559 results about "Key exchange" patented technology

The present invention discloses a post-quantum key negotiation system and method based on the IKE protocol, which relates to the field of network security, especially the design and implementation of key exchange and identity authentication protocols. The present invention provides security for data protection and identity authentication by combining the IKE protocol scheme with the post-quantum cryptographic algorithm; by introducing post-quantum cryptographic algorithms such as ML‑KEM, ML‑DSA and FALCON, the quantum resistance of key exchange and identity authentication is enhanced, and the flexibility and adaptability of the protocol are also improved; in addition, the dynamic algorithm selection mechanism adopted by the present invention enables users to optimize security performance according to specific needs, thereby improving the overall efficiency of the system while ensuring information security.

The invention belongs to the technical field of digital information transmission, and relates to a vehicle-mounted ad hoc network security communication system and method based on an NTRU lattice cryptosystem, and the system comprises a message signature module, a message encryption module, a message decryption module, an identity authentication module, and a key exchange module. The message signature module carries out signature by utilizing a private key and a random polynomial dynamically generated by a pseudo-random number generator based on an NTRU lattice cryptosystem; the message encryption module encrypts a to-be-sent message by randomly selecting a temporary polynomial and combining a public key of a receiver; the message decryption module is used for decrypting the received ciphertext # imgabs1 # by using a private key and an inverse element # imgabs0 # of a module p of the private key; the identity authentication module is used for performing identity authentication; the key exchange module realizes secure key exchange between communication nodes in the vehicle-mounted ad hoc network through an improved Blom key distribution protocol. The system improves the security and communication efficiency of the vehicle-mounted network.

The invention relates to the technical field of commercial password detection methods, and discloses a high-security method for negotiating a temporary session key based on a national secret algorithm, and the commercial password detection method comprises the following steps: initialization and identity authentication: two communication parties generate an SM2 public and private key pair, and the identity is verified through a digital certificate and an SM2 signature; temporary key negotiation: generating a shared key point based on an SM2 key exchange protocol; session key derivation: generating a temporary session key by using an SM3 hash algorithm; key confirmation and encrypted communication: verifying the key through an SM4 algorithm and encrypting communication data; according to the high-security method for negotiating the temporary session key based on the national secret algorithm, efficient key negotiation of both communication parties in an unsecure channel is realized through an SM2 key exchange protocol, an SM3 hash algorithm and an SM4 symmetric encryption algorithm. The method combines digital certificate authentication, dynamic random numbers and timestamps, has forward security, replay attack resistance and man-in-the-middle attack resistance, and is suitable for high-security scenes such as finance and government affairs.

The invention discloses an anti-quantum security identity authentication method and system, a medium and equipment. The method comprises the following steps: S1, a client, a service server and a key distribution center perform key configuration by adopting a digital signature algorithm; s2, the client sends an authentication request to the authentication server, and receives an authentication response with a bill granted bill returned by the authentication server; s3, the client sends a bill request to the bill issuing server, and receives a bill response with the service bill returned by the bill issuing server; s4, the client generates a client key exchange public key by adopting a first key exchange algorithm and sends an access request, the service server calculates a shared key and a ciphertext after receiving the public key, generates an access response comprising the ciphertext and identity information encrypted by using the shared key, and returns the access response to the client; and S5, the client receives the access response and obtains the shared key, and performs encrypted communication with the service server by using the shared key. The method has forward safe quantum attack resistance and strong identity authentication.

The invention relates to the technical field of quantum key distribution, and discloses a communication protocol security verification method based on quantum key distribution, which comprises the following steps of: establishing a quantum communication channel framework, loading protocol parameters to generate an initial security verification model, configuring a security state transition rule, and performing cross-layer data fusion in combination with quantum entity parameters; and obtaining a whole-process safety tracking model. And executing security path deduction through the model, generating a key exchange trajectory chain, constructing security trajectory simulation data, establishing a quantum conflict resolution mechanism, training and generating a security policy optimization model, and outputting security governance parameters. Security increment simulation information is generated based on security governance parameters and the like, a multi-target decision model is constructed in combination with protocol evolution constraint conditions, optimal security path parameters are adjusted and generated, a security verification strategy is verified and updated through a real-time quantum mapping network, and a whole-process security matching target is achieved. According to the method, the comprehensiveness, the accuracy and the dynamic adaptability of quantum communication protocol security verification are effectively improved.

A method and system for optimizing compute runtime and memory footprint of a linear transformation process are provided. The method includes determining a set of optimal rotation parameters, wherein the optimal rotation parameters provide an optimal tradeoff between runtime compute resources and a memory footprint for a runtime execution of the linear transformation process; initializing the linear transformation process to run a boosting technique with the determined set of optimal rotation parameters, wherein the boosting technique, when executed at runtime as part of the linear transformation process, performs at least one iteration that yields rotated ciphertexts, and wherein the at least one iteration is based on the determined set optimal rotation parameters and at least one key switching key (KSK); and loading the initialized linear transformation process to an internal memory of a hardware accelerator.

The invention provides an IKE (Internet Key Exchange) protocol security enhancement method based on PUF (Physical Unclonable Function) dynamic authentication and a post-quantum mixed key, which organically combines a PUF, a post-quantum cryptographic algorithm (PQC, especially Kyber KEM) and an improved Internet Key Exchange Protocol (IKE) to realize key exchange of post-quantum security and enhanced identity authentication. The method comprises the following steps: generating a dynamic pre-shared key (PSK) by utilizing the PUF; the method comprises the following steps: integrating a Kyber KEM to an IKE protocol, and replacing traditional Diffie-Hellman key exchange; the PUF-driven dynamic PSK is used as an identity authentication method of the IKE; meanwhile, Kyber KEM and ECDH are adopted for key exchange, and a final session key is generated through joint participation of a Kyber negotiation key, an ECDH negotiation key and PSK derived by PUF; and an IKE protocol process is optimized, and Kyber key exchange and PUF (Physical Unclonable Function) authentication are completed in an IKESAINIT stage and an IKEINTERMEDIATE stage. According to the method, key exchange is post-quantum secure, identity authentication is also post-quantum secure, and the final key integrates three key components of Kyber, ECDH and PUF, so that triple security assurance is provided.

The invention discloses a data protection method for fusing a quantum key in a TLS, and relates to the technical field of quantum secret communication. According to the method, a quantum key is combined with a pre-shared key to perform identity authentication, and a pre-shared key database is continuously updated, so that the problem that a public key identity authentication system is easily attacked by quantum computing and the problem that the security is reduced due to repeated use of the pre-shared key in the existing method are solved; meanwhile, according to the method, a session key used in the communication process is generated by taking the quantum key as a key material through a preset key generation algorithm, so that the use of an unsafe traditional key exchange algorithm is avoided, and the security of data transmission is enhanced.

A data management server manages a database storing confidential data, and stores public information and first secret information in a trust zone. A client terminal holds the public information and second secret information. The data management server generates a first public key by using the public information and the first secret information; and transmits the first public key. The client terminal generates the user secret key by using the public information, the second secret information, and the first public key; generates a second public key by using the public information and the second secret information; and transmits the second public key. The data management server generates the user secret key in the trust zone by using the public information, the first secret information, and the second public key; and generate, in the trust zone, key management data for managing the user secret key; and record the key management data.

The invention discloses an encryption method and device for industrial internet data exchange, equipment and a medium, and relates to the technical field of industrial information security, and the encryption method comprises the following steps: generating a pair of public key and private key for industrial equipment or nodes preliminarily participating in data exchange by using an elliptic curve ECDH protocol, and carrying out initialized key exchange; generating a temporary additional key, and calculating a temporary session key; encrypting the temporary session key by using a public key of a receiver to obtain a session key, and processing data according to different stages of data exchange; and when each session ends or a preset time / data volume threshold is reached, automatically discarding the old key and renewedly negotiating a new session key. According to the method, resource consumption in the key exchange process is reduced, potential safety hazards possibly caused by key reuse or long-term key fixation are reduced, the attack resistance of the data exchange process is improved, the confidentiality and integrity of data exchange are guaranteed, and a continuous and safe environment is constructed for data exchange of the industrial internet.

A server can receive a device public key and forward the device public key to a key server. The key server can perform a first elliptic curve Diffie-Hellman (ECDH) key exchange using the device public key and a network private key to derive a secret X1. The key server can send the secret X1 to the server. The server can derive an ECC PKI key pair and send to the device the server public key. The server can conduct a second ECDH key exchange using the derived server secret key and the device public key to derive a secret X2. The server can perform an ECC point addition using the secret X1 and secret X2 to derive a secret X3. The device can derive the secret X3 using (i) the server public key, a network public key, and the device private key and (ii) a third ECDH key exchange.

The invention provides a secret key negotiation method based on an SM2 encryption certificate and a communication system. Wherein the definition of an SM2 key exchange protocol and an SM2 encryption certificate is added in the extension of a TLS protocol, so that the SM2 dual-certificate mechanism of the national secret can be applied to the key negotiation process based on the TLS protocol, namely, a client and a server can respectively generate temporary public keys through handshake messages and complete the generation of a shared key; the application of the encryption certificate of the SM2 algorithm in the key negotiation based on the TLS protocol is realized, and the normal application of other extensions of the TLS protocol is not influenced.

Disclosed embodiments provide systems and methods for generating an SKE Authentication Response using a Security Parameter Index (SPI) Transform to provide secure data transfer in a computing environment. A disclosed method comprises receiving, from an initiator channel on an initiator node, a SKE Authentication Request message at a local key manager (LKM) executing a responder node to initiate a secure communication between the initiator channel and a responder channel. The LKM obtains a Security Parameter Index (SPI) Transform, an SA Index, and SPI Transform values. The LKM creates an SPI based on the SPI Transform using the SA Index and the SPI Transform values. The LKM builds an SKE Authentication Response message based on the SKE Authentication Request message and the SPI, which including the SPI and an encryption algorithm. The LKM transmits the SKE Authentication Response message to the initiator channel on the initiator node using the responder channel.

The invention discloses an IPSec (Internet Protocol Security) VPN (Virtual Private Network) security gateway communication method fused with a post quantum cryptography technology, which comprises the following steps of: S1, in a first-stage main mode of IKE (Internet Key Exchange) key agreement, replacing a traditional single SM2 algorithm and a digital certificate based on an SM2 cryptographic algorithm with an SM2 and PQC mixed algorithm and a mixed PQC digital certificate; s2, the initiator and the responder respectively use the PQC encryption key pair and the PQC signature key pair to carry out key exchange and data signature, and simultaneously use the SM2 encryption key pair and the SM2 signature key pair to carry out key exchange and data signature; s3, in the message 1, the initiator sends a security alliance load containing the attribute of the fused SM2 and PQC algorithm to the responder; s4, in the message 2, the responder feeds back a PQC series hybrid certificate and an SA proposal; and S5, in the message 3 and the message 4, the initiator and the responder complete key exchange and verification. According to the invention, the security of the IPSec VPN security gateway can be improved, and quantum computing attacks can be resisted.

The invention discloses a lightweight identity authentication and key exchange scheme based on an SRAM (Static Random Access Memory) PUF (Physical Unclonable Function) in an Internet of Vehicles environment. The lightweight identity authentication and key exchange scheme comprises the following steps: (1) a one-time registration stage: a vehicle unit (OBU) transmits static random access memory (SRAM) information and identity (ID) information serving as fingerprints to a roadside unit (RSU) under a safe condition; and (2) an identity authentication stage: the OBU and the RSU verify each other through dynamic identity authentication. And the OBU sends a challenge value, the RSU generates a response value by using the stored SRAM fingerprint, and the OBU verifies the identity of the RSU by confirming the correctness of the response value. Then, the RSU generates a new challenge value, the OBU generates and sends a response value through the SRAM PUF, the RSU verifies and confirms the OBU identity, and therefore bidirectional authentication is completed; and (3) key generation: after identity authentication is completed, the OBU and the RSU generate a secure session key through Hash operation. The secret key is used for subsequent encryption communication, and the integrity and confidentiality of data in the transmission process are ensured. The new key generated by each communication session further enhances the security of the system.

A method and system of the device may include identifying, in an FHE program, key-switching operations occurring after a ModRaise operation. In addition, the device may include determining a first aggregated polynomial sum and a second aggregated polynomial sum; and configuring instructions for performing a MultSum operation based on the determined first aggregated polynomial sum and the second aggregated polynomial sum, the instructions are programmed to be executed during runtime, where the MultSum operation outputs two polynomials, each of which is an inner product between a single cyphertext polynomial and the first aggregated polynomial sum and a single cyphertext polynomial and the second aggregated polynomial sum, thereby reducing memory usage and computational overhead and enhancing key-switching efficiency.

Embodiments of the present disclosure provide systems and methods for generating a secure key exchange (SKE) Authentication Request using a Security Parameter Index (SPI) Transform to provide secure data transfer in a computing environment. A disclosed method comprises receiving an SKE SA Initialization Response message at a local key manager (LKM) executing on an initiator node to initiate a secure communication between an initiator channel on the initiator node and a responder channel on a responder node. The LKM creates an SPI based on an SPI Transform using an SA Index and SPI Transform values, and the LKM builds the SKE Authentication Request message, which comprises the SPI, a set of cryptographic keys, and a list of encryption algorithms supported by the initiator channel. The LKM sends the SKE Authentication Request message to the responder channel on the responder node using the initiator channel.

Disclosed are an authentication and key agreement method and a system. The method comprises: receiving first verification information sent by a communication initiator, and after the first verification information passes verification, querying to obtain information of a first QKD node and information of a second QKD node; sending to the first QKD node a first identity verification request, so that after verifying that the first identity verification request has passed, the first QKD node generates a session key at the first QKD node and the second QKD node; receiving a key distribution session message which is sent by the first QKD node and carries an identifier of a session key, and forwarding said message to the second QKD node; and when the session key corresponding to the identifier of the session key exists at the second QKD node, receiving an identifier of a session key which is sent by the second QKD node, and forwarding the identifier of the session key to the communication initiator, so that the communication initiator carries the identifier of the session key to request a session key from the first QKD node.

The invention relates to the technical field of audio and video transmission, in particular to an internal and external network audio and video secure transmission method and system based on a cloud platform. By combining the load balancing technology with the real-time load state and the audio and video stream characteristics of the cloud platform, the encrypted traffic can be dynamically distributed to a plurality of back-end servers, and the calculation overhead in the encryption process can be effectively reduced through selection of the lightweight asymmetric encryption algorithm and the optimized key exchange process; in a handshake stage, by optimizing a key negotiation process and adjusting a key exchange process according to segmentation characteristics, the execution efficiency of a protocol is further improved, and by dynamically adjusting the execution opportunity of encryption operation, it is ensured that the encryption operation is executed at a proper opportunity, and the encryption efficiency is improved. By monitoring and adjusting the load distribution strategy and the encryption parameters in real time, the system operation mode can be dynamically adjusted according to the distortion degree and the transmission state of the audio and video streams, and the distortion degree of the audio and video streams is effectively reduced.

The invention discloses a network communication dynamic encryption method, an encryption and decryption system, equipment, a medium and a product, and relates to the technical field of communication. The method comprises the steps that a dynamic factor is obtained through a Berkley packet filter function, a key is generated based on the dynamic factor, the key generated based on the dynamic factor has high randomness and unpredictability, and the problem that a fixed key is adopted in a traditional encryption mode, and consequently the key is prone to being cracked can be solved; moreover, by using the execution environment of the Berkley packet filter function in the kernel mode, the risk that the key is stolen in the transmission and storage process is reduced, the influence on the network communication performance is small, and the network communication encryption efficiency and the network communication security are improved. Moreover, the information of network communication is used as the basis of key generation, additional key distribution and storage management processes are not needed, complex key exchange and certificate management mechanisms are not needed, the key management process is simplified, and the operation and maintenance cost of the system is reduced.

One feature pertains to a method for secure wireless communication at an apparatus of a network. The method includes receiving a user equipment identifier identifying a user equipment and a cryptographic key from a wireless wide area network node, and using the cryptographic key as a pairwise master key (PMK). A PMK identifier (PKMID) is generated based on the PMK and the two are stored at the network. A PMK security association is initialized by associating the PMK with at least the PMKID and an access point identifier identifying an access point of the apparatus. An association request is received that includes a PMKID from the user equipment, and it's determined that the PMKID received from the user equipment matches the PMKID stored. A key exchange is initiated with the user equipment based on the PMK to establish a wireless local area network security association with the user equipment.

The invention discloses a cross-domain authentication bridging method and system oriented to industrial Internet of Things interconnection, and belongs to the technical field of Internet of Things security, and the method comprises the steps of system initialization, cross-domain bridging, certificate verification, key exchange and secure communication, dynamic certificate updating and management and the like. According to the method, technical means such as ChaCha20, Poly1305, BLAKE2s, Ed25519, an elliptic curve Diffie-Hellman and the like are comprehensively utilized, a Bloom filter and a Merkle tree are utilized to realize incremental updating and rapid verification of a revoked list, and dynamic key generation and seamless switching are completed through domain division management. Therefore, the system has the characteristics of low time delay, high safety and fault tolerance, is suitable for large-scale industrial scenes, can remarkably reduce the bandwidth and calculation overhead, improves the equipment interconnection efficiency, enhances the safety, and is suitable for industrial field multi-domain collaboration.

The invention relates to the technical field of communication security, in particular to a security authentication method and system and electronic equipment, and the method comprises the steps: sending an algorithm support list, a mixed key exchange parameter, a first random number and a first certificate request to a second terminal, and enabling the second terminal to generate a second handshake key and a ciphertext; and determining the first handshake key and verifying the target first certificate chain sent by the second terminal by using the first handshake key to obtain an authentication result. Identity authentication is performed based on the mixed key exchange parameter, so that the terminal has the security of quantum attack resistance, and in the whole identity authentication process, the authentication efficiency of the terminal is improved. The leakage of plaintext parameters in the initial handshake message is reduced, and subsequent messages are subjected to different encryption processing, so that the risk of leakage of an identity authentication key is reduced, and the security of identity authentication is improved. Meanwhile, the algorithm selection list is sent in a combined algorithm mode, the algorithm selection matching time of the second terminal can be effectively shortened, and the identity authentication efficiency is improved.

Examples of the disclosure provide for a scatter network device. In some examples, the scatter network device includes a non-transitory memory, at least one processor, and a key exchange application stored in the non-transitory memory. When executed by the at least one processor, the key exchange application generates a key exchange request, transmits the key exchange request to a first network endpoint via a first communication band, responsive to transmitting the key exchange request, receives a key exchange response, generates a symmetric encryption key based on the key exchange response, and transmits an authenticated message encrypted via the symmetric encryption key to a second network endpoint via a second communication band.

The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for Secure Node Exchange Attribute-based Keys (SNEAK) including secure exchange of sensitive message elements between sequential message nodes using attribute-based key management. Each message node can access none, one, some, or all encrypted message elements based on assigned attributes of that message node. A key management node provides key exchange for each Content Encryption Key (CEK) used to protect the message elements based on attributes of the message nodes.

The invention provides a routing method suitable for a quantum key distribution network and related equipment, and relates to the technical field of quantum communication. The method comprises the following steps: determining a source key node and a target key node in the quantum key distribution network; obtaining a plurality of key relay paths between the source key node and the target key node according to the topological information of the quantum key distribution network; for each secret key relay path, calculating a composite routing metric value of the secret key relay path according to the minimum value of the residual secret key quantity of each link on the secret key relay path, the minimum value of the reliability metric value of each link and the secret key exchange rate of all secret key nodes; and determining a target key relay path from the plurality of key relay paths according to the calculated composite routing metric value. According to the method, the composite routing metric value of the key relay path is defined, the security, stability and transmission efficiency of the path can be comprehensively and accurately reflected, the method is suitable for a large-scale quantum key distribution network, and the routing accuracy is improved.

The invention relates to the technical field of information security and intelligent transportation, and discloses an airport self-service luggage check-in data security and privacy protection method, which comprises the following steps that an encryption key is generated through a quantum key distribution technology, and the encryption key realizes secure sharing between communication equipment at two ends through quantum entanglement; the security of the key is ensured by using the quantum unclonable theorem; in the data transmission process, a homomorphic encryption algorithm is adopted to encrypt data, it is ensured that even if the data is operated in the encryption state, data content cannot be leaked, and homomorphic encryption allows addition and multiplication operations to be executed on the encrypted data without decryption. Key exchange is carried out through the quantum key distribution technology, high safety in the data transmission process is ensured, and compared with a key exchange mode depending on a traditional encryption algorithm in the prior art, the method adopts the quantum entanglement and quantum unclonable theorem.

The invention belongs to the technical field of federated learning and Internet of Vehicles crossing, and particularly relates to an asynchronous federated learning method for realizing lightweight privacy protection in Internet of Vehicles. Public key exchange is carried out between the station and the base station to calculate a shared secret key; the vehicle updates a local model by using the global model parameters, and performs training by using local data; random number generation is carried out based on the shared secret key and the training round, and the vehicle adds the random number to the gradient of the trained local model parameter to realize local model parameter encryption; the RSU forwards the vehicle information and the training round to a base station, the base station searches a shared secret key corresponding to the vehicle information, and the sum of random numbers is calculated in combination with the training round; the RSU carries out decryption aggregation on the encrypted gradient information based on the sum of the random numbers, and global model parameters are updated; and the RSU broadcasts the global model parameters, the vehicle updates the local model by using the global model parameters, and then the next round of training is continued until the training is finished.

The invention discloses an IPSec VPN security gateway communication method based on a post quantum cryptography technology, and the method comprises the following steps: S1, replacing a conventional SM2 algorithm and a certificate with a PQC algorithm and a digital certificate in a first-stage main mode of IKE key negotiation; s2, the initiator and the responder respectively use the PQC key pair to complete key exchange and signature; s3, in the message 1, the initiator sends a security alliance load containing a PQC public key algorithm attribute to the responder; s4, in the message 2, the responder sends an SA load containing a PQC signature certificate and an encryption certificate, and a received SA proposal sent by the initiator is marked; s5, in the message 3 and the message 4, the initiator and the responder complete key exchange and verification; and S6, in the message 5 and the message 6, the initiator and the responder encrypt the transmitted information by using a symmetric cryptographic algorithm, and identify the previous exchange process. According to the invention, the security of the IPSec VPN security gateway is improved, and quantum computing attacks can be resisted.

A key exchange system according to an aspect of the present disclosure includes: a plurality of quantum key distribution (QKD) apparatuses that executes a quantum key distribution protocol including at least error correction; and a plurality of hub apparatuses that performs encrypted communication with each other, in which each of the hub apparatuses includes a key generation unit configured to generate an encryption key for performing the encrypted communication with another hub apparatus based on information received from a corresponding one of the QKD apparatuses, and each of the QKD apparatuses includes a QKD processing unit configured to execute the quantum key distribution protocol with another QKD apparatus and generate a correction key from a ciphertext of random number information, and a first transmission unit configured to transmit information representing a result of basis reconciliation in the quantum key distribution protocol to a corresponding one of the hub apparatuses.