275 results about "Certificate authority" patented technology

The invention relates to a QUIC protocol-based distributed node unified identity authentication method and system, belongs to the technical field of network security, is applied to a client, and comprises the following steps: registering a client domain name identity through a certificate authority, obtaining a client certificate, and pre-storing a server certificate chain; generating a QUIC initial data packet according to the target server domain name identifier and the client certificate, and sending the QUIC initial data packet to the server; receiving a QUIC handshake data packet returned by the server; verifying the legality of the server certificate based on the server certificate chain, and if the server certificate is legal, calculating a pre-master key according to the client DH private key and the server DH public key; deriving a 1-RTT session key based on the pre-master key; generating a signature verification message, and sending the client certificate and the signature verification message to a server; and synchronously using the 1-RTT session key to encrypt the application layer data with the server, and transmitting the data to the server in the 1-RTT encryption space of the QUIC protocol. According to the invention, the reliability of node identities and the confidentiality of data are ensured.

The invention relates to the field of network security, and discloses an identity authentication unloading method and system based on an intelligent network card. The method comprises the following steps: presetting a master key in an intelligent network card; presetting a master key in the intelligent network card; receiving client request data forwarded by the application layer and extracting a service identifier; generating a private key of the corresponding service through the service identifier and the master key; acquiring a local authentication message, signing the local authentication message by using the private key, generating a server signature value, and sending the server signature value to the client through the application layer to trigger a client authentication process; receiving client certificate data forwarded by the application layer and extracting a certificate signature value; and verifying the certificate signature value by using a preset certificate issuing mechanism public key and generating a verification result, and outputting feedback information based on the verification result. According to the method, a hardware-level unloading function in an identity authentication process is realized through the intelligent network card, and the problems of high calculation overhead and poor expansibility of traditional TLS bidirectional authentication are solved.

The invention discloses an anti-quantum composite digital certificate implementation method. The method comprises the following steps: generating a classical cryptographic algorithm key pair and an anti-quantum cryptographic algorithm key pair; combining the classical key algorithm public key and the anti-quantum cryptography algorithm public key to obtain a public key algorithm identifier and a dual-algorithm public key combination; respectively performing signature processing on the certificate request by using a classical cryptographic algorithm private key and an anti-quantum cryptographic algorithm private key, and combining two signature results to obtain a signature algorithm identifier and a dual-algorithm signature value combination; submitting a composite digital certificate application request to a CA certificate authority; and verifying the dual-algorithm signature value combination by using the dual-algorithm public key combination in the composite digital certificate application request through the CA certificate authority, and issuing the digital certificate if the verification is passed. The invention also discloses a device for realizing the anti-quantum composite digital certificate realization method, computer equipment and a storage medium. According to the invention, dual security assurance under the threat of quantum computing is realized.

A method, system, and apparatus for managing digital certificates, managing a certificate authority (CA), and cross-referencing CA hierarchies. The method includes receiving, by a processor of a CA computing system, at least one of a digital certificate generation request and a digital certificate revocation from a user via a user computing device, the digital certificate generation request including a user public key and a user identity. The method further includes generating a digital certificate for the user and signing the digital certificate with a CA private key, wherein the CA private key is associated with a known CA public key. The method further includes publishing the digital certificate signed with the CA private key to a digital certificate blockchain, determining a certificate status of the digital certificate, and publishing an update to the digital certificate blockchain to reflect the certificate status of the digital certificate.

The disclosed technology provides for authenticating access to servers using enterprise credentials. A method can include: generating, by a client device operating within an enterprise environment, a request to access a destination server including a token authenticating a user of the client device, transmitting the request to a computer system that can use the token to obtain the SSH certificate signed by an SSH certificate authority (CA), retrieve, from a data store, authorized group information for the user based on the token, and mint the SSH certificate with the retrieved information. The method can include receiving the SSH certificate with the authorized group information and returning the request and the SSH certificate with the authorized group information to a server to access the destination server. The server can be preconfigured with authorized group credentials corresponding to destination servers, which can include the destination server.

Embodiments described herein provide techniques for securely validating firmware on a device using certificates and providing a mechanism for deprecating select certificates when a traditional certificate authority is unavailable or otherwise cannot be used. When a first firmware package is installed on the device, a first certificate in a first secure memory location is associated with an active status. Responsive to validation and installation of a second firmware package on the device, a second certificate in a second secure memory location on the device is associated with an active status. During a boot-up operation on the device, embodiments determine to use the second certificate to validate the second firmware package by starting at a predefined secure memory location and scanning backwards until a status of active is identified. The second firmware package on the device is then validated using the second certificate.

A method, performed by at least one processor of a trust broker, for establishing trust of vendor-supplied Open Radio Access Network (O-RAN) software, includes: receiving a plurality of O-RAN software from a plurality of O-RAN software vendors, the plurality of O-RAN software respectively signed by the plurality of O-RAN software vendors; for a software, among the plurality of O-RAN software, verifying a signature included with the software using a vendor certificate issued by a certificate authority (CA) of the corresponding vendor; based on successful verification of the signature, performing a software attestation with respect to the software using a digital certificate issued by a CA of the trust broker; and providing the attested software to an operator corresponding to the O-RAN system and with which the trust broker has a trust relationship.

Methods and systems for cross-certification to bind together two cryptographic systems are disclosed. One method includes receiving, from a first certificate authority at a second certificate authority, a cross certificate request, the cross certificate request including an attribute unique to the first certificate authority. The method also includes calculating a signature at the second certificate authority based at least in part on the attribute, and calculating a hash value based on a combination of the signature calculated at the second certificate authority and a key associated with the second certificate authority. The method includes generating a cross certificate and embedding the hash value as a certificate extension within the cross certificate.

A method and system are directed to protecting a hardware design against confidentiality and integrity attacks, the method comprising providing a bootable image (BI) to a tenant computing entity; receiving a certificate chain originating from the tenant computing entity via the BI; validating the certificate chain with a certificate authority; providing a design rule data object to the tenant computing entity via the BI; receiving an secure design rule result data object and an encrypted bitstream; determining a match of the secure design rule result data object with the design rule data object; and programming a cloud programmable logic instance with a decryption of the encrypted bitstream based at least in part on the match.

Embodiments include methods for a certificate authority (CA) associated with a communication network, including first and / or second sets of operations. The first set includes receiving a first message about a network function (NF) lifecycle management (LCM) event performed by a first NF of the communication network. The first message includes an identifier of a second NF associated with the NF LCM event, and an event type associated with the NF LCM event. The first operations include performing a first certificate LCM event for certificate(s) associated with the second NF, based on the event type. The second set includes performing a second certificate LCM event for the certificate(s) associated with the second NF and sending the first NF a second message about the second certificate LCM event. The second message includes an identifier of the second NF and an event type associated with the certificate LCM event.

The invention discloses a privacy authentication method and device based on zero knowledge proof, equipment and a medium, and relates to the technical field of information security, and the method comprises the steps: sending a user attribute comprising a fingerprint attribute value corresponding to first fingerprint information of a user side to a certificate issuing center, determining a polynomial commitment value by the certificate issuing center based on a first preset polynomial constructed by the user attributes, and signing the polynomial commitment value to obtain a signature value; respectively determining a fingerprint encryption value corresponding to the fingerprint attribute value and an attribute encryption value corresponding to the user strategy attribute, determining an overall challenge based on the fingerprint encryption value, the attribute encryption value and the polynomial commitment value, and constructing an attribute proof package based on the overall challenge and the polynomial commitment value; and uploading the attribute certification package and the signature value to the smart contract, so that the smart contract verifies the signature value and the attribute certification package, and monitoring a verification result through the server to determine the access authority of the user side. And privacy information exposure in user privacy authentication is prevented.

A device, system and method to log a communication device into services using a device identifier is provided. An identity management (IM) computing device receives, from a certificate authority, a first digital certificate, and further receives from a given communication device, a second digital certificate and a device identifier associated with the given communication device. The IM computing device successfully validates the second digital certificate using the first digital certificate, obtains a user identifier associated with the device identifier, and issues, to the given communication device, one or more tokens that include the user identifier, the one or more tokens enabling the given communication device to log into one or more services using the user identifier.

Method (100) for operating a field device (1) comprising an adjustable clock (2), at least one non-volatile CA memory (3) containing a public key certificate (3a) of a trusted certification authority, CA, at least one non-volatile time memory (4) for recording a date and / or time (4a) and at least one interface (5), comprising the steps: • A current date and / or time (7a) is received via the interface (5) (170); • this current date or time (7a) is compared with the date or time (4a) in the time memory (4) (180); and • In response to the fact that the current date or time (7a) is later (190) than the date or time (4a) in the time memory (4), the adjustable clock (2) of the field device (1) is set to the current date or time (7a) (200).

The invention discloses an attribute-based access control method for realizing puncture revocation and outsourcing decryption under multiple authorizations, which is characterized in that a certificate issuing mechanism is responsible for initialization of a system and registration of an attribute issuing mechanism and a user, and the attribute issuing mechanism manages part of attributes authorized by the attribute issuing mechanism and generates a conversion key of an agency for outsourcing decryption; the data owner encrypts the data by using attribute-based encryption according to the defined access structure and the label structure; and the proxy server converts the access strategy formulated by the data owner into a puncture strategy and then punctures the conversion key so as to cancel the specified user group. According to the method, puncture revocation and outsourcing decryption attribute-based access control under a multi-authorization mechanism can be realized, and a feasible method is provided for lightweight and fine-grained user revocation under the multi-authorization mechanism.

The invention relates to the technical field of information security, and discloses a cross-domain trust identity authentication method and system based on an alliance chain, and the method comprises the steps: when a registration request sent by a user from a first trust domain is received, according to a preset block chain certificate format and verified target user information, carrying out the authentication of the target user; a user block chain certificate is generated through a certificate issuing mechanism, the user block chain certificate is linked to a block chain through an alliance chain server, and when it is detected that a user sends a cross-domain communication request to a service provider, the cross-domain communication request is sent to the service provider. And the service provider performs legality verification on the user signature of the user, the user block chain certificate and the issuing mechanism generating the user block chain certificate through the alliance chain server according to the cross-domain communication request, and when the legality verification is passed, the service provider is determined to pass user authentication. Therefore, the digital certificate management and maintenance cost can be reduced, and the certificate is ensured to be credible, controllable and traceable in the whole process from the source to the storage sharing.

The invention discloses an anti-quantum certificate signature verification method, which comprises the following steps: signing and issuing a traditional certificate to a certificate issuing mechanism, and carrying out abstract operation processing on a serial number of the traditional certificate to obtain an abstract of the traditional certificate; issuing an anti-quantum certificate to a certificate issuing mechanism, and adding the abstract of the traditional certificate into an extension item of the anti-quantum certificate, so that the anti-quantum certificate is bound with the traditional certificate; when the security of the certificate needs to be verified in the interaction process with other application systems, performing signature verification processing on the traditional certificate; and after the signature verification of the traditional certificate is passed, carrying out signature verification processing on the countermeasure quantum certificate, and if the verification is passed, considering the certificate as a trusted certificate. The invention further discloses a device for implementing the anti-quantum certificate signature verification method, computer equipment and a storage medium. According to the method, the potential risk that a traditional digital certificate is attacked by quantum during use can be well solved, and the security of the certificate is greatly improved.

This disclosure provides a remote attestation method and a related device, to verify a remote attestation report by using a symmetric key of a subscriber identity module (SIM), without depending on a digital certificate provided by a certificate authority (CA) server. This can improve reliability of a remote attestation report verification process. In the method, a first apparatus receives request information, where the request information is for requesting a remote attestation report, and the remote attestation report is for remote attestation of the first apparatus. The first apparatus sends first information based on the request information, where the first information includes the remote attestation report and verification information, the verification information is for verifying the remote attestation report, and the verification information is obtained by processing the remote attestation report based on a symmetric key of a SIM in the first apparatus.

The invention discloses a distributed identity association and verification method and system combining an alliance chain and a trusted CA (Certificate Authority). The method comprises the following steps: firstly, guiding a user to complete identity verification in a trusted third-party authentication center to obtain an authoritative verifiable certificate; based on the certificate, the back end of the system automatically applies for signing and issuing an operation certificate for on-chain interaction to the alliance chain. The system constructs a distributed identity document aggregating verifiable credentials and public key information for a user. A user imports an operation certificate and a private key into a block chain wallet, signs a transaction in person, and registers a DID and a document thereof into an on-chain smart contract, so that the problems that in an existing block chain identity system, an on-chain identity is separated from an entity identity, roots of trust are not uniform, and interoperability is poor are solved; unified and non-tampering on-chain association of a user entity identity, an on-chain operation identity and a standardized DID is realized, an identity system with a trusted CA as a root of trust is established, the sovereignty and security of the user are guaranteed while supervision requirements are met, and the identity interoperability is improved.

Operations of a certificate bundle distribution service may include: detecting a trigger condition to distribute a certificate bundle that includes a set of certificate authority certificates; determining, for each of a plurality of network entities associated with a computer network, a fault domain representing at least one single point of failure; partitioning the plurality of network entities into a plurality of certificate distribution groups, based on a set of partitioning criteria that includes a fault domain of each particular network entity, in which each particular certificate distribution group includes a particular subset of network entities, and the particular subset of network entities are associated with a particular fault domain; selecting a particular certificate distribution group, of the plurality of certificate distribution groups, for distribution of the certificate bundle; and transmitting the certificate bundle to the particular subset of network entities in the particular certificate distribution group.

The invention discloses an anti-quantum anonymity voucher generation method and device, equipment and a medium, and the method comprises the steps: carrying out the improvement of a conventional original image sampling method based on an approximate trap door sampling and refusal sampling technology, constructing a more efficient anonymity voucher generation protocol, remarkably reducing the calculation complexity, and improving the practicality. The user sends an application to a certificate authority (CA) to obtain an anonymous certificate for a specific attribute; and the CA interacts with the user and returns the signed attribute, and the user calculates an anonymous certificate according to the attribute and locally stores the anonymous certificate. During identity authentication, a user interacts with a service provider (SP) by using a local certificate to dynamically generate a proof; and the SP verifies the certification and then outputs an authentication result. According to the method, the defects of traditional identity authentication and anonymous certificates are overcome, efficient authentication can be realized under limited equipment and a high-privacy scene, and a better scheme is provided for actual deployment of the anonymous certificates.

Methods and apparatus for automatically securing communications between a mediation device (MD) and a law enforcement device, such as an agent's terminal, to which intercepted communications, e.g., traffic, is sent are described. Based on a desired intercept request to be implemented, a Lawful Interception (LI) administration (admin) device (LID) identifies at least a first mediation device (MD) which will be involved in implementing the intercept request. The LID then proceeds to enable the use of a private certificate authority to automatically generate and provision the MD and a law enforcement device with certificates and private keys via an automated process. Each of the MD and law enforcement device automatically obtain a security certificate and corresponding private key. The security certificates and corresponding private keys are then used, in an automated manner, to establish a mutual TLS connection between the MD and the law enforcement device.

The invention discloses an automatic certificate management method and system, and belongs to the technical field of network security and digital certificate management, and the method comprises the following steps: 1, providing a protocol adaptation layer supporting multiple protocols, the protocol adaptation layer supporting ACME, SCEP, EST, CMP and private RESTful protocols, and communicating with a certificate authority (CA); step 2, setting a strategy management module, and defining an automatic management strategy of the certificate, including conditions and rules of certificate application, updating, revoking and distribution; and step 3, automatically executing application, updating, revoking and distribution operations of the certificate by using a certificate management module. According to the automatic certificate management method, the system and the system architecture, a new certificate management protocol is allowed to be integrated in the future, technical development is adapted, a machine learning algorithm is introduced, a certificate management strategy is optimized according to historical data, and a complete secure ecology is constructed by integrating with other security systems and operation and maintenance systems through an open API (Application Program Interface).

A system and method for providing a single sign-on for connecting a client device to a virtual infrastructure. The virtual infrastructure includes a server, an enterprise connector and a certificate authority. The client device receives an identity provider (IdP) token obtained from an IdP on authenticating a user of the client device. On authentication of the user, a desktop client application on the client device sends a request through the enterprise authority for a login certificate. A login certificate generated by the certificate authority is received by the client device. The login certificate to the client device is sent to the virtual infrastructure to allow the client device a connection to a virtual machine of the virtual infrastructure.

A method for providing a digital certificate to a device, comprises: receiving a device identification dataset, uniquely identifying the device; determining a key creation dataset including a certificate identifier, the certificate identifier being based on the device identification dataset; sending the key creation dataset to the device; receiving a certificate creation request related to a first domain name based on the key creation dataset from the device, the first domain name including the certificate identifier; sending the certificate creation request or a modified certificate creation request to a certificate authority; and providing the digital certificate to the device, the digital certificate being a wildcard certificate based on the first domain name signed by the certificate authority.

The invention provides a data processing method and system, electronic equipment and a computer program product, and relates to the technical field of data processing.The method comprises the steps that a mixed encryption result sent by a data encryption party is received; wherein the hybrid encryption result is obtained by encrypting to-be-encrypted data based on a previously obtained hybrid digital certificate by the data encryption party, and the hybrid digital certificate is obtained by requesting a certificate authority (CA) based on a certificate obtaining request and is sent to the data encryption party; and according to the hybrid encryption result, searching a corresponding hybrid digital certificate, and decrypting the hybrid encryption result by using a target private key corresponding to the hybrid digital certificate to obtain plaintext data. According to the method, the security of data in links such as storage and transmission is greatly improved, and plaintext data is effectively protected from being maliciously acquired and tampered.

Aspects of the present application utilizes onboard vehicle hardware for secure ECU data communication. In some embodiments, a main ECU receives a private key from a certificate authority and stores it within a hardware security module (HSM). The main ECU may then generate a symmetric vehicle-specific key based on at least one vehicle parameter of the vehicle (e.g., the odometer) and store it in the HSM. An additional ECU may be detected by the main ECU on a vehicle communication network (e.g., ethernet). The additional ECU may be an FPGA that includes an unprovisioned vehicle control operation. The main ECU may generate an FPGA image for the additional ECU where the FPGA image has the symmetric vehicle-specific key. The main ECU may then cryptographically sign the FPGA image using the private key stored in the HSM and transmit the signed FPGA image to the additional ECU for installation.

A request to provide a data object attestation authority certificate to a second cluster of secure environments is received at a first cluster of secure environments. The request comprises a cluster certificate of the second cluster issued by a cluster enrollment certificate authority (CA). The cluster certificate is validated using a public key of the enrollment CA. An encrypted message comprising the attestation authority certificate and a digital signature of the first cluster is generated. The encrypted message is encrypted using a public key indicated in the cluster certificate of the second cluster. The digital signature is associated with a cluster certificate of the first cluster issued by the enrollment CA. The encrypted message is provided to the second cluster to be decrypted using a private key associated with the cluster certificate of the second cluster, and to be validated using at least the public key of the enrollment CA.

An operating method for an electronic device is disclosed. An operating method for an electronic device according to an embodiment of this disclosure may include the following operations: retrieving a certificate from a file stored in the electronic device; sending a verification request for the certificate to a certificate authority in response to recognizing that the certificate is a new certificate; determining whether the certificate's validity period has expired in response to receiving a response from the certificate authority confirming the certificate's validity; determining whether the certificate is included in an exception list when the certificate's validity period has expired; and storing the certificate in the memory of the electronic device in response to determining that the certificate is included in the exception list, wherein the exception list includes at least one certificate.

The invention provides a digital certificate management method. The method can be applied to the technical fields of big data and financial science and technology. The method is applied to a server for distributing a digital certificate in a distributed server cluster, and comprises the following steps: acquiring a digital certificate application element, and generating a digital certificate request file and a private key based on the digital certificate application element. Wherein the private key is a private key of an environment system which cannot carry out data transmission and is bound with a server used for distributing the digital certificate. And sending the digital certificate request file to a digital certificate issuing mechanism for generating a digital certificate. Wherein the digital certificate comprises a public key corresponding to the private key, and the private key is used for verifying the digital certificate. And acquiring the digital certificate, and distributing the digital certificate to a server for authenticating the digital certificate in a distributed server cluster. The invention further provides a digital certificate management device and equipment, a storage medium and a program product.