43 results about "Trusted client" patented technology

The invention provides a resource access method and device, a zero-trust platform and a storage medium, and the method comprises the steps: receiving an internal resource access request of a zero-trust client, the access request carrying an access address of a target resource, user information of the zero-trust client, and temporary authentication information; the access address comprises a zero-trust platform domain name and a target resource identifier, the zero-trust platform domain name points to a public network address of the zero-trust platform, and the target resource identifier is used for uniquely identifying a target resource; the temporary authentication information is used for authenticating that the zero-trust client has the qualification of initiating the access request; based on the user information and the temporary authentication information, verifying the user identity and the access authority of the zero-trust client; after the verification is successful, determining a real address of the target intranet server based on a pre-configured mapping relationship between the real address of the intranet server and the internal resource identifier; and forwarding the access request to the target intranet server according to the real address of the target intranet server.

The embodiment of the invention provides a zero-trust security access control system and method. Relates to the technical field of cloud services. The system comprises a zero-trust client, a zero-trust access gateway, a zero-trust control center and a zero-trust access control gateway, and the zero-trust client is used for collecting user terminal information, user behavior information and environment information; the zero-trust control center is used for issuing an admission permission command to the zero-trust admission gateway according to a preset security admission strategy; and, according to a preset access control authority, issuing a command whether to allow access to the zero-trust access control gateway, the zero-trust access gateway is used for allowing the zero-trust client to connect according to the access command; and the zero-trust access control gateway is used for allowing the zero-trust client to access the target application according to the access command. The method is used for achieving comprehensive visibility of user behaviors and network activities in a cloud desktop scene, and the effect of improving user experience is achieved.

The invention relates to an authorized login method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the steps of feeding back an authorized page to a mobile terminal in response to an access request of the authorized page sent by the mobile terminal; the access request is sent by the mobile terminal in response to identifying a graphic code displayed by the zero-trust client, and the graphic code is generated based on parameter information in the management and control server; the parameter information at least comprises an access address and a user identifier of an authorized page, and the authorized page is used for triggering a login authorization request; receiving a login authorization request sent by the mobile terminal, wherein the login authorization request carries an authorization code and a user identifier provided by a third-party platform; and obtaining identity information corresponding to the user identifier from the third-party platform based on the authorization code, and completing authorization login processing. By adopting the method, off-line login authorization of the zero-trust client can be realized.

The invention relates to a robust federated learning method based on dynamic aggregation weight and prototype guidance, and belongs to the technical field of federated learning. The method comprises the following steps: classifying clients into credible clients and drifting clients based on mutual evaluation; extracting trainable vectors in the client, and constructing a positive prototype set and a negative prototype set; calculating the similarity and complementarity of each client, obtaining the dynamic weight of each client in global model aggregation, and combining to obtain a dynamic aggregation weight matrix; based on a preset merging threshold value, performing merging operation on the models in the trusted clients to obtain a trusted client aggregation model; and carrying out distillation training based on the trusted client aggregation model, the positive prototype set and the negative prototype set, issuing the trained model to each client for the next round of iteration, and realizing robust federated learning through multiple rounds of iteration. The objective of the invention is to solve the problem of global model performance reduction caused by dynamic change of client data distribution and malicious client interference in federated learning.

The invention relates to the technical field of federated learning, in particular to a federated learning security aggregation method based on vector space secret sharing, which comprises the following steps that: a client divides a local model gradient into a plurality of secret shares and distributes the secret shares to a plurality of servers; the server carries out aggregation operation on the secret share through a security computing protocol, wherein the aggregation operation comprises addition and multiplication operation; calculating the similarity between the clients based on the secret state data, and screening out a credible client set; and executing security aggregation on the gradient share of the trusted client, reconstructing a global model gradient and issuing the global model gradient. According to the method, client poisoning attacks can be resisted, server reasoning attacks can also be resisted, a federal learning global model security aggregation method is designed based on vector space secret sharing, and threats caused by server offline are reduced.

The invention discloses a geographic information remote sensing surveying and mapping system and a geographic information remote sensing surveying and mapping method, and relates to the technical field of geographic information remote sensing surveying and mapping. According to the method, geographic information remote sensing surveying and mapping data collected in a corresponding time period is intercepted, and then a sharing transmission unit converts the geographic information remote sensing surveying and mapping data into a sharing document for transmission based on a system image of a corresponding trusted user, so that on one hand, the security and confidentiality of the data in a sharing process are enhanced; and in combination with the system image, it is ensured that the shared data can be correctly interpreted only at the trusted client, on the other hand, it is ensured that sharing of the data has pertinence and timeliness based on the acquisition time period carried in the sharing request, and unnecessary data transmission and resource waste are avoided.

The application discloses a kind of securities asset risk prediction data encryption method and risk prediction method, including label semi-ordered tree construction step, the generation step of ciphertext-based random forest classification model, customer securities asset risk prediction step.First, in the trusted client, the securities asset information of historical customer is in clear text, the construction of LSOPE tree is completed and semi-ordered encryption is carried out to user data, and the yield-loss data as label is encrypted using deterministic symmetric encryption scheme, to hide the actual securities asset information of user, only the relative ordering relationship is retained.Then, the ciphertext is sent to the server, and a classification model is constructed using the random forest algorithm.Finally, the client encrypts the new securities asset information, the server performs risk prediction, and the prediction result is transmitted back to the client for decryption.The application can protect the privacy of customer data in all directions, while ensuring the calculation efficiency and accuracy of risk prediction.

The invention discloses a distributed lock management method and device, electronic equipment and a storage medium, and relates to the technical field of storage, the management method comprises the following steps: in response to lease overdue of a client, judging whether a server works normally or not; in response to normal work of the server, releasing a distributed lock held by the overdue client, and recording session information of the overdue client into a preset database to prohibit the overdue client from executing lock recovery; and in response to restarting of the server, notifying the metadata server to enter a delay period, determining a target client of which the lock state is not recovered after the delay period is ended, controlling the metadata server to clear lock information of a distributed lock held by the target client, and recording session information of the target client into a preset database, the technical problem that the unconditionally trusted client recovers the lock request after the server is restarted is solved, and the technical effect of guaranteeing the data consistency and reliability of the distributed file system in a fault scene is achieved.

Described embodiments generally relate to a method for facilitating data transfer. The method comprises receiving a data packet from a client computing device via a data connection; comparing an identifier of the data connection with entries in a state table to determine whether an active session exists for the connection; upon determining that no active session exists for the connection, causing a selective acknowledgement to be sent to the client computing device, wherein the selective acknowledgement acts as a request for a previously sent data packet; and in response to receiving a compliant response to the selective acknowledgement, recording the client computing device as a trusted client.

This invention discloses a method, apparatus, electronic device, and storage medium for verifying remote login to a vehicle, relating to the field of vehicles. The method includes: after the vehicle's infotainment system starts up, detecting an access request command sent by a client; in response to detecting the access request command, performing initial verification on the client based on the access request command to obtain an initial verification result; if the initial verification result indicates that the client is a pre-trusted client, controlling the remote login port of the infotainment system to switch from a hidden state to an open state; and performing login verification on the pre-trusted client based on the remote login interface in the open state to obtain a target verification result, wherein the target verification result indicates whether the client is a trusted client. This invention solves the technical problem of low security protection for remote login to vehicles.

The invention discloses a data sharing system based on the P2P technology, and relates to the technical field of data sharing, data pre-shared by a user is obtained through a client module and is shared to other trusted clients, an equipment scoring unit scores the trusted clients, and the trusted clients are shared by the equipment scoring unit. The sharing analysis unit periodically analyzes the data capacity and click time of all the shared data and calculates a sharing capability evaluation amount in combination with an equipment score, and the sharing management unit intercepts a plurality of trusted clients according to the sharing capability evaluation amount to obtain a sharing management table; then, after a certain client module pre-shares the data, a sharing client is preferentially selected from the sharing management table, and the sharing client replaces the transfer service unit to carry out data sharing operation, so that the load pressure of the server on the shared data can be greatly reduced through the mode; and meanwhile, the shared resources of the trusted client can be reasonably utilized as much as possible.

The invention discloses a resource access method and device, a readable medium, electronic equipment and a program product. Relates to the technical field of information security. A client sends a resource access request message of a target application to gateway equipment, the resource access request message comprising a first access token issued by the client based on a private key in a service key pair and a session identifier of a session generated by a server based on a login request message sent by the client; sending the first access token and the session identifier to the gateway device, so that the gateway device performs identity authentication on the client through a binding relationship pre-established by the server according to the first access token and the session identifier, and requests a service resource of the target application based on the resource access request message in response to passing of the identity authentication on the client; wherein the binding relationship represents the relationship between the session and the trusted client of the target application. And on the basis of the binding relationship, the client sending the resource access request message can be confirmed to belong to a trusted client, so that Session theft prevention is realized, and the security of service data is improved.

Disclosed are various approaches for distinguishing between genuine biometric identifiers and fabricated or fraudulent biometric identifiers created using generative artificial intelligence (GenAI). One or more watermarks and one or more encryption keys can be distributed to authorized client applications executing on trusted client devices of users. A watermark can be encrypted and then embedded into a biometric identifier using a quantum computing device. To verify the authenticity of the biometric identifier, a quantum computing device can be used to extract the watermark from the biometric identifier. The watermark can then be decrypted. If the decrypted watermark is successfully extracted and decrypted, then it can be determined that the biometric identifier is legitimate.

The present invention relates to the field of information security technology, and to a defense method for federated learning poisoning attacks, including a client obtaining a training image set; the client injecting noise into the training image set to obtain a noisy image set, using the noisy image set to train a client denoising model, and uploading the trained client denoising model to a server; the server injecting noise into a verification image to obtain a noise verification image, inputting the noise verification image into the client denoising model uploaded by the client, and obtaining verification data; screening a list of trusted clients from clients participating in federated learning according to the verification data; aggregating client classification models uploaded by clients in the trusted client list to obtain a global classification model, and distributing the global classification model back to the client. The present invention also proposes a defense system for federated learning poisoning attacks. The present invention can improve the server's ability to judge the credibility of the client model and improve the model's defense capability against poisoning attacks.

The embodiment of the invention discloses a zero-trust-based data processing method and device, equipment and a medium, which can be applied to scenes such as intelligent traffic, auxiliary driving, cloud technology and artificial intelligence. The method comprises the steps that if a zero-trust server receives a data access request sent by a zero-trust client, an operation triggered by the zero-trust client is acquired from the data access request, and then the security level of the zero-trust client is determined based on the type of the operation; and then distributing a credential to the zero-trust client based on the security level of the zero-trust client, so that the zero-trust client uses the credential to access data from the data server. According to the technical scheme, the data processing reliability based on zero trust is improved.

Techniques to operate storage equipment involve, in response to a startup command, registering the storage equipment as an untrusted client at a data center through first connectivity between a connectivity client embedded within the storage equipment and the data center. The connectivity client obtains a set of temporary credentials while registering. The techniques further involve establishing second connectivity between the connectivity client and the data center based on the set of temporary credentials, the second connectivity providing stronger security than the first connectivity. The techniques further involve, after establishing the second connectivity between the connectivity client and the data center, providing trusted communications between the connectivity client and the data center through the second connectivity to manage the storage equipment.

Root trusted client memory page management is described. The root trusted client is loaded and authenticated by the hardware platform. The root trusted client is configured to manage memory operations of different clients via special permissions that allow it to perform memory operations using clients' private memory pages. To this end, the client page table includes a novel "T bit" in each entry, indicating whether the root trusted client or a different client owns the associated memory page. Each entry in the root trusted client's client page table additionally includes a "C bit," indicating whether the corresponding memory page is a protected page. The combined C and T bit values ​​of the page table entry indicate whether the operation performed as part of processing a client's memory request is offloaded from the hardware platform to the root trusted client.

Embodiments of the present application disclose a method, device, equipment, system and medium for defending against a network phishing attack to solve the problem of security loopholes in the prior art for defending against a network phishing attack. The system for defending against a network phishing attack comprises a zero-trust gateway configured to receive a service access request sent by a zero-trust client, redirect the service access request to a remote browser service device, receive a modified HTTP response returned by the remote browser service device, and forward the modified HTTP response to the zero-trust client; and the remote browser service device configured to start a remote browser container instance according to the service access request, send an HTTP request to a target website through the remote browser container instance, receive an HTTP response returned by the target website, insert a security defense interceptor code into an HTML document of the HTTP response, obtain a modified HTTP response, and send the modified HTTP response to the zero-trust gateway.

The invention discloses a federal recommendation system end cloud collaborative defense method based on disturbance trajectory consistency, which comprises the following steps: a client locally executes optimization of a personalized recommendation model, and introduces a structure perception disturbance control mechanism; the client introduces an embedded amplitude constraint term in local training; the client adds a user preference direction guide regular item in a local training stage; updating uploaded by the client side is transmitted to the server side through a communication channel, the server records uploading history of the client side in multiple rounds of training, and behavior characteristics of the client side are modeled and analyzed; according to the uploaded track information, the server calculates the credibility score of each client; and a credible client set is screened out according to an evaluation result, and global model parameters are updated. According to the method, complex poisoning attacks such as slow drift type and alignment type can be effectively identified and inhibited under the condition that an external verification set is not needed, and the method has good universality and privacy friendliness and is suitable for various federal recommendation application scenes such as e-commerce, social contact and music recommendation.

This application provides an application access method and apparatus, relating to the field of communication technology. The method is applied to a gateway device in a zero-trust network. It receives a first service message sent by a terminal device through a zero-trust client for accessing a web application; obtains a virtual IP address corresponding to the user token in the first service message, wherein the virtual IP address is allocated and issued to the gateway device by the controller in the zero-trust network after the terminal device successfully goes online; replaces the source IP address in the first service message with the virtual IP address to obtain a second service message; and forwards the second service message to the resource server of the web application.

The invention discloses a method, a device and a product for protecting intellectual property based on a DBUS. Comprising a server and a client. The server comprises a component registration module, an event monitoring module, an authentication module, a data decryption module and a request callback module; and the client comprises a ciphertext loading module, a data encryption module and a communication control module. The authentication module analyzes a token field of a JSON data structure of the communication request to extract encrypted authentication information, and if a piece of decrypted data of which the MAC address is matched with the MAC address of the current service equipment is extracted, it is proved that the communication request comes from a credit granted client, and data decryption operation continues; if the data are not matched, the authentication is not passed, error information is returned, and the communication request is interrupted. According to the invention, the DBUS is used as a service providing carrier, so that the service is safer and more stable.

A computing system is configured to perform zero-trust domain name resolution. The computing system includes applications coupled to a zero-trust client. The zero-trust client is configured to receive requests for IP addresses corresponding to endpoint identifiers for internet connected endpoints. The zero-trust client includes a synthetic DNS service configured to identify synthetic IP addresses for the endpoint identifiers. The zero-trust client provides the synthetic IP addresses for the endpoint identifiers to the applications. The zero-trust client sends data traffic from the applications to a zero-trust service with the synthetic IP addresses where corresponding synthetic IP addresses are correlated to the endpoint identifiers at the zero-trust service.

1. Name of the product in this design: Quantum Zero Trust Client Graphical User Interface for Electronic Devices. 2. Purpose of this design: An electronic device. 3. The key design features of this product are its graphical user interface. 4. The picture or photo that best illustrates the key design points: Design 1 front view. 5. Design 1 is designated as the basic design. 6. Purpose of the graphical user interface: Used to set up and display the Quantum Zero Trust client software. 7. Human-computer interaction method of graphical user interface: Click "Connect" in the main view of Design 1 to enter the interface change state diagram 1 of Design 1; in the interface change state diagram 1 of Design 1, enter the username and password and click "Login" to enter the interface change state diagram 2 of Design 1; in the interface change state diagram 2 of Design 1, obtain and fill in the SMS verification code, click "Recharge Shield" to enter the interface change state diagram 3 of Design 1. Click "Connect" in the main view of Design 2 to enter the Design 2 interface change state diagram 1; in the Design 2 interface change state diagram 1, click "Username SMS" to enter the Design 2 interface change state diagram 2; in the Design 2 interface change state diagram 2, enter the username, obtain and fill in the SMS verification code, and click "Login" to enter the Design 2 interface change state diagram 3; in the Design 2 interface change state diagram 3, obtain and fill in the SMS verification code, and click "Recharge Shield" to enter the Design 2 interface change state diagram 4.

The embodiment of the invention discloses a method, a device, equipment and a system for defending a phishing attack, and a medium, so as to solve the problem of security vulnerabilities in the prior art for defending the phishing attack. The system for defending the phishing attack comprises a zero-trust gateway used for receiving a service access request sent by a zero-trust client, redirecting the service access request to a remote browser service device, receiving a modified HTTP response returned by the remote browser service device, and forwarding the modified HTTP response to the zero-trust client; the remote browser service device is used for starting a remote browser container instance according to a service access request, sending an HTTP request to a target website through the remote browser container instance, receiving an HTTP response returned by the target website, inserting a security defense interceptor code into an HTML document of the HTTP response, obtaining a modified HTTP response and sending the modified HTTP response to the target website. And the modified HTTP response is sent to the zero trust gateway.

The invention provides a mobile terminal security access authentication method for a 5G independent private network, and the method comprises the following steps: constructing a 5G independent private network architecture which comprises a 5G core network, a zero-trust gateway, an MDM server and an enterprise intranet application server; in a 5G core network, a UIF network element is added, and the UIF network element configures and maintains an employee information base; and meanwhile, each employee in the enterprise has an employee work card in which the identity information of the user of the employee is stored. According to the invention, the UIF network element is newly added in the core network, the user identity information is stored in the UIF of the 5G core network, and the user identity information is uniformly issued to the zero-trust client and the App in the enterprise through the 5G core network, so that the problem of multiple App login processes is effectively avoided, the login security of the mobile terminal equipment is ensured, and the user experience is improved. The non-inductive login access of the user can be realized, and the use and management processes are greatly simplified.

A method in a client-server system involves providing a trusted client application (TCA; 310) solely executing within a secure virtual machine (320) that is embedded within a client application (340). The secure virtual machine has a virtualized operating system (330) and provides an isolated runtime for the trusted client application (TCA; 310) to securely handle client resources (112; client data) for the client application (340). The client resources (112; client data) comprises executable client logic (client_logic), client assets data (client_assets), and optionally one or more of a client digital certificate (client_certificate) and client subscription data (client_subscription). The trusted client application (TCA; 310) receives (144) an execution request (142) from the client application (340) and validates (146) one or more of the client assets data (client_assets), client digital certificate (client_certificate) and client subscription data (client_subscription). Upon successful validation (148), the trusted client application (TCA; 310) executes at least some of the client logic (client_logic) and updates the client assets data (client_assets).

A method for policy-based association of a hardware security module with a secure client is disclosed. The method includes maintaining a binding between the secure client and the HSM. Thereby, the binding enables the trusted client to send only non-sensitive requests to the HSM. The method further includes maintaining a pair of a secret and a secret name for the secure client, submitting a query to the bound HSM to obtain HSM configuration data, and upon determining that the obtained HSM configuration data matches a rule available to the secure client, where the rule associates the HSM to the secret name, the request associates a secret from a pair of the secret and the secret name to the bound HSM, thereby triggering the trusted firmware to allow the secure client to submit a sensitive cryptographic request to the bound and associated HSM.

The invention discloses a zero-trust-based power distribution edge Internet of Things intelligent terminal multi-factor trust evaluation system. The system comprises a cloud server layer, an edge layer and an Internet of Things terminal layer, the cloud server layer serves as a data center, can interact with an edge Internet of Things proxy server in the edge layer through a communication network, provides services required by an edge Internet of Things proxy, and performs identity authentication on the edge Internet of Things proxy; the edge layer comprises one or more edge internet-of-things proxy servers, and a zero-trust engine is arranged in each edge internet-of-things proxy server; the Internet of Things terminal layer refers to an intelligent terminal accessed to the power distribution Internet of Things, a zero-trust client is deployed on the intelligent terminal, and the intelligent terminal can interact with an edge Internet of Things proxy server of a region where the intelligent terminal is located through the zero-trust client and submit an access request. The invention further discloses a zero-trust-based multi-factor trust evaluation method and application of the intelligent terminal of the power distribution edge Internet of Things.

The application discloses a kind of based on hierarchical index screening's blockchain federated learning security aggregation framework, it is related to federated learning technical field, including pre-training stage, formal training stage and aggregation stage, wherein: pre-training stage, training client participates in pre-training and uploads the loss value calculated to blockchain;Official training stage, trusted client trains model and provides scoring standard, training client trains and uploads local model parameter, trusted client scores local model and calculates its weight, uploads model trust score and weight;Aggregation stage, model aggregation is carried out according to model trust score and weight, obtains the global model of this round and is chained.The application aggregates the trust score of uploaded local model by FLTrust algorithm, excludes malicious client, to some extent, counteracts byzantine attack, guarantees the accuracy of finally obtained global model, accelerates aggregation speed by loss prediction and aggregation weight, obtains better global model with less convergence round.

The invention provides a terminal equipment access control method, a communication system and a zero-trust security management platform, and relates to the technical field of communication. The terminal equipment access control method comprises the following steps: receiving terminal feature information sent by a zero-trust client deployed on terminal equipment; acquiring access control information of the terminal equipment according to the terminal feature information; and sending a subscription data modification request for the terminal equipment to a network equipment function NEF network element according to the access control information, so that the NEF network element modifies subscription data of the terminal equipment in a unified data management UDM network element according to the subscription data modification request, and triggers PDU session modification of the terminal equipment. Generating access control information of the terminal device based on the terminal feature information collected by the zero-trust client; therefore, the state of the terminal equipment accessing the target core network can be subjected to safety management based on the access control information, and potential safety hazards are avoided.