Hewlett Packard Enterprise Development LP

Chinese Academy of Sciences

New H3c Technologies Co., Ltd.

Hangzhou H3c Technologies Co., Ltd

Institute of Informational Engineering, Cac

Dan Meng

Yue Wang

Xiangqing Chang

Jinfeng Li

Gang Shi

Liwei Chen

Hongshu Shi

Yunfeng Zhao

Aimin Yu

Yibin Gong

Jiangang Ma

Kunpeng Zhao

Cairui She

The system provided in the present application includes a public key infrastructure builder, a container image identity builder, a signature list builder, a container image verifier, a signature list and user certificates loader, and a container program verifier. The method provided in the present application is capable of conveniently authorizing container images and software running in the container, and verifying the container images and programs in the container at the right time, so as to ensure that container images running on the container platform are trusted, and the software running in the container is also trusted, thereby improving the security of the container platform.

Container platform-oriented trusted software authorization and verification system and method

Embodiments of the present disclosure provide a method for control-flow integrity protection, including: changing preset bits of all legal target addresses of a current indirect branch instruction in a control flow of a program to be protected to be same; and rewriting preset bits of a current target address of the current indirect branch instruction to be same as the preset bits of the legal target addresses, so that the program to be protected terminates when the current target address is tampered with. By changing the preset bits of all the legal target addresses of the current indirect branch instruction to be same and rewriting the preset bits of the current target address to be consistent with the preset bits of the legal target addresses, traditional label comparison is replaced by the preset bit overlap operation, reducing performance overhead and improving attack defense efficiency.

Method for control-flow integrity protection, apparatus, device and storage medium

By splitting CGN functions based on a control plane and a forwarding plane, a CGN control plane function is put into a BRAS CP device, and a CGN forwarding plane function is retained on a CGN card on the BRAS DP device, and CGN configuration information is distributed by the BRAS CP device to the BRAS DP device.

Separating CGN forwarding and control

In an example, a network device may receive a L3VPN packet of which an egress label edge router (LER) is the network device, and acquire an adjacency index of an adjacency entry in an adjacency table according to the destination IP address of the inner IP datagram from the L3VPN packet. The network device may acquire a PW extended index of a PW extended entry in a PW extended table and a private network layer-2 header for the inner IP datagram from an adjacency entry having the adjacency index. By using the private network layer-2 header and a public network label, a private network label and a public network layer-2 header in a PW extended entry having the PW extended index, the network device may encapsulate the inner IP datagram into a L2VPN packet and forward the L2VPN packet through a physical egress interface in the PW extended entry.

Access layer-2 virtual private network from layer-3 virtual private network

When needing to forward a packet from a switch line card to a programmable line card, the switch line card may encapsulate a pseudo-Layerheader for the packet based on uplink forwarding process of the switch line card. The pseudo-Layerheader may carry an adjacency table index and an egress interface table index which is used by the programmable line card. Correspondingly, the programmable line card may obtain the adjacency table index and the egress interface table index from the pseudo-Layerheader of the packet, and then may re-encapsulate a real Layerheader for the packet based on downlink forwarding process of the programmable line card, and transmit the packet through a corresponding egress interface.

Interoperation of switch line card and programmable line card

A method accelerates access of a multi-core system to its critical resources, which includes preparing to delete a critical node in a critical resource, separating the critical node from the critical resource, and deleting the critical node if the conditions for deleting the critical node are satisfied. An apparatus includes a confirmation module for the node to be deleted and a deletion module to accelerate access of a multi-core system to its critical resources.

Deleting a shared resource node after reserving its identifier in delete pending queue until deletion condition is met to allow continued access for currently accessing processor

Growing community of inventors

Beijing, China

Dan Meng