专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US08218772B2 Secure multicast content delivery 有权
标题翻译：安全的多播内容传送
公开(公告)号：US08218772B2
公开(公告)日：2012-07-10
申请号：US12165201
申请日：2008-06-30
申请人： Onur Aciicmez , Xinwen Zhang , Jean-Pierre Seifert
发明人： Onur Aciicmez , Xinwen Zhang , Jean-Pierre Seifert
IPC分类号： H04L9/00
CPC分类号： H04L63/06 , H04L12/1859 , H04L2463/062
摘要： In one embodiment, a method for establishing a secure multicast channel between a service provider and a terminal is provided. A request is received from the service provider for a configuration of the terminal. A configuration of the terminal at a first time is sent to the service provider. A security key is obtained, wherein the security is bound to the configuration of the terminal at the first time. Then the security key is decrypted using a configuration of the terminal at a second time, wherein the decryption fails if the configuration of the terminal at the second time is not identical to the configuration of the terminal at the first time. A secure multicast channel is then established with the service provider using the security key.
摘要翻译：在一个实施例中，提供了一种用于在服务提供商和终端之间建立安全组播信道的方法。从服务提供商接收到终端配置的请求。首先将终端的配置发送给服务提供商。获得安全密钥，其中安全性在第一时间被绑定到终端的配置。然后使用终端的配置在第二时间对安全密钥进行解密，其中如果第二次终端的配置与终端的配置不同，则解密失败。然后使用安全密钥与服务提供商建立安全的多播信道。

2. 发明授权

US08136153B2 Securing CPU affinity in multiprocessor architectures 有权
标题翻译：在多处理器架构中保护CPU关联
公开(公告)号：US08136153B2
公开(公告)日：2012-03-13
申请号：US11937320
申请日：2007-11-08
申请人： Xinwen Zhang , Jean-Pierre Seifert , Onur Aciicmez , Qingwei Ma
发明人： Xinwen Zhang , Jean-Pierre Seifert , Onur Aciicmez , Qingwei Ma
IPC分类号： G06F13/00
CPC分类号： G06F9/5033 , G06F21/52 , G06F21/62 , G06F21/6281
摘要： In an embodiment of the present invention, the ability for a user or process to set or modify affinities is restricted in order to method for control a multi-processor environment. This may be accomplished by using a reference monitor that controls a process' capability to retrieve and set its or another process' affinity. This aids in the prevention of security breaches.
摘要翻译：在本发明的一个实施例中，为了控制多处理器环境的方法，限制了用户或进程设置或修改关联性的能力。这可以通过使用参考监视器来实现，该监视器控制过程检索和设置其或另一进程的亲和力的能力。这有助于预防安全漏洞。

3. 发明授权

US08112634B2 Security-enhanced storage devices using media location factor in encryption of hidden and non-hidden partitions 失效
标题翻译：使用媒体位置因子加密隐藏和非隐藏分区的安全增强型存储设备
公开(公告)号：US08112634B2
公开(公告)日：2012-02-07
申请号：US12132862
申请日：2008-06-04
申请人： Onur Aciicmez , Xinwen Zhang , Jean-Pierre Seifert
发明人： Onur Aciicmez , Xinwen Zhang , Jean-Pierre Seifert
IPC分类号： G06F11/30 , G06F12/14
CPC分类号： H04L9/0872
摘要： Methods and devices for increasing or hardening the security of data stored in a storage device, such as a hard disk drive, are described. A storage device provides for increased or hardened security of data stored in hidden and non-hidden partitions of a storage medium in the device. An algorithm may be utilized for deriving a key that is used to encrypt or decrypt text before it is read from or written to the hard disk. The algorithm accepts as input a specific media location factor, such as an end address or start address of the block where the text is being read from or written to, and a secret key of the storage component. The output of the algorithm is a final key that may be used in the encryption and decryption process. Thus, in this manner, the final key is dependent on the location of the block where the data is being written or read, thereby making it more difficult to tamper with the data, which may be stored in a hidden or non-hidden partition of a hard disk.
摘要翻译：描述用于增加或加强存储在诸如硬盘驱动器的存储设备中的数据的安全性的方法和设备。存储设备提供存储在设备中的存储介质的隐藏和非隐藏分区中的数据的增加或加强的安全性。可以使用算法来导出用于在从硬盘读取或写入硬盘之前加密或解密文本的密钥。该算法接受特定媒体位置因子的输入，诸如文本被读取或写入的块的结束地址或起始地址以及存储组件的秘密密钥。算法的输出是可以在加密和解密过程中使用的最终密钥。因此，以这种方式，最终密钥取决于数据被写入或读取的块的位置，从而使得更难以篡改可以存储在隐藏或非隐藏分区中的数据一个硬盘。

4. 发明授权

US08055848B2 Method and system for securing instruction caches using substantially random instruction mapping scheme 有权
标题翻译：使用基本上随机的指令映射方案来保护指令高速缓存的方法和系统
公开(公告)号：US08055848B2
公开(公告)日：2011-11-08
申请号：US12183689
申请日：2008-07-31
申请人： Onur Aciicmez , Jean-Pierre Seifert , Qingwei Ma , Xinwen Zhang
发明人： Onur Aciicmez , Jean-Pierre Seifert , Qingwei Ma , Xinwen Zhang
IPC分类号： G06F12/08
CPC分类号： G06F12/1408 , G06F12/0842
摘要： A method and system is provided for securing micro-architectural instruction caches (I-caches). Securing an I-cache involves maintaining a different substantially random instruction mapping policy into an I-cache for each of multiple processes, and for each process, performing a substantially random mapping scheme for mapping a process instruction into the I-cache based on the substantially random instruction mapping policy for said process. Securing the I-cache may further involve dynamically partitioning the I-cache into multiple logical partitions, and sharing access to the I-cache by an I-cache mapping policy that provides access to each I-cache partition by only one logical processor.
摘要翻译：提供了一种用于保护微架构指令高速缓存（I缓存）的方法和系统。保护I缓存涉及为多个进程中的每一个维护不同的基本上随机的指令映射策略到I缓存中，并且对于每个进程，执行基本上随机的映射方案，用于将处理指令映射到I缓存中，用于所述进程的随机指令映射策略。保护I缓存还可以包括动态地将I缓存分区成多个逻辑分区，并且通过仅由一个逻辑处理器提供对每个I缓存分区的访问的I缓存映射策略共享对I缓存的访问。

5. 发明申请

US20100162240A1 CONSISTENT SECURITY ENFORCEMENT FOR SAFER COMPUTING SYSTEMS 审中-公开
标题翻译：一致的安全执行，为安全的计算机系统
公开(公告)号：US20100162240A1
公开(公告)日：2010-06-24
申请号：US12343154
申请日：2008-12-23
申请人： Xinwen Zhang , Jean-Pierre Seifert , Onur Aciicmez
发明人： Xinwen Zhang , Jean-Pierre Seifert , Onur Aciicmez
IPC分类号： G06F9/455
CPC分类号： G06F21/577
摘要： Security can be enforced in a consistent manner with respect to various computing environments that may be operable in a computing system. Consistent security criteria can be generated, based on input security criterion, in a computer readable and storable form and stored in a computer readable storage medium, thereby allowing the consistent security criterion to be effectively provided to a computing system for enforcement of the input security criterion in a consistent manner with respect to, for example, (a) a first executable computer code effectively supported by an Operating System (OS), and (b) a second computer code effectively supported by the Virtual Computing Environment (VCE). A Trusted Component (TC) can effectively provide a consistent security criterion as a part and/or form that is suitable for a particular computing environment. The TC can, for example, be an automated tool that performs various functions including: verifying the consistency of security criteria, generation and deployment of consistent security criteria, and transformation of security criteria to parts and/or forms suitable for various computing environments. In addition, a Virtual Computing Environment (VCE) can obtain from the Operating System (OS) one or more security criteria. The Virtual Computing Environment (VCE) can be operable in a Trusted Computing Environment (TCE) and interface with a Trusted Operating System (TOS) that effectively enforces Mandatory Access Control (MAC), thereby allowing the Virtual Computing Environment (VCE) to leverage the security provided by the OS. The OS can, for example, be a Security-Enhanced Linux (SELinux) Operating System operating as a Trusted Component in a Trusted Environment that includes a Trusted Security Agent (TSA) operable to deploy consistent security criteria.
摘要翻译：相对于可在计算系统中可操作的各种计算环境，可以以一致的方式实施安全性。可以基于输入安全标准以计算机可读和可存储的形式生成一致的安全标准，并存储在计算机可读存储介质中，从而允许将一致的安全标准有效地提供给计算系统，以便执行输入的安全标准以相对于例如（a）由操作系统（OS）有效支持的第一可执行计算机代码和（b）由虚拟计算环境（VCE）有效支持的第二计算机代码以一致的方式。可信组件（TC）可以有效地提供一致的安全标准作为适合特定计算环境的部分和/或形式。例如，TC可以是执行各种功能的自动化工具，包括：验证安全标准的一致性，生成和部署一致的安全标准，以及将安全标准转换为适用于各种计算环境的部件和/或形式。此外，虚拟计算环境（VCE）可以从操作系统（OS）获得一个或多个安全标准。虚拟计算环境（VCE）可以在可信计算环境（TCE）中进行操作，并与可靠的操作系统（TOS）进行接口，可靠的操作系统（TOS）有效地强制执行强制访问控制（MAC），从而允许虚拟计算环境（VCE）利用 OS提供的安全性。例如，操作系统可以是在可信环境中作为受信任组件运行的安全增强型Linux（SELinux）操作系统，其中包含可操作以部署一致的安全性标准的可信安全代理（TSA）。

6. 发明申请

US20090199296A1 DETECTING UNAUTHORIZED USE OF COMPUTING DEVICES BASED ON BEHAVIORAL PATTERNS 有权
标题翻译：检测基于行为模式的计算机设备的未经授权的使用
公开(公告)号：US20090199296A1
公开(公告)日：2009-08-06
申请号：US12025678
申请日：2008-02-04
申请人： Liang Xie , Xinwen Zhang , Jean-Pierre Seifert , Onur Aciicmez , Afshin Latifi
发明人： Liang Xie , Xinwen Zhang , Jean-Pierre Seifert , Onur Aciicmez , Afshin Latifi
IPC分类号： G06F11/00
CPC分类号： H04L63/1416 , G06F21/316 , G06F21/552 , G06F21/554 , G06F21/566 , H04L63/1408 , H04L63/145
摘要： Techniques for detecting unauthorized use (e.g., malicious attacks) of the computing systems (e.g., computing devices) are disclosed. Unauthorized use can be detected based on patterns of use (e.g., behavioral patterns of use typically associated with a human being) of the computing systems. Acceptable behavioral pattern data can be generated for a computing system by monitoring the use of a support system (e.g., an operating system, a virtual environment) operating on the computing system. For example, a plurality of system support provider components of a support system (e.g., system calls, device drivers) can be monitored in order to generate the acceptable behavioral pattern data in a form which effectively defines an acceptable pattern of use (usage pattern) for the monitored system support provider components, thereby allowing detection of unauthorized use of a computing system by detecting any deviation from the acceptable pattern of use of the monitored system support provider components.
摘要翻译：公开了用于检测计算系统（例如，计算设备）的未经授权的使用（例如，恶意攻击）的技术。可以基于计算系统的使用模式（例如，通常与人相关联的行为模式）来检测未经授权的使用。可以通过监视在计算系统上运行的支持系统（例如，操作系统，虚拟环境）的使用来为计算系统生成可接受的行为模式数据。例如，可以监视支持系统的多个系统支持提供商组件（例如，系统调用，设备驱动程序），以便以有效地定义可接受的使用模式（使用模式）的形式生成可接受的行为模式数据，用于监视的系统支持提供者组件，从而通过检测与受监视的系统支持提供商组件的可接受的使用模式的任何偏离来允许检测计算系统的未经授权的使用。

7. 发明申请

US20090049510A1 SECURING STORED CONTENT FOR TRUSTED HOSTS AND SAFE COMPUTING ENVIRONMENTS 失效
标题翻译：保护有关主机和安全计算环境的存储内容
公开(公告)号：US20090049510A1
公开(公告)日：2009-02-19
申请号：US11839439
申请日：2007-08-15
申请人： Xinwen Zhang , Onur Aciicmez , Jean-Pierre Seifert , Qingwei Ma
发明人： Xinwen Zhang , Onur Aciicmez , Jean-Pierre Seifert , Qingwei Ma
IPC分类号： G06F21/00 , G06F15/16 , G06F9/455 , H04L9/32 , H04L9/30 , G06F17/00
CPC分类号： G06F21/53 , G06F21/57 , G06F21/79
摘要： Techniques for protecting content to ensure its use in a trusted environment are disclosed. The stored content is protected against harmful and/or defective host (or hosted) environments. A trusted security component provided for a device can verify the internal integrity of the stored content and the host before it allows the content to come in contact with the host. As a counter part, a trusted security component provided for the host can verify and attest to the integrity of the host and/or specific host computing environment that can be provided for the content stored in the device. The trusted security component provided for a device effectively verify the host integrity based on the information attested to by the trusted security component provided for the host. If the trusted security component trusts the host, it allows the trusted host to provide a trusted host computing environment trusted to be safe for the content stored in the device. A trusted host can effectively provide a safe virtual environment that allows a content representing a copy (or image) of an original computing environment to operate on the host computing system to give a similar appearance as the original computing environment.
摘要翻译：公开了用于保护内容以确保其在可信环境中使用的技术。存储的内容受到保护，防止有害和/或缺陷的主机（或托管）环境。为设备提供的受信任的安全组件可以在允许内容与主机联系之前验证存储的内容和主机的内部完整性。作为计数器部件，为主机提供的可信安全组件可以验证和证实可以为存储在设备中的内容提供的主机和/或特定主机计算环境的完整性。为设备提供的受信任的安全性组件基于为主机提供的可信安全组件所证明的信息有效地验证主机完整性。如果信任的安全组件信任主机，则允许可信主机提供受信任的主机计算环境，以便对存储在设备中的内容安全。可信主机可以有效地提供安全的虚拟环境，其允许表示原始计算环境的副本（或图像）的内容在主机计算系统上操作以给出与原始计算环境相似的外观。

8. 发明授权

US08752130B2 Trusted multi-stakeholder environment 失效
标题翻译：可信赖的利益相关者环境
公开(公告)号：US08752130B2
公开(公告)日：2014-06-10
申请号：US11963363
申请日：2007-12-21
申请人： Xinwen Zhang , Jean-Pierre Seifert , Wookhee Min , Onur Aciicmez
发明人： Xinwen Zhang , Jean-Pierre Seifert , Wookhee Min , Onur Aciicmez
IPC分类号： G06F7/04
CPC分类号： G06F21/6218 , G06F2221/2141
摘要： In one embodiment, a multi-stakeholder environment is controlled by first assigning a first domain to a first stakeholder and a second domain to a second stakeholder. Then a first access policy is defined for the first domain and access is restricted to the first domain for the second stakeholder according to the first access policy. In another embodiment, an access request is handled in a multi-stakeholder environment by first receiving parameters forwarded by hooks in system call functions in a kernel of the multi-stakeholder environment, wherein the parameters contain information about a first stakeholder requesting access to a domain corresponding to a second stakeholder. Then it is determined whether to allow the first stakeholder to access the domain based at least partially upon security settings corresponding to the domain.
摘要翻译：在一个实施例中，通过首先将第一域分配给第一利益相关者，将第二域分配给第二利益相关者来控制多利害关系者环境。然后为第一个域定义第一个访问策略，根据第一个访问策略，访问被限制到第二个利益相关者的第一个域。在另一个实施例中，通过首先在多方利益相关者环境的内核中接收由钩子在系统调用函数中转发的参数来处理访问请求，其中参数包含关于请求访问域的第一个利益相关者的信息对应于第二个利益相关者。然后确定是否允许第一利益相关者至少部分地基于对应于域的安全设置来访问域。

9. 发明授权

US08621551B2 Safety and management of computing environments that may support unsafe components 失效
标题翻译：可能支持不安全组件的计算环境的安全和管理
公开(公告)号：US08621551B2
公开(公告)日：2013-12-31
申请号：US12106235
申请日：2008-04-18
申请人： Xinwen Zhang , Liang Xie , Jean-Pierre Seifert , Onur Aciicmez , Afshin Latifi
发明人： Xinwen Zhang , Liang Xie , Jean-Pierre Seifert , Onur Aciicmez , Afshin Latifi
IPC分类号： G06F21/00
CPC分类号： G06F21/552 , G06F21/53 , G06F21/554 , G06F21/57 , G06F2221/2149 , G06F2221/2153 , H04L63/0876 , H04L63/10 , H04L63/1441 , H04L63/20
摘要： Techniques for managing and protecting computing environments are disclosed. A safe computing environment can be provided for ensuring the safety and/or management of a device. The safe computing environment can be secured by a safe component that isolates and protects it from unsafe computing environments which may also be operating. As a result, various security and management activities can be securely performed from a safe computing environment. A safe computing environment can, for example, be provided on a device as a safe virtual computing environment (e.g., a safe virtual machine) protected by a safe virtual computing monitor (e.g., a safe virtual machine monitor) from one or more other virtual computing environments that are not known or not believed to be safe for the device. It will also be appreciated that the safe components can, for example, be provided as trusted components for a device. As such, various trusted components (or agent) can operate in a trusted computing environment secured from interference by components that many not be trusted and perform various security and/or management tasks alone or in connection, for example, with other trusted components (e.g., trusted serves).
摘要翻译：公开了用于管理和保护计算环境的技术。可以提供安全的计算环境，以确保设备的安全和/或管理。安全的计算环境可以通过一个安全的组件来保护，该安全组件可以将其与可能还在运行的不安全的计算环境进行隔离和保护。因此，可以从安全的计算环境安全地执行各种安全和管理活动。例如，可以将安全的计算环境作为安全的虚拟计算环境（例如，安全的虚拟机）在由一个或多个其他虚拟的安全的虚拟计算监视器（例如，安全的虚拟机监视器））保护的设备上提供不知道或不相信设备安全的计算环境。还将理解，安全组件可以例如被提供为用于设备的可信组件。因此，各种受信任的组件（或代理）可以在受信任的计算环境中操作，以防受到许多不被信任的组件的干扰，并且单独执行各种安全和/或管理任务，或者例如与其他受信任的组件（例如，，可信任的服务）。

10. 发明授权

US08108519B2 Secure inter-process communication for safer computing environments and systems 失效
标题翻译：安全的进程间通信，用于更安全的计算环境和系统
公开(公告)号：US08108519B2
公开(公告)日：2012-01-31
申请号：US12364303
申请日：2009-02-02
申请人： Xinwen Zhang , Wenjuan Xu , Onur Aciicmez , Jean-Pierre Seifert
发明人： Xinwen Zhang , Wenjuan Xu , Onur Aciicmez , Jean-Pierre Seifert
IPC分类号： G06F13/00
CPC分类号： G06F9/54 , G06F9/468
摘要： Techniques for Inter-Process Communication (IPC) in a more secure manner are disclosed. A communication component operating outside of an operating system can obtain operating-system data pertaining to processes that also operate outside of the operating system. The operating-system data can be more reliable than information that may have been provided by the processes, thereby allowing more secure IPC and consequently a more secure computing environment and/or system. A communication component can also be operable to make control decisions regarding the IPC data (e.g., IPC messages) based on the information provided and/or originated by the operating system (or operating-system data) and/or effectively provide the operating-system data pertaining to a sender process to its intended recipient process. A recipient process can also be operable to obtain the operating-system data pertaining to a sender process. Moreover, a recipient process can make control decisions regarding the IPC data originated by the sender process based on the operating-system data effectively provided and/or originated by the operating system rather than the sender process, thereby allowing the recipient process to make control decisions based on information provided by a more reliable (e.g., Trusted) source.
摘要翻译：公开了以更安全的方式进行进程间通信（IPC）的技术。在操作系统外部操作的通信组件可以获得与在操作系统外部操作的处理有关的操作系统数据。操作系统数据可能比由过程可能提供的信息更可靠，从而允许更安全的IPC，从而允许更安全的计算环境和/或系统。通信组件还可以用于基于由操作系统（或操作系统数据）提供和/或发起的信息和/或有效地提供操作系统来进行关于IPC数据（例如，IPC消息）的控制决定与发送者进程有关的数据到其预期收件人进程。接收者进程也可以用于获得与发送者进程有关的操作系统数据。此外，接收者进程可以基于由操作系统而不是发送者进程有效提供和/或发起的操作系统数据来发起关于由发送者进程发起的IPC数据的控制决定，从而允许接收者进程作出控制决定基于由更可靠的（例如，可信赖的）源提供的信息。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式