75 results about "Cryptographic hardware" patented technology

A method includes: receiving, through a user interface at a computer system, information indicating a change to one or more aggregate operational parameters for cryptographic hardware assets remote from the computer system and communicatively coupled to the computer system through one or more networks; obtaining one or more hardware parameters for one or more of the cryptographic hardware assets; based on the one or more hardware parameters, identifying a subset of the cryptographic hardware assets to receive one or more adjustments to one or more computing parameters to cause the change to the one or more aggregate operational parameters; and sending instructions to the subset of the cryptographic hardware assets to effect the adjustment to the one or more computing parameters.

The invention relates to the technical field of electric digital data processing security, and discloses a solid state disk data encryption method and a solid state disk. According to the method, a national cryptographic algorithm hardware encryption and decryption co-processing module is serially arranged on a data bus between a main control chip and a flash memory particle array, so that transparent encryption of write-in data and transparent decryption of read-out data are realized; the module performs encryption and decryption based on an SM4 algorithm and an XTS advanced encryption standard mode in combination with a logic address as an adjustment value, and securely injects a root key through an out-of-band interface to derive a data key. The system comprises a main control chip, a flash memory array and the co-processing module, wherein the co-processing module is integrated with a hardware encryption and decryption engine, a key management unit and data flow control logic. On the premise that a general main control chip is not changed, high-performance, high-compatibility and high-security national cryptographic hardware-level full-disk encryption is realized.

The invention provides a task processing method and device, electronic equipment and a storage medium, and relates to the technical field of computers. The method comprises the steps of obtaining at least one task request operation instruction from an upper-layer application; distributing each task request operation instruction to a password acceleration resource component according to the target scheduling mode, and processing the task request operation instructions by the password acceleration resource component; the password acceleration resource component comprises a coprocessor and encryption hardware, and the target scheduling mode comprises proportional scheduling or polling scheduling; and respectively reading a processing result of the task request operation instruction corresponding to the coprocessor and a processing result of the task request operation instruction corresponding to the encryption hardware, and returning the read processing results corresponding to the task request operation instructions to the upper-layer application. According to the scheme, idle resources can be effectively and reasonably utilized, the processing burden of a processing engine in an application layer is effectively relieved, the task processing speed is increased, and the effects of all high-performance acceleration resources in a platform are dynamically exerted.

The invention discloses a secure communication method and system of an MQTT protocol based on a national cryptographic module, a server and a client based on MQTT protocol communication are both configured with the national cryptographic module, and the secure communication method comprises the following steps: the server and the client generate an initial key pair based on the national cryptographic module, signature verification is carried out based on a national cryptographic algorithm and the initial key pair, so that security identity authentication between the server and the client is realized; negotiating an encryption key between the server and the client based on a national secret algorithm; the client sends a connection message of an MQTT protocol encrypted based on an encryption key and a national cryptographic algorithm to the server, and verification of a client user name and a password is carried out; the MQTT protocol communication based on the encryption key and the national cryptographic algorithm is carried out based on the verification result, SM2 algorithm signature and signature verification are fused in the MQTT protocol based on the national cryptographic hardware cryptographic module, the SM4 algorithm is adopted to symmetrically encrypt and decrypt data transmitted by the MQTT protocol, the MQTT protocol conforming to the national cryptographic algorithm is designed, and the confidentiality of the data is ensured.

The invention discloses a multi-modal extensible high-performance homomorphic encryption system, and relates to the technical field of computer systems, the system comprises an upper-layer server software and drive architecture and a multi-modal homomorphic encryption hardware architecture realized based on an FPGA (Field Programmable Gate Array), which are in communication connection; the upper-layer server software and drive architecture comprises a multi-modal homomorphic encryption algorithm software library, a software memory scheduler, a modulo calculation module software drive and a floating point calculation module software drive; the multi-modal homomorphic encryption hardware architecture realized based on the FPGA comprises a communication data controller, a plurality of modulo calculation modules, a floating point calculation module, a data read-write bus and a high-bandwidth memory, and each modulo calculation module comprises a fast number theory transformation calculation unit. Through a software and hardware collaborative design scheme, the problem of low scheduling efficiency of ciphertext calculation tasks of different scales in hardware architecture design under multi-modal homomorphic encryption is solved, and the calculation efficiency is remarkably improved.

A computer-implemented method (CIM), according to one approach, includes generating a primary cryptographic recovery key, and generating an alternate cryptographic recovery key, where the alternate cryptographic recovery key is generated and stored in a cryptographic Hardware Security Module (HSM). The method further includes storing an encrypted fallback key in metadata associated with a data set, where the encrypted fallback key is an operational key encrypted by the primary cryptographic recovery key, and storing a Recovery Key Verification Pattern (RKVP) in the metadata, where the RKVP is associated with the primary cryptographic recovery key and is stored for the primary cryptographic recovery key. In response to a determination that the operational key is unavailable, the encrypted fallback key is retrieved to perform a data decryption operation.

A Web3 gamepad contains a secure element to hold the user's cryptographic identity to access their accounts with just the gamepad. These accounts are not limited to Web2 accounts, such as Netflix or Steam, but include Web3 accounts, to allow players to store access keys to a blockchain (NFTs . . . etc). The secure element can be removable if integrated into a hardware wallet module that is matable to the gamepad to allow for portability and compatibility with laptop / desktop, and to be able to substitute the gamepad in the event of accidental damage, without substituting the wallet.

The embodiment of the invention discloses an anti-quantum cryptography encryption method and device, an anti-quantum SIM (Subscriber Identity Module) card, equipment and a medium, the anti-quantum cryptography encryption method and device are applied to a terminal comprising the SIM card, the SIM card comprises a central processing unit, a post-quantum cryptography hardware accelerator, an input / output buffer area and a bus, and the central processing unit comprises an instruction cache unit. The method comprises the steps that a central processing unit receives an encryption request sent by an upper-layer application through an instruction cache unit and converts the encryption request into a set of instructions, and the set of instructions comprise a data loading instruction and a data encryption instruction; executing the data loading instruction to transmit the data to an input / output buffer area through a bus; and executing the data encryption instruction through the post quantum cryptography hardware accelerator so as to encrypt the data in the input / output buffer area. By adopting the embodiment of the invention, communication response delay caused by relatively long calculation time of the anti-quantum cryptography can be reduced, and post-quantum security encryption is supported in the SIM card.

A real time, on-the-fly data encryption system is operable to encrypt and decrypt data flow between a secure processor and an unsecure external memory system. Multiple memory segments are supported, each with its own separate encryption capability, or no encryption at all. Data integrity is ensured by hardware protection from code attempting to access data across memory segment boundaries. Protection is also provided against dictionary attacks by monitoring multiple access attempts to the same memory location.

Provided in the embodiments of the present disclosure are a method for configuring cryptographic hardware, a confidential computing method for data, and a related device. The method for configuring cryptographic hardware comprises: maintaining a device state of cryptographic hardware bound to a plurality of simulation devices, which device state is an idle state or a busy state, wherein one simulation device corresponds to one virtual machine, and a plurality of simulation devices are bound to the cryptographic hardware, such that the plurality of virtual machines share the cryptographic hardware by means of the corresponding simulation devices; and on the basis of the device state of the cryptographic hardware, processing a use request of a virtual machine for the cryptographic hardware by means of the simulation device corresponding to the virtual machine, such that the virtual machine uses the cryptographic hardware, wherein the virtual machine is any one of the plurality of virtual machines. The embodiments of the present disclosure can improve the utilization rate of cryptographic hardware by virtual machines.

The invention provides a starting method and device for a vehicle-mounted central domain controller, a vehicle and a storage medium, and the method comprises the steps: starting a bootstrap program after the central domain controller is powered on, and carrying out the self-inspection of built-in firmware of a preset encryption device when the bootstrap program succeeds in bootstrap loading; after firmware built in the encryption device passes self-inspection, checking a bootstrap program, a kernel file and a root file of a preset real-time operating system; after all verification succeeds, the real-time operating system is started, and a bootstrap program, a kernel file and a root file of a preset universal operating system are verified in sequence through firmware built in the encryption device; and after all verification succeeds, starting the universal operating system. According to the invention, through the improvement of the encryption hardware chip and the starting process, the data verification time is reduced, the starting process of the whole system is accelerated, and the security and reliability of the verification strategy file are ensured.

An information handling system includes a hardware processor and a memory device to execute code instructions of an automatic peripheral device pairing management system pairing agent to receive, via a wireless interface adapter, a device identifier composition engine (DICE) certificate from a wireless peripheral device indicating the identity of the wireless peripheral device, the DICE certificate including a public key. The hardware processor executes computer readable program code of an out-of-band (OOB) temporary key generator agent to generate an OOB temporary key. The hardware processor executes the computer readable program code of the automatic peripheral device pairing management system pairing agent to encrypt the OOB temporary key using the public key. The hardware processor to sends the public key-encrypted OOB temporary key to the wireless peripheral device to be decrypted using a private key at the wireless peripheral device. The hardware processor executes a confirm value generation function to confirm that the OOB temporary key matches the decrypted OOB temporary key at the wireless peripheral device to automatically Bluetooth® (BT) pair the information handling system to the wireless peripheral device.

The application discloses a kind of SM4 S box hardware implementation method and application based on redundant tower area, belong to information security technical field, including: using redundant tower area to express AES S box, and using little end order to express affine transformation;Give the conversion relationship between the S box of AES and SM4, and express affine transformation and constant offset using little end order;Based on step 1 and step 2, give the SM4 S box expression based on redundant tower area;Combined with the mask implementation of three-stage inverse of redundant tower area, complete the complete SM4 hardware design.The application first maps SM4 S box to the redundant tower area implementation framework of AES S box, by optimizing and merging multiple affine transformation layers and constant offset, realize high compact RTF-SM4.The S box is very easy to combine with mask class and double-track class and other gate-level side channel attack protection schemes, realize compact and anti-side channel attack SM4 hardware implementation, ensure the side channel security of encryption hardware.

The invention relates to hardware generated key encryption. A hardware generated encryption key is provided to enable per-file encryption of a file to be stored in a flash memory storage in a mobile device. The hardware generated encryption key is also used to decrypt the encrypted file stored in the flash memory storage. The hardware key manager is configured to provide an unlimited number of sub-keys generated from one or more base keys. The random number is applied to the base key to generate a sub-key. The hardware key manager transmits the subkey to the host controller interface via the first bus. Software on the mobile device does not have access to the value of the subkey. The flash memory storage drive transmits a command to the host controller interface via the second bus. The host controller interface includes a cryptographic engine that utilizes a subkey to encrypt data to be written to the flash memory storage or decrypt data read from the flash memory.

A computer-implemented method for completing self-executing cryptographic interaction protocols using a completion device is disclosed. The method comprises: establishing, by the completion device, a wireless connection with a source device; receiving, from the source device, a request for completion of a self-executing cryptographic interaction protocol; comparing the information that identifies the self-executing cryptographic interaction protocol or the source device to a configuration stored in the completion device; and based on the comparing resulting in a match: outputting, via an output component of the completion device, a first indication of the match between the information and the configuration; signing the self-executing cryptographic interaction protocol using a digital signature stored in a cryptographic hardware element of the completion device; and sending the signed self-executing cryptographic interaction protocol to the source device.

Systems and techniques for offloading encryption services are described herein. For example, a method may include receiving a request to provide an encrypted service type, and initiating an encryption algorithm in an encryption hardware component, where the encryption algorithm is associated with the encrypted service type. The method may also include applying the encryption operation to the data to obtain an encrypted result. The encryption operation is associated with an encryption algorithm. The method may also include storing at least a portion of the encryption result in a hardware register of the encryption hardware component. The encryption result is configured for performing an encryption action.

The invention discloses an SM4 S box hardware implementation method and application based on a redundant tower domain, and belongs to the technical field of information security, and the method comprises the steps: employing the redundant tower domain to represent an AES S box, and employing a small end sequence to represent affine transformation; giving a transformation relation between the S boxes of the AES and the SM4, and representing affine transformation and constant offset by adopting a small end sequence; based on the step 1 and the step 2, SM4 S box representation based on the redundant tower domain is given; and in combination with mask implementation of three stages of redundancy tower domain inversion, complete SM4 hardware design is completed. According to the method, the SM4 S box is mapped into the redundant tower domain implementation framework of the AES S box for the first time, and the high-compactness RTF-SM4 is realized by optimizing and combining a plurality of affine transformation layers and constant offsets. The S box is very easily combined with gate-level side channel attack protection schemes such as a mask type and a double-track type, so that compact SM4 hardware capable of resisting side channel attack is realized, and the side channel security of encryption hardware is ensured.

A real time, on-the-fly data encryption system is operable to encrypt and decrypt data flow between a secure processor and an unsecure external memory systen. Multiple memory segments are supported, each with its own separate encryption capability, or no encryption at all. Data integrity is ensured by hardware protection from code attempting to access data across memory segment boundaries. Protection is also provided against dictionary attacks by monitoring multiple access attempts to the same memory location.

The application discloses a dual-mode reduction operation system and method for lattice-based cryptography hardware acceleration, and relates to the technical field of cryptography and information security. The system comprises a routing control unit, which is used for receiving intermediate result data generated in a lattice-based cryptography algorithm operation process, and generating corresponding routing control signals according to the operation type of the intermediate result data, and outputting the intermediate result data and the routing control signals to corresponding data output ends; a first modular reduction operation unit, which is used for executing Montgomery reduction operation based on a prime number condition on corresponding intermediate result data when receiving a routing control signal of modular multiplication operation; and a second modular reduction operation unit, which is used for executing Barrett reduction operation with 2 as a base on corresponding intermediate result data when receiving a routing control signal of modular addition operation. The application can optimize the implementation performance of the algorithm without affecting the security, and is suitable for various software and hardware environments.

The present invention discloses a look-up table type threshold implementation method for PRESENT encryption and decryption, belonging to the field of cryptographic hardware design. The present invention includes an input selection layer, a first layer of round function, a second layer of round function, a third layer of round function, a fourth layer of round function, and a fifth layer of round function; first, based on the secondary decomposition of the S-box in the encryption part, the secondary decomposition derivation of the S-box inverse is carried out; then the threshold implementation of the non-linear function F in the decryption part is derived. ‑1 Based on the S-box decomposition in the encryption part, the present invention gives the inverse decomposition of the S-box in the decryption part, and also gives the look-up table type encryption and decryption threshold implementation method, which is applicable to the application scenarios that require both encryption and decryption for two-way operations; this method can be applied to various hardware platforms such as FPGA and ASIC to implement PRESENT.

The present invention discloses a data encryption system based on a storage-computing integrated architecture, and relates to the field of data encryption. The data encryption system based on the storage-computing integrated architecture includes: a data receiving subsystem, a storage subsystem, an encryption subsystem, and an output subsystem; the data receiving subsystem is used to receive data to be encrypted and perform preprocessing; the storage subsystem is used to pre-store static parameters in the encryption algorithm, specifically a rotation factor array and a modulus; the encryption subsystem is used to call the static parameters in the encryption algorithm pre-stored in the storage subsystem to perform number theory transformation encryption processing on the pre-processed data to be encrypted. The present invention uses the storage-computing integrated architecture adopted by the encryption subsystem to perform the polynomial multiplication calculation with the largest overhead in the cryptographic algorithm at high speed and low power consumption, and combines number theory transformation and modular reduction operations at the same time, thereby solving the speed and power consumption bottleneck problems caused by data handling in the traditional cryptographic hardware architecture.

The invention discloses a parallel computing platform, method, system and equipment based on an SM2 signature algorithm, and belongs to the technical field of data encryption. The system comprises a bus which reads and writes data stored in an external storage unit and obtains an encryption task or a decryption task; the working queue storage unit is used for sequentially storing the encryption tasks or the decryption tasks to obtain a task queue; a plurality of cryptographic hardware accelerators; and the command execution unit is used for obtaining the encryption tasks or the decryption tasks from the task queue in sequence, and distributing one or more of the password hardware accelerators to the corresponding encryption tasks or decryption tasks according to the task commands corresponding to the obtained multiple parallel encryption tasks or decryption tasks.

The invention discloses a cooperative hardware security terminal architecture based on a glass vacuum cavity, which comprises an independently arranged glass vacuum cavity security module, can cooperatively work with an existing terminal main processor, and realizes hardware-level security upgrade on the premise of not influencing original performance and use experience. The glass vacuum cavity adopts two selectable sealing processes, so that both mass production and flexibility are considered; and a national security level hardware security unit is integrated in the cavity to realize key storage and encrypted transmission. An end-cloud collaborative architecture is adopted, sensitive data are not stored locally, and the security module can realize physical transplantation. The method is high in compatibility, does not depend on an advanced process, is high in physical attack resistance, can be widely applied to various smart phones and high-security-level terminals, and has high practicability and market value.

A method of generating true random numbers for use by a cryptographic hardware component for cryptographic algorithms or communication protocols, and a cryptographic hardware component for cryptographic algorithms or communication protocols. The method comprises the steps of controlling a clock pulsewidth, PW, for pulsed-latch clocking in the cryptographic hardware component to switch between using the cryptographic hardware component to generate the true random numbers in a first operating state; and using the cryptographic hardware component for cryptographic processing in a second operating state.

The application discloses a kind of based on converter ripple communication's collaborative noise masking secure communication method and system, applied to including at least two power electronic converters and the power transmission line connected to its power electronic system;Source converter superimposes information signal in power control loop, and forms information carrier in power transmission line by pulse width modulation;Sink converter synchronously superimposes collaborative noise signal in power control loop, and injects collaborative noise carrier with the same frequency as information carrier in power transmission line, so that information carrier and collaborative noise carrier are superimposed to form hybrid carrier on power transmission line;Sink converter constructs noise transfer characteristic estimation model using collaborative noise signal injected by itself, and carries out collaborative noise carrier component elimination processing to recover information carrier;The application does not need to add new communication line or special encryption hardware, and can realize the improvement of power electronic system communication security.

The invention relates to the technical field of industrial host software, and provides an authorization permission detection method applied to industrial host software, which comprises the following steps: S1, finishing authorization system deployment on a host running the industrial software; s2, when the industrial software is triggered to run according to a preset time interval, the industrial software calls an authorization SDK interface function to initiate an authorization state verification request and an authorization SDK packaging request and then transmits the authorization state verification request and the authorization SDK packaging request to a kernel layer drive program; s3, the driving program calls a process protection module to detect the safety of a software operation environment, initiates an encryption calling request to the safety encryption hardware through the USB bus after confirming that no abnormity exists, and then returns a result to the driving program; s4, the drive program transmits the encryption result to the authorization SDK in a transparent manner, the SDK decrypts the encryption result to obtain a plaintext result and feeds the plaintext result back to the industrial software for operation, and the industrial software modifies an internal authorization flag bit according to the result; and S5, safety monitoring and connection verification are maintained in the whole detection process. The problem that a traditional industrial software authorization mode is prone to being counterfeited or cracked is solved.

Hardware-generated encryption keys are provided to enable per-file encryption of files to be stored in flash storage in a mobile device. Hardware-generated encryption keys are also used to decrypt encrypted files stored in the flash storage. A hardware key manager is configured to provide an unlimited number of child keys generated from one or more base keys. A nonce is applied to a base key to generate the child key. The hardware key manager communicates the child key to a host controller interface via a first bus. Software on the mobile device does not have access to the value of the child keys. A flash storage driver communicates commands to the host controller interface via a second bus. The host controller interface includes a cryptographic engine that utilizes the child keys to encrypt data to be written to the flash storage or decrypt data read from the flash storage.

The application discloses a multi-modal scalable high-performance homomorphic encryption system, and relates to the technical field of computer systems, which comprises an upper-layer server software and a driving architecture in communication connection and a multi-modal homomorphic encryption hardware architecture realized based on FPGA; the upper-layer server software and the driving architecture comprise a multi-modal homomorphic encryption algorithm software library, a software memory scheduler, a modulo calculation module software driver and a floating-point calculation module software driver; the multi-modal homomorphic encryption hardware architecture realized based on FPGA comprises a communication data controller, a plurality of modulo calculation modules, a floating-point calculation module, a data read-write bus and a high-bandwidth memory; each modulo calculation module comprises a fast number theory transformation calculation unit. Through the design scheme of software and hardware cooperation, the application solves the problem of low scheduling efficiency of different-scale ciphertext calculation tasks under multi-modal homomorphic encryption in the design of hardware architecture, and significantly improves the calculation efficiency.

Method for configuring a payment terminal and the associated payment terminal. The proposed technique relates to a method for configuring a payment terminal. The method comprises a step (11) of loading, into a secure memory of the payment terminal, firmware comprising several different cryptographic methods, each of which is designed to allow a third party possessing the appropriate cryptographic hardware for the method in question to subsequently perform operations to verify the authenticity and integrity of at least one application installed on the payment terminal.