579 results about "Security function" patented technology

The invention belongs to the field of network security, and relates to a trusted management and control network platform construction method and device, electronic equipment and a storage medium, the method comprises the following steps: constructing a basic security architecture and a trusted base, the basic security architecture being used for providing a unified root of trust and a management core for collaborative operation of upper security components; based on the basic security architecture and the trusted base, implementing multi-dimensional trusted verification and dynamic access control; an intelligent boundary protection and depth detection system is deployed and is used for constructing an intelligent, three-dimensional and self-adaptive security defense line at the boundary of each region of the network, and various known and unknown threats can be identified and blocked; constructing a unified secure communication tunnel and a cross-domain transmission guarantee; defining and realizing a standardized security function interface and a collaboration protocol; and a continuous trust evaluation and automatic operation management and control closed loop is established. The overall security is enhanced, the secure transmission of data is ensured, the compatibility and collaboration of the system are improved, and the security operation intelligence is realized.

Some embodiments enhance the security of domain name resolution and other DNS operations, by automatically intercepting the DNS operation, determining an associated device identity or ascertaining an associated user identity, and enforcing a security policy based on at least the DNS operation and based on at least one of the identities. Some securable DNS operations include resolution requests, reverse lookups from IP addresses to domain names, DNS record accesses, mail server mappings, redirection, forwarding, and DNS record cache operations. Enforcing the policy includes, e.g., preventing a result requested by the DNS operation, permitting computational progress toward the requested result, allowing a different result, modifying a DNS record, or flushing a DNS record from a cache. In some embodiments, DNS operation security functionality utilizes or implements a conditional access security functionality, thereby providing, e.g., a secure conditional domain name resolution.

A process includes determining, by a recommendation engine, a security risk profile for a container environment. The container environment includes a plurality of pods that are to be deployed on an infrastructure that includes a plurality of nodes. Determining the security risk profile includes determining an infrastructure context characterizing the infrastructure and determining a workload context characterizing a workload associated with the container environment. The process includes determining, by the recommendation engine, a recommendation of a security policy for the container environment based on the security risk profile. The security policy includes a security control. The process includes deploying an agent to the infrastructure to manage compliance of the container environment with the security control.

Embodiments of the present disclosure may provide a data clean room allowing secure data analysis across multiple accounts, without the use of third parties. Each account may be associated with a different company or party. The data clean room may provide security functions to safeguard sensitive information. For example, the data clean room may restrict access to data in other accounts. The data clean room may also restrict which data may be used in the analysis and may restrict the output. The overlap data may be anonymized to prevent sensitive information from being revealed.

A security platform architecture is described herein. The security platform architecture includes multiple layers and utilizes a combination of encryption and other security features to generate a secure environment.

In some implementations, a system includes a set of servers configured to establish a set of virtual machines to provide a computing environment; a set of compute express link (CXL) interface components configured to communicate with the set of servers via a set of CXL interconnects; and a controller configured to at least one of: encrypt protocol data against a CXL interposer security threat associated with the set of CXL interconnects or a malicious extension security threat, provide a secure handshake verification of an identity of the set of CXL interface components, enforce a chain of trust rooted in hardware of the set of CXL interface components; restrict access to an area of memory of the set of CXL interface components that stores security data for verified or secured processes; or perform a security check and set up a set of security features of the set of CXL interface components.

Systems and methods of handling sessions between client devices and one or more server based on session classifications are provided. A device identifies a time series of security metrics corresponding to requests received during a session established by a client device to access a resource provided by one or more servers. The device generates security features from the time series of security metrics based on one or more time windows. The device classifies the session as one of anomalous or genuine using the security features generated from the time series of security metrics based on the one or more time windows. The device handles subsequent requests received during the session based on the classification of the session as the one of anomalous or genuine.

The invention relates to the technical field of CPU card security chips, and discloses a low-power-consumption design method and system for a CPU card security chip, and the method comprises the steps: carrying out the current waveform sampling of a secret key storage region, an encryption operation unit and an identity authentication processor of the CPU card security chip, recording current data when the CPU card security chip executes data encryption, identity authentication and security calculation to obtain a feature parameter set of the security function module; establishing an encryption operation power consumption model and an identity authentication power consumption model, and obtaining power consumption characteristic matrixes under different key lengths through piecewise linear fitting; classifying the security application tasks to obtain a multi-level security task classification table; according to the multi-level security task classification table, a differential power consumption attack protection strategy is executed, the working voltage and frequency configuration sequence of each security function module is calculated, the optimal balance of power consumption and performance is achieved under different key lengths, and the comprehensive performance of the CPU card security chip is improved.

The invention relates to the technical field of network organization, and provides a monitoring network organization method, device and equipment, a program product and a storage medium. The method comprises the following steps: obtaining optimal positions and optimal connection paths of a plurality of target monitoring nodes in a monitoring network based on a target path search algorithm; adjusting the current positions and the current connection paths of the plurality of target monitoring nodes based on the optimal positions and the optimal connection paths; the target path search algorithm is determined based on a target pheromone updating algorithm and a target path security updating algorithm, and the target pheromone updating algorithm updates the pheromone concentration based on real-time feature data of a monitoring target and a monitoring environment; the target path security update algorithm updates the security function value of the path based on the real-time feature data of the path obstacle. According to the invention, the position of the monitoring node and the connection path can be rapidly adjusted when facing real-time changes of the monitoring target, the monitoring environment and the path obstacle, and the monitoring effect is improved.

Various systems and methods implement a decision architecture for autonomous systems. An autonomous system framework includes a safety ring configured to interface with safety features of an autonomous system; a security ring configured to provide authentication and verification services to transactions passed through the security ring; a privacy ring configured to ensure privacy of a user of the autonomous system; a trustworthiness ring configured to log and provide transparency of transactions passed through the trustworthiness ring; and a well-being ring configured to interface with the user and provide feedback and information to the user on a state of the autonomous system, wherein: each of the safety, security, privacy, trustworthiness, and well-being rings include at least one interface to at least one other of the safety, security, privacy, trustworthiness, and well-being rings.

This disclosure describes techniques for distributing security service by performing security policy-based routing among network devices. The techniques include determining a security function to be applied to a packet of a data traffic flow. The security function may be determined based on a security policy and an intended destination of the packet. The techniques may also include determining whether a network device is capable of performing the security function. A route for the packet to the destination may be determined based on whether the network device is capable of performing the security function. As such, distributing security service techniques may improve efficiency in data traffic routing, and may reduce cost and / or prevent redundancy in security service application.

A method for determining a user plane security algorithm, a system, and an apparatus. The method may include: a second device selects a non-null user plane confidentiality protection algorithm based on a security capability of a first device and a security capability of the second device in a case in which user plane confidentiality protection between the second device and the first device is enabled and control plane confidentiality protection between the second device and the first device is not enabled. The second device sends a first message to the first device. The first message includes first algorithm indication information indicating the user plane confidentiality protection algorithm. Therefore, the first device can obtain the non-null user plane confidentiality protection algorithm. Embodiments can be adopted to determine an effective user plane confidentiality protection algorithm, for confidentiality protecting user plane data.

Negotiating security mechanisms (300) between user equipment and a network. In an embodiment, an access and mobility management function (212) is operatively coupled to user equipment (106). The access and mobility management function comprises a means (1504) for identifying security capabilities of the user equipment in supporting one or more non-access stratum combined integrity and encryption algorithms (1050), a means (1504) for selecting a non-access stratum combined integrity and encryption algorithm from the one or more non-access stratum combined integrity and encryption algorithms to protect non-access stratum signaling, and a means (1502) for sending a non-access stratum security mode command message (2312) to the user equipment indicating the non-access stratum combined integrity and encryption algorithm.

One example includes a security device system. The system includes a constrained environment housing and operational components configured to implement a security function. The system further includes an integrated circuit (IC) configured to implement a 256-bit Advanced Encryption Standard (AES-256) encryption algorithm, the IC comprising fewer than 5,000 gate equivalents and operating at a power of less than 1.5 microwatts to be accommodated in the constrained environment housing.

Document (100) with a security feature, comprising: a first substrate layer (103) having a first substrate layer region (105), wherein the substrate layer region (105) is impregnated with a black fluid over the entire thickness of the first substrate layer (103), the black fluid having carbon particles; a second substrate layer (107) with a second substrate layer region (109), wherein the second substrate layer (107) is arranged above the first substrate layer (103), the second substrate layer region (109) having a light reflection characteristic which differs from a light reflection characteristic of the first substrate layer region (105), wherein the first substrate layer region (105) and the second substrate layer region (109) form a composite security feature.

A data lake for enterprise security is created from an asynchronous stream of security events by deduplicating objects and creating metadata related to downstream security functions. Deduplication of objects may be efficiently performed with a bloom filter as objects are ingested into the data lake. The objects may also be augmented with metadata arranged in schemas to facilitate monitoring and use within the data lake.

A boot process for a computing device, such as integrated circuit, includes security features that are inaccessible during certain operation modes. An image including permission to access those security features is received during the boot process and may be verified using one or more keys. In operation, access to the security features is permitted during the operation modes after the image is verified. Such an approach enables a boot process to permit access to certain features after receipt and verification of different images.

Various techniques are provided to implement multi-chip secure and programmable systems and methods. In one example, a multi-chip module system for providing an integrated programmable logic functionality and security functionality. The multi-chip module system includes a first die including a programmable logic device (PLD) configured to provide at least a portion of the programmable logic functionality. The multi-chip system further includes a second die including a security engine configured to perform at least a portion of the security functionality. The security engine is further configured to receive, from the first die, data associated with a first and second configuration image; perform a read operation on a memory for the second configuration image based on the data; and authenticate the second configuration image. The multi-chip system further includes a configuration engine configured to program the PLD according to the first configuration image. Related devices and methods are provided.

The invention provides a traffic arrangement method and device, electronic equipment and a storage medium, and the method comprises the steps: determining that a security service chain corresponding to business traffic carries information indicating that a security function component is a security resource pool where a seven-layer Web application firewall component is located; inserting the internal header identifier into a service traffic processing request to obtain a first service traffic, and processing the first service traffic by using a first security resource pool to obtain a second service traffic; if the security function component in the first security resource pool is a seven-layer Web application firewall component, calling the first virtual service to analyze the second service flow to obtain an internal header identifier; and generating a new session as a first session based on the initial session information recovered by the internal header identifier, and marking the first session as a sub-session of the initial session. Therefore, the problem of layout failure caused by session identification failure due to the fact that quintuple information is modified by a seven-layer Web application firewall component in the related technology is solved.

The invention discloses a property asset digital operation and intelligent security linkage cooperative processing system and an implementation method, and relates to the technical field of Internet of Things, and the system comprises a protocol adaptive gateway layer which solves the problem of compatibility of multi-manufacturer equipment, and outputs a standardized data stream based on a dynamic protocol sniffing and fingerprint feature library, SDK-free access control, fire protection, monitoring and IoT equipment; the method comprises the following steps: constructing a millimeter-level precision three-dimensional space model by a digital twinborn middle table layer, fusing a security event and operation data, and ensuring that the operation is compliant and audible through blood relationship tracking; the intelligent decision execution layer combines a rule engine and machine learning to generate a linkage instruction, drives a work order to be automatically distributed and positions an equipment fault responsible party; and the edge cooperative computing node locally realizes video millisecond-level analysis, and starts localized linkage according to an emergency plan when the network is disconnected, so as to ensure that the core security function is not interrupted.

The invention relates to the technical field of function chain construction, in particular to a system and a method for constructing a virtual network security function chain, which comprises the following steps of: virtualizing various security functions, deploying the security functions in a network in a virtualized form, constructing a virtual security function chain, identifying security threats and generating a corresponding security event report. When a security threat is identified, a response is quickly made and corresponding protection measures are taken, so that data transmission and instruction communication among the virtualization security functions are realized, tasks of the security functions are dynamically allocated, resource utilization is optimized, system performance bottlenecks and potential faults are detected, and maintenance and optimization are carried out. According to the invention, each virtualization security function cooperatively works through an effective communication interface and a task scheduling mechanism, and it is ensured that the system can quickly respond and take corresponding protection measures when identifying security threats, such as blocking malicious traffic and isolating infected nodes.

Various example embodiments for supporting network security for a communication network are presented herein. Various example embodiments for supporting network security for a communication network may be configured to support programming of security functions, including security rules, into network devices. Various example embodiments for supporting programming of security functions into network devices may be configured to support programming of security functions into high performance application-specific integrated circuits (ASICs) of the network device. Various example embodiments for supporting programming of security functions into network devices may be configured to support programming of security functions into various types of network device, such as routers, switches, servers, or the like.

To achieve a redundant mobile line anew while continuously using an operating function such as a security function of a communication device that is being used, without changing configuration settings of the communication device being used. Provided is a multiprotocol / multilayer compatible relay device that relays, to a second communication line, connection of a communication device that is connected to a first communication line, and the multiprotocol / multilayer compatible relay device includes: an interface that houses the first communication line; an interface that houses the second communication line of a communication scheme different from the first communication line; an interface connecting to the communication device; a failure / recovery detection unit; a transmission / reception path control unit; a first communication line transfer processing unit; and a second communication line transfer processing unit.

A security platform architecture is described herein. The security platform architecture includes multiple layers and utilizes a combination of encryption and other security features to generate a secure environment.

The invention discloses a security function-oriented Internet of Things firmware fuzz test seed generation method and a security function-oriented Internet of Things firmware fuzz test seed generation device. The method comprises the following steps: generating an intention file according to a firmware security function test purpose; analyzing the intention file line by line, matching a security function code template according to an analysis result, and assembling the matched security function code template to obtain a security function calling code template; filling in a security function calling code template according to an analysis result to obtain an initial seed set; using the cue word template and the initial seed set to generate a fuzzy test seed generation command set, using the fuzzy test seed generation command set to guide the large language model to mutate the initial seed set, and outputting a new seed set; and calculating the similarity between the new seed set and the initial seed set, and if the similarity meets a preset condition, taking the new seed set as a fuzzy test seed. According to the method, the coverage rate of the Internet of Things firmware fuzzy test seeds can be further improved, so that vulnerabilities of security performance functions are effectively mined.

Storage devices, host devices and electronic devices are disclosed. In an embodiment of the disclosed technology, an electronic device providing an improved security function may include a storage device including a replay protected memory block (RPMB), and a host device configured to provide a command protocol information unit (PIU) instructing the storage device to access the RPMB. The command PIU may include a basic header segment including a total extra header segment length field having a value other than 0 and an extra header segment including a host RPMB message.

A system for providing decentralized network management comprises a private, secure network that has a plurality of authentication nodes that collectively authenticate client devices or perform other security functions. That is, the security functions are decentralized such that they are performed by a plurality of authentication nodes that communicate with one another to arrive at a consensus for a given security action, such as whether to authenticate a user. Decentralizing the security functions generally helps to increase the security and robustness of the network. In this regard, even if a hacker is able to access and compromise an authentication node, the other authentication nodes may act to prevent the hacker from using the compromised node to perform harmful or unauthorized actions. In addition, if any of the authentication nodes fails, the other authentication nodes may continue performing security functions allowing the network to recover from the failure.

This disclosure describes techniques for orchestrating implementation of a security solution among network devices. The techniques include determining capabilities of routers of the network and capabilities of a cloud security service to perform security features of a security solution. Based at least in part on the capabilities, the techniques include configuring a router of the network to execute a first subset of the security features on data traffic of the network, and configuring the cloud security service to execute a second subset of the security features on the data traffic. The techniques may also include causing the security solution to be presented to a security administrator via a display, the display providing representations of the first subset and the second subset of the security features.

In one implementation, a method is disclosed comprising: associating, by a device in a service mesh, a security function with a portion of an online application that is executed in a distributed manner across the service mesh; executing, by the device, the security function and the portion of the online application within a trusted execution environment of the device to produce output data; generating, by the device, a cryptographic proof for the output data based on the security function; and providing, by the device, the output data and the cryptographic proof to a remote execution environment within the service mesh to establish a verifiable data lineage for the output data.

Embodiments of the present disclosure may provide a data clean room allowing secure data analysis across multiple accounts, without the use of third parties. Each account may be associated with a different company or party. The data clean room may provide security functions to safeguard sensitive information. For example, the data clean room may restrict access to data in other accounts. The data clean room may also restrict which data may be used in the analysis and may restrict the output. The overlap data may be anonymized to prevent sensitive information from being revealed.