the key symbolic link file is realized, the key symbolic link file cannot be deleted even by an administrator user with root authority, the key symbolic link file is effectively prevented from being accidentally or maliciously deleted, and the stability and the safety of a Linux operating system are improved.

The invention relates to an attack-fault tree-based operating system security evaluation method, which comprises the following steps of: aiming at an attack-fault tree-based operating system, evaluating an attack surface exposure risk result of an exposure element in a simulated attack scene; based on an attack surface exposure risk result, performing adaptive adjustment on a security evaluation algorithm and algorithm parameters of an operation system defense mechanism; based on the self-adaptively adjusted security evaluation algorithm and algorithm parameters, evaluating a defense mechanism of the operating system to obtain a defense mechanism evaluation result; based on matrix operation, quantifying the comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on the overall security state of the operating system to obtain a preliminary comprehensive risk value; and obtaining real-time operation data of the operating system, correcting the preliminary comprehensive risk value, and generating a comprehensive security assessment result of the operating system. According to the invention, the mutual influence of multiple aspects is comprehensively considered, so that the final comprehensive safety assessment result is more accurate.

The present application relates to a method for verifying the trust level of a system program based on an edge Internet of Things proxy device, including the following specific steps: Considering the characteristic that the one-time programmable memory eFuse can only be programmed once, the hash value of the secure root key SRK based on the eFuse characteristic is burned in and used as the root of trust; Starting from the boot of the operating system, multi-level verification is carried out until the trust level verification program for boot-up is completed to ensure the security of the boot of the operating system. Based on the premise of being granted credit by the "trust level verification program", the present application verifies the trust levels of the system's built-in application programs and newly added application programs later, eliminating the risk that the traditional "whitelist" protection mechanism loses its protection effectiveness due to the uncontrollability of the secure boot of the operating system, and fundamentally solving the trust problem of the programs running within the system.

The invention relates to the technical field of safe starting of operating systems, in particular to a system signature mirror image file generation method and an equipment safe starting method. An equipment development end signs mirror image data of an operating system of equipment to obtain a digital signature of the mirror image data, the equipment development end sets identification information of the mirror image data, and the identification information is used for representing the memory position of the mirror image data in the operating system to obtain a system signature mirror image file. Namely, the system signature mirror image file of the mirror image data is generated by using the digital signature and the identification information. And finally, the equipment development end stores the system signature mirror image file on an equipment disk. When the device is started, namely the operating system of the device is started, the digital signature is directly positioned based on the identification information, and the safety of the operating system is verified by verifying the digital signature. As the identification information occupies a small memory space, the situation that the system signature mirror image file occupies the whole disk where the operating system is located due to the increase of the identification information is avoided, that is, the size of the system signature mirror image file is reduced, and the time cost required for upgrading the operating system is saved.

The invention provides an operating system security verification method, device and system and related equipment, and the method comprises the steps: executing an initial boot block code, and reading first mirror image data of a basic input / output system mirror image from a serial peripheral interface flash memory; performing first security verification on the first mirror image data, executing the basic input / output system mirror image under the condition that the first security verification result is passed, and reading second mirror image data of the boot loader mirror image; performing second security verification on the second mirror image data, executing the boot loader mirror image under the condition that the second security verification result is passed, and reading third mirror image data of the operating system kernel mirror image from the main storage device; and performing third security verification on the third mirroring data, and executing the operating system kernel mirroring under the condition that the third security verification result is that the third mirroring data passes the third security verification.

The invention discloses a process permission configuration method and device based on multi-domain transfer, equipment and a medium, and relates to the technical field of operating systems, the process permission configuration method comprises the following steps: creating a target process associated with a target operation request sent by a target management user side, placing the target process in a preset initial domain, and taking the initial domain as a current domain of the target process; and performing security verification on the current domain, if a verification result represents that the current domain is safe, judging whether a preset domain transfer termination condition is met currently, if not, determining a target transfer path according to a domain transfer strategy, and transferring the current domain corresponding to the target process to the next domain according to the target transfer path. Taking the next domain as a new current domain and skipping to the step of carrying out security verification on the current domain, and if yes, taking the current domain corresponding to the target process as a final domain; and according to the final domain, granting a target permission required for executing the request to the target process, so that the target process executes a target operation by using the target permission. The security of the operating system is improved.

The invention discloses a duplex stacked operating system security mechanism. The mechanism comprises the following steps: S1, system resource classification configuration: carrying out system resource classification and integrity grade division on system resources; carrying out credibility marking and forming a protection configuration table; s2, marking management: carrying out integrity marking on the system resources; s3, forming a mapping relation between the integrity mark and the integrity level; issuing the mapping relation from the user space to the kernel space; issuing the credibility mark and the protection configuration table from the user space to the kernel space; s4, when the software runs, judging whether the software is system software or not; if yes, trusted measurement is carried out, and the step S5 is carried out after success; if the measurement is not successful, directly ending; if the software is not the system software, directly entering the step S5; and S5, carrying out integrity verification on the software, if the verification is successful, allowing the software to access, and if the verification is not successful, directly ending.

The present application discloses a kernel architecture based on the PKS system, including: the user area in the dual-architecture processor is used to call the operating system security module LSM to provide functions for security software to hook the sub to uniformly manage software hooking, and to allocate operating resources for the hooked security software; the security area in the dual-architecture processor is used to call the TEE module to perform security verification and signature on the code loaded into the kernel when a resource access request is obtained, and if the verification and signature pass, the code loaded into the kernel is run; among them, the permission of the security area is higher than that of the user area; the UEFI module is used to perform trusted measurement on the UEFI firmware and the operating system through interaction with the TEE module to achieve trusted boot. The kernel architecture of the present application can obtain the computing space state in real time for protection, avoiding the few security space functions and weak performance caused by the dual-architecture with external security.

The invention discloses an information processing system and method based on security cloud. Comprising a cloud management end and at least one special hardware end, the cloud management end is in communication connection with each special hardware end; the special hardware end is configured on track hardware equipment, the special hardware end is configured with a secure cloud operating system, the secure cloud operating system is configured with at least one virtual environment, and the virtual environment is configured with a track traffic application; the cloud management end is used for configuring the special hardware end; and the special hardware end is used for acquiring the communication signal of the rail transit equipment in the rail area received by the rail transit application, determining the control information of the rail transit equipment according to the communication signal, and feeding back the control information to the rail transit equipment. According to the embodiment of the invention, the rail transit information processing efficiency can be improved.

The present invention belongs to the field of mobile Internet security technology, and particularly relates to a mobile Internet operating system third-party application risk analysis method and system for static and dynamic evaluation and detection of malicious applications, comprising: for dangerous permission risk sources and sensitive API function risk sources, using dangerous permissions and sensitive API functions to quantitatively evaluate the risk of privacy leakage of third-party applications; based on the quantitative evaluation results, using the function call graph structure features that characterize the calling relationship between functions and the multi-hop function node topology information to identify and distinguish the third-party application categories; by extracting the state transition relationship between the third-party application system calls, based on the system call sequence fingerprint features and using a convolutional neural network to identify and distinguish the third-party application categories. The present invention supplements the Android operating system security mechanism through the combination and complementarity of dynamic and static analysis detection, improves the accuracy of Android malicious application detection, and provides technical support for creating a good Android software ecological environment.

This invention discloses a method for controlling a video transcoding device and a transcoding method. This invention divides read and write commands into Level Analyzers (LBAs), assigning different LBAs to represent different transcoding commands. This allows for the implementation of different transcoding commands through I / O read / write commands, thereby enabling communication between the operating system and the video transcoding device without being limited by the operating system and without requiring administrator privileges. This ensures video transcoding compatibility while maintaining operating system security. In other words, this invention guarantees the compatibility of the video transcoding device on any operating system and addresses permission management issues, and also provides excellent support for virtual machines and containers without requiring additional permission settings.

The invention relates to the field of security prevention and control and the field of information security, can be applied to the field of financial science and technology, and provides a security authentication method and device compatible with multiple operating systems, and the method comprises the steps: receiving network access authentication messages sent by different operating system terminals; analyzing the network access authentication message sent by each operating system terminal, and converting the network access authentication message into a unified authentication message; performing identity authentication and authority authentication according to the unified authentication message; grouping the terminals passing the identity and authority authentication; and controlling the network access of the terminal according to the fire wall of the group to which the terminal belongs and the security policy. According to the invention, unified management of security authentication of multiple operating systems can be realized, timeliness and accuracy of network access are ensured, and security authentication management difficulty of different operating systems is reduced. Through grouping network access control of the users, personalized control of network access of the users can be realized, rationality of network access control is increased, and the problem of information leakage or resource consumption of network access control is avoided.

1. Name of the designed product: packing box (YunLan operating system security defense software). 2. Use of the designed product: for packing products. 3. Design points of the designed product: combination of shape and pattern. 4. Picture or photo best indicating the design points: perspective view.

An information handling system includes an embedded controller and a memory device storing code that when executed causes the embedded controller to perform operations that includes receiving a request to change a security setting, determining a security policy associated with the security setting, and determining whether the change to the security setting deviates from the security policy. In addition, the embedded controller in response to determining that the change to the security setting deviates from the security policy, denying the request and reverting the change to the security setting.

This disclosure relates to, among other things, electronic device security systems and methods. Certain embodiments disclosed herein provide for protection of cryptographic keys and / or associated operations using both an operating system security service and a software-based whitebox cryptographic security service executing on a device. Leveraging operating system security services and software-based whitebox cryptographic security services may provide enhanced security when compared to using either service alone to protect cryptographic keys and associated operations. In additional embodiments, server-side cryptographic security solutions may be further used to enhance device security implementations.

This invention discloses a secure encryption method for the operating system kernel based on the AES algorithm, relating to the fields of operating system security and data encryption technology. The method comprises the following steps: S1, traversing and scanning the data in the operating system kernel, identifying sensitive data, and classifying it according to its sensitivity level; S2, generating an encryption master key and hierarchical subkeys based on the AES algorithm; S3, encrypting data of different sensitivity levels using AES encryption algorithms with different rounds and encryption modes; S4, dynamically updating the key and encrypting and storing the updated key in the kernel secure storage area; S5, adding a checksum to the encrypted sensitive data and verifying data integrity; S6, reading the corresponding key and decrypting the data to complete data access. This invention significantly improves key security and data integrity, effectively balances encryption efficiency and system performance, has strong adaptability and high practicality, and is easy to promote and apply.

The invention relates to the technical field of mobile power supply monitoring and data communication, in particular to a cross-platform mobile power supply data interaction and state monitoring system and method, and aims to solve the problems of unreliability, high delay and poor compatibility of cross-platform communication caused by limitation of a safety mechanism of an operating system in the prior art. According to the system, a triple redundancy communication architecture which is based on a standard MIDI protocol and fuses an MTP protocol and gamepad equipment simulation is constructed, sensor data is embedded into an MIDI SysEx message through a displacement coding algorithm, and millisecond-level safety warning is achieved through a kernel-level audio path; and meanwhile, dynamic switching of communication protocols is supported, and drive-free, low-delay and high-reliability data interaction and active safety intervention of the whole platform are ensured.

The invention relates to a program running method and device, computer equipment and a readable storage medium. The method comprises the steps that signature information corresponding to a target application program is obtained, wherein the target application program is obtained by conducting signature processing on code sections contained in an initial application program according to a preset encryption algorithm; loading the signature information and the target application program to a kernel mode, and verifying the target application program in the kernel mode based on a preset configuration file and a signature verification mechanism corresponding to a preset encryption algorithm to obtain a target verification result; and determining an operation control result of the target application program based on the target verification result. By adopting the method, the safety of the operating system can be improved.

The invention relates to the field of operating system security, and particularly provides a device for defending ROP and ROP variant category attacks in a Linux system, which comprises a reference value generation module, a side hanging monitoring module and a detection defense module, the reference value generation module is used for obtaining and storing a measurement reference value from a target program executable file; the side-hung monitoring module is used for creating a side-hung monitoring process, monitoring execution of a target process, and obtaining an execution path of an execution stream feature instruction and execution times of the execution stream feature instruction; and the detection defense module is used for comparing the measurement reference value with the execution path of the execution stream feature instruction and the execution times of the execution stream feature instruction, and judging whether attack of the ROP or a variant category thereof occurs or not. According to the technical scheme, the safety and the stability of the system are protected.

The invention discloses an operating system emergency response method and device, and relates to the technical field of computers.The operating system emergency response method comprises the steps that a level integrated operating system tool is called to collect key data, and a first batch of classified key data information is obtained; a built-in tool of the operating system collects key data to obtain a second batch of classified key data information; calculating the difference between the two batches of classified key data information to obtain second-level suspicious key data information; collecting key data information in a safe state of the operating system as a preset condition; data information which does not meet a preset condition in the first batch of classified key data information is used as first-level suspicious key data information; the intersection of the first-level suspicious key data information and the second-level suspicious key data information is used as intrusion data information; and restoring normal use of the operating system tool. The problem that the tool is tampered is avoided by using the call-level integrated operating system tool, the problems of false alarm and missing alarm are reduced by using the preset condition, and the accuracy and efficiency of emergency response of the operating system are improved.

The application discloses a Linux distribution operating system security vulnerability automatic repairing method and relates to the technical field of system security, which comprises a CVE database used for recording all historical CVE information related to a distribution product platform, a distribution product software SBOM database used for recording the basic information of all components of a single distribution system and forming component information, a product-component-CVE repairing state recording database used for recording the affected state and repairing state information of a single component about a specific CVE, a CVE crawler module used for grabbing CVE vulnerability disclosure information from domestic and foreign CVE vulnerability disclosure platforms, an automatic investigation module used for performing automatic investigation work, and an automatic repairing module used for implementing automatic repairing on components with CVE vulnerabilities and performing compiling, installation testing and automatic testing on the repaired code.

The invention relates to a security reinforcement method and system for an operating system of a credential mobile terminal, and relates to the field of information security. Generating dynamic two-dimensional code image information when the insection information is preset standard insection information; analyzing the dynamic two-dimensional code image information to obtain a dynamic analysis format; after the dynamic two-dimensional code image information is collected, a U disk overturning operation is executed to obtain dynamic digital sequence image information; determining a target digital sequence based on the dynamic digital sequence image information; analyzing the target digital sequence based on the dynamic analysis format to determine a target password; executing a password output operation based on the target password; determining an authority code after the password output operation; and outputting corresponding information according to the permission code. According to the invention, through the generation and analysis of the dynamic two-dimensional code image information and the verification of the insection information, the uniqueness and accuracy of identity authentication are ensured.

The invention discloses a semantic continuity guarantee method and device, a terminal and a storage medium, and the method comprises the steps: carrying out the structural representation of a natural language demand, and determining the structural demand information; converting the structured demand information into a formalized protocol in a linear tense logic form; performing semantic representation and semantic alignment on the formalized protocol according to the first image data, and determining aligned semantic representation; decoding the aligned semantic representation, and determining executable data; determining a target mode according to the available CPU resources of the system and the edge equipment information, performing runtime guarantee based on the target mode and the executable data, and determining a runtime guarantee result; and generating a device control instruction based on the runtime guarantee result through the operating system security center. Therefore, the problems that the existing method in the prior art cannot fundamentally solve the problem of lack of full-link semantic continuity and is difficult to meet the high-reliability operation requirement of the safety key AI system in a dynamic environment can be effectively solved.