341 results about "Certificate authority" patented technology

Techniques for updating certificate bundles may include receiving, at an entity associated with a virtual cloud network, a certificate bundle that includes an updated set of certificate authority (CA) certificates. The techniques may include applying a validation process to an entity certificate based on the certificate bundle, with the entity certificate having been issued to the entity prior to the entity receiving the certificate bundle. The validation process may include validating, by the entity, a certificate chain that includes the entity certificate and a CA certificate included in the updated set of CA certificates. The techniques may include, responsive to validating the certificate chain, installing the certificate bundle in a storage medium associated with the entity, and utilizing, by the entity, the certificate bundle to authenticate at least one additional entity associated with the virtual cloud network.

Techniques for provisioning a cloud resource instance associated with a virtual cloud network may include detecting a certificate bundle-retrieval trigger during a provisioning process for the cloud resource instance, and responsive to detecting the certificate bundle-retrieval trigger, sending, to an agent executing on a network interface linked to the cloud resource instance, a request for a certificate bundle for the cloud resource instance. Techniques may further include receiving the certificate bundle from the network interface. The certificate bundle may include a set of certificate authority (CA) certificates. Techniques may further include installing the certificate bundle in a storage medium associated with the cloud resource instance. Installing the certificate bundle may represent an operation of the provisioning process.

The invention relates to a QUIC protocol-based distributed node unified identity authentication method and system, belongs to the technical field of network security, is applied to a client, and comprises the following steps: registering a client domain name identity through a certificate authority, obtaining a client certificate, and pre-storing a server certificate chain; generating a QUIC initial data packet according to the target server domain name identifier and the client certificate, and sending the QUIC initial data packet to the server; receiving a QUIC handshake data packet returned by the server; verifying the legality of the server certificate based on the server certificate chain, and if the server certificate is legal, calculating a pre-master key according to the client DH private key and the server DH public key; deriving a 1-RTT session key based on the pre-master key; generating a signature verification message, and sending the client certificate and the signature verification message to a server; and synchronously using the 1-RTT session key to encrypt the application layer data with the server, and transmitting the data to the server in the 1-RTT encryption space of the QUIC protocol. According to the invention, the reliability of node identities and the confidentiality of data are ensured.

The invention relates to the field of network security, and discloses an identity authentication unloading method and system based on an intelligent network card. The method comprises the following steps: presetting a master key in an intelligent network card; presetting a master key in the intelligent network card; receiving client request data forwarded by the application layer and extracting a service identifier; generating a private key of the corresponding service through the service identifier and the master key; acquiring a local authentication message, signing the local authentication message by using the private key, generating a server signature value, and sending the server signature value to the client through the application layer to trigger a client authentication process; receiving client certificate data forwarded by the application layer and extracting a certificate signature value; and verifying the certificate signature value by using a preset certificate issuing mechanism public key and generating a verification result, and outputting feedback information based on the verification result. According to the method, a hardware-level unloading function in an identity authentication process is realized through the intelligent network card, and the problems of high calculation overhead and poor expansibility of traditional TLS bidirectional authentication are solved.

Operations of a digital signature manager may include detecting, in a certificate repository on a first virtual cloud network, set of one or more new certificate authority (CA) certificates; transmitting, to a key management service hosted on a second virtual cloud network, a CA dataset that includes the set of one or more new CA certificates; receiving, from the key management service, a digital signature of the CA dataset generated based at least on a global private key stored on the second virtual cloud network in a private key repository associated with the key management service; and storing the digital signature in the certificate repository in a data structure that associates the digital signature with the CA dataset.

An authority authentication system includes an electronic device configured to generate a first unique asymmetric key pair, including a first public key and a first private key, a certificate authority server configured to generate a unique asymmetric key certificate and a unique certificate chain, and inject the unique certificate chain into the electronic device, at least one owner terminal device configured to request authority authentication from the electronic device based on at least one owner certificates and at least one owner key pair corresponding to the at least one owner terminal device, the at least one owner key pair including at least one public owner key and at least one private owner key, a communication network including a secure communication channel configured to transmit and receive the at least one owner certificate and the at least one public owner key.

In one embodiment, a method includes receiving a request to reissue a certificate for a smart contract, wherein an original certificate was previously issued for the smart contract, determining by a certificate authority that the smart contract is upgradeable and was modified after being issued or the original certificate was revoked, receiving a copy of updated source code of an updated version of the smart contract in a development environment by the certificate authority, determining whether the copy satisfies security criteria by the certificate authority, receiving an indication by the certificate authority that the updated smart contract was deployed on a first blockchain network, determining by the certificate authority that the updated smart contract deployed on the first blockchain network matches the copy of updated source code in the development environment, and issuing a reissue certificate for the updated smart contract by the certificate authority based on the determination.

The invention discloses an anti-quantum composite digital certificate implementation method. The method comprises the following steps: generating a classical cryptographic algorithm key pair and an anti-quantum cryptographic algorithm key pair; combining the classical key algorithm public key and the anti-quantum cryptography algorithm public key to obtain a public key algorithm identifier and a dual-algorithm public key combination; respectively performing signature processing on the certificate request by using a classical cryptographic algorithm private key and an anti-quantum cryptographic algorithm private key, and combining two signature results to obtain a signature algorithm identifier and a dual-algorithm signature value combination; submitting a composite digital certificate application request to a CA certificate authority; and verifying the dual-algorithm signature value combination by using the dual-algorithm public key combination in the composite digital certificate application request through the CA certificate authority, and issuing the digital certificate if the verification is passed. The invention also discloses a device for realizing the anti-quantum composite digital certificate realization method, computer equipment and a storage medium. According to the invention, dual security assurance under the threat of quantum computing is realized.

The invention provides a unified management method, device and equipment for confidential containers, and the method comprises the steps: on the basis of a container cluster management system k8s and a virtualization container technology kata, based on sev, scv, tdx, tpm, tpcm, vtpm, vtpcm and the like, calling a security container kata run to create a VM on a k8s platform; the secret container is pulled up by the kata runtime through the kata-agent; the attestation-agent of the kata virtual machine generates a remote proof Quote with a hardware executable environment, and the remote proof Quote is sent to the host-attestation-agent; the host-attestation-agent is used for sending a remote certificate (Quote) with a hardware executable environment to the CA (Certificate Authority); after the CA receives the remote proof Quote with the hardware executable environment, trusted remote verification type judgment is carried out; and the CA performs container security verification according to the judgment result of the credible remote verification type judgment, so that a processor micro-architecture level memory access control and isolation mechanism can be provided, encryption and integrity protection can be provided at the memory level, and sensitive data and codes are prevented from being leaked or tampered in the calculation process.

In one embodiment, a method includes identifying first entities by a first root authority entity, authorizing one or more first entities to be certificate authorities by the first root authority entity, wherein each certificate authority is configured to audit a smart contract in a development environment before it is deployed on a first blockchain network and authorized to issue a certificate for each smart contract audited in the development environment based on a determination that the corresponding smart contract deployed on the first blockchain network matches the smart contract that was audited in the development environment, determining certificate authority authorization parameters are not satisfied for at least a first certificate authority, and revoking the certificate authority authorization for the first certificate authority by the first root authority entity, wherein each certificate issued by the first certificate authority prior to the revocation remains valid after the revocation.

An enhanced certificate authority system and method allows for the enhanced security, validation, and Multi-Factor Authentication of user's within a digital signature, digital identity and general user data and transaction system through the creation and management of a user's Digital Identity certificate and users data elements to be share in a secure environment, so that through an enhanced certificate authority a user's identity, users general data to be shared and bona fides may be both protected and established across a diversity of electronic devices and transactions.

In one embodiment, a method includes sending a verification request for a certificate issued by a certificate authority by a first smart contract deployed on a first blockchain network by a first entity, wherein the certificate is associated with a second smart contract, and wherein the verification request includes a program address of the second smart contract and an address of a first root authority entity associated with the certificate authority, receiving a verification response by the first smart contract indicating that the second smart contract is associated with a certificate matching the program address and the address of the first root authority entity in the verification request, determining whether the second smart contract is upgradeable by the first smart contract, determining whether the certificate is valid by the first smart contract based on a determination of whether the second smart contract was modified after the certificate was issued.

A method, system, and apparatus for managing digital certificates, managing a certificate authority (CA), and cross-referencing CA hierarchies. The method includes receiving, by a processor of a CA computing system, at least one of a digital certificate generation request and a digital certificate revocation from a user via a user computing device, the digital certificate generation request including a user public key and a user identity. The method further includes generating a digital certificate for the user and signing the digital certificate with a CA private key, wherein the CA private key is associated with a known CA public key. The method further includes publishing the digital certificate signed with the CA private key to a digital certificate blockchain, determining a certificate status of the digital certificate, and publishing an update to the digital certificate blockchain to reflect the certificate status of the digital certificate.

In one embodiment, a method includes receiving authorization by a certificate authority to access a specified development environment of a smart contract, receiving in the development environment a first copy of source code of the smart contract by the certificate authority authorized to audit the smart contract, generating an audit report for the smart contract by the certificate authority, receiving a second copy of source code of the smart contract in the development environment, wherein the second copy of source code is generated responsive to the audit report, determining that the second copy of source code satisfies the security criteria, receiving an indication that the smart contract was deployed on the first blockchain network, determining that the smart contract deployed on the first blockchain network matches the second copy of source code in the development environment, and issuing a certificate for the smart contract based on the determination.

The present disclosure provides a provisioning method and a terminal device. The provisioning method is applied to the terminal device, including: the security module establishes a secure channel with the certificate authority CA server through one or more session keys shared by the security module and the CA server; and obtains one or more digital certificates from the CA server; wherein, the security module is to implement Universal Subscriber Identity Module (USIM) functions.

The present invention relates to a scalable certificate management system architecture. An example system may include one or more application platforms (e.g., VMs) running a registration approval authority, which are communicatively connected to one or more computing engines that perform cryptographic calculations required by the registration approval authority. The system may also include one or more application platforms running a registration certificate issuing authority, which are communicatively connected to one or more computing engines that perform cryptographic calculations required by the registration certificate issuing authority. The system may further include one or more application platforms running a pseudonymous certificate issuing authority, which are communicatively connected to one or more computing engines that perform cryptographic calculations required by the pseudonymous certificate issuing authority. The system may also include one or more application platforms running a first link authority and a second link authority, which are communicatively connected to one or more computing engines that perform cryptographic calculations required by the link authority.

The methods and system allow for the generation of a signcrypted biometric electronic signature token using a subsequent biometric sample after an enrollment of a biometric reference value in a biometric system. The signcrypted biometric electronic signature token involves simultaneous encryption and digital signature to protect the confidentiality. The system as described herein provides data integrity, origin authentication, and efficiency by performing encryption and digital signature simultaneously. The process allows a signcrypting party to enroll in a biometric service, sign a piece of data or content using a public key, that may be tied to a trusted anchor certificate authority, and submit a biometric sample. Subsequently, the relying party may validate the information on that piece of data or content to confirm the identity of the signcrypting party.

A system includes a host network entity associated with a computing network. The host network entity may establish a first connection with a client network entity via a provisioner account in response to a connection request from a client network entity. The host network entity may receive a digital certificate from the client network entity via the first connection. The digital certificate may include an instruction set with a first instruction to generate an operator account for the client network entity. The host network entity may perform a validation of the digital certificate and the instruction set based on a public key associated with a certificate authority that is trusted by the host network entity, and responsive to the validation, the host network entity may generate the operator account based on the first instruction and establish a second connection with the client network entity via the operator account.

The invention provides a method for realizing development of an app embedded webpage through a virtual gateway, which comprises the following steps: in a development environment, generating a virtual HTTPS certificate through Nginx configuration; after the virtual certificate is generated, updating a configuration file of the Nginx; a preset certificate verification rule is added in the Nginx configuration to ensure reasonable use of the virtual certificate; and HTTPS access is carried out through the configured Nginx proxy. The method for realizing the development of the app embedded webpage through the virtual gateway has the beneficial effects that the process of manually applying for a certificate from a certificate authority (CA) is avoided by generating the virtual certificate through an automatic tool, and the management of the HTTPS certificate in the development stage is simplified, so that the local development environment can seamlessly simulate the HTTPS communication in the production environment.

The disclosed technology provides for authenticating access to servers using enterprise credentials. A method can include: generating, by a client device operating within an enterprise environment, a request to access a destination server including a token authenticating a user of the client device, transmitting the request to a computer system that can use the token to obtain the SSH certificate signed by an SSH certificate authority (CA), retrieve, from a data store, authorized group information for the user based on the token, and mint the SSH certificate with the retrieved information. The method can include receiving the SSH certificate with the authorized group information and returning the request and the SSH certificate with the authorized group information to a server to access the destination server. The server can be preconfigured with authorized group credentials corresponding to destination servers, which can include the destination server.

A system for processing digital signatures includes a sender device and a receiver device. The sender device encrypts a plaintext message and transmits an encrypted ciphertext message to the receiver device. The receiver device receives and decrypts the encrypted ciphertext message into a coded plaintext message, which is then decoded to output a readable plaintext message to the receiver device substantially corresponding to the plaintext message at the sender device. The sender and receiver devices are in communication with a certificate authority of a public key infrastructure configured to generate a keypair including a public key and a private key. The sender encrypts the plaintext message, and the receiver device decrypts the encrypted ciphertext message, using a common coding scheme that is configured for a document containing the public key.

Embodiments described herein provide techniques for securely validating firmware on a device using certificates and providing a mechanism for deprecating select certificates when a traditional certificate authority is unavailable or otherwise cannot be used. When a first firmware package is installed on the device, a first certificate in a first secure memory location is associated with an active status. Responsive to validation and installation of a second firmware package on the device, a second certificate in a second secure memory location on the device is associated with an active status. During a boot-up operation on the device, embodiments determine to use the second certificate to validate the second firmware package by starting at a predefined secure memory location and scanning backwards until a status of active is identified. The second firmware package on the device is then validated using the second certificate.

A method, performed by at least one processor of a trust broker, for establishing trust of vendor-supplied Open Radio Access Network (O-RAN) software, includes: receiving a plurality of O-RAN software from a plurality of O-RAN software vendors, the plurality of O-RAN software respectively signed by the plurality of O-RAN software vendors; for a software, among the plurality of O-RAN software, verifying a signature included with the software using a vendor certificate issued by a certificate authority (CA) of the corresponding vendor; based on successful verification of the signature, performing a software attestation with respect to the software using a digital certificate issued by a CA of the trust broker; and providing the attested software to an operator corresponding to the O-RAN system and with which the trust broker has a trust relationship.

Methods and systems for cross-certification to bind together two cryptographic systems are disclosed. One method includes receiving, from a first certificate authority at a second certificate authority, a cross certificate request, the cross certificate request including an attribute unique to the first certificate authority. The method also includes calculating a signature at the second certificate authority based at least in part on the attribute, and calculating a hash value based on a combination of the signature calculated at the second certificate authority and a key associated with the second certificate authority. The method includes generating a cross certificate and embedding the hash value as a certificate extension within the cross certificate.

A method and system are directed to protecting a hardware design against confidentiality and integrity attacks, the method comprising providing a bootable image (BI) to a tenant computing entity; receiving a certificate chain originating from the tenant computing entity via the BI; validating the certificate chain with a certificate authority; providing a design rule data object to the tenant computing entity via the BI; receiving an secure design rule result data object and an encrypted bitstream; determining a match of the secure design rule result data object with the design rule data object; and programming a cloud programmable logic instance with a decryption of the encrypted bitstream based at least in part on the match.

Embodiments include methods for a certificate authority (CA) associated with a communication network, including first and / or second sets of operations. The first set includes receiving a first message about a network function (NF) lifecycle management (LCM) event performed by a first NF of the communication network. The first message includes an identifier of a second NF associated with the NF LCM event, and an event type associated with the NF LCM event. The first operations include performing a first certificate LCM event for certificate(s) associated with the second NF, based on the event type. The second set includes performing a second certificate LCM event for the certificate(s) associated with the second NF and sending the first NF a second message about the second certificate LCM event. The second message includes an identifier of the second NF and an event type associated with the certificate LCM event.

The invention discloses a privacy authentication method and device based on zero knowledge proof, equipment and a medium, and relates to the technical field of information security, and the method comprises the steps: sending a user attribute comprising a fingerprint attribute value corresponding to first fingerprint information of a user side to a certificate issuing center, determining a polynomial commitment value by the certificate issuing center based on a first preset polynomial constructed by the user attributes, and signing the polynomial commitment value to obtain a signature value; respectively determining a fingerprint encryption value corresponding to the fingerprint attribute value and an attribute encryption value corresponding to the user strategy attribute, determining an overall challenge based on the fingerprint encryption value, the attribute encryption value and the polynomial commitment value, and constructing an attribute proof package based on the overall challenge and the polynomial commitment value; and uploading the attribute certification package and the signature value to the smart contract, so that the smart contract verifies the signature value and the attribute certification package, and monitoring a verification result through the server to determine the access authority of the user side. And privacy information exposure in user privacy authentication is prevented.

A device, system and method to log a communication device into services using a device identifier is provided. An identity management (IM) computing device receives, from a certificate authority, a first digital certificate, and further receives from a given communication device, a second digital certificate and a device identifier associated with the given communication device. The IM computing device successfully validates the second digital certificate using the first digital certificate, obtains a user identifier associated with the device identifier, and issues, to the given communication device, one or more tokens that include the user identifier, the one or more tokens enabling the given communication device to log into one or more services using the user identifier.

Method (100) for operating a field device (1) comprising an adjustable clock (2), at least one non-volatile CA memory (3) containing a public key certificate (3a) of a trusted certification authority, CA, at least one non-volatile time memory (4) for recording a date and / or time (4a) and at least one interface (5), comprising the steps: • A current date and / or time (7a) is received via the interface (5) (170); • this current date or time (7a) is compared with the date or time (4a) in the time memory (4) (180); and • In response to the fact that the current date or time (7a) is later (190) than the date or time (4a) in the time memory (4), the adjustable clock (2) of the field device (1) is set to the current date or time (7a) (200).

The invention discloses an attribute-based access control method for realizing puncture revocation and outsourcing decryption under multiple authorizations, which is characterized in that a certificate issuing mechanism is responsible for initialization of a system and registration of an attribute issuing mechanism and a user, and the attribute issuing mechanism manages part of attributes authorized by the attribute issuing mechanism and generates a conversion key of an agency for outsourcing decryption; the data owner encrypts the data by using attribute-based encryption according to the defined access structure and the label structure; and the proxy server converts the access strategy formulated by the data owner into a puncture strategy and then punctures the conversion key so as to cancel the specified user group. According to the method, puncture revocation and outsourcing decryption attribute-based access control under a multi-authorization mechanism can be realized, and a feasible method is provided for lightweight and fine-grained user revocation under the multi-authorization mechanism.