公开(公告)号：US20100117873A1

公开(公告)日：2010-05-13

申请号：US12268001

申请日：2008-11-10

申请人： Onur ACIICMEZ ,  Jean-Pierre SEIFERT ,  Xinwen ZHANG ,  Afshin LATIFI

发明人： Onur ACIICMEZ ,  Jean-Pierre SEIFERT ,  Xinwen ZHANG ,  Afshin LATIFI

IPC分类号： H03M7/30

CPC分类号： H03M7/3086 ,  H03M7/30

摘要： Techniques for hashing and decompression of data are disclosed. Hashing and decompression of compressed data can be integrated in order to effectively hash and decompress the compressed data at the same time. The integrated hashing and decompression techniques of the invention are useful for any computing environment and/or system where compressed data is hashed and decompressed. The invention is especially useful for safe computing environment and/or system (e.g., a Trusted Computing (TC) computing environment) where hashing decompression of compressed data can be routinely performed. The Integrity of a computing environment and/or system can be protected by integrating the decompressing and hashing of the compressed data or effectively hashing and decompressing the compressed data at the same time. A combined hashing and decompression function can be provided based on conventional hashing and compression functions by integrating their similar components and in an efficient manner.

摘要翻译： 公开了散列和解压缩数据的技术。 可以集成压缩数据的哈希和解压缩，以便同时有效地对压缩数据进行散列和解压缩。 本发明的集成散列和解压缩技术对于压缩数据被散列和解压缩的任何计算环境和/或系统是有用的。 本发明对于可以常规执行压缩数据的散列解压缩的安全计算环境和/或系统（例如，可信计算（TC）计算环境）特别有用。 计算环境和/或系统的完整性可以通过对压缩数据的解压缩和散列进行集成来进行保护，或者同时有效地对压缩数据进行散列和解压缩。 可以通过集成其类似组件并以有效的方式，基于常规散列和压缩功能提供组合的散列和减压功能。

公开(公告)号：US20090271844A1

公开(公告)日：2009-10-29

申请号：US12108455

申请日：2008-04-23

申请人： Xinwen ZHANG ,  Jean-Pierre SEIFERT ,  Onur ACIICMEZ ,  Afshin LATIFI

发明人： Xinwen ZHANG ,  Jean-Pierre SEIFERT ,  Onur ACIICMEZ ,  Afshin LATIFI

IPC分类号： G06F12/00

CPC分类号： G06F12/1458

摘要： Improved techniques for controlling access to accessible components of computing environments are disclosed. The techniques, among other things, can be used to provide Mandatory Access Control (MAC) mechanisms for mobile and embedded systems. One or more accessible components (e.g., accessible resources) which a component may attempt to access are determined so that one or more access permissions can be stored in a manner that they can be obtained if the component attempts to access the one or more accessible components, thereby allowing access to the one or more accessible components to be determined based on access permissions that are readily available. Generally, access permissions can be identified and stored in anticipation of need. Access permissions can be identified, for example, based on the likelihood of use, or all possible access permissions can be determined and stored. A safe (e.g., a trusted) access controlling (or monitoring) system (or component) can control access to resources of a computing environment. For example, a trusted access monitoring system can be provided in a secure and trusted operating environment utilizing Mandatory Access Control (MAC) capabilities of a secure operating system (e.g., SELinux Operating System).

摘要翻译： 公开了用于控制对计算环境的可访问组件的访问的改进的技术。 这些技术可以用于为移动和嵌入式系统提供强制访问控制（MAC）机制。 确定组件可尝试访问的一个或多个可访问组件（例如，可访问资源），使得可以以如下方式来存储一个或多个访问许可：如果组件尝试访问一个或多个可访问组件 从而允许基于容易获得的访问权限来访问要被确定的一个或多个可访问组件。 通常，可以根据需要识别和存储访问权限。 可以例如基于使用的可能性来识别访问权限，或者可以确定和存储所有可能的访问许可。 安全（例如，受信任的）访问控制（或监视）系统（或组件）可以控制对计算环境的资源的访问。 例如，可以使用安全操作系统（例如，SELinux操作系统）的强制访问控制（MAC）功能在安全和受信任的操作环境中提供可信赖的访问监控系统。

公开(公告)号：US20100122314A1

公开(公告)日：2010-05-13

申请号：US12267990

申请日：2008-11-10

申请人： Xinwen ZHANG ,  Jean-Pierre SEIFERT ,  Onur ACIICMEZ ,  Afshin LATIFI

发明人： Xinwen ZHANG ,  Jean-Pierre SEIFERT ,  Onur ACIICMEZ ,  Afshin LATIFI

IPC分类号： G06F21/22

CPC分类号： G06F21/554

摘要： Techniques for controlling access are disclosed. The techniques can be used for reference monitoring in various computing systems (e.g., computing device) including those that may be relatively more susceptible to threats (e.g., mobile phones). Allowed access can be disallowed. In other words, permission to access a component can be effectively withdrawn even though access may be on-going. After permission to access a component has been allowed, one or more disallow access conditions or events can be effectively monitored in order to determine whether to withdraw the permission to access the component. As a result, allowed access to the component can be disallowed. Access can be disallowed by effectively considering the behavior of a component in the aggregate and/or over a determined amount of time. By way of example, a messaging application can be disallowed access to a communication port if the messaging application sends more messages than an acceptable limit during a session or in 4 hours. Disallow-access policies, rules and/or conditions can be defined and modified, for example, by end-users and system administrators, allowing a customizable and flexible security environment that is more adaptable to change.

摘要翻译： 公开了用于控制访问的技术。 这些技术可用于各种计算系统（例如，计算设备）中的参考监视，包括可能相对更易受威胁（例如，移动电话）的那些。 允许访问可以被禁止。 换句话说，即使访问可能正在进行，也可以有效地撤销访问组件的权限。 允许访问组件后，可以有效地监视一个或多个不允许访问条件或事件，以便确定是否撤销访问组件的权限。 因此，允许访问组件可以被禁止。 可以通过有效地考虑组件在集合中和/或在确定的时间内的行为来禁止访问。 作为示例，如果消息传递应用程序在会话期间或在4小时内发送比可接受的限制更多的消息，则可以不允许消息传递应用程序访问通信端口。 禁止访问策略，规则和/或条件可以由最终用户和系统管理员进行定义和修改，从而允许更适应于更改的可自定义和灵活的安全环境。

公开(公告)号：US20100106976A1

公开(公告)日：2010-04-29

申请号：US12256773

申请日：2008-10-23

申请人： Onur ACIICMEZ ,  Jean-Pierre SEIFERT ,  Xinwen ZHANG ,  Afshin LATIFI

发明人： Onur ACIICMEZ ,  Jean-Pierre SEIFERT ,  Xinwen ZHANG ,  Afshin LATIFI

IPC分类号： G06F21/00

CPC分类号： G06F17/30516 ,  G06F21/565 ,  G06F21/64 ,  H04L9/0643

摘要： Techniques for representation and verification of data are disclosed. The techniques are especially useful for representation and verification of the integrity of data (integrity verification) in safe computing environments and/or systems (e.g., Trusted Computing (TC) systems and/or environments). Multiple independent representative values can be determined independently and possibly in parallel for respective portions of the data. The independent representative values can, for example, be hash values determined at the same time for respective distinct portions of the data. The integrity of the data can be determined based on the multiple hash values by, for example, processing them to determine a single hash value that can serve as an integrity value. By effectively dividing the data into multiple portions in multiple processing streams and processing them in parallel to determine multiple hash values simultaneously, the time required for hashing the data can be reduced in comparison to conventional techniques that operate to determine a hash value for the data as a whole and in a single processing stream. As a result, the time required for integrity verification can be reduced, thereby allowing safe features to be extended to devices that may operate with relatively limited resources (e.g., mobile and/or embedded devices) as well as improving the general efficiency of device that are or will be using safety features (e.g., Trusted Computing (TC) device).

摘要翻译： 公开了用于表示和验证数据的技术。 这些技术对于在安全计算环境和/或系统（例如，可信计算（TC）系统和/或环境）中的数据完整性（完整性验证）的表示和验证特别有用。 可以针对数据的各个部分独立且可能并行地确定多个独立代表值。 独立代表值可以例如是数据的相应不同部分同时确定的散列值。 可以通过例如处理它们来确定可以用作完整性值的单个散列值，基于多个散列值来确定数据的完整性。 通过在多个处理流中有效地将数据划分成多个部分并且并行处理它们以同时确定多个散列值，与操作以确定数据的散列值的常规技术相比，可以减少散列数据所需的时间 一个整体和一个处理流。 因此，可以减少完整性验证所需的时间，从而允许将安全功能扩展到可以以相对有限的资源（例如，移动和/或嵌入式设备）运行的设备，以及提高设备的总体效率 是或将使用安全功能（例如可信计算（TC）设备）。

公开(公告)号：US20090323962A1

公开(公告)日：2009-12-31

申请号：US12165201

申请日：2008-06-30

申请人： Onur ACIICMEZ ,  Xinwen Zhang ,  Jean-Pierre Seifert

发明人： Onur ACIICMEZ ,  Xinwen Zhang ,  Jean-Pierre Seifert

IPC分类号： H04L9/06

CPC分类号： H04L63/06 ,  H04L12/1859 ,  H04L2463/062

摘要： In one embodiment, a method for establishing a secure multicast channel between a service provider and a terminal is provided. A request is received from the service provider for a configuration of the terminal. A configuration of the terminal at a first time is sent to the service provider. A security key is obtained, wherein the security is bound to the configuration of the terminal at the first time. Then the security key is decrypted using a configuration of the terminal at a second time, wherein the decryption fails if the configuration of the terminal at the second time is not identical to the configuration of the terminal at the first time. A secure multicast channel is then established with the service provider using the security key.

摘要翻译： 在一个实施例中，提供了一种用于在服务提供商和终端之间建立安全组播信道的方法。 从服务提供商接收到终端配置的请求。 首先将终端的配置发送给服务提供商。 获得安全密钥，其中安全性在第一时间被绑定到终端的配置。 然后使用终端的配置在第二时间对安全密钥进行解密，其中如果第二次终端的配置与终端的配置不同，则解密失败。 然后使用安全密钥与服务提供商建立安全的多播信道。

公开(公告)号：US20090028323A1

公开(公告)日：2009-01-29

申请号：US11828849

申请日：2007-07-26

申请人： Onur ACIICMEZ ,  Jean-Pierre SEIFERT ,  Qingwei MA ,  Xinwen ZHANG

发明人： Onur ACIICMEZ ,  Jean-Pierre SEIFERT ,  Qingwei MA ,  Xinwen ZHANG

IPC分类号： H04L9/28

CPC分类号： H04L9/302

摘要： In one embodiment, cryptographic transformation of a message is performed by first performing a table initiation phase to populate a data structure. Then, a first random number multiplied by a public key is added to each value in the data structure, in modulo of a second random number multiplied by the public key. Then an exponentiation phase is performed, wherein each modular multiplication and square operation in the exponentiation phase is performed in modulo of the second random number multiplied by the public key, producing a result. Then the result of the exponentiation phase is reduced in modulo of the public key. The introduction of the random numbers aids in the prevention of potential security breaches from the deduction of operands in the table initiation phase by malicious individuals.

摘要翻译： 在一个实施例中，通过首先执行表起始阶段来填充数据结构来执行消息的密码学变换。 然后，乘以公开密钥的第一随机数被加到数据结构中的每个值上，以第二随机数乘以公钥的模数。 然后执行取幂阶段，其中乘幂相位中的每个模乘和平方运算以第二随机数乘以公钥进行模拟，产生结果。 然后，乘法相位的结果以公钥的模数减少。 随机数的引入有助于防止潜在的安全漏洞在恶意个人的桌面启动阶段扣除操作数。

公开(公告)号：US20120265884A1

公开(公告)日：2012-10-18

申请号：US13492772

申请日：2012-06-08

申请人： Xinwen ZHANG ,  Onur ACIICMEZ ,  Simon J. GIBBS ,  Anugeetha KUNJITHAPATHAM ,  Sangoh JEONG ,  Doreen CHENG

发明人： Xinwen ZHANG ,  Onur ACIICMEZ ,  Simon J. GIBBS ,  Anugeetha KUNJITHAPATHAM ,  Sangoh JEONG ,  Doreen CHENG

IPC分类号： G06F15/16

CPC分类号： H04L29/08144 ,  G06F9/5044 ,  G06F9/5094 ,  H04L29/08306 ,  H04N21/23103 ,  Y02D10/22

摘要： Techniques for assessing the cost of allocation of execution and affecting the allocation of execution are disclosed. The cost of allocation of execution between a first computing device (e.g., mobile device) and one or more computing resource providers (e.g., Clouds) can be determined during runtime of the code. A computing system can operate independently of the first computing device and a computing resource provider and provide execution allocation cost assessment. Execution allocation cost can be assessed based on execution allocation data pertaining to the first computing device and computing resource providers. Power consumption of a mobile device can be used as a factor in determining how to allocate individual components of an application program between a mobile phone and a Cloud. In an Elastic computing environment, external computing resources can be used to extend the computing capabilities beyond that which can be provided by internal computing resources.

摘要翻译： 披露了评估分配成本和影响执行分配的技术。 可以在代码的运行时间期间确定第一计算设备（例如，移动设备）与一个或多个计算资源提供者（例如，云）之间的执行分配成本。 计算系统可以独立于第一计算设备和计算资源提供者操作并提供执行分配成本评估。 可以基于与第一计算设备和计算资源提供者有关的执行分配数据来评估执行分配成本。 可以将移动设备的功耗用作确定如何在移动电话和云之间分配应用程序的各个组件的因素。 在弹性计算环境中，外部计算资源可用于将计算能力扩展到内部计算资源所能提供的计算能力之外。

公开(公告)号：US20130139244A1

公开(公告)日：2013-05-30

申请号：US13306697

申请日：2011-11-29

申请人： Andrew C. BLAICH ,  Onur ACIICMEZ

发明人： Andrew C. BLAICH ,  Onur ACIICMEZ

IPC分类号： G06F21/00

CPC分类号： H04L63/0236 ,  G06F21/629 ,  G06F2221/2101 ,  G06F2221/2141 ,  H04L63/10

摘要： A Mandatory Access Control (MAC) aware firewall includes an extended rule set for MAC attributes, such as a security label or path. Application labels may be used to identify processes and perform firewall rule-checking. The firewall rule set may including conventional firewall rules, such as address checking, in addition to an extension for MAC attributes.

摘要翻译： 强制访问控制（MAC）感知防火墙包括用于MAC属性的扩展规则集，例如安全标签或路径。 应用标签可用于识别进程并执行防火墙规则检查。 除了用于MAC属性的扩展之外，防火墙规则集可以包括常规防火墙规则，例如地址检查。

公开(公告)号：US20130212380A1

公开(公告)日：2013-08-15

申请号：US13371195

申请日：2012-02-10

申请人： Tasneem BRUTCH ,  Onur ACIICMEZ

发明人： Tasneem BRUTCH ,  Onur ACIICMEZ

IPC分类号： H04L9/32

CPC分类号： H04L63/0823 ,  G06F8/65 ,  H04L9/083 ,  H04L9/321 ,  H04L9/3247 ,  H04L9/3263 ,  H04L29/06775 ,  H04L29/06816

摘要： A method for securely altering a platform component is provided, comprising: assigning certificates for public encryption and signature verification keys for the device; assigning certificates for public encryption and signature verification keys for an upgrade server; mutually authenticating a device containing the platform component and the upgrade server; causing the device and the upgrade server to exchange a session key; and providing an alteration to be made to the platform component from the upgrade server to the device using the session key.

摘要翻译： 提供一种用于安全地改变平台组件的方法，包括：为所述设备分配用于公共加密的证书和签名验证密钥; 为升级服务器分配公共加密证书和签名验证密钥; 相互验证包含平台组件和升级服务器的设备; 使设备和升级服务器交换会话密钥; 并且使用会话密钥向平台组件提供从升级服务器到设备的改变。

公开(公告)号：US20130097654A1

公开(公告)日：2013-04-18

申请号：US13274061

申请日：2011-10-14

申请人： Onur ACIICMEZ ,  Andrew C. BLAICH

发明人： Onur ACIICMEZ ,  Andrew C. BLAICH

IPC分类号： G06F21/00

CPC分类号： G06F21/00 ,  G06F21/10 ,  G06F21/62

摘要： The security of web widgets is improved by transferring a set of access control decisions conventionally handled by the Web Runtime system (WRT) to a more secure portion of the computing system, such as a kernel in the operating system. Access control rules are extracted and provided to the more secure portion. This may be performed during widget installation or at invocation of a widget. During runtime, the more secure portion performs security checking functions for the widget instead of the WRT.

摘要翻译： 通过将通常由Web运行时系统（WRT）处理的一组访问控制决定转移到诸如操作系统中的内核的计算系统的更安全的部分来改进web小部件的安全性。 访问控制规则被提取并提供给更安全的部分。 这可以在小部件安装期间或在调用小部件时执行。 在运行时，更安全的部分执行小部件而不是WRT的安全检查功能。