22 results about "Key-agreement protocol" patented technology

A remote security controller (RSC) generates a private key for a client application on a different host computing device and splits the private key into a first fragment and a second fragment. The first fragment, but not the second fragment, is encrypted using a symmetric key. The split private key is returned to the different host computing device. A local security controller (LSC) on the different host computing device is able to derive the symmetric key using a key agreement protocol with the RSC. When the client application needs to digitally sign a data value with the split private key, the client application generates a first partial Multiparty Computation (MPC) signature using the second fragment. The LSC generates a second partial MPC signature with the first fragment, which has been decrypted using the symmetric key. The first and second partial MPC signatures are combinable to digitally sign the data value.

The invention discloses a financial-level secure transmission system based on quantum encryption communication, and the system comprises a terminal quantum key distribution module, a cloud trusted node cluster, and a dynamic key agreement protocol engine. The terminal quantum key distribution module, the cloud trusted node cluster and the dynamic key agreement protocol engine are used for generating a shared key of anti-quantum computing through quantum key division, and realizing end-to-end encrypted transmission of a transaction instruction between a terminal and a cloud; according to the invention, by constructing a quantum key dynamic distribution and hybrid encryption system and creatively fusing quantum teleportation and trusted execution environment technologies, the performance bottleneck of an existing quantum communication system in a financial scene is broken through, and end-to-end secure transmission resisting quantum computing attack is realized.

The application provides a data security encryption method and a smart wearable device, and the method comprises the following steps: performing a hash operation based on a current timestamp and a shared key to obtain a first key seed, performing a hash operation based on the first key seed and a data sequence to be transmitted to determine a second key seed; determining a mapped key symbol sequence based on the second key seed and a preset ring modulus, mapping the data sequence to be transmitted in the preset ring modulus to obtain a data symbol sequence; calculating a Lee distance bit by bit based on the mapped key symbol sequence and the data symbol sequence to obtain a Lee distance sequence, encrypting the Lee distance sequence and the mapped key symbol sequence on the preset ring modulus based on the Lee distance sequence to obtain an encrypted ciphertext symbol sequence; and generating a transmission data packet based on the encrypted ciphertext symbol sequence and the current timestamp and sending the transmission data packet to a receiving end. The application realizes the dynamic key and the anti-cracking capability without relying on a complex key agreement protocol, and improves the data transmission security.

The specification provides a distributed state synchronization method based on a trusted execution environment, applied to a distributed system containing N TEE containers, at least including a first TEE container, the method comprising: the first TEE container determining a second TEE container from the N TEE containers based on a gossip protocol; the first TEE container and the second TEE container respectively confirming whether the other party is trusted based on a remote attestation mechanism; if both parties confirm that the other party is trusted, both parties determine a first session key based on a preset key agreement protocol; both parties determine first incremental data missing in first state data in the first TEE container relative to second state data in the second TEE container; the second TEE container encrypts the first incremental data through the first session key to obtain first encrypted data and sends the first encrypted data to the first TEE container; the first TEE container decrypts the first encrypted data through the first session key to restore the first incremental data, and updates the first state data through the first incremental data.

Systems and methods herein describe privacy preserving multi-touch attribution. The described systems access a plurality of impression events and a plurality of conversion events, and for each impression event and each conversion event, wherein each impression event and each conversion event are associated with user identifiers, the described systems generates a hashed user identifier based on the associated user identifier, initiates a key agreement protocol comprising a key, generates an encrypted identifier by encrypting the hashed user identifier with the key, and stores the encrypted identifier.

The invention provides an anti-quantum security authentication and key agreement method and system for cloud-side-end cooperation, and belongs to the field of security communication of the Internet of Things. The problem that when an existing lattice-based identity authentication and key agreement protocol is deployed for the large-scale and resource-limited Internet of Things, the calculation overhead is large, the energy consumption is high, and the protocol lacks the dynamic updating capability is solved. According to the method, four-stage safety life cycle design of system initialization, equipment registration, bidirectional authentication and key negotiation and dynamic key is combined, quantum attacks can be effectively resisted, the exposure of the real identity of the terminal is avoided, and the calculation and energy consumption overhead of resource-constrained equipment is reduced, so that efficient, extensible and safe identity authentication and key negotiation are realized.

There is provided techniques for authentication between a communication device and a mobile network. A method is performed by the communication device. The method comprises generating a SUCI. The method comprises deriving a key, Kmacme_CD, from a shared secret established as part of generating the SUCI. The shared secret is established by a key agreement protocol. The method comprises sending a registration request message comprises the SUCI to the mobile network. The method comprises receiving an authentication request message from a management device in the mobile network. The authentication request comprises authentication protocol data provided by a server device. The authentication protocol data is based on a key, Kmacme_UDM, of the server device. The method comprises performing an authentication procedure in conjunction with verifying the authentication protocol data using the key Kmacme_CD.

This invention provides a lightweight quantum-resistant key negotiation protocol method and system for edge computing, relating to the field of edge computing security technology. The method includes generating a short vector private key and a public key multinomial matrix based on lattice cryptographic parameters, embedding an identity digest vector into the public key to form an identity-binding public key, generating a dynamic lattice basis chain through recursive reconstruction, and adaptively sparsifying the session parameters using a resource weight vector to finally generate a lightweight session key. This method is resistant to quantum attacks and can be dynamically adjusted according to the computing performance and communication bandwidth of edge nodes, reducing resource consumption.

The application discloses a label privacy set intersection method with enhanced information protection, and relates to the technical field of privacy calculation. The method is initiated by a data demander and is executed together with a data and label holder. The method comprises the following steps: the two parties adopt an inverse Diffie-Hellman key agreement protocol variant on an elliptic curve, add a data disordering operation, and obtain matching data indexes after anonymization; the data demander adopts an inverse process of the disordering operation to restore original data indexes of the intersection set; the two parties execute an inadvertent transmission protocol, and the data demander obtains labels corresponding to intersection data. The method can screen data label information meeting certain characteristics without leaking any data participating in the intersection to the participants, and can maintain the privacy of data other than the labels.

The present invention relates to a backup device for securely transferring state data from a first secure element to a second secure element, the device comprising: - a communication interface configured to establish a secure communication link with the first secure element of a user device, wherein the user device is a smartphone or tablet comprising an eUICC; - a processing unit configured to issue a backup command to the first secure element and receive a backup payload in response - a second secure element configured to store said backup payload; wherein the processing unit is further configured to process the backup payload as a data structure representative of internal state information, secret keys, secret phrases, identity data, cryptographic counters, parts of an eSIM profile, and / or applets executed on or stored in the first secure element, and wherein the backup payload is encrypted by the first secure element using a symmetric key derived from a shared cryptographic session and / or the processing unit is configured to perform a key agreement protocol with the first secure element.

The invention belongs to the field of information security, and provides an anonymous post-quantum two-party authentication and key agreement protocol method and system for an Internet of Vehicles environment. The method comprises an initialization stage, a registration stage and an authentication and key negotiation stage. Wherein in the authentication and key negotiation stage, the vehicle-type entity sends a service request to the server-type entity by using system parameters, a pseudonym and long-term secret information of the vehicle-type entity so as to complete authentication; the server class entity receives the request information of the vehicle class entity, carries out authentication, generates a common session key and a service response by using system parameters and long-term secret information of the server class entity after the authentication is passed, and sends the service response to the vehicle class entity to complete the response; and after receiving the service response of the server class entity, the vehicle class entity calculates a common session key to complete key confirmation. According to the invention, the vehicle entity class entity can be ensured to safely apply for the front work of the service from the server class entity in the Internet of Vehicles environment.

The invention relates to a verification unit (2), comprising a detection unit (21) designed to detect an authentication and key agreement protocol process, a creation unit (22) designed to derive data belonging to the authentication and key agreement protocol process from the authentication and key agreement protocol process taking into account a confirmation criterion (211), an authentication unit (23) designed to authenticate the authentication and key agreement protocol process from the creation unit (22), the device comprises a protection unit (24) configured to protect data for integrity, thereby forming integrity-protected data (232), and a provision unit (24) configured to provide the integrity-protected data (232). The invention further relates to a device (1) and to a method for providing integrity-protected data (232).

The invention discloses a multi-factor group authentication and key agreement protocol method based on certificateless aggregation signature. A trusted authentication mechanism generates system parameters and distributes a key to initialize a system; the user and the intelligent equipment node register to the gateway node through a public channel, so that extra overhead caused by establishment of a secure channel is avoided; in an authentication and key negotiation stage, a user only needs to send an authentication request to a gateway node to realize bidirectional authentication and session key negotiation with a group of intelligent device nodes; the protocol adopts an aggregation signature mechanism, so that a user can verify the authenticity and integrity of keys returned by all devices at one time, a negotiated session key has uniqueness, and even if a gateway node key is broken, the key security can still be ensured, and perfect forward secrecy is supported; meanwhile, the protocol dynamically updates the key in the group through the Chinese remainder theorem to realize forward security and backward security; the method has higher safety and efficiency in an industrial internet scene, and is particularly suitable for a multi-device environment.

The invention relates to the technical field of network communication privacy protection, in particular to an SM9-based three-party one-round key negotiation method, which comprises the following steps of: introducing an SM9 key exchange protocol to construct a three-party system, setting a main public key and a main private key through a key generation center KGC, and then respectively performing key extraction and key exchange by users of all parties, in the communication process, the user A sends verification data to the users B and C and receives the verification data transmitted by the users B and C, and the communication cost is only 4G (G represents the length of points on the group G). According to the negotiation method, three-party key negotiation can be completed only through one round of interaction, and compared with a traditional three-party multi-round key negotiation protocol, the number of times of interaction and calculation overhead are reduced.

The present application provides a communication method and communication device, comprising: configuring a first security connectivity set key; receiving a key agreement protocol message from a second network device, the key agreement protocol message including a preset extended parameter set, the preset extended parameter set including a multi-bit random number generated based on the second security connectivity set key and a security association key; wherein the second network device acts as a key server for providing the security association key, and the second network device is configured with the second security connectivity set key; determining the security association key based on the multi-bit random number and the first security connectivity set key; and using the security association key to encrypt communication messages between the first network device and the second network device. The present application improves the security of security association key distribution, thereby improving the security of communication messages transmitted between network devices.

The invention relates to the technical field of key management, and discloses an Ad hoc network group key management method, which comprises the following steps of: constructing a logic key tree based on an elliptic curve cryptosystem; mapping the elliptic curve points into integer field numerical values through a mapping function, wherein the integer field numerical values are used for generating each node key of the logic key tree; when a group is initialized, dynamically generating a group key through a multi-party key negotiation protocol; when a new member joins, adjusting a logic key tree structure and updating a related node key to ensure that the new member cannot decrypt the communication content before joining; and when the member exits, updating the node key on the related path of the exit member to ensure that the exit member cannot decrypt the communication content after the exit. According to the method, a logic key tree structure and multi-party key negotiation are adopted, and the method has the key independence characteristic. The method is based on a logic key tree structure, supports node dynamic event group key updating, meets the requirements of group key forward and backward security, and is suitable for an Ad hoc network environment.

Apparatus and methods for managing data stored within a container. The container may be associated with at least one registered user. Data within the container may be encrypted by a data encryption key (DEK). A computing device comprises: a security module including a cryptographic processor, a main processor, and a memory. The memory stores instructions that, when executed, configure the processor to: authenticate a user based on a user secret associated with the container, and generate a soft key based on the user secret. The instructions cause the cryptographic processor to generate a security generator output including a cryptographic key component, and generate an enhanced user key based on a key agreement protocol using the soft key and the cryptographic key component. The instructions cause the processor to construct an unencrypted DEK associated with the enhanced user key, and use the unencrypted DEK to decrypt a subset of the data.

This invention discloses a decentralized key negotiation method and system for weak network environments, comprising: discovering a set of devices participating in the negotiation, including statically configured neighboring devices and online devices dynamically discovered through multicast; determining the negotiation initiator based on the IP address of each device; exchanging negotiation messages with the target device, executing a key negotiation protocol for a preset number of rounds, generating a shared key using the elliptic curve Diffie-Hellman algorithm, and performing bidirectional key consistency verification using message verification codes; during the key negotiation process, performing immediate retransmission of negotiation messages based on sequence numbers and selective acknowledgment mechanisms, and dynamically adjusting the retransmission timeout threshold according to the round-trip time. This invention achieves efficient and reliable key negotiation between cryptographic devices in weak network environments without relying on a central coordinator, significantly improving the negotiation success rate and transmission efficiency.

The invention relates to the technical field of network and security, in particular to a satellite terminal authentication method and device, computer equipment and a storage medium. The method comprises the following steps: in response to a received first authentication request sent by an AMF network element, decrypting a subscription hidden identifier (SUCI) in a terminal authentication request to obtain a user permanent identifier (SUPI); sending the SUPI to a unified data management UDM network element, so that the UDM network element sends an authentication vector generation request to an AKMS network element after determining an authentication mode according to the SUPI; in response to a received authentication vector generation request sent by the UDM network element, generating an authentication vector according to a core algorithm group contained in a key agreement agreement (AKA) authentication protocol; and performing AKA authentication on the satellite terminal according to the authentication vector. According to the method and the device, the subsequent process of generating the key through the authentication vector and the storage of the key are both completed by the AKMS network element, so that the security of key transmission in the AKA authentication process is improved, and the repeated deployment of a cryptographic operation function is avoided.

This invention discloses a disaster-resilient emergency communication method and system based on an authentication and key negotiation protocol, including steps such as system initialization, UAV registration, two-way authentication and key negotiation, share calculation, and group session key recovery. This invention achieves secure communication among UAV groups through a designed threshold secret-sharing group authentication and key negotiation protocol, and allows the group authentication and key negotiation protocol to remain usable even when a few UAVs are offline or disconnected, providing theoretical support for UAV-enabled resilient disaster-relief. Security analysis and performance evaluation show that this invention has significant advantages in security level, computational overhead, and communication overhead.

Systems and methods herein describe privacy preserving multi-touch attribution. The described systems access a plurality of impression events and a plurality of conversion events, and for each impression event and each conversion event, wherein each impression event and each conversion event are associated with user identifiers, the described systems generates a hashed user identifier based on the associated user identifier, initiates a key agreement protocol comprising a key, generates an encrypted identifier by encrypting the hashed user identifier with the key, and stores the encrypted identifier.

A method for pairing a key fob with a control unit is provided. The key fob executes an ID authenticated key agreement protocol with a pairing device based on a key fob identification to authenticate one another and to generate a first encryption key. The pairing device encrypts a control unit identification using the first encryption key. The key fob receives the encrypted control unit identification transmitted from the pairing device. The key fob then executes an ID authenticated key agreement protocol with the control unit based on the control unit identification to authenticate one another and to generate a second encryption key. The key fob then receives an operational key transmitted from the control unit that is encrypted with the second encryption key.