177 results about "Ephemeral key" patented technology

The invention relates to the technical field of commercial password detection methods, and discloses a high-security method for negotiating a temporary session key based on a national secret algorithm, and the commercial password detection method comprises the following steps: initialization and identity authentication: two communication parties generate an SM2 public and private key pair, and the identity is verified through a digital certificate and an SM2 signature; temporary key negotiation: generating a shared key point based on an SM2 key exchange protocol; session key derivation: generating a temporary session key by using an SM3 hash algorithm; key confirmation and encrypted communication: verifying the key through an SM4 algorithm and encrypting communication data; according to the high-security method for negotiating the temporary session key based on the national secret algorithm, efficient key negotiation of both communication parties in an unsecure channel is realized through an SM2 key exchange protocol, an SM3 hash algorithm and an SM4 symmetric encryption algorithm. The method combines digital certificate authentication, dynamic random numbers and timestamps, has forward security, replay attack resistance and man-in-the-middle attack resistance, and is suitable for high-security scenes such as finance and government affairs.

The invention discloses a dynamic key threshold fragmentation privacy tracing method based on block chain collaborative verification, and belongs to the field of information security. According to the method, a dynamic key is taken as a hub, decentralized identity, zero-knowledge verification, deep watermark and threshold collaborative decryption are deeply coupled, a temporary key generated by each conference is split into a plurality of fragments, the fragments are stored in a distributed manner by a block chain node and a tracing unit, only a hash fingerprint combined by the fragments is subjected to chaining and evidence storage, and the dynamic key is subjected to zero-knowledge verification and deep watermark and threshold collaborative decryption. A light evidence chain which cannot be tampered but has no privacy exposure is formed; participants are anonymously accessed through a verifiable certificate without leaking specific information, and truth of anonymous identity is ensured through signature of a trusted unit; when data leakage occurs, the tracing unit extracts a watermark, compares a zero knowledge proof, verifies the relevance between a leaked ciphertext and a chain fingerprint, triggers a multi-party threshold decryption recovery key, and finally accurately positions a person in charge in combination with the encrypted and stored DID mapping table without exposing irrelevant information in the whole process.

A navigation system and method are disclosed for operation in GPS-denied environments using quantum-inspired sensor fusion, dynamic virtual anchor points (VAPs), and predictive environmental modeling. The system represents multiple position hypothesis using wavefunction-like expansions and integrates VAP-based triangulation for drift correction. A predictive modeling module ingests solar, geomagnetic, and environmental data to proactively adjust sensor weighting. A cybersecurity module employs quantum-algebraic key generation and location-derived ephemeral keys to secure inter-device communication. The system includes an augmented reality (AR) interface to visualize and edit anchor references, and a neurofeedback module that adapts the AR interface based on real-time physiological signals from the user. The method further enables anchor optimization via AI-driven repositioning and supports low-power edge execution using approximate amplitude filtering. Additional modules may include fractal antennas, neuromorphic processors, and adaptive forecasting layers to maintain positional accuracy and user experience in subterranean, multi-floor, or magnetically complex environments.

Mechanisms for resource management are described. A public key of a second device and an identifier of the public key may be received at a first device. The public key may correspond to a private key stored at the second device, be referenceable using the key identifier, and be associated with a user. A string of randomized characters may be encrypted at the first device using a secret generated from an ephemeral key generated at the first device and the public key, and encrypted data may be obtained. A packet may be generated at the first device that includes the ephemeral key, the key identifier, and the encrypted data. Based on providing the packet to the second device, the string of randomized characters may be inputted into the first device and the user may be authenticated for access to the first device.

A method of enabling knowledge proof in a blockchain transaction is disclosed. The method comprises sending, from a verifier to a prover, a blockchain transaction redeemable by means of data including (i) first data (y) based on a combination of an ephemeral key (r), second data (c) and a private key of a public-private key pair of a cryptography system, wherein the public key (v) is based on an integer generator raised to a first power, wherein the first power is based on the private key, and wherein knowledge of the private key is required in order to determine the ephemeral key from the first data, and (ii) third data (x) based on the integer generator raised to a second power, wherein the second power is based on the ephemeral key.

The invention discloses a cross-regional vehicle authentication method based on a physical unclonable function, which belongs to the field of Internet of Vehicles information security, and comprises the following steps: initializing a trusted management mechanism system; initializing a regional agent mechanism; the cross-regional vehicle CDV selects a local trusted vehicle LTV; carrying out cross-regional vehicle authentication; the agent ATA creates an interaction identity; the LTV generates a temporary key; the CDV obtains the secret key and verifies the secret key; and the LTV verifies the credibility of the CDV. According to the method, the unique identity label is generated by using the PUF, so that the authentication security is ensured, the calculation and communication overhead is reduced, the robustness and diversity of the authentication information are improved, the potential safety hazard in cross-regional authentication can be effectively reduced, and the method has a wide application prospect in the fields of intelligent transportation, automatic driving and the like.

A navigation system and method are disclosed for operation in GPS-denied environments using quantum-inspired sensor fusion, dynamic virtual anchor points (VAPs), and predictive environmental modeling. The system represents multiple position hypothesis using wavefunction-like expansions and integrates VAP-based triangulation for drift correction. A predictive modeling module ingests solar, geomagnetic, and environmental data to proactively adjust sensor weighting. A cybersecurity module employs quantum-algebraic key generation and location-derived ephemeral keys to secure inter-device communication. The system includes an augmented reality (AR) interface to visualize and edit anchor references, and a neurofeedback module that adapts the AR interface based on real-time physiological signals from the user. The method further enables anchor optimization via AI-driven repositioning and supports low-power edge execution using approximate amplitude filtering. Additional modules may include fractal antennas, neuromorphic processors, and adaptive forecasting layers to maintain positional accuracy and user experience in subterranean, multi-floor, or magnetically complex environments.

The invention discloses a target equipment upgrading method and device based on an equipment grading strategy, equipment, a medium and a product, and relates to the field of mobile terminal software upgrading, and the method comprises the steps that a server collects hardware features of target equipment and automatically grades the equipment by using a K-means clustering algorithm; generating a differential OTA upgrade package based on the grading result; segmenting the differential packet into data fragments with fixed sizes, and generating a hash value and a digital signature for each fragment; the equipment end downloads one by one, verifies integrity and signatures in real time, and supports breakpoint resume; the server side predicts the OTA upgrade failure risk through the trained random forest model, and dynamically adjusts a push strategy; the equipment adopts an A / B partition mechanism to realize safe rollback; in a non-secure network environment, the server and the device cooperatively generate a temporary key based on a device ID and a timestamp to encrypt and transmit fragments. The volume of the upgrade package is effectively reduced, the transmission efficiency is improved, the security is enhanced, and the upgrade failure rate is remarkably reduced.

A method for atomic exchange of assets on multiple blockchains using transient key pairs includes: generating, by a first computing device, a proposal message, the proposal message including at least a first transaction value, a first network identifier corresponding to a first blockchain, a second transaction value, a second network identifier corresponding to a second blockchain, and a swap public key of a swap cryptographic key pair; generating, by the first computing device, a first digital signature for the proposal message; encrypting, by the first computing device, the first digital signature using the swap public key and a first private key of a first cryptographic key pair; appending, by the first computing device, the encrypted first digital signature to the generated proposal message; and transmitting, by the first computing device, the generated proposal message with appended encrypted first digital signature to a second computing device.

The invention discloses an inter-vehicle bidirectional authentication and key agreement method and system, and relates to the technical field of Internet of Vehicles information security, and the method comprises the steps: a registration stage: a vehicle and a trusted mechanism derive a temporary session key based on ECDH and HKDF, and achieve the secure interaction; the trusted institution generates a basic identity label, a part of private key, a signature and a basic certificate for the vehicle, and encrypts and transmits the basic identity label, the part of private key, the signature and the basic certificate to the vehicle; the vehicle generates a hardware fingerprint and extracts a secret key by using the embedded PUF, and part of the private key is encrypted and then is locally and safely stored with the basic certificate; in the authentication stage, the two communication parties dynamically recover part of private keys through PUF, and generate dynamic pseudo names, temporary ECDH key pairs and cryptographic evidence; and calculating a cross item and a binding item by interaction parameters of the two parties, negotiating a unique session key, and completing bidirectional confirmation through a message authentication code. According to the method and the device, efficient, physical attack-resistant and privacy-protecting V2V security mutual recognition and key agreement are realized in a resource-limited vehicle-mounted environment.

Methods and systems for maintaining security of communications in a multi-device environment are provided herein. A private key associated with a first device is obtained. The private key is known to the first device and unknown to other devices. A public key is generated based on the obtained private key. The public key and the symmetric key is provided to a second device. A respective ephemeral key is generated for each time period of a future time window, where each ephemeral key is generated based on the private key and the symmetric key. A set of hash values is obtained based on each respective ephemeral key and provided to a computing device of a platform. A notification of a secure message of the second device for the first device is received. Content of the secure message is accessed based on the symmetric key and the private key.

The invention relates to a vehicle diagnosis system, method and device, which are used for solving the unsafe influence caused by using a long-term secret key to carry out vehicle diagnosis. The vehicle diagnosis system comprises a key management system and a to-be-diagnosed unit, the key management system receives a key authorization request sent by a diagnosis device, generates a temporary key according to the key authorization request and sends a key authorization response to the diagnosis device, the temporary key is carried in the key authorization response, and the to-be-diagnosed unit sends the temporary key to the diagnosis device. And the key management system configures the temporary key to the to-be-diagnosed unit, so that the diagnosis device and the to-be-diagnosed unit complete diagnosis based on the temporary key and obtain a diagnosis result. Wherein the temporary key is independent of the long-term key in the vehicle. The vehicle diagnosis is completed by configuring the temporary secret key, and the diagnosis equipment can be prevented from being in contact with the long-term secret key in the vehicle as much as possible, so that the privacy data of a vehicle owner can be protected, the possibility that illegal personnel control the operation of the vehicle by using the long-term secret key can be reduced, and the driving safety of the vehicle owner is improved.

The invention discloses an Internet of Things device anti-quantum password migration method based on a national cryptographic algorithm, and relates to the field of data security, the method comprises the following steps: configuring a Hash agility module taking a national cryptographic SM3 as a default algorithm, and dynamically switching to an anti-quantum or compatibility alternative algorithm based on monitoring; carrying out identity authentication and temporary key negotiation by adopting SM2, and generating a key pair only used for a single session; deriving a session key based on the key pair, and adopting a differential double-layer signature verification mechanism according to the data security level; for firmware updating, a differential package is generated through function level differential analysis, and atomic updating and rollback are achieved through A / B system partition. According to the method, quantum computing threats are effectively resisted, national security compliance and forward security are ensured, the volume of an update package is remarkably reduced through a resource optimization technology, memory occupation is reduced, verification efficiency is improved, and the method is particularly suitable for resource-limited Internet of Things equipment.

Systems and methods for secure electronic data transfer utilizing an ephemeral key for encryption and decryption of data.

Methods and systems for maintaining security of communications in a multi-device environment are provided herein. A private key associated with a first device is obtained. The private key is known to the first device and unknown to other devices. A public key is generated based on the obtained private key. The public key and the symmetric key is provided to a second device. A respective ephemeral key is generated for each time period of a future time window, where each ephemeral key is generated based on the private key and the symmetric key. A set of hash values is obtained based on each respective ephemeral key and provided to a computing device of a platform. A notification of a secure message of the second device for the first device is received. Content of the secure message is accessed based on the symmetric key and the private key.

The invention discloses a system and method for constructing a trusted secure digital storage space, and relates to the technical field of secure data storage, and the method comprises the following steps: carrying out dynamic fragmentation mapping on original data, and generating an initial dynamic distribution key; performing secondary encryption on the initial time dynamic distribution key to obtain a re-encrypted time dynamic distribution key; performing authority control on the data access behavior according to the user role and the dynamically generated temporary key; performing hierarchical verification on the encrypted data fragments, and calculating and storing an authentication code; a dynamic redundancy storage strategy is carried out according to the data sensitive category of the original data, and the secondary encryption processing calculation process is accelerated. By systematically integrating dynamic fragmentation, hierarchical encryption, dynamic access control, hierarchical verification and a self-healing disaster recovery technology, a comprehensive data security protection framework is constructed, and a set of complete and operable methodology and technology implementation giving consideration to security and efficiency is provided.

The invention relates to the technical field of near field communication, in particular to an NFC card encryption transaction process based on certificate exchange. The existing NFC card encryption transaction process has the problems of insufficient security, weak tamper-proof capability, limited applicability and the like. According to the invention, by introducing a dynamic key negotiation mechanism based on certificate exchange, the security, flexibility and communication efficiency of NFC card encryption transaction are improved. The technical scheme of the invention mainly comprises the following steps of: using a temporary key pair, generating a pair of new keys in each transaction, and avoiding a fixed key; verifying the identity through a public key certificate based on a secret key exchange mechanism of the certificate; the dynamic generation of the AES session key improves the communication efficiency through a key sharing protocol. Through the technical scheme, the security is remarkably improved, the key management is simplified, the communication efficiency is improved, the identity verification is enhanced, the application range is expanded, the implementation cost is reduced, and a comprehensive security guarantee is provided for the encrypted transaction of the NFC card.

A secure communications method includes: receiving, by a first network device, a second ephemeral public key of a second network device; determining, by the first network device, an ephemeral session key based on a first shared key, a first ephemeral secret key of the first network device, and the second ephemeral public key, where the first shared key is shared between the first network device and the second network device; and performing, by the first network device, secure communication with the second network device based on the ephemeral session key.

In a method of data processing, when a service request is initiated by an application running on a terminal device, a temporary key is allocated to the service request. The temporary key is encrypted by using a certificate public key, to obtain an encrypted temporary key, the certificate public key is preset in a source code of the application, and a certificate private key associated with the certificate public key is stored in a server for the application. Request data of the service request is encrypted by using the temporary key, to obtain at least a ciphertext. A network response request packet is generated based on the encrypted temporary key and the ciphertext. The network response request packet is transmitted to the server, the network response request packet requests the server to respond to the service request. Apparatus and non-transitory computer-readable storage medium counterpart embodiments are also contemplated.

A method for associating and authenticating a station (STA) with a coordinated access point (AP) group may include generating a pairwise master key (PMK) between the STA and a coordinator of the coordinated AP group, and maintaining an association and authentication state between the STA and the coordinated AP group based on the PMK. The method may further include generating one or more temporal keys between the STA and the coordinator based on the PMK. The method may further include distributing the PMK from the coordinator to a first member AP and a second member AP of the coordinated AP group. The method may further include generating a first temporal key between the STA and the first member AP, and generating a second temporal key between the STA and the second member AP.

The invention discloses a sandbox debugging method and device and a storage medium, and the method comprises the steps: responding to an API interface of a payment platform selected by a user on a sandbox debugging platform, analyzing a corresponding API document, and generating a parameter debugging form; performing standardization preprocessing on parameters in the parameter debugging form according to an API interface requirement of the payment platform; signing the parameters after standardization preprocessing based on a national cryptographic algorithm, wherein a signature key of the signature is a temporary key dynamically distributed when the user logs in the sandbox debugging platform; the signed parameters are packaged into a request message, and the request message is sent to the API interface; and receiving response data which is returned by the API interface based on the request message and comprises a signature verification result. According to the application, through fusion of full-process automation and the national cryptographic algorithm, the ubiquitous problems of low efficiency and high security risk in the API debugging process in the payment industry are solved.

The invention relates to the technical field of data transmission, in particular to an industrial data transmission security authentication method and system based on OpenHarmony, and the method comprises the steps: obtaining equipment information for data transmission, constructing a cross-platform equipment trust root, generating a dynamic challenge code based on the obtained equipment identification information, and carrying out bidirectional identity verification according to the challenge code. And performing session isolation on the terminal passing the bidirectional identity verification, namely deriving a session key by adopting a hierarchical HKDF mechanism and realizing session isolation, transmitting industrial data by adopting a dual-encryption mechanism based on a session isolation result, automatically triggering key update according to the transmission data volume and duration, destroying a temporary key after the session is ended and generating a chained auditing log, and transmitting the chained auditing log to the terminal after the chained auditing log is ended. According to the method, the dynamic challenge code is generated based on the device identifier through multiple times of Hash, the temporary key pair and the double ECDSA signature are generated in combination with the multi-dimensional entropy source, strict two-way identity verification is achieved, and illegal device access is completely eradicated from the source.

This disclosure relates to a firmware update method, an electronic device, a server, and a system. The method includes: obtaining from a user device an encrypted firmware update package sent by a server to the user device in response to a firmware update request from the electronic device, and a firmware decryption key enDecKey encrypted by the server using a key encryption key KEK, wherein the key encryption key KEK is a temporary key derived based on a predetermined key derivation function; decrypting the received encrypted firmware decryption key enDecKey using the key encryption key KEK to obtain a firmware decryption key decKey; and decrypting the encrypted firmware update package using the firmware decryption key decKey to obtain a firmware update package for updating the firmware in the electronic device.

Systems and methods for secured peripheral device communication via a bridge device in virtualized computer systems. An example method may comprise receiving, by a virtualized execution environment running on a computing system, a state measurement associated with a bridge device of the computing system; generating an ephemeral key; responsive to validating the state measurement, transmitting, to the bridge device, the ephemeral key encrypted using a device key associated with the bridge device; and transmitting, to the bridge device, an access request directed to a peripheral device accessible via the bridge device, wherein the access request is encrypted using a value derived from the ephemeral key.

The invention provides a secret key distribution method and system for end-to-end encryption based on national secret, and relates to the field of secret key distribution, and the method comprises the steps: generating a derived temporary secret key pair based on an SM4 algorithm, and transmitting the derived temporary secret key pair to a client; receiving identity ciphertext information sent by the client, decrypting the identity ciphertext information, generating a derived session key pair, encrypting a private key based on the derived temporary key pair to obtain session public key ciphertext information, and sending the session public key ciphertext information to the client; and receiving encryption request ciphertext information sent by the client, performing decryption to obtain an encryption request, generating a target content key, encrypting the private key of the derived session key to obtain target content key ciphertext information, and sending the target content key ciphertext information to the client. According to the application, the cryptographic algorithm is adopted to protect the secret key distribution process, so that the application under specific security requirements and compliance requirements is met; and the method can conform to most scenes of secure key distribution, solves the problem that the system cannot be used due to a single-point fault, and is more flexibly suitable for a large-scale distributed system.

This invention discloses a blockchain-based method for medical data privacy protection and authorized sharing, relating to the field of medical data technology. This invention achieves medical data privacy protection and compliant sharing through a four-step closed-loop process. The first step is data splitting and encryption: the original data from the target hospital is split into cell units according to the smallest clinical semantic unit, independently encrypted using the SM4 algorithm, and then differentiated enhancement processing is implemented according to sensitivity to build a strong privacy defense. The second step is storage and evidence preservation: the encrypted units are distributed and stored in fragments, and the fragment hash value, semantic tag, and storage index are uploaded to the shared chain for evidence preservation, simultaneously building a cross-chain gateway and protocol to break down sharing barriers. The third step is authorization and verification: a four-dimensional intelligent authorization model is built to verify requests and generate a temporary key bound to this authorization, achieving precise authorization. The fourth step is usage control: the user decrypts and reassembles the data in a TEE adapted to the cryptographic algorithm, with real-time monitoring of the entire operation and synchronization to both chains, ensuring end-to-end security, controllability, and traceability.

The application provides a key distribution method and system based on end-to-end encryption of national encryption, and relates to the field of key distribution, which comprises the following steps: generating a derived temporary key pair based on an SM4 algorithm and sending the derived temporary key pair to a client; receiving identity ciphertext information sent by the client, decrypting the identity ciphertext information, and generating a derived session key pair; encrypting a session public key ciphertext information based on a private key of the derived temporary key pair and sending the session public key ciphertext information to the client; receiving encrypted request ciphertext information sent by the client and decrypting the encrypted request ciphertext information to obtain an encryption request; generating a target content key and encrypting the target content key through a private key of the derived session key pair to obtain target content key ciphertext information and send the target content key ciphertext information to the client. The application protects the process of distributing the key by using the national encryption algorithm, meets the application under specific security requirements and compliance requirements, can meet most of the scenes of securely distributing the key, solves the problem that a single point failure causes the system to be unable to be used, and is more flexible and suitable for large-scale distributed systems.

The application provides a data trusted sharing method and device, and belongs to the technical field of data sharing. The application effectively solves the problems of privacy leakage and compliance of data sharing across domains by constructing a national secret authorization system based on a block chain and an HDFS in-situ computer mechanism. The ownership and domain identifier are strictly checked by using the block chain combined with the national secret asymmetric encryption algorithm, the HDFS block position and other meta information are anchored on the chain, and the non-tamperable digital asset ownership is established. After checking the access certificate based on the temporary key of the national secret symmetric encryption algorithm generated on the chain, only the encrypted query logic is received and executed in the local HDFS, and only the calculation result checked by the national secret hash algorithm and encrypted by the national secret symmetric encryption algorithm is outputted. The architecture of the ciphertext logic in and the statistical result out truly realizes the data usability and invisibility and the sovereignty not being transferred due to sharing under the premise that the whole process meets the national secret compliance requirements.

The technical solutions are directed to MAC address protection for frame integrity verification. A sender device can compute, using a temporal key (TK) programmed in hardware, a first key for a body of a frame and a second key for a header of the frame, different from the first key. The sender can encrypt the body of the frame at a machine access control (MAC) layer using the first key and the header of the frame at the MAC layer using the second key. The sender can compute a first MIC of the encrypted frame using the first key and a second MIC of a content of the header at the MAC layer using the second key. The sender can transmit the frame with the first MIC and the second MIC to a receiver configured to determine integrity of the header of the frame based on the second MIC.

Various embodiments of the present disclosure provide techniques for modifying a value of a credential-less exchange in near real time using a plurality of identifier mappings, member interfaces, and exchange modifiers. The techniques may include receiving an exchange request for executing a value-based exchange that is indicative of a universally unique ephemeral key (UUEK) and one or more request attributes. The techniques include identifying an exchange data object based on the UUEK and identifying a user exchange modifier for the exchange request based on the exchange data object and the request attributes. The techniques include generating a modified exchange value for the exchange request based on the user exchange modifier and providing an exchange authorization request to a member platform with the modified exchange value.