29 results about "Trusted components" patented technology

The invention provides a property management platform based on endogenous safety. The property management platform comprises an endogenous safety property management system, wherein the endogenous safety property management system comprises essential place analysis, heterogeneous resource configuration, heterogeneous execution body generation and mimicry component embedding; a security architecture technical route in the endogenous security property management system comprises a control plane and a data plane. The endogenous security property management system further comprises a mimicry construction intelligent Internet of Things zero-trust assembly, and the mimicry construction intelligent Internet of Things zero-trust assembly is used for providing endogenous security for the zero-trust system. Fine-grained security control of continuous authentication and dynamic authorization is realized by taking a software-defined dynamic fine-grained boundary as guidance, that is, a trusted network is established by taking an identity label of an Internet of Things terminal as a center, a model framework for realizing an intelligent Internet of Things zero-trusted network is researched, and a framework of an endogenous security property management system is constructed.

Methods, systems, and computer program products for executing trusted software components in public computing clouds. Verifiably authentic software components are installed into a tenant partition of a multi-tenant public cloud-based environment. To do so, a software component installer is configured to install registered software components into the tenant partition. Installer processing includes (1) obtaining a component-specific token for a software component wherein the component-specific token is specific to both the software component to be installed and a particular tenant, and (2) installing the software component on behalf of the given tenant in the multi-tenant public cloud-based environment. Prior to executing the underlying code of the tenant-specific software component, the software component is authenticated with a component registry using the component-specific token. Additional trusted components are installed based on demand from within the tenant partition. No user or administrator intervention is needed and no credentials are hard-coded into the software components.

The application provides a component verification method and device of an Internet of Things equipment and a readable storage medium, and the specific implementation scheme is as follows: reading the equipment component information of an OTP storage area after the equipment component is powered on and completed, performing self-checking based on the equipment component information to obtain a component self-checking result; sending the corresponding equipment component start state to a verification platform according to the component self-checking result; receiving a discrimination random number generated by the verification platform in response to the normal start state of the equipment component, calling an internal private key to digitally sign the discrimination random number to obtain a signature value; and sending the signature value and the built-in digital certificate to the verification platform to verify whether the component of the Internet of Things equipment is a trusted component. The application scheme provides a component trusted verification mechanism of the Internet of Things equipment, improves the component trustworthiness of the Internet of Things equipment, and in addition, the component self-checking by the Internet of Things equipment and the second re-verification by the verification platform improve the security strength of the equipment component verification.

The invention provides an online code editing system, an online code editing device and a related product, the online code editing system is characterized by comprising a code protection device, a browser, a trusted component, an online I DE module and an online I DE association component, the code protection device is configured with code security protection logic, and the browser is configured with the trusted component. The browser and the trusted component are both in communication connection with the code protection device, and the code protection device is in communication connection with the online I DE module. Therefore, duplex interaction between the browser and at least one of the online I DE module and the online I DE associated component, duplex interaction between the trusted component and the online I DE module, and duplex interaction between the trusted component and at least one of the online I DE module and the online I DE associated component are controlled through code security protection logic configured on the code protection device. The duplex interaction is based on a code editing request and a code editing function calling request, and the code editing request and the code editing function calling request are both generated through a browser.

A method may include dividing code into trusted components and untrusted components, and identifying a dynamic call in a first component of the code. The first component may be an untrusted component. The method may also include extracting dynamic information from the dynamic call, and using the dynamic information and metadata describing the dynamic behavior of the code to identify a target of the dynamic call. The target may correspond to a second component of the code. The method may also include determining that the target matches the dynamic call, and in response to determining that the target matches the dynamic call, adding an edge from the dynamic call to the target to a call graph generated from the code.

The application provides a method for dividing and automatically deploying trusted components of a trusted DCS controller, comprising: dividing components in the trusted DCS controller into trust_module bottom management trusted security components and agent proxy management communication trusted security components according to the functional characteristics and security requirements of the components in the trusted DCS controller; and simultaneously or separately installing the trust_module bottom management trusted security components and the agent proxy management communication trusted security components by using a trust_module trusted security component automatic deployment tool and an agent proxy trusted security component automatic deployment tool. The application realizes modular design of trusted components, and the required trusted security components can be separately installed and configured, so that the deployment process of the trusted components is greatly simplified and the deployment efficiency is improved.

The invention relates to the technical field of creative mobile terminals, in particular to a trusted startup method and system for a creative mobile terminal, and the method comprises the steps: carrying out hierarchical verification and state monitoring on a hardware trust root module, security startup firmware and an operating system kernel, extracting multi-dimensional security features, and constructing a system security feature vector; secondly, establishing a trust chain component dependency graph, and generating a trusted startup sequence with the minimum security risk through constraint optimization; in combination with the trusted startup sequence and the feature vector, intelligently identifying startup threats and dividing risk levels to form a layered security protection strategy; and dynamically adjusting a protection strategy and allocating a resource weight, loading and dividing the trusted component into a high-security verification area and a basic verification area for block verification, and outputting a trusted startup execution result. According to the method, full-link trusted measurement, intelligent risk management and control and resource optimization scheduling in the starting process are realized, and the safety and starting efficiency of the credential terminal are remarkably improved.

The invention relates to a method for starting a computing unit comprising a microcontroller and a trusted component, wherein, during the startup of the computing unit, the trusted component verifies the hardware configuration of the microcontroller. The invention further relates to a device and a computer program.

The invention provides a trusted component division and automatic deployment method for a trusted DCS (Distributed Control System) controller, which comprises the following steps of: dividing components in the trusted DCS controller into a trustmodule bottom layer management trusted security component and an agent proxy management communication trusted security component according to functional characteristics and security requirements of the components in the trusted DCS controller; and installing a trust module bottom layer management trusted security component and an agent agent management communication trusted security component at the same time or in a time-sharing manner through a trust module trusted security component automatic deployment tool and an agent agent trusted security component automatic deployment tool. According to the method, the modular design of the trusted component is realized, the required trusted security component can be independently installed and configured, the deployment process of the trusted component is greatly simplified, and the deployment efficiency is improved.

At least one secure object of the security module is bound to the security guest. The trusted component determines whether metadata of the security guest includes a secret binding attribute of the security module. Based on determining that the metadata includes the secret binding attribute, the trusted component configures the security module for the security guest in a select mode. The select mode prevents certain operations from being intercepted by a hypervisor associated with the security guest. The trusted component intercepts security module communications and performs cryptographic operations on one or more secure objects of the security module communications using the secret binding attribute to provide cryptographic results. Results of the security module communications including the cryptographic results are provided to a receiver.

The application discloses a trusted starting method of a multi-processor system, a trusted component and a chip, and relates to the chip field.In the method, when starting, the multi-processor system performs identity authentication and key negotiation between a processor and a trusted component through a main processor, and after the identity authentication is passed and the key is negotiated, the measurement result of the slave processor encrypted based on the key is forwarded to the trusted component through the main processor, so that the slave processor and the trusted component are guaranteed to perform channel encryption on the basis of mutual trust of identities, the measurement result of the slave processor cannot be viewed or tampered with in the transmission process, and the security of the trusted starting of the system is improved.

There is provided techniques for self-revocation. A method is performed by a TC node (200a). The TC node (200a) is provided with an identifier and DAA credentials. The TC node (200a) is to receive a heartbeat message from an RA node (300). The heartbeat message comprises a freshness parameter and a revocation request with a list of identifiers for which revocation is pending. The method comprises revoking (S106a, S106b) the DAA credentials when either: the heartbeat message is received from the RA node (300) whilst a counter condition is satisfied, correctness of the freshness parameter is verified by the TC node (200a), and the identifier is present in the list of identifiers; or failing to receive the heartbeat message from the RA node (300) whilst the counter condition is satisfied.

A trusted component is suggested to be added to off the shelf computing systems such as PCs or smartphone providing secure functions for access management and credential protection—safe authentication, maintaining session integrity and validation of content modification. An additional advantage of the solution that it detects malware / hacking attempts on first try allowing of taking action while oblivious to the malware / hacker to avoid retaliation.

The invention discloses a blockchain-enabled low-altitude Internet of Things zero-trust security protection system, which comprises a low-altitude airspace module, a zero-trust management and control module and a data storage module, the invention discloses a blockchain-enabled low-altitude Internet of Things zero-trust security protection method. The method comprises the following steps: step 1, deploying a distributed zero-trust component; step 2, setting a low-altitude block chain storage architecture; step 3, performing active trust evaluation on the low-altitude terminal; the method has the characteristics that the zero-trust protection efficiency is improved, the security of cross-airspace data interaction is guaranteed, the security and load problems caused by large-scale low-altitude terminal access are effectively solved, and the storage efficiency and security are optimized.

A highly versatile process control or factory automation field device is configured with interfaces and communication connection structures as well as security features that enable the field device to operate as a data server that directly or indirectly communicates with and supports multiple different applications or clients while performing standard process and factory automation control functions in a highly secure manner. The security features include a root of trust component, a secure boot component, a secure storage component, a secure communication component, a security audit component, a secure provisioning component, and an endpoint identity component, making the field device communication and operation secure and trustworthy. In addition, various different process control and factory automation network architectures, particularly communication architectures, support the general-purpose field device so that the general-purpose field device can communicate with multiple different client devices or applications (each associated with a different system) via a common communication network infrastructure using the same or different communication protocols in a very secure manner.

At least one secure object of a security module is bound to a secure guest. A trusted component determines whether metadata of the secure guest includes a confidential binding attribute for the securi

A field device with a root of trust component 302 that includes a unique device identity stored in a computer readable memory, and one or more security keys or certificates that are stored in the memo

A trusted component can be deployed to a computing cluster that collects audit evidence inside the cluster continuously. Performing the evidence collection within the cloud service avoids extending access to cloud resources, since the cloud service already has access to the cloud resources being audited. Additionally, since the evidence collection component is deployed to production servers, existing processes for testing and verifying standards compliance will be applied to the evidence collection component, increasing the quality of the component as compared to less thoroughly vetted external solutions. The evidence collection component may run on a regular schedule and collect evidence regularly (e.g., daily). The relevant information is retrieved from logs generated by the services being audited. The retrieved data is stored in an object store. Thus, only the information published by the evidence collection component is made accessible to external tools, enhancing the security of the services.

A computer program product for enabling processing within a data processing environment, wherein the computer program product comprises: comprising at least one computer-readable storage medium that is readable by at least one processing circuit and stores instructions for carrying out a procedure: Binding at least one secure object of a security module (150) of the data processing environment to a secure guest (180) of the data processing environment, wherein the secure guest is configured to use the security module (150), and wherein the binding has: Determine (300) through a trusted component (160) of the data processing environment whether metadata of the secure guest (180) contains a confidential binding attribute for the security module (150), wherein the confidential binding attribute is to be used to bind the one or more secure objects generated by the security module (150) to the secure guest (180), wherein the security module (150) is separate from the trusted component and is assigned to the secure guest (180) via a hypervisor (170); Configure (304) by the trusted component (160) based on the finding that the metadata contains the confidential binding attribute, the security module (150) for the secure guest (180) in a selected mode, wherein the selected mode prevents certain operations from being intercepted by a hypervisor (170); Interception (306) of a security module data transmission by the trusted component (160); Performing a cryptographic operation on one or more secure objects of the security module data transmission using the confidential binding attribute to provide a cryptographic result; and Providing a result of the security module data transmission to a receiver, wherein the result contains the cryptographic result.

Systems and methods to enhance validation of trusted components of an electronic gaming terminal are described. The system includes a platform controller, and one or more component controllers. The platform controller generates and shares an encryption key with the component controllers. The platform controller validates the component controller by transmitting encrypted first data set, receiving encrypted second data set, and validating the component controller based on decrypting the second data set. In response to the component controller being deemed invalid, the platform controller prevents launching of a gaming application.

Methods, systems, and computer program products for executing trusted software components in public computing clouds. Verifiably authentic software components are installed into a tenant partition of a multi-tenant public cloud-based environment. To do so, a software component installer is configured to install registered software components into the tenant partition. Installer processing includes (1) obtaining a component-specific token for a software component wherein the component-specific token is specific to both the software component to be installed and a particular tenant, and (2) installing the software component on behalf of the given tenant in the multi-tenant public cloud-based environment. Prior to executing the underlying code of the tenant-specific software component, the software component is authenticated with a component registry using the component-specific token. Additional trusted components are installed based on demand from within the tenant partition. No user or administrator intervention is needed and no credentials are hard-coded into the software components.

A method and system for public key infrastructure (PKI) in software defined vehicles enables secure communication between electronic components. The method includes establishing trust between multiple electronic components through a certificate history comprising signed public keys stored on each component. Once trust is established through attestation between components, the method utilizes signed Diffie-Hellman key exchange to securely distribute symmetric keys to the trusted components. These symmetric keys enable authenticated communication between the components to control vehicle systems and functions. The system operates locally without requiring internet connectivity or specialized service tools, allowing for secure field replacement and upgrading of components while maintaining system security through verification of component authenticity and prevention of counterfeit hardware.

The invention relates to an identity authentication method and device, equipment and a medium. The method comprises the following steps: sending a service request to a service platform to indicate the service platform to query an identity authentication result representing that a user has a third-party platform permission from a block chain; if not, encrypting identity plaintext information of the user on the third-party platform by using a public key provided by the trusted component; sending the encrypted identity ciphertext information to the trusted component to indicate the trusted component to generate first verification information, decrypting the identity ciphertext information by using a private key matched with the public key in a trusted domain provided by the trusted component, and sending the first verification information to a third-party platform based on the decrypted identity plaintext information; and sending second verification information to the trusted component to instruct the trusted component to generate an identity authentication result and store the identity authentication result to the block chain after comparing that the second verification information is consistent with the first verification information, the identity authentication result being used for instructing the service platform to provide services for the user. By adopting the method, the privacy data of the user can be protected.

The application discloses a software license verification method based on hardware binding, generates a logical instance identifier separated from a virtual hardware identity for a software instance, generates a hardware binding proof and a candidate state transition record based on a non-exportable instance binding key, a hardware monotonic state value and a random challenge value by a hardware trusted component; verifies the consistency of a hardware consistency, a pre-record abstract field and a unique effective chain head abstract, and the non-backtracking relationship of a hardware state, and atomically updates the chain head; verifies the inheritance relationship of a source target instance by a target takeover pre-proof, a migration handover record and an inherited state record during migration; identifies a conflict branch when multiple candidate records point to the same pre-record; and recovers an authorized state by an offline reserved chain head and a continuous offline state record during offline operation. The application can improve the anti-copying capability, migration continuity and cloning detection reliability of software license verification.

The present specification discloses a firmware flashing method, device, storage medium and electronic device, wherein the method comprises: a management platform uses a manufacturer's public key to perform integrity verification on a first functional firmware of a functional device; if the integrity verification of the first functional firmware succeeds, a transaction private key and a transaction public key are generated based on a trusted component; the first functional firmware is signed with the transaction private key to obtain an initial functional firmware; the initial functional firmware and the transaction public key are flashed to the functional device; the functional device obtains a flashing request for a newly added functional firmware; the integrity of a flashing tool is verified based on the trusted component; if the integrity verification of the flashing tool succeeds, the integrity of the newly added functional firmware is verified based on the transaction public key in the signature verification firmware; if the integrity verification of the newly added functional firmware succeeds, the flashing tool is used to flash the newly added functional firmware.

A computing network comprising a computing service provider and an edge computing network is managed. A trusted device establishes a root of trust at the edge computing network via a trusted component on the trusted device. In response to receiving a first indication of a disconnection or degradation of communications between the computing service provider and the edge computing network, the edge computing network initiates an autonomous mode at the edge computing network. While the edge computing network is operating in the autonomous mode, the trusted device detects new devices that are attempting to access computing resources in the edge computing network. The trusted device stores data pertaining to new devices that were not authorized to access the computing resources in the edge computing network.

A rollback protection method for preventing message equivocation in a consensus system is provided. The consensus system includes distributed computational nodes connected by a network and configured to run a TEE-based consensus protocol. The method includes: executing, within a trusted execution environment of a node of distributed computational nodes, a trusted component instance, that includes volatile protected memory with protected data stored therein and a protected piece of code implementing at least a part of a consensus algorithm, generating identity data comprising a unique ephemeral identity, and storing the identity data in the volatile protected memory of the trusted component instance, and certifying a message of the consensus algorithm, wherein a certified consensus algorithm message is generated by cryptographically binding parts of the consensus algorithm message to the unique ephemeral identity of the trusted component instance and at least parts of the protected data of the trusted component instance.

An access object authentication method includes a trusted component that is in a computing device and that completes an access object authentication process. When a client requests to access a target object, the trusted component receives an object identifier (ID) and an authentication ID of the target object from the client to perform, based on the authentication ID, tenant authentication on a tenant to which the client belongs. When the authentication on the tenant to which the client belongs succeeds, the trusted component accesses a storage device based on the object ID of the target object.

The invention provides a component verification method and device for an Internet of Things device and a readable storage medium, and the specific implementation scheme comprises the steps: reading device component information of an OTP storage area after the power-on of a device component is completed, and carrying out the self-verification based on the device component information, and obtaining a component self-verification result; sending a corresponding equipment component starting state to a verification platform according to a component self-verification result; receiving an identification random number generated by the verification platform in response to the equipment component starting normal state, and calling an internal private key to perform digital signature on the identification random number to obtain a signature value; and sending the signature value and a built-in digital certificate to a verification platform, so that the verification platform verifies whether the component of the Internet of Things equipment is a trusted component or not. According to the scheme of the invention, a part credibility verification mechanism of the Internet of Things equipment is provided, the part credibility of the Internet of Things equipment is improved, in addition, the part self-verification is carried out by the Internet of Things equipment, the second verification is carried out by the verification platform, and the safety intensity of equipment part verification is improved.