48 results about "Key exchange" patented technology

The application provides a third-party-based key exchange method and system, a trusted third party and an entity, wherein the trusted third party only participates in identity authentication of the entity and assists in negotiation of a key between the two entities, and cannot obtain a shared key between the two entities, effectively solving the problem that the trusted third party cannot avoid obtaining the exchanged key in the existing key exchange scheme based on the trusted third party, and ensuring that the finally exchanged key is only owned by the two entities participating in the key exchange. In addition, in the application, the trusted third party can also provide a random number to participate in the final key generation, thereby ensuring the strength of the final key, meeting the requirement that the trusted third party needs to manage the strength of the exchanged key in a specific application scenario, and enhancing the management and control capability of the system.

This application discloses a method, apparatus, electronic device, and medium for collaborative key exchange. In this application, upon receiving a peer random number public key from a peer key device, the peer random number public key and a first random number public key are sent to a second communicating party. The first random number public key is calculated by the first communicating party using an elliptic curve cryptography algorithm. The second communicating party calculates its own random number public key based on the peer random number public key, the first random number public key, and a second sub-private key, and then sends its own random number public key and intermediate parameters to the first communicating party. The first communicating party calculates a shared key based on its own random number public key, intermediate parameters, and the first sub-private key, and then sends its own random number public key to the peer key device.

The application discloses a post-quantum identity authentication method, system, device, equipment and medium based on a hybrid certificate and a quantum key, and the method comprises the following steps: sending a first authentication request to a key management platform; receiving and determining a preset platform encryption certificate, encryption challenge information and a quantum key according to first response data; determining a client challenge parameter according to the preset platform encryption certificate and the encryption challenge information, the quantum key, a preset client signature certificate and a platform decryption challenge parameter, and determining a second authentication request; sending the second authentication request to the key management platform; receiving and determining a preset platform signature certificate, a platform challenge parameter and an authentication token according to second response data; verifying the data legality of the platform challenge parameter and completing identity authentication according to the quantum key, the preset platform signature certificate and the platform challenge parameter, preventing the identity authentication mechanism from being invalidated due to the cracking of a traditional algorithm, and guaranteeing the long-term security of key exchange and data encryption.

This invention provides a network attack detection method and system for vehicle-to-grid (V2G) interaction. It includes: a local client capturing raw traffic data and extracting key features; then receiving the latest global model parameters, detecting the raw traffic data and encoding the attack detection results into metadata tags, while simultaneously using the key features to train the global model parameters to calculate the quantization gradient; extracting feature vectors from the raw traffic data and combining them with the metadata tags to perform attack prediction and obtain the attack prediction probability; the local client executing defensive actions based on reinforcement proxy learning on the attack prediction probability; the local client uploading the quantization gradient and metadata tags to the server via a secure sparse aggregation protocol; the server reconstructing the global gradient to update the global model parameters via a key exchange protocol and updating the attention weights of the global model using the metadata tags; the latest global model outputting the attack probability of V2G interaction, determining whether to issue an alarm and execute defensive actions.

This invention proposes a hybrid quantum-resistant security enhancement method for IPSec VPNs. The method includes: intercepting Internet Key Exchange (ITE) packets and adding a proxy header between the transport layer header and the ISE payload of the packets; obtaining a quantum key from a key pool using quantum key distribution technology and generating a first-stage session key based on the quantum key; protecting the ISE key negotiation process using a quantum-resistant cryptographic algorithm to generate a second-stage session key; and using the first-stage and second-stage session keys as input parameters for a key derivation function to generate a final session key for encrypted data transmission. This invention, without modifying the original IPSec negotiation process, supports dynamic key combinations of different security levels, enhancing the quantum security protection capability of VPN data transmission while maintaining system flexibility and performance.

The application provides a patient data privacy encryption processing method and system based on digital signature encryption, which comprises the following steps: when a first entity requests to access patient privacy data held by a second entity, the following steps are performed: the first entity sends an access request to the second entity, and attaches a first message signed by a long-term digital signature private key of the first entity; after the second entity verifies the signature, the second entity generates a temporary key exchange key pair, signs a second message containing the temporary public key using the long-term digital signature private key of the second entity, and sends the second message to the first entity; a shared secret is calculated based on the long-term or temporary private key of the first entity and the temporary public key of the second entity, and a symmetric session key dedicated to this data access is derived therefrom; and the metadata information of this data access is jointly signed using the signature private keys of the first entity and the second entity to form an unalterable audit log for storage. The above method guarantees the data security of patient privacy.

The application discloses an end-to-end secret state transmission method for distributed energy power data, and relates to the technical field of distributed energy power data transmission.The application strictly converges the trust boundary to the terminal and the cloud by constructing an end-to-end secret state channel, and the edge gateway only undertakes the functions of ciphertext forwarding and protocol adaptation, does not hold any session key, and does not have decryption capability.The method breaks the traditional hop-by-hop decryption mode, completely eliminates the systematic decryption risk of the gateway as a plaintext gathering point, and simultaneously introduces a hybrid key exchange mechanism in the key system construction between the photovoltaic terminal and the cloud, which provides the ability to resist future quantum computation backtracking decryption through quantum shared secret, and ensures the security compatibility with the existing system through classical shared secret, thereby forming a double insurance security barrier, avoiding the combined attack path of near-end plaintext stealing and far-end quantum backtracking, and realizing efficient and secure secret state transmission.

The invention relates to the technical field of electronics, and discloses a device security upgrade verification method and device, a device, a medium and a program product.The method comprises the steps that a first parameter, a second parameter, a third parameter and a fourth parameter of a to-be-upgraded device are obtained, the first parameter is determined through a device identification code of the to-be-upgraded device, and the fourth parameter is determined through a device identification code of the to-be-upgraded device; the second parameter is determined through first peripheral power supply voltage data of the to-be-upgraded equipment, the third parameter is determined through second peripheral power supply voltage data of the to-be-upgraded equipment, and the fourth parameter is determined through a clock period of the to-be-upgraded equipment; any multiple of the first parameter, the second parameter, the third parameter and the fourth parameter are selected to be combined to obtain a private key; performing key exchange with the server by using the private key and a preset key exchange algorithm to obtain a session key; the session key is used for verifying the upgrade package data sent by the server side, so that the security verification of the upgrade package data is realized, the requirement of one machine with one key can be met, and the security of subsequent vehicle machine equipment upgrade is ensured.

This invention relates to the field of Internet of Things (IoT) technology, specifically to a data encryption method based on WiFi Mesh. The WiFi Mesh-based data encryption method includes the following steps: S1, a key exchange phase, where an unconnected node sends a network access request to a connected node, and the connected node generates a public key A and a private key a using an asymmetric encryption algorithm; S2, the connected node sends public key A to the unconnected node, which generates a random key B using a random number, and encrypts the random key B using public key A to obtain ciphertext b; the broadcast key E is initially generated by the WiFi root node using a random number, and all WiFi Mesh network endpoints use the same broadcast key E; the unicast key F is randomly generated by the connected node. Compared with existing technologies, this invention has the following advantages: it solves the problem of sensitive information leakage during the initial key exchange in data transmission using an asymmetric encryption algorithm; it improves the starting point of the entire cycle, ensuring the security of subsequent data communication.

A method may include: a first verifier receiving a request for a claimed position verification from a prover; the first verifier randomly generating a first bitstring and a second bitstring; the first verifier sending the first bitstring and the second bitstring to a second verifier; the first verifier preparing a quantum system and sending the quantum system to the prover; the first verifier sending the first bitstring to the prover; the second verifier sending the second bitstring to the prover such that the first bitstring and the second bitstring arrive at the claimed position at the same time; the first verifier validating a response received from the prover; and the first verifier confirming that the response was received within an expected time window.

A key exchange system according to an aspect of the present disclosure includes: a plurality of quantum key distribution (QKD) apparatuses that executes a quantum key distribution protocol including at least error correction; and a plurality of hub apparatuses that performs encrypted communication with each other, in which each of the hub apparatuses includes a key generation unit configured to generate an encryption key for performing the encrypted communication with another hub apparatus based on information received from a corresponding one of the QKD apparatuses, and each of the QKD apparatuses includes a QKD processing unit configured to execute the quantum key distribution protocol with another QKD apparatus and generate a correction key from a ciphertext of random number information, and a first transmission unit configured to transmit information representing a result of basis reconciliation in the quantum key distribution protocol to a corresponding one of the hub apparatuses.

A method for exchanging a cryptographic key between a sender and a receiver using a neutrino-based communication channel, comprising the steps of: Sender-side generation of a neutrino beam by: - ​​accelerating protons in a proton beam, - deflecting the proton beam onto a target to produce neutrinos through the decay of short-lived particles; Sender-side generation of a sequence of random bits representing the cryptographic key, and encoding of the random bits by: - ​​controlling the deflection of the proton beam by means of a controllable deflection system to direct the proton beam either onto the target or onto an absorber according to the random bits, thereby encoding the random bits as neutrino pulses; transmission of the neutrino pulses from the sender to the receiver;Synchronization of transmitter and receiver by means of a time synchronization unit that synchronizes the timing of the generated neutrino pulses with time windows of the receiver system; reception of the neutrino pulses by a neutrino detector of the receiver, wherein: - decay products, in particular light signals, which are generated during the interaction of the neutrinos with a detector medium are detected and - the detected signals are each assigned to a key bit; storage and concatenation of the received key bits to generate the cryptographic key, which is stored in a key storage module of the receiver.

Mechanisms for establishing forward secrecy during digest access authentication are provided. A method is performed by a client device. The method includes performing digest access authentication with a server device. The digest access authentication includes sending a first request towards the server device for accessing a resource; and receiving a first response. The first response includes a challenge and a public component of an asymmetric key pair for a key exchange with the server device. The digest access authentication includes calculating, using a digest algorithm, a response parameter based at least on the challenge and the public component of the asymmetric key pair; and sending a second request towards the server device for accessing the resource. The second request includes the calculated response parameter. The digest access authentication includes receiving a second response from the server device that indicates successful digest access authentication with the server device.

A method may include: a third-party receiving a claimed position from a prover; the third-party and the prover exchanging quantum information; the third-party generating a third-party raw key based on the quantum information; the prover generating a prover raw key based on the quantum information; the third-party and the prover performing classical post-processing based on the raw keys; the third-party sending, a position verification request with the claimed position to a first verifier and a second verifier; the first verifier and the second verifier sending classical messages and a quantum system to the prover to arrive at a target time; the prover measuring the quantum system using the classical messages; the prover sending responses to the verifiers; the verifiers validating the responses and confirming that the responses were received within an expected time window; and the first verifier informing the third-party of a result of the validation.

A device can (i) store public keys Ss and Sn for a network and (ii) record private key sd. A network can record a corresponding private keys ss and sn. The device can (i) generate a device ephemeral PKI key pair (Ed, ed) and (ii) send public key Ed to the network. The device can receive an ephemeral public key Es from the network. The device can calculate values for A: an elliptic curve point addition over Ss, Sn, and Es, and B: (sd+ed) mod n. The device can input values for X and Y into an elliptic curve Diffie Hellman key exchange (ECDH) in order to determine a mutually derived shared secret X5, where the network can also derive shared secret X5. The device can (i) use X5 to derive a key K2 and (ii) decrypt a ciphertext from the network using key K2.

This disclosure relates to methods and systems for selecting secure prime numbers for a finite field Diffie-Hellman key exchange. A method for Diffie-Hellman key exchange includes: selecting a field size p in the format p = hq + 1, where q is a prime number of 1 plus factorial b such that q = (b! + 1), and h is a cofactor of a prime number such that p = hq + 1; selecting a generator integer g whose order modulo p is a prime number q or divisible by q; selecting a private key x; and calculating the public key g by applying arithmetic modulo operations on the prime field size p using the power of the private key x raised to the power of the generator g. x mod p; Sends the public key g to the communicating party. x mod p; Receive the second public key B from the communicating party. The second public key B includes the second private key y raised to the power of g, in the form g y The second private key y is chosen by the communicating party; and the key B is created from the received second public key B by applying arithmetic modulo operation on the size p of the prime field, by raising the second public key B to the power of the private key x. x .

The present application relates to the technical field of industrial communication, and particularly relates to a Modbus trusted enhancement method based on a national secret algorithm, comprising the following steps: S1: a client sends identity authentication message information including a time factor, a random number, a client public key and a digest to a server to complete public key exchange, and then identity authentication of both communication parties is performed through transmission of a session identifier; S2: the client sends a key negotiation message to the server, and after receiving the server key parameter returned by the server after successful verification of the key negotiation message, generates a session-specific key; S3: key verification is performed between the client and the server; S4: the client sends a Modbus trusted message carrying a time factor, a random number and a Modbus command to the server after encrypting the Modbus trusted message, and the server analyzes and replies. The present application increases an identity verification process, is used for avoiding misoperation of other PLCs in a PLC login scene, and guarantees anti-replay and tamper resistance of the message through the time factor, the random number and the digest.

A lightweight encryption method is disclosed, designed to reduce computational resource demands on devices such as IoT devices and mobile phones. The method utilizes Shamir's three-pass protocol for key exchange, converting the encryption key into a signed digit number using an odd base. The message is broken into portions, with each portion encrypted by applying a sequence of non-commutative functions based on the signed digit representation of the key. This approach provides secure encryption while minimizing power and resource consumption.

This application relates to the field of information security and discloses a certificate and key management method and terminal based on the HarmonyOS operating system. The method includes: generating and storing key pairs by calling the HUKS interface of the HarmonyOS system; binding a key alias used to uniquely identify the key pair to the corresponding certificate chain, and synchronizing the binding relationship between the key alias and the certificate chain and the certificate status across multiple devices; encapsulating a unified signature interface using Signer; performing bidirectional conversion between the public key of the key pair and SPKI using SpkiUtils to ensure the public key is compatible with external standard PKI systems; and executing the target application operation. This application's embodiment implements complete certificate and key management capabilities under the HarmonyOS system environment, ensures the compatibility of signature results with standard certificate chains, achieves interoperability between public keys and external standard PKI systems, guarantees the compatibility of public key exchange, and possesses cross-device and multi-scenario universality.

The application discloses a kind of unmanned aerial vehicle self-organizing network group key management methods supporting member dynamic joining, quitting and key recovery, belongs to unmanned aerial vehicle self-organizing network security communication technical field.The method includes: system initialization;UAV node is registered, and based on physically unclonable function generation and equipment binding key material;Utilize Cuckoo filter to quickly screen legal members;Two-way authentication and key exchange process are executed between adjacent nodes and establish edge session key;Group key derivation is realized based on edge session key;When node is lost, group key recovery is executed;When member dynamic joins, quits or is revoked, group key update is executed.The method can reduce authentication and key management overhead, improve the processing efficiency when node recovery and member change, and ensure the forward security, backward security, integrity and confidentiality of group communication.

This application provides a key generation method, apparatus, and system. The key generation method, applied to Internet of Things (IoT) devices, includes: generating a first temporary key pair based on first identification information of the IoT device, the first temporary key pair including a first public key and a first private key; determining a connection request based on the first public key and the first identification information; sending the connection request to a cloud server; obtaining verification information sent by the cloud server; and generating a master key based on the verification information and the first identification information; wherein the connection request and verification information are configured to be transmitted through a secure communication channel established by a key exchange protocol between the IoT device and the cloud server. The key generation method of this application achieves a strong association between the master key and the physical hardware of the IoT device, significantly reducing the risk of device cloning due to firmware copying, and improving the security and maintainability of the IoT system.

This invention relates to the field of network security technology in telecommunications, and more particularly to a remote security control system based on computer data. The invention employs an identity authentication unit to perform biometric, token, and hardware multi-factor authentication on the user before connection establishment; and a digital certificate verification unit to establish a secure control channel between the control end and the controlled end after successful authentication and server signature verification; a key negotiation unit generates a session key using a shared secret value generated by a key exchange algorithm and combined with a generated dynamic state factor; a verification unit decrypts control commands based on this session key and verifies the command matching and integrity according to a whitelist similarity threshold and a preset bit error rate of the hash check value; if successful, the command is executed; finally, the remote security control status is determined based on the deviation of the operation behavior, and the similarity threshold, preset deviation, or preset bit error rate is adjusted accordingly. This invention improves the efficiency of remote security control.

The application provides a gateway dynamic switching method and system and a storage medium. The method comprises the following steps: after a gateway device joins a dynamic multicast group, a multicast message and a discovery packet are sent; when the gateway device receives the discovery packet, the multicast server and the multicast client are determined according to the discovery packet, the multicast client is controlled to initiate a transmission control connection to the multicast server, key exchange is performed, an encryption key is obtained, and gateway login is performed according to the encryption key; after the multicast client and the multicast server are successfully logged in, link communication is performed, link quality of the multicast server and the multicast client is detected, and link path switching of the multicast server and the multicast client is performed according to the link quality detection result. According to the embodiment of the application, the link communication is automatically controlled, the link path switching of the multicast server and the multicast client is automatically performed based on the link quality detection result, and the user experience is improved.

An example operation may include one or more of storing a public key of a router and a private key of the router, connecting to a network through one or more network connection ports of the router, transmitting the public key of the router to a remote device and receiving a public key of the remote device via a network connection port during a public key exchange, activating a virtual private network (VPN) on the network connection port based on the public key exchange, selecting an Internet Protocol (IP) address for the remote device, and encrypting a packet with the IP address based on the public key of the remote device and transmitting the encrypted packet to the remote device via the VPN.

This invention relates to the field of federated learning technology, specifically to a decentralized training method based on a secure federated generative adversarial network (GAN) framework. First, a decentralized secure federated GAN framework is constructed, introducing an encrypted model sharding method. Parameter encryption transmission and storage are achieved through vertical sharding, DH key exchange, and pseudo-random noise. Simultaneously, a dual-metric dynamic reputation and anti-poisoning aggregation mechanism are employed, combined with similarity verification, reputation voting, and weighted aggregation to isolate malicious clients. Finally, decentralized iterative training is used, and a sample visualization graph is generated after convergence. Experimental results show that the framework of this invention can still converge stably with a malicious client ratio of 10%–40%, achieving a main task accuracy of 0.89 on the MNIST dataset and 0.67 on the Fashion-MNIST dataset. The backdoor attack success rate is suppressed to below 20%, while achieving end-to-end privacy protection, eliminating single points of failure, and balancing model performance and scalability.

A lightweight encryption method is disclosed, designed to reduce computational resource demands on devices such as IoT devices and mobile phones. The method utilizes Shamir's three-pass protocol for key exchange, converting the encryption key into a signed digit number using an odd base. The message is broken into portions, with each portion encrypted by applying a sequence of non-commutative functions based on the signed digit representation of the key. This approach provides secure encryption while minimizing power and resource consumption.

This invention discloses an identity authentication method integrating quantum-resistant signatures and the X.509 format, relating to the field of data security technology. The method includes: S1, CA generates and publishes globally public parameters; S2, EE1 and EE2 obtain Cert1 and Cert2; S3, EE1 and EE2 perform bidirectional authentication and session key negotiation, and communicate using the session key; constructing a quantum-resistant digital identity certificate to ensure the long-term security and traceability of registration information; during the registration phase, the SLH-DSA algorithm is used to sign the user-submitted registration information to ensure the long-term validity and strong anchoring of the identity certificate, while the ML-DSA algorithm is reused to sign the registration information for rapid verification scenarios; during the authentication interaction phase, the ML-KEM quantum-resistant algorithm is used to implement a dual-path quantum-resistant DKE key exchange protocol to generate a session key, and the ML-DSA algorithm, with higher signature and verification performance, is used to digitally sign and verify the authentication message, achieving identity confirmation and communication integrity protection for both parties, and improving the performance of establishing a secure session link.

This invention relates to the field of PLC communication security technology, and provides an IoT system based on PLC communication and a method for device network access. In this method, the server obtains STA device information and transmits it encrypted to the PLC gateway. By securely encrypting and transmitting the device information, it ensures that user-provided information is not easily tampered with or stolen. Furthermore, the CCO (Controlled Access Center) includes the STA device information in a whitelist, enabling designated STA devices to securely access the network and exchange data. This effectively avoids network security risks that may arise from disabling the whitelist mechanism. Through an automated network access method, STA device authentication, key exchange, and network access are completed, providing a secure, convenient, and effective network access method. The introduction of data encryption and authentication for STA devices during network configuration enhances the overall network security, effectively prevents potential network attacks, and reduces the risk of unauthorized STA devices entering the network by ensuring the legitimacy of the STA devices.