53 results about "Cryptographic protocol" patented technology

A computer-implemented method and system for privacy-preserving location verification in distributed networks comprises initializing a multi-modal biometric authentication system on a user device, generating cryptographic keys using a distributed key generation protocol, binding the cryptographic keys to biometric templates using a fuzzy vault scheme, constructing and broadcasting encrypted location beacons, and generating zero-knowledge proofs of location claims. The system includes user devices equipped with biometric sensors and verifier devices configured to validate location claims and maintain consensus in a blockchain network. The method implements real-time liveness detection for multiple biometric input types, executes fault-tolerant consensus algorithms with privacy preservation, and maintains a dual-scoring mechanism comprising device trust scores and user reputation scores. The system enables secure location verification while preserving user privacy through cryptographic protocols and biometric authentication in decentralized environments.

The invention discloses an Internet of Things test platform adaptation method, system and device based on post quantum cryptography. The method comprises the following steps: constructing a quantum threat perception model; establishing a multi-dimensional adaptive decision matrix, and generating a candidate post-quantum cryptography algorithm set; dynamic injection of a cryptographic protocol is executed, and lossless replacement of a communication layer encryption suite is achieved; deploying a runtime performance monitoring engine, and collecting encryption and decryption delay, memory occupancy rate and electromagnetic radiation characteristic data in real time; and constructing an algorithm switching decision tree based on reinforcement learning, and when a quantum attack feature or an equipment performance threshold is detected to break through, triggering cryptographic algorithm dynamic migration. A quantum threat perception driven Internet of Things security adaptation system is constructed, and by introducing a dynamic password switching mechanism, a hardware acceleration optimization scheme and a trusted execution environment, the security upgrading problem of traditional Internet of Things equipment in the post-quantum era is solved. According to the invention, the execution efficiency of the PQC algorithm of the resource-constrained equipment can be improved, and the key updating delay is reduced.

The invention discloses a post-quantum TLCP protocol design method, device, equipment and medium, and relates to the field of information security, the post-quantum TLCP protocol design method is applied to a client, and the post-quantum TLCP protocol design method comprises the following steps: constructing client handshake information based on an information security technology transport layer cryptographic protocol, and sending the client handshake information to a server to receive returned server handshake information and establish connection; receiving a server-side digital certificate constructed based on the cryptographic algorithm encrypted public key information and the post-quantum key encapsulation algorithm public key information of the server-side and server-side key exchange information constructed based on the post-quantum key encapsulation algorithm and the cryptographic algorithm; and performing identity authentication based on the post-quantum digital signature algorithm public key information and the national cryptographic algorithm signature public key information to construct a pre-master key for data transmission. An active public key cryptographic algorithm and functions are reserved in an information security technology transport layer cryptographic protocol, and a post-quantum public key cryptographic algorithm is put into the protocol, so that the quantum security is realized while the active public key cryptographic security is realized.

In some embodiments, there is provided a system, which comprises a processor, and at least one non-transitory computer readable media storing instructions. The stored instructions, when executed by the processor, cause the processor to perform operations comprising initiating a cryptographic protocol between a first computing environment and a second computing environment, the initiating including: securing, in association with the second computing environment, content associated with data of a user associated with the first computing environment, and securing, in association with the first computing environment, a parameter associated with a trained machine learning model, implementing the trained machine learning model on the data that is secured, the machine learning model operating on the first computing environment and the second computing environment, determining an output associated with the data that is secured, responsive to the implementing of the trained machine learning model, and providing the output to the first computing environment.

The invention discloses a cryptographic algorithm and protocol test system, the system is configured into two deployment modes: a transparent mode and a man-in-the-middle mode, the transparent mode can hide an IP or MAC address of a device, and certificate and algorithm information in a cryptographic protocol is identified and analyzed through a passive traffic analysis mode; the man-in-the-middle mode provides a dynamic packet changing function, realizes a dynamic interaction function with a server in an agent mode, can be used for application scenarios such as identity authentication, data encryption and decryption, protocol vulnerability analysis and performance test, can effectively improve the evaluation integrity and accuracy of a cryptographic algorithm and a cryptographic protocol, forms a complete and accurate test evaluation evidence chain, and improves the evaluation efficiency of the cryptographic algorithm and the cryptographic protocol. And the detection evaluation result is effectively supported. The system can be accessed to a production network to capture, identify and analyze network traffic, so that an international / national cryptographic algorithm and protocol security analysis function is realized, and verification and analysis on compliance, correctness, effectiveness and the like of password application in an important network and information system can be realized.

The invention relates to the technical field of data security, in particular to a federated learning-based distributed privacy data security aggregation method, which comprises the following steps of: acquiring multi-source heterogeneous data of a leaf supplier node; performing weighted fusion on the multi-source heterogeneous data by using the multi-modal fusion model to generate a health state vector; training by using the health state vector in combination with a blade X-ray defect data set to obtain a local model; calculating a leakage risk score, and performing privacy processing on the local model through a differential privacy mechanism to obtain a noise adding model; calculating the reference data set by using a noise adding model to obtain a performance score, and generating an encryption proof for a calculation process; and the central server receives the zk-SNARK encryption proof submitted by all the nodes, converts the performance score into an aggregation weight, initiates a secure multi-party computing protocol, and performs weighted calculation on the noise adding model by using the aggregation weight to generate a global model. According to the method, multi-party safe and credible collaborative modeling is realized by fusing multiple cryptographic protocols.

Embodiments are directed to methods and systems for crypto-agile encryption and decryption. A computer system can possess a protocol file that identifies one or more cryptographic software modules. Using these cryptographic software modules, the computer system can generate a plurality of shared secrets and a session key, then use the session key to encrypt a message. The message can be sent to a server computer that can subsequently decrypt the message. At a later time, the protocol file can be updated to identify a different set of cryptographic software modules, which can be used to encrypt messages. Further, the server computer can transmit additional cryptographic software modules to the computer system, enabling the computer system to use those cryptographic software modules to generate cryptographic keys. As such, the cryptographic protocol file can be changed in response to changes in the cryptographic needs of the computer system.

A system and method for altering client fingerprint that includes editing data components of network communication from a client device to a server, which comprises editing network protocol data from the client during negotiation of a cryptographic protocol; selectively enabling access to library components specified in the edited client network protocol data; and sending a client communication to the server using the edited client network protocol data.

Each medical site visited by a patient stores the patient's clinical data in a local database, indexed by a site-specific pseudo-ID (SPID) assigned to the patient, such as a patient number or other identifier. A Patient Data Directory System (PDDS) is provided to facilitate access to the clinical data of the patient at each medical site. As each medical site stores the patient's clinical data, a set of metadata is provided to the PDDS that identifies where the clinical data is stored at the medical site, as well as the SPID used at the particular site. This metadata is entered into the PDDS, and can be used to retrieve the clinical data stored at each medical site. Access to the PDDS is controlled by the patient, thereby enabling the patient to provide some or all of the metadata required to access the patient's clinical data to select clinicians. A variety of cryptographic protocols are used to prevent unauthorized access to the patient's data.

A system (100) for quantum-resistant routing via dynamic cryptographic switching in a WAN or SD-WAN environment, the system comprising: (a) a threat intelligence and crypto resilience assessment module configured to monitor cyber threats in real time and assess the security level of active cryptographic protocols; (b) a Dynamic Crypto Switching Module operatively connected to the assessment module and configured to automatically switch between classical cryptographic algorithms and post-quantum cryptographic algorithms based on the assessed threat levels; c) an SD-WAN policy integration and orchestration module configured to enforce organizational policies related to security, compliance, and performance to control cryptographic transitions; (d) an adaptive routing and path selection module configured to select network paths based on real-time security assessments and cryptographic strength; (e) a cryptographic compatibility and interoperability layer configured to manage encryption protocol handshakes and fallback mechanisms and to support communication between classical and post-quantum-enabled endpoints; f) and an audit, compliance and analytics dashboard configured to log cryptographic transitions, generate compliance reports and provide real-time visibility into system operations; g) whereby the system dynamically adapts encryption protocols and routing paths in response to evolving quantum and classical cybersecurity threats, thereby ensuring secure, continuous and compliant data transmission over WAN or SD-WAN networks.

The invention discloses an identity-based signature method supporting multi-message aggregation. The identity-based signature method comprises the steps of system initialization and key generation, user signature key generation, message signature construction, single signature verification, signature aggregation and aggregation signature verification. Due to the fact that the linear homomorphic signature technology is adopted, the identity-based aggregation signature method is provided, and the technical problems of signature after aggregation, key size expansion and the like in the existing aggregation signature technology are solved. Through the method, a verifier can safely and efficiently merge a plurality of signatures into a signature with a compact size, efficient data source authentication can be realized while the data integrity is guaranteed, and the verification efficiency is remarkably improved. The method has the advantages of high security, low communication cost, small calculation overhead and the like, can be applied to the technical fields of large-scale data authentication, distributed system security, lightweight cryptographic protocols and the like, and is particularly suitable for mobile terminals or Internet of Things equipment scenes with limited calculation resources.

The embodiment of the application discloses a self-defined encryption protocol clustering method and device, the method comprises the following steps: obtaining a target encryption protocol to be identified, and extracting traffic data and metadata of the target encryption protocol; constructing a label matrix and a value matrix based on the traffic data; and fusing the label matrix and the value matrix by using a multi-mode matching algorithm to obtain a clustering label. In this way, the self-defined encryption protocol clustering method provided by the application combines double-matrix combination with a pattern matching algorithm to realize clustering of self-defined encryption protocols. The method solves the problem that mixed self-defined protocols cannot be quickly and accurately clustered, and provides support for subsequent protocol analysis by quickly and accurately realizing clustering of self-defined protocols.

The present application belongs to the technical field of network security and artificial intelligence, and provides a large language model driven password protocol automatic formalization modeling method and system, acquires a natural language protocol specification document, and performs preprocessing; according to the priority order of a message block, a verification block and a calculation statement, a large language model extracts corresponding semi-structured intermediate representations from text blocks; all intermediate representation statements are scanned at one time by using the large language model, protocol functions and symbols are identified and stored in a knowledge base, the large language model is driven in units of intermediate representation statements to be refined one by one, and global context and local context are extracted; the completely structured intermediate representations, a protocol role set and the updated knowledge base are taken as inputs to perform deterministic one-to-one mapping with formal verification tool code, and conversion is completed. The present application can automatically generate symbol model code which can be directly input into a formal verification tool.

The present invention discloses a secure communication method and system based on national cryptographic algorithms and an improved Modbus TCP protocol. The secure communication method includes: sharing an initial public key between a host and a slave; establishing a TCP connection between the host and the slave and generating random numbers respectively based on a cryptographic module; performing signature verification on the random numbers using national cryptographic algorithms to achieve secure identity authentication between the host and the slave; negotiating an encryption key between the host and the slave based on national cryptographic algorithms; and performing data transmission between the host and the slave based on the encryption key. The present invention improves the standard Modbus TCP protocol, adds a security check field to achieve anti-replay attack, and expands the design of the national cryptographic protocol by combining the SM2 asymmetric algorithm and the SM4 symmetric algorithm to ensure data confidentiality. By configuring a cryptographic module for national cryptographic authentication, functions such as cryptographic operations, key generation, and random number generation of the host / slave are supported. Thus, secure and compliant communication based on the improved Modubs TCP protocol in an industrial system is achieved.

A circuit arrangement includes a plurality of cryptographic accelerators. Each cryptographic accelerator is configured to perform cryptographic operations according to a respective cryptographic protocol. A first memory is coupled to the cryptographic accelerators. A first processor is configured to specify, in response to requests to perform the cryptographic operations, parameters to the cryptographic accelerators according to the requests. The first processor is configured to identify, in the first memory, keys that are associated with the cryptographic accelerators, and signal the cryptographic accelerators to commence performing the cryptographic operations according to the parameters and using the associated keys.

To provide a device, method, and program capable of achieving a reproducible result of calculation on floating-point (FP) format data.SOLUTION: A network interface device executes the steps of: forming a communication connection with one or more devices so as to provide an endpoint for a transport layer and security protocols; rearranging the data before decryption of the data on the basis of the reception of packets out of order from one device or multiple devices; decrypting the encrypted data on the basis of the applicable cryptographic protocols; performing calculation as a portion of a series of operations on the basis of the decrypted data to generate a reproducible result; encrypting the result of the calculation on the basis of the applicable cryptographic protocols; and transferring the encrypted data to the device with a packet transferred on the basis of a remote direct memory access or reliable transport protocols.SELECTED DRAWING: Figure 10

The invention relates to the technical field of network information security, in particular to a password definition security architecture and a rule execution method, the architecture comprises a device plane, a security plane, a computing plane, a network plane, a data plane, a rule plane and an application plane, and each plane realizes execution of security rules in a password protocol mode. The rule execution method of the password definition security architecture comprises the following steps: after an information system is initialized, planning a routing path, authenticating password definition security equipment on the path, establishing a security access channel by adjacent equipment to ensure the routing security of data on the path, and then packaging each packet of data based on a service data identifier to obtain a password definition security architecture; according to the method, service slicing and protocol filtering based on the authorization credential are realized, and then safe forwarding is performed according to a routing path specified by the authorization credential, so that covert channels and illegal external connection are prevented, and the safety of the whole access request session depends on the safety rule of the authorization credential. According to the invention, the security and compliance of the business data in the circulation process can be ensured.

The invention discloses an information hiding information transmission method based on a lattice cipher signature domain, which supports both communication parties to extract secret information at the same time under the condition of correct verification of a signature, thereby completing information hiding and communication on the lattice cipher protocol signature domain on the basis of a lattice cipher protocol. All operations of the two communication parties are recorded, and it is guaranteed that the operation track reserved traces of the two parties can be traced back. Meanwhile, the client side and the server side are constructed, the server side is responsible for managing information and operation of the client side, and the client side can serve as an information sender and an information receiver for communication. Based on the fault tolerance of the lattice password, the method achieves the extraction of secret information and the lossless recovery of carriers on the premise of not needing any external information, improves a classical differential extension steganography scheme, and guarantees the information embedding bit rate even if the number of carriers is small.

This application relates to a control method for a multi-protocol switching quantum-resistant security gateway. The method includes, after the security gateway powers on, performing a hardware environment security self-test and generating a unique root key based on a physically non-cloning function; continuously collecting and analyzing network traffic characteristics; identifying quantum attack patterns and dynamically deciding on encryption algorithm modes based on a machine learning model; parsing communication data packets; dynamically converting and adapting between traditional and quantum-resistant cryptographic protocols according to instructions and preset rules; calling a quantum-resistant cryptographic engine for encryption or signature operations; dynamically deriving and managing session keys throughout their lifecycle based on the root key; and, based on quantum attack detection results, switching algorithm modes, communication protocols, and keys in a coordinated manner, while also enabling side-channel attack protection and hardware security response. This method achieves proactive protection against quantum attacks, seamless multi-protocol compatibility, and full lifecycle security management of keys for the security gateway.

The present application relates to the technical field of network information security, and particularly relates to a password definition security architecture and a rule execution method, the architecture comprising a device plane, a security plane, a calculation plane, a network plane, a data plane, a rule plane and an application plane, each plane implementing execution of a security rule through a password protocol mode. The rule execution method of the password definition security architecture comprises, after initialization of an information system, planning a routing path, authenticating password definition security devices on the path, establishing a secure access channel between adjacent devices to guarantee routing security of data on the path, then encapsulating each packet of data based on business data identification to implement business slicing and protocol filtering based on an authorized credential, then performing secure forwarding according to a routing path specified by the authorized credential to prevent hidden channels and rule violations, and the security of an entire access request session depends on the security rule of the authorized credential. The present application can ensure security and compliance of business data in a flow process.

This invention provides a method and system for detecting and warning of anomalies in encryption protocols, belonging to the field of network security technology. The method includes: extracting a multimodal feature set from the target encryption protocol communication stream; inputting it in parallel into an adaptive rule engine and an interpretable artificial intelligence model to obtain rule-triggered events and confidence weights, a first anomaly score, and an attribution explanation report, respectively; calculating a second anomaly score based on the above outputs using an improved scoring algorithm; fusing the first and second anomaly scores to obtain a comprehensive anomaly score and generating a warning decision; and uploading the warning information to a federated collaborative node to drive the collaborative evolution of the global rule base and the model. This invention, employing the aforementioned method and system for detecting and warning of anomalies in encryption protocols, solves the collaborative problems of poor interpretability, lagging knowledge updates, and data silos in encryption threat detection through deep collaboration between an interpretable artificial intelligence model and a rule engine, achieving accurate, reliable, and adaptive anomaly warnings.

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for using cryptographic protocols to generate network measurements in privacy preserving ways are described. In one aspect, a method includes sending, by a network measurement system and to a client device, data indicating a size for a partial identifier for an application of the client device. The network measurement system receives, from the client device, (i) a partial masked identifier generated by masking a complete identifier for the client device or a user of the client device and removing a portion of a resulting complete masked identifier based on the size and (ii) a first encrypted identifier generated by encrypting the complete masked identifier using an encryption key of the client device.

A system and method for distributed data intersection using privacy preserving collaborative detection is disclosed The system includes a processor and a memory that causes the processor to verify data sets and configurations from a first and second entity interacting in a distributed data intersection to ensure data integrity and privacy during a data collaboration. The processor enables computations between the first and second entity using cryptographic protocols to identify common data points. The processor allows the first and second entity to retrieve the common data points pertaining to other entity using a oblivious data sharing technique while maintaining confidentiality of the data accessed during the interaction. The processor facilitates validation of data integrity and accuracy without revealing underlying information. The processor controls data-sharing policies ensuring that authorized data is disclosed based on a predefined criteria thereby enabling collaboration of data for re-identification while protecting privacy.

In one embodiment, a method includes receiving a traffic flow including a plurality of packets encrypted using a cryptographic protocol, determining cryptographic protocol data of the traffic flow, and transmitting telemetry data of the traffic flow including the cryptographic protocol data. In another embodiment, a method includes receiving telemetry data of a traffic flow including a plurality of packets encrypted using a cryptographic protocol, the telemetry data including cryptographic protocol data of the traffic flow, classifying the traffic flow based on the cryptographic protocol data using a machine learning classifier; and taking a remedial action with respect to the traffic flow based on the classification of the traffic flow.

The invention belongs to the field of data encryption transmission, and particularly discloses a black box data transmission method based on quantum key encryption, and the method comprises the steps: generating a quantum key, carrying out the post-processing of the quantum key, and carrying out the data transmission based on the quantum key. According to the scheme, the quantum key encryption technology is adopted, and the encryption security is improved by using the unclonable principle of quantum and the uncertainty of quantum state; a quantum key is generated based on an improved BB84 quantum cryptographic protocol, a safe public two-way communication channel is established with a receiver to transmit the quantum key, and the safety of black box data in the transmission process is guaranteed; a substitution box is designed to perform confusion transformation on a quantum key, an initial substitution box is generated by using discrete chaotic mapping, and the substitution box is optimized through a migrant bird search algorithm, so that the security of the key is enhanced, and the noise resistance of data transmission is improved.

The invention discloses an anti-quantum enhancement method and an anti-quantum enhancement device for a stock password equipment system. On the premise of not changing the hardware architecture of stock classical cryptographic equipment, an anti-quantum cryptographic card or entrance guard type anti-quantum security enhancement equipment is connected with the anti-quantum cryptographic card or entrance guard type anti-quantum security enhancement equipment to provide anti-quantum security enhancement; the stock classical cryptographic equipment system refers to a cryptographic chip, a cryptographic machine, a signature verification machine, a gateway, a software system and the like which are deployed and cannot resist quantum attacks; the anti-quantum cryptographic card is a cryptographic card supporting a classical cryptographic algorithm and an anti-quantum cryptographic algorithm, a classical cryptographic chip, an anti-quantum FPGA chip and other components are arranged on the anti-quantum cryptographic card, and the anti-quantum cryptographic card is connected with stock classical cryptographic equipment through a PCIe interface. The entrance guard type anti-quantum security enhancement equipment is electronic equipment which is deployed between classical cryptographic equipment and a public network and carries out anti-quantum security protection on a Diffie-Hellman type cryptographic protocol, so that a session key cannot be exported even if communication between entrance guard type equipment is acquired by an enemy.

Described herein are systems and methods for fraud detection in network operations. The method may receive a request for execution of a network operation, the request including a first identifier associated with a user device. The method may extract, using the first identifier, attributes of the network operation and user device attributes. The method may extract a second identifier previously generated for the user device. The method may execute a cryptographic protocol using the second identifier and a cryptographic key to generate a first authentication code. The method may execute a machine learning model to predict a likelihood of fraud using mismatched attributes based on determining that the first authentication code matches a second authentication code parsed from the first identifier. The method may reject the request to execute the network operation in response to determining that a prediction of likelihood of fraud fails to satisfy a security threshold.

Novel tools and techniques might provide for implementing secure communications for IoT devices. In various embodiments, a gateway or computing device might provide connectivity between or amongst two or more Internet of Things (“IoT”) capable devices, by establishing an IoT protocol-based, autonomous machine-to-machine communication channel amongst the two or more IoT capable devices. For sensitive and / or private communications, the gateway or computing device might establish a secure off-the-record (“OTR”) communication session within the IoT protocol-based, autonomous machine-to-machine channel, thereby providing encrypted machine-to-machine communications amongst the two or more IoT capable devices, without any content of communications that are exchanged amongst the IoT capable devices over the secure OTR communication session being recorded or logged. In some cases, the secure OTR communication session utilizes cryptographic protocols including, without limitation, one or more of AES symmetric-key algorithm, Diffie-Hellman key exchange, SHA-1 hash function, forward secrecy, deniable authentication, malleable encryption, and / or the like.

The present application provides a method, device, electronic device, and storage medium for testing a VPN device with national cryptographic algorithms. Among them, the testing method is applied to a testing terminal, and the GMSSL testing tool is pre-installed on the testing terminal. The GMSSL testing tool is used to obtain user login information and simulate a login session based on the user login information. The testing method includes: sending multiple authentication login requests to the VPN device to be tested in a multi-threaded concurrent manner or a multi-process concurrent manner, and maintaining the login session corresponding to each authentication login request; based on the processing results of the VPN device to be tested for the multiple authentication login requests, counting the maximum number of online users of the VPN device to be tested per unit time; calculating the average value of the maximum number of online users obtained from multiple tests; and obtaining a new test value. The present application can be used to simulate and test the usage environment of a VPN device under a real national cryptographic protocol, and then test the VPN device based on the real usage environment of the VPN device, thereby improving the testing accuracy of the VPN device.

The invention discloses a random number generation protection method and system based on electronic hardware thermal noise, and relates to the technical field of network information, and the method comprises the steps: collecting a thermal noise signal in electronic hardware, filtering the thermal noise signal through a low-pass filter, and processing the filtered thermal noise signal through a low-noise amplifier; quantizing the processed thermal noise signal, and introducing equivalent noise to carry out random number mixing on the quantized thermal noise signal; and the mixed random numbers are mapped into a cryptographic protocol and are combined, so that the protection capability of a cryptographic algorithm is improved. According to the invention, the randomness and security of the random number are effectively improved, the predictability and periodicity problems of a traditional pseudo-random number generator are avoided, the random number is applied to the key updating and management process, the protection capability of a cryptographic algorithm is improved, and an important technical breakthrough is brought to the field of information security.