126 results about "Security association" patented technology

Systems and methods support collection of telemetry by an Information Handling System (IHS). A policy decision point of a zero-trust computing environment controls access to protected resources and receives an indication of attack related to the IHS. A telemetry definition is identified that specifies telemetry being collected by the IHS and it is updated to specify a security delay for telemetry related to the indication of attack. The updated telemetry definition is transmitted to the IHS. Upon identifying telemetry that is ready for transmission, the IHS determines whether the telemetry is subject to a security delay specified in the updated telemetry definition. When the telemetry is subject to a security delay, the telemetry that is ready for transmission is queued and transmitted to one or more destinations specified in the updated telemetry definition upon expiration of the security delay.

Example methods and systems for flow-based secure packet forwarding are described. In one example, a first computer system may assess validity of a security token associated with a flow of one or more packets. In response to determination that the security token is valid, a security association associated with the flow and the security token may be negotiated with a second computer system. The first computer system may process a packet associated with the flow and the security token to generate an encapsulated encrypted packet by performing encryption and encapsulation based on the security association. The encapsulated encrypted packet may be forwarded towards the second computer system to cause the second computer system to perform decapsulation and decryption, and to forward a decapsulated and decrypted packet towards the destination.

Embodiments include methods for a first node to manage rekeying of a security association (SA) between the first node and a second node in a communication network. Such methods include sending to the second node a request indicating a rekey priority of the first node, and receiving from the second node a response indicating a rekey priority of the second node. Such methods also include selectively initiating rekeying of the SA between the first node and the second node based on the request and the response. Other embodiments include complementary methods for the second node, as well as nodes (e.g., hosts, gateways, UEs, base stations, servers, etc.) configured to perform such methods.

The invention provides a cross-platform user behavior analysis method and system based on transfer learning, and relates to the technical field of network security, first, historical network behavior record data of a source domain security platform and real-time network behavior flow data of a target domain security platform are obtained, the historical network behavior record data comprise security behavior sequences of source domain users in different access scenes, and the real-time network behavior flow data are stored in the target domain security platform; the method comprises the following steps of: performing cross-domain security feature extraction on two types of data, constructing a cross-domain security behavior association graph, migrating source domain historical malicious behavior mode knowledge to a target domain through a migration learning model based on the graph, generating cross-platform migration security features, and performing cross-domain security feature extraction on the target domain historical malicious behavior mode knowledge. And calling a security behavior analysis model to carry out joint modeling and time sequence security association analysis, identifying an abnormal security behavior mode of a target domain user, and finally matching a network security disposal rule base according to the abnormal mode, generating and issuing a protection strategy, and realizing real-time risk interception.

One feature pertains to a method for secure wireless communication at an apparatus of a network. The method includes receiving a user equipment identifier identifying a user equipment and a cryptographic key from a wireless wide area network node, and using the cryptographic key as a pairwise master key (PMK). A PMK identifier (PKMID) is generated based on the PMK and the two are stored at the network. A PMK security association is initialized by associating the PMK with at least the PMKID and an access point identifier identifying an access point of the apparatus. An association request is received that includes a PMKID from the user equipment, and it's determined that the PMKID received from the user equipment matches the PMKID stored. A key exchange is initiated with the user equipment based on the PMK to establish a wireless local area network security association with the user equipment.

Disclosed embodiments implement rekeying keys of a Security Association (SA) using an SPI Transform to provide secure data transfer in a computing environment. A disclosed method comprises detecting, by a local key manager (LKM) executing on a computing node, an expired rekey timer of an SA between an initiator channel on the computing node and a responder channel on a responder node. The LKM requests, based on the expired rekey timer, an SA Index from the initiator channel on a computing node. The LKM creates an SPI based on an SPI Transform using the new SA Index and SPI Transform values. The LKM builds an SKE SA Initialization Request message based on an authentication key of the SA and the SPI to obtain a new session key.

A method and apparatus are provided for automatically distributing pre-shared keys (PSKs) in a secure communication network. A first security association (SA) or secured message (SM) is created between two endpoints based on a first PSK. Then, one or more subsequent PSKs are distributed between the endpoints with secure communication support by the first SA or SM. Based on one of the subsequent PSKs, a second security association is formed between the endpoints. Messages between the endpoints can then be transmitted with secure communication support by the second SA or SM.

In some implementations, a first network device may communicate, with a second network device, one or more internet key exchange (IKE) messages to exchange a first identifier associated with the first network device and a second identifier associated with the second network device, and to indicate that a post-quantum preshared key (PPK) is to be used as a shared key for an IKE security association (SA) between the first network device and the second network device. The first network device may obtain, from a key management entity (KME), a quantum key based on providing the second identifier to the KME, wherein the PPK is based on the quantum key. The first network device may communicate, with the second network device, one or more IKE authentication messages to exchange a third identifier associated with the quantum key and to confirm that the second network device successfully obtained the PPK.

A system and method are provided for generating a pairwise transient key security association (PTKSA) by: providing a first media access control (MAC) address that is shared by multiple access points (APs), the first MAC address corresponding to an infrastructure comprising the multiple APs, and each AP of the multiple APs having a respective AP MAC address; providing a second MAC address to a station (STA); and establishing a secure link between the STA and the infrastructure using the first MAC address and the second MAC address to derive a pairwise transit key (PTK) for the secure link, wherein the secure link is between the STA and the multiple APs.

The invention discloses a high-speed IPSec gateway optimization method and device based on combination of a VPP and an FPGA, and the method comprises the steps: receiving a data packet from a network card drive program through a VPP processing module in a CPU, and carrying out the primary processing; the VPP processing module identifies the data stream processed by the IPSec to form a target data packet; the VPP processing module triggers an IKE daemon process according to a security policy matching result, performs IKE negotiation and creates data transmission security association; the VPP processing module preprocesses a target data packet needing to be encrypted and decrypted and transmits the target data packet to the FPGA through the 10-gigabit network card chip / PCIe channel; the FPGA carries out encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the target data packet, and returns the processed target data packet to the CPU; and the CPU performs recombination processing according to the fragmentation state of the target data packet, and forwards the target data packet to the application program for subsequent processing. According to the invention, the problems of performance bottleneck and security of the existing IPSec gateway equipment are solved, and an efficient and safe data encryption and decryption solution is provided.

This invention provides a cross-platform user behavior analysis method and system based on transfer learning, relating to the field of network security technology. First, it acquires historical network behavior records from a source domain security platform and real-time network behavior stream data from a target domain security platform. The former includes security behavior sequences of source domain users under different access scenarios, while the latter includes dynamic security operation records of the target domain user's current session. Next, it extracts cross-domain security features from both types of data to construct a cross-domain security behavior association graph. Based on this graph, it uses a transfer learning model to transfer historical malicious behavior patterns from the source domain to the target domain, generating cross-platform transferred security features. Then, it calls a security behavior analysis model for joint modeling and temporal security association analysis to identify abnormal security behavior patterns of target domain users. Finally, it matches the abnormal patterns with a network security handling rule base to generate and distribute protection policies, achieving real-time risk interception.

This disclosure describes systems, methods, and devices related to KEK frame encryption. A device may identify, within a received authentication frame, a capability bit in a Robust Security Network Extension Element (RSNXE) indicating peer device support for Key Encryption Key (KEK) derivation during an authentication frame exchange. The device may derive the KEK during the authentication frame exchange based on mutual support for KEK derivation and derivation of a Pairwise Transient Key Security Association (PTKSA) during the exchange. The device may use a cryptographic key protection process for deriving the KEK. The device may encrypt a portion of the authentication frame using the derived KEK.

The invention relates to the technical field of network security, in particular to a network security situation awareness method and system based on a large model and threat assessment. The method comprises the following steps: firstly, acquiring and standardizing multi-modal security data in a cloud service environment in real time, distributing a behavior modal cluster for security event metadata through clustering analysis, and generating a security feature vector containing business semantics and behavior dynamic features based on a cluster center relocation technology; then constructing a local situation map reflecting asset topology and an access link by using a cloud security association model; semantic reasoning is performed on the atlas through a large language model, an attack intention is recognized, and an attack path is predicted; and finally, combining the path probability, the asset value and the vulnerability feature to quantitatively calculate a risk index, and automatically generating a response strategy. Semantic compression of massive logs is realized through modal clustering, and the calculation bottleneck of processing original data by a large model is overcome; and in combination with graph correlation and large model reasoning, the crossing from passive warning to active intention prediction is realized.

Disclosed embodiments implement rekeying keys of a Security Association (SA) using an SPI Transform to provide secure data transfer in a computing environment. A disclosed method comprises detecting, by a local key manager (LKM) executing on a computing node, an expired rekey timer of an SA between an initiator channel on the computing node and a responder channel on a responder node. The LKM requests, based on the expired rekey timer, an SA Index from the initiator channel on a computing node. The LKM creates an SPI based on an SPI Transform using the new SA Index and SPI Transform values. The LKM builds an SKE SA Initialization Request message based on an authentication key of the SA and the SPI to obtain a new session key.

In an embodiment, a method includes transmitting an initiation request from a first electronic device to a second electronic device, the initiation request being associated with a notification that the first electronic device is capable of early detection of duplicate security associations (SAs), receiving an initiation request from the second electronic device at the first electronic device, the initiation request being associated with a capability notification that the second electronic device is capable of early detection of duplicate SAs, determining a possibility of duplicate SAs by the first electronic device, transmitting responses configured to prevent duplicate SAs from the first electronic device to the second electronic device, receiving responses at the first electronic device from the second electronic device, wherein the responses indicate no duplicate SAs created by the second electronic device, and establishing a non-duplicate SA for the first and second electronic devices.

The invention relates to a sensitive data security association analysis method and device based on security multi-party computing. The method comprises the following steps: creating a plurality of roles and endowing the roles with permissions; identity authentication and authorization management between participants are realized; establishing a secure communication tunnel for the participant; sensitive data of participants are encrypted, and the data are partially decrypted only in a predefined calculation process; and capturing and recording data access and processing behaviors. According to the invention, after the identity authentication of each participant carrying out data association analysis is successful, the secure communication tunnel is established for the participant, the sensitive data of each participant is encrypted, and the necessary data is partially decrypted only in the predefined necessary calculation process. And meanwhile, the audit tracking system captures and records data access and processing behaviors, so that the privacy of each party is protected when multiple participants carry out data association analysis, the sensitive data is prevented from being leaked, and the effect of improving the security of sensitive data association analysis is achieved.

A method for providing, in a computer connected via a network to a 5G core network, a security gateway function is provided. The method includes connecting the security gateway function to the 5G core network via a non-3GPP access network, registering the security gateway function with the non-3GPP access network, establishing a secure tunnel between the security gateway function and the 5G core network, obtaining authentication keys and security association keys for the security gateway function from the 5G core network, and establishing user plane and control plane connectivity between the security gateway function and the 5G core network. The security gateway function is configured to establish a secure connection to an external device coupled to the computer.

In an embodiment, a method includes transmitting an initiation request from a first electronic device to a second electronic device, the initiation request being associated with a notification that the first electronic device is capable of early detection of duplicate security associations (SAs), receiving an initiation request from the second electronic device at the first electronic device, the initiation request being associated with a capability notification that the second electronic device is capable of early detection of duplicate SAs, determining a possibility of duplicate SAs by the first electronic device, transmitting responses configured to prevent duplicate SAs from the first electronic device to the second electronic device, receiving responses at the first electronic device from the second electronic device, wherein the responses indicate no duplicate SAs created by the second electronic device, and establishing a non-duplicate SA for the first and second electronic devices.

A system and method for generating a pairwise transient key security association (PTKSA) is provided, including providing a first media access control (MAC) address shared by a plurality of access points (APs), the first MAC address corresponding to an infrastructure including the plurality of APs, and each AP of the plurality of APs having a respective AP MAC address; providing the second MAC address to a station (STA); and establishing a secure link between the STA and the infrastructure using the first MAC address and the second MAC address to derive a pair-to-pair transmission key (PTK) for the secure link, where the secure link is between one or more of the plurality of APs and the STA.

The present application discloses a communication data transmission method, device, equipment and storage medium, which relates to the field of information security technology, including: sending the first security alliance load determined based on the pre-quantum cryptographic algorithm, the post-quantum cryptographic algorithm and the hybrid mode recommended load to the responder through the initiator, so that the responder can send the second security alliance load; if it is a spliced ​​hybrid mode, the pre-quantum double certificate and the post-quantum double certificate are sent to the initiator through the responder, and if it is a nested hybrid mode, the pre-quantum and post-quantum hybrid double certificates are sent to the initiator through the responder; the identity authentication of the two communicating parties and the generation of the target key parameters are performed, and after the authentication is successful, the target key parameters are verified; if the verification is successful, the key exchange is performed based on the target key parameters and the post-quantum cryptographic algorithm, the session key is determined, and the communication data transmission is performed according to the security message protocol and the session key. The quantum security enhancement of the national secret Internet security protocol is realized.

This disclosure describes systems, methods, and devices related to using pairwise master key security association (PMKSA) caching for authentication and time synchronization factor security. A method may include sending a first message of an 802.1X authentication frame exchange, including an indication of a first pairwise master key identifier (PMKID) associated with one or more PMKSA identifiers; identifying a second PMKID indicated in a second message of the 802.1X authentication frame exchange, received from a responder device; determining that second PMKID matches the first PMKID; storing a PMKSA identifier corresponding to the second PMKID; and sending an association request frame to the responder device based on determining that the second PMKID matches the first PMKID, wherein the association request frame is sent in succession with receiving the second message of the 802.1X authentication frame exchange.

Techniques for utilizing post-quantum pre-shared key (PPK) identifiers (PPK_ID) to determine control association key(s) (CAK(s)) and / or secure association key(s) (SAK(s)) utilized in MACsec sessions are described herein. A key server (KS) and a non-key server (NKS) may advertise capabilities indicating an ability to utilize PPKs as CAKs and / or SAKs in MACsec sessions. The KS may leverage a quantum key distribution (QKD) service to determine a PPK_ID and a PPK, which may be utilized as a CAK for a MACsec session with the NKS. The PPK_ID may be transmitted to the NKS, where the NKS may retrieve the PPK from the QKD, and a new group connectivity association may be established using the PPK as the CAK. In some examples, the KS may be configured to refresh the PPK as the CAK for instantiating subsequent MACsec sessions. Additionally, the KS may be configured to distribute a SAK in a similar manner.

The embodiment of the invention provides a wireless communication reconnection method and device, equipment and a storage medium, and is applied to the technical field of wireless communication. The method comprises the following steps: a wireless client sends a detection request frame to an access point, the detection request frame comprising a first state flag bit, and the first state flag bit is used for inquiring whether the access point saves a key session association (PMKSA); the access point receives the detection request frame, generates a detection response frame based on the detection request frame and sends the detection response frame to the wireless client, the detection response frame comprises a second state flag bit, and the second state flag bit is used for indicating whether the access point stores the PMKSA; the wireless client judges whether the access point stores the PMKSA or not according to the detection response frame; when the access point stores the PMKSA, initiating a connection request to the access point according to the PMKSA; and when the PMKSA is not stored in the access point, initiating an authentication request to the access point, and initiating a connection request to the access point after the authentication is passed. The method can improve the success rate and efficiency of wireless communication reconnection.

The storage port receives a login request. The storage port configures the audit mode indicator as enabled in the login response to the host port to enter the enabled security mode and indicates to the host port that input / output (I / O) operations will be sent from the host port to the storage port even if the authentication or security association negotiation with the storage port cannot be successfully completed.

The present invention discloses a local area network (LAN) and data security-based office equipment rental management method and system. The method includes responding to office equipment rental requests from rental terminals, obtaining equipment loss rates and network behavior security scores from historical rental behaviors; parsing the target device model and required quantity in the rental request when both meet preset conditions; monitoring the LAN online status and resource occupancy rate of the target device in real time to calculate the available inventory of the target device; when the available inventory is lower than the required quantity, matching security-associated devices of the same type as the target device in the LAN device registry to calculate the device replacement security index; generating a device replacement policy when the index is greater than a security baseline, signing the policy with a digital certificate, and issuing it to the rental terminal. The system generates a target rental plan by requesting the device replacement policy in response to the rental terminal. The present invention improves the data security and response speed of rental services, and increases the utilization rate of equipment resources and the transaction rate of rental business.

The invention relates to the technical field of security and protection, and discloses a hospital security and protection management system based on the Internet of Things, and the system comprises a fixed sampling module which obtains the safety parameter data of a designated position; the movable sampling module is used for acquiring security association data near the movable mechanism; the communication unit, the risk analysis center, the safety management center and the early warning strategy center analyze the air condition in a hospital by obtaining safety parameter data of a fixed position and movably obtaining safety association data, traceability is carried out by utilizing a movable sampling module when potential risks are found, and the safety of the hospital is improved. And finally, a corresponding early warning security strategy is executed, so that the reliability of hospital security and protection is fully improved.

One example method includes receiving, at a first computing system from a secure association (SA) service, a first event that indicates that a first SA encryption tunnel has been generated that includes the first computing system, the first SA encryption tunnel including encryption and decryption keys assigned to an IP address of the first computing system. In response to receiving the first event, requesting from the SA service a first SA encryption tunnel list that lists all SA encryption tunnels existing in a computing environment. Comparing the first SA encryption tunnel with the SA encryption tunnels included in the first SA encryption tunnel list. Based on the comparison, determining whether the first SA encryption tunnel is a duplicate of one or more of the SA encryption tunnels included in the first SA encryption tunnel list.

An electronic device may include at least one wireless communication module configured to transmit and receive a wireless signal; a memory electrically configured to store instructions; and at least one processor operatively connected to the at least one wireless communication module and the memory, the at least one processor being configured to execute the instructions to: based on an attempt to connect to an access point (AP), identify whether a pairwise master key security association (PMKSA) for the AP, generated based on to a previous connection of the electronic device to the AP, is present, and based on identifying that the PMKSA is present, determine whether to reuse a pairwise master key (PMK) stored in the PMKSA by comparing a lifetime of the PMK with a margin time in which a use of the PMK is guaranteed.

The present application relates to a method and apparatus for secure association analysis of sensitive data based on secure multi-party computing, comprising the steps of: creating several roles and granting permissions; implementing identity authentication and authorization management between participants; establishing a secure communication tunnel for the participants; encrypting the sensitive data of the participants, and partially decrypting the data only during predefined computing processes; and capturing and recording data access and processing behaviors. The present application establishes a secure communication tunnel for each participant in data association analysis after successful identity authentication, encrypts the sensitive data of each participant, and partially decrypts the necessary data only during predefined required computing processes. At the same time, an audit tracking system is used to capture and record data access and processing behaviors. This protects the privacy of each party when multiple parties conduct data association analysis, prevents the leakage of sensitive data, and improves the security of sensitive data association analysis.

Methods and apparatus for dynamic adaption of anti-replay window (ARW) management with enhanced security. According to aspects of the method, pre-ARW block employing a pre-ARW sliding window and an ARW block employing an ARW sliding window are maintained for an associated IPsec security association (SA). A determination is made to whether a received packet passes a pre-ARW check using the pre-ARW sliding window. When it does, the pre-ARW sliding window is advanced, encrypted content in the packet is decrypted, and processing is forwarded to the ARW block which performs an ARW check and advances the ARW sliding window when the ARW check is passed. Packets that do not pass the pre-ARW check may be buffered in queues and subsequently rechecked against the ARW sliding window. Under solutions provided herein, ARW checks and updates are decoupled from the decryption processes, enabling decryption to be performed in parallel and / or offloaded to a hardware accelerator.