22 results about "Client certificate" patented technology

A certificate management service (CMS) may securely provision and rotate certificates for edge devices. The CMS may pre-register a unique device ID of an edge device (e.g., provided by the device manufacturer). When the edge device is installed at the client's remote network, it is provisioned with a common bootstrap certificate that allows the edge device to initially establish a secure to connection to a local hub device and to request a client certificate. The CMS receives the request for the client certificate, which includes the unique device ID. Since the unique device ID was pre-registered at the CMS, the CMS authenticates the request for the client certificate. The CMS causes a signed client certificate to be delivered back to the edge device, which may be used by the edge device to establish subsequent secure connections.

This certificate authority verification system includes: a verification device; a local certificate authority device that operates under an isolated execution environment; a certificate presenter device that serves as a server or a client and uses a server certificate or a client certificate; and a certificate verifier device that serves as a server or a client and verifies a presented certificate. The certificate authority device includes a self-certificate generation unit that generates a self-certificate which is a certificate of the certificate authority device itself, an evidence generation unit that generates evidence of the self-certificate, and a reference value registration request unit that executes a reference value registration request together with a reference value of the self-certificate. The verification device includes a reference value registration unit that registers the reference value of the self-certificate.

A connection management device may be used to with a common API to allow a host device of a client to securely connect to a remote provider network. The host device may only be able to use a connection management device by using a defined set of commands of a common API. A hardware root of trust may be pre-provisioned with security data (e.g., client certificate, encryption keys). A connection command may be used that is not specific to any particular communication protocol (e.g., WiFi, cellular, wired protocol). In response to receiving the connection command from a host device, the connection management device may perform commands specific to the communication protocol of the connection management device to connect to a remote provider network, use the security data for authentication, and establish a connection in accordance with the communication protocol based on the authentication.

The invention provides an access authentication method for binding a switch port and a host, which is used for solving the problems that a server is difficult to judge the correctness of the port and the management complexity is high when a multi-port client is accessed. According to the method, switch port information (a switch identifier and a port number) is aggregated into a logic user, and the logic user is bound with a client certificate, so that unified authentication is realized. A client can obtain current port information through a link layer discovery protocol, and submits an authentication request in the form of'switch identifier-port number '; and the authentication server carries out verification according to the stored port information, the logic user and the certificate public key, and if the connection port does not accord with the binding relationship, the access is refused. The authentication request carries the network port MAC information of the first accessed switch so as to prevent the switch from being counterfeited. According to the technology, the security and flexibility of authentication are effectively improved, and when the network configuration is changed, only the binding relationship needs to be updated at the server without modifying the configuration of the client, so that the management burden is remarkably reduced.

Technology for mesh network management including role-based authorization for wireless network management services is described. In one embodiment, a wireless mesh device receives, from a requesting device, a request to establish a secure communication session, authenticates the client certificate and establishes the secure communication session. The wireless mesh device further receives, from the requesting device via the secure communication session, a request directed to a service of a plurality of services provided by the wireless mesh device, where the request comprises the client certificate associated with the requesting device, identifies a root certificate used to cryptographically sign the client certificate, wherein the root certificate is associated with a role assigned to the requesting device, identifies role information associated with the requesting device and the client certificate, and responsive to determining that the role information indicates that the requesting device has permission to access the service, forwards the request to the service.

In certain aspects of this disclosure, a computer implementation method includes registering at least one managed device in a mobile device management service. This method includes receiving a client certificate on at least one managed device. This method includes integrating a generic device identifier SDK via a trusted ecosystem vendor app on at least one managed device. This method includes obtaining a pre-salted device identifier address associated with at least one managed device by the generic device identifier SDK based on a request from the trusted ecosystem vendor app. This method includes at least one managed device sending the pre-salted device identifier address to a security vendor service via a trusted ecosystem vendor to generate a generic device identifier address. This method includes at least one managed device receiving a generic device identifier address from the security vendor service via a trusted ecosystem vendor.

Systems, apparatus, and methods for device attestation are disclosed. An example apparatus includes communication circuitry to obtain a request to access an organization resource and a client certificate including a device identifier and a certificate authority issuer, at least one memory storing machine readable instructions, and programmable circuitry to execute the machine readable instructions to determine that the certificate authority issuer is a trusted issuer, compare the device identifier against device identifiers in a database storing trusted device identifiers of an organization protecting the organization resource, in response to determining that an instance of the device identifier exists in the database, determine that a client device associated with the device identifier is authorized to access the organization resource based on checking a policy of the organization, and grant the client device access to the organization resource.

This application provides a multi-protocol compatible communication method and related equipment. The multi-protocol compatible communication method includes: obtaining a target client certificate; determining the encryption algorithm of the target client certificate; determining a target communication protocol based on the encryption algorithm of the target client certificate; and establishing a connection with a server using the target communication protocol. The technical solution of this application automatically selects a suitable protocol through certificate analysis, eliminating compatibility issues that may occur in traditional protocol selection. The client and server can automatically adjust the communication protocol they use based on the encryption algorithm information contained in the client certificate, ensuring that both the client and server use compatible protocols in the same communication, effectively avoiding authentication failures or connection problems caused by mismatched protocols. Automated protocol selection ensures that both parties can use a matching protocol for authentication, reducing the chance of configuration errors and improving overall communication security.

The application provides a data interaction method and device, and relates to the technical field of cloud computing. A data interaction method is applied to a client and includes the following steps: obtaining a CA certificate and a client certificate issued by a private cloud; performing handshake information verification with a public cloud according to the CA certificate and the client certificate; and performing data interaction with the public cloud after the handshake information verification is successful. According to the embodiment of the application, the client can perform handshake with the public cloud through the certificate issued by the private cloud, and the private cloud can perform identity verification on the client through the handshake process.

An update deployment service performs secure provisioning of an edge device using a fiducial marker. A client registers an edge device with a provisioning service of a remote service provider network by providing a unique device ID. When the edge device is turned on, the edge device detects, based on input from a camera of the device, a fiducial marker that was generated by the provisioning service. The edge device decodes a network address (URL) and security credentials represented by the fiducial marker. The edge device sends the device ID and credentials to the provisioning service. The provisioning service authenticates the credentials and sends, to the edge device, a client certificate that can be used by the edge device for authentication by one or more other services of the provider network.

The application relates to a communication configuration method and device based on a DPU centralized service grid and a medium, in particular to the technical field of centralized service grids. The application is applied to a client node, the client node comprises a client host and a client data processing unit (DPU), the client host deploys a client preset adaptation component, and the client DPU deploys a client data plane agent; the method comprises the following steps: the client preset adaptation component receives a key discovery service request sent by the client data plane agent, generates a certificate signature request and sends the certificate signature request to a server control plane component, so that the server control plane component issues a client certificate; the client preset adaptation component receives the client certificate; and after the client preset adaptation component performs format conversion on the client certificate, the client preset adaptation component sends the client certificate to the client data plane agent, so that the client data plane agent performs bidirectional transport layer security communication by using the client certificate.

The application discloses a virtual machine migration method, device, equipment and medium, and belongs to the technical field of servers. The method comprises the following steps: when OpenStack is required to perform a virtual machine migration operation, a target libvirt container image is acquired; a target computing node for deploying the target libvirt container image is specified in the OpenStack, and it is judged whether the target libvirt container image needs to perform the migration operation by using a national secret algorithm according to a global configuration file; if yes, a central certificate is generated according to the national secret algorithm, and a corresponding relationship between the target computing node and the central certificate is stored into a libvirt pod; a client certificate and a server certificate are generated according to the central certificate, and each certificate is stored into a specified directory, so as to deploy the target libvirt container image on the target computing node. By the method, the safety and reliability of the virtual machine in the migration process can be further ensured.

Embodiments for securely exchanging Certificate Authority (CA) certificates inline and bi-directionally to make it easier for client-server transmissions to use certificate-based authentication. The client certificate is transferred securely through encryption with a pre-shared key based on certain parameters, and the server certificate is transferred securely through encryption with a pre-shared key based on the parameters. The process reduces the burden from applications to maintain and save the CA certificate. It also reduces the burden from server to maintain and save the CA certificate of the client so that server can select it to be used during authentication. This helps enable large scale deployments where the server can maintain the CA certificate and send it to client.

The invention discloses a MySQL public network encryption transmission method and system based on an X.509 certificate and Srunnel, and relates to the technical field of network security and database communication, secure communication of a MySQL database in a public network environment is realized by deploying a Srunnel encryption agent module at a client and a server and establishing a bidirectional authentication TLS encryption tunnel based on the X.509 digital certificate, and the security of the MySQL database in the public network environment is improved. The method comprises the steps that a certificate issuing mechanism root certificate is generated, a server certificate and a client certificate are signed and issued, a Srunnel server agent module and a client agent module are configured, a certificate path and a verification level are set, a MySQL client carries out TLS handshake and two-way certificate verification through a local Srunnel agent and a server Srunnel agent, after an encryption tunnel is established, data are transmitted in an encrypted mode, and the data are transmitted to the server Srunnel agent. The method supports an RSA and SM2 dual-certificate system, end-to-end encryption and strong identity authentication are realized, man-in-the-middle attack and data leakage risks are effectively defended, and the method is suitable for the fields of finance, government affairs and the like which have strict requirements on data security.

The invention provides a terminal verification method and system, electronic equipment and a storage medium, and the method comprises the steps: obtaining the environment information of a current client when the client responds to a user entering a target application; determining that environmental security exists based on the environmental information, responding to user identity information input by a user, and obtaining a target identifier and a client certificate; the user identity information, the target identifier, the client certificate and the environment information are packaged to generate a data packet, and the data packet is sent to credit processing equipment; the credit data device determines whether the user can access the target environment through the client based on the user identity information, the target identifier, the client certificate, the identity credential and the environment information in the data packet; and if it is determined that the client can access the target environment, determining that the client logs in successfully. According to the invention, bidirectional authentication is carried out on the user identity and the client identity through the client and the credit processing equipment, so that the network security problem in the industrial control network is solved by controlling the user permission and the terminal permission.

This invention proposes an access authentication method that binds switch ports to hosts, addressing the challenges of server-side port verification and high management complexity when multiple clients access the network. This method aggregates switch port information (switch identifier + port number) into logical users and binds them to client certificates for unified authentication. Clients can obtain current port information via a link-layer discovery protocol and submit authentication requests in the form of "switch identifier - port number." The authentication server verifies the connection based on stored port information, logical users, and certificate public keys. If the connection port does not match the binding relationship, access is rejected. The authentication request includes the MAC address of the first connected switch to prevent switch spoofing. This technology effectively improves authentication security and flexibility. When network configuration changes, only the binding relationship needs to be updated on the server side, without modifying client configurations, thus significantly reducing the management burden.

The invention relates to an operation data reporting method, device, equipment and system based on a VR project and a medium. In the application, before a central control system deployed by a store main control device operates a VR project, authentication information needs to be sent to a cloud authentication system; only when the authentication result shows that the authentication is successful, TLS bidirectional authentication with a project server with a first MQTT client certificate can be carried out through the MQTT server certificate in the authentication result, so that after the authentication is successful, the VR project is operated through the project server and the project client; through the mode, only the central control system which is successfully authenticated can obtain the MQTT server certificate and run the VR project, and the illegally copied VR project is effectively prevented from running in unauthorized equipment; moreover, after the central control system and the project server side carry out TLS bidirectional authentication, the project server side can send the operation data through an MQTTS protocol, and the safety of the operation data is ensured.

Systems and methods are provided for enabling a scalable load balancer to implement client certificate access control using mutual transport layer security authentication, including hardware configured to receive trust store files including certificate authority (CA) bundles and certificate revocation lists (CRLs); generate a single trust store file based on the trust store files; distribute a snapshot of the single trust store file to one or more nodes of the scalable load balancer; validate a client certificate from a client device by searching for a trusted CA from the CA bundles in the snapshot using the snapshot; determine whether the CRL included in the snapshot includes the client certificate; and transmit connection data from the client device to an application target upon validating the client certificate and determining that the CRL does not include the client certificate.

In certain aspects of the disclosure, a computer-implemented method includes enrolling, at a mobile device management service, at least one managed device. The method includes receiving a client certificate on the at least one managed device. The method includes integrating, via a trusted ecosystem vendor app on the at least one managed device, a universal device identifier SDK. The method includes retrieving, by the universal device identifier SDK based on a request from the trusted ecosystem vendor app, a pre-salted device identifier address associated with the at least one managed device. The method includes transmitting, by the at least one managed device via the trusted ecosystem vendor, the pre-salted device identifier address to a security vendor service for generating a universal device identifier address. The method includes receiving, from the security vendor service by the at least one managed device via the trusted ecosystem vendor, the universal device identifier address.

The application discloses an authentication data processing method, device, system, equipment and medium. The application receives authentication data returned by a server, wherein the first true random number is generated by the server through a quantum random number generator; the first true random number encrypted by the private key in the server certificate is decrypted according to the public key in the server certificate to obtain the decrypted first true random number; the first true random number is encrypted according to the private key in the client certificate and the first quantum key to obtain the encrypted first encrypted data; and the first encrypted data is sent to the server, wherein the first encrypted data is used for the server to perform identity authentication on the client. According to the embodiment of the application, the difficulty of forcibly cracking data in the authentication process is increased, and the security of the authentication process is further improved.

Systems, apparatus, and methods for device attestation are disclosed. An example apparatus includes communication circuitry to obtain a request to access an organization resource and a client certificate including a device identifier and a certificate authority issuer, at least one memory storing machine readable instructions, and programmable circuitry to execute the machine readable instructions to determine that the certificate authority issuer is a trusted issuer, compare the device identifier against device identifiers in a database storing trusted device identifiers of an organization protecting the organization resource, in response to determining that an instance of the device identifier exists in the database, determine that a client device associated with the device identifier is authorized to access the organization resource based on checking a policy of the organization, and grant the client device access to the organization resource.