307 results about "Security context" patented technology

The invention relates to the technical field of network security, in particular to a dynamic access blocking method based on zero trust. Comprising the following steps: step 1, collecting whole network flow data in real time in a bypass monitoring mode through a flow mirroring function of a network switch, performing deep packet inspection analysis on the collected original flow data, and extracting network flow characteristic parameters; 2, maintaining a dynamic identity information base; 3, performing real-time behavior analysis on each network session; 4, according to the risk assessment result and the real-time security context, generating a dynamic access control strategy based on a minimum permission principle; 5, implementing access control at the network execution point; and 6, continuously monitoring the network flow and the strategy execution effect, collecting feedback data, optimizing the risk assessment model and the strategy generation algorithm based on the feedback data, and forming closed-loop control. By dynamically updating the identity and asset information, the system can identify new assets or changes in real time, so that the adaptability and response capability of a network environment are improved.

The invention discloses an AI interactive data protection method and system based on a security context protocol. According to the method, a client application sends a user request carrying a session identifier to an application gateway; the gateway queries a required context range and a security processing strategy according to the request type, and transmits a strategy instruction; after the SCS verifies the gateway permission, the context data is retrieved and processed according to the strategy instruction, and a security context data block is generated; the gateway assembles the user input and the security context data block into a final request according to an SCP protocol, and sends the final request to an AI model; the AI model processes the request and returns a response; after receiving the response, the gateway updates the session context and updates the stored context data; and finally, the gateway returns the response of the AI model to the client application to complete interaction. According to the method, the exposure of the sensitive context data in the system can be reduced to the greatest extent while the AI interaction effect is ensured, so that the data security and compliance of the AI application are improved.

In one embodiment, a method includes receiving a selection of a UI element from a UI and determining a context associated with the UI element. The method also includes receiving an inquiry associated with the UI element and communicating the inquiry and the context to one or more language models. The method further includes receiving, by the one or more language models, a response to the inquiry using the inquiry and the context.

A wireless transmit / receive unit (WTRU) may be configured to process first downlink data from a source cell using a first security context. The WTRU may receive, from the source cell, configuration information indicating one or more candidate cells for Layer 1 or Layer 2 (L1 / L2) triggered mobility (LTM). The WTRU may receive, from the source cell, a LTM indication to perform a handover (HO) to a candidate cell among the one or more candidate cells. The WTRU may determine a second security context associated with the candidate cell. The WTRU may process second downlink data based on the first security context. The WTRU may process third downlink data from the candidate cell using the second security context upon a determination that one or more of the conditions are met.

The invention discloses a mandatory access control method and device based on a process function context, and the method comprises the steps: collecting a security context associated with a system call initiated by a target process, so as to generate a standardized object description; mapping the object description into a target function classification identifier, so as to obtain a process function context view of the target process according to the target function classification identifier; constructing a target decision key for access decision based on the current policy era, the qualifier, the function classification identifier, the view identifier of the process function context view and the isolation domain abstract; and querying the multi-level cache according to the target decision key to determine a matched target access decision. Therefore, context-sensitive judgment and cross-component consistency taking the functional context as the center are realized.

The technology described herein, which can be incorporated into a bare metal as a service environment, is generally directed towards monitoring retrieving and analyzing security configuration stored on recovery partition storage (e.g., OEM partition drives), which can contain critical logs, error state data, and boot critical security data. A backend security policy engine enforces security context configuration policy data, including to prevent malicious attacks on the backend services. Bare metal in-band compute device health is monitored by an out-of-band network using telemetry data services. When an unrecoverable system state is detected, the out-of-band network activates the recovery partition storage for recording the system sensitive logs, debug data and error states, which is stored as encrypted per security policies. Security policy is enforced, including on system logs, to prevent data tampering and / or malicious attacks. A recovery scenario is performed to restore operation of the compute device.

An AMF receives, from a wireless device, a first registration request message for a first access path of an access type via a first access node. The AMF determines a common security context for the wireless device and sends, to the first access node, a first access stratum (AS) key, wherein the first AS key is based on a first value associated with the first access path and the common security context. The AMF receives, from the wireless device a second registration request message for a second access path of the access type via a second access node, and sends, to the second access node, a second AS key, wherein the second AS key is based on a second value associated with the second access path and the common security context.

The invention relates to the technical field of security protection, in particular to an API (Application Program Interface) security protection method based on anomaly detection, which comprises the following steps of: based on a received API request, analyzing the API request, extracting a request source network address and a target API calling instruction, and carrying out source authenticity verification and instruction validity judgment. According to the method, the initial security context is established by analyzing the source network address and the interface calling instruction of the API request in combination with the timestamp and the request type, so that the pre-modeling of the environment state of each request is realized, and the basic credibility of the request can be judged immediately before the request is subjected to deep business processing. On the basis, a sequence mode of the request load is combined with a parameter boundary for comparison, the behavior deviation degree is used as a reference item, interface sensitivity information in the context is introduced to complete quantitative judgment on the risk level, and a judgment result has dynamic adaptability and structural relevance.

Systems and methods for immutability assurance of backup data based on comprehensive threat detection. A method includes performing static and dynamic analysis of a process executing on a computing device, registering an operation of the process with a file on a storage communicatively coupled to the computing device, determining that the file in operation is a backup archive, collecting a context of the process, which includes at least a security context based on the static and dynamic analysis, and a backup archive context based on attributes of the backup archive, analyzing the process operation with the backup file using an access control machine-learning model that calculates an immutability rate based on the collected context, and granting or blocking the process access to the backup archived.

Embodiments include methods for a user equipment (UE) configured to communicate with a communications network via a first access network. Such methods include, without registering with the communications network. receiving from the communications network an authentication-related message that includes an identifier associated with the first access network and at least one of a temporary UE identifier and a security key identifier. Such methods include, based on the identifier, generating a first security key usable for establishing a secure connection with the first access network and establishing a secure connection with the first access network based on the first security key. Such methods include registering with the communications network based on the at least one of the temporary UE identifier and the security key identifier. Other embodiments include complementary methods for network nodes or functions (NNFs) of the communications network. as well as UEs and NNFs configured to perform such methods.

A method for privacy preserving data processing in a linked data operating environment wherein applications have secure and permissioned access in an interoperable manner to data that is stored in one or more online data stores. The method begins by creating a privacy preserving data processing (PPDP) agent for use by an entity to process the data in association with the online data stores. The PPDP agent is then subjected to a certification process that ensures that the PPDP agent does not exfiltrate any data from the online data stores. After a successful certification, and following registration of the agent with an agent repository, a secure PPDP environment is instantiated in association with the data stores and in which the PPDP agent is then configured to execute. The PPDP agent is then executed within the secure PPDP environment over a configured security context and life-cycle of the PPDP agent. At the close of the PPDP agent's life-cycle, or upon a given event, the PPDP agent is terminated and the PPDP environment is closed.

Systems and methods for USN monitoring via virtual tap is provided. A system may obtain, from a virtual tap, virtual network data packets associated with a first type of wireless communication protocol. The system may extract a first ID from the virtual network data packets. The system may query a first database associated with the first type of wireless communication protocol or a second database using a second type of wireless communication protocol using the first ID. The system may determine a second ID and a security context based on the query. The system may convert the security context from a first type to a second type of security context. The system may store the converted security context into a field based on the second ID.

This disclosure generally relates to securely pushing messages from an AF to a User Equipment (UE) in communication networks. Performed by a wireless device in a wireless network, the method includes receiving, from a first network element hosting an Application Function (AF), a message comprising one of: an AKMA (Authentication and Key Management for Applications) key identifier (ID) identifying an AKMA anchor key of the wireless device; or a set of parameters indicative of the AKMA key ID; and storing the AKMA key ID and an AF key associated with the first network element in a security context, wherein the first network element outside of a core network of the wireless network.

Systems and methods are disclosed for enhancing cryptographic security in 5G networks by addressing key management, algorithm selection, and security context consistency. One method ensures uniform cryptographic key lengths during Access and Mobility Function (AMF) changes, maintaining consistent Non-Access Stratum (NAS) security contexts across transitions. Another method focuses on dual connectivity scenarios, ensuring uniform cryptographic key lengths across Master Node and Secondary Node communications by defining a unified cryptographic profile and enhancing capability signaling. Additionally, an entropy-based approach to cryptographic algorithm selection is introduced, incorporating entropy assessment into the capability signaling process. This ensures that selected cryptographic algorithms for Access Stratum (AS) and NAS layers align with the actual entropy of long-term keys, providing true security levels.

Systems, methods, apparatuses, and computer program products are described for dual-access and multi-access to public land mobile networks (PLMNs) via vehicle-mounted relay (VMR) access and terrestrial access User equipment (UE) access can be supported by a VMR-UE and a terrestrial access node (gNB). UE can send an initial UE message including User Location Information (ULI) that indicates access type is VMR-Access. PLMNs can manage traffic using Access Type. UE can access a first PLMN via VMR-gNB Access and a second PLMN via Terrestrial New Radio (NR) Access using the same subscriber information. The two PLMNs can establish two different Non-Access Stratum (NAS) security contexts for UE. A packet data unit (PDU) overlay session can be established that is shared by the two PLMNs. Alternatively, each PLMN can establish a different NAS security context and PDU session without being aware of the other NAS security context and PDU session.

An electronic device, a method, and a computer program product provide authorization for a user to access functions and applications / application features of the electronic device while the device operates within a secure context and dynamically trigger second level authentication for the user to access secure device functions and applications / application features while the device is operating outside of a secure context. The method includes determining, by a controller of the device, whether the device is being operated in a secure context from among (i) operating within a trusted location and (ii) operating while communicatively connected to a trusted second device. The method includes, in response to determining that the device is not operating in the secure context, activating a second level authentication function that prevents automatic access and requires an additional level of user authentication for access to at least one of specific device operating functions and pre-selected applications / application features.

The invention provides a communication method and a communication device, and the method comprises the steps that a terminal device sends a registration request message which is used for requesting to register to a network, and under the condition that authentication between the terminal device and the network is passed, the terminal device and a network element activate a security context which is used for protecting secure communication between the terminal device and the network element. And under the condition that the operation requester requests to execute the first operation on the terminal equipment, executing the first operation by skipping the NAS SMC process or transmitting the operation instruction type in executing the NAS SMC process. According to the technical scheme of the invention, under the condition of ensuring secure communication, the whole service process is simplified, the processing complexity is reduced, and the processing time delay is reduced.

The invention provides a secure communication connection establishment method, a data transmission method, a device and equipment, which can be used in the field of communication. According to the scheme, the system comprises a management node with a built-in encryption card and a terminal node. Wherein key negotiation algorithms different from those of the two nodes are configured in the encryption card. Firstly, a terminal node selects a key negotiation algorithm shared with a notification message broadcast by a management node as a target key negotiation algorithm by means of an encryption card based on a communication message broadcast by the management node, and sends an association request message to the management node. The management node and the terminal node then make a request and response of a security context message between the management node and the terminal node. And finally, after the integrity verification and the parameter verification are passed, establishing secure communication connection between the management node and the terminal node, and performing subsequent secure data transmission. According to the technical scheme, the whole process of key negotiation is completed by means of the built-in encryption cards in the management node and the terminal node, so that special requirements of users are met.

The embodiment of the invention provides a method and device for allowing an application to access a system resource, and a terminal. The method includes: acquiring an operation control request of anapplication; determining a user environment where the application is about to operate according to the operation control request of the application; acquiring a safe context corresponding to the userenvironment from a plurality of preconfigured safe contexts in a system, wherein the plurality of preconfigured safe contexts in the system are corresponding to different user environments respectively, and system resource access rights corresponding to the plurality of preconfigured safe contexts are different from each other; and performing access processing on the system resource according to the system resource access right corresponding to the safe context corresponding to the user environment. The scheme can perform application behavior control on the same application under different users.

A communication method and a related device are applied to the technical field of communication. A second management node in the embodiment of the invention can receive a security communication parameter from a first management node, wherein the security communication parameter comprises a parameter used when the first management node is in communication connection with a terminal node and is associated with a security context of the terminal node. And the second management node performs an association operation with the security context with the terminal node according to the security communication parameter. Thus, the second management node can directly or indirectly use the communication security parameter to ensure the security of the interactive information in the association operation, on one hand, when the second management node and the terminal node perform the association operation, the second management node does not need to negotiate the security context with the terminal node again, signaling interaction is reduced, and the association time delay is reduced. And on the other hand, re-determination of security communication parameters, negotiation of security context and the like are not needed, the calculation amount of the terminal node and the second management node is reduced, and the time delay of connection establishment is further shortened.

The invention discloses a USB access safety control system, and particularly relates to the field of USB access electric digital data processing, which comprises an identification module, an isolation module, an encryption continuous transmission module, an auditing module and a kernel interrupt signal triggered by USB physical insertion, and the identification module is used for receiving the kernel interrupt signal and writing the kernel interrupt signal into the interrupt event buffer area, generating a to-be-analyzed interrupt data group, analyzing and generating identification notification information and pushing the identification notification information as a USB access snapshot data frame. Strong binding of USB device access identities, interval control of permission states and traceable closed management of behavior tracks are achieved by constructing a security context vector with device fingerprints, authorization group IDs and insertion timestamps as cores and forming a dynamic association verification path among isolation state judgment, behavior integrity measurement and chain audit account books. The key problems of equipment loopback cheating, permission mismatching, audit failure and the like are solved.

An apparatus, method and computer-readable media are disclosed for performing wireless communications. For example, a process for wireless communications can include transmitting, to an identity and routing service, a service registration request, wherein the service registration request includes a service identifier for the network service, wherein the network service is separate from the identity and routing service; receiving, from the identity and routing service, a first temporary service identifier (TSID) for the network service; allocating a first temporary device identifier (TUID) to a device; and transmitting the first TSID and first TUID to the device for a first security context.

Up front authorization of a workflow and a security context for workflow execution are disclosed. All possible authorizations that may be required by a workflow definition are identified up front. A requestor is allowed to execute the workflow only when the authorizations of the user include the authorizations that may be required by the workflow. An immutable security context is generated and associated with the workflow or an instance thereof. The immutable security context can prevent or reduce failures associated with changes to a requestor's authorizations and may also scope or limit the workflow to at least the type or capacity of work requested and / or work uniquely identified in the security context. The immutable security context is managed in a security context that is separate and independent of the workflow execution context.

The invention discloses a development board Linux system security authentication multi-start method, which comprises the steps of 1, hardware trust root initialization and storage area division, 2, hardware trust root self-inspection and measurement, 3, starting item dynamic loading and multi-stage authentication, 4, security context establishment and system switching, and 5, multi-system isolation and collaboration. Step 6, performing security audit and exception handling; full-link authentication is realized by taking a hardware trust root as an anchor point, malicious mirror startup and inter-system data leakage are effectively resisted in combination with a storage and resource isolation mechanism, scenes such as on-demand dynamic switching, flexible adaptation debugging, upgrading and fault recovery of multiple systems can be realized, and the system reliability is improved by optimizing the lightweight design of an authentication algorithm and resource management. Limited computing power of the development board is adapted, the starting process and abnormal events can be completely recorded, and illegal operation can be traced conveniently.

An apparatus, method and computer-readable media are disclosed for performing wireless communications. For example, a process for securely accessing a service, can include: receiving, by a security service from a service, a request for a service key for accessing the service, the request for the service key including an indication to use a user plane security anchor (UPSA); transmitting, from the security service in response to the request for the service key, a service key response including the service key; receiving an indication for a UPSA key, the indication including an identifier for a UPSA for the service; generating the UPSA key based on the identifier for the UPSA; and transmitting the generated UPSA key to the UPSA for establishing a user plane security context between the UPSA and a wireless device.

The invention provides a Web workflow system and method based on JSON data analysis, and relates to the technical field of workflow design. A standardized JSON process definition file is generated by adopting a visual process designer, process semantic verification and BPMN conversion are realized through a three-level analysis architecture, and efficient management of the whole process of process modeling, execution and auditing is realized in combination with a plug-in task executor, a thread security context manager and a process monitoring module, so that the process modeling, execution and auditing efficiency is improved. The method has the advantages of fast analysis, strong expansion, easy collaboration, traceability and the like.

The invention relates to the technical field of communication, and discloses a communication method and device. The method comprises: a terminal device sending a first de-registration request message to a network device, and receiving a security mode command message from the network device, the security mode command message being used for starting a first security context; sending a response message of the security mode command message to the network device according to the security mode command message, and enabling the first security context; receiving a response message of the first de-registration request message from the network equipment; according to the present NAS security context (the first security context) and the non-present NAS security context (the second security context), integrity protection verification is attempted to be performed on the response message of the de-registration request message, so that it is convenient to ensure that the terminal device completes de-registration under the condition that the security mode control process conflicts with the de-registration process.

The invention provides a hybrid encryption method and device and a storage medium, and the method comprises the steps: a client generates a short-term SM2 key pair and exchanges with a server after obtaining a long-term SM2 key pair and a server public key, dynamically generates a session SM4 symmetric key through an SM2 key exchange protocol, and finally achieves the data transmission and response processing through the session SM4 symmetric key. Through the implementation of the scheme of the invention, the client not only establishes the basic trust relationship based on the long-term SM2 key pair, but also generates the short-term SM2 key pair during each service request, and dynamically derives a unique session SM4 symmetric key and an initial vector by cooperatively executing the SM2 key exchange protocol with the short-term key of the server. And each request has an independent security context, so that the decryption risk after the session key is reused or stolen is fundamentally prevented, and the end-to-end dynamic security communication under the national secret system is really realized.

An information handling system has a storage device including a telemetry log, a BIOS configured to provide BIOS status data and BIOS security data, an OS configured to provide OS status data and OS security data, and a security management module. The security management module determines whether the information handling system is in a low-threat state or a high-threat state. When the information handling system is in the low-threat state, the security management module directs the BIOS to store the BIOS status data to the telemetry log and the OS to store the OS status data to the telemetry log. When the information handling system is in the high-threat state, the security management module directs at least one of the BIOS to store the BIOS security data and the OS to store the OS security data.

Up front authorization of a workflow and a security context for workflow execution are disclosed. All possible authorizations that may be required by a workflow are identified up front. A requestor is allowed to execute the workflow only when the authorizations of the user include the authorizations that may be required by the workflow. A security context is generated and associated with the workflow or an instance thereof. The security context scopes or limits the workflow to at least the type or capacity of work requested, work uniquely identified in the security context, and / or service / workflow / call paths that the request is allowed to be processed through.