400 results about "Trust network" patented technology

The invention discloses a zero-trust network dynamic access control method based on an AI behavior portrait, and the method comprises the following steps: 1, collecting multi-source real-time behavior data during an access request; 2, constructing an AI behavior portrait engine based on historical data, inputting the integrated multi-source behavior data, calculating a behavior deviation degree through the AI behavior portrait engine, and outputting a risk score; 3, dynamic strategy decision making, wherein a decision making engine executes hierarchical control according to the risk score; 4, continuous session monitoring and real-time adjustment are carried out; step 5, when risk upgrading is detected in the session, degrading the session authority, limiting high-risk operation, terminating the session, and retaining evidence obtaining data; step 6, audit event generation and portrait updating; and step 7, strategy optimization closed loop. According to the method, the risk score is calculated in real time based on the AI behavior portrait, transition from static authorization to dynamic permission adjustment is realized, and internal threats such as voucher stealing and the like are effectively blocked.

In order to efficiently manage a secure tunnel between a zero trust network access (ZTNA) connector (on the customer premises hosting a ZTNA application) and a cloud-based ZTNA data plane, tunnel components such as a WebSocket server can be run on the cloud platform that is hosting the data plane. As a significant advantage, this can simplify customer ZTNA deployments by permitting a reduction in the size and complexity of the ZTNA connector that is deployed to the customer premises.

A system and method for configuring a client device to communicate utilizing a secure web gateway. The method includes generating a virtual network interface having a namespace with a plurality of names, wherein a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible to the client device through a zero trust network environment, wherein the resource is deployed in a secure network environment; and configuring the client device to communicate only through the virtual network interface.

In some examples, a proxy system establishes a client-side secure network tunnel between the proxy system and a client device, and establishes a plurality of server-side secure connections between the proxy system and respective servers of a trust network. The proxy system load balances a plurality of connections of the client device in the client-side secure network tunnel across the servers of the trust network through respective server-side secure connections of the plurality of server-side secure connections.

Techniques for leveraging the MASQUE protocol to provide remote clients with full application access to private enterprise resources are described herein. One or more network nodes may be configured to execute a MASQUE proxy service to provide a remote client device with full access to an enterprise / private application resource executing on an application node and hosted in an enterprise / application network, behind the MASQUE proxy service. In some examples, the MASQUE proxy service may execute on a single proxy node hosted at an edge of a cloud network or at an edge of an enterprise network. Additionally, or alternatively, a first instance of the MASQUE proxy service may execute on a first proxy node hosted at an edge of a cloud network (e.g., an ingress proxy node) and a second instance of the MASQUE proxy service may execute on a second proxy node hosted at an edge of the enterprise network.

The invention discloses a decentralized public key infrastructure constructed based on a block chain and a trusted network, and belongs to the field of information security PKI public key infrastructure, and the method comprises the following steps: 1, building a decentralized CA mechanism; 2, a user submits a certificate application / update / abolish request; the user certificate request is submitted to a decentralized CA mechanism, and the decentralized CA mechanism service calls the block chain to generate / update / abolish the digital certificate; and 3, verifying the user certificate request by using a block chain technology. The certificate request is validated using a smart contract technique. The decentralized public key infrastructure constructed based on the block chain and the trusted network aims to solve the problems of single-point failure, non-transparent certificate, time-consuming certificate revocation and the like existing in a CA mechanism in a traditional PKI system, and emphatically realizes that the problem that the PKI trusted system collapses due to the failure of the CA mechanism in a certificate life cycle management process of the CA mechanism is solved; and meanwhile, certificate transparency is realized, and certificate revocation efficiency is improved.

A method performed by a user equipment to establish a secured connection with an application entity in an enterprise network. The method comprises sending an establishment request to a secure access secure edge (SASE) entity: receiving an establishment response from the application entity if the SASE entity determines to allow the establishment request and authorizes Generic Bootstrapping Architecture / Authenticated Key Management for Application (GBA / AKMA) platform to share a session key with the application entity; and establishing a connection with the application entity based on the session key.

Systems and methods for performing ZTNA secure traffic forwarding are provided. In one example, as part of setting up a TFAP tunnel, between a target service and an endpoint security agent of an endpoint device through which an application running on the endpoint device can interact with the target service, a secure connection is established between the endpoint security agent and a ZTNA AP. Based on an encryption status of traffic transmitted from the application to the target service: (i) protection against eavesdropping by an MITM attacker is provided by using the secure connection to encrypt one or more critical messages of the traffic between the endpoint security agent and the ZTNA AP; and (ii) the endpoint security agent abstains from switching to bypassing mode through the TFAP tunnel until after the one or more critical messages of the traffic have been exchanged.

The invention provides a digital culture product right confirmation and data sharing method and system based on a block chain, and relates to the technical field of digital culture, and the method comprises the steps: generating a comprehensive trust score through a self-adaptive trust evaluation model by fusing timeliness, integrity and consistency trust scores, and constructing a self-evolution data trust network and an encrypted data synchronization channel. After smart contract verification, the access authority of the data requester is determined according to the trust score, access features are extracted through a bidirectional long-short term memory network and a multi-head attention mechanism, a proof chain node is constructed, a mapping relation with an authority confirmation certificate is established by using a graph neural network, and the access contribution degree is calculated through homomorphic encryption and federated learning; and finally, performing income distribution according to a sectional income distribution curve. According to the invention, the problems of difficult right confirmation and low data sharing credibility of digital culture products are effectively solved, and safe and controllable data sharing and income distribution are realized.

Techniques and architecture are described for eliminating double encryption in zero-trust network access authenticated sessions. The techniques include an endpoint client-based proxy of a network receiving, from a browser, a request to access a protected private service. The endpoint client-based proxy pauses access of the browser to the protected private service and establishes a transport layer security (TLS) connection between the endpoint client-based proxy and a zero-trust network access (ZTNA) gateway. The ZTNA gateway determines whether the protected private service uses a secure transport mechanism and establishes either a null cipher encrypted tunnel between at least the endpoint client-based proxy and the ZTNA gateway or a non-null cipher encrypted tunnel between at least the endpoint client-based proxy and the ZTNA gateway. The endpoint client-based proxy resumes access of the browser to the protected private service.

In a cloud-based data plane for a zero trust network access system, a service proxy manages incoming user requests for access to ZTNA applications. A load balancer may be configured to retrieve connection information from the data plane such as connection counts, tunnel distributions, and so forth, and to use this information to provide load balancing information to the service proxy, so that the service proxy can specify a route to the customer premises through the data plane. Secure tunnels to a customer premises can also be scaled according to traffic using tunnel information available within the data plane. In one aspect, tunnels can be scaled up by checking for connections and only adding a new tunnel when existing tunnels are full. In another aspect, tunnels can be scaled down by removing existing connections as they are taken down by users, and timing out connections that exceed a timeout window.

The invention belongs to the field of privacy protection data, and provides a privacy protection data exchange method and system under a zero-trust network architecture in order to solve the problem that a traditional scheme cannot cope with the privacy leakage risk through data analysis. The privacy protection data exchange method under the zero-trust network architecture comprises the following steps: performing tagging processing on user behavior data, equipment state data and operation environment data; executing multi-dimensional dynamic risk assessment, and calculating a comprehensive risk score; adjusting privacy budget and noise intensity according to a comprehensive risk scoring result, and protecting a data query result in combination with an adaptive differential privacy mechanism; performing dynamic data desensitization based on information entropy on a data query result; embedding a self-evolved data watermark into the data after the data query result desensitization processing is completed; the embedded watermark data is exchanged through the encrypted transmission channel, and the transmission process is monitored in real time, so that the security and integrity of the data exchange under the zero-trust network architecture are ensured.

A system and method for providing file scanning between a client device and a resource through a zero trust network environment (ZTNE) are disclosed. The method includes detecting in network traffic between the client device and the ZTNE a request to receive a first content from a resource deployed in a private network, wherein the resource is accessible to the user device making first request through the ZTNE; detecting in network traffic between the client device and the ZTNE a second request to send a second content from the client device to a public network, wherein the public network is accessible to the user device making the second request through the ZTNE; sending the request to the public network, in response to determining that the second content is allowable; and blocking the request to the public network, in response to determining that the second content is not allowable network traffic.

A system and method for dynamic authentication attack detection an enforcement at the network, application, and host level that enables zero trust network security principles when combined with stateful authentication object tracking, authentication object manipulation and forgery7 detection, and assessment of authentication and identity7 attack surface. The methodology involves gathering all authentication objects issued by a network, storing the authentication objects in a centralized location for use in stateful deterministic authentication object tracking, scoring the completeness of the authentication risk observations, and intervening in authentication processes when the potential risk is too great.

The invention belongs to the technical field of novel electric power system operation control and trust management, and particularly discloses a virtual power plant full-process trusted aggregation method and system based on a hierarchical trust chain. Differentiated hierarchical trust chain models of a data acquisition link, a scheduling control link and a market transaction link are constructed respectively; through real-time credibility evaluation and adaptive weight adjustment, credibility calculation of multi-agent collaborative decision is realized. According to the invention, a trust network formed by a plurality of efficient, safe and transparent virtual power plant trust chains is constructed, solid technical support is provided for fair competition, intelligent scheduling and reliable operation of a power market, and efficient interaction and stable operation of a power system are ensured.

The disclosure provides a method for authenticating a network agent deployed in a networking environment. The method generally includes receiving, by a network controller in the networking environment, a name of an external node where the network agent is running and a token associated with the external node; in response to receiving the name of the external node, obtaining, by the network controller, a secret associated with the token; parsing, by the network controller, the secret to determine an expected external node name corresponding to the token; comparing the expected external node name with the received external node name; and trusting the network agent when the expected external node name and the received external node name match.

A method performed by a computer-implemented controller is provided. The method includes receiving a request for managing one or more user equipments (UEs); obtaining a user-specific security profile from a first service provider; obtaining a subscriber identity module (SIM) profile from a network node or a second service provider; obtaining a set of secure access service edge (SASE) instances from the network node; building one or more UE-specific bootstrap configurations based on the user-specific security profile, the SIM profile, and the set of SASE instances; and sending the one or more UE-specific bootstrap configurations to a third service provider. The one or more UE-specific bootstrap configurations are obtainable by the one or more UEs to establish a secured wireless communication channel through a zero-trusted network.

A system and method for facilitating communication between a user device and a web application through a zero trust network providing a secure web gateway using authentication cookies. The method includes receiving network traffic from a user device including an altered authentication cookie, the network traffic directed at a web application; retrieving an original authentication cookie based on the altered authentication cookie; generating a new network traffic based on: the received network traffic, and the original authentication cookie; and sending the new network traffic from the zero trust network environment to the web application.

The embodiment of the invention discloses a human and AI collaborative large-scale group decision-making method and equipment based on a trusted network. The method comprises the following steps: constructing a decision-making problem; performing initial evaluation on the alternative scheme through a human decision maker set and an AI decision maker set to obtain initial evaluation information; constructing a human and AI trusted network; establishing a continuously learned human and AI consensus reaching algorithm, and dynamically updating the human and AI trust network and the initial evaluation information through the human and AI consensus reaching algorithm to obtain final evaluation information; calculating the weight of each attribute in the alternative scheme and the weight of each decision maker according to the final evaluation information; the final score of each alternative scheme is calculated, and a final decision is generated; the decision-making response speed, precision and decision-making consistency can be effectively improved, and the method is suitable for the complex decision-making field.

The embodiment of the invention provides a distributed medical equipment management platform and method based on a zero-trust network. In the distributed medical equipment management platform based on the zero-trust network, an edge trusted access module adopts a hardware root of trust mechanism, so that equipment accessed for the first time is connected to a temporary supply network isolated from a medical core network, and a zero-trust security normal form is followed; the distributed trust anchor point cluster constructs a distributed identity verification network based on federated learning, and the access pre-authorization authority is verified through a device distributed identity identification (DID); the dynamic permission arrangement engine injects an attribute-based access control strategy, generates a permission token in combination with network micro-segmentation, and realizes two-way encryption communication between the equipment and a target service; the intelligent isolation gateway cuts off temporary connection through a software defined network technology and sends a network access state proof through a block chain mechanism, and edge module initialization is executed by a trusted node outside the medical cloud.

Examples of the present disclosure describe systems and methods for zero trust domain name system (DNS) (ZTDNS) based networking. A computing device implementing ZTDNS based networking blocks any outbound connections that are not included in a list of trusted IP addresses. The list of trusted IP addresses is updated in response to the computing device receiving from a trusted DNS server an IP address corresponding to a DNS request. In some examples, the ZTDNS based networking intercepts and evaluates outbound communications for applications that implement a custom application DNS client. In other examples, the ZTDNS based networking intercepts and evaluates outbound communications for virtual environments. The outbound communications for both the custom application DNS client and the virtual environments are proxied through a local DNS client of the computing device.

A zero trust network access (ZTNA) system provides secure access to applications hosted on a customer premises. The ZTNA system is modified to facilitate distributed and / or cloud-based deployments of components for a control plane and a data plane that cooperate to support a network-accessible front end for the customer's locally hosted applications. A customer-side connector can be further simplified for deployment by moving ZTNA components for, e.g., secure tunneling, authorization, and authentication into the cloud-based infrastructure, and by managing deployment and configuration of the connector through a threat management facility for the customer premises.

The invention relates to the related technical field of zero-trust networks, in particular to a network data security protection method and system based on multi-protection right control, and the method comprises the steps: connecting a terminal and a protection center, setting a primary authorization mechanism, starting hierarchical authorization of a right group, evaluating the risk in real time, interrupting the access if the risk does not accord with the threshold, and carrying out the threat sharing. The technical problems that the authority is allocated only according to a fixed role, the enterprise business scene change and the user actual demand change cannot be adapted, the access of the user to the isolated data area resource is lack of fine-grained control, the situation of excessive authority granting or insufficient authority granting is easy to occur, and the data leakage risk is increased are solved; according to the invention, dynamic hierarchical management of the authority is realized by constructing a primary authorization authentication mechanism and a hierarchical authorization authentication mechanism, the authority is minimized to a single service instance, and fine-grained partitioning is carried out on resources, so that data access control is more accurate, illegal data access and attack diffusion are effectively blocked, and data access efficiency is improved. And the safety of the isolated data area is ensured.

The invention relates to a zero-trust network node dynamic trust degree evaluation and intelligent resource allocation method, equipment and medium, based on the principle of never trust and continuous verification, continuous information acquisition processing is carried out on all interaction nodes in a zero-trust network environment, a node trust degree calculation model is constructed based on processed data, and the dynamic trust degree evaluation and intelligent resource allocation of the zero-trust network node is realized. Weight parameters are dynamically optimized through a credibility evaluation layer; a dynamic trust threshold is set according to the node trust degree, an access control strategy is adjusted at a decision-making layer, and hierarchical allocation of resources is implemented. In addition, a continuous authentication and anomaly detection mechanism is introduced, node behaviors are monitored in real time, a trust strategy is dynamically adjusted, and abnormal access is limited; based on behaviors, contexts and real-time trust evaluation, refined access control and resource management are realized, internal threats, permission abuse and potential attacks can be effectively prevented, security requirements in a complex dynamic environment are met, and trust management efficiency and resource scheduling rationality are further improved.

The invention provides a property management platform based on endogenous safety. The property management platform comprises an endogenous safety property management system, wherein the endogenous safety property management system comprises essential place analysis, heterogeneous resource configuration, heterogeneous execution body generation and mimicry component embedding; a security architecture technical route in the endogenous security property management system comprises a control plane and a data plane. The endogenous security property management system further comprises a mimicry construction intelligent Internet of Things zero-trust assembly, and the mimicry construction intelligent Internet of Things zero-trust assembly is used for providing endogenous security for the zero-trust system. Fine-grained security control of continuous authentication and dynamic authorization is realized by taking a software-defined dynamic fine-grained boundary as guidance, that is, a trusted network is established by taking an identity label of an Internet of Things terminal as a center, a model framework for realizing an intelligent Internet of Things zero-trusted network is researched, and a framework of an endogenous security property management system is constructed.

Systems and methods for secure peer-to-peer communications are described. Devices registered into trusted network may be capable of establishing a shared data encryption key (DEK). In embodiments, each device may be configured to obtain a share of a data encryption key (DEKi) that can be stored locally. The shares may be shares in an M of N Secret Sharing Scheme. This may involve a network that includes an integer, N, devices, and in which M devices may share a secret (i.e. the DEK) during communications, M being an integer less than or equal to N. To obtain the entire DEK during encryption / decryption, a requesting device may send requests to M of N devices for their shares of the DEK. Once M shares are obtained, they may be used generate the DEK for encrypting / decrypting data between the devices.

A cloud computing platform provides zero trust network access as a service to customers that maintain applications on-premises. In this context, the cloud computing platform may associate customers and / or applications with specific service proxies, and add an abstraction layer for network access that maps an alias domain for each customer and / or application to a network load balancer associated with the specific service proxies associated with the corresponding application(s). This approach advantageously simplifies the configuration of service proxies at the cloud computing platform by permitting dedicated relationships among network load balancers, specific service proxies, and specific applications, while concurrently reducing or avoiding the administrative burden on customers of updating network pointers when the clusters of service proxies are periodically reconfigured to adjust to varying user traffic.

A method for communications in a network can include performing a pairing between a first device and a second device in the network. The method can include deriving a port knocking sequence from identification information of the pairing. The method can include providing port knocking according to the port knocking sequence. The method can include authorizing a connection between the first device and the second device responsive to detecting the port knocking sequence. Other devices and methods are described.

A cloud-based platform for zero trust network access (ZTNA) services provides zero trust network access as a service for multiple customers in a multi-tenant architecture. In this context, the configuration for a new ZTNA application is validated with a service proxy in a sandbox or similar environment before release by the cloud-based platform for access through a public network. As a significant advantage, this approach mitigates inadvertent conflicts or instability in a service proxy that supports other applications and customers.

The embodiment of the invention provides an SQL injection attack protection method and device based on a zero-trust framework, and the method comprises the steps: tracking a current operation behavior of operation data in a zero-trust network, and determining whether the current operation behavior belongs to a to-be-verified behavior in the zero-trust network; if yes, calling a pre-trained linear support vector classifier (LSVC) model to detect the current operation behavior; if the detection result is the SQL injection attack, refusing the current operation behavior; wherein the pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set comprises data of a plurality of malicious SQL injection attacks and normal data. The method provided by the embodiment of the invention solves the problems that the user experience is reduced and the management cost of an administrator is increased due to limitation of user input in the prior art.