46 results about "Cryptographic protocol" patented technology

A computer-implemented method and system for privacy-preserving location verification in distributed networks comprises initializing a multi-modal biometric authentication system on a user device, generating cryptographic keys using a distributed key generation protocol, binding the cryptographic keys to biometric templates using a fuzzy vault scheme, constructing and broadcasting encrypted location beacons, and generating zero-knowledge proofs of location claims. The system includes user devices equipped with biometric sensors and verifier devices configured to validate location claims and maintain consensus in a blockchain network. The method implements real-time liveness detection for multiple biometric input types, executes fault-tolerant consensus algorithms with privacy preservation, and maintains a dual-scoring mechanism comprising device trust scores and user reputation scores. The system enables secure location verification while preserving user privacy through cryptographic protocols and biometric authentication in decentralized environments.

The invention discloses an Internet of Things test platform adaptation method, system and device based on post quantum cryptography. The method comprises the following steps: constructing a quantum threat perception model; establishing a multi-dimensional adaptive decision matrix, and generating a candidate post-quantum cryptography algorithm set; dynamic injection of a cryptographic protocol is executed, and lossless replacement of a communication layer encryption suite is achieved; deploying a runtime performance monitoring engine, and collecting encryption and decryption delay, memory occupancy rate and electromagnetic radiation characteristic data in real time; and constructing an algorithm switching decision tree based on reinforcement learning, and when a quantum attack feature or an equipment performance threshold is detected to break through, triggering cryptographic algorithm dynamic migration. A quantum threat perception driven Internet of Things security adaptation system is constructed, and by introducing a dynamic password switching mechanism, a hardware acceleration optimization scheme and a trusted execution environment, the security upgrading problem of traditional Internet of Things equipment in the post-quantum era is solved. According to the invention, the execution efficiency of the PQC algorithm of the resource-constrained equipment can be improved, and the key updating delay is reduced.

The invention discloses a cryptographic algorithm and protocol test system, the system is configured into two deployment modes: a transparent mode and a man-in-the-middle mode, the transparent mode can hide an IP or MAC address of a device, and certificate and algorithm information in a cryptographic protocol is identified and analyzed through a passive traffic analysis mode; the man-in-the-middle mode provides a dynamic packet changing function, realizes a dynamic interaction function with a server in an agent mode, can be used for application scenarios such as identity authentication, data encryption and decryption, protocol vulnerability analysis and performance test, can effectively improve the evaluation integrity and accuracy of a cryptographic algorithm and a cryptographic protocol, forms a complete and accurate test evaluation evidence chain, and improves the evaluation efficiency of the cryptographic algorithm and the cryptographic protocol. And the detection evaluation result is effectively supported. The system can be accessed to a production network to capture, identify and analyze network traffic, so that an international / national cryptographic algorithm and protocol security analysis function is realized, and verification and analysis on compliance, correctness, effectiveness and the like of password application in an important network and information system can be realized.

The invention relates to the technical field of data security, in particular to a federated learning-based distributed privacy data security aggregation method, which comprises the following steps of: acquiring multi-source heterogeneous data of a leaf supplier node; performing weighted fusion on the multi-source heterogeneous data by using the multi-modal fusion model to generate a health state vector; training by using the health state vector in combination with a blade X-ray defect data set to obtain a local model; calculating a leakage risk score, and performing privacy processing on the local model through a differential privacy mechanism to obtain a noise adding model; calculating the reference data set by using a noise adding model to obtain a performance score, and generating an encryption proof for a calculation process; and the central server receives the zk-SNARK encryption proof submitted by all the nodes, converts the performance score into an aggregation weight, initiates a secure multi-party computing protocol, and performs weighted calculation on the noise adding model by using the aggregation weight to generate a global model. According to the method, multi-party safe and credible collaborative modeling is realized by fusing multiple cryptographic protocols.

Embodiments are directed to methods and systems for crypto-agile encryption and decryption. A computer system can possess a protocol file that identifies one or more cryptographic software modules. Using these cryptographic software modules, the computer system can generate a plurality of shared secrets and a session key, then use the session key to encrypt a message. The message can be sent to a server computer that can subsequently decrypt the message. At a later time, the protocol file can be updated to identify a different set of cryptographic software modules, which can be used to encrypt messages. Further, the server computer can transmit additional cryptographic software modules to the computer system, enabling the computer system to use those cryptographic software modules to generate cryptographic keys. As such, the cryptographic protocol file can be changed in response to changes in the cryptographic needs of the computer system.

A system and method for altering client fingerprint that includes editing data components of network communication from a client device to a server, which comprises editing network protocol data from the client during negotiation of a cryptographic protocol; selectively enabling access to library components specified in the edited client network protocol data; and sending a client communication to the server using the edited client network protocol data.

A system (100) for quantum-resistant routing via dynamic cryptographic switching in a WAN or SD-WAN environment, the system comprising: (a) a threat intelligence and crypto resilience assessment module configured to monitor cyber threats in real time and assess the security level of active cryptographic protocols; (b) a Dynamic Crypto Switching Module operatively connected to the assessment module and configured to automatically switch between classical cryptographic algorithms and post-quantum cryptographic algorithms based on the assessed threat levels; c) an SD-WAN policy integration and orchestration module configured to enforce organizational policies related to security, compliance, and performance to control cryptographic transitions; (d) an adaptive routing and path selection module configured to select network paths based on real-time security assessments and cryptographic strength; (e) a cryptographic compatibility and interoperability layer configured to manage encryption protocol handshakes and fallback mechanisms and to support communication between classical and post-quantum-enabled endpoints; f) and an audit, compliance and analytics dashboard configured to log cryptographic transitions, generate compliance reports and provide real-time visibility into system operations; g) whereby the system dynamically adapts encryption protocols and routing paths in response to evolving quantum and classical cybersecurity threats, thereby ensuring secure, continuous and compliant data transmission over WAN or SD-WAN networks.

The invention discloses an identity-based signature method supporting multi-message aggregation. The identity-based signature method comprises the steps of system initialization and key generation, user signature key generation, message signature construction, single signature verification, signature aggregation and aggregation signature verification. Due to the fact that the linear homomorphic signature technology is adopted, the identity-based aggregation signature method is provided, and the technical problems of signature after aggregation, key size expansion and the like in the existing aggregation signature technology are solved. Through the method, a verifier can safely and efficiently merge a plurality of signatures into a signature with a compact size, efficient data source authentication can be realized while the data integrity is guaranteed, and the verification efficiency is remarkably improved. The method has the advantages of high security, low communication cost, small calculation overhead and the like, can be applied to the technical fields of large-scale data authentication, distributed system security, lightweight cryptographic protocols and the like, and is particularly suitable for mobile terminals or Internet of Things equipment scenes with limited calculation resources.

The embodiment of the application discloses a self-defined encryption protocol clustering method and device, the method comprises the following steps: obtaining a target encryption protocol to be identified, and extracting traffic data and metadata of the target encryption protocol; constructing a label matrix and a value matrix based on the traffic data; and fusing the label matrix and the value matrix by using a multi-mode matching algorithm to obtain a clustering label. In this way, the self-defined encryption protocol clustering method provided by the application combines double-matrix combination with a pattern matching algorithm to realize clustering of self-defined encryption protocols. The method solves the problem that mixed self-defined protocols cannot be quickly and accurately clustered, and provides support for subsequent protocol analysis by quickly and accurately realizing clustering of self-defined protocols.

The present application belongs to the technical field of network security and artificial intelligence, and provides a large language model driven password protocol automatic formalization modeling method and system, acquires a natural language protocol specification document, and performs preprocessing; according to the priority order of a message block, a verification block and a calculation statement, a large language model extracts corresponding semi-structured intermediate representations from text blocks; all intermediate representation statements are scanned at one time by using the large language model, protocol functions and symbols are identified and stored in a knowledge base, the large language model is driven in units of intermediate representation statements to be refined one by one, and global context and local context are extracted; the completely structured intermediate representations, a protocol role set and the updated knowledge base are taken as inputs to perform deterministic one-to-one mapping with formal verification tool code, and conversion is completed. The present application can automatically generate symbol model code which can be directly input into a formal verification tool.

The present invention discloses a secure communication method and system based on national cryptographic algorithms and an improved Modbus TCP protocol. The secure communication method includes: sharing an initial public key between a host and a slave; establishing a TCP connection between the host and the slave and generating random numbers respectively based on a cryptographic module; performing signature verification on the random numbers using national cryptographic algorithms to achieve secure identity authentication between the host and the slave; negotiating an encryption key between the host and the slave based on national cryptographic algorithms; and performing data transmission between the host and the slave based on the encryption key. The present invention improves the standard Modbus TCP protocol, adds a security check field to achieve anti-replay attack, and expands the design of the national cryptographic protocol by combining the SM2 asymmetric algorithm and the SM4 symmetric algorithm to ensure data confidentiality. By configuring a cryptographic module for national cryptographic authentication, functions such as cryptographic operations, key generation, and random number generation of the host / slave are supported. Thus, secure and compliant communication based on the improved Modubs TCP protocol in an industrial system is achieved.

A circuit arrangement includes a plurality of cryptographic accelerators. Each cryptographic accelerator is configured to perform cryptographic operations according to a respective cryptographic protocol. A first memory is coupled to the cryptographic accelerators. A first processor is configured to specify, in response to requests to perform the cryptographic operations, parameters to the cryptographic accelerators according to the requests. The first processor is configured to identify, in the first memory, keys that are associated with the cryptographic accelerators, and signal the cryptographic accelerators to commence performing the cryptographic operations according to the parameters and using the associated keys.

The invention relates to the technical field of network information security, in particular to a password definition security architecture and a rule execution method, the architecture comprises a device plane, a security plane, a computing plane, a network plane, a data plane, a rule plane and an application plane, and each plane realizes execution of security rules in a password protocol mode. The rule execution method of the password definition security architecture comprises the following steps: after an information system is initialized, planning a routing path, authenticating password definition security equipment on the path, establishing a security access channel by adjacent equipment to ensure the routing security of data on the path, and then packaging each packet of data based on a service data identifier to obtain a password definition security architecture; according to the method, service slicing and protocol filtering based on the authorization credential are realized, and then safe forwarding is performed according to a routing path specified by the authorization credential, so that covert channels and illegal external connection are prevented, and the safety of the whole access request session depends on the safety rule of the authorization credential. According to the invention, the security and compliance of the business data in the circulation process can be ensured.

This application relates to a control method for a multi-protocol switching quantum-resistant security gateway. The method includes, after the security gateway powers on, performing a hardware environment security self-test and generating a unique root key based on a physically non-cloning function; continuously collecting and analyzing network traffic characteristics; identifying quantum attack patterns and dynamically deciding on encryption algorithm modes based on a machine learning model; parsing communication data packets; dynamically converting and adapting between traditional and quantum-resistant cryptographic protocols according to instructions and preset rules; calling a quantum-resistant cryptographic engine for encryption or signature operations; dynamically deriving and managing session keys throughout their lifecycle based on the root key; and, based on quantum attack detection results, switching algorithm modes, communication protocols, and keys in a coordinated manner, while also enabling side-channel attack protection and hardware security response. This method achieves proactive protection against quantum attacks, seamless multi-protocol compatibility, and full lifecycle security management of keys for the security gateway.

The present application relates to the technical field of network information security, and particularly relates to a password definition security architecture and a rule execution method, the architecture comprising a device plane, a security plane, a calculation plane, a network plane, a data plane, a rule plane and an application plane, each plane implementing execution of a security rule through a password protocol mode. The rule execution method of the password definition security architecture comprises, after initialization of an information system, planning a routing path, authenticating password definition security devices on the path, establishing a secure access channel between adjacent devices to guarantee routing security of data on the path, then encapsulating each packet of data based on business data identification to implement business slicing and protocol filtering based on an authorized credential, then performing secure forwarding according to a routing path specified by the authorized credential to prevent hidden channels and rule violations, and the security of an entire access request session depends on the security rule of the authorized credential. The present application can ensure security and compliance of business data in a flow process.

This invention provides a method and system for detecting and warning of anomalies in encryption protocols, belonging to the field of network security technology. The method includes: extracting a multimodal feature set from the target encryption protocol communication stream; inputting it in parallel into an adaptive rule engine and an interpretable artificial intelligence model to obtain rule-triggered events and confidence weights, a first anomaly score, and an attribution explanation report, respectively; calculating a second anomaly score based on the above outputs using an improved scoring algorithm; fusing the first and second anomaly scores to obtain a comprehensive anomaly score and generating a warning decision; and uploading the warning information to a federated collaborative node to drive the collaborative evolution of the global rule base and the model. This invention, employing the aforementioned method and system for detecting and warning of anomalies in encryption protocols, solves the collaborative problems of poor interpretability, lagging knowledge updates, and data silos in encryption threat detection through deep collaboration between an interpretable artificial intelligence model and a rule engine, achieving accurate, reliable, and adaptive anomaly warnings.

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for using cryptographic protocols to generate network measurements in privacy preserving ways are described. In one aspect, a method includes sending, by a network measurement system and to a client device, data indicating a size for a partial identifier for an application of the client device. The network measurement system receives, from the client device, (i) a partial masked identifier generated by masking a complete identifier for the client device or a user of the client device and removing a portion of a resulting complete masked identifier based on the size and (ii) a first encrypted identifier generated by encrypting the complete masked identifier using an encryption key of the client device.

A system and method for distributed data intersection using privacy preserving collaborative detection is disclosed The system includes a processor and a memory that causes the processor to verify data sets and configurations from a first and second entity interacting in a distributed data intersection to ensure data integrity and privacy during a data collaboration. The processor enables computations between the first and second entity using cryptographic protocols to identify common data points. The processor allows the first and second entity to retrieve the common data points pertaining to other entity using a oblivious data sharing technique while maintaining confidentiality of the data accessed during the interaction. The processor facilitates validation of data integrity and accuracy without revealing underlying information. The processor controls data-sharing policies ensuring that authorized data is disclosed based on a predefined criteria thereby enabling collaboration of data for re-identification while protecting privacy.

In one embodiment, a method includes receiving a traffic flow including a plurality of packets encrypted using a cryptographic protocol, determining cryptographic protocol data of the traffic flow, and transmitting telemetry data of the traffic flow including the cryptographic protocol data. In another embodiment, a method includes receiving telemetry data of a traffic flow including a plurality of packets encrypted using a cryptographic protocol, the telemetry data including cryptographic protocol data of the traffic flow, classifying the traffic flow based on the cryptographic protocol data using a machine learning classifier; and taking a remedial action with respect to the traffic flow based on the classification of the traffic flow.

The invention belongs to the field of data encryption transmission, and particularly discloses a black box data transmission method based on quantum key encryption, and the method comprises the steps: generating a quantum key, carrying out the post-processing of the quantum key, and carrying out the data transmission based on the quantum key. According to the scheme, the quantum key encryption technology is adopted, and the encryption security is improved by using the unclonable principle of quantum and the uncertainty of quantum state; a quantum key is generated based on an improved BB84 quantum cryptographic protocol, a safe public two-way communication channel is established with a receiver to transmit the quantum key, and the safety of black box data in the transmission process is guaranteed; a substitution box is designed to perform confusion transformation on a quantum key, an initial substitution box is generated by using discrete chaotic mapping, and the substitution box is optimized through a migrant bird search algorithm, so that the security of the key is enhanced, and the noise resistance of data transmission is improved.

The invention discloses an anti-quantum enhancement method and an anti-quantum enhancement device for a stock password equipment system. On the premise of not changing the hardware architecture of stock classical cryptographic equipment, an anti-quantum cryptographic card or entrance guard type anti-quantum security enhancement equipment is connected with the anti-quantum cryptographic card or entrance guard type anti-quantum security enhancement equipment to provide anti-quantum security enhancement; the stock classical cryptographic equipment system refers to a cryptographic chip, a cryptographic machine, a signature verification machine, a gateway, a software system and the like which are deployed and cannot resist quantum attacks; the anti-quantum cryptographic card is a cryptographic card supporting a classical cryptographic algorithm and an anti-quantum cryptographic algorithm, a classical cryptographic chip, an anti-quantum FPGA chip and other components are arranged on the anti-quantum cryptographic card, and the anti-quantum cryptographic card is connected with stock classical cryptographic equipment through a PCIe interface. The entrance guard type anti-quantum security enhancement equipment is electronic equipment which is deployed between classical cryptographic equipment and a public network and carries out anti-quantum security protection on a Diffie-Hellman type cryptographic protocol, so that a session key cannot be exported even if communication between entrance guard type equipment is acquired by an enemy.

Described herein are systems and methods for fraud detection in network operations. The method may receive a request for execution of a network operation, the request including a first identifier associated with a user device. The method may extract, using the first identifier, attributes of the network operation and user device attributes. The method may extract a second identifier previously generated for the user device. The method may execute a cryptographic protocol using the second identifier and a cryptographic key to generate a first authentication code. The method may execute a machine learning model to predict a likelihood of fraud using mismatched attributes based on determining that the first authentication code matches a second authentication code parsed from the first identifier. The method may reject the request to execute the network operation in response to determining that a prediction of likelihood of fraud fails to satisfy a security threshold.

Novel tools and techniques might provide for implementing secure communications for IoT devices. In various embodiments, a gateway or computing device might provide connectivity between or amongst two or more Internet of Things (“IoT”) capable devices, by establishing an IoT protocol-based, autonomous machine-to-machine communication channel amongst the two or more IoT capable devices. For sensitive and / or private communications, the gateway or computing device might establish a secure off-the-record (“OTR”) communication session within the IoT protocol-based, autonomous machine-to-machine channel, thereby providing encrypted machine-to-machine communications amongst the two or more IoT capable devices, without any content of communications that are exchanged amongst the IoT capable devices over the secure OTR communication session being recorded or logged. In some cases, the secure OTR communication session utilizes cryptographic protocols including, without limitation, one or more of AES symmetric-key algorithm, Diffie-Hellman key exchange, SHA-1 hash function, forward secrecy, deniable authentication, malleable encryption, and / or the like.

The present application provides a method, device, electronic device, and storage medium for testing a VPN device with national cryptographic algorithms. Among them, the testing method is applied to a testing terminal, and the GMSSL testing tool is pre-installed on the testing terminal. The GMSSL testing tool is used to obtain user login information and simulate a login session based on the user login information. The testing method includes: sending multiple authentication login requests to the VPN device to be tested in a multi-threaded concurrent manner or a multi-process concurrent manner, and maintaining the login session corresponding to each authentication login request; based on the processing results of the VPN device to be tested for the multiple authentication login requests, counting the maximum number of online users of the VPN device to be tested per unit time; calculating the average value of the maximum number of online users obtained from multiple tests; and obtaining a new test value. The present application can be used to simulate and test the usage environment of a VPN device under a real national cryptographic protocol, and then test the VPN device based on the real usage environment of the VPN device, thereby improving the testing accuracy of the VPN device.

The application relates to the technical field of anti-quantum computing, in particular to a mixed authentication handshake method fusing an anti-quantum algorithm and a national secret protocol, acquiring a national secret and an anti-quantum path key segment, extracting a number and a source to write a handshake structure, completing position comparison and chain numbering, adjusting segment positions in the structure and synchronizing fields, executing number checking and data block shifting, promoting content insertion and frame structure updating, and completing the mixed authentication handshake structure. The application marks key segment numbers, sources and stages, binds writing paths in combination with positions and promotion data, introduces chain numbering to control segment sequences in combination with source comparison, adjusts segment distribution in combination with position exchange and field synchronization, enhances structure scheduling capability, processes conflicts and overlaps in combination with number checking and data block shifting, promotes parallel insertion in combination with a handshake identifier written in a channel, and improves structure consistency and data bearing integrity.

The application discloses an electronic signing system and method based on commercial cryptographic technology and a storage medium, and particularly relates to the field of distributed storage security technology. The electronic contract signing request is initiated at a first signing node, and the signing data is encrypted using a commercial cryptographic algorithm, and then the encrypted data is distributed to multiple signing nodes using the security channel of the commercial cryptographic protocol. After receiving the signing request, each signing node verifies the signing data and the key state using a distributed consistency algorithm, generates a local signature after verification, and aggregates the local signature to form a final signature result. A fuzzy logic-based analytic hierarchy model and a time series decomposition model are used to analyze the path and response consistency of the signing nodes to determine the credibility of the signature result. When the result is credible, the signed electronic contract is stored in a distributed ledger, and if the result is not credible, a re-verification mechanism is triggered to ensure the security and consistency of the signing data.

The invention provides a time series data transaction privacy protection method based on quality spot check and identity verification. The method comprises the following steps: carrying out adaptive partitioning on original time series data of a seller; adding trace noise, and selecting a block to embed a spread spectrum watermark; encrypting the data block and the watermark key; the buyer randomly checks the specified block based on the metadata, the platform verifies the noise consistency through inverse element subtraction, and the transaction is completed if both the buyer and the platform confirm that the noise consistency is correct. According to the method, the attention mechanism is utilized to dynamically block the original data in real time, so that redundancy is reduced, and the processing efficiency is improved; server behaviors are constrained through a cryptographic protocol, the balance of privacy, efficiency and supervision is realized, and whether data are from illegal resale can be verified without decrypting plaintexts through watermark tampering prevention and micro-noise original-sample multiplexing prevention.

The invention relates to an anti-quantum cryptography hybrid programming language program verification method and an anti-quantum cryptography hybrid programming language program verification system. The method comprises the following steps: inputting a password protocol program to be verified in Rocq based on a hybrid programming language; subprograms in the cryptographic protocol program are modeled in a formalized mode through a module system, and classic program behaviors and quantum program behaviors in the cryptographic protocol program are described based on a unified grammar framework of a hybrid programming language; performing type checking and grammar checking on a program written based on a unified grammar framework and a module system; generating semantics of the program according to grammar for the program passing the check; protocol properties needing to be proved are described in a formalized mode according to grammar; establishing an inference rule based on program rewriting on the basis of grammar; and carrying out interactive certification on the formally described protocol property in the Rocq by using a certification strategy of the Rocq. According to the method, the security of the complex password protocol can be completely and accurately described and automatically verified, and the verification reliability and efficiency are remarkably improved.

A cryptographic protocol system where plural images are held on behalf of plural parties by plural respective providers includes the following steps, choosing a first subset of providers by a first party; choosing a second subset of providers by a second party; storing images under control of a first party held by the first subset of the providers; storing images under control a second party held by the second subset of providers; choosing first ratios by a first party between providers of the first set; choosing second ratios by a second party between providers of the second set; and transferring images from control of the first party to control of the second party by decreasing those under control of the first party substantially according to the first ratios and increasing the images under control of the second party substantially according to the second ratios.

The application provides a transaction management method, medium and device of a password protocol based on transaction messages, the method comprising: using an application system of a password protocol and a message middleware, executing the password protocol in the application system, steps A and B of the password protocol having transaction characteristics, and the transaction characteristics of both parties being guaranteed by transaction messages of the message middleware; wherein the application system records transaction information of each execution by establishing a transaction table, and different transactions are distinguished by a transaction ID field in the transaction table. The application can solve the data consistency problem between password protocol steps having distributed transaction characteristics or between two password protocols.