68 results about "Authenticated encryption" patented technology

The invention discloses an intelligent charging management system of a new energy automobile, and relates to the technical field of charging control of the new energy automobile, and the system comprises a user identification and authentication module which supports three authentication modes, account association related information and authentication encryption transmission; the charging demand prediction module collects multiple types of data, and predicts charging related parameters through a fusion algorithm; the charging pile and battery state monitoring module collects various operation data in real time; the power grid load sensing module collects power grid information and synchronizes peak and valley periods; the charging strategy optimization module dynamically adjusts a charging scheme in combination with multi-source data; the safety protection module has six protection functions and a fault diagnosis capability; the data storage module adopts a distributed database and an encryption technology; the man-machine interaction module supports multiple operation modes and displays key information; and the communication coordination module is responsible for multi-terminal data interaction and protocol conversion. According to the invention, intelligence and accuracy of charging management are improved, safety protection and data safety are enhanced, and multi-scene charging requirements are met.

The invention relates to the technical field of wireless communication, in particular to a public network interphone with a quantum chip. According to the interphone, a master control module and a quantum security chip work cooperatively, a quantum random number generator is used for dynamically deriving a session key, and offline security distribution of a group master key is realized by encrypting a two-dimensional code; in a communication process, a system adaptively switches a voice coding mode according to a network condition, end-to-end authentication encryption is carried out on voice data by using a hardware encryption engine, and low-delay transmission is guaranteed through a network priority mark; the device establishes a complete key life cycle management mechanism, supports regular update and forward security of session keys and instant update and backward security of a group master key when members change, and ensures that all key operations are completed in a quantum chip. According to the invention, various eavesdropping and tampering attacks are effectively resisted, and safe, real-time and clear high-confidentiality voice communication in a public network environment is realized.

The invention discloses a zero-trust gateway single packet authentication method and system for a new energy fan control system, computing equipment, a computer storage medium, a computer program product and a chip. The authentication method comprises the steps of generating an authentication material; exchanging and deriving a mixed key; binding Hash calculation is carried out; encrypting and assembling the message; receiving and verifying by the gateway; and binding verification and registration are carried out. The invention relates to a zero-trust gateway single packet authentication method combining a post quantum cryptography algorithm and a national commercial cryptography algorithm. The method is applied to secure communication between a wind power plant and a centralized control center, an SM2, SM3 and SM4 combined algorithm in a national secret system is combined with a post-quantum key agreement algorithm CRYSTALS-Kyber512, identity authentication, encryption and integrity verification are completed through a single message, confidentiality protection and anti-quantum security guarantee under one-time interaction are achieved, and the security of the wind power plant is improved. The method is especially suitable for new energy scenes with wide fan distribution, complex links and high real-time requirements.

Disclosed are techniques for wireless communication. In an aspect, a method performed by a receiving entity includes: receiving, from a transmitting entity, a first physical layer identity matrix (PHY ID) for the transmitting entity; receiving, from the transmitting entity, an encrypted ranging message; calculating a second PHY ID for the transmitting entity based on the encrypted ranging message; and authenticating the encrypted ranging message based on a comparison of the first PHY ID and the second PHY ID. Upon determining that the encrypted ranging message is authentic, the encrypted ranging message is decrypted to produce a decrypted ranging message and processing the decrypted ranging message. In some aspects, upon determining that the encrypted ranging message is not authentic, the encrypted ranging message is not processed (e.g., ignored or discarded). In some aspects, the receiving entity rejects further signal transmission and ranging procedures with the device thereby preventing successful attack.

The invention relates to a time-sensitive network end-to-end secure communication method, and belongs to the technical field of communication. According to the method, a TSN terminal system of Linux is used for realizing bidirectional identity authentication and key agreement based on an SM2 cryptographic algorithm, and an SM4-CCM algorithm is used for realizing time-sensitive network security communication and data integrity verification; the SM2 national secret algorithm is an asymmetric encryption algorithm, a signature pair is generated based on an elliptic curve discrete logarithm problem, the two parties negotiate a shared key through elliptic curve point operation, a public key of a receiver is used for encryption, and only a private key can be used for decryption; sM4-CCM is a combination of an SM4 block cipher algorithm and a CCM mode, and is used for providing confidentiality, integrity and authenticity of data; according to the CCM mode, through combination of CTR encryption and CBC-MAC authentication, efficient authentication encryption is realized. The method can be used for real-time secure communication in a high-reliability industrial scene.

The invention discloses an agent interaction system and method supporting multi-user anonymous identity agency, and the system comprises a user side which is used for generating a one-time decentralized identity identifier and a secret key, generating a zero-knowledge proof based on a local certificate, and submitting the identifier, the proof and metadata to an agent side; the intelligent agent end is used for managing multi-user session data, establishing a decentralized identity-based bidirectional authentication encryption channel with the platform end, forwarding zero-knowledge proof and metadata, signing and encrypting a result returned by the platform end, and returning the result to the user end; and the platform end is used for verifying the identity of the agent end, receiving the zero-knowledge proof and the metadata, completing proof verification based on the on-chain verification parameters, and executing the anonymous request of the user after the proof verification is passed. According to the method, the real identity of the user and the platform service are effectively isolated by introducing the intelligent agent, the privacy security of the user and the data is practically protected, and the method is suitable for scenes needing strong privacy protection and multi-user cooperation, such as online transaction, shared economy, family and enterprise agency and the like.

The present disclosure relates to an authenticated encryption method, apparatus, system, and computer program for providing enhanced security and extension of a nonce length, and more specifically, the present disclosure discloses a method for performing authenticated encryption using a computing apparatus, the method including: producing a plurality of intermediate values, based on a given input value; generating a random number, based on a combination of a plurality of intermediate random values produced by performing block cipher-based encoding on the plurality of intermediate values; and performing encryption or decryption, based on the random number.

Encryption system with an application-specific integrated circuit (ASIC) which has a permanent memory for the non-volatile storage of the operating system (OS) of a processor and software modules for encrypting the data memory of the processor and which has a hardware-implemented encryption algorithm, characterized in that a security module (SM) is integrated in the ASIC for autonomous booting of the operating system (OS), consisting of: - a symmetric cryptosystem (SK) for processing symmetric keys, - an asymmetric cryptosystem (AK) for the use of public and private keys, - a module for generating cryptographic hash functions (KH), - a module for the secure exchange of keys using hardware-implemented key exchange protocols (SP), - a key storage (SS) for the secure storage of root keys (WS), which are protected by appropriate measures in the physical structures of the ASIC and - a key management system (SMS) for the secure introduction of authenticated-encrypted key packets, and that the security module (SM) communicates with a central processing unit (CPU) via a communication interface (CS1), and that the central processing unit (CPU) communicates with at least one internal storage (IS) and one external storage (ES), as well as with at least one internal persistent storage (IP) and one external persistent storage (EP), such that the operating system (OS) is loaded by a second-stage bootloader (SSB) stored in the external persistent storage (EP), and then the operating system (OS) loads the applications, the second-stage bootloader (SSB) itself being decrypted and loaded by a first-stage bootloader (FSB) stored in the internal persistent storage (IP), and a public key (PUBOS) to verify the operating system (OS).and a symmetric key (KOS) to decrypt the operating system (OS), and that the contents of the internal memory (IS) and the external memory (ES) are decrypted by the security module (SM) during read accesses by the central management unit (CMU) or other modules integrated on the ASIC, and re-encrypted during write accesses by the same.

A system and method are disclosed for securely transferring or storing protected working memory outside an owner thread while maintaining full encryption throughout its lifecycle. The protected working memory has an encrypted data component and a keystream component containing dynamically updated encryption information used for per-cycle decryption and re-encryption. A hardened cryptographic subsystem, such as a Trusted Execution Environment (TEE), Secure Element (SE), TPM, or HSM, performs authenticated encryption using device-bound key material to wrap either (i) the keystream component alone or (ii) the entire protected working memory blob. The wrapped object is suitable for storage or transfer across threads or in external memory, without exposing plaintext or keystream material. When restoring, an authorized owner thread supplies a key handle to the hardened subsystem to securely decrypt and reconstruct the protected working memory only within a guarded heap. At no point are plaintext contents or keystreams available to the operating system or user-accessible memory.

The invention discloses a safe remote control and cut-off method for an electric energy meter, and aims to solve the problems that an instruction is counterfeited or replayed and executed out of order in a remote cut-off / switch-on closed loop in a weak network (NB-IoT / PLC) environment, and ACK can be counterfeited by a concentrator. The method comprises the following steps: generating a work order identifier by a work order serial number, an operation type and a previous closed loop label through a verifiable random function; performing authentication encryption on the instruction and the feedback by using the session key; deriving a one-time fragment key of each work order for metering and executing the two microcontrollers based on the chained context, and aggregating a threshold signature; the command label, the action proof, the time window and the double count are hashed into a binding message; fountain code coding is adopted for feedback, and end-to-end credible closed-loop control which is unforgeable in ACK, strong in binding of instructions and physical actions, resistant to replay and disorder, reliable in delivery under a weak network and capable of being audited is achieved.

The invention discloses a distributed storage data protection method for cryptographic algorithm dynamic reconstruction, which relates to the technical field of data encryption, and comprises the following steps of: determining an algorithm capability set and an alternating window before data writing, calculating path hash and generating an algorithm reconstruction vector, deriving a session key from a root key and signing and issuing a key algorithm capsule, forming write context data; the method comprises the following steps of: performing deterministic fragmentation on data by using a write-in context, generating an abstract from the tail part of a fragment, performing hash synthesis on the abstract and a path to obtain an initialization vector, encrypting a head part by using a path-sensitive authentication encryption algorithm, protecting the rest part by using a pseudo-random mask, and generating a fragment ciphertext list and an original index table; according to the method, after deterministic fragmentation, an initialization vector is synthesized through a tail abstract and path hash, path-sensitive authentication encryption and body segment pseudo-random mask are executed, and fragmentation-level anti-replay and high-throughput data encryption is achieved.

This application provides an optical network communication method and a communication device. The method is applied to an optical fiber network, which includes a master device and at least one slave device, wherein the at least one slave device includes a first slave device. During the initialization phase, after receiving the authentication and encryption capabilities of the slave device, the master device can indicate a specific authentication and encryption mode (e.g., a first authentication and encryption mode) to the slave device. This eliminates the need for the master device to configure security-related parameters such as the authentication and encryption mode for the slave device in subsequent processes (e.g., roaming parameter configuration processes), thereby improving configuration efficiency and saving configuration overhead.

Training an artificial intelligence model to categorize data by sensitivity and for applying the model to selectively protect sensitive portions of multimodal datasets. Sensitive training data can be obfuscated with synthetic noise or randomized errors to preserve confidentiality while enabling the model to learn patterns correlated with sensitivity. The trained model is validated on labeled data and can be refined as classification standards evolve. In operation, the classifier assigns sensitivity levels to data elements and directs tiered protection. Elements assigned to a higher relative sensitivity classification level are protected using post-quantum key establishment, for example a key encapsulation mechanism, combined with symmetric authenticated encryption of payloads, and associated metadata is authenticated using a post-quantum digital signature scheme. Less sensitive elements can be protected using conventional symmetric encryption for efficiency. This approach automates sensitivity classification, optimizes cryptographic resource allocation, and improves confidentiality and integrity for simulation and mission data.

The invention provides an authentication encryption method and device and a verification decryption method and device, and a specific implementation mode of the authentication encryption method comprises the following steps: segmenting plaintext data to be encrypted to obtain a plurality of plaintext blocks with index values; generating initial state information based on the associated data of the plaintext data and a message authentication code algorithm; generating first intermediate state information by using a compression function of a preset Hash algorithm; based on the compression function, performing encryption operation on the plurality of plaintext blocks, the encryption operation comprising: based on the current intermediate state information and the current plaintext block, generating a current ciphertext block; processing the secret key, the current plaintext block, the current intermediate state information and the index value and the mark value of the current plaintext block by using a compression function to obtain next intermediate state information; and generating ciphertext data based on the plurality of ciphertext blocks, and determining the next intermediate state information generated based on the last plaintext block as the authentication tag.

An initial processing unit (21) generates a secret value (B) on the basis of a secret key in authentication encryption. The function F processing unit (22) repeats a process for updating the secret value (B) by block encryption using the secret value (B) generated by the initial processing unit (21) as an input block for block encryption. The ciphertext processing unit (23) uses the secret value (B) updated by the function F processing unit (22) to execute at least one of an encryption process for encrypting the plaintext (M) and a decryption process for decrypting the ciphertext (C).

The invention discloses a robot remote operation and maintenance method and system, a robot and a readable storage medium, and relates to the technical field of robots. The method comprises the steps that a current remote operation and maintenance request of a robot is acquired from an operation and maintenance terminal through an operation and maintenance platform, and the current remote operation and maintenance request and the current state of the robot are verified; after the verification is passed, generating a session identifier corresponding to the current remote operation and maintenance request through the operation and maintenance platform, and establishing an operation and maintenance session based on the session identifier; based on the operation and maintenance session, performing bidirectional identity authentication between the operation and maintenance platform and the robot, and after the bidirectional identity authentication is passed, establishing a communication channel between the operation and maintenance platform and the robot according to a session identifier; and executing the current remote operation and maintenance request through the robot based on the communication channel. Thus, the current remote operation and maintenance request and the current state of the robot are verified, an independent bidirectional authentication encryption communication operation and maintenance session is dynamically established for each remote operation and maintenance task, and safe remote operation and maintenance are achieved.

The application provides an optical network communication method and a communication device. The method is applied to an optical fiber network, and the optical fiber network comprises a master device and at least one slave device, and the at least one slave device comprises a first slave device. In an initialization stage, after receiving an authentication encryption capability of the slave device, the master device can indicate a determined authentication encryption mode (for example, a first authentication encryption mode) to the slave device, so that in a subsequent process (for example, in a roaming parameter configuration process), the master device does not need to configure the authentication encryption mode and other security-related parameters for the slave device, thereby improving the configuration efficiency and saving the configuration overhead.

The invention provides a credible security cloud detection method and system based on digital signature technology fused with Internet of Things, and belongs to the technical field of product security detection. The trusted security cloud detection method comprises the steps that a detection authentication mechanism generates a detection task corresponding to a to-be-detected product through an authentication system terminal after obtaining product information, and a cooperative laboratory terminal of the detection authentication mechanism pushes the detection task to an enterprise laboratory terminal corresponding to a manufacturer according to manufacturer information; the cooperative laboratory terminal remotely controls the enterprise laboratory terminal to carry out product detection; checking the product detection data, generating a test report after the checking is passed, and performing electronic sealing and certificate signing on the test report through the new energy cloud authentication detection platform; non-tampering log record information is generated for the detection process, and a complete audit tracing chain is formed; and all data communication between the new energy cloud authentication detection platform and the enterprise laboratory terminal adopts a bidirectional authentication encryption strategy for data transmission.

The application provides a flow-based combinable cryptography command line implementation method and system, and relates to the technical field of cryptography command line tools. By abstracting symmetric encryption and decryption, authentication encryption and other cryptographic operations into unified flow contract stream processing operators, which are freely combined in series through Unix pipes; by uniformly packaging single / multiple packet cryptographic operations as a stream interface and automatically managing the life cycle of multiple packet sessions; by asynchronously processing input streams in blocks, built-in format transparent conversion, and multiple TCP connection concurrency for efficiency improvement, a remote non-native composite cryptographic process can be implemented in combination, the dependence on temporary files is eliminated, the delay is reduced, the memory occupation is constant, and the advantages of low delay, low memory and seamless combination are achieved.

Disclosed herein are systems and methods for authenticated-encryption and authenticated-decryption operations for conducting authenticated-encryption communications between a host device and a peripheral device. A sending device performs authenticated-encryption operations that apply a symmetric encryption algorithm on plaintext to encrypt the data and generate an authentication tag or message authentication code (“MAC”). The sending device sends the ciphertext and a shared subset of the tag to the receiving device, and stores a non-shared subset of the tag in cache. The receiving device performs authenticated-decryption operations that verify the tag and decrypt the ciphertext to recover the data by applying the effective inverse of the symmetric encryption algorithm (or decryption algorithm) and using the known parameters.

This application provides an optical network communication method and a communication device. The method is applied to an optical fiber network, which includes a master device and at least one slave device, wherein the at least one slave device includes a first slave device. During the initialization phase, after receiving the authentication and encryption capabilities of the slave device, the master device can indicate a specific authentication and encryption mode (e.g., a first authentication and encryption mode) to the slave device. This eliminates the need for the master device to configure security-related parameters such as the authentication and encryption mode for the slave device in subsequent processes (e.g., roaming parameter configuration processes), thereby improving configuration efficiency and saving configuration overhead.

An example procedure includes: selecting an access point to connect to; obtaining a public key of the access point; generating a temporary key for pre-authentication encryption; encrypting the temporary key with the access point's public key; sending an authentication request to the access point to initiate an authentication process with the access point, the authentication request containing the encrypted temporary key; completing the authentication process to begin authenticated communications with the access point; and discarding the temporary key.

The invention discloses a single-encryption multi-level differential privacy output method based on attribute driving, and the method comprises three entities: an attribute management mechanism, a data owner and a data visitor, and comprises the following steps: the attribute management mechanism inputs data information to a computer system, and executes system initialization based on security parameters; generating a system master key, a public parameter and directory metadata, and signing and publishing the system master key, the public parameter and the directory metadata; the data owner obtains directory metadata and the signature result for verification, and output results of a plurality of privacy levels are generated through incremental noise accumulation; an encrypted data packet is formed by combining attribute encryption and authentication encryption mechanisms; the data accessor obtains the encrypted data packet and the directory metadata, consistency verification is carried out, decryption operation is carried out according to the hierarchy from high to low after verification, and a highest available hierarchy result is output. According to the method, the privacy protection capability is improved while the data availability is ensured, and the method is suitable for a multi-level permission data sharing scene.

The application discloses a dynamic key negotiation and encryption method and system for a power wireless private network, and relates to the technical field of power communication security. The method comprises the following steps: a terminal device collects first channel characteristic parameters, generates a first random number, generates a device fingerprint through a physically unclonable function, generates a temporary key pair by taking the first random number and the device fingerprint as an entropy source, and sends a negotiation request; a base station collects second channel characteristic parameters for consistency comparison, generates a shared key raw material after matching, generates a session key through a hash operation by combining channel parameters, a base station identifier and the device fingerprint, and returns a response; and the terminal generates the same session key to complete negotiation. The terminal generates a chaotic sequence by taking the session key as a seed and combining the device fingerprint, and encrypts power service data by using an authentication encryption algorithm. The physically unclonable function is used to replace a software pseudo-random number generator, so that the problems of insufficient entropy source and easy prediction of a key of a resource-restricted power terminal are solved.

This invention discloses a single-pass encryption multi-level differential privacy output method based on attribute-driven principles. The method comprises three entities: an attribute management organization, a data owner, and a data accessor. The steps include: the attribute management organization inputs data information into a computer system and performs system initialization based on the security parameters, generating a system master key, public parameters, and directory metadata, which are then signed and published; the data owner obtains the directory metadata and the signature result for verification, generating multiple privacy-level output results through incremental noise accumulation; and combines attribute encryption and authentication encryption mechanisms to form an encrypted data packet; the data accessor obtains the encrypted data packet and directory metadata, performs consistency verification, and upon successful verification, performs decryption operations from highest to lowest privacy level, outputting the highest-level result. This invention improves privacy protection capabilities while ensuring data availability and is suitable for multi-level access control data sharing scenarios.

A wireless peripheral device operatively coupled to a wireless dongle of an information handling system includes a microcontroller to receive a polling packet from the operatively coupled wireless dongle, via a wireless peripheral device radio, identifying a selected number of encrypted data packets for a data packet frame. The microcontroller executes code instructions of a wireless input / output protocol authenticated encryption agent with bi-lateral linear-feedback shift register (LFSR) input stream to generate an initial key or a later dynamic key. With the initial key or dynamic key, the encryption system uses a shifting state machine output from each of a first and second LFSR in an encryption algorithm to generate a data packet encryption output value. The data packet is encrypted via an XOR operator with the data packet encryption output value, and each generated data packet encryption output value is subsequently the dynamic key for encryption of subsequent data packets.

The invention relates to a dynamic hierarchical encryption method for document sensitive fragments based on content semantic features. The method comprises the following steps: carrying out structured fragmentation modeling on to-be-protected document data to obtain sensitive fragment data and structure context data; performing multi-modal semantic representation construction on the sensitive fragment data and the structure context data to obtain content semantic representation data and irreversible semantic sketch ciphertext data; performing hierarchical state calculation on the content semantic representation data and the irreversible semantic sketch ciphertext data to obtain hierarchical state data; performing hierarchical binding double-layer envelope authentication encryption by combining the sensitive fragment data and the hierarchical state data to obtain fragment ciphertext data and key encapsulation ciphertext data; and carrying out encapsulation layer strategy rebinding updating on the fragment ciphertext data and the key encapsulation ciphertext data to obtain encrypted document data. By adopting the method, the security of the sensitive fragment of the document can be improved.

An object of a system according to an embodiment is to enhance safety and privacy protection of communication between a patient and a doctor in remote medical care.SOLUTION: A system includes a biometric authentication part, an encryption part, a document sharing part, a translation part, and an emergency notification part. The biometric authentication unit performs biometric authentication. The encryption unit encrypts communication data. The document sharing unit securely shares a document. The translation unit translates different languages in real time. The emergency reporting unit reports an emergency situation.SELECTED DRAWING: Figure 1

This invention discloses a lightweight authentication encryption algorithm differential fault attack method, relating to the fields of cryptography and information security technology; it initializes the AEGIS encryption algorithm and injects a random single-bit fault, with plaintext P as input. i The method involves encrypting the AEGIS encryption algorithm after initialization to generate correct and incorrect ciphertexts and obtaining their output difference. The output difference between the correct and incorrect ciphertexts is then XORed, and the location of the fault is determined using the XOR result. Byte state recovery is then performed based on the XOR result, and the word state recovery process is repeated. Finally, the inverse round function formula and encryption formula are applied to restore the complete internal state. This invention employs a lightweight authentication encryption algorithm differential fault attack method, which can efficiently extract key features from complex high-dimensional time-series data and accurately identify potential fault modes.