33 results about "Cryptography protocols" patented technology

The invention provides a network traffic identification method and system for an unknown cryptographic protocol, and relates to the technical field of network traffic analysis, and the method comprises the steps: carrying out the preprocessing of captured dynamic traffic data, and obtaining target traffic data; acquiring a multi-dimensional feature parameter set based on predetermined feature dimension collection; constructing an initial knowledge graph, and introducing a graph dimension reduction mechanism to carry out dimension reduction processing to obtain a target knowledge graph; performing clustering analysis on the network flow knowledge graph database to obtain a target class cluster; reading a predetermined clustering degree evaluation strategy, and performing clustering degree evaluation analysis to obtain a target clustering degree; and if the preset clustering degree limit value is reached, marking the target protocol type corresponding to the target class cluster as the protocol type of the target traffic data. The technical problem that in the prior art, a static feature recognition method is generally adopted, effective detection on an unknown password protocol is lacked, the requirement for continuous evolution of the protocol cannot be met, and then network security vulnerabilities are caused is solved.

The verification of individuals entering controlled locations such as events and venues is improved by using wireless devices as the entry tickets themselves, verifiable by a telecommunications network. The wireless device provides a network subscriber's identification information (e.g., a phone number) to an access point terminal, in response to an identification / authentication request from the access point terminal. In order to obtain the identification information to provide to the terminal, the wireless device verifies itself via the telecommunications network, which is capable of verifying the device's subscriber identity module (SIM) via cryptographic protocols. Thus, by verifying the device's SIM, the telecommunications network verifies the identity of the network subscriber operating the device, for purposes of sharing a phone number as an entry ticket. Because entry is controlled according to the device's own network-verifiable identity, third-parties that operate events or venues need not distribute entry tickets (e.g., physical or electronic) to individuals.

The invention discloses a protocol logic vulnerability mining method based on program multi-dimensional variation. The method comprises the following steps: firstly, based on an RFC protocol standard, automatically positioning a buffer write function responsible for writing a message and a state variable used for identifying a protocol state in a program; then, multi-dimensional variation is carried out, including content level variation (field replacement, field multiplexing and field deletion) and sequence level variation (message repetition and message skipping), and a variation message with legal grammar and abnormal semantics is generated; and finally, monitoring state variables of a protocol state machine and an instrumentation program defined based on the RFC standard, detecting the difference of behaviors of a plurality of protocol implementation state machines under the same variation input by using a consistency test method, automatically discovering violation of protocol implementation on the RFC standard, and classifying the violation into logic vulnerabilities. According to the method, typical vulnerabilities such as degradation attacks, repeated extension and missing extension in cryptographic protocol implementation can be automatically mined, and 49 logic problems are found in multiple protocol implementation.

The invention provides an automobile bus safety detection system and method based on a commercial password technology. The system comprises a bus data acquisition module, a configuration temperature compensation crystal oscillator and a double DDR4 buffer pool; the protocol analysis engine is used for integrating a predefined analyzer and a BiLSTM-based custom protocol recognition model; the cryptographic protocol identification module is used for monitoring and identifying a cryptographic protocol through the protocol characteristic matrix and the Shannon entropy; the password compliance detection module is used for loading a national password GM / T standard library to execute algorithm identifier verification; the key security analysis module is used for implementing key entropy grading detection and life cycle analysis; the simulation attack module is used for dynamically adjusting an attack strategy according to the environmental risk factors; and the auditing and reporting module generates a visual compliance report. According to the method, automatic security detection of automobile bus password communication is realized through seven steps of data acquisition, protocol analysis, password identification, compliance detection, key analysis, attack simulation and report generation, and the problem that a traditional tool cannot detect password compliance and key security is solved.

The invention belongs to the technical field of information security, relates to zero-knowledge proof and block chain technologies, and particularly provides a public verifiable data service method for an instrument control system, so as to solve the technical problem of huge calculation overhead caused by the fact that commitment consistency check of large-scale data needs to be executed in a circuit in an existing zk-SNARK-based scheme. According to the invention, a hybrid proving system based on a cryptographic protocol Plonk and Groth16 is designed, the promise adaptive to the system is designed, and the consistency check of the promise of the database is transferred from the inside of an arithmetic circuit to the outside of the circuit, so that the huge calculation overhead introduced into a zk-SNARK circuit by the promise consistency check of a large-scale database is avoided; and finally, the verifiable execution of safe calling and operation on the data subset from the third-party cloud storage is realized, the accuracy and integrity of industrial data are ensured, and the problem of trust missing in a cross-domain scene is solved.

This invention discloses a general two-party unintentional signature method and system, belonging to the field of cryptographic protocol technology. The method includes: participants P1 and P2 jointly generating a signature public key; participants P1 and P2 jointly calculating a signature of the message, wherein the signature is known only to participant P1, and participant P1 uses the signature public key to verify the signature. This invention can both distribute key storage to avoid the risk of key leakage and prevent additional participants from obtaining the final signature content.

A hybrid Quantum Key Distribution (QKD) protocol and method for secure transmission in optical communications systems and in particular long distance optical communications systems such as those in undersea environments. Our inventive method advantageously exploits fundamental security features of quantum-base encryption with the added intrinsic security of encapsulated and sealed equipment of undersea optical networks. Our method employs an intermediate node that generates an optical signal, and a pair of quantum state generators that respectively generate quantum states of the optical signal and transmit the generated quantum states to secure nodes, respectively. The secure nodes then communicate securely using a quantum key distribution (QKD) protocol.

The invention provides a cryptographic protocol state transition modeling method and system based on a sequence recursion relation, and the method comprises the following steps: obtaining a current state triple, the state triple comprising a state identifier, a configuration parameter and an operation sequence, and the state identifier corresponding to a state node in a state transition diagram of a cryptographic protocol; searching is carried out in an operation sequence of the state triad based on configuration parameters in the state triad, an executed operation is determined, and a state transition quadruple contained in the operation comprises a current state identifier, a protocol message type, a subsequent state identifier and subsequent configuration parameters; determining a subsequent state node of the current state node according to the subsequent state identifier of the state transition tetrad in the operation, and completing state transition; obtaining a state transition tetrad in the operation executed by the state transition, and updating a state transition tetrad sequence of the protocol; and recording the state transition tetrad of each state transition, and constructing a log file.

This invention discloses a method for information hiding and intelligence transmission based on lattice cipher signature fields. This method allows both communicating parties to simultaneously extract secret information upon correct signature verification, thereby achieving information hiding and communication within the lattice cipher protocol's signature field. This invention records all operations of both communicating parties, ensuring traceable operational traceability. Furthermore, this invention constructs a client and a server, with the server managing the client's information and operations. The client can communicate as both an intelligence sender and receiver. Based on the fault tolerance of lattice ciphers, this invention achieves lossless extraction of secret information and recovery of the carrier without requiring any external information. It also improves upon the classic differential extended steganography scheme, ensuring a high information embedding bit rate even with a small number of carriers.

The present invention relates to the field of SMS security technology, and discloses an SMS sending system for preventing data leakage, including a session key generation module, an encryption module, an SMS sending module, and an SMS decryption module. Among them, the session key generation module sends a receiving request from the sender to the receiver and sends a random number. After receiving the request, the receiver generates another random number and uses a pre-agreed quantum secure key exchange protocol to generate a session key using the two random numbers. The receiver sends the other random number to the sender. After receiving the other random number, the sender also generates the same session key. In the present invention, the receiver can safely receive the SMS sent by the sender, and at the same time, the intermediate random relay and any third party cannot know the content of the SMS. The sending process utilizes a quantum-secure cryptographic protocol and secure multi-party computation, ensuring the security of SMS interaction in the era of quantum computers.

The invention relates to a method for generating a blind signature for a message based on a cryptographic protocol implemented in a Euclidean network comprising a public key formed of at least one matrix A composed of elements of a set and a secret key linked to the public key and known exclusively to a signatory entity, the method comprising: generating a first ring vector r; determining a second vector c equal to A.r +f(m); the signatory entity generating a third ring vector s such that c= A.s, with s complying with at least one constraint relating to its norm; generating the intermediate signature comprising an aggregation vector resulting from a combination of the first and third vectors; decomposing the aggregation vector into a first part and a second part; generating a blind signature composed of the first part and of a proof of knowledge of the matrix and of the second part.

A hybrid quantum key distribution (QKD) protocol and method for secure transmission in optical communication systems, and particularly in long-range optical communication systems such as those in underwater environments. Our inventive method advantageously utilizes the fundamental security features of quantum-based encryption with the added security of the encapsulated and sealed equipment of underwater optical networks. Our method uses an intermediate node that generates an optical signal and a pair of quantum state generators, each of which generates quantum states of the optical signal and transmits the generated quantum states to secure nodes. The secure nodes then communicate securely using a quantum key distribution (QKD) protocol.

The invention relates to the technical field of information security, and discloses a lightweight transmission encryption method based on a commercial cryptographic algorithm, which comprises the following steps: two communication parties establish an initial session through a lightweight handshake protocol; collecting a feature vector of the data to be sent and an equipment operation state containing CPU, memory and energy limited parameters; calculating a comprehensive load index according to the acquired parameters, comparing a threshold according to a preset decision function, determining a simplified strength mode when the equipment is in a high-load state and processes non-critical data, and otherwise, determining a standard strength mode; and writing the encryption mode into a message header, and performing block encryption and packaging transmission on the data load by using the session key. According to the method, through a parallel key exchange process, compact key storage and a self-adaptive encryption decision mechanism, the problems of large calculation overhead, high handshake delay and large storage occupation of a commercial cryptographic protocol in a resource-constrained environment are effectively solved, and the equipment energy consumption and the communication delay are reduced while the security of key data is guaranteed.

A method for implementing RMFE based on the Galois ring involves initializing and selecting the Galois ring to obtain the interpolation set on the Galois ring, then performing polynomial interpolation calculations on the Galois ring based on the input RMFE; finally, the interpolated Galois ring GR(p k The polynomial on (r) is transformed into the Galois ring GR(p) k The elements on the integer ring (dr) are used to implement the RMFE mapping φ and the inverse mapping ψ, and finally the two mappings are concatenated to implement the RMFE. This invention addresses the gaps in the existing technology by implementing and optimizing the efficiency of the polynomial interpolation algorithm on the Galois ring, making it possible to extend many cryptographic protocols to integer rings, while improving the amortization efficiency of the protocols.

The verification of individuals entering controlled locations such as events and venues is improved by using wireless devices as the entry tickets themselves, verifiable by a telecommunications network. The wireless device provides a network subscriber's identification information (e.g., a phone number) to an access point terminal, in response to an identification / authentication request from the access point terminal. In order to obtain the identification information to provide to the terminal, the wireless device verifies itself via the telecommunications network, which is capable of verifying the device's subscriber identity module (SIM) via cryptographic protocols. Thus, by verifying the device's SIM, the telecommunications network verifies the identity of the network subscriber operating the device, for purposes of sharing a phone number as an entry ticket. Because entry is controlled according to the device's own network-verifiable identity, third-parties that operate events or venues need not distribute entry tickets (e.g., physical or electronic) to individuals.

The present invention provides a network traffic identification method and system for unknown cryptographic protocols, which relates to the field of network traffic analysis technology, including: pre-processing captured dynamic traffic data to obtain target traffic data; collecting a multi-dimensional feature parameter set based on predetermined feature dimensions; constructing an initial knowledge graph, and introducing a graph dimensionality reduction mechanism to perform dimensionality reduction processing to obtain a target knowledge graph; clustering analysis of the network traffic knowledge graph database to obtain a target cluster; reading a predetermined clustering degree evaluation strategy, and performing clustering degree evaluation analysis to obtain a target clustering degree; if a predetermined clustering degree limit is reached, the target protocol type corresponding to the target cluster is recorded as the protocol type of the target traffic data. The present invention solves the technical problem that the prior art generally adopts a static feature recognition method, lacks effective detection of unknown cryptographic protocols, and is unable to adapt to the needs of the ever-evolving protocols, thereby leading to network security vulnerabilities.

The embodiment of the invention provides a key migration method, a cryptographic module and a live migration method thereof, and related equipment, the key migration method is applied to a target cryptographic module coupled to a key mirror image import interface, and the key mirror image import interface is an interface which is preset by a target physical host and is only used for transmitting a key mirror image ciphertext. Comprising the following steps: sending a public key certificate and first cryptographic protocol information when a cryptographic module is thermally migrated; receiving a key mirror image ciphertext and second cryptographic protocol information based on the key mirror image import interface, the second cryptographic protocol information being generated by the source cryptographic module; and generating a decryption key for decrypting the key mirror image ciphertext according to the second cryptographic protocol information to obtain a key mirror image, and after the integrity of the key mirror image is verified, outputting an import result, thereby realizing the thermal migration of the cryptographic module.

The invention discloses an unmanned aerial vehicle authentication and key negotiation system and method based on PUF and chaotic mapping, and relates to the field of information security and cryptographic protocol security. The system generates a unique challenge-response pair through an unmanned aerial vehicle terminal PUF module to complete registration, a four-way handshake mechanism is adopted in the authentication stage, a session key is dynamically generated in combination with Henon chaotic mapping, the number of chaotic iterations is hidden through XOR operation, and identity legality is guaranteed through multi-layer MAC verification. According to the method, secret keys do not need to be pre-stored, the PUF physical unclonability and the chaotic mapping sensitivity are utilized, anonymous authentication and forward security are achieved, lightweight computing adapts to unmanned aerial vehicle resource constraints, various attacks are effectively resisted, and communication security is guaranteed.

The invention discloses a full-link safe electronic passport authentication system and method, and the method comprises the steps: deploying a quantum cryptographic protocol and a classical cryptographic protocol at an Android end electronic passport and a passport reader, and guaranteeing the seamless compatibility of the system and an existing electronic passport system; electronic passport information is electronically read through the Android end, and the electronic passport information and a connection request are sent to the passport reader; and the passport reader completes authentication and establishes secure communication based on the received electronic passport information and the connection request on the basis of a post quantum cryptographic protocol and a classical cryptographic protocol. According to the technical scheme, technologies such as a lattice-based module lattice key encapsulation mechanism ML-KEM, a module lattice digital signature algorithm ML-DSA, an electronic passport protocol standard and the like are utilized to support efficient communication of double-end equipment, a low-cost authentication process and multi-dimensional security assurance.

Aspects of the present invention relate to a control system (100) for use in updating software in a plurality of electronic control units, ECUs (112, 114, 116), of a vehicle (200). The control system receives software data (104) comprising software update information (134) associated with one or more of the ECUs (112, 114, 116), verifies the software update information (134) using a cryptographic protocol, and, responsive to successful verification of the software update information (134) according to the cryptographic protocol, outputs a software update (106, 108, 110) for each of the one or more ECUs (112, 114, 116), each software update (106, 108, 10 110) being based on the software update information (134) for the associated ECU (112, 114, 116).

Systems, methods, and computer readable media are provided for improving the usability of a cryptogram generated in a first cryptographic protocol such as triple-DES. The methods may generate a first cryptogram using a first identifier in a first cryptographic protocol, stored in a key store within an insecure memory of the mobile communication device, generate, within a secure memory of the mobile communication device, a second cryptogram using a second identifier in a second cryptographic protocol, stored in the secure memory, combining, the first cryptogram and a number of characters of the second cryptogram equal to the length of the first cryptogram to generate a third cryptogram and transmitting the third cryptogram to an payment processing network to validate a transaction. A transaction associated with the third cryptogram may be validated by an authorization entity or an issue entity.

Systems and techniques may generally be adapted for establishing secure communications with use of quantum entanglement, including via the use of mesh networks and multiple satellite communication locations. An example technique may include generating a stream of quantum entangled particles, and transmitting at least part of the stream of the quantum entangled particles to at least a first node, a second node, and an intermediate node connected via a satellite communication network. In this context, the intermediate node is located between the first node and the second node, and a secure trusted mesh of entities can be established among the first, second, and intermediate nodes. The stream of the quantum entangled particles can used to derive a quantum entangled value, such as for use with a cryptographic protocol of secure communications between the first node and the second node via the satellite communication network.

The application discloses an information data operation processing system based on a security isolation gateway, and relates to the technical field of data communication.The system comprises a security isolation gateway, a global side subsystem and N participant side subsystems, wherein N is a positive integer; the security isolation gateway is connected between the global side subsystem and each participant side subsystem and is configured to establish a controlled one-way data transfer channel between the two; the global side subsystem comprises a global coordination module, a trusted verification module and a security aggregation module; and each participant side subsystem comprises a trusted execution module.The application solves the technical problem that the privacy protection of the existing information data processing process depends on a complex cryptography protocol, is inefficient and is difficult to exclude malicious or low-quality updates, and affects the security and efficiency of cross-domain information processing, and achieves the technical effects of simplifying privacy protection, efficiently excluding malicious updates and improving the security and efficiency of cross-domain information processing by using the security isolation gateway.

A computer-implemented method is disclosed for handling sensitive data in a network comprising multiple security zones. The method includes sharing a data cleansing ruleset among a plurality of servers that are each within a respective security zone and using a multi-party cryptographic protocol that each of the plurality of servers participates in, to obtain a shared secret. Each server individually cleanses a respective dataset containing sensitive data using the data cleansing ruleset and then hashes the resulting cleansed dataset with a hash function using the shared secret as a salt. This produces a resultant dataset containing hashed representations of the original sensitive data, meaning that the dataset produced by each server can be collated to form a composite dataset without breaching data security requirements. A data operation can then be performed on the composite dataset.

The invention discloses an information data operation processing system based on a security isolation gatekeeper, and relates to the technical field of data communication, the system comprises the security isolation gatekeeper, a global side subsystem and N participant side subsystems, and N is a positive integer; the security isolation gatekeeper is connected between the global side subsystem and each participant side subsystem, and is configured to establish a controlled one-way data ferry channel between the global side subsystem and each participant side subsystem; the global side subsystem comprises a global coordination module, a credible verification module and a security aggregation module, and each participant side subsystem comprises a credible execution module. The technical problems that privacy protection in an existing information data processing process depends on a complex cryptographic protocol, efficiency is low, malicious or low-quality updating is difficult to eliminate, and the safety and efficiency of cross-domain information processing are affected are solved, and the purposes that privacy protection is simplified through a safety isolation gatekeeper, malicious updating is efficiently eliminated, and the safety and efficiency of cross-domain information processing are improved are achieved. And the safety and efficiency of cross-domain information processing are improved.

The present technology relates to techniques for integrating centralized custodial services and DeFi services. In one aspect of the technology, a platform stores a cryptographic key associated with a user of the platform. The user instructs the platform of a first digital asset to transfer from a centralized custodial service to a DeFi service in exchange for a second digital asset. Based on these instructions, the platform causes the centralized custodial service to transmit the first digital asset to a self-executing computer program of the platform. The platform then transmits the cryptographic key, as well as the instructions, to the self-executing computer program. Upon receipt of the cryptographic key, the instructions, and the first digital asset, the self-executing computer program executes, transmitting the first digital asset to the DeFi service and causing the DeFi service to transmit the second digital asset to the centralized custodial service.

The invention relates to a cryptographic protocol analysis method and device, computer equipment and a readable storage medium. The method comprises the following steps: extracting field state features and dependency relationship features from a dynamic field state graph by acquiring the dynamic field state graph constructed for a cryptographic protocol to be analyzed, the features being used for describing the features of state changes under different events and different contexts; and inputting the field state features and the dependency relationship features into a pre-constructed attack prediction model to obtain a potential attack occurrence probability and an attack path of a network using a cryptographic protocol. The method comprises the following steps: acquiring a dynamic field state map, extracting dynamic field state features and dependency relationship features from the dynamic field state map, and inputting the field state features and the dependency relationship features into an attack prediction model for attack prediction, thereby realizing analysis of a cryptographic protocol currently used by a network; and the analysis result accuracy and the environment adaptability are enhanced.

This invention discloses a privacy-preserving identity registration and authentication method and system compatible with standard SIM cards, belonging to the field of cryptographic protocol technology. The system includes three participants: a user terminal, an operator, and an application. It is based on the SIM card issued by the mobile operator and owned by all mobile phone users. The user and the operator collaborate to complete the application's authentication of the user's identity. This invention features high security and efficiency; even if an adversary compromises the operator, they cannot obtain the user's login behavior. It also protects user authentication from man-in-the-middle attacks, is compatible with existing SIM cards, requires no replacement of existing hardware, and is easy to deploy. This invention further enhances privacy protection, ensuring that user access behavior is not tracked, has excellent interoperability, and is suitable for large-scale 5G application deployment.

The embodiment of the invention provides a data transmission method, device and unit, a receiver and a storage medium. The method comprises the following steps: analyzing positioning data generated by a GNSS signal processing unit to obtain receiving end information; wherein the positioning data is obtained by processing satellite signals; based on a cryptographic protocol sub-layer in a bottom layer of the transmission protocol stack, encrypting the positioning data by adopting an encryption strategy in a commercial password security engine to obtain first encrypted data; wherein the first encrypted data comprises an encryption header; transmitting the first encrypted data to an external device according to the receiving end information; wherein the first encrypted data is used for obtaining the positioning data after decryption processing. According to the method, the security of data transmission based on the receiver can be improved, so that the credibility of the data is ensured.

Embodiments are directed to methods and systems for crypto-agile encryption and decryption. A computer system can possess a protocol file that identifies one or more cryptographic software modules. Using these cryptographic software modules, the computer system can generate a plurality of shared secrets and a session key, then use the session key to encrypt a message. The message can be sent to a server computer that can subsequently decrypt the message. At a later time, the protocol file can be updated to identify a different set of cryptographic software modules, which can be used to encrypt messages. Further, the server computer can transmit additional cryptographic software modules to the computer system, enabling the computer system to use those cryptographic software modules to generate cryptographic keys. As such, the cryptographic protocol file can be changed in response to changes in the cryptographic needs of the computer system.