277 results about "Trust network" patented technology

The invention discloses a zero-trust network dynamic access control method based on an AI behavior portrait, and the method comprises the following steps: 1, collecting multi-source real-time behavior data during an access request; 2, constructing an AI behavior portrait engine based on historical data, inputting the integrated multi-source behavior data, calculating a behavior deviation degree through the AI behavior portrait engine, and outputting a risk score; 3, dynamic strategy decision making, wherein a decision making engine executes hierarchical control according to the risk score; 4, continuous session monitoring and real-time adjustment are carried out; step 5, when risk upgrading is detected in the session, degrading the session authority, limiting high-risk operation, terminating the session, and retaining evidence obtaining data; step 6, audit event generation and portrait updating; and step 7, strategy optimization closed loop. According to the method, the risk score is calculated in real time based on the AI behavior portrait, transition from static authorization to dynamic permission adjustment is realized, and internal threats such as voucher stealing and the like are effectively blocked.

In order to efficiently manage a secure tunnel between a zero trust network access (ZTNA) connector (on the customer premises hosting a ZTNA application) and a cloud-based ZTNA data plane, tunnel components such as a WebSocket server can be run on the cloud platform that is hosting the data plane. As a significant advantage, this can simplify customer ZTNA deployments by permitting a reduction in the size and complexity of the ZTNA connector that is deployed to the customer premises.

A method performed by a user equipment to establish a secured connection with an application entity in an enterprise network. The method comprises sending an establishment request to a secure access secure edge (SASE) entity: receiving an establishment response from the application entity if the SASE entity determines to allow the establishment request and authorizes Generic Bootstrapping Architecture / Authenticated Key Management for Application (GBA / AKMA) platform to share a session key with the application entity; and establishing a connection with the application entity based on the session key.

Systems and methods for performing ZTNA secure traffic forwarding are provided. In one example, as part of setting up a TFAP tunnel, between a target service and an endpoint security agent of an endpoint device through which an application running on the endpoint device can interact with the target service, a secure connection is established between the endpoint security agent and a ZTNA AP. Based on an encryption status of traffic transmitted from the application to the target service: (i) protection against eavesdropping by an MITM attacker is provided by using the secure connection to encrypt one or more critical messages of the traffic between the endpoint security agent and the ZTNA AP; and (ii) the endpoint security agent abstains from switching to bypassing mode through the TFAP tunnel until after the one or more critical messages of the traffic have been exchanged.

The invention provides a digital culture product right confirmation and data sharing method and system based on a block chain, and relates to the technical field of digital culture, and the method comprises the steps: generating a comprehensive trust score through a self-adaptive trust evaluation model by fusing timeliness, integrity and consistency trust scores, and constructing a self-evolution data trust network and an encrypted data synchronization channel. After smart contract verification, the access authority of the data requester is determined according to the trust score, access features are extracted through a bidirectional long-short term memory network and a multi-head attention mechanism, a proof chain node is constructed, a mapping relation with an authority confirmation certificate is established by using a graph neural network, and the access contribution degree is calculated through homomorphic encryption and federated learning; and finally, performing income distribution according to a sectional income distribution curve. According to the invention, the problems of difficult right confirmation and low data sharing credibility of digital culture products are effectively solved, and safe and controllable data sharing and income distribution are realized.

In a cloud-based data plane for a zero trust network access system, a service proxy manages incoming user requests for access to ZTNA applications. A load balancer may be configured to retrieve connection information from the data plane such as connection counts, tunnel distributions, and so forth, and to use this information to provide load balancing information to the service proxy, so that the service proxy can specify a route to the customer premises through the data plane. Secure tunnels to a customer premises can also be scaled according to traffic using tunnel information available within the data plane. In one aspect, tunnels can be scaled up by checking for connections and only adding a new tunnel when existing tunnels are full. In another aspect, tunnels can be scaled down by removing existing connections as they are taken down by users, and timing out connections that exceed a timeout window.

The invention belongs to the technical field of novel electric power system operation control and trust management, and particularly discloses a virtual power plant full-process trusted aggregation method and system based on a hierarchical trust chain. Differentiated hierarchical trust chain models of a data acquisition link, a scheduling control link and a market transaction link are constructed respectively; through real-time credibility evaluation and adaptive weight adjustment, credibility calculation of multi-agent collaborative decision is realized. According to the invention, a trust network formed by a plurality of efficient, safe and transparent virtual power plant trust chains is constructed, solid technical support is provided for fair competition, intelligent scheduling and reliable operation of a power market, and efficient interaction and stable operation of a power system are ensured.

The disclosure provides a method for authenticating a network agent deployed in a networking environment. The method generally includes receiving, by a network controller in the networking environment, a name of an external node where the network agent is running and a token associated with the external node; in response to receiving the name of the external node, obtaining, by the network controller, a secret associated with the token; parsing, by the network controller, the secret to determine an expected external node name corresponding to the token; comparing the expected external node name with the received external node name; and trusting the network agent when the expected external node name and the received external node name match.

A method performed by a computer-implemented controller is provided. The method includes receiving a request for managing one or more user equipments (UEs); obtaining a user-specific security profile from a first service provider; obtaining a subscriber identity module (SIM) profile from a network node or a second service provider; obtaining a set of secure access service edge (SASE) instances from the network node; building one or more UE-specific bootstrap configurations based on the user-specific security profile, the SIM profile, and the set of SASE instances; and sending the one or more UE-specific bootstrap configurations to a third service provider. The one or more UE-specific bootstrap configurations are obtainable by the one or more UEs to establish a secured wireless communication channel through a zero-trusted network.

The embodiment of the invention discloses a human and AI collaborative large-scale group decision-making method and equipment based on a trusted network. The method comprises the following steps: constructing a decision-making problem; performing initial evaluation on the alternative scheme through a human decision maker set and an AI decision maker set to obtain initial evaluation information; constructing a human and AI trusted network; establishing a continuously learned human and AI consensus reaching algorithm, and dynamically updating the human and AI trust network and the initial evaluation information through the human and AI consensus reaching algorithm to obtain final evaluation information; calculating the weight of each attribute in the alternative scheme and the weight of each decision maker according to the final evaluation information; the final score of each alternative scheme is calculated, and a final decision is generated; the decision-making response speed, precision and decision-making consistency can be effectively improved, and the method is suitable for the complex decision-making field.

The embodiment of the invention provides a distributed medical equipment management platform and method based on a zero-trust network. In the distributed medical equipment management platform based on the zero-trust network, an edge trusted access module adopts a hardware root of trust mechanism, so that equipment accessed for the first time is connected to a temporary supply network isolated from a medical core network, and a zero-trust security normal form is followed; the distributed trust anchor point cluster constructs a distributed identity verification network based on federated learning, and the access pre-authorization authority is verified through a device distributed identity identification (DID); the dynamic permission arrangement engine injects an attribute-based access control strategy, generates a permission token in combination with network micro-segmentation, and realizes two-way encryption communication between the equipment and a target service; the intelligent isolation gateway cuts off temporary connection through a software defined network technology and sends a network access state proof through a block chain mechanism, and edge module initialization is executed by a trusted node outside the medical cloud.

Examples of the present disclosure describe systems and methods for zero trust domain name system (DNS) (ZTDNS) based networking. A computing device implementing ZTDNS based networking blocks any outbound connections that are not included in a list of trusted IP addresses. The list of trusted IP addresses is updated in response to the computing device receiving from a trusted DNS server an IP address corresponding to a DNS request. In some examples, the ZTDNS based networking intercepts and evaluates outbound communications for applications that implement a custom application DNS client. In other examples, the ZTDNS based networking intercepts and evaluates outbound communications for virtual environments. The outbound communications for both the custom application DNS client and the virtual environments are proxied through a local DNS client of the computing device.

A zero trust network access (ZTNA) system provides secure access to applications hosted on a customer premises. The ZTNA system is modified to facilitate distributed and / or cloud-based deployments of components for a control plane and a data plane that cooperate to support a network-accessible front end for the customer's locally hosted applications. A customer-side connector can be further simplified for deployment by moving ZTNA components for, e.g., secure tunneling, authorization, and authentication into the cloud-based infrastructure, and by managing deployment and configuration of the connector through a threat management facility for the customer premises.

The invention relates to the related technical field of zero-trust networks, in particular to a network data security protection method and system based on multi-protection right control, and the method comprises the steps: connecting a terminal and a protection center, setting a primary authorization mechanism, starting hierarchical authorization of a right group, evaluating the risk in real time, interrupting the access if the risk does not accord with the threshold, and carrying out the threat sharing. The technical problems that the authority is allocated only according to a fixed role, the enterprise business scene change and the user actual demand change cannot be adapted, the access of the user to the isolated data area resource is lack of fine-grained control, the situation of excessive authority granting or insufficient authority granting is easy to occur, and the data leakage risk is increased are solved; according to the invention, dynamic hierarchical management of the authority is realized by constructing a primary authorization authentication mechanism and a hierarchical authorization authentication mechanism, the authority is minimized to a single service instance, and fine-grained partitioning is carried out on resources, so that data access control is more accurate, illegal data access and attack diffusion are effectively blocked, and data access efficiency is improved. And the safety of the isolated data area is ensured.

The invention relates to a zero-trust network node dynamic trust degree evaluation and intelligent resource allocation method, equipment and medium, based on the principle of never trust and continuous verification, continuous information acquisition processing is carried out on all interaction nodes in a zero-trust network environment, a node trust degree calculation model is constructed based on processed data, and the dynamic trust degree evaluation and intelligent resource allocation of the zero-trust network node is realized. Weight parameters are dynamically optimized through a credibility evaluation layer; a dynamic trust threshold is set according to the node trust degree, an access control strategy is adjusted at a decision-making layer, and hierarchical allocation of resources is implemented. In addition, a continuous authentication and anomaly detection mechanism is introduced, node behaviors are monitored in real time, a trust strategy is dynamically adjusted, and abnormal access is limited; based on behaviors, contexts and real-time trust evaluation, refined access control and resource management are realized, internal threats, permission abuse and potential attacks can be effectively prevented, security requirements in a complex dynamic environment are met, and trust management efficiency and resource scheduling rationality are further improved.

The invention provides a property management platform based on endogenous safety. The property management platform comprises an endogenous safety property management system, wherein the endogenous safety property management system comprises essential place analysis, heterogeneous resource configuration, heterogeneous execution body generation and mimicry component embedding; a security architecture technical route in the endogenous security property management system comprises a control plane and a data plane. The endogenous security property management system further comprises a mimicry construction intelligent Internet of Things zero-trust assembly, and the mimicry construction intelligent Internet of Things zero-trust assembly is used for providing endogenous security for the zero-trust system. Fine-grained security control of continuous authentication and dynamic authorization is realized by taking a software-defined dynamic fine-grained boundary as guidance, that is, a trusted network is established by taking an identity label of an Internet of Things terminal as a center, a model framework for realizing an intelligent Internet of Things zero-trusted network is researched, and a framework of an endogenous security property management system is constructed.

A cloud computing platform provides zero trust network access as a service to customers that maintain applications on-premises. In this context, the cloud computing platform may associate customers and / or applications with specific service proxies, and add an abstraction layer for network access that maps an alias domain for each customer and / or application to a network load balancer associated with the specific service proxies associated with the corresponding application(s). This approach advantageously simplifies the configuration of service proxies at the cloud computing platform by permitting dedicated relationships among network load balancers, specific service proxies, and specific applications, while concurrently reducing or avoiding the administrative burden on customers of updating network pointers when the clusters of service proxies are periodically reconfigured to adjust to varying user traffic.

A method for communications in a network can include performing a pairing between a first device and a second device in the network. The method can include deriving a port knocking sequence from identification information of the pairing. The method can include providing port knocking according to the port knocking sequence. The method can include authorizing a connection between the first device and the second device responsive to detecting the port knocking sequence. Other devices and methods are described.

A cloud-based platform for zero trust network access (ZTNA) services provides zero trust network access as a service for multiple customers in a multi-tenant architecture. In this context, the configuration for a new ZTNA application is validated with a service proxy in a sandbox or similar environment before release by the cloud-based platform for access through a public network. As a significant advantage, this approach mitigates inadvertent conflicts or instability in a service proxy that supports other applications and customers.

The embodiment of the invention provides an SQL injection attack protection method and device based on a zero-trust framework, and the method comprises the steps: tracking a current operation behavior of operation data in a zero-trust network, and determining whether the current operation behavior belongs to a to-be-verified behavior in the zero-trust network; if yes, calling a pre-trained linear support vector classifier (LSVC) model to detect the current operation behavior; if the detection result is the SQL injection attack, refusing the current operation behavior; wherein the pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set comprises data of a plurality of malicious SQL injection attacks and normal data. The method provided by the embodiment of the invention solves the problems that the user experience is reduced and the management cost of an administrator is increased due to limitation of user input in the prior art.

The invention discloses a transaction management method, system and device based on electronic visa, and a medium, and relates to the field of transaction management. The method comprises the following steps: constructing a distributed trusted network, and deploying a block chain on the distributed trusted network; compiling a smart contract according to a preset rule and a preset protocol, and deploying the smart contract to the block chain; when two transaction parties conclude a transaction intention, a transaction initiator initiates a transaction request on the block chain, and an electronic visa of the transaction initiator is attached to the transaction request; and according to the transaction request, the identities and the electronic visa of the two transaction parties are verified through the smart contract, and when the verification is passed, the two parties are approved to perform the transaction and a transaction record is generated on the block chain. By implementing the technical scheme provided by the invention, the transaction efficiency is improved, the human intervention is reduced, and the legality and credibility of the transaction are ensured.

The invention discloses an intelligent decision-making method and system based on deep learning, and relates to the field of data processing. The method comprises the steps of obtaining place data and corresponding attribute data of a to-be-decided project; establishing a fuzzy relation matrix between the places and the attributes; generating a network model reflecting trust relationship strength among users through trust propagation operation of the graph neural network; identifying a community structure containing a community overlapping degree through a community discovery algorithm; and according to the trust relationship strength between the users and the community overlapping degree, calculating an influence weight of a decision maker, forming a group consensus through a robust optimization method, and generating a decision result of the project to be decided. Aiming at low network relation modeling precision caused by multi-source heterogeneous data in bus station layout decision making in the prior art, the method and the device have the advantages that the network relation modeling precision is low through accurate modeling of an information propagation path in a complex trusted network, effective dimension reduction representation of a high-dimensional feature space and robust optimization solution in an uncertain environment; therefore, the calculation precision and robustness of the bus station layout intelligent decision-making system are improved.

Enhanced security for Zero Trust networks is provided by SSH-customized tunnel clients / tunnel servers, a catalog service, and loopback address DNS mechanisms. Systems and methods provide Policy Enforcement Point (PEP) layer enhancements, strategically positioning the PEP between the user and the network resource. It manages network traffic flows and provides moderate control granularity, near-real-time enforcement decisions, low overheads, and broad applicability to TCP / IP traffic through modified tunneling implementations of Secure Shell (SSH). Unique use of SSH tunneling is utilized and adapted to selectively filter tunnel requests based on user entitlements, ensuring secure and authorized access to network resources. This method entails detailed assessment of tunneling requests, DNS manipulation, and the use of loopback address space for traffic redirection, all without requiring modifications to client-side applications. The approach significantly enhances network security by controlling access based on continuous verification of user entitlements, addressing the shortcomings of traditional network security models.

Systems and methods for active directory security enforcement and threat insights on zero trust networks include performing inline monitoring of traffic associated with a plurality of tenants of the cloud-based system; classifying the traffic as being associated with any of one or more active directory protocols; inspecting the traffic associated with the one or more detected active directory protocols; and performing one or more actions on the traffic based on the inspecting.

Techniques for leveraging the MASQUE protocol to provide remote clients with full application access to private enterprise resources are described herein. One or more network nodes may be configured to execute a MASQUE proxy service to provide a remote client device with full access to an enterprise / private application resource executing on an application node and hosted in an enterprise / application network, behind the MASQUE proxy service. In some examples, the MASQUE proxy service may execute on a single proxy node hosted at an edge of a cloud network or at an edge of an enterprise network. Additionally, or alternatively, a first instance of the MASQUE proxy service may execute on a first proxy node hosted at an edge of a cloud network (e.g., an ingress proxy node) and a second instance of the MASQUE proxy service may execute on a second proxy node hosted at an edge of the enterprise network.

A system for zero-trust cybersecurity access control using continuous identity verification (100), comprising: a Policy Decision and Enforcement Orchestrator (1) configured to receive an access request from a user device and enforce a session with minimal privileges; an engine for continuous identity verification (2) configured to generate a time-dependent identity trust score by continuously verifying the user identity during an active session; a device state and telemetry collector (3) configured to acquire device state parameters, runtime signals and network telemetry and to generate a state value; a module for detecting behavioral risks and anomalies (4) that is configured to create behavioral profiles and detect anomalies based on user activity patterns, contextual signals and the history of resource access; a cryptographic authentication and secure token module (5) configured to issue and update a short-lived, bound access token associated with at least the identity trust value and the state value; and an adaptive response and microsegmentation module (6) configured to dynamically adjust access permissions, network segmentation and session privileges in real time, based on an aggregated risk assessment derived from modules (2) to (4), where the system (100) continuously reassesses trustworthiness during the session and selectively allows, restricts, requires enhanced authentication or terminates the session based on the aggregated risk assessment.

The invention discloses a zero-trust security access system based on a random forest positioning method, and the system comprises the following modules: a behavior characteristic collection module which is used for collecting original behavior data generated by network interaction between a user and equipment; the structure time sequence modeling module is used for converting the behavior characteristic data set into structured time sequence diagram data; the graph neural network analysis module is used for generating a security risk feature representation vector; the adversarial disturbance enhancement module is used for actively generating random disturbance data to form a disturbance enhancement risk feature representation vector; the random forest positioning module is used for positioning safety risk positions of the user and the equipment through an improved random forest algorithm; the dynamic risk assessment module is used for calculating a security risk level in real time; and the access decision module is used for dynamically adjusting zero-trust network access permission configuration. According to the invention, the security risk positioning precision and the dynamic risk response capability are effectively improved.

In one embodiment, a method may implement a multi-layer cybersecurity model for a multi-layer distributed computer system which comprises a sensitive data resource, such as a computing environment with an operational technology (OT) layer with multiple zones, an information technology (IT) layer, a DMZ, and a cloud layer. The method can assess a policy based on a zero-trust model for the sensitive data resource. The method can receive one or more requests, at any layer of a multi-layer distributed computing system, to access the sensitive data resource and acquire identity information for a user account specified in the first request. The method can perform a multi-layer multi-factor authentication of the user account using the identity information and the multi-layer cybersecurity model. In response to authenticating the identity information, the method can acquire sensitive access data corresponding to the identity information. The method can determine a sensitive resource access value using the sensitive access data and the zero trust model. In response to determining the sensitive resource access value is above a predetermined threshold, the method can authenticate the user account.

Systems and methods for active directory protection in zero trust networks. In an embodiment, steps include performing inline monitoring of traffic associated with a cloud-based system; detecting one or more active directory protocols based on the inline monitoring; classifying the traffic as being associated with any of the one or more active directory protocols; inspecting the traffic associated with the one or more detected active directory protocols; and generating one or more active directory logs based on the inspecting and classifying.

A cloud-based platform for zero trust network access (ZTNA) services provides zero trust network access as a service for multiple customers in a multi-tenant architecture. In this context, the configuration for a new ZTNA application is validated with a service proxy in a sandbox or similar environment before release by the cloud-based platform for access through a public network. As a significant advantage, this approach mitigates inadvertent conflicts or instability in a service proxy that supports other applications and customers.