26 results about "Protection domain" patented technology

The invention provides a comprehensive multi-judgment station domain protection method based on fault discriminators, and the method comprises the steps: determining a cooperative protection domain which comprises a plurality of protection domains, and each protection domain is provided with at least one fault discriminator; determining a first fault discriminator and a second fault discriminator under the condition that the fault discriminator discriminates that a fault occurs in the protection domain of the fault discriminator; according to the fault discrimination result of the first fault discriminator and the fault discrimination result of the second fault discriminator, cooperatively discriminating whether the fault of the first fault discriminator is misjudged; under the condition that the fault occurring in the first fault discriminator is not misjudged, cooperatively discriminating the fault type and position of the fault occurring in the first fault discriminator according to the fault information discriminated by the first fault discriminator and the fault information discriminated by the second fault discriminator; and performing fault isolation on the fault type. Rapid and accurate fault positioning is carried out through cooperative discrimination, the backup protection action can be accelerated, and the overall protection performance of the transformer substation is improved.

The invention belongs to the technical field of computer network communication, and provides an RDMA-oriented reliable connection fault rapid recovery method and system, the method is executed by a first communication end, communication is established between the first communication end and a second communication end through a queue pair QP, and the queue pair QP is used for bearing service data transmission. The first communication end reserves resources after the QP enters an error state, and sends a PROBE control frame to the opposite end through the control plane queue pair; the second communication end decides to reuse the original QP or allocate a new QP (reuse an original protection domain, a memory registration area and a completion queue) according to the local QP state, and returns a QP number and a start packet serial number in an RESP frame; and the first communication end updates the local QP context and drives the state machine to switch to a ready sending state. The whole process does not need to destroy the QP and does not depend on CM handshake, the recovery time delay is less than 0.5 millisecond, and the method is transparent to the upper layer application and is suitable for the RoCE v2 network environment.

There is provided an apparatus that includes processing circuitry for performing processing in one of a fixed number of at least two domains. One of those domains is subdivided into a variable number of execution environments and memory protection circuitry uses a key input to perform encryption or decryption on the data of a memory access request issued to a memory address from within a current one of the domains. The key input is different for each of the domains and for each of the execution environments, the key input for each of the domains is fixed at boot time of the apparatus, and the key input for each of the execution environments is dynamic.

The application discloses a power industrial control safety protection system and method based on a microkernel active defense, wherein the system takes a microkernel isolation base as a minimum trusted computing base, allocates revocable communication endpoints and controlled mapping permissions to each protection domain, and provides base support for the isolation domain boundary and permission recovery in the active defense; in the method, the system is uniformly formatted by an input module to process field data and service requests and generate a request identifier, a request distribution service distributes the same request to an odd number of online executors for parallel processing, a single decision output available externally is generated, an executor scheduling service selects a candidate executor from a candidate protection domain pool and reconstructs an online user mode service cluster according to a feedback index by adopting a periodic rotation and event triggering strategy, and if the request distribution service, the consistency arbitration service or the executor scheduling service fails, a minimum bottom-up cleaning is performed by an active defense kernel state support module and a reestablishable state is entered.

In one embodiment, an apparatus comprises a processor to execute instruction(s), wherein the instructions comprise a memory access operation associated with a memory location of a memory. The apparatus further comprises a memory encryption controller to: identify the memory access operation; determine that the memory location is associated with a protected domain, wherein the protected domain is associated with a protected memory region of the memory, and wherein the protected domain is identified from a plurality of protected domains associated with a plurality of protected memory regions of the memory; identify an encryption key associated with the protected domain; perform a cryptography operation on data associated with the memory access operation, wherein the cryptography operation is performed based on the encryption key associated with the protected domain; and return a result of the cryptography operation, wherein the result is to be used for the memory access operation.

Systems, devices, and methods related to securing domain crossover using domain access tables are described. For example, a computer processor may have registers configured to store the locations of domain access tables for predefined, non-hierarchical domains. Each respective domain access table may be pre-associated with a respective domain and may have entries configured to identify entry points for the respective domains. The processor is configured to use the domain access tables to perform domain crossovers during instruction execution and to prevent arbitrary and / or unauthorized domain crossovers from occurring.

The application discloses a multi-layer protection recovery and resource allocation method of an optical network, and relates to the technical field of network communication.The application comprehensively considers multi-service characteristics and network resource dynamic scheduling, and proposes a hybrid method of multi-routing selection and network service slicing, so that protection based on a WDM optical network in a complex network environment is realized.Meanwhile, a work domain and a protection domain are arranged in a bandwidth allocation period, and a flexible resource allocation scheme is adopted, so that network resource utilization can be improved, and the work route can be protected.

The invention relates to the field of biological feature recognition and information security, in particular to a face revocable template protection method based on deep hash. The method comprises the following steps: detecting and aligning an input face image, and extracting and normalizing features; performing projection and symbol quantization to obtain a binary vector with a fixed length; deriving a dimension permutation and index subset by using a user key, and generating a protected template; registration and identification are completed in a protected domain by a Hamming distance; when the template is leaked or needs to be replaced, a new template is regenerated by updating a secret key or an index rule, and template revocation and non-linkability are achieved. The system side only stores the protected template and necessary verification parameters and does not store plaintext images and unprotected features, so that the method is low in calculation overhead, convenient to deploy and suitable for face identity authentication of end-side equipment and a cloud platform.

The invention relates to a drive test method and system, and the method comprises the steps: calling a standardized Verbs interface, creating a protection domain, registering a memory space, creating a completion queue and a queue pair, initializing the queue pair, modifying the state of the queue pair into a ready state, submitting a work request, starting data transmission, and carrying out the polling of the completion queue. According to the method and the device, the work request is acquired and processed to obtain and process the completion event of the work request, so that the basic function of the RDMA driver is realized, a uniform API interface is provided for the RDMA driver verification test in a DSP bare core simulation environment, the development of the API of the RDMA driver of a specific version for different simulation platforms is avoided, the development difficulty of the RDMA driver is remarkably reduced, and the flexibility of cross-platform transplantation of the RDMA driver is improved.

In various embodiments, a memory key service is used to remotely access one or more portions of a physical memory included in a host node. The memory key service generates a first memory key that maps a host address space from a first protection domain associated with the host node to a second protection domain associated with a proxy node. The memory key service generates a second memory key based on the first memory key and a first address range associated with the host node. The memory key service transmits the second memory key to a software component executing on the proxy node. The software component causes a shared storage system to access a first portion of the physical memory based on the second memory key.

The invention discloses a biological characteristic secret state protection method, a verification method, equipment and a medium. Dividing the biological characteristics into a plurality of biological characteristic fragments, carrying out homomorphic encryption calculation on each biological characteristic fragment by adopting a randomly generated fragment encryption key to obtain a secret state biological characteristic fragment, randomly generating a fragment index of the secret state biological characteristic fragment, and storing the fragment index of the secret state biological characteristic fragment into a database; storing the secret state biological characteristic fragments into a local biological characteristic secret state protection domain based on the fragment index, dividing the biological characteristic into a plurality of biological characteristic fragments, and performing homomorphic encryption calculation by adopting a randomly generated fragment encryption key to obtain the secret state biological characteristic fragments; then, the secret state biological characteristics are fragmented and stored in random positions in a local biological characteristic secret state protection domain, fragmented secret state protection on the biological characteristics is achieved, biological characteristic data are prevented from being leaked, and safety is improved.

A plurality of computing devices are communicatively coupled to each other via a network, and each of the plurality of computing devices comprises one or more of a plurality of storage devices. A plurality of failure resilient address spaces are distributed across the plurality of storage devices such that each of the plurality of failure resilient address spaces spans a plurality of the storage devices. Each one of the plurality of failure resilient address spaces is organized into a plurality of stripes. Each one or more stripes of the plurality of stripes is part of a respective one of a plurality of forward error correction (FEC) protection domains. Each of the plurality of stripes may comprise a plurality of storage blocks. Each block of a particular one of the plurality of stripes may reside on a different one of the plurality of storage devices.

In various embodiments, a memory key service is used for remote access to one or more sections of physical memory contained in a host node. The memory key service generates a first memory key that maps a host address space from a first protection domain assigned to the host node to a second protection domain assigned to a proxy node. The memory key service generates a second memory key based on the first memory key and a first address range assigned to the host node. The memory key service transmits the second memory key to a software component running on the proxy node. The software component causes a shared storage system to access a first section of the physical memory based on the second memory key.

The application discloses a kind of in trusted execution environment realizes transparent communication protection method, by inserting security protocol layer in the libOS kernel network module of TEE, for the application running in TEE provides transparent communication protection.Developer does not need to write communication protection module in source code.Communication protection range covers the network TCP communication that data flows from one TEE protection domain to another TEE protection domain is not protected by TEE, and protection type includes data confidentiality protection, data integrity protection and identity authentication protection.Specifically includes: key exchange, symmetric encryption and decryption, message verification protocol, and overload socket class and related system call of libOS, so that application is automatically encrypted and decrypted when sending and receiving data.Lightweight high-performance block ring buffer is introduced for fast reassembly and decryption and encryption data, located in TEE protection domain, to ensure data security and efficient processing.

A method for controlling packet transmission at a PTN access node for an ITS communication network and an apparatus for the same are disclosed. A packet transmission control method according to an embodiment of the present invention may include: a step of classifying into a plurality of service classes including control traffic and video traffic based on the header and service identifier of a received frame; a step of receiving traffic event metadata including signal cycles, conflicting traffic events, and priority signal events from a control policy server; a step of generating scheduling parameters including time slot allocation parameters for a control traffic queue and weight adjustment parameters for a video traffic queue based on the metadata; a step of calculating a microburst indicator based on frame inflow characteristics in a short-time observation window, and determining the output order by performing queue management and scheduling control for a queue by service class according to the scheduling parameters and the microburst indicator; a step of transmitting by applying a predetermined transmission encapsulation according to a service identifier; and a step of maintaining an independent protection domain for each service and performing linear or ring protection switching only for the corresponding service when a threshold is exceeded based on an OAM performance indicator for each service.

The application provides a force feedback method and device for a surgical robot master manipulator, and the force feedback method comprises the following steps: acquiring first force feedback data and scene data of the surgical robot master manipulator; generating a virtual protection domain corresponding to the surgical robot master manipulator based on the scene data; generating target force feedback data by using an impedance control algorithm based on the first force feedback data and the virtual protection domain; and sending a first instruction to a force feedback device controller, wherein the first instruction is used to instruct the force feedback device controller to control the surgical robot master manipulator based on the target force feedback data. By using the above method, the design of the virtual protection domain can complete the construction of a repulsion force field or a pulling force field for the surgical robot master manipulator, so that tactile feedback can be provided to the surgical robot master manipulator, and doctors can truly feel the force feedback effect, thereby avoiding damage to human tissues.

Methods and systems for selective presentation of sensitive information are described herein. A computing system may receive, from a cloud computing platform, a history protection extension. The computing system may install the history protection extension, which may cause the computing system to selectively display sensitive information based on whether or not the computing system is connected to a secure network. The computing system may identify, using the history protection extension, that the computing system is currently operating on the secure network. The computing system may intercept a URL access request. The computing system may compare a domain of the URL access request to a protection domain list. Based on identifying that the domain of the URL is included on the protection domain list, the computing system may launch the URL in a secure browser, and display, within the secure browser and based on a history data list, the sensitive information.

In various embodiments, a memory key service is used to remotely access one or more portions of a physical memory included in a host node. The memory key service generates a first memory key that maps a host address space from a first protection domain associated with the host node to a second protection domain associated with a proxy node. The memory key service generates a second memory key based on the first memory key and a first address range associated with the host node. The memory key service transmits the second memory key to a software component executing on the proxy node. The software component causes a shared storage system to access a first portion of the physical memory based on the second memory key.

This invention relates to a zero-copy acceleration method for virtual machine network I / O based on a passthrough driver of a domestic operating system. The method includes: customizing the kernel of the domestic operating system to introduce a dedicated passthrough driver module; expanding the virtual machine's virtual network device to provide a passthrough mode; receiving passthrough enable requests from virtualization components and performing security authentication and resource pre-checks; upon successful pre-check, creating a virtual machine-specific protection domain based on the IOMMU, locking memory pages used for network transmission and reception and establishing a mapping to the IOVA, recording the mapping relationship to restrict the physical network card to only access the mapped virtual machine memory; configuring the physical network card's passthrough transmission and reception queue and establishing a control channel, sending configuration information to initialize the descriptor ring; and executing a zero-copy transmission and reception process, enabling the physical network card's DMA to directly access the virtual machine's network buffer to complete data transmission. This method reduces host-side data copying and protocol stack processing overhead, lowers latency, and improves throughput.

The invention discloses an internal-external isolation method for an automatic library operating system. The method comprises the following steps: firstly, analyzing a system micro-library, and automatically detecting and marking all potentially variables needing to set isolation permissions and functions related to cross-domain calling; secondly, initializing micro-library composition of a library operating system based on a configuration file, and dividing a protection domain shared in the system and a function allowing external access; then, automatically calculating variable permission and carrying out placeholder conversion, and determining the permission level of the variable and a cross-domain execution function; in the system initialization starting stage, according to the determined variable permission, the variables are distributed to corresponding memory spaces, internal isolation of the system is achieved, and a safe remote service interface is provided for external access; when an external caller initiates remote access through the VMFUNC, it is ensured that only variables isolated between systems can be accessed by external access through permission check and access stack division, meanwhile, memory access safety of a callee is ensured, and external isolation of the systems is achieved.

A plurality of computing devices are communicatively coupled to each other via a network, and each of the plurality of computing devices comprises one or more of a plurality of storage devices. A plurality of failure resilient address spaces are distributed across the plurality of storage devices such that each of the plurality of failure resilient address spaces spans a plurality of the storage devices. Each one of the plurality of failure resilient address spaces is organized into a plurality of stripes. Each one or more stripes of the plurality of stripes is part of a respective one of a plurality of forward error correction (FEC) protection domains. Each of the plurality of stripes may comprise a plurality of storage blocks. Each block of a particular one of the plurality of stripes may reside on a different one of the plurality of storage devices.

The present invention provides a station-domain protection method based on comprehensive multiple determinations by a fault discriminator. The method includes determining a collaborative protection domain, which includes multiple protection domains, each of which is configured with at least one fault discriminator. When a fault discriminator determines that a fault has occurred in its protection domain, a first fault discriminator and a second fault discriminator are determined. Based on the fault determination results of the first fault discriminator and the second fault discriminator, a collaborative determination is made as to whether the fault occurred by the first fault discriminator is a misjudgment. When the fault occurred by the first fault discriminator is not a misjudgment, the method collaboratively determines the fault type and location of the fault occurred by the first fault discriminator based on the fault information determined by the first fault discriminator and the fault information determined by the second fault discriminator. The method also performs fault isolation on the fault type. Faster and more accurate fault location through collaborative determination can accelerate backup protection action and improve the overall protection performance of the substation.

The invention provides a security isolation method and system applied to an electric power monitoring system, and belongs to the technical field of electric power system security, and the method comprises the steps: firstly capturing a real-time operation interaction link and an abnormal behavior track of each component in the electric power monitoring system, and then generating an isolation starting instruction including an instruction triggering condition and the like; then, a cross-domain protection linkage framework is constructed based on the isolation starting instruction, and protection strategies of an equipment layer, a communication layer and an application layer are integrated; a hierarchical isolation execution plan is generated by using a cross-domain protection linkage framework, and action sequences of all protection domains and the like are defined; and finally, pushing the hierarchical isolation execution plan to a protection execution component, collecting execution state information, updating framework association logic parameters, and keeping a system global isolation situation, thereby effectively improving the security of the power monitoring system.

The invention provides a video anti-refreshing system based on an access control technology and an implementation method thereof, and the system comprises a cloud storage service timestamp anti-theft link module which is used for logging in a cloud storage server platform, and starting the timestamp anti-theft link through the configuration of a target storage bucket; the anti-stealing-link key acquisition and configuration module is used for generating or copying a signature key in the cloud storage server platform and configuring a protection domain name, a threshold value and the signature key; and the video anti-refreshing module is used for enabling the generated anti-hotlinking key to enter an anti-refreshing system, checking the health state of each server node and carrying out video anti-refreshing monitoring.

This application relates to a driving test method and system. In this application, by calling a standardized Verbs interface, a protection domain is created, a memory space is registered, a completion queue and a queue pair are created, and the queue pair is initialized. The state of the queue pair is modified to the ready state, and a work request is submitted to start data transmission. The completion queue is polled to obtain and process the completion event of the work request, so as to implement the basic functions of the RDMA driver, provide a unified API interface for the RDMA driver verification test in the DSP bare core simulation environment, avoid developing specific versions of the RDMA driver API for different simulation platforms, significantly reduce the development difficulty of the RDMA driver, and improve the flexibility of cross-platform transplantation of the RDMA driver.

The invention discloses a proxy recursive side domain name preservation method and system, and relates to the technical field of DNS security. According to the technical scheme, DNS software does not need to be modified, specific domain names and domain overall preservation are supported, and the problem that DNS analysis services are not available within the restarting time of the software is solved. The technical key points are as follows: a BIND9 self-definition cache recording function is adopted, cache information which is most adaptive to a current query domain name is adopted in a DNS server, and two recursive resolvers are adopted as a resolver cluster, so that at least one resolver can normally provide an analysis service; the BIND9 starts a time delay solution; the invention discloses an overall architecture of a proxy recursive side domain name preservation scheme. The overall architecture comprises protected domain name list configuration, protected domain name record information collection, trusted record generation, a recursive parser controller, a proxy parser controller and a log module. According to the method, after the specific domain name or the whole domain is maliciously tampered, it can be ensured that the domain name or the domain can be correctly analyzed, and the serious influence of a malicious analysis result on Internet users is avoided.