410 results about "Trusted Computing" patented technology

The invention discloses a driving vehicle road cloud collaborative safety management and control method and system based on trusted computing, and the method comprises the steps: generating an HMAC-SM3 data fingerprint through employing an SM3 Hash algorithm engine, and proposing an LSTM lightweight dynamic trust evaluation model based on a TinyML framework; through a step-by-step Hash verification and rollback mechanism, through Geohash coding and SM3 Hash joint calculation, based on an aggregation signature of a BLS12-381 curve and public key aggregation, the communication overhead during multi-RSU collaborative signature is reduced; distributed private key fragmentation decryption is realized by adding a homomorphic aggregation ciphertext; aggregating and delaying the compressed ciphertext; dynamically evaluating the credibility of the nodes by a Krum dynamic defense mechanism; the system comprises a vehicle side credible sensing layer, a roadside credible broadcast layer and a cloud credible decision-making layer. According to the invention, through layered credibility verification, dynamic trust chain extension and a data privacy protection mechanism, the security and credibility problems of multi-node cooperation in an automatic driving scene are solved.

The invention discloses an intelligent fusion analysis system for multi-source heterogeneous data, and the system comprises a dynamic data collection module which is used for carrying out the data collection, and carrying out the processing of a collected mixed data flow; the semantic alignment module is used for constructing a domain ontology knowledge graph according to a preset scene target and carrying out semantic alignment and coordinate alignment on the collected data; the self-adaptive fusion engine module is used for fusing the collected multi-source heterogeneous data; the trusted computing module integrates a secure multi-party computing protocol and a homomorphic encryption algorithm to realize that data is available and invisible; and the intelligent decision-making module constructs a state action reward model based on reinforcement learning according to a preset scene target, and performs analysis and decision-making by using historical data and data acquired in real time. According to the invention, the capability and effect of data processing and decision support are improved.

Systems and methods support collection of telemetry by an Information Handling System (IHS). A policy decision point of a zero-trust computing environment controls access to protected resources and receives an indication of attack related to the IHS. A telemetry definition is identified that specifies telemetry being collected by the IHS and it is updated to specify a security delay for telemetry related to the indication of attack. The updated telemetry definition is transmitted to the IHS. Upon identifying telemetry that is ready for transmission, the IHS determines whether the telemetry is subject to a security delay specified in the updated telemetry definition. When the telemetry is subject to a security delay, the telemetry that is ready for transmission is queued and transmitted to one or more destinations specified in the updated telemetry definition upon expiration of the security delay.

Systems and methods provide collection of telemetry by an Information Handling System (IHS). A policy decision point (PDP) of a zero-trust computing environment controls access to protected resources and receives an indicator of attack related to the IHS. The PDP identifies a telemetry definition specifying telemetry being collected by the IHS and updates the telemetry definition to specify a subsystem telemetry chain for configuring telemetry by hardware subsystems of the IHS that are related to the indicator of attack. The updated telemetry definition is transmitted to the IHS. Upon identifying the subsystem telemetry chain in the updated telemetry definition, the IHS adjusts telemetry generation by one or more of the hardware subsystems of the IHS based on their position in the subsystem telemetry chain.

Systems and methods provide collection of telemetry by an Information Handling System (IHS). A policy decision point (PDP), of a zero-trust computing environment that controls access to a plurality of protected resources, receives an indication of resource piracy related to hardware components of the IHS. The PDP identifies a telemetry definition specifying telemetry being collected by the IHS and updates the telemetry definition to specify an updated telemetry chain for configuring telemetry collection by the hardware components of the IHS. The updated telemetry definition is transmitted to the IHS. Upon identifying the updated telemetry chain in the telemetry definition received from the PDP, the IHS adjusts telemetry generation by one or more of the hardware components of the IHS based on their position in the telemetry chain.

Systems and methods that operate an Information Handling System (IHS) support secure telemetry for use in a zero-trust environment. Upon being initialized, the IHS retrieves a factory-provisioned locator of a service that provides the IHS with a network location of a policy decision point of the zero-trust environment and that provides an encryption key. The IHS identifies telemetry generated by the sensors that is ready for transmission. The IHS transmits the telemetry to a policy information point of the zero-trust environment, where the telemetry includes the factory-provisioned encryption key and also includes the provided network location of the policy decision point. The policy information point uses the network location included in the telemetry and the factory-provisioned encryption key included in the telemetry to establish an encrypted session with the policy decision point. Via the encrypted session, the telemetry is transmitted to the policy decision point.

Systems and methods that operate an Information Handling System (IHS) support secure telemetry for use in a zero-trust environment. Upon being initialized, the IHS retrieves a factory-provisioned resource locator of a service that provides the location of a policy decision point of the zero-trust environment. The IHS establishes an encrypted session with the policy decision point that is located using the factory-provisioned resource locator. Via the encrypted session, the IHS receives a symmetric key from the policy decision point, where the key may be fleet-wide key for encryption of a customer's telemetry. Telemetry that is generated by the sensors is identified when ready for transmission and encrypted using the symmetric key received from the policy decision point. The customer's encrypted telemetry can then be securely transmitted.

Systems and methods provided adaptive collection of telemetry. A policy decision point of a zero-trust computing environment receives an indication of a change in risk posture within the environment. The policy decision point identifies a telemetry definition specifying telemetry being collected by one or more IHSs that are currently accessing a protected resource of the zero-trust computing environment. The telemetry definition is updated to specify adjusted telemetry to be collected by an IHS that is currently accessing the protected resource and the updated telemetry definition is transmitted to the IHS. Based on the updated telemetry definition received from the policy decision point, the IHS adjust measurements by one or more of the sensors of the IHS. Telemetry generated based on the adjusted measurements is transmitted by the IHS to one or more destinations specified in the updated telemetry definition.

Systems and methods provide adaptive collection of telemetry. A telemetry orchestrator of a IHS (Information Handling System) collects telemetry related to a session used by the IHS to access a protected resource of a zero-trust environment, where the telemetry is collected based on a telemetry definition received from a policy decision point of the zero-trust environment. The telemetry orchestrator of the IHS monitors for updates to the telemetry definition, where the updates are generated by the policy decision point of the zero-trust environment. The telemetry orchestrator adjusts measurements by one or more of the sensors of the IHS based on updates to the telemetry definition received from the policy decision point. Telemetry that is generated based on the adjusted measurements is transmitted by the telemetry orchestrator to one or more destinations specified in the update telemetry definition.

Systems and methods support collection of validated telemetry by an Information Handling System (IHS). A policy decision point (PDP) of a zero-trust computing environment controls access to protected resources The PDP identifies a telemetry stream of the IHS to be validated and identifies a telemetry definition specifying telemetry being collected by the IHS. The PDP updates the telemetry definition to specify adjustments to telemetry streams of the IHS to be authenticated and transmits the updated telemetry definition to the IHS. The IHS identifies telemetry that is ready for transmission and, based on the updated telemetry definition received from the policy decision point, generates a digital signature that authenticates the telemetry that is ready for transmission. The authenticated telemetry is transmitted to one or more destinations specified in the updated telemetry definition.

The invention discloses a trusted computing method and system for regional correction of carbon emission factors, and relates to the technical field of blockchains, comprising: constructing a blockchain intelligent terminal; performing classification comparison; establishing a carbon emission factor calculation model; establishing a carbon emission model; and analyzing the carbon emission coefficient influence factors of the regional power grid. According to the invention, accurate measurement of a data source and calculation under different power utilization conditions by using a block chain intelligent terminal and a carbon emission flow theory are realized, so that the technical problems that the accuracy of carbon emission accounting is insufficient and the nearby consumption of new energy is not fully considered are solved, and the accuracy of carbon emission accounting is improved; therefore, the carbon emission data can reflect the actual situation more truly and reliably, the enthusiasm of users to use renewable energy sources is stimulated, the nearby consumption of new energy sources is promoted, and a powerful basis is provided for making a reasonable carbon reduction policy.

The invention belongs to the technical field of computer trusted computing, and particularly relates to a method and system for constructing a TPCM trusted root based on a multi-core BMC, and the method comprises the steps: selecting the multi-core BMC, configuring one core as a trusted core, and achieving the physical and logic isolation with other cores; tPCM related codes are integrated in the trusted core, and a TCM module is combined to provide a running environment for the TPCM; when the system is started, the TPCM performs measurement check on the BMC code and the BIOS code, and if the BMC code and the BIOS code are abnormal, a security policy is started In the system operation process, the TPCM monitors hardware, firmware and software of a calculation part in real time, and discovers abnormal behaviors to block and give an alarm; and meanwhile, the management interface is connected with a trusted management center, so that remote configuration and monitoring are realized. A multi-core BMC is used as a protection component, a server host side is used as a calculation component, and a trust chain model of a star-shaped trusted topological structure is constructed. According to the method, the TPCM trusted root is constructed by using the existing resources of the multi-core BMC, so that the hardware cost is reduced, the real-time performance of trusted measurement and the monitoring comprehensiveness are improved, and the running safety and credibility of the server are improved.

The invention discloses a block chain technology-based review data information security tamper-proofing method, and relates to the technical field of information security, the tamper-proofing method comprises the following steps: a data encryption storage step, a data evidence storage step, a trusted computing step and a data verification step, when a computing request is received, the trusted computing step is executed, and the trusted computing step is executed; whether the identity of a requester conforms to the access control strategy is verified through the smart contract, after verification is passed, the smart contract generates a calculation task event, the oracle monitors and captures the event, then a calculation task is transmitted to the trusted execution environment, ciphertext data is obtained in the trusted execution environment and decrypted, and the calculation task is sent to the target server. The method has the advantages that the balance of data privacy protection and integrity verification is realized through a hierarchical architecture combining on-chain evidence storage and off-chain encrypted storage, sensitive review data is stored in an off-chain database in an encrypted form, the security of the review data is improved, the security of the review data is improved, and the security of the review data is improved. Only data fingerprints are recorded on the block chain, data privacy is protected, and data integrity can be verified through the block chain.

The invention discloses a sandbox type trusted data space construction method and equipment based on a trusted verification architecture, belongs to the technical field of data security circulation and trusted computing, and aims to overcome the defects that a traditional sandbox behavior is unknowable and untrusted and a strategy is rigid. The method comprises the following steps of: starting a sandbox in a hardware trusted execution environment and generating a task unique context identifier; intercepting system call by a monitoring agent; generating a chained operation certificate containing preorder certificate hash; compiling an advanced security policy into a deterministic finite automaton executable policy set; and the auditing unit is used for generating a decision instruction in an illegal scale, storing the chain anchor point to the non-tampering system, forcibly executing decision and generating a Merkel tree evidence. The equipment correspondingly comprises a sandbox management module, a behavior monitoring module, a strategy compiling module, a verification judgment module and an auditing execution module. The full-flow transparent tracing of the operation in the sandbox is realized, the strategy dynamic adaptation is supported, and the problem that a traditional sandbox monitoring log is easy to counterfeit and difficult to verify is solved.

The invention discloses a physical information enhanced space-time diagram network trusted computing method for traffic flow anomaly prediction, and the method comprises the steps: building an LWR model physical constraint through an embedded traffic flow LWR equation, correcting critical density and free flow speed parameters through a Kruithof curve, and improving the flow density of an LWR model; carrying out road discretization and establishing a macroscopic CTM model; carrying out dynamic weight fusion on a prediction result of the macroscopic CTM model and a correction factor generated by the microscopic IDM model, and calculating a fusion result; constructing a space-time diagram convolution network model and a loss function, constructing a space diagram convolution module and a time sequence convolution module, and extracting a space feature matrix and a time sequence feature matrix; fusing and updating the spatio-temporal characteristics by using a gating circulation unit; performing dynamic anomaly detection and hierarchical response; a TEE is deployed in a traffic network sensing device, and evidence storage is carried out through a block chain. According to the invention, the traffic flow change is predicted in real time, the abnormal fluctuation in the traffic flow is identified, and the traffic flow prediction accuracy is improved.

Information Handling Systems (IHSs) support pre-boot telemetry for use in a zero-trust environment. A pre-boot telemetry orchestrator of the IHS retrieves a factory-provisioned resource locator of a service that provides a location of a policy decision point of the zero-trust environment. The pre-boot telemetry orchestrator establishes an encrypted session with the policy decision point that is located using the factory-provisioned resource locator. Via the encrypted session, the pre-boot telemetry orchestrator receives a telemetry definition specifying pre-boot telemetry to be collected by the IHS. Th telemetry is collected and transmitted during the pre-boot intervals according to the telemetry definition.

The invention relates to the field of network and information security, and discloses a server security authentication system based on block chain trusted computing. Comprising a block chain network, an intelligent contract module, an authentication service module, a verification node and a to-be-authenticated server. The intelligent contract module records a registration index, a certification public key, a policy version number, a baseline commitment value and a revocation state. The authentication service module generates a challenge parameter and a challenge value based on the block height and the block hash digest. The trusted agent module collects a measurement abstract and forms a certification packet, and the trusted root module derives a staging certification key in a protected environment and signs the certification packet. And the verification node reads the data on the chain to complete signature verification, challenge value re-calculation, window verification and compliance proof verification, and generates an authentication bill containing an effective height range for resource access judgment after passing the verification.

The invention discloses a medical insurance trusted space system, which comprises a service center, a data processing center, a trusted management and control center, a technical component, a connector, an operation management layer and a supervision management layer, the service center provides a unified service entrance and business support capability for users; the data processing center is responsible for full life cycle processing and trusted computing of data; the credible management and control center guarantees credibility of participants and operations in the data space; the technical component provides bottom-layer technical tools and algorithm support, the connector realizes cross-system and cross-network secure interconnection and intercommunication, the operation management layer ensures stable operation and continuous optimization of the system, and the supervision management layer ensures compliance and risk controllability of data flow; the method has the advantages that the technology is mature and stable, the safety is high, and the whole link is controllable.

The invention discloses a PLC behavior measurement method, device and equipment based on trusted 3.0 and national cryptographic algorithms, and relates to the field of safety control in an industrial control system.The method comprises the steps that a hardware trust root module installed on a PLC in advance is used for conducting trusted verification on the PLC during starting, and the module is constructed based on the trusted computing 3.0 standard; after verification succeeds, a behavior feature vector of the PLC operation state is obtained based on trusted computing 3.0, wherein the vector comprises at least one of an integrity verification parameter, a resource consumption parameter, an operation parameter and an associated parameter; generating behavior measurement data based on trusted computing 3.0, and measuring a vector through an Euclidean distance algorithm in combination with behavior baseline data; comparing the measurement result with a preset Euclidean distance threshold value, encrypting the measurement result by adopting a domestic key algorithm, and transmitting a comparison result to a security management platform; according to the method, trusted computing 3.0 (TC3.0) and the national cryptographic algorithm are combined, accurate behavior measurement is carried out on the operation state, and the equipment safety and the attack resistance can be enhanced.

The invention discloses an emergency rescue integrated data security protection method based on a block chain, and belongs to the technical field of data security protection, and the method comprises the following steps: constructing an end-side cloud cooperative trusted computing architecture, and establishing a trust chain transmission mechanism from a terminal to an edge node through a physical trusted root; a dynamic multi-dimensional credibility measurement model is adopted, the static credibility, the behavior credibility and the collaborative credibility of the equipment are comprehensively evaluated, and the real-time credibility of the equipment is generated in combination with environmental factors; implementing credibility verification based on the behavior measurement index; cross-domain data sharing auditing is realized by using a block chain smart contract, and the full-life-cycle security of data is ensured through a fragmented storage strategy and a self-destruction key design. According to the method, the problems of insufficient security authentication, dynamic trust evaluation and data cross-domain sharing auditing of the multi-source heterogeneous equipment in emergency rescue are solved.

The invention discloses a trusted startup design method of a server, and belongs to the technical field of information security and trusted computing, after the server is powered up, a trusted root CPU core is started preferentially, a trusted startup program is operated, and a security environment is initialized; integrity measurement and verification are conducted on the BIOS, and after verification is passed, other CPU cores are released, and the BIOS is operated; the service CPU core loads a bootstrap program GRUB and submits the bootstrap program GRUB to the trusted root CPU core for verification; then loading an operating system kernel image and executing hash measurement, and calculating a path entropy value in combination with control flow information in a kernel initialization stage; performing segmentation comparison on the memory image and the disk mirror image, and calculating a mapping consistency coefficient; if the verification is passed, continuing to start the operating system; according to the method, the tampered component in the system startup chain can be effectively prevented from being loaded and operated, and the startup safety and the overall credibility of the server are enhanced.

The invention discloses a supply chain data protection method fusing a block chain and attribute-based proxy re-encryption, and the method comprises the steps: building an industry-based attribute through credible initialization, and achieving the parameter distribution through a block chain smart contract; dynamic key management is adopted to generate an attribute binding key for each participant, and automatic revocation and update are supported; an access strategy is accessed through conditional proxy re-encryption, and it is ensured that data only decrypts a requester meeting service conditions; a hierarchical encryption storage mechanism is designed, key data are stored on a chain, and large-capacity production logs are efficiently processed outside the chain through IPFS; and meanwhile, a compliance penetration interface is provided for a supervision mechanism, and legal data access under an emergency event is supported. It is ensured that the parameter generation process meets the verifiability requirement of a trusted computing platform, compliance verification and security isolation of data access are achieved, and attribute-level dynamic authorization and cross-enterprise security sharing of supply chain data are ensured.

The invention provides a data encryption and decryption method, system and device and a storage medium, the data encryption and decryption method comprises the following steps: S1, reading fragment keys from members in a key management group; the members of the key management group store fragmentation keys and manage the fragmentation keys through the smart contract of the block chain; members in the key management group are trusted computing modules; s2, combining the plurality of read fragment keys to generate an integral key; and S3, encrypting or decrypting the data by using the overall key. According to the invention, the members of the key management group manage the fragmented keys through the smart contract of the block chain, so that the fragmented keys conform to the unified smart contract, and the fragmented keys can be combined to form an integral key. And the situation that the fragmented keys cannot be combined to form an integral key due to the fact that the members adopt different key management methods is avoided.

The invention discloses a credible computing method and device based on a model vector, and the method comprises the steps: carrying out the preprocessing operation of to-be-processed data, obtaining a data credible influence factor set and a data time dimension set, the data time dimension set evaluates time factors based on a time decay function; assigning a credible score to each credible influence factor in the data credible influence factor set, and assigning a basic score to the corresponding credible influence factor as an element score based on the influence degree for each time dimension in the data time dimension set; and performing variation coefficient calculation, variation proportion calculation and weighted proportion calculation on each element in the data credible influence element set and the data time dimension set to obtain a final credible score. According to the method, the time attenuation form is perfected into model calculation in a more practical and more reasonable form, so that the business rule is consistent with the actual condition.

The invention discloses a data privacy trusted computing method and system, and relates to the technical field of data security and privacy protection.The method comprises the steps that a data privacy trusted computing engine is established in a federal learning mode; performing backdoor defense on the data privacy trusted computing engine by adopting a multi-stage federated learning backdoor defense mode; the multi-stage federated learning backdoor defense mode comprises the steps of screening a model uploaded by a user by adopting a robust aggregation algorithm, detecting whether the model has a backdoor by adopting trigger reverse engineering and a backdoor judging device, and repairing the model with the backdoor by adopting a backdoor forgetting technology; and constructing a federated learning backdoor defense system according to processing results of a robust aggregation algorithm, trigger reverse engineering, a backdoor judger and a backdoor forgetting technology. According to the method, the technical problems of low heterogeneous data processing efficiency and insufficient backdoor defense are effectively solved by constructing a multi-modal federal learning architecture and a multi-level self-adaptive defense system, and reliable technical support is provided for data security sharing in the power industry.

The invention provides an industrial project cross-department collaborative approval and supervision system based on trusted computing, and relates to the technical field of cross-department processing, and the system comprises an extraction module which is used for triggering an intelligent contract deployed on an alliance chain based on an on-chain evidence storage record, generating an approval event, and sending the approval event to a server; according to the data integrity, the process time sequence and the operation behavior characteristics in the approval process event, each behavior characteristic is quantified into a risk index corresponding to each dimension through a preset risk model, and a set of the risk indexes of each dimension forms a multi-dimensional vector; through on-chain credible evidence storage, multi-dimensional risk measurement, dynamic credit evaluation and closed-loop regulation and control, precision, credibility and dynamic optimization of industrial project cross-department collaborative approval and supervision are realized, approval efficiency and supervision efficiency are improved, and scientificity and safety of collaborative management and control are guaranteed.

The invention discloses a data management method and system for a data credible delivery platform. Access is realized through symmetric encryption of source data, and credible right confirmation is realized by relying on identities of owners and users of alliance chain evidence storage, source data hash and authorization rules; adding a timestamp to the encrypted data stream verified by the certificate to form a traceability mark, and encrypting or desensitizing privacy data; the trusted computing is provided with three modes: a local mode executes an algorithm in an ownership party isolation environment and records a log on a chain, a third-party mode constructs a trusted sandbox based on TEE, executes computing and links log hash after remote certification, and an algorithm privacy mode realizes cooperative computing through a Shamir secret sharing splitting algorithm in combination with MPC, a confusion circuit and zero-knowledge certification; and the result delivery adopts public key encryption, a decryption key is issued after the receipt of the user is verified, and the result hash and the receipt are linked for evidence storage, so that the problems that the existing trusted platform cannot support the execution of various algorithms and is lack of effective supervision are solved.

The invention relates to a secure deduction method and device based on trusted computing, and the method comprises the steps: collecting target data in a real environment through a trusted terminal in a deduction model which is obtained through training based on real historical data, the target data is subjected to credibility verification all the time according to credibility parameters and credibility states in the data circulation process; performing feature matching on the target data and a preset target feature library, and predicting a threat event in the target data; and determining a defense strategy corresponding to the threat event according to a preset defense scheme, and executing the defense strategy. On the basis that the deduction model has authenticity and security, active defense of threat events is realized.

Provided in the present disclosure are a data circulation method and apparatus, and a first platform and a first node. The method comprises: a first platform receiving information which is related to a data resource and is sent by a first node; and the first platform adding to a global data directory the information related to the data resource, wherein the first node is a trusted computing node of a data provider, and the first platform is a data scheduling center platform.

The invention discloses an oil reservoir digital intelligence twin modeling system based on trusted computing, which comprises a physical entity layer used for collecting oil reservoir field data in real time and a data processing layer responsible for processing the collected data, the intelligent twinborn layer is used for constructing a digital twinborn model of the oil reservoir and performing model prediction and optimization; the digital intelligent application layer is used for realizing data visualization; the trusted computing layer is used for realizing the safety of the whole data process; the trusted computing layer is connected with the physical entity layer, the data processing layer, the intelligent twinborn layer and the digital intelligent application layer. According to the system, the security and traceability of data can be enhanced, the security and integrity of the data in the acquisition, transmission and processing processes can be ensured, and more efficient real-time monitoring and decision support can be realized.