60 results about "Security analysis" patented technology

The invention provides a security analysis method for a post-quantum NTRU cryptographic algorithm, and the method comprises the steps: an attacker carries out the sampling of a public key, and obtains a public key sample, different private keys g with a public Hamming weight, and a fixed target private key; according to each public key sample and information disclosed by the Hamming weight of the private key, establishing a modular equation, and solving the modular equation by combining a linear technology and a preset initial value; obtaining a complete value of the second polynomial based on a linear relation between the equation set solution and other parts except the constant term in the second polynomial and a linear relation between a preset initial value and the constant term of the second polynomial; and according to the public key sample and the complete value of the second polynomial, utilizing a GS algorithm to obtain a speculative value of the target private key, and according to the relationship between the speculative value and the actual value of the target private key, carrying out security analysis on the password security system. The private key is recovered by using the relation between the solution of the modular equation and the private key, and the bottleneck of the existing technical means is broken through.

The invention discloses an alliance chain-based inspection and detection report collaborative generation method. The method comprises six algorithms: an initialization algorithm, a user registration algorithm, a report generation algorithm, a report consensus uplink algorithm, a report query algorithm and a penetrating supervision algorithm. According to the invention, efficient cooperation among multiple inspection and detection mechanisms is realized, the reliability of inspection and detection reports is ensured, penetrating supervision is realized, and hierarchical access to the inspection and detection reports is supported. Therefore, on the premise of ensuring data security and privacy protection, the availability of the report is improved, security analysis verifies that the scheme has penetrating supervision, report confidentiality and report reliability of unauthorized users and the like, and performance analysis shows that the scheme has relatively low calculation and communication overhead.

The invention relates to the field of vulnerability detection, in particular to an intelligent contract vulnerability detection method and system based on taint analysis, and the method comprises the steps: carrying out the control flow analysis of an EVM byte code of an intelligent contract, and extracting key operation instructions in a control flow diagram and key parameters of each key operation instruction; performing access right control identification on the EVM byte code based on a defined access right control condition, and identifying access right control check and access right control state variables; setting a taint sink based on a key operation instruction and an access authority control state variable, performing taint analysis, generating a constraint condition of a taint flow path through symbolic execution, efficiently and accurately distinguishing expected normal operation in the smart contract from a real security vulnerability, negating the constraint condition to obtain a negative constraint condition, and finally obtaining an access authority control state variable. And negative constraint conditions are further solved, so that the accuracy and reliability of security analysis of the smart contract are remarkably improved, and powerful support is provided for security assurance of the smart contract.

The invention relates to the technical field of data security, can be applied to business scenes of financial science and technology, medical health and the like, and discloses a security processing method, device and equipment oriented to software development and a medium. Obtaining an architecture design document to identify potential safety hazards and generate design improvement suggestions; generating a code based on the business logic description and the design improvement suggestion, and completing security detection and repair to obtain a processed code and a code repair record; performing security test on the processed code and recording a test result; collecting data of exception identification, hidden danger identification, code detection and repair and security test to update the security knowledge base; and generating a security analysis report based on the demand exception list, the design improvement suggestion, the code repair record and the test result. According to the invention, through a security identification and restoration process from demand to test, early discovery of security problems, linkage processing and knowledge self-updating are realized.

The invention provides a safety analysis method based on a SelfTargetSIS problem. The method comprises the following steps: modeling a solution target of the SelfTargetSIS problem into explicit search on a message set, an allowable vector set and a challenge vector set; estimating a first search complexity in the classic model under a random oracle model; estimating a second search complexity in the quantum model under a random oracle model; and determining the minimum value of the first search complexity and the known classical optimal attack complexity as the effective attack complexity under the classical model, and determining the minimum value of the second search complexity and the known quantum optimal attack complexity as the effective attack complexity under the quantum model, thereby performing security evaluation on the anti-quantum signature. According to the method, an explicit search path based on a message set, an allowable vector set and a challenge vector set is supplemented and quantified, and the attack cost in the real world can be reflected more comprehensively.

The application discloses a routing protocol analysis method and device, equipment and a storage medium. After obtaining a routing protocol to be analyzed, an attack point in the routing protocol to be analyzed is identified, the attack point is an attack purpose of an attacker, the path of the attack to be performed by the attacker to achieve the attack purpose is reversely searched in the routing protocol to be analyzed starting from the attack purpose of the attacker, a detection rule is generated for the attack path, and the routing protocol to be analyzed is analyzed based on the generated detection rule. The attack path is obtained by comprehensively searching in the routing protocol to be analyzed starting from the attack point. The detection rule is obtained by analyzing the attack path. The routing protocol is analyzed according to the detection rule. The possible vulnerabilities in the routing protocol can be comprehensively analyzed.

The disclosure provides a security analysis method and system based on protocol state, which relates to the technical field of protocol security protection. The method includes the following: a node traversal table is built, the node traversal table is scanned and analyzed according to the protocol trigger sequence rule, a first security evaluation factor of a protocol stack is determined, and a second security evaluation factor of each protocol is determined based on protocol normal application rule, and the trustworthiness degree of the second security factor is determined based on the first security factor, and the second security factor is revised based on the trustworthiness degree, and the security state of the protocol is determined according to the revised second security factor, thus the analysis of the protocol state is realized, and the security of the protocol can be accurately determined.

Systems and methods are disclosed for software security analysis. In certain embodiments, a method may comprise identifying a set of potential security vulnerabilities, comparing the potential vulnerabilities to a catalog identifying elements on a client system, and generating risk mitigation advice based on potential security vulnerabilities matching an element in the catalog. The method may include evaluating a data field of a service request to a third party to determine an expected data type for the field, determining whether the actual data included in the service request matches the expected data type, and quarantining the service request when the actual data does not match the expected data type. The method may comprise operating as a proxy for the service request, including receiving the service request from the client system, evaluating the service request for irregularities, and forwarding the service request to the third party once the irregularities have been addressed.

The application discloses a fair commodity transaction privacy protection method based on a blockchain, which comprises the following steps: system initialization; a buyer publishes a payment transaction; a miner verifies the transaction and executes a payment function of a contract if the transaction is passed, or ends the process; the buyer publishes a payment proof transaction; a seller verifies a verifiable encryption signature and publishes a delivery transaction if the encryption signature is passed, or ends the process; the buyer publishes a redemption proof transaction; the seller publishes a redemption transaction; and the miner verifies the transaction and executes a redemption function of the contract if the transaction is passed. The method realizes the comprehensive protection of the identities, account balances, transaction amounts and transaction contents of the two parties of the transaction by using blind signature, verifiable encryption signature, homomorphic encryption, range proof and zero-knowledge proof technology to protect the transaction privacy and ensure the fairness of the transaction while recording the transaction information through the blockchain and the smart contract. Through security analysis, the method meets the effectiveness, time limit, fairness, anonymity, confidentiality and balance.

The present application discloses a security analysis method, device, equipment and readable storage medium. Based on the target log information in the alarm log whose hazard level is higher than the hazard level threshold and the alarm confidence is higher than the confidence threshold, the present application determines the attacked state of the device, and then uses the analysis strategy corresponding to the attacked state to analyze the alarm log, and can analyze the alarm log in a targeted manner according to different analysis strategies. For example: when the device is in an attacked state, the alarm log generated at the current moment is analyzed in focus; when the device is in a controlled state, the alarm information at the current moment, before the current moment, and after the current moment are analyzed in focus, so as to accurately analyze the current attack event based on the alarm log, and can also improve the analysis efficiency and accuracy. Correspondingly, a security analysis device, equipment and readable storage medium provided by the present application also have the above-mentioned technical effects.

The invention provides an intelligent contract reusable component use logic compliance detection method and system, and belongs to the technical field of intelligent contract reusable component safety analysis. Inputting an intelligent contract source code and carrying out preprocessing operation; constructing a multi-dimensional smart contract feature analyzer, generating a multi-dimensional smart contract feature graph representation, and further extracting a use case of a reusable component of the smart contract and a core feature of the use case; a use logic compliance review model is generated based on large model retrieval enhancement, and potential use logic non-compliance use cases are identified; a large model illusion suppression engine based on snapshot conflicts is constructed, large model illusion is suppressed, and potential use logic non-compliance use cases after illusion suppression are obtained; constructing a verification engine based on similarity analysis, and carrying out secondary verification on the potential non-compliance use cases; and outputting a detection report of the use logic compliance of the reusable component in the current smart contract, thereby realizing automatic detection of the use logic compliance of the reusable component in the smart contract.

The present invention proposes a theoretical security analysis method for a lattice-based PKE / KEM scheme based on a compressed public key design, comprising the following steps: obtaining a key encapsulation scheme; utilizing the properties of a discrete Gaussian distribution to decompose e into two parts, e1 and e2, and then re-expressing the parameters as #imgabs0#; expressing #imgabs1# and #imgabs2# as #imgabs3#, wherein #imgabs4# is taken from an appropriate distribution; utilizing the properties of the discrete Gaussian distribution to decompose a secret #imgabs5# into a secret #imgabs6# and a redundant part #imgabs7# of a standard modulus LWE problem; and then rewriting the sample form as #imgabs8#; utilizing the standard modulus LWE problem corresponding to #imgabs9# to evaluate the theoretical difficulty lower bound of the corresponding problem, and then evaluating the security strength lower bound of the KEM scheme; and selecting specific parameters of the key encapsulation scheme for a required security strength λ according to the computational complexity of the standard modulus LWE problem corresponding to #imgabs10#.

A method utilizes a policy engine for supply chain security analysis. The method includes processing programming code, written in an imperative programming language, using a fact collector to instantiate a programming object representing a set of facts of a build system that includes an artifact. The method further includes processing the programming object using a mapper to expose the set of facts as a fact database. The method further includes evaluating a policy, written in a declarative programming language, and the fact database using a policy engine to construct a result corresponding to the artifact of the build system. The method further includes presenting the result with a supply chain security analysis of the artifact.

The invention provides a theoretical security analysis method of a lattice-based PKE / KEM scheme based on compressed public key design. The method comprises the following steps: obtaining a key packaging scheme; the method comprises the following steps: splitting e into two parts e1 and e2 by utilizing the property of discrete Gaussian distribution, and then re-representing parameters as # imgabs0 #, representing # imgabs1 # imgabs2 # as # imgabs3 #, wherein # imgabs4 # is selected from proper distribution; secondly, splitting a secret # imgabs5 # by utilizing the property of discrete Gaussian distribution, decomposing the secret # imgabs5 # into a secret # imgabs6 # and a redundant part # imgabs7 # of a standard model LWE problem, further rewriting a sample form into # imgabs8 #, evaluating a theoretical difficulty lower bound of a corresponding problem by utilizing the standard model LWE problem corresponding to # imgabs9 #, and further evaluating a safety intensity lower bound of a KEM scheme; and for the required security strength lambda, selecting specific parameters of a key packaging scheme according to the calculation complexity of a standard module LWE problem corresponding to # imgabs10 #.

The invention discloses a virtual transmitted currency identification method based on machine learning based on a complex network, and belongs to the technical field of block chain security analysis and financial anti-fraud. Comprising the steps of task creation and data preparation, primary data search and key address mining, graph network construction and feature engineering, deep data search and transaction detail analysis, involved feature monitoring, contract address feature monitoring, model training and optimization, and result display and decision support. According to the method, multi-level fund flow and transaction relations are deeply analyzed, key nodes and abnormal transactions in virtual currency sales activities are automatically identified, the discovery and early warning efficiency of illegal sales activities is remarkably improved, and the problem that information sources are insufficient in traditional monitoring is solved.

The present invention discloses a model conversion method and system, and relates to the technical field of model conversion. The method automatically converts the flattened model of AltaRica3.0 into a SBIP model, and the flattened model of AltaRica3.0 into a Guard conversion system GTS model; including: using the metalanguage of the language recognition tool ANTLR to describe the grammatical rules of the Guard conversion system GTS model to generate an abstract syntax tree AST of the Guard conversion system GTS model; using the abstract syntax tree AST to convert the variable part, event part, migration part, assertion part and delay part of the Guard conversion system GTS model respectively. The method realizes the automatic conversion of the AltaRica3.0 flattened model GTS to the SBIP model, so that the AltaRica3.0 model can perform statistical model detection and enrich the security analysis function of AltaRica3.0.

The application discloses a kind of system security analysis method, system and equipment, method includes: system task is decomposed, each subtask is determined as the functional unit of the system;The performance of each functional unit is evaluated using time and precision, the output variability score of each functional unit is obtained by introducing expert score, then the potential coupling of each functional unit performance change is analyzed, and the functional coupling variability score of each functional unit is obtained in combination with the output variability score;Threshold value of functional coupling variability score is set, when exceeding the threshold value of functional coupling variability score, system will occur functional resonance, so as to identify the key functional unit in system, and set barrier for the key functional unit to prevent potential accidents from happening.The application fuses subjective and objective factors to analyze the safety of system, solves the technical problems that cannot give quantitative analysis results due to excessive dependence on expert subjective evaluation, and lacks theory or process to construct functional resonance.

The invention relates to the technical field of security evaluation of encryption algorithms, and provides a virtual shuffling security analysis method and system for bit slice misuse, and the method comprises the steps: creating a counter array which comprises a plurality of elements, and the index of each element corresponds to the value of a candidate key; for virtual shuffling, collecting a plurality of groups of tracks, screening out effective tracks for each track group, and if the number of the effective tracks is smaller than a threshold value, discarding the track group; performing LDA operation on the reserved track group to obtain a recommended key set, and for each candidate key in the recommended key set, adding one to the value of the index position of the corresponding counter array; and after all the track groups are processed, traversing the counter array, finding out the key with the highest count as a correct key, counting the count of the correct key, and obtaining the actual recommendation frequency of the correct key. And the risk of misuse of bit slice virtual shuffling in IF-ELSE implementation can be efficiently identified.

The invention provides an information-leakage-free quantum dialogue method based on Grover quantum search, so that two communication parties realize mutual exchange of secret messages by utilizing transmission of quantum signals. According to the method, the auxiliary initial two-particle product state is directly transmitted from one user to the other user, so that the problem of information leakage is eliminated. Security analysis proves that the method can resist interception-retransmission attacks, measurement-retransmission attacks, entanglement-measurement attacks and Trojan horse attacks initiated by external eavesdroppers. According to the method provided by the invention, the quantum bit efficiency is up to 2 / 3 after the eavesdropping detection process is ignored. According to the method, only the product state of the two particles is used as an initial quantum resource, only single particle measurement is needed, and quantum entanglement swapping does not need to be executed.

The invention relates to the technical field of security analysis, in particular to a security analysis method based on a function prototype, and provides the following scheme: receiving function demand information and analyzing, and extracting functional elements of perception, decision, control and execution modules; constructing a virtual function prototype, and generating a sub-function module model; and setting operation parameters and parameter transmission constraint conditions. In a virtual simulation environment, a driving scene is constructed, each function module is tested, and potential system failure points and potential safety hazards are identified. And further performing structured processing on the analyzed function requirements, and establishing a dependency graph through graph theory analysis. Finally, the stability and safety of the system are evaluated by using multi-dimensional data analysis and a Monte Carlo simulation method, and a comprehensive safety evaluation report is generated to ensure the reliability of the automatic driving system.

The present invention discloses a method, system and computing device for automatic detection of malicious code for smart contracts, relates to the field of security analysis technology, and solves the technical problem that the prior art has the risk of omitting key execution states, thereby causing underreporting of malicious code detection; the present invention generates an abstract syntax tree by parsing source code; traverses and identifies all types of address variables in the abstract syntax tree, marks them as address variable sets and classifies them; calls the initial state and builds a symbolic execution engine with a buffer pool, and uses the initial state as input to output a matrix through the symbolic execution engine; builds and initializes a result deviation table based on the output matrix; updates the result deviation table according to a symbol replacer and generates a deviation function queue; iteratively analyzes the result deviation based on the deviation function queue to obtain a final deviation variable set; and judges whether the corresponding smart contract is malicious based on the final deviation variable set; the present invention covers a wider range of malicious contract codes.

The invention provides an automatic reasoning method and system for use specifications of a reusable component of a smart contract, and belongs to the technical field of security analysis of the reusable component of the smart contract. An automatic crawling framework is used for collecting source codes of reusable components of mainstream smart contracts to be analyzed and document information of the reusable components of the mainstream smart contracts to be analyzed. And the crawled information of the reusable component of the smart contract is processed by using the task planning intermediate, and the planning of the reusable component use specification automatic analysis working process is completed according to a two-layer planning principle of'process task-subtask '. And constructing and using an intelligent analysis model oriented to reusable component code semantic understanding to process the code understanding class subtasks. And constructing and using a contract analysis tool set to process the program analysis class subtasks. And constructing and using an auxiliary tool set to process the message conversion type subtasks. And integrating the analysis result of each process task, and outputting a usage specification report of the reusable component of the smart contract, thereby realizing efficient and accurate automatic reasoning of usage specification information of the reusable component of the smart contract.

The present application relates to devices and components including apparatus, systems, and methods to perform risk analysis of authentication systems and presenting results of the risk analysis. The approaches can transform configuration data indicating authentication operations to a data format representation for performing risk analysis of the authentication systems.

The invention discloses a prime power RSA modulus decomposition method and system, a medium and equipment, and the method comprises the following steps: obtaining a value through the information of a part of high bits leaked by a private key, a prime power RSA modulus and a small public key index; recovering partial information of the prime number by using the obtained information, specifically comprising the following steps: constructing a modular equation to solve the value of the prime number; the method comprises the following steps: constructing two functions, and approaching a prime number in a binary search mode by using a size relationship of function values to obtain high bit information of a prime number part; constructing a first-order modular equation by using part of information of the recovered prime number, and recovering a complete prime number in combination with a Appersmith algorithm; and decomposing by using prime numbers and moduli. According to the method, less private key bit information is utilized, and modulus decomposition is completed, so that security analysis of the prime power RSA cryptographic algorithm is realized.

The application provides a security analysis method for a post-quantum NTRU cryptographic algorithm, which comprises the following steps: an attacker samples a public key to obtain a plurality of public key samples, a different private key g with a Hamming weight open to the public, and a fixed target private key; a modular equation is established according to each public key sample and the private key Hamming weight open-to-the-public information, and the plurality of modular equations are solved in combination with a linear technique and a preset initial value; based on a linear relationship between the equation set solution and the rest of a second polynomial except for a constant term and a linear relationship between the preset initial value and the constant term of the second polynomial, a complete value of the second polynomial is obtained; a guess value of the target private key is obtained by using a GS algorithm according to the public key sample and the complete value of the second polynomial, and a security analysis is performed on a cryptographic security system according to a relationship between the guess value and an actual value of the target private key. The application restores the private key by using the relationship between the solution of the modular equation and the private key, and breaks through the bottleneck of the prior art means.

Various examples reveal systems and procedures related to facilitating automated security analysis. Specifically, a security analysis can be performed on a software product or a part thereof to identify potential security risks associated with the product. To perform code security data analysis, various types of code security data can be analyzed for a comprehensive analysis of any potential security risks associated with a product. For example, different phases of product development can be analyzed to enable the prevention of security breaches. During implementation, design analysis, design-to-code analysis, and / or code analysis can be performed to identify potential security risks.Performing such diverse analyses enables a robust and comprehensive safety assessment of a product from design to implementation.

A method for security analysis and control of an information-physical system under a periodic denial-of-service attack belongs to the field of information-physical systems. The present invention solves the problem of poor security analysis and control performance of existing methods. The present invention provides conditions for ensuring exponential stability of a closed-loop system. Independent of any assumptions and the residence time method used in the switching system, a critical value of the amount of denial-of-service attacks within an attack cycle can be derived through direct analysis, and the information-physical system can maintain stability when the critical value is higher than the critical value. Compared with existing methods, the method of the present invention has lower conservatism and improves the security analysis and control performance of information-physical systems. The method of the present invention can be applied to the security analysis and control of information-physical systems.

The invention provides an LWE problem solving method in combination with leaked information in a post quantum cryptography environment, and a security analysis method and device. The solving method comprises the following steps: aiming at a to-be-analyzed cryptographic system, constructing an LWE instance about the cryptographic system; extracting leakage information of the password system by adopting a side channel analysis technology and formally representing the leakage information as prompt information; constructing a first lattice basis matrix and a corresponding transformation matrix according to the prompt information; and fusing the LWE instance with the first lattice basis matrix and the transformation matrix to construct a second lattice basis matrix, carrying out lattice basis reduction on the generated lattice, obtaining a short vector, verifying whether the short vector is a private key of the cryptographic system, and if not, continuing to carry out lattice basis reduction on the lattice generated by the second lattice basis matrix. According to the method, LLL reduction is replaced by regular calculation, so that the operation speed is increased; in the LWE solving stage, batch processing of different quantities and types of prompt information is realized, flexible adjustment of the used LWE sampling quantity is supported, and the problem calculation efficiency is improved.

The invention discloses an intelligent contract security analysis method and system based on neighbor contrast learning, and the method comprises the steps: firstly carrying out the function-level slicing of an intelligent contract source code, recognizing a key node, a common node and a rollback node based on a rule, and constructing a contract graph fusing the grammar and multi-dimensional semantic relation; for the problems of graph sparsity and noise, a neighbor node set is updated through semantic feature similarity and a graph topology distance, feature aggregation is carried out by adopting a graph attention network fused with a dynamic edge semantic correction mechanism, and an edge semantic scoring network synthesizes edge features, node similarity and global context to generate a dynamic edge weight so as to correct attention. And finally, training a classification model by using a total loss function fusing neighbor contrast learning loss and classification loss. According to the method, through the synergistic effect of node distinguishing, double-neighbor contrast learning and dynamic edge correction, the data sparsity is effectively relieved, noise interference is inhibited, a key path is amplified, and the accuracy, robustness and generalization ability of vulnerability detection are remarkably improved.

The invention provides a fault transmission analysis method based on a functional physical mapping model, and belongs to the technical field of complex system safety analysis, and the method comprises the following steps: S1, carrying out the preparation before modeling; s2, creating a functional physical mapping model of the system; and S3, carrying out security analysis on the functional physical mapping model. By adopting the fault transmission analysis method based on the functional physical mapping model, the problem of repeated modeling work caused by separation of functional modeling and physical modeling is solved, a method for associating a system function with a physical architecture is provided, the efficiency of safety analysis work based on the model is improved, and the method is suitable for popularization and application. And the integrity and accuracy of hardware fault identification are ensured.