155 results about "Security properties" patented technology

Method and system for analyzing software or firmware of computing systems to assess security properties includes loading predicate device input data including characteristics about predicate devices; translating predicate device input data into predicate device model data describing characteristics or dependencies of the predicate device input data relevant to the analysis; determining digital twin configuration data used to configure digital twin; loading the digital twin configuration data onto the digital twin; storing configuration data in the memory; instructing the digital twin to configure itself to implement the loaded digital twin configuration data; determining security analysis to be carried out on the digital twin; simulating the predicate device; executing security analysis on the digital twin; generating output data describing the result of execution of the security analysis; storing output data pertaining to the result; and determining if the result satisfies a predetermined condition, and if so, executing action corresponding to the result.

The invention provides a digital asset security verification and information monitoring method and system, and the method comprises the steps: carrying out the classification of digital assets through employing a multi-dimensional classification model according to the type attributes of the digital assets, obtaining the classification labels and feature vector representations of the digital assets, and building a digital asset feature database; obtaining transaction historical data of the digital assets from the digital asset association map, discovering association rules and abnormal modes of digital asset transactions by using a time sequence mode mining technology, and forming a transaction verification rule base; according to the data structure of the algorithm adaptation layer, an intelligent data analysis and conversion technology is adopted, heterogeneous digital asset data is mapped to a unified feature space, standardized digital asset data is generated, and a digital asset feature database is formed; and performing deep verification analysis by using the digital asset feature database to obtain security attribute information of the digital assets, and performing dynamic assessment on the security level of the digital assets by using a multi-factor risk assessment model to generate the security rating of the digital assets.

The embodiment of the invention provides a test case sample cutting method, device and system and a storage medium, and relates to the technical field of network security testing. The method comprises the following steps: constructing an industrial control system attack tactical library; wherein the tactical library comprises classified and arranged attack techniques and corresponding security attributes; performing information analysis and semantic analysis on the test case sample to generate structured data of the test case sample and / or function points in the test case sample; and cutting the test case sample according to the security attribute and / or the structured data and / or the function point to obtain a test fragment corresponding to the security attribute and / or the function point. According to the method, classification-based attack techniques and security attributes are cut by constructing a tactical library, key information can be accurately extracted and test intentions can be understood through information analysis and semantic analysis, redundant tests are avoided, cut test fragments can concentrate on specific security attributes or function points, the test coverage range is more accurate, and the test efficiency is improved. And the distributed security test effect is improved.

The invention provides a property management platform based on endogenous safety. The property management platform comprises an endogenous safety property management system, wherein the endogenous safety property management system comprises essential place analysis, heterogeneous resource configuration, heterogeneous execution body generation and mimicry component embedding; a security architecture technical route in the endogenous security property management system comprises a control plane and a data plane. The endogenous security property management system further comprises a mimicry construction intelligent Internet of Things zero-trust assembly, and the mimicry construction intelligent Internet of Things zero-trust assembly is used for providing endogenous security for the zero-trust system. Fine-grained security control of continuous authentication and dynamic authorization is realized by taking a software-defined dynamic fine-grained boundary as guidance, that is, a trusted network is established by taking an identity label of an Internet of Things terminal as a center, a model framework for realizing an intelligent Internet of Things zero-trusted network is researched, and a framework of an endogenous security property management system is constructed.

The invention discloses a time domain and security attribute joint modeling method based on RTL information flow, belongs to the technical field of hardware security, and solves the problems of how to model time domain attributes from the perspective of information flow to design security behaviors and detect time sequence channel attacks. The security behavior is modeled and designed by the security attribute and the time domain attribute from the angle of information flow, the additional time domain attribute tracking logic circuit is used for capturing data flow and the updating time of a signal in the process, the security attribute and the time domain attribute of RTLIFT are modeled in a dual mode, and the security behavior is modeled and designed by analyzing propagation of a time label. According to the method, how the input change affects the output time change can be determined, so that the model can capture and analyze the time difference caused by the imbalance of the execution path, and the hardware time side channel possibly causing sensitive information leakage can be effectively identified.

A method for automatic detection and remediation of security posture in web-applications using large vision models is fulfilled in the ongoing description by (a) initiating a headless browser as an agent to access an administrative section of a web-application, (b) enabling a pre-trained large vision model to navigate through a web user-interface of the web-application using a state transition graph, (c) determining subsequent navigation actions of the navigated web-user interface using screenshots of the navigated web-user interface with the large vision model, (d) detecting and analyzing a final state of navigation sequence of the administrative section to extract security attributes, (e) monitoring and collecting data associated with security posture of the web-application based on the security attributes, and (f) initiating automated corrective actions through a security posture remediation module upon identifying a security issue in the web-application.

The embodiment of the invention discloses an integrated circuit, a resource access control method, equipment and a medium, and the method comprises the steps: in response to a received resource access request sent by a requester, based on pre-configured access authority control information, determining whether the requester has an access authority for a resource party corresponding to an access address requested by the requester, and obtaining a first determination result; and in response to the request party having the access authority to the resource party, determining whether the request party has the operation authority to the access address based on pre-configured security control information and security attribute information in the resource access request to obtain a second determination result, and processing the resource access request based on the second determination result, according to the invention, the security of functions with high security level requirements can be effectively guaranteed, and the information security and the function security can be improved.

Exemplary embodiments for data security include a data access proxy coupled with a database, further coupled with a server configured to operate the data access proxy to: identify a user and request to access a data item; validate the user and request, including inspecting the user's identity, evaluating the user's history, and evaluating permissions and restrictions associated with the user and the data item; access the database to retrieve the data item; inspect security attributes related to the data item; and transform the data item based on one or more privacy rules, including redacting the at least one data item, deleting information from the at least one data item, substituting information from the at least one private data item with other information, adding information to the at least one data item, providing synthetic data as a private data item, or providing proxy data for the data item.

The invention discloses a software security detection method and a security development process management system. The method relates to the field of supply chain information security or other related fields, and comprises the following steps: under the condition of receiving software initial data of target software, controlling a security design module to draw a software security architecture diagram according to the software initial data, and determining M security attribute values based on the software security architecture diagram; controlling a security modeling module to obtain N security requirements from a security database according to each security attribute value to obtain Y security requirements; and controlling the demand detection module to detect the Y security demands to obtain a detection result of the target software, and under the condition that the detection result represents that the detection is not passed, re-drawing the software security architecture diagram until the detection result associated with the updated software security architecture diagram represents that the detection is passed. Through the software security detection method and device, the problems of low detection efficiency and low detection accuracy during software security detection in related technologies are solved.

The invention belongs to the technical field of crowd sensing, and discloses a trust-based crowd sensing distributed privacy protection method and system, and the method comprises the steps: constructing a detailed reputation evaluation system, covering the calculation of a reputation value and the setting of a reputation threshold value of a participating user, and integrating a game model in an evaluation stage, the user is guided to avoid malicious behaviors through an income incentive mechanism so as to obtain higher income; a dobby machine model is introduced to dynamically balance the decision-making process of'exploring 'new users and'utilizing' high-reputation users, so that the cold start problem of insufficient reputation of the new users is effectively solved; and finally, verifying the security of the scheme through theoretical derivation of the security attribute of the scheme, verifying the validity of the scheme in the aspects of data credibility, privacy protection effect and the like in combination with experimental analysis, and providing support for credible operation and privacy protection of the crowd sensing system.

The computer-implemented methods, computer program products, and computer systems include computer operations that include executing, in a trusted computing environment, a call from a host in an untrusted computing environment, where the call is to determine a status of a large page of memory for use by a secure guest, where the secure guest is managed by the host in the untrusted computing environment. The executing includes determining that all small pages comprising the large page and the large page meet pre-defined security requirements. The executing also includes, based on the determining, setting security properties of the large page and the small pages comprising the large page to enable translation for the large page for a given block of memory of the secure guest. The executing also includes storing in a computing element, a designation identifying the large page as belonging to the secure guest.

The invention discloses a road cargo transportation management method and system based on an electronic waybill, and relates to the technical field of the Internet of Things, and the method comprises the steps: carrying out the real-time collection and comparison of transportation data and a safety domain through a vehicle-mounted OBD device and a roadside RFID reader-writer according to a digital twinborn body updated for the first time and a safe passing time-space map, and carrying out the real-time collection and comparison of the transportation data and the safety domain; when a composite anomaly is detected, the digital twin state is updated, and a third-level alarm code is triggered; and according to the five-dimensional auditing report, splitting the transportation attribute and the security attribute, respectively anchoring the transportation attribute and the security attribute to a transportation chain and a security chain, and generating a verifiable cross-chain evidence packet through a cross-chain relay technology. According to the method, the transport attributes and the security attributes are split and anchored to the transport chain and the security chain respectively, and the MPT tree is constructed to generate the double-chain consistency proof, so that joint auditing under data sovereignty separation is realized, and the collaborative response time of multiple departments is shortened; a tamper-resistant evidence chain is formed from waybill initialization, security domain implantation to final audit destruction.

Apparatus and method for role-based register protection. For example, one embodiment of an apparatus comprises: one or more processor cores to execute instructions and process data, the one or more processor cores to execute one or more security instructions to protect a virtual machine or trusted application from a virtual machine monitor (VMM) or operating system (OS); an interconnect fabric to couple the one or more processor cores to a device; and security hardware logic to determine whether to allow a read or write transaction directed to a protected register to proceed over the interconnect fabric, the security hardware logic to evaluate one or more security attributes associated with an initiator of the transaction to make the determination.

The invention provides a formal security verification method for a password energy side channel before silicon. The method comprises the following steps: establishing an information flow security model library for circuit design by adopting a gate-level information flow tracking technology; converting the password core design into a gate-level netlist, mapping each basic logic unit in the gate-level netlist into an information flow security model library for matching, and obtaining an energy side channel security model; summarizing target function attributes by analyzing structural characteristics of a cryptographic algorithm and characteristics of an energy side channel; performing simulation verification on the energy side channel security model by taking the target function attribute as a constraint so as to determine a target register; based on the energy consumption model, in combination with the energy side channel security model, performing security attribute mining of the energy side channel; and according to the security attribute and the energy side channel security model, analyzing whether the target register has energy leakage or not by adopting a formalized verification method. According to the method, accurate analysis of the password core design energy side channel security can be well realized.

The invention discloses a book resource data security collection retrieval monitoring system based on big data, and relates to the technical field of information technology and data security, and the system comprises a permission-aware association reasoning retrieval module which is in communication connection with a knowledge graph and dynamic index construction module and is used for receiving a user retrieval request and sending the user retrieval request to a database; analyzing a retrieval intention and obtaining a real-time permission context of a user to determine a security level threshold value, verifying a security attribute voucher of the data when retrieving the mixed index, only putting the data with the security level not higher than the threshold value into a result set, and performing association reasoning based on the knowledge graph under permission constraint to expand a result. According to the method, the mixed index structure fusing the inverted index, the vector index and the graph index is constructed, the security attribute voucher is associated, efficient full-text retrieval, semantic retrieval and association reasoning are supported, meanwhile, it is ensured that the retrieval process and result are strictly constrained by permission, and maximum mining of data values on the premise of security is achieved.

The present disclosure provides a business security policy generation method, device, equipment and storage medium, which can be applied to the field of information security technology and the field of financial technology. The business security policy generation method comprises: in response to receiving business data, generating a security attribute table based on the data type of the business sub-data included in the business data; determining target attribute data from a plurality of attribute data included in the security attribute table; determining a risk policy corresponding to the target attribute data from a preset risk database, wherein the preset risk database comprises an association relationship between the target attribute data and the risk policy; and determining a business security policy model based on the risk policy and a target processing policy corresponding to the risk policy.

Technology is shown for dynamically attaching secure properties to an identity certificate. Claims determining secure properties for an identity are signed and embedded in an identity certificate. Both the identity certificate and the signed claims in the certificate are verified. When a service request is received from the identity, the signed claims from the identity certificate are checked to determine if the request is permitted. If the request is permitted, then the service request is processed. Some examples involve creating claims determining the secure properties for the remote machine, signing the claims to create the signed claims, distributing the signed claims to a certificate authority, embedding the signed claims in the remote machine identity certificate, and distributing the remote machine identity certificate. The claims can be embedded in the certificate as X.509 properties.

The invention provides supporting memory paging in a virtualized system using a trust domain. Embodiments of the present disclosure provide techniques to support full memory paging between different trust domains (TDs) in a computing system without losing any security attributes, such as tamper / detection and confidentiality based on per TD. In one embodiment, a processing device is provided that includes a memory controller and a memory paging circuit operatively coupled to the memory controller. Memory paging circuitry is to evict memory pages associated with a trust domain (TD) executed by a processing device. The binding of the memory page to the first memory location of the TD is removed. A deliverable page of encrypted content including the memory page is created. Thereafter, the memory page is provided to a second memory location.

A secure cloud computing architecture including: a first data management and / or computer program execution space (A) in which the data management or program execution is controlled by a user; and a second data management and / or computer program execution space (B) in which the data management or program execution is controlled by a third-party operator, first security policies (PSA) applied to the data or execution of programs in the first execution space (A); second security policies (PSB) applied to the data or execution of programs in the second execution space (B); a security property (P) expected by the user, compliance with the first and second security policies guaranteeing a data management and / or computer program execution in accordance with this property (P); and a trusted computing base (TCB) guaranteeing, in the absence of a violation, the application of the second security policies (PSB) in the management of the data and / or execution of the programs in the second execution space (B).

The invention discloses a privacy protection and traceable anonymous bidirectional authentication method for heterogeneous Internet of Vehicles, which comprises the following steps: generating public and private keys based on a key generation center, a private key generator and a trusted registration mechanism, and constructing a heterogeneous password system; the vehicle completes key registration by fusing the certificateless public key system, and the roadside unit completes key registration based on the identity public key system; the vehicle registers and uses the pseudonym to communicate with the roadside unit; and the vehicle and roadside unit bidirectional authentication verifies the legality of the opposite side through a hash function and a temporary value, and finally generates a session key. According to the invention, by providing traceable pseudonym and anonymous authentication communication for each vehicle, the privacy of the vehicle can be effectively protected, and an attacker can be prevented from tracking the identity information of the vehicle. Based on various security hypotheses, the method meets various security attributes including anonymity, unlinkability, perfect forward security, security of known temporary information specific to sessions and the like, and the security of data transmission of the Internet of Vehicles can be improved.

The present invention discloses a cloud computing task scheduling method based on privacy protection, which relates to the field of task processing technology and includes the following steps: S1, obtaining tasks to be scheduled and performing privacy processing on the tasks to be scheduled; S2, after the privacy processing, generating an influence matrix between the tasks to be scheduled and each container based on a number of containers of the cloud platform, and determining the scheduling unit of the tasks to be scheduled according to the influence matrix; S3, completing the scheduling processing according to the scheduling unit of the tasks to be scheduled. The present invention converts the security attributes of the container nodes into vector form through a hash vectorizer, determines the influence matrix in combination with the task priority; then captures the synergistic effect of risk and priority through vector operations, avoiding the one-sidedness of single indicator decision-making; and finally enables the tasks to be scheduled to run in units of containers, reducing interference between tasks. At the same time, the present invention enhances the robustness against unknown attacks and overcomes the defense shortcomings of traditional scheduling methods.

The embodiment of the invention relates to the technical field of industrial network security, in particular to a data interaction method and device and a storage medium. The method comprises the following steps: receiving an S7Comm-plus protocol message sent by a client; the message type of the S7Comm-plus protocol message is determined; determining a processing mode of the S7Comm-plus protocol message according to the message type, wherein the processing mode comprises message encryption and security attribute check; the S7Comm-plus protocol message is processed on the basis of the processing mode, so that the processed S7Comm-plus protocol message is obtained; the processed S7Comm-plus protocol message is sent to the equipment end, and the S7Comm-plus protocol message is sent to the equipment end; receiving response data returned by the equipment end; and sending the processed response data to the client. Through the scheme, the confidentiality and security of the data can be improved, illegal access and malicious control are effectively prevented, and the security of data interaction is improved.

The present invention relates to a method, computing device, medium and program product for controlling data access. The method comprises: determining at least one GPU instance as a secure GPU instance among one or more GPU instances configured on the device side, wherein the one or more GPU instances are used to construct one or more physically isolated hardware access paths between a host and a device; using a security main control unit configured in the secure GPU instance to set a security bit, wherein the security bit is used to indicate the security attribute of an access request to a device memory; and at least using the security bit to check access to the device memory associated with the secure GPU instance. The present invention can prevent sensitive data on the device side from being leaked due to untrusted drivers or insecure command packet transmission, thereby significantly improving the security of sensitive data.

A method, device, equipment and storage medium for data access control are provided. The method described herein comprises: receiving a data query request for characterizing a first user's request for target data; obtaining a business data access capability attribute corresponding to the first user and obtaining a business security attribute corresponding to the target data; calling a data access security model to determine a data query processing strategy corresponding to the data query request according to the business data access capability attribute of the first user and the business security attribute of the target data; and calling the data query processing strategy to process the target data and generating a response message for feedback. According to the fact of the present disclosure, by providing a response to the request based on the business data access capability attribute of the user and the business security attribute of the target data, the access of the user to the data can be effectively controlled.

The invention provides a module safety protection system and method, computer equipment and a storage medium, the system comprises a plurality of main control modules and a plurality of safety gate modules, and each safety gate module corresponds to an internal module; each master control module is used for initiating an access request to the internal module, and the access request carries a hardware identity label and an access security attribute of the master control module; each security gate module is used for receiving the access request and carrying out legality verification on the hardware identity identifier and the access security attribute based on a pre-configured security rule; and each security gate module is also used for allowing access to the corresponding internal module when the hardware identity identifier and the access security attribute pass verification, or blocking the access request. By adopting the scheme, illegal access can be accurately resisted, the data security of the internal module is protected, and the protection capability is improved.

The invention discloses a data storage method, private cloud equipment and a medium, and relates to the technical field of cloud resource data storage, the method is used for the private cloud equipment, and the method comprises the following steps: obtaining a data file and configuration information sent by a terminal; wherein the configuration information comprises authority information corresponding to a plurality of storage resources; the storage resource comprises at least one of a public cloud server, a private cloud server and private cloud equipment; under the condition that the received configuration information comprises the storage resource of the data file, sending the data file to the storage resource according to the security attribute of the data file and the authority information corresponding to the storage resource; wherein the configuration information further comprises security attributes of the data file; storing a storage record of the storage data file to the private cloud equipment; wherein the storage record comprises a storage resource to which the data file is sent. The method has the advantages that data management is convenient, user operation is non-inductive, and storage resources are expanded.

The present invention discloses a counter-example guided sparse spatial flow model detection method and system, compiles the C program code to be verified into LLVM intermediate code; constructs a sparse spatial flow model of the program to be verified; abstracts the model variables, and executes a model detection algorithm of explicit value analysis to detect whether there are counter-examples in the abstract model; verifies the feasibility of the counter-examples, and determines whether the counter-example path is valid in the original model; guides the model to refine the abstraction based on interpolation and the path, context and field sensitive strong update refinement model through counter-example information, and performs model detection again; determines whether the program violates the security attribute by the presence or absence of weak updates on the counter-examples and counter-example paths. The method of the present invention can accurately and efficiently analyze the state changes of C language program software at the symbol level and address space level by implementing the counter-example guided sparse spatial flow model detection method, and realizes security formal verification.

The present application relates to a method, device and equipment for security verification of a recursive protocol based on constraint solving. The method includes: obtaining known information of the recursive protocol; establishing adversary derivation rules, and deducing known messages according to the adversary derivation rules to obtain new messages; symbolizing the new messages constructed by the adversary at a certain stage of the recursive protocol execution as variables, abstracting the infinite number of possible execution traces of the security protocol into a set of derivation constraints, and the adversary constructs a constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol; simplifying the constraint system according to pre-set simplification rules to obtain a simple constraint system; modeling the security attribute to be verified as a first-order formula, and determining whether the adversary can destroy the security attribute to achieve security verification by solving whether the simple constraint system and the first-order formula have a common solution. This method can be used to achieve security verification for recursive protocols.

The invention relates to the technical field of operation permission management, in particular to an operation ticket electronization and process automation method and system. Comprising an operation ticket data acquisition unit; a ticket template configuration and electronic generation unit; a process automation scheduling and execution unit; and an approval and authority verification unit. According to the invention, through deep linkage of a personnel positioning function and approval process circulation, the on-duty state of the approval personnel and the security attribute of the area where the approval personnel are located can be captured in real time; and dynamically adjusting the trend of the approval process and the substitution qualification of related personnel according to the information, namely automatically skipping the substitution qualification of the approval personnel in an operation dangerous area, and starting a substitution matching process for the approval personnel in a safe area. The method effectively avoids the stagnation of the examination and approval process caused by the fact that the examination and approval personnel are out of duty or cannot perform duty in a dangerous area, and fully meets the actual demands of flexible adjustment of the examination and approval process in a complex operation scene.

Context-aware security policies and incident identification, via automated cloud graph building with security overlays, are determined and performed by systems and platforms. Graph nodes, of a graph associated with a computing system, that represent resources associated with the computing system and entities associated with the computing system that have respective associations to the resources are generated. Security attributes are determined and assigned to the graph nodes that represent the entities and resources, and static and dynamic connections between the graph nodes are added to the graph. Additionally, possible connections in the graph between the graph nodes are added based on heuristic relational determinations of the graph nodes. From the graph, security incidents and kill chains are identified, context-aware security policies are generated and validated, and scopes and relationships of applications are identified. Accordingly, security actions are taken for the computing system.