370 results about "Security function" patented technology

The invention belongs to the field of network security, and relates to a trusted management and control network platform construction method and device, electronic equipment and a storage medium, the method comprises the following steps: constructing a basic security architecture and a trusted base, the basic security architecture being used for providing a unified root of trust and a management core for collaborative operation of upper security components; based on the basic security architecture and the trusted base, implementing multi-dimensional trusted verification and dynamic access control; an intelligent boundary protection and depth detection system is deployed and is used for constructing an intelligent, three-dimensional and self-adaptive security defense line at the boundary of each region of the network, and various known and unknown threats can be identified and blocked; constructing a unified secure communication tunnel and a cross-domain transmission guarantee; defining and realizing a standardized security function interface and a collaboration protocol; and a continuous trust evaluation and automatic operation management and control closed loop is established. The overall security is enhanced, the secure transmission of data is ensured, the compatibility and collaboration of the system are improved, and the security operation intelligence is realized.

Some embodiments enhance the security of domain name resolution and other DNS operations, by automatically intercepting the DNS operation, determining an associated device identity or ascertaining an associated user identity, and enforcing a security policy based on at least the DNS operation and based on at least one of the identities. Some securable DNS operations include resolution requests, reverse lookups from IP addresses to domain names, DNS record accesses, mail server mappings, redirection, forwarding, and DNS record cache operations. Enforcing the policy includes, e.g., preventing a result requested by the DNS operation, permitting computational progress toward the requested result, allowing a different result, modifying a DNS record, or flushing a DNS record from a cache. In some embodiments, DNS operation security functionality utilizes or implements a conditional access security functionality, thereby providing, e.g., a secure conditional domain name resolution.

A process includes determining, by a recommendation engine, a security risk profile for a container environment. The container environment includes a plurality of pods that are to be deployed on an infrastructure that includes a plurality of nodes. Determining the security risk profile includes determining an infrastructure context characterizing the infrastructure and determining a workload context characterizing a workload associated with the container environment. The process includes determining, by the recommendation engine, a recommendation of a security policy for the container environment based on the security risk profile. The security policy includes a security control. The process includes deploying an agent to the infrastructure to manage compliance of the container environment with the security control.

Embodiments of the present disclosure may provide a data clean room allowing secure data analysis across multiple accounts, without the use of third parties. Each account may be associated with a different company or party. The data clean room may provide security functions to safeguard sensitive information. For example, the data clean room may restrict access to data in other accounts. The data clean room may also restrict which data may be used in the analysis and may restrict the output. The overlap data may be anonymized to prevent sensitive information from being revealed.

In some implementations, a system includes a set of servers configured to establish a set of virtual machines to provide a computing environment; a set of compute express link (CXL) interface components configured to communicate with the set of servers via a set of CXL interconnects; and a controller configured to at least one of: encrypt protocol data against a CXL interposer security threat associated with the set of CXL interconnects or a malicious extension security threat, provide a secure handshake verification of an identity of the set of CXL interface components, enforce a chain of trust rooted in hardware of the set of CXL interface components; restrict access to an area of memory of the set of CXL interface components that stores security data for verified or secured processes; or perform a security check and set up a set of security features of the set of CXL interface components.

The invention relates to the technical field of CPU card security chips, and discloses a low-power-consumption design method and system for a CPU card security chip, and the method comprises the steps: carrying out the current waveform sampling of a secret key storage region, an encryption operation unit and an identity authentication processor of the CPU card security chip, recording current data when the CPU card security chip executes data encryption, identity authentication and security calculation to obtain a feature parameter set of the security function module; establishing an encryption operation power consumption model and an identity authentication power consumption model, and obtaining power consumption characteristic matrixes under different key lengths through piecewise linear fitting; classifying the security application tasks to obtain a multi-level security task classification table; according to the multi-level security task classification table, a differential power consumption attack protection strategy is executed, the working voltage and frequency configuration sequence of each security function module is calculated, the optimal balance of power consumption and performance is achieved under different key lengths, and the comprehensive performance of the CPU card security chip is improved.

Various systems and methods implement a decision architecture for autonomous systems. An autonomous system framework includes a safety ring configured to interface with safety features of an autonomous system; a security ring configured to provide authentication and verification services to transactions passed through the security ring; a privacy ring configured to ensure privacy of a user of the autonomous system; a trustworthiness ring configured to log and provide transparency of transactions passed through the trustworthiness ring; and a well-being ring configured to interface with the user and provide feedback and information to the user on a state of the autonomous system, wherein: each of the safety, security, privacy, trustworthiness, and well-being rings include at least one interface to at least one other of the safety, security, privacy, trustworthiness, and well-being rings.

This disclosure describes techniques for distributing security service by performing security policy-based routing among network devices. The techniques include determining a security function to be applied to a packet of a data traffic flow. The security function may be determined based on a security policy and an intended destination of the packet. The techniques may also include determining whether a network device is capable of performing the security function. A route for the packet to the destination may be determined based on whether the network device is capable of performing the security function. As such, distributing security service techniques may improve efficiency in data traffic routing, and may reduce cost and / or prevent redundancy in security service application.

A method for determining a user plane security algorithm, a system, and an apparatus. The method may include: a second device selects a non-null user plane confidentiality protection algorithm based on a security capability of a first device and a security capability of the second device in a case in which user plane confidentiality protection between the second device and the first device is enabled and control plane confidentiality protection between the second device and the first device is not enabled. The second device sends a first message to the first device. The first message includes first algorithm indication information indicating the user plane confidentiality protection algorithm. Therefore, the first device can obtain the non-null user plane confidentiality protection algorithm. Embodiments can be adopted to determine an effective user plane confidentiality protection algorithm, for confidentiality protecting user plane data.

Document (100) with a security feature, comprising: a first substrate layer (103) having a first substrate layer region (105), wherein the substrate layer region (105) is impregnated with a black fluid over the entire thickness of the first substrate layer (103), the black fluid having carbon particles; a second substrate layer (107) with a second substrate layer region (109), wherein the second substrate layer (107) is arranged above the first substrate layer (103), the second substrate layer region (109) having a light reflection characteristic which differs from a light reflection characteristic of the first substrate layer region (105), wherein the first substrate layer region (105) and the second substrate layer region (109) form a composite security feature.

A data lake for enterprise security is created from an asynchronous stream of security events by deduplicating objects and creating metadata related to downstream security functions. Deduplication of objects may be efficiently performed with a bloom filter as objects are ingested into the data lake. The objects may also be augmented with metadata arranged in schemas to facilitate monitoring and use within the data lake.

Various techniques are provided to implement multi-chip secure and programmable systems and methods. In one example, a multi-chip module system for providing an integrated programmable logic functionality and security functionality. The multi-chip module system includes a first die including a programmable logic device (PLD) configured to provide at least a portion of the programmable logic functionality. The multi-chip system further includes a second die including a security engine configured to perform at least a portion of the security functionality. The security engine is further configured to receive, from the first die, data associated with a first and second configuration image; perform a read operation on a memory for the second configuration image based on the data; and authenticate the second configuration image. The multi-chip system further includes a configuration engine configured to program the PLD according to the first configuration image. Related devices and methods are provided.

The invention provides a traffic arrangement method and device, electronic equipment and a storage medium, and the method comprises the steps: determining that a security service chain corresponding to business traffic carries information indicating that a security function component is a security resource pool where a seven-layer Web application firewall component is located; inserting the internal header identifier into a service traffic processing request to obtain a first service traffic, and processing the first service traffic by using a first security resource pool to obtain a second service traffic; if the security function component in the first security resource pool is a seven-layer Web application firewall component, calling the first virtual service to analyze the second service flow to obtain an internal header identifier; and generating a new session as a first session based on the initial session information recovered by the internal header identifier, and marking the first session as a sub-session of the initial session. Therefore, the problem of layout failure caused by session identification failure due to the fact that quintuple information is modified by a seven-layer Web application firewall component in the related technology is solved.

The invention discloses a property asset digital operation and intelligent security linkage cooperative processing system and an implementation method, and relates to the technical field of Internet of Things, and the system comprises a protocol adaptive gateway layer which solves the problem of compatibility of multi-manufacturer equipment, and outputs a standardized data stream based on a dynamic protocol sniffing and fingerprint feature library, SDK-free access control, fire protection, monitoring and IoT equipment; the method comprises the following steps: constructing a millimeter-level precision three-dimensional space model by a digital twinborn middle table layer, fusing a security event and operation data, and ensuring that the operation is compliant and audible through blood relationship tracking; the intelligent decision execution layer combines a rule engine and machine learning to generate a linkage instruction, drives a work order to be automatically distributed and positions an equipment fault responsible party; and the edge cooperative computing node locally realizes video millisecond-level analysis, and starts localized linkage according to an emergency plan when the network is disconnected, so as to ensure that the core security function is not interrupted.

To achieve a redundant mobile line anew while continuously using an operating function such as a security function of a communication device that is being used, without changing configuration settings of the communication device being used. Provided is a multiprotocol / multilayer compatible relay device that relays, to a second communication line, connection of a communication device that is connected to a first communication line, and the multiprotocol / multilayer compatible relay device includes: an interface that houses the first communication line; an interface that houses the second communication line of a communication scheme different from the first communication line; an interface connecting to the communication device; a failure / recovery detection unit; a transmission / reception path control unit; a first communication line transfer processing unit; and a second communication line transfer processing unit.

Storage devices, host devices and electronic devices are disclosed. In an embodiment of the disclosed technology, an electronic device providing an improved security function may include a storage device including a replay protected memory block (RPMB), and a host device configured to provide a command protocol information unit (PIU) instructing the storage device to access the RPMB. The command PIU may include a basic header segment including a total extra header segment length field having a value other than 0 and an extra header segment including a host RPMB message.

A system for providing decentralized network management comprises a private, secure network that has a plurality of authentication nodes that collectively authenticate client devices or perform other security functions. That is, the security functions are decentralized such that they are performed by a plurality of authentication nodes that communicate with one another to arrive at a consensus for a given security action, such as whether to authenticate a user. Decentralizing the security functions generally helps to increase the security and robustness of the network. In this regard, even if a hacker is able to access and compromise an authentication node, the other authentication nodes may act to prevent the hacker from using the compromised node to perform harmful or unauthorized actions. In addition, if any of the authentication nodes fails, the other authentication nodes may continue performing security functions allowing the network to recover from the failure.

In one implementation, a method is disclosed comprising: associating, by a device in a service mesh, a security function with a portion of an online application that is executed in a distributed manner across the service mesh; executing, by the device, the security function and the portion of the online application within a trusted execution environment of the device to produce output data; generating, by the device, a cryptographic proof for the output data based on the security function; and providing, by the device, the output data and the cryptographic proof to a remote execution environment within the service mesh to establish a verifiable data lineage for the output data.

Embodiments of the present disclosure may provide a data clean room allowing secure data analysis across multiple accounts, without the use of third parties. Each account may be associated with a different company or party. The data clean room may provide security functions to safeguard sensitive information. For example, the data clean room may restrict access to data in other accounts. The data clean room may also restrict which data may be used in the analysis and may restrict the output. The overlap data may be anonymized to prevent sensitive information from being revealed.

To provide a technology that enables a safety function of a device operated by a built-in RTOS at a low cost and with a low processing load.SOLUTION: A safety device has at least two control units. Each of the control units has a real-time operating system (RTOS) and a processor that executes a task. Each of the control units is configured to output a safety output signal generated based on calculation results of one or more tasks, perform comparison processing to compare, for one or more tasks that affect a value of the safety output signal, data related to calculation of the own task, which is a task executed by the own processor, with data related to calculation of a corresponding task, which is a task executed by a processor of the other control unit and corresponds to the own task, and if a result of the comparison processing is a mismatch, determine that an abnormality has occurred.SELECTED DRAWING: Figure 1

The invention discloses an identity authentication method for a supervision terminal of an automatic driving commercial vehicle, which belongs to the field of vehicle supervision, and comprises the steps of deploying a unified password service platform, and calling various password services by a supervision platform so as to support various safety functions. In addition, by supervising terminal device registration, generating a device unified identifier and interacting with a unified password service platform, generation and distribution of a device initial key are realized. According to the method, an equipment SM9 private key acquisition process is introduced, and the secure acquisition of the equipment private key is realized through the generation of an SM2 public and private key pair. Meanwhile, a specific supervision terminal authentication process is provided, and the identity authentication security of the terminal equipment and the unified password service platform is guaranteed through a challenge-response mode. Moreover, the authentication entity relationship and the key updating mechanism are described in detail, and an all-dimensional and multi-level authentication system is constructed.

Methods, storage systems and computer program products implement embodiments of the present invention that include specifying a security feature for a software application including application instructions, and then analyzing the software application so as to identify a given application instruction for modification so as to implement the security feature. In response to analyzing the software application, the specified security feature is implemented by modifying the identified application instruction. Finally, execution of the software application with the modified application instruction is initiated so as to perform the specified security feature.

A self-contained biometric device, method, and system for secure digital transactions is provided. The device comprises a housing that may be a subdermal implant, dermally-applied biometric tattoo, ergonomic external wearable, or smart card. The housing maintains consistent secure functionality during offline and online operation modes and includes a biometric verification module that captures a biometric input of a user and performs user authentication entirely within the device. A hardware-isolated storage module physically isolated from external networks stores cryptographic keys, credentials, and biometric templates. The device permits access to the cryptographic keys and credentials only upon successful user authentication. A transaction processing module resident inside the hardware-isolated storage module executes digital asset transactions entirely within the device in offline mode. This self-contained architecture enables secure, autonomous operation without reliance on external networks or computation.

The invention discloses a security computing channel dynamic combination method based on a cloud platform, a medium and equipment. The method is used for generating a cloud computing security platform. Comprising the following steps: constructing an IaaS layer by adopting a plurality of server clusters; setting each processor core of each server in each server cluster as a computing channel, and acquiring physical attributes of all computing channels; according to the physical attributes of all the computing channels, constructing a security cloud channel physical attribute structural body which is composed of the computing channels and comprises a plurality of computing channel sets of different physical attributes; constructing security middleware of the physical attribute structural body of the security cloud channel in the PaaS layer according to requirements, and correspondingly linking computing channels of different physical attributes in the physical attribute structural body of the security cloud channel through the security middleware to generate a final scheme; and generating the cloud computing security platform according to the final scheme. The method has the advantage of ensuring that the channels with different security function levels are simultaneously operated on the security cloud platform.

The invention relates to the field of network security, and particularly provides a security cooperation system and method in a hybrid cloud environment. The system comprises a unified security management module, a security solution cooperation module and a security function module. The unified security management module analyzes a self-healing algorithm through a policy graph, carries out graph modeling on a multi-cloud security policy, automatically identifies policy conflicts and drifts through graph difference analysis, and realizes continuous consistency and self-healing of a cross-cloud policy. And the security solution cooperation module is embedded into a reinforcement learning agent, dynamically decides an optimal deployment scheme of security resources according to a reward function by sensing a threat situation, a resource utilization rate and response delay, and realizes intelligent self-adaptive arrangement of protection resources. The security function module is used for micro-servitizing and containerizing security capability based on a cloud native technology, transparent injection is realized through a service grid, an automatic compliance repair and verification mechanism is built in, and a compliance closed loop for detection, repair and verification is formed. And the management efficiency and the protection accuracy of the security policy are improved.

A storage device for providing a security function may include: a nonvolatile memory device including a Replay Protected Memory Block (RPMB); and a memory controller configured for receiving, from an external host, a command UFS Protocol Information Unit (UPIU) including a host RPMB message, and storing data in the RPMB according to authentication performed using the host RPMB message. The command UPIU may include a basic header segment commonly included in UPIUs transmitted / received between the external host and the memory controller, and the basic header segment may include a data segment length field as information indicating that the host RPMB message has been included in the command UPIU.

Solutions for efficiently scalable assurance assessments for hard third party intellectual property (3PIP) are disclosed. Examples parse a data file (e.g., a netlist, GDSII, or OASIS) identifying components and connections for a functional component of an integrated circuit (e.g., ASIC, FPGA) and generate a graph having nodes and edges corresponding to the components and connections. Subgraph matching identifies portions of the graph that match subgraphs in a library of known secure functionality. Unmatched portions are then further analyzed for security, such as by extracting a schematic, performing a Boolean analysis, or performing a circuit simulation. When all portions of the data file are found to be secure, the data file is flagged and the integrated circuit may be fabricated or programmed.

Various aspects of the present disclosure relate to authorized access to security event data. An apparatus, such as a network equipment (NE) that implements a first network function (NF) (e.g., a network repository function (NRF)), receives a request from a second NF (e.g., an operator security function (OSF)) for a token to access security event data from a third NF (e.g., an NF service producer). The first NF generates the token using a profile of the second NF. The first NF transmits the token to the second NF. A fourth NF (e.g., a data collection function) can request a second token from the first NF to access the security event data for the second NF. The third NF can transmit the security event data to the second NF via the fourth NF or directly. This enables secure and authorized access to security event data in wireless communication networks.

An electronic device may include: an application processor, a communication processor, and a security subsystem for processing a security function related to the application processor or the communication processor. The security subsystem may decrypt, based on reception of a request for decrypting a nonce value from the communication processor, the nonce value and transmit the decrypted nonce value to the communication processor, and may generate a signature using the nonce value and network lock data based on reception of a request for network lock signature from the communication processor and transmit the generated signature to the communication processor. The communication processor may receive a signature value generated from the security subsystem, compare a signature value pre-stored in the application processor with a signature value received from the security subsystem, and determine whether to restrict use of the electronic device based on whether the signature value pre-stored in the application processor and the signature value received from the security subsystem are matched to each other.

An apparatus, including a controller, camera, display, speaker, global positioning system, and sensor or detector which senses or detects a dangerous, hazardous, or unsafe, condition at or in a vicinity of the apparatus. The sensor or detector senses or detects the dangerous, hazardous, or unsafe, condition, and the apparatus provides, via the speaker, an audible alarm, siren blare, or verbal message, containing information regarding the dangerous, hazardous, or unsafe, condition. The apparatus or the controller generates an alert message containing information regarding the dangerous, hazardous, or unsafe, condition. The apparatus transmits the alert message to a central processing computer, to a communication device of a parent, relative, or friend, or other authorized individual, or to a police or law enforcement communication device.