52 results about "Security policy database" patented technology

A searching method for a Security Policy Database (SPD) is proposed. The characteristic of peer gateway of the IPSec is applied to divide the original SPD into multiple smaller peer-based SPDs, and build a peer table corresponding to the peer-based SPDs. When it is required to search the policies in the database, the peer-based SPD according to the present invention can be directly used so as to save the time of data searching.

A packet communication system for effectively using network resources and for improving network operability. A transmission security policy database specifies the omission of header information attached when a transmission packet is capsulated, as a transmission security policy. A header-information omitting section omits the header information of the capsulated transmission packet. A packet transmission processing section adds a security header and a header for tunnel communication to the packet from which the header information has been omitted and transmits the packet. A receiving security policy database specifies that the header information has been omitted, as a receiving security policy. A header-information recovering section searches the receiving security policy database for a security policy for a received packet, and when recognizing that the received packet is a target packet from which the header information has been omitted, recovers the header information.

A security policy database identifies the intended security policies within a network, a traffic generator provides test traffic that is configured to test each defined security policy, and a simulator simulates the propagation of this traffic on a model of the network. The model of the network includes the configuration data associated with each device, and thus, if devices are properly configured to enforce the intended security policies, the success / failure of the simulated test traffic will conform to the intended permit / deny policy of each connection. Differences between the simulated message propagation and the intended security policies are reported to the user, and diagnostic tools are provided to facilitate identification of the device configuration data that accounts for the observed difference. Additionally, if a network's current security policy is unknown, test traffic is generated to reveal the actual policy in effect, to construct a baseline intended security policy.

A security procedure for invoking IPsec security for communication of a packet in a network includes the steps of generating a message to be sent at the transport layer, building Internet Protocol and Transport Control Protocol headers for the message, selecting a security policy in accordance with a security policy database after the step of building Internet Protocol and Transport Control Protocol headers, and processing the packet according to the selected security policy.

A virtual firewall system based on a common security policy and a method of controlling the same. The virtual firewall system includes one or more virtual security policy modules, each of which includes a local security policy database; a security policy determiner, which determines, from the one or more virtual security policy modules, a virtual security policy module corresponding to a packet received from outside; and a common security policy database, which stores security policies. Each of the one or more virtual security policy modules determines whether or not to apply a security policy of the common security policy database to the received packet, and when the security policy of the common security policy database is applied, does not apply the security policy of a local security policy database. An operator can easily and conveniently set and restore the system.

The invention belongs to the field of integrating ubiquitous network security perception, and discloses a designing method for a multilevel ubiquitous network security perception component based on security situation analysis, security policy management and the like. The method comprises the steps of firstly, developing a security engine by utilizing Java MIDP (Mobile Information Device Profile) 2.0, then sending a request of a terminal through an event driving mechanism, continuously calling the information on security situation management, security policy database, a context server and the like of the system terminal through the security engine so as to realize the dynamic roles or permission grant, making comprehensive evaluation to the request, responding the evaluation result to an application program (a carrier of protected resources), and allowing or rejecting the access of a user by the protected resource according to the response. According to the method, a middleware technology, a network security situation awareness technology, a network security analysis technology and the like are integrated, the security control problem under a terminal environment and the problems of heterogeneous authentication, access, interoperability control, privacy protection, data safe sharing and the like are solved, and safe guarantee is provided for the user.