30 results about "Client-side encryption" patented technology

A privacy protection heterogeneous federal learning method with Byzantine robustness includes training a local model and calculating a sketch, removing an abnormal local model, selecting a client with quick response capability, encrypting local update and submitting ciphertext, executing weighted aggregation and distributing an updated global model. The method has the beneficial effects that a high-dimensional local model is converted into a low-dimensional sketch by adopting locality sensitive hashing, and the quality of the local model is effectively evaluated on the premise of protecting data privacy. Then, the Byzantine clients are identified and removed based on the hierarchical clustering technology, aggregation weights are distributed to the remaining clients according to the local model quality, and the global model convergence speed is increased; in addition, by selecting the clients which are high in response speed and have representative data sets to participate in model training, the problem of outdated persons caused by system isomerism is solved under the condition that the global model accuracy is not affected.

The invention discloses a sensitive data import and export system and method based on a substrate management controller, and relates to the technical field of information security, and the system comprises an encryption algorithm selection module which is used for selecting a target encryption algorithm based on a context-aware intelligent encryption algorithm negotiation strategy; corresponding encryption, decryption and communication operations are carried out through the encryption module, the decryption module and the communication module; the zero-trust adaptation module is used for dynamically adjusting the import and export operation authority based on a zero-trust strategy; the security level of the system is improved through the key management module, the authentication module and the data integrity check module; and the plug-in module is used for loading each module in a plug-in form, and reserving an interface for future algorithm replacement and encryption strategy expansion, so that the technical problems that in the related technology, the export function is limited, complete backup cannot be carried out, the flexible encryption capability is lacked, the client encryption capability and an algorithm negotiation mechanism are lacked, and different encryption compliance requirements are difficult to adapt are solved.

The invention relates to a transverse federation and multivariate representation-based commodity recommendation model training method, which comprises the following steps that: a central server runs a key generation algorithm to generate a public key and a private key, and sends the public key to a client participating in federation learning in the current round through a secure channel; the central server issues a global commodity recommendation model to each client; each client uses local user-commodity interaction data to train the global commodity recommendation model to obtain a local commodity recommendation model; the local commodity recommendation model and the performance index are encrypted through a public key of the central server and then uploaded to the central server; the central server decrypts the local commodity recommendation models encrypted by the clients and the performance indexes by using the private keys, and aggregates the local commodity recommendation models uploaded by the clients according to the performance indexes to obtain a global commodity recommendation model of the next round of iterative training; the above steps are repeatedly executed until the global commodity recommendation model converges or reaches a preset number of iterations, and the trained commodity recommendation model is obtained.The real-time performance and accuracy in recommendation can be improved, and meanwhile the generalization ability of the model is improved.

A method applies secure cryptographic communication between legacy applications and corresponding external services. A user device has one or more processors and memory, and runs a legacy application. The application receives input (e.g., from a user). In response to the input, the application initiates communication over a secure communication protocol to an external service not running on the user device. A client crypto-service encapsulates the communication and provides a secure encrypted tunnel to a server crypto-service, at a server system, in communication with the external service. The server system has one or more processors and memory. The server system receives the encapsulated communication at the server crypto-service and sends the communication to the external service. The server system then receives a response to the communication from the external service and returns the response, through the secure encrypted tunnel, to the user device.

One or more embodiments of the present disclosure provide a data transmission method in an agent system, an agent system, a device and a medium, the agent system comprising an agent application, a first client, a first server and a large model, the first client, the first server and the large model being deployed in a trusted execution environment, comprising the following steps: receiving a first user request in response to an agent application, encrypting the first user request by a first client, and transmitting first encrypted data to a large model; the first client receives second encrypted data transmitted by the large model; the first client obtains the reasoning result, encrypts at least one subtask, and transmits third encrypted data to the first server; the first client receives fourth encrypted data transmitted by the first server; and the first client obtains a task execution result, and the agent application outputs the task execution result. And deploying the first client, the first server and the large model in a trusted execution environment to realize security and credibility of data transmission in the intelligent agent system.

The invention discloses a network attack detection method and system based on a federal large model, and relates to the technical field of network attack detection. The method comprises the following specific steps: acquiring captured flow data in real time at a client; analyzing the traffic data, and extracting field information in the data packet; inputting the field information into the SecGPT-LSTM model in a text form for data feature extraction and deep analysis, and outputting a network attack detection classification result; and designing a network attack detection framework based on a federal large model to update and learn the SecGPT-LSTM model, receiving incremental parameters encrypted by the client, executing weighted aggregation to generate global model parameters, and issuing the global model parameters to the client for updating and iteration. Through federated learning and a SecGPT large model technology, the problems of insufficient data privacy protection, model updating efficiency, attack detection accuracy and model generalization ability are solved, and the overall performance of network attack detection is improved.

The application discloses a cloud-edge collaborative business process intelligent optimization method and device and a storage medium, and belongs to the field of business process optimization. The method comprises the following steps: step 1, a client preprocesses a local business process event log, and calculates the support, cost and average cost lower bound of a scenario with a length of m; step 2, the client encrypts the scenario and the calculation result and uploads them to a server; step 3, the server calculates the global confidence, global average cost and global average cost lower bound of the scenario, adds scenarios meeting high correlation and low cost to a result set and a candidate set, and adds scenarios meeting high correlation and potential low cost to the candidate set; step 4, the server generates a candidate scenario with a length of m+1 based on the candidate set, and encrypts and distributes the candidate scenario to the client; step 5, the client calculates the support, cost and average cost lower bound of the new candidate scenario; and step 6, steps 2-5 are circularly executed until there is no new candidate scenario, and a final result set is output.

The application discloses a cloud sharing multi-terminal real-time online document encryption device based on a national secret, belongs to the technical field of cloud sharing and encryption, and aims to solve the technical problem of how to realize real-time collaborative editing of user sensitive data and avoid content leakage in a document editing process. The technical scheme is that the device comprises a server and a client, the client comprises an application terminal and a password module, the server comprises a key distribution service unit and a collaborative service unit, the key distribution service unit comprises a key management service module and a key distribution service module, the collaborative service unit comprises a service module and a collaborative processing service module, the key distribution service unit is used for key distribution and key management, the collaborative service unit completes key distribution by calling the key distribution service module, and the client-encrypted document is converted and stored in ciphertext through collaborative operation, and the ciphertext is retransmitted to other clients.

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium for retrieving information from a server. Methods can include a server receiving a set of client-encrypted queries. The server identifies a set of server-encrypted decryption keys and transmits the set to the client device. The server receives a set of client-server-encrypted decryption keys that includes the set of server-encrypted decryption keys encrypted by the client device. The server also receives a set of client-encrypted / client-derived decryption keys that were derived by the client device. The server generates matching a map that specifies matches between the set of client-server-encrypted decryption keys and the set of client-encrypted / client-derived decryption keys. The server filters the set of client-encrypted queries using the map to create a set of filtered client-encrypted queries and generates a set of query results.

The invention discloses a design implementation method and system for simulating a defense gateway. The simulation defense gateway comprises a simulation gateway container management platform, generates a simulation gateway container with redundancy based on a simulation gateway image, and runs a heterogeneous gateway program in the container; the simulation agent is deployed between the client and the simulation gateway container, distributes request data of the client to the simulation gateway container and returns response data of the simulation gateway container to the client; the multi-mode voting device is used for performing multi-mode voting on the output processed by the analog gateway container; the negative feedback controller receives the multi-mode voting results, if the voting results are inconsistent, the simulation gateway container management platform is triggered to clean the current simulation gateway container, other heterogeneous simulation gateway containers are randomly selected from the simulation gateway mapping pool for recovery, and meanwhile, a negative feedback result is sent to the simulation agent; and closing the encrypted session of the client. According to the invention, the security defense capability of the gateway is effectively improved.

The invention provides a method for preventing an H5 page in an APP from being attacked by a man-in-the-middle, and the specific operation steps of the method are as follows: step 1, a client prepares request data, step 2, the client encrypts the data, and the client encrypts the data, step 3, the client generates a signature, step 4, the client sends an encryption request, step 5, a server verifies the signature, and step 6, the server verifies the signature. The method comprises the following steps: step 1, a client receives response data, step 2, a server decrypts the data, step 7, the server processes the data, step 8, the server generates a response, step 9, the server sends an encrypted response, step 10, the client receives the response data, step 11, the client verifies a signature, step 12, the client decrypts the response data, and step 13, the client completes data processing. According to the method, the risk of data leakage and tampering caused by the fact that the data is attacked by a man-in-the-middle can be effectively reduced, frequent certificate replacement of the client is avoided, security vulnerabilities possibly caused by improper implementation are reduced, the risk of service interruption caused by configuration errors is reduced, and the complexity of operation and maintenance is reduced.

The present application relates to the technical field of artificial intelligence, and in particular to a distributed training method and device, terminal equipment and computer readable medium. The present application encrypts local original graph data, sends the encrypted graph data to other clients and obtains encrypted graph data of other clients, performs private intersection on the local encrypted graph data and the obtained encrypted graph data of other clients, obtains target graph data, trains the local model according to the target graph data, sends the trained model parameters to the central server to update the global model parameters, and sends the updated global model parameters to each local client to update the local model. The present application encrypts the local client graph data by the private intersection technology, interacts with the encrypted graph data of other clients, obtains data for model training, can ensure the security in the data interaction process, and improves the accuracy of the distributed training parameters.

This application provides a stateless session recovery method, apparatus, and device for the TLCP protocol. The method includes: determining a second client signature hash value based on a client signature certificate; determining a second client encryption hash value based on a client encryption certificate; determining a second server signature hash value based on a server signature certificate; determining a second server encryption hash value based on a server encryption certificate; if the first client signature hash value is the same as the second client signature hash value, the first client encryption hash value is the same as the second client encryption hash value, the first server signature hash value is the same as the second server signature hash value, and the first server encryption hash value is the same as the second server encryption hash value, then the client's session is recovered, and a TLCP connection is established with the client. The technical solution of this application can save network bandwidth resources, reduce the computing resource consumption of business servers, and significantly shorten the connection establishment time.

The present application discloses a sensitive data import and export system and method based on a baseboard management controller, which relates to the field of information security technology, including: an encryption algorithm selection module, which is used to select a target encryption algorithm based on a context-aware intelligent encryption algorithm negotiation strategy; corresponding encryption, decryption and communication operations are performed through an encryption module, a decryption module and a communication module; a zero-trust adaptation module, which is used to dynamically adjust the import and export operation permissions based on a zero-trust strategy; the security level of the system is improved through key management, authentication and data integrity verification modules; a plug-in module, which is used to load each module in the form of a plug-in, and reserve an interface for future algorithm replacement and encryption strategy expansion, thereby solving the technical problems in related technologies such as limited export functions, inability to perform complete backup, lack of flexible encryption capabilities, lack of client encryption capabilities and algorithm negotiation mechanisms, and difficulty in adapting to different encryption compliance requirements.

The application discloses an information sharing method, system, device and storage medium, relates to the field of cryptography, and comprises the following steps: an initialization module is used for distributing the signature private key and the signature public key corresponding to the current user group and the public parameter information to each layer client in the current user group after the signature private key and the signature public key corresponding to the current user group and the public parameter information are generated, initializing the identity key information of the first layer client, and recording by using a block chain; a key distribution module is used for obtaining corresponding identity key information by configuring corresponding next layer clients by taking each layer client as a key generation party; an information encryption and sharing module is used for obtaining target ciphertext by encrypting the first target layer client, calling a preset block chain by using the identity key information of the second target layer client as an information receiver, verifying the preset block chain, and obtaining target contract events including the ciphertext after the verification is passed; and an information decryption module is used for decrypting and signing when the second target layer client listens to the target contract events. The system management burden is reduced.

An apparatus in an illustrative embodiment comprises a client device configured for communication with a storage system, with the client device comprising a processor coupled to a memory. The client device is further configured to generate a data encryption key for a data item by computing a function of at least the data item, to encrypt the data item using the data encryption key for the data item, to encrypt the data encryption key using a secret key of the client device, and to send the encrypted data item and the encrypted data encryption key to the storage system for storage in the storage system. The client device is still further configured to retrieve the encrypted data item and the encrypted data encryption key from the storage system, and to perform an integrity check on the retrieved encrypted data item using a result of decrypting the retrieved encrypted data encryption key.

Systems and methods for interacting with smart documents are disclosed. The system includes a document user interface that receives access requests, communicates with the smart document, and displays the content of the document. Features include rendering layouts tailored to user roles and devices, authentication mechanisms, and security measures such as screenshot prevention and client-side encryption, among a variety of others. The interface may support multi-panel displays, dynamic configurations, and other functionality like scheduling reports, marketing actions, and due diligence processes. Various other methods, systems, and features are also disclosed.

The application provides a homomorphic convolution acceleration method based on approximate fast Fourier transform, and belongs to the technical field of algorithm optimization of privacy calculation.The method mainly comprises client encryption, server-side calculation and client decryption, uses the fault tolerance feature of homomorphic convolution to perform optimized calculation on the homomorphic convolution, replaces the number theory transform NTT with fast Fourier transform FFT, and introduces an approximate method to further reduce the bit width, so as to reduce the hardware cost of each operation; in the process of determining the approximate FFT bit width, a multi-objective design space exploration method is adopted, different bit widths are used in multiple stages of fast Fourier transform, a space evaluation method based on a lookup table is designed, and multi-objective space exploration is performed on the space evaluation method, so that a design balance between calculation accuracy and power consumption is realized. The application is suitable for any convolution layer, reduces the overall overhead of homomorphic convolution, improves the calculation efficiency, and has a wide application prospect.

The application discloses an information encryption and decryption device, an information encryption method and an information decryption method. The device comprises an adaptation unit, a client encryption unit and a server decryption unit. The adaptation unit is used for determining a target encryption mode and informing the target encryption mode to the client encryption unit. The client encryption unit is used for encrypting to-be-transmitted information according to the target encryption mode to obtain information ciphertext, and sending the information ciphertext to the server decryption unit. The server decryption unit is used for receiving the information ciphertext sent by the client encryption unit, and decrypting the information ciphertext to obtain the to-be-transmitted information. The technical scheme of the embodiment of the application provides an information encryption and decryption device with rich encryption strategies, has strong portability, is isolated from business logic and page layout, well adapts to various application system platforms, and greatly reduces introduction cost.

A system and method for secure cloud storage of client-side encrypted data using a hierarchical encryption structure and a hierarchical storage structure to provide hierarchical key management and hierarchical data access.

The invention provides a stateless session recovery method, device and equipment for a TLCP protocol, and the method comprises the steps: determining a second client signature hash value based on a client signature certificate, and determining a second client encryption hash value based on a client encryption certificate; determining a second server-side signature hash value based on the server-side signature certificate, and determining a second server-side encryption hash value based on the server-side encryption certificate; if the signature hash value of the first client is the same as the signature hash value of the second client, the encrypted hash value of the first client is the same as the encrypted hash value of the second client, the signature hash value of the first server is the same as the signature hash value of the second server, and the encrypted hash value of the first server is the same as the encrypted hash value of the second server; and if not, recovering the session of the client, and establishing the TLCP connection with the client. According to the technical scheme, network bandwidth resources can be saved, computing resource consumption of the service server can be reduced, and connection establishment time is remarkably shortened.

The invention relates to a protein data encryption storage and operation method based on a TEE server cluster. The method comprises the following steps: performing encryption processing on protein data through an encryption algorithm, and storing encrypted data fragments in a TEE server cluster by adopting a distributed storage strategy; after the cluster credibility is verified, an encryption operation request of a client is received; performing comparison operation among the cluster nodes based on the encrypted data to generate an encryption result; and an encryption operation result is returned to the client through an authorization mechanism. By adopting the method, the confidentiality and integrity protection of the protein data in the whole process of storage, transmission and operation is realized, and the technical problems that the data is easy to leak and the operation is not credible in the traditional scheme are effectively solved.

The invention provides a homomorphic convolution acceleration method based on approximate fast Fourier transform, and belongs to the technical field of algorithm optimization of privacy calculation. The method mainly comprises client encryption, server calculation and client decryption, fault tolerance characteristics of homomorphic convolution are utilized, optimization calculation is carried out on the homomorphic convolution, NTT is replaced with FFT, and an approximation method is introduced to further reduce the bit width so as to reduce the hardware cost of each operation. In the process of determining the approximate FFT bit width, a multi-target design space exploration method is adopted, different bit widths are used in multiple stages of fast Fourier transform, a space evaluation method based on a lookup table is designed, and multi-target space exploration is carried out on the space evaluation method, so that design balance between calculation accuracy and power consumption is achieved. The method is suitable for any convolutional layer, reduces the overall overhead of homomorphic convolution, improves the calculation efficiency, and has a wide application prospect.

The application discloses a large model cloud end security reasoning chip architecture based on hardware encryption, which comprises a client encryption terminal, a cloud end security reasoning chip and a key management service.The client encryption terminal is integrated with a hardware encryption module, adopts a hybrid encryption strategy, encrypts user input data through a symmetric encryption algorithm, and realizes the safe distribution of session keys through an asymmetric encryption algorithm.The cloud end security reasoning chip is a special ASIC chip, adopts a multi-stage pipeline architecture, and comprises a ciphertext input processing unit, a secure calculation area, a ciphertext output processing unit and a security control and root of trust.The secure calculation area is a physically isolated chip area, and the decrypted input data, model weights and intermediate calculation results are circulated between the secure on-chip cache and the calculation unit in the area.The security control and root of trust are integrated with a physically unclonable function to realize hardware identity authentication.The key management service is a distributed key management system based on a PKI system, and supports key rotation, revocation and update operations.

Systems and methods for interacting with smart documents are disclosed. The system includes a document user interface that receives access requests, communicates with the smart document, and displays the content of the document. Features include rendering layouts tailored to user roles and devices, authentication mechanisms, and security measures such as screenshot prevention and client-side encryption, among a variety of others. The interface may support multi-panel displays, dynamic configurations, and other functionality like scheduling reports, marketing actions, and due diligence processes. Various other methods, systems, and features are also disclosed.

An electronic device and method for client-side encryption for virtual meetings is provided. The electronic device acquires one or more encryption keys for a virtual meeting session with one or more participant devices, where the electronic device includes a meeting client to join or host the virtual meeting session and to communicate with meeting clients of the one or more participant devices. The electronic device determines, in a duration of the virtual meeting session, first content to be transferred to the one or more participant devices, via the meeting client of the electronic device. The electronic device encrypts the determined first content by use of the one or more encryption keys and transfers the encrypted first content to a meeting server. The meeting server transfers the encrypted first content to the one or more participant devices.

Systems and methods for interacting with smart documents are disclosed. The system includes a document user interface that receives access requests, communicates with the smart document, and displays the content of the document. Features include rendering layouts tailored to user roles and devices, authentication mechanisms, and security measures such as screenshot prevention and client-side encryption, among a variety of others. The interface may support multi-panel displays, dynamic configurations, and other functionality like scheduling reports, marketing actions, and due diligence processes. Various other methods, systems, and features are also disclosed.

The invention discloses a cloud edge collaborative business process intelligent optimization method and device and a storage medium, and belongs to the field of business process optimization. The method comprises the following steps of: 1, preprocessing a local business process event log by a client, and calculating the support degree, the cost and the average cost lower bound of a plot with the length of m; 2, the client side encrypts the plot and uploads the plot and a calculation result to the server; 3, the server calculates the global confidence degree, the global average cost and the global average cost lower bound of the plots, the plots meeting the high correlation and low cost are added into a result set and a candidate set, and the plots meeting the high correlation and potential low cost are added into the candidate set; 4, the server generates m + 1 length candidate plots based on the candidate set, encrypts and distributes the m + 1 length candidate plots to the client; 5, the client side calculates the lower bound of the support degree, the cost and the average cost of the new candidate plot; and 6, circularly executing the steps 2-5 until no new candidate plot exists, and outputting a final result set.

The present invention discloses a method for securely distributing private electronic files, which relates to the field of information security technology. The method comprises: a sending end user securely loads a private electronic file, wherein the private electronic file includes basic information of each receiving end and private data corresponding to the basic information; a client encrypts the private electronic file and uploads it to a server; the server receives, re-encrypts and stores the private electronic file; the server sends a private electronic file viewing message to the receiving end user; the receiving end user receives the message and decrypts and views the private electronic file. The present invention greatly enhances the security of sending and receiving private electronic files.