34 results about "Operating system security" patented technology

The invention provides an automatic vulnerability identification and repair method for an intelligent universal domestic operating system, and belongs to the field of operating system security technology and artificial intelligence. EBPF (extended Burkley data packet filter), TEE (trusted execution environment) and bidirectional GNN-lite (simplified graph neural network) technologies are utilized to automatically identify and repair vulnerabilities of the operating system; an efficient, AI intelligent and safe vulnerability real-time identification and dynamic repair system is constructed, a closed loop of real-time monitoring, credible analysis, automatic patching and effect evaluation is established, and kernel defects are efficiently repaired on the premise of not interrupting services.

The invention provides a security policy recommendation method and device, electronic equipment and a storage medium, and belongs to the technical field of operating system security, and the method comprises the following steps: obtaining context sensing information of SELinux; constructing a subject domain feature matrix and an object type feature matrix based on the context sensing information; the subject domain feature matrix comprises permission similarity between any two subjects, and the object type feature matrix comprises permission similarity between any two objects; clustering subjects with similar permissions according to the subject domain feature matrix to obtain a first recommendation rule; clustering objects with similar permissions according to the object type feature matrix to obtain a second recommendation rule; and intersecting the first recommendation rule with the second recommendation rule to obtain a recommended security policy. According to the method, the SELinux security policy can be effectively recommended based on the context-aware information, and the method is suitable for a new type without policy rules.

The invention discloses a symbolic link file anti-deletion method and device, equipment and a storage medium, and relates to the technical field of operating system security. The method comprises the steps that when a kernel layer detects a deletion operation for a first symbolic link file, the first symbolic link file is deleted according to file path information of the first symbolic link file; judging whether a second symbolic link file matched with the first symbolic link file is found in an anti-deletion rule set or not; and when the second symbol link file is found, executing a forced interception operation aiming at the first symbol link file, and when the second symbol link file is not found, executing a deletion processing operation aiming at the first symbol link file. According to the method and the device, dynamic, real-time and efficient protection of the key symbolic link file is realized, the key symbolic link file cannot be deleted even by an administrator user with root authority, the key symbolic link file is effectively prevented from being accidentally or maliciously deleted, and the stability and the safety of a Linux operating system are improved.

The invention relates to an attack-fault tree-based operating system security evaluation method, which comprises the following steps of: aiming at an attack-fault tree-based operating system, evaluating an attack surface exposure risk result of an exposure element in a simulated attack scene; based on an attack surface exposure risk result, performing adaptive adjustment on a security evaluation algorithm and algorithm parameters of an operation system defense mechanism; based on the self-adaptively adjusted security evaluation algorithm and algorithm parameters, evaluating a defense mechanism of the operating system to obtain a defense mechanism evaluation result; based on matrix operation, quantifying the comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on the overall security state of the operating system to obtain a preliminary comprehensive risk value; and obtaining real-time operation data of the operating system, correcting the preliminary comprehensive risk value, and generating a comprehensive security assessment result of the operating system. According to the invention, the mutual influence of multiple aspects is comprehensively considered, so that the final comprehensive safety assessment result is more accurate.

The invention relates to the technical field of safe starting of operating systems, in particular to a system signature mirror image file generation method and an equipment safe starting method. An equipment development end signs mirror image data of an operating system of equipment to obtain a digital signature of the mirror image data, the equipment development end sets identification information of the mirror image data, and the identification information is used for representing the memory position of the mirror image data in the operating system to obtain a system signature mirror image file. Namely, the system signature mirror image file of the mirror image data is generated by using the digital signature and the identification information. And finally, the equipment development end stores the system signature mirror image file on an equipment disk. When the device is started, namely the operating system of the device is started, the digital signature is directly positioned based on the identification information, and the safety of the operating system is verified by verifying the digital signature. As the identification information occupies a small memory space, the situation that the system signature mirror image file occupies the whole disk where the operating system is located due to the increase of the identification information is avoided, that is, the size of the system signature mirror image file is reduced, and the time cost required for upgrading the operating system is saved.

The invention discloses a process permission configuration method and device based on multi-domain transfer, equipment and a medium, and relates to the technical field of operating systems, the process permission configuration method comprises the following steps: creating a target process associated with a target operation request sent by a target management user side, placing the target process in a preset initial domain, and taking the initial domain as a current domain of the target process; and performing security verification on the current domain, if a verification result represents that the current domain is safe, judging whether a preset domain transfer termination condition is met currently, if not, determining a target transfer path according to a domain transfer strategy, and transferring the current domain corresponding to the target process to the next domain according to the target transfer path. Taking the next domain as a new current domain and skipping to the step of carrying out security verification on the current domain, and if yes, taking the current domain corresponding to the target process as a final domain; and according to the final domain, granting a target permission required for executing the request to the target process, so that the target process executes a target operation by using the target permission. The security of the operating system is improved.

The present invention belongs to the field of mobile Internet security technology, and particularly relates to a mobile Internet operating system third-party application risk analysis method and system for static and dynamic evaluation and detection of malicious applications, comprising: for dangerous permission risk sources and sensitive API function risk sources, using dangerous permissions and sensitive API functions to quantitatively evaluate the risk of privacy leakage of third-party applications; based on the quantitative evaluation results, using the function call graph structure features that characterize the calling relationship between functions and the multi-hop function node topology information to identify and distinguish the third-party application categories; by extracting the state transition relationship between the third-party application system calls, based on the system call sequence fingerprint features and using a convolutional neural network to identify and distinguish the third-party application categories. The present invention supplements the Android operating system security mechanism through the combination and complementarity of dynamic and static analysis detection, improves the accuracy of Android malicious application detection, and provides technical support for creating a good Android software ecological environment.

This invention discloses a method for controlling a video transcoding device and a transcoding method. This invention divides read and write commands into Level Analyzers (LBAs), assigning different LBAs to represent different transcoding commands. This allows for the implementation of different transcoding commands through I / O read / write commands, thereby enabling communication between the operating system and the video transcoding device without being limited by the operating system and without requiring administrator privileges. This ensures video transcoding compatibility while maintaining operating system security. In other words, this invention guarantees the compatibility of the video transcoding device on any operating system and addresses permission management issues, and also provides excellent support for virtual machines and containers without requiring additional permission settings.

1. Name of the designed product: packing box (YunLan operating system security defense software). 2. Use of the designed product: for packing products. 3. Design points of the designed product: combination of shape and pattern. 4. Picture or photo best indicating the design points: perspective view.

This invention discloses a secure encryption method for the operating system kernel based on the AES algorithm, relating to the fields of operating system security and data encryption technology. The method comprises the following steps: S1, traversing and scanning the data in the operating system kernel, identifying sensitive data, and classifying it according to its sensitivity level; S2, generating an encryption master key and hierarchical subkeys based on the AES algorithm; S3, encrypting data of different sensitivity levels using AES encryption algorithms with different rounds and encryption modes; S4, dynamically updating the key and encrypting and storing the updated key in the kernel secure storage area; S5, adding a checksum to the encrypted sensitive data and verifying data integrity; S6, reading the corresponding key and decrypting the data to complete data access. This invention significantly improves key security and data integrity, effectively balances encryption efficiency and system performance, has strong adaptability and high practicality, and is easy to promote and apply.

The invention relates to the technical field of mobile power supply monitoring and data communication, in particular to a cross-platform mobile power supply data interaction and state monitoring system and method, and aims to solve the problems of unreliability, high delay and poor compatibility of cross-platform communication caused by limitation of a safety mechanism of an operating system in the prior art. According to the system, a triple redundancy communication architecture which is based on a standard MIDI protocol and fuses an MTP protocol and gamepad equipment simulation is constructed, sensor data is embedded into an MIDI SysEx message through a displacement coding algorithm, and millisecond-level safety warning is achieved through a kernel-level audio path; and meanwhile, dynamic switching of communication protocols is supported, and drive-free, low-delay and high-reliability data interaction and active safety intervention of the whole platform are ensured.

The invention relates to a program running method and device, computer equipment and a readable storage medium. The method comprises the steps that signature information corresponding to a target application program is obtained, wherein the target application program is obtained by conducting signature processing on code sections contained in an initial application program according to a preset encryption algorithm; loading the signature information and the target application program to a kernel mode, and verifying the target application program in the kernel mode based on a preset configuration file and a signature verification mechanism corresponding to a preset encryption algorithm to obtain a target verification result; and determining an operation control result of the target application program based on the target verification result. By adopting the method, the safety of the operating system can be improved.

The invention relates to the field of operating system security, and particularly provides a device for defending ROP and ROP variant category attacks in a Linux system, which comprises a reference value generation module, a side hanging monitoring module and a detection defense module, the reference value generation module is used for obtaining and storing a measurement reference value from a target program executable file; the side-hung monitoring module is used for creating a side-hung monitoring process, monitoring execution of a target process, and obtaining an execution path of an execution stream feature instruction and execution times of the execution stream feature instruction; and the detection defense module is used for comparing the measurement reference value with the execution path of the execution stream feature instruction and the execution times of the execution stream feature instruction, and judging whether attack of the ROP or a variant category thereof occurs or not. According to the technical scheme, the safety and the stability of the system are protected.

The application discloses a Linux distribution operating system security vulnerability automatic repairing method and relates to the technical field of system security, which comprises a CVE database used for recording all historical CVE information related to a distribution product platform, a distribution product software SBOM database used for recording the basic information of all components of a single distribution system and forming component information, a product-component-CVE repairing state recording database used for recording the affected state and repairing state information of a single component about a specific CVE, a CVE crawler module used for grabbing CVE vulnerability disclosure information from domestic and foreign CVE vulnerability disclosure platforms, an automatic investigation module used for performing automatic investigation work, and an automatic repairing module used for implementing automatic repairing on components with CVE vulnerabilities and performing compiling, installation testing and automatic testing on the repaired code.

The invention relates to a security reinforcement method and system for an operating system of a credential mobile terminal, and relates to the field of information security. Generating dynamic two-dimensional code image information when the insection information is preset standard insection information; analyzing the dynamic two-dimensional code image information to obtain a dynamic analysis format; after the dynamic two-dimensional code image information is collected, a U disk overturning operation is executed to obtain dynamic digital sequence image information; determining a target digital sequence based on the dynamic digital sequence image information; analyzing the target digital sequence based on the dynamic analysis format to determine a target password; executing a password output operation based on the target password; determining an authority code after the password output operation; and outputting corresponding information according to the permission code. According to the invention, through the generation and analysis of the dynamic two-dimensional code image information and the verification of the insection information, the uniqueness and accuracy of identity authentication are ensured.

The invention discloses a semantic continuity guarantee method and device, a terminal and a storage medium, and the method comprises the steps: carrying out the structural representation of a natural language demand, and determining the structural demand information; converting the structured demand information into a formalized protocol in a linear tense logic form; performing semantic representation and semantic alignment on the formalized protocol according to the first image data, and determining aligned semantic representation; decoding the aligned semantic representation, and determining executable data; determining a target mode according to the available CPU resources of the system and the edge equipment information, performing runtime guarantee based on the target mode and the executable data, and determining a runtime guarantee result; and generating a device control instruction based on the runtime guarantee result through the operating system security center. Therefore, the problems that the existing method in the prior art cannot fundamentally solve the problem of lack of full-link semantic continuity and is difficult to meet the high-reliability operation requirement of the safety key AI system in a dynamic environment can be effectively solved.

The invention discloses a formalized verification method of a memory management module and a related device, and relates to the technical field of operating system security, and the formalized verification method comprises the following steps: based on a demand document, a design document and a source code, sequentially constructing a demand layer formalized model, a design layer formalized model and an implementation layer formalized model in an interactive theorem prover, and on the basis of the demand document, constructing a demand layer formalized protocol in the interactive theorem prover, and completing the proving of the demand layer formalized protocol in the interactive theorem prover. And establishing a first refinement relationship between the design layer formalized model and the demand layer formalized model, and completing the certification of the first refinement relationship in the interactive theorem prover. And establishing a second refinement relationship between the implementation layer formalized model and the design layer formalized model, and completing the proof of the second refinement relationship in the interactive theorem prover. If the formalized specification, the first refinement relation and the second refinement relation are proved, it is judged that the memory management module passes formalized verification.

This disclosure provides an operating system security verification method, apparatus, system, and related devices. The method includes: executing initial boot block code to read first image data of a basic input / output system image from a serial peripheral interface flash memory; performing a first security verification on the first image data, and if the first security verification result is passed, executing the basic input / output system image and reading second image data of a bootloader image; performing a second security verification on the second image data, and if the second security verification result is passed, executing the bootloader image and reading third image data of an operating system kernel image from a main storage device; performing a third security verification on the third image data, and if the third security verification result is passed, executing the operating system kernel image.

The invention relates to the technical field of safety verification of robot operating systems, in particular to a robot monitoring node automatic generation method based on a structured natural language. The method comprises the following steps: acquiring a structured natural language monitoring requirement; analyzing and converting the data into a probability sequential logic formula and a variable mapping relation; verifying whether the variable exists in the target data stream framework or not; and automatically generating a monitoring node capable of running in the data stream framework based on the verified formula and the mapping relation. And when the monitoring node runs, monitoring variable update, and only triggering conformity judgment of the correlation formula. The problems that in the prior art, requirement conversion is difficult, monitoring logic and a platform are strongly coupled, and execution time is unpredictable are solved, and requirement unambiguous formalization and monitoring code full-automatic generation are achieved.

The application discloses a kind of based on post-quantum signature operating system security authentication and key management method, belong to operating system security and quantum security technical field, including the following steps, establish the three-layer security architecture model based on hardware trust root-post-quantum signature chain-mixed key management;Operating system security authentication is carried out based on three-layer security architecture model;After security authentication passes, the whole life cycle management of post-quantum key is executed to generate key, and in the process, the way of hardware isolation and encryption protection is used to ensure that key is not leaked, traceable and controllable;Post-quantum signature and the post-quantum key obtained in the above step are deployed to the operating system and terminal equipment that have passed security authentication, the application uses the above method, realizes operating system full-scene anti-quantum security authentication, guarantees the safety of the whole life cycle of key, realizes the smooth compatibility with existing traditional cryptographic system, reduces migration cost, improves the overall security level of operating system.

The invention discloses a Linux process layered monitoring method and system based on a dynamic decision engine, and belongs to the technical field of operating system security monitoring. The method comprises the following steps: sensing a system environment, and detecting the support capability of the system to a monitoring technology; capturing a process creation event through a lightweight trigger, extracting a process identifier, predicting survival time and a security risk score feature; dynamically selecting an optimal monitoring channel for the process by a dynamic decision engine according to the characteristics and the system load: distributing a short-life-cycle or low-risk process to a high-performance eBPF channel, distributing a high-risk or key process to an auditd channel with complete functions, and automatically degrading to an inotify-based standby channel when the eBPF is unavailable; and uniformly processing and outputting the heterogeneous monitoring data. According to the method, static configuration is replaced by intelligent decision, and the problem that an existing monitoring scheme cannot consider high performance, low overhead, completeness and environment universality at the same time is solved.

The application relates to an attack-fault tree-based operating system security evaluation method, which comprises the following steps: for an attack-fault tree-based operating system, evaluating an attack surface exposure risk result of an exposed element under a simulated attack scene; based on the attack surface exposure risk result, adaptively adjusting a security evaluation algorithm and algorithm parameters of an operating system defense mechanism; based on the adaptively adjusted security evaluation algorithm and algorithm parameters, evaluating the defense mechanism of the operating system to obtain a defense mechanism evaluation result; based on matrix operation, quantifying the comprehensive influence of the attack surface exposure risk result and the defense mechanism evaluation result on the overall security state of the operating system to obtain a preliminary comprehensive risk value; acquiring real-time running data of the operating system, correcting the preliminary comprehensive risk value, and generating a comprehensive security evaluation result of the operating system. In the application, the mutual influences of multiple aspects are comprehensively considered, so that the final comprehensive security evaluation result is more accurate.

The method and apparatus for generating encrypted operating system installation files, in this embodiment, at the operating system level, encrypts the files of the kernel, temporary file system, and root file system necessary for running the operating system layer by layer. Data in the root file system can only be accessed by sequentially decrypting the files during system startup on the target product hardware platform according to the bootloader, kernel, temporary file system, and root file system. This avoids the risk of static decryption after system files are extracted, achieving system-level protection of storage media data and improving operating system security. Writing the aforementioned files according to second hardware address mapping information prevents users without access rights from directly reading the files, further enhancing data security. At the user interface level, users can only use product functions in a limited operating environment, preventing users with lower-level permissions from accessing data in the root file system, effectively protecting storage media data at the user level.

This application provides a method, apparatus, device, and storage medium for switching application interfaces, creating a persistent image carrier. The persistent image carrier has a corresponding persistent display controller and a corresponding carrier layer on the screen of the terminal device. A first application interface is displayed on the screen via the persistent display controller. When it is necessary to switch from the first application interface to a second application interface, the carrier layer is raised to the upper layer of the first application interface, and a preset animation is played on the screen via the persistent image carrier. The first application interface is then switched to the second application interface. The second application interface is then displayed on the screen via the persistent display controller. This application provides a smoother and more visually appealing experience for users when switching applications without integrating multiple applications into one, avoiding modifications to the operating system source code and minimizing the impact on operating system security.

The invention discloses a TPCM (Trusted Platform Control Module)-based operating system security update solution, which comprises the following steps that: when an operating system is started, a TPCM performs self-inspection, and after the self-inspection is passed, the TPCM generates a pair of public and private keys; the method comprises the following steps: an operating system supplier signs an update packet by using a private key before issuing the update packet, and generates a hash value of the update packet after the update packet is signed; after the user equipment receives the update package, the TPCM verifies the signature of the update package by using the public key of the operating system supplier, and after the signature verification is passed, the TPCM calculates the hash value of the update package and compares the hash value with the hash value in the signature; after the comparison is passed, the TPCM transmits the update package to an operating system for installation, and in the update package installation process, the TPCM monitors the update progress in real time; after updating is completed, the TPCM generates an updating log, and the TPCM sends the generated updating log to an operating system supplier. By introducing the trusted platform control module, the security and efficiency of the updating process of the operating system are improved.

The invention discloses a data access method and device based on an access control model, equipment and a medium, and relates to the technical field of operating system security reinforcement, and the method comprises the steps: when a target object accesses target information in an information system, determining the target object as a subject, and determining the target information as an object; determining a first confidentiality level and a first integrity level of the subject, and determining a second confidentiality level and a second integrity level of the object; and comparing the first confidentiality level with the first integrity level, and determining whether to compare the second confidentiality level with the second integrity level based on an obtained current comparison result so as to determine the priority condition of the BLP model and the Biba model in the access control model, and performing data access by using the priority condition, the BLP model and the Biba model. Therefore, the integrity and confidentiality of the data can be improved in the data access process.

The invention discloses an operating system security auditing method and system based on multi-dimensional monitoring. The method comprises the following steps: configuring an auditing strategy and monitoring parameters; multi-dimensional parallel monitoring is started; the multiple dimensions comprise an account dimension, a login dimension, a service dimension, a log dimension and a resource dimension; collecting security events of each dimension in real time, and adopting an event-driven real-time monitoring mechanism; an intelligent filtering algorithm is applied to perform multi-level filtering, so that the redundancy of data is remarkably reduced; executing cross-dimension event association analysis, identifying complex security threat modes and threat behaviors, and performing threat level evaluation according to an audit strategy; executing a corresponding response strategy according to the threat evaluation result and generating an audit report; the method has the beneficial effects that comprehensive, accurate and real-time detection of the security threats of the operating system is realized through multi-dimensional cooperative monitoring, an event-driven real-time monitoring mechanism, multi-level filtering and cross-dimensional event association analysis, and the auditing efficiency and accuracy are remarkably improved.

This application relates to a program execution method, apparatus, computer device, and readable storage medium. The method includes: obtaining signature information corresponding to a target application, wherein the target application is obtained by signing each code section contained in an initial application according to a preset encryption algorithm; loading the signature information and the target application into kernel mode, and verifying the target application in kernel mode based on a preset configuration file and a signature verification mechanism corresponding to the preset encryption algorithm, obtaining a target verification result; and determining the execution control result of the target application based on the target verification result. This method can improve operating system security.

The invention provides a PCIe interface-based soft shutdown method and system for an operating system in case equipment, the method and the system are suitable for running a computer single board of a Linux operating system, according to the scheme, a hardware triggering mechanism of a power button is transformed, so that a user only needs to press down the power button of the case equipment for one time to trigger a safe shutdown process of the operating system, and the operation efficiency is improved. And after the system is shut down, the power supply output of the power supply module is automatically cut off to realize a complete soft shutdown function. The invention aims to simplify the shutdown process of the traditional case equipment, and effectively avoid the problem of data loss of an operating system caused by sudden power failure through a hardware signal and software collaborative shutdown mechanism.