40 results about "Security policy management" patented technology

The invention, which relates to the technical field of data security, discloses a power grid enterprise power data storage security risk assessment system comprising the following components: a virtual environment monitoring module, a risk assessment and isolation module, an early warning and response module and a security policy management module. According to the invention, omnibearing real-time monitoring is carried out on a virtual server and a virtual network of a power grid enterprise data center through the virtual environment monitoring module, an abnormal behavior detection model is continuously optimized by using a machine learning algorithm, and high-precision identification of novel abnormal behaviors is realized. Meanwhile, the risk assessment and isolation module introduces a specific risk factor weight in combination with the unique characteristics of the power data of the power grid enterprise, ensures that an assessment result highly accurately reflects the actual safety risk of power data storage, and remarkably improves the safety and stability of power data storage of the power grid enterprise.

The invention provides an API behavior prediction and security policy management and control method based on machine learning, and relates to the field of computer network security, and the method comprises the steps: obtaining API original data in real time, preprocessing the original data, obtaining the preprocessed original data, obtaining API dimension features in real time based on the preprocessed original data, and fusing the API dimension features to obtain unstructured data, establishing a dynamic feature validity verification rule to pre-process the unstructured data to obtain a standardized feature tensor of a unified dimension; joint modeling of API behavior spatio-temporal characteristics is carried out through a collaborative architecture of a multi-head time attention mechanism and a dynamic graph neural network, API behavior prediction is carried out, an API dynamic security management and control strategy is generated in real time through a strategy engine, strategy execution is carried out, a security strategy execution effect is monitored in real time, and iterative optimization is carried out. According to the invention, the problems that the security control strategy of the traditional API gateway is fixed and rigid, and the security strategy is difficult to dynamically adjust according to the real-time access condition and behavior are solved.

Methods and systems for protecting a secured network are presented. For example, one or more packet security gateways may be associated with a security policy management server. At each packet security gateway, a dynamic security policy may be received from the security policy management server, packets associated with a network protected by the packet security gateway may be received, and at least one of multiple packet transformation functions specified by the dynamic security policy may be performed on the packets.

For increased device security, a security policy manager is used to configure permissions for applications installed on mobile computing devices. In one approach, an evaluation server receives data associated with a context for a computing device. Based on the received data, a policy that is applicable for the current context of the computing device is identified. The identified policy has rules regarding access permissions for software installed on computing devices. The server determines a current policy implemented on the computing device, which includes determining an access permission for software installed on the computing device. The server determines that the access permission for the installed software does not comply with the policy applicable to the current context. Based on this determination, the server revokes the access permission for the installed software.

The invention discloses an intrusion prevention system used in a meta universe environment, which relates to the technical field of information security and comprises a virtual identity verification module, a virtual asset protection module, a virtual scene integrity verification module, a behavior analysis and threat detection module, a real-time response and recovery module and a security policy management module. According to the invention, by setting a multi-layer defense mechanism, through virtual identity verification, virtual asset protection, scene integrity verification, behavior analysis and other multi-layer defense mechanisms, the system can comprehensively cover various security threats in the universe, it is ensured that a user is protected in each link in the virtual world, and AI and ML technologies are introduced at the same time, so that the security of the user is improved. The system can dynamically adapt to complex virtual interaction scenes and detect and respond to threats in real time, meanwhile, the system can continuously optimize the protection model through the self-adaptive learning function so as to cope with new attack means, and high real-time performance and self-adaptability are achieved.

In various examples, input queries (e.g. open user queries) are used combination with predefined queries to perform security policy-related actions using a generative machine learning (GML) model or GML models. In one example, an input query relating to a security policy is matched with a predefined query stored in an instruction database. In some examples, the instruction database contains examples of structured configuration data, which in turn can be used by a GML model to configure a predetermined extractor code module to perform a specific policy-related action. In other examples, a security context relating to a security policy is used together with an input query and template query to generate a GML model query. In some examples, the two approaches are combined.

The invention provides a high-altitude anti-falling comprehensive analysis method based on high-altitude operation monitoring multi-dimensional data and a related device, and belongs to the field of high-altitude operation safety monitoring. The method comprises the following steps: acquiring position and posture data, physiological data, working environment data and group management data of each operator, and preprocessing to obtain a real-time data set; using the risk evaluation model to obtain a real-time risk score of high-altitude operation; using the risk prediction model to obtain a prediction risk probability of high-altitude operation; and carrying out real-time anti-falling alarm on high-altitude operation based on the real-time risk score and the predicted risk probability. According to the invention, by integrating position, physiology, environment, group management and other multi-dimensional data and through risk evaluation and prediction model comprehensive analysis, the comprehensiveness and accuracy of safety evaluation are significantly improved; and real-time anti-falling alarm is carried out based on a double-model result, so that the early warning accuracy and reliability are effectively improved, group-level security policy management is realized, and modern aerial work management requirements are met.

The invention relates to the technical field of Web application security, and provides a depth context-aware front-end dynamic depth security protection method, which comprises the following steps of: S1, acquiring a current user role, an authority level, an access routing path and semantic attributes of an operation UI (User Interface) component to form multi-dimensional depth context data; s2, the dynamic CSP strategy engine injects the obtained CSP strategy into a front-end environment by creating or updating a page Meta label; s3, performing double-layer protection during operation, wherein the double-layer protection comprises an input protection layer and an operation protection layer; s4, threat linkage response: if a hostile attack is detected in the step S3, a threat event is encrypted and reported to a security policy management center, and the management center dynamically updates a CSP policy and a sensitive operation verification rule; and S5, global strategy optimization: the management center counts and analyzes threat logs, and automatically adjusts a default strategy of high-risk routing. Through dynamic security policy generation, context-aware semantic analysis and a multi-layer protection linkage response mechanism, a self-adaptive and deep front-end security protection system is constructed.

The invention provides a data security function verification system based on data driving for the Internet of Things, and the system mainly comprises a security policy management module which is used for defining a variable name and a data security label mode, and a data security rule verification model; the security policy labeling AOP module is used for adding security labels for all variable names and data in the application program to be verified and analyzed, and the security labels are used as entry points of the aspect-oriented programming AOP data security verification aspect; the AOP section code module is used for generating a section-oriented programming AOP data security verification section code, and the AOP data security verification section code is configured to execute an enhanced logic of a data security rule verification model and a log record according to an activation state and a path of a security label; and the runtime verification module is used for executing the enhanced logic of the data security rule verification model and the log record by the AOP data security verification section code according to the activation state and the path of the security label during runtime so as to realize data security rule verification.

The application discloses a file anti-leakage and traceability evidence system based on a digital label, and relates to the technical field of computer security. The system comprises a terminal agent unit and a behavior audit center, the terminal agent unit is connected with the behavior audit center through a network to complete information interaction, the terminal agent unit is arranged on each terminal computer in a local area network, and through label embedding, label verification, behavior audit and access control on intranet files, fine-grained access control and behavior audit of the intranet files based on label attributes are realized; the behavior audit center is arranged on a local area network background server, receives file attributes and label information reported by the terminal agent unit, realizes intranet file asset presentation, digital label management, security policy management and behavior log audit, realizes comprehensive presentation of file behavior situation and threat prediction based on artificial intelligence technology, and realizes automatic threat disposal according to preset security policies.

An enterprise-level security policy management tool receives, via a graphical user interface (GUI), inputs defining a security policy configured to be deployed within an enterprise that operates one or more operational technology (OT) networks, generates the security policy based on the inputs, and transmits the security policy to one or more computing devices running respective other instantiations of the enterprise-level security policy management tool, wherein the respective other instantiations of the enterprise-level security policy management tool are configured to facilitate enforcement of the security policy within the one or more OT networks operated by the enterprise.

Methods and systems for managing operations of a data processing system are disclosed. To manage operations of the data processing system, a management controller of the data processing system may provide user access data for the data processing system obtained from hardware resources to a security manager. The management controller may obtain a response from the security manager based on the user access data. In a first instance of the obtaining where the response indicates that the data processing system is exhibiting a level of data vulnerability that meets criteria, the management controller may obtain a security policy comprising an action set for updating the operation of the data processing system. The management controller may perform the action set to update an existing operating state of the data processing system to a new operating state to reduce the level of data vulnerability exhibited by the data processing system.

Systems and methods extend Non-Volatile Memory express over Fabric (NVMe-oF) zoning to enable security policy administration and authentication of NVMe-oF entities in a centralized manner without requiring per-connection provisioning administered by a Centralized Discovery Controller (CDC). In various embodiments a zone configuration is defined that represents access control rules, which determine which entities can connect with each other, and that may be augmented by specifying in a zone attribute whether members of a zone should authenticate or authenticate and establish a secure channel between themselves. Each entity may be configured with a per-entity global security policy that comprises a security credential and that enables an authentication and / or a secure channel communication between entities. Once an entity issues a Get Log Page request to the CDC to discover other entities, the CDC may provide a list of such entities and specify whether authentication and / or secure channel communication should be performed.

This invention discloses a security enhancement method and system for the IEC 104 protocol on the master station side of a power monitoring system, comprising: generating input data, dynamically selecting a security mode and issuing configuration commands, generating original ASDU messages, calling application-layer security plugins to generate enhanced ASDU messages, encapsulating them into complete APDUs, generating security messages via transport-layer security plugins, and sending them to the station. This invention adopts a plug-in embedded architecture, integrating IEC 62351-5 application-layer and IEC 62351-3 transport-layer security plugins into the protocol processing module and communication processing module respectively, achieving decoupling of security functions and business functions; establishing a policy-driven mechanism, adding a security policy management module and an operation monitoring module, and providing port differentiation to adapt to different terminals to meet the needs of gradual transformation; controlling terminal concurrent connection latency at the millisecond level to meet the needs of large-scale high-concurrency access at the master station, and establishing a layered security protection system that coordinates the transport layer and application layer, ensuring message security even if transport layer security fails.

The invention discloses a firewall security policy management system, which belongs to the technical field of firewall security management, and comprises the following steps: calculating a data packet exception coefficient by obtaining the sizes of all data packets in each traffic session within a preset time period; obtaining a request flow and a response flow in each flow session, and calculating a flow direction abnormal coefficient; obtaining the total number of times of connection attempting in each traffic session, and calculating a session retry abnormal coefficient; obtaining a session feature abnormal coefficient of the corresponding session according to the data packet abnormal coefficient, the traffic direction abnormal coefficient and the session retry abnormal coefficient; managing the firewall security according to the session feature abnormal coefficients in all the traffic sessions in the preset time period; in this way, the flow of the session can be deeply analyzed; the traffic characteristics of each session are monitored in time, so that the attack form cannot bypass the firewall, and intrusion is successful under the condition that firewall rules are not violated.

The invention discloses a face recognition building intercom system based on VOIP encryption transmission, and relates to the technical field of building intercom communication, the system comprises an entrance machine, an indoor machine and a management platform, the entrance machine is integrated with a network state sensing module, a security policy management module, a biological characteristic key generation module and a human body posture recognition model, the entrance machine collects a face image and completes preliminary recognition, the biological feature key generation module extracts feature factors from the face image and dynamically generates a unique encryption key, the security policy management module switches encryption policies such as a ChaCha20 stream cryptographic algorithm and an AES-256 algorithm according to a call stage and network quality parameters, and the security policy management module carries out encryption on the face image. The redundancy error correction strategy is dynamically adjusted based on the data packet priority and the network condition, the management platform is responsible for coordinating system operation, storing logs and pushing strategy suggestions, dynamic balance of communication safety, real-time performance and reliability is achieved, system energy consumption is reduced, user privacy is protected, and the method is suitable for application scenes with complex network conditions.

Methods and systems of access control to enterprise applications. Embodiments of the invention implement a unified secure access control solution to enable users to securely authenticate with applications no matter whether they are hosted in SAAS cloud or private networks. Intelligence Edge Gateways deployed at a network edge close to users' geographical locations ensure the control of users' secure access to software services and applications with minimized latency. A user only needs one set of credentials to gain access to various applications hosted in SAAS cloud or private networks. In an embodiment, Intelligence Edge Gateways enables IT administrators to set data plane level security policies in addition to the identity and access management policies. IT administrators are able to configure and manage all the security policies at Unified Access Cloud in a centralized manner.

In various examples, input queries (e.g. open user queries) are used combination with predefined queries to perform security policy-related actions using a generative machine learning (GML) model or GML models. In one example, an input query relating to a security policy is matched with a predefined query stored in an instruction database. In some examples, the instruction database contains examples of structured configuration data, which in turn can be used by a GML model to configure a predetermined extractor code module to perform a specific policy-related action. In other examples, a security context relating to a security policy is used together with an input query and template query to generate a GML model query. In some examples, the two approaches are combined.

The invention relates to the technical field of information management terminals, in particular to a distributed nursing information safety monitoring and management method and system, and the method comprises the steps: enabling a plurality of nursing terminals to be connected with a plurality of distributed safety servers in a one-to-one correspondence manner, and enabling all distributed safety servers to be connected with a safety strategy manager; monitoring security event data of a plurality of nursing terminals in a period of time through a plurality of distributed security servers, and uploading the security event data to a security policy manager; according to the data security risk index, whether a security policy execution unit is triggered to perform dynamic adjustment is judged; and after the security policy execution unit performs dynamic adjustment, whether global early warning needs to be triggered to the administrator terminal is judged.

The invention relates to the technical field of watershed information management, and discloses a watershed information security architecture construction method and device, computer equipment and a product, and the watershed information security architecture construction method comprises the steps: constructing a security policy management layer, a security policy control layer and a security policy execution layer based on a watershed information network, a drainage basin information production large area, a drainage basin information operation large area and a drainage basin information internet-of-things large area are constructed based on drainage basin information data, and data are transmitted in a one-way mode in a security policy management layer, a security policy control layer and a security policy execution layer according to transmission authority; constructing a watershed information security policy by using the security policy management layer, applying the watershed information security policy to a watershed information total platform and sending the watershed information security policy to the security policy control layer; the security policy control layer is utilized to generate a watershed information security sub-policy, and the watershed information security sub-policy is applied to a watershed information sub-platform and issued to the security policy execution layer; and executing the drainage basin information security sub-policy by using the security policy execution layer. According to the invention, the watershed information data security can be improved.

The invention provides a DRAM (Dynamic Random Access Memory) data security policy management method and device. The method comprises the following steps: acquiring the maximum refresh cycle of a target DRAM and the hardware power-on reset time of a processor; determining a refreshing mode and read-write task time of the target DRAM according to the received task requirement; determining self-refreshing time according to the refreshing mode and task requirements; and according to the maximum refresh cycle, the self-refresh time, the hardware power-on reset time and the read-write task time, determining the latest self-refresh completion time when the processor is reset. According to the scheme, the reliable self-refreshing method of the DRAM is provided, self-refreshing of the DRAM can still be completed when hardware reset occurs, and data safety is guaranteed.

The present invention relates to the field of network security technology, and particularly relates to a security policy transparency mechanism architecture, access control method and system based on a Merkle tree. Auditing protection of policy operations based on a Merkle Tree can transparently audit security policies, enhance the monitoring ability of each PEP (Policy Enforcement Point) for the PMP (Policy Management Point), improve the security of the security management ecosystem itself, achieve trusted network data access, enable the policy enforcement point to verify the correctness and effectiveness of the policy, enhance the anti-attack ability of the security policy management itself, improve the transparency of the security policy management system, be able to combat internal threats and misoperations, enhance the integrity and traceability of the security policy maintenance process, use the audit logs of the issued security policies to mitigate the problems of security policy tampering and inconsistency, be able to avoid the security team from issuing different security policies on multiple sub-domains, and provide guarantee for enterprises to achieve compliance management and consistent implementation of basic security policies.

The invention discloses a terminal antivirus management system for deep learning based on the Internet, relates to the technical field of computer security, and aims to solve the problem that traditional terminal antivirus software can detect and eliminate known viruses to a certain extent; however, for the problem that novel and complex virus variants and malicious behaviors of stealing information through a covert communication channel, the system comprises an intelligent data acquisition module, an analysis module, a cloud deep learning security engine, a secret communication module, a monitoring center and a security policy management center. The intelligent data acquisition module is deployed on terminal equipment and is used for acquiring equipment operation and communication data, and the acquired data comprises a system kernel calling sequence, a process memory access mode, quintuple information of a network data packet and API calling frequency and sequence of an application program. The method has the advantage of effectively solving the problem that traditional antivirus software is inrelaxed in searching and killing novel complex virus variants.

Security policies can be dynamically updated in response to changes in endpoints associated with those policies. A user can indicate one or more regions or networks from which access is to be granted under a specific security policy. The user can subscribe to receive notifications upon a change relating to those endpoints, such as the addition or removal of one or more endpoints. When a change is detected, new policy information can be generated automatically and published for subscribed policies, which can then have the updates applied automatically or provided for manual review and application. Such a process enables access determinations to be made based upon up-to-date endpoint information.

The application provides an API behavior prediction and security policy management method based on machine learning, relates to the field of computer network security, and comprises the following steps: acquiring API original data in real time, preprocessing the original data to obtain preprocessed original data, acquiring API dimension features in real time based on the preprocessed original data, and fusing to obtain unstructured data; a dynamic characteristic validity verification rule is established to preprocess the unstructured data, and a unified dimension standardization feature tensor is obtained; the joint modeling of API behavior space-time features is performed through the collaborative architecture of a multi-head time attention mechanism and a dynamic graph neural network, API behavior prediction is performed, API dynamic security management and control strategies are generated in real time through a strategy engine, strategy execution is performed, the security strategy execution effect is monitored in real time, and iterative optimization is performed. The application solves the problems of fixed and rigid security management and control strategies of a traditional API gateway, and the difficulty in dynamically adjusting security strategies according to real-time access conditions and behaviors.

Methods and systems for protecting a secured network are presented. For example, one or more packet security gateways may be associated with a security policy management server. At each packet security gateway, a dynamic security policy may be received from the security policy management server, packets associated with a network protected by the packet security gateway may be received, and at least one of multiple packet transformation functions specified by the dynamic security policy may be performed on the packets.

The invention relates to the technical field of container safety, and provides a priority-based container behavior supervision method and device. The method comprises the following steps: determining a mirror image priority according to a mirror image construction file; appointing a corresponding Seccomp strategy according to the mirror image priority; a mapping relation between the mirror image priority and the Seccomp strategy is established; obtaining a Seccomp strategy according to the mapping relation, and starting a container by using the Seccomp strategy; and monitoring a Seccomp event triggered by the container process, extracting a system calling behavior and performing structured recording to generate a structured log. According to the method and the device, dynamic security policy management based on the mirror image risk level is implemented on the container operation authority, and the problems of relatively low security, isolation and traceability during container operation in the prior art are solved.

The invention discloses a method and a system for realizing a secure operating system of an electric power embedded device. The method comprises the steps that a mainboard is connected to a TPCM hardware module, and the TPCM hardware module controls a CPU through an I / O pin and carries out safe interaction with the CPU through an SPI bus; before an SFOS operating system is started, a bootstrap program of the operating system is measured through a TPCM hardware module, if measurement succeeds, the bootstrap program normally loads the operating system, and if measurement fails, the TPCM organizes operation of the operating system; the trusted basic software module is operated, the TPCM module is managed, the SFOS and the application program are protected, active interception is carried out in an SFOS operating system, and transparent and trusted support for the application program is realized; a security management center is created, system management, security management and audit management are realized, comprehensive security policy management is performed on a computing environment, a region boundary and a communication network, user operation authority is determined, and whole-course audit tracking is implemented. According to the scheme, the safety of the automatic secondary equipment of the power system is improved.

The invention relates to data security, in particular to a quantum security and credible meteorological data system based on a quantum key, and the system comprises a quantum security service platform which carries out the life cycle management of the quantum key, and carries out the identity authentication of a quantum security application terminal; the quantum security database performs quantum key interaction with the quantum security service platform, realizes encrypted storage of data in an application system by using a quantum cryptography technology in a manner of avoiding development and transformation, and provides a compliant and easy-to-implement data security protection scheme; the quantum application service is in butt joint with the business application service through customized research and development, and after business application is simply configured, automatic encryption and decryption of data can be realized, and abundant data security policy management capability is provided; according to the technical scheme provided by the invention, the defect that the safety of meteorological data is difficult to effectively guarantee in the prior art can be effectively overcome.