Abstract: A system and a method for security authentication, in which a biometric authentication subsystem in the security authentication system receives a biometric certificate held by the user and the user's biometric information from a user terminal; the biometric certificate contains the user's biometric template or the storage address of the biometric template; next, the biometric authentication subsystem authenticates the biometric certificate, performs matching between the biometric information and the biometric template, and generates the identity authentication result. The invention can also combine biometric authentication with PMI privilege authentication, so as to enhance security of identity authentication in PMI and widen applicability of biometric authentication.

Abstract: A detecting method is provided, which includes extracting an Internet Protocol Identifier value from an obtained data packet. The detecting method may further include searching in a record table containing a correspondence relationship between an Internet Protocol Identifier value and a terminal serial number to determine whether the record table contains an adjacent Internet Protocol Identifier value smaller than the extracted Internet Protocol Identifier value and modifying the adjacent Internet Protocol Identifier value that is smaller than the extracted Internet Protocol Identifier value to be the extracted Internet Protocol Identifier value if the record table contains the adjacent Internet Protocol Identifier value smaller than the extracted Internet Protocol Identifier value. Otherwise, the detecting method may also include, adding a new record of the extracted Internet Protocol Identifier value and the corresponding terminal serial number into the record table.

Abstract: A method for preventing Spam over Internet Telephony (SPIT), includes: a terminal receives a call request of a calling user; the terminal sets an identifier of the calling user into a SPIT reporting request upon receipt of the call request; and sends the SPIT reporting request to a server in response to an instruction of a called user that the call request is the SPIT.

Abstract: A system and method for generating analog-digital mixed chaotic signal and an encryption communication method thereof are provided. In the system and method, the complementarity between continuous chaotic systems (12, 22) and digital chaotic systems (11, 21) are reasonably utilized. In specific, the digital chaotic systems, which are separated from each other, control the local continuous chaotic systems respectively, so as to enable the continuous chaotic systems, which are also separated from each other, to stably and synchronously work for a long time. Thus, there is no need to transmit the synchronizing signal, and as a result the anti-attack capability is increased effectively. Further, the continuous chaotic systems disturb the local digital chaotic systems to prevent the digital chaotic systems from degradation. This compensates the drawbacks of digital chaotic systems.

Abstract: A correlative reacting system and a method for implementing security update of mobile station. The correlative reacting system includes a security correlative agent at a terminal side and a security correlative server at a network side communicated with the security correlative agent via an air interface. In the present invention, the correlative reacting system performs an information interaction with the mobile station, controls the mobile station to carry out an automatic security update. The automatic security update includes automatic downloading and installation, update of the security correlative agent, and automatic recovery of the insecurity factors of the mobile station and the like.

Abstract: The present invention provides a method, a device and a system for controlling VoIP border security. The system includes: a border security controller, which includes two dynamic information tables, an active session information table and a registered user information table, acting as the basis of security control; and a security policy server, in communication with the border security controller, adapted to provide a security policy to the border security controller and check the security of a signaling packet forwarded by the border security controller. The border security control system first checks the security and processes the packets of a user datagram received according to the active session information table and the registered user information table, and allows a packet which passed the security processing to pass, and then performs protocol processing on the media packet and signaling packet which are allowed to pass.

Abstract: The present invention discloses a method and system for remote password based authentication using smart cards for accessing a communications network. The disclosed method does not require a remote authentication sever to maintain a table of passwords for all users. The disclosed method and system also support mutual authentication. It not only prevents the illegal use of system resources by an impersonator, the user can also authenticate the identity of the remote authentication server.

Abstract: A method, device for identifying service flows and a method, system for protecting against a denial of service attack are provided. The method for identifying service flows includes: detecting a user access to a target system; dynamically generating a set of user identifier information according to the detected user access to the target system and a preset user access statistical model; when the service flow needs to be identified, extracting the user identifier information from the service flow; comparing the extracted user identifier information with the user identifier information in the set of user identifier information to determine whether they are matched; determining whether the service flow is legal service flow according to the comparison result.

Abstract: A detecting method is provided, which includes extracting an Internet Protocol Identifier value from an obtained data packet. The detecting method may further include searching in a record table containing a correspondence relationship between an Internet Protocol Identifier value and a terminal serial number to determine whether the record table contains an adjacent Internet Protocol Identifier value smaller than the extracted Internet Protocol Identifier value and modifying the adjacent Internet Protocol Identifier value that is smaller than the extracted Internet Protocol Identifier value to be the extracted Internet Protocol Identifier value if the record table contains the adjacent Internet Protocol Identifier value smaller than the extracted Internet Protocol Identifier value. Otherwise, the detecting method may also include, adding a new record of the extracted Internet Protocol Identifier value and the corresponding terminal serial number into the record table.

Abstract: A system and method for generating analog-digital mixed chaotic signal and an encryption communication method thereof are provided. In the system and method, the complementarity between continuous chaotic systems (12, 22) and digital chaotic systems (11, 21) are reasonably utilized. In specific, the digital chaotic systems, which are separated from each other, control the local continuous chaotic systems respectively, so as to enable the continuous chaotic systems, which are also separated from each other, to stably and synchronously work for a long time. Thus, there is no need to transmit the synchronizing signal, and as a result the anti-attack capability is increased effectively. Further, the continuous chaotic systems disturb the local digital chaotic systems to prevent the digital chaotic systems from degradation. This compensates the drawbacks of digital chaotic systems.

Abstract: A message forwarding method includes: receiving a SIP registration request message carrying a contact address; obtaining the contact address carried in the SIP registration request message; and determining that the contact address is one of SIP proxy server addresses in a network stored in advance; and executing an abnormal process on the SIP registration request message. The present invention also discloses a network device. The message forwarding method and network device in the present invention can prevent a SIP loop attack.

Abstract: The present invention discloses a method, device and system for determining a mail class. The method for determining a mail class includes: reading a mail head of a mail with an unknown class; extracting a first field in compliance with a first preset condition from the mail head; vectorizing combinations of the first field and its presentation forms into a first preset number of first feature vectors; taking the first feature vectors as input to a preset predictive algorithm for calculation with use of data stored for a pre-established behavior model to derive a calculation result; and determining the mail class of the mail with an unknown class from the calculation result.

Abstract: A method for implementing security communication. A bit for representing CI is added, and a judge process for the CI and encryption algorithm supported by both the current subscriber and network is added. If the CN supports more than one encryption algorithm, if the CI is 1 and a standard encryption algorithm is supported by both UE and CN, the standard encryption algorithm is determined as the encryption algorithm for security communication: otherwise, the communication is disconnected; if the CI is 0 and a self-developed non-standard encryption algorithm is supported by both UE and CN, the encryption algorithm is determined as the encryption algorithm for security communication; otherwise, the communication is disconnected. If the CN only supports the standard encryption algorithm, if this algorithm is also supported by UE, this standard encryption algorithm is determined as the encryption algorithm for security communication directly; otherwise, the communication is disconnected.

Abstract: Some embodiments of the present invention provide a system and method for preventing viruses from intruding into a network. The system for preventing viruses from intruding into a network includes: a detection unit for performing virus detection to traffic passing through the network, and a control unit arranged between terminals and the network. The control unit is adapted to control access of the terminals to the network, and decide whether to allow the terminals to access the network according to detection result from the detection unit. According to the invention, all the traffic of a terminal infected by a virus is limited, and the connection between the terminal and the network is interrupted, thereby preventing the virus from diffusing and propagating widely over the network, and improving operation security of the network.

Abstract: The present invention provides a method, a device and a system for controlling VoIP border security. The system includes: a border security controller, which includes two dynamic information tables, an active session information table and a registered user information table, acting as the basis of security control; and a security policy server, in communication with the border security controller, adapted to provide a security policy to the border security controller and check the security of a signaling packet forwarded by the border security controller. The border security control system first checks the security and processes the packets of a user datagram received according to the active session information table and the registered user information table, and allows a packet which passed the security processing to pass, and then performs protocol processing on the media packet and signaling packet which are allowed to pass.

Abstract: The present invention discloses a method for determining encryption algorithm used in security communication based on Mobile Country Code (MCC) number. In this method, a Mobile Country Code (MCC) number list is preset in a Core Network (CN), and all the MCC numbers of those countries or service providers adopting the same self-developed encryption algorithms as those adopted by the homeland are stored in this MCC number list. When a User Equipment (UE) is calling or being called, the UE sends an International Mobile Subscriber Identifier (IMSI) information of the current subscriber to the CN, and the CN parses the information and extracts the MCC number after receiving the IMSI information.

Abstract: This invention discloses a method for preventing Spam over Internet Telephony, comprising: receiving by a terminal a call request by a calling user; setting by the terminal an identifier of said calling user into a SPIT reporting request upon receipt of said call request; and sending the SPIT reporting request to a server in response to an instruction by a called user that the call request is SPIT.

Abstract: The present invention discloses a method and system for remote password based authentication using smart cards for accessing a communications network. The disclosed method does not require a remote authentication sever to maintain a table of passwords for all users. The disclosed method and system also support mutual authentication. It not only prevents the illegal use of system resources by an impersonator, the user can also authenticate the identity of the remote authentication server.