专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US08949931B2 System and method for monitoring application security in a network environment 有权
标题翻译：监控网络环境中的应用安全性的系统和方法
公开(公告)号：US08949931B2
公开(公告)日：2015-02-03
申请号：US13462110
申请日：2012-05-02
申请人： Vina Ermagan , Suraj Nellikar , Sudarshana Kandachar Sridhara Rao , Fabio R. Maino , Massimiliano Menarini
发明人： Vina Ermagan , Suraj Nellikar , Sudarshana Kandachar Sridhara Rao , Fabio R. Maino , Massimiliano Menarini
IPC分类号： G06F17/00 , H04L29/06
CPC分类号： H04L63/20 , G06F21/54 , G06F2221/2101 , H04L63/0209 , H04L63/102
摘要： A method includes determining an application role in a distributed application in a network environment, generating a role profile for the application role from an interaction pattern, mapping the role profile to a virtual machine (VM), and detecting a security breach of the VM. Determining the application role includes obtaining network traces from the distributed application, and analyzing the network traces to extract the application role. In one embodiment, detection of the security breach includes generating an access control policy for the VM from the role profile, and determining an anomaly in traffic based thereon. In another embodiment, detection of the security breach includes inserting the role profile in a port profile of the VM, generating a small state machine from the role profile, running the small state machine on a port associated with the VM, and inspecting, by the small state machine, an application level traffic at the port.
摘要翻译：一种方法包括确定在网络环境中的分布式应用程序中的应用程序角色，从交互模式生成应用程序角色的角色配置文件，将角色配置文件映射到虚拟机（VM），以及检测虚拟机的安全漏洞。确定应用程序角色包括从分布式应用程序获取网络跟踪，并分析网络跟踪以提取应用程序角色。在一个实施例中，安全漏洞的检测包括从角色简档生成VM的访问控制策略，并且基于此来确定业务的异常。在另一个实施例中，安全漏洞的检测包括将角色简档插入到VM的端口配置文件中，从角色配置文件生成小状态机，在与VM关联的端口上运行小状态机，并且通过小型状态机，端口上的应用级流量。

2. 发明申请

US20130298184A1 SYSTEM AND METHOD FOR MONITORING APPLICATION SECURITY IN A NETWORK ENVIRONMENT 有权
标题翻译：在网络环境中监控应用安全的系统和方法
公开(公告)号：US20130298184A1
公开(公告)日：2013-11-07
申请号：US13462110
申请日：2012-05-02
申请人： Vina Ermagan , Suraj Nellikar , Sudarshana Kandachar Sridhara Rao , Fabio R. Maino , Massimiliano Menarini
发明人： Vina Ermagan , Suraj Nellikar , Sudarshana Kandachar Sridhara Rao , Fabio R. Maino , Massimiliano Menarini
IPC分类号： G06F21/00
CPC分类号： H04L63/20 , G06F21/54 , G06F2221/2101 , H04L63/0209 , H04L63/102
摘要： A method includes determining an application role in a distributed application in a network environment, generating a role profile for the application role from an interaction pattern, mapping the role profile to a virtual machine (VM), and detecting a security breach of the VM. Determining the application role includes obtaining network traces from the distributed application, and analyzing the network traces to extract the application role. In one embodiment, detection of the security breach includes generating an access control policy for the VM from the role profile, and determining an anomaly in traffic based thereon. In another embodiment, detection of the security breach includes inserting the role profile in a port profile of the VM, generating a small state machine from the role profile, running the small state machine on a port associated with the VM, and inspecting, by the small state machine, an application level traffic at the port.
摘要翻译：一种方法包括确定在网络环境中的分布式应用程序中的应用程序角色，从交互模式生成应用程序角色的角色配置文件，将角色配置文件映射到虚拟机（VM），以及检测虚拟机的安全漏洞。确定应用程序角色包括从分布式应用程序获取网络跟踪，并分析网络跟踪以提取应用程序角色。在一个实施例中，安全漏洞的检测包括从角色简档生成VM的访问控制策略，并且基于此来确定业务的异常。在另一个实施例中，安全漏洞的检测包括将角色简档插入到VM的端口配置文件中，从角色配置文件生成小状态机，在与VM关联的端口上运行小状态机，并且通过小型状态机，端口上的应用级流量。

3. 发明授权

US08903593B1 System and method for analyzing vehicular behavior in a network environment 有权
标题翻译：用于分析网络环境中车辆行为的系统和方法
公开(公告)号：US08903593B1
公开(公告)日：2014-12-02
申请号：US13117860
申请日：2011-05-27
申请人： Sateesh K. Addepalli , Lillian Lei Dai , Ashok K. Moghe , Flavio Bonomi , Rodolfo A. Milito , Vina Ermagan , Fabio R. Maino , Pere Monclus
发明人： Sateesh K. Addepalli , Lillian Lei Dai , Ashok K. Moghe , Flavio Bonomi , Rodolfo A. Milito , Vina Ermagan , Fabio R. Maino , Pere Monclus
IPC分类号： G01M17/00 , G06F7/00 , G06F11/30 , G06F19/00 , G07C5/00
CPC分类号： H04W4/046 , B60R16/023 , B60W50/10 , G06F3/017 , G06F3/167 , G06F9/542 , G06F21/45 , H04L1/008 , H04L29/06578 , H04L43/0811 , H04L43/0858 , H04L43/0876 , H04L45/12 , H04L51/02 , H04L61/2592 , H04L63/08 , H04L63/107 , H04L67/12 , H04L67/32 , H04L69/18 , H04Q9/00 , H04W4/00 , H04W4/10 , H04W8/06 , H04W8/08 , H04W8/26 , H04W12/02 , H04W12/04 , H04W12/06 , H04W12/08 , H04W28/0215 , H04W28/06 , H04W36/08 , H04W40/02 , H04W40/20 , H04W48/02 , H04W48/06 , H04W48/16 , H04W48/18 , H04W52/12 , H04W52/143 , H04W52/225 , H04W52/241 , H04W52/346 , H04W72/0406 , H04W72/042 , H04W72/0493 , H04W76/45 , H04W80/02 , H04W84/005 , H04W84/12 , H04W92/18 , Y02A30/60
摘要： A method in one example embodiment includes receiving a set of data in real time from a plurality of machine devices associated with at least one vehicle, providing a set of reference data corresponding to a machine device of the plurality of machine devices, comparing the set of data with the set of reference data, and detecting a deviation within the set of data from the set of reference data. The method further includes initiating an operation associated with the deviation. The set of reference data could be a trend of previous data received from the machine device or a common trend based on a previous set of data of the machine device. More specific embodiments include receiving a plurality of data containing the set of data from the plurality of machine devices and identifying a state of the machine device using the set of data.
摘要翻译：一个示例实施例中的方法包括从与至少一个车辆相关联的多个机器设备实时接收一组数据，提供与多个机器设备的机器设备相对应的一组参考数据，具有参考数据集的数据，以及从该组参考数据中检测该组数据内的偏差。该方法还包括启动与偏差相关联的操作。参考数据集可以是从机器装置接收的先前数据的趋势或基于机器装置的先前数据集合的常见趋势。更具体的实施例包括从多个机器设备接收包含该组数据的多个数据，并使用该组数据识别机器设备的状态。

4. 发明授权

US08863256B1 System and method for enabling secure transactions using flexible identity management in a vehicular environment 有权
标题翻译：用于在车辆环境中使用灵活身份管理实现安全交易的系统和方法
公开(公告)号：US08863256B1
公开(公告)日：2014-10-14
申请号：US13014605
申请日：2011-01-26
申请人： Sateesh K. Addepalli , Fabio R. Maino , Flavio Bonomi , Lillian Lei Dai , Vina Ermagan , Alexander Loukissas , Erick D. Lee , Landon Curt Noll
发明人： Sateesh K. Addepalli , Fabio R. Maino , Flavio Bonomi , Lillian Lei Dai , Vina Ermagan , Alexander Loukissas , Erick D. Lee , Landon Curt Noll
IPC分类号： G06F7/04 , H04L29/06 , H04W12/08
CPC分类号： H04W4/046 , B60R16/023 , B60W50/10 , G06F3/017 , G06F3/167 , G06F9/542 , G06F21/45 , H04L1/008 , H04L29/06578 , H04L43/0811 , H04L43/0858 , H04L43/0876 , H04L45/12 , H04L51/02 , H04L61/2592 , H04L63/08 , H04L63/107 , H04L67/12 , H04L67/32 , H04L69/18 , H04Q9/00 , H04W4/00 , H04W4/10 , H04W8/06 , H04W8/08 , H04W8/26 , H04W12/02 , H04W12/04 , H04W12/06 , H04W12/08 , H04W28/0215 , H04W28/06 , H04W36/08 , H04W40/02 , H04W40/20 , H04W48/02 , H04W48/06 , H04W48/16 , H04W48/18 , H04W52/12 , H04W52/143 , H04W52/225 , H04W52/241 , H04W52/346 , H04W72/0406 , H04W72/042 , H04W72/0493 , H04W76/45 , H04W80/02 , H04W84/005 , H04W84/12 , H04W92/18 , Y02A30/60
摘要： A method in one embodiment includes detecting an event for a transaction on an on-board unit (OBU) of a vehicle, where the event has a trigger associated with an agent. The method also includes determining whether the transaction is authorized, identifying network credentials in an identity profile that corresponds to the agent, providing network credentials to a transaction application corresponding to the transaction, and accessing a remote network using the network credentials. Certain embodiments include selecting the network credentials from a plurality of available network credentials corresponding to the agent. In more specific embodiments, the network credentials include one or more virtual subscriber identity modules (VSIMs) of a plurality of VSIMs provisioned on the OBU. In specific embodiments, the network credentials are mapped to a combination of two or more of the agent, the transaction application, and a predefined current location of the vehicle.
摘要翻译：一个实施例中的方法包括检测车辆的车载单元（OBU）上的事务的事件，其中事件具有与代理相关联的触发。该方法还包括确定事务是否被授权，识别与代理相对应的身份简档中的网络凭证，向与事务相对应的事务应用提供网络凭证，以及使用网络凭证访问远程网络。某些实施例包括从与代理相对应的多个可用网络证书中选择网络凭证。在更具体的实施例中，网络证书包括在OBU上提供的多个VSIM的一个或多个虚拟用户识别模块（VSIM）。在具体实施例中，网络凭证被映射到代理，交易应用和车辆的预定义的当前位置中的两个或更多个的组合。

5. 发明授权

US07333612B2 Methods and apparatus for confidentiality protection for Fibre Channel Common Transport 有权
标题翻译：光纤通道共同运输机密保护方法与装置
公开(公告)号：US07333612B2
公开(公告)日：2008-02-19
申请号：US10805111
申请日：2004-03-19
申请人： Fabio R. Maino , Claudio DeSanti
发明人： Fabio R. Maino , Claudio DeSanti
IPC分类号： H04K1/00 , H04L9/00
CPC分类号： H04L63/0435 , H04L63/061 , H04L63/123 , H04L63/126
摘要： Methods and apparatus are provided for improving message-based security in a Fibre Channel network. More specifically, the present invention relates to methods and apparatus for providing confidentiality for Fibre Channel control messages encapsulated within Common Transport Information Units. Control messages transported with the Fibre Channel Common Transport protocol, and passed between Fibre Channel network entities, can be encrypted providing confidentiality combined with data origin authentication, integrity and anti-replay protection provided by existing Fibre Channel security mechanisms.
摘要翻译：提供了用于在光纤通道网络中改进基于消息的安全性的方法和装置。更具体地，本发明涉及用于为公共传输信息单元中封装的光纤通道控制消息提供保密性的方法和装置。通过光纤通道公共传输协议传输的光纤通道公共传输协议传输的控制消息可以通过光纤通道网络实体进行加密，从而提供机密性，并结合现有光纤通道安全机制提供的数据源认证，完整性和防重放保护。

6. 发明授权

US08356177B2 Key transport in authentication or cryptography 有权
标题翻译：密钥传输在认证或加密
公开(公告)号：US08356177B2
公开(公告)日：2013-01-15
申请号：US12604221
申请日：2009-10-22
申请人： David A. McGrew , Brian E. Weis , Fabio R. Maino
发明人： David A. McGrew , Brian E. Weis , Fabio R. Maino
IPC分类号： H04L9/00
CPC分类号： H04L9/0637 , H04L9/0822 , H04L9/0833 , H04L9/3242
摘要： A computer system for authenticating, encrypting, and transmitting a secret communication, where the encryption key is transmitted along with the encrypted message, is disclosed. In an embodiment, a first transmitting processor encrypts a plaintext message to a ciphertext message using a data key, encrypts the data key using a key encrypting key, and sends a communication comprising the encrypted data key and the ciphertext message. A second receiving processor receives the communication and then decrypts the encrypted data key using the key encrypting key and decrypts the ciphertext message using the data key to recover the plaintext message.
摘要翻译：公开了一种用于认证，加密和发送秘密通信的计算机系统，其中加密密钥与加密消息一起发送。在一个实施例中，第一发送处理器使用数据密钥将明文消息加密为密文消息，使用密钥加密密钥加密数据密钥，并发送包括加密数据密钥和密文消息的通信。第二接收处理器接收通信，然后使用密钥加密密钥解密加密的数据密钥，并使用数据密钥解密密文消息以恢复明文消息。

7. 发明授权

US08266431B2 Method and apparatus for performing encryption of data at rest at a port of a network device 有权
标题翻译：用于在网络设备的端口处静止地进行数据的加密的方法和装置
公开(公告)号：US08266431B2
公开(公告)日：2012-09-11
申请号：US11264191
申请日：2005-10-31
申请人： Jonathan M. Parlan , Raymond J. Kloth , Ying Huang , Fabio R. Maino , Pawan Agrawal
发明人： Jonathan M. Parlan , Raymond J. Kloth , Ying Huang , Fabio R. Maino , Pawan Agrawal
IPC分类号： G06F21/00
CPC分类号： H04L9/0897 , H04L9/0891 , H04L9/0894 , H04L9/3247 , H04L63/0428 , H04L63/0485 , H04L2209/56 , H04L2209/80
摘要： Methods and apparatus for performing encryption for data at rest at a port of a network device such as a switch are disclosed. Specifically, when data is received from a host during a write to a storage medium such as a disk, the data is encrypted by the port prior to transmitting the encrypted data to the storage medium. Similarly, when a host attempts to read data from the storage medium, the port of the network device receives the encrypted data from the storage medium, decrypts the data, and transmits the decrypted data to the host. In this manner, encryption and decryption of data at rest are supported by the port of the network device.
摘要翻译：公开了用于在诸如交换机的网络设备的端口处静止的数据执行加密的方法和装置。具体地说，当在向诸如盘的存储介质的写入期间从主机接收到数据时，在将加密数据发送到存储介质之前，数据被端口加密。类似地，当主机尝试从存储介质读取数据时，网络设备的端口从存储介质接收加密的数据，解密数据，并将解密的数据发送到主机。以这种方式，网络设备的端口支持静止数据的加密和解密。

8. 发明授权

US07965843B1 Methods and apparatus for security over fibre channel 有权
标题翻译：光纤通道安全的方法和装置
公开(公告)号：US07965843B1
公开(公告)日：2011-06-21
申请号：US10034367
申请日：2001-12-27
申请人： Fabio R. Maino , Marco Di Benedetto , Claudio Desanti
发明人： Fabio R. Maino , Marco Di Benedetto , Claudio Desanti
IPC分类号： H04L9/12
CPC分类号： H04L63/123 , H04L9/0838 , H04L9/3239 , H04L63/12
摘要： Methods and apparatus are provided for improving both node-based and message-based security in a fibre channel network. Entity to entity authentication and key exchange services can be included in existing initialization messages used for introducing fibre channel network entities into a fibre channel fabric, or with specific messages exchanged over an already initialized communication channel. Both per-message authentication and encryption mechanisms can be activated using the authentication and key exchange services. Messages passed between fibre channel network entities can be encrypted and authenticated using information provided during the authentication sequence. Security services such as per-message authentication, confidentiality, integrity protection, and anti-replay protection can be implemented.
摘要翻译：提供了用于改进光纤通道网络中的基于节点和基于消息的安全性的方法和装置。可以将实体认证和密钥交换服务的实体包括在用于将光纤信道网络实体引入光纤信道结构的现有初始化消息中，或者通过已经初始化的通信信道交换的特定消息。可以使用认证和密钥交换服务来激活每消息认证和加密机制。在光纤通道网络实体之间通过的消息可以使用在认证序列期间提供的信息进行加密和认证。可以实现诸如每消息认证，机密性，完整性保护和反重放保护等安全服务。

9. 发明授权

US07568078B2 Epoch-based MUD logging 有权
标题翻译：基于时代的MUD记录
公开(公告)号：US07568078B2
公开(公告)日：2009-07-28
申请号：US11494036
申请日：2006-07-26
申请人： Samar Sharma , Dinesh G. Dutt , Fabio R. Maino , Sanjaya Kumar
发明人： Samar Sharma , Dinesh G. Dutt , Fabio R. Maino , Sanjaya Kumar
IPC分类号： G06F12/00
CPC分类号： G06F11/2082 , H04L67/1097
摘要： Methods and apparatus for performing MUD logging for a volume in a system implementing network-based virtualization are disclosed. This is accomplished by enabling two or more MUD loggers to separately maintain a MUD log for the volume. Through enabling the MUD loggers to communicate, the MUD loggers may update their respective MUD logs. Each MUD log includes information for one or more epochs, where the information for each of the epochs indicates a set of one or more regions that have been modified during the corresponding epoch.
摘要翻译：公开了在实现基于网络的虚拟化的系统中执行用于卷的MUD日志记录的方法和装置。这是通过使两个或多个MUD记录器能够单独维护该卷的MUD日志来实现的。通过启用MUD记录器进行通信，MUD记录器可以更新其各自的MUD日志。每个MUD日志包括一个或多个纪元的信息，其中每个历元的信息指示在相应历元期间被修改的一个或多个区域的集合。

10. 发明授权

US08812871B2 Method and apparatus for trusted execution in infrastructure as a service cloud environments 有权
标题翻译：在基础架构中作为服务云环境中的可信执行的方法和装置
公开(公告)号：US08812871B2
公开(公告)日：2014-08-19
申请号：US12789189
申请日：2010-05-27
申请人： Pere Monclus , Fabio R. Maino
发明人： Pere Monclus , Fabio R. Maino
IPC分类号： G06F21/00
CPC分类号： H04L9/0894 , G06F9/45558 , G06F21/53 , G06F21/72 , G06F21/79 , G06F2009/45587
摘要： The present disclosure presents a method and apparatus configured to provide for the trusted execution of virtual machines (VMs) on a virtualization server, e.g., for executing VMs on a virtualization server provided within Infrastructure as a Service (IaaS) cloud environment. A physical multi-core CPU may be configured with a hardware trust anchor. The trust anchor itself may be configured to manage session keys used to encrypt/decrypt instructions and data when a VM (or hypervisor) is executed on one of the CPU cores. When a context switch occurs due to an exception, the trust anchor swaps the session key used to encrypt/decrypt the contents of memory and cache allocated to a VM (or hypervisor).
摘要翻译：本公开提供了一种方法和装置，被配置为提供虚拟化服务器上虚拟机（VM）的可信执行，例如用于在基础架构即服务（IaaS）云环境中提供的虚拟化服务器上执行虚拟机。物理多核CPU可以配置有硬件信任锚点。当在其中一个CPU核上执行VM（或管理程序）时，信任锚本身可以被配置为管理用于加密/解密指令和数据的会话密钥。当由于异常而发生上下文切换时，信任锚转换用于加密/解密分配给VM（或管理程序）的内存和缓存内容的会话密钥。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式