2378 results about "Key management" patented technology

The invention provides a security encryption communication method and system based on quantum key management. The method comprises the following steps: acquiring system state data, and generating node state data, network connection diagram data and a system state matrix; receiving a communication request data packet, and generating a request feature vector, a service weight coefficient and a service demand matrix; the method comprises the following steps: collecting real-time network state data, constructing an enhanced Bayesian network model, and generating a network state scoring matrix; acquiring key pool state data, establishing a key consumption prediction model, and generating a key resource distribution matrix; constructing a multi-objective optimization model, and generating a scheduling strategy matrix; and executing the scheduling strategy and performing performance evaluation. According to the method, the quantum state de-coherence effect and the channel noise influence are considered, efficient management and safe distribution of quantum keys are achieved by establishing a complete evaluation and prediction system, and the performance and reliability of a communication system are improved.

The invention provides a secure channel networking method based on edge computing power, and the method comprises the steps: obtaining the security parameters of a link between nodes in a network topology structure based on a selected networking strategy, including link encryption strength, an authentication mechanism and a key updating period, and combining the bandwidth and time delay of the link, obtaining an optimal secure communication route between the nodes through an edge calculation method; issuing the optimized node communication route to each edge computing node, and dynamically adjusting an authentication mechanism and a key management strategy of a secure channel between the nodes according to link security parameters including link encryption strength, a delay jitter threshold and a packet loss rate threshold; and according to the updated networking strategy, dynamically optimizing node roles and link redundancy, updating a network topology structure, and dividing edge nodes into three node function roles of computing nodes, storage nodes and forwarding nodes in combination with node computing capability, storage capacity and energy consumption level.

The invention relates to the technical field of intelligent security operation and maintenance, in particular to an artificial intelligence network security system based on multi-modal large model training, which comprises a server fault diagnosis module, a network attack detection module, an endpoint security monitoring module, a key management optimization module and a threat analysis feedback module. According to the method, the fault prediction accuracy is improved through multi-dimensional data analysis, service interruption caused by sudden hardware faults is reduced, the network access frequency, source and instruction features are evaluated based on the server abnormality, the attack detection accuracy is improved, the misjudgment risk is reduced, the endpoint equipment execution behavior, resource calling and behavior sequence are extracted, and the service performance of the terminal equipment is improved. Fine-grained security monitoring is realized, attack traceability is enhanced, a key strategy is dynamically adjusted, security adaptability is improved, strategy lag risk is reduced, multi-level data is integrated to calculate threat behavior and attack fitting degree, threat assessment fineness and response speed are enhanced, and global security situation awareness is improved.

The invention discloses a distributed storage method and system for data security, and belongs to the technical field of data storage security, the method comprises the following steps: firstly, fragmenting original data, and generating a unique identifier for each data fragment; for each fragment, an encryption algorithm and key credentials are adaptively selected, and the key credentials are stored in a key management system. By performing homomorphic encryption on the key voucher, an encryption handle is generated, and efficient positioning and retrieval of the key are realized. According to the method, a differentiated encryption strategy is adopted, a most suitable encryption scheme is selected according to fragment characteristics, and encrypted data fragments are dispersed and stored in a plurality of distributed storage nodes. A global mapping index is constructed in a metadata management server, and a corresponding relation between an original data global identifier and metadata of each data fragment is recorded, including information such as identifiers before and after encryption, a storage position, an encryption algorithm, a key handle and the like. According to the method, the data leakage risk is effectively reduced, and the safety and reliability of the storage system are improved.

The invention discloses a data security management method and system based on cloud computing, and relates to the technical field of data management, and the method comprises the following steps: S1, making a security policy; s2, performing security assessment on the cloud infrastructure; s3, performing identity authentication and access control; s4, data encryption and key management; s5, data classification and level-to-level management; s6, data leakage detection and defense; s7, performing auditing and compliance management; s8, abnormal behavior monitoring and threat response; and S9, an elastic backup and recovery mechanism. According to the data security governance method and system based on cloud computing, the elasticity and dynamic response capability of data security are remarkably improved by setting the distributed key management system and the intelligent monitoring model. The distributed key management system dispersedly stores the keys in different physical areas, so that the risk of single-point fault and attack is reduced; the AI-based intelligent behavior monitoring system analyzes user behaviors in real time, predicts abnormal operation and automatically responds.

The invention discloses a data access permission control method and system based on a block chain, and relates to the technical field of block chains, the system is composed of a plurality of function modules, and the system comprises a hierarchical permission module which adopts a role hierarchical strategy and defines the access granularity of a role through an intelligent contract; the dynamic permission adjustment module is used for dynamically adjusting the permission range by analyzing user behaviors in real time through machine learning according to the principle of following the minimum permission in the permission distribution process; attribute encryption and zero-knowledge proof are introduced, an access key is dynamically generated according to user attributes, and sensitive information is hidden in the verification process; the multi-chain collaboration module is used for coding an intelligent contract through an authority rule, automatically executing access request verification, storing encrypted data through a private chain, managing an index and an access strategy through an alliance chain, isolating a storage domain from an access domain, and carrying out process traceability on a data request through a cross-chain verification mechanism; and the key management module is used for generating a true random number private key by adopting a hardware security unit.

The invention relates to the technical field of information security, and discloses a data security management system and method in an intelligent power grid, and the system comprises a dynamic encryption and key management module which is used for carrying out the encryption and key management of the data of the intelligent power grid, determining an encryption algorithm according to the sensitivity of the data, and generating a corresponding key, the dynamic encryption and key management module transmits encrypted data and key information to the adaptive access control module so as to ensure the security of data access; and the self-adaptive access control module is used for managing access permissions of the user and the equipment and performing dynamic authorization according to the attribute label and the context information. Through dynamic encryption and adaptive key management, an encryption algorithm and a key length are adjusted in real time according to data sensitivity and a network environment, a quantum key distribution technology is combined, high security and quantum attack resistance of a key are ensured, and then security and real-time performance of data transmission are ensured.

The invention relates to a secure communication method between an edge server and terminal equipment. The secure communication method comprises the following steps: establishing a physical layer channel state information database, generating a multi-dimensional feature vector and encoding the multi-dimensional feature vector into a terminal equipment identifier, generating an identity authentication request by the terminal equipment, and performing hash operation to obtain a first hash value; the identity authentication request and the first hash value are sent to the edge server, the edge server verifies the identity authentication request and queries a corresponding device key, performs hash operation to obtain a second hash value, generates an authentication response message after successfully comparing the second hash value with the first hash value, encrypts the authentication response message by using the device key, and sends the encrypted authentication response message to the edge server; and sending the encrypted authentication response message to the terminal equipment. And the terminal equipment decrypts by using the equipment key to obtain the session key, and communicates with the edge server based on the session key. By using the physical layer channel information and the equipment hardware characteristics, the security communication method fusing dynamic identity authentication and efficient key management improves the security, reliability and anti-attack ability of communication between the edge server and the terminal equipment.

A method for data processing, a readable medium, and an electronic device are provided. The method for data processing includes: receiving a data processing task; determining target data corresponding to the data processing task and a target first key corresponding to the target data; decrypting the target first key according to the first session key via a target computing node to obtain the first key, and decrypting the target data based on the first key to obtain the data to be processed; and determining a data processing result according to a target model and the data to be processed. The target computing node is executed in a trusted execution environment. The target model is obtained by decrypting an encrypted target model based on a model key, the model key is stored in a key management service, and the key management service is executed in the trusted execution environment.

The invention discloses a computer network data secure transmission system and method, and particularly relates to the technical field of network data secure transmission, and the system comprises a dynamic key management module which generates a key seed through a quantum random number generator, generates a dynamic key bound with a data packet in combination with a timestamp, and transmits the dynamic key to a server; after being encrypted by a receiving end public key, the data are transmitted through an independent verification channel; the dual-path transmission control module is used for establishing dual channels of a main path and a shadow path, a data packet of the main path is embedded into a random camouflage protocol header to simulate a non-sensitive protocol, and a blank data packet is filled in the shadow path to maintain traffic characteristics; according to the real-time verification engine, a receiving end constructs an encrypted hash tree to achieve fragment-level integrity verification, and meanwhile, requests key state three-state verification from the key management module. Through key dynamic generation and separation transmission, dual-path adaptive fragmentation distribution, fragmentation hash tree reconstruction and key linkage verification, and abnormal triggering fragmentation level retransmission, the problems of long-term effectiveness of a static key, predictable transmission path and verification lag are solved.

An example system and method that can provide integrity and privacy-preserving communication and integrated operation in smart factory and other IOT applications using smart contracts in blockchain and Merkle Tree-based key management operations. The exemplary Merkle tree-based key management can ensure all communication, control operations, and shared models (e.g., Federated Learning models) are encrypted prior to transmission and sharing with other nodes in the network, with keys being split into parts to each of multiple recipients and later assembled to allow blocking consensus / validation to be performed.

The invention relates to the technical field of vehicle regulation level MCU chip safety, and discloses a vehicle regulation MCU chip safety starting method and system based on a national secret algorithm, and the method comprises the following steps: taking a built-in BootROM of a chip as a root of trust, initializing a hardware safety module HSM, and loading a bootloader; the invention further discloses a vehicle regulation MCU chip safe starting system based on the national secret algorithm. The vehicle regulation MCU chip safe starting system comprises a safe starting management module, a secret key management and storage module, a firmware integrity verification module, a trusted execution environment module and an anomaly detection and defense module. According to the invention, through supporting cross-platform adaptation of ARMTrustZone and RISC-VPMP architectures, firmware version rollback protection and starting process isolation are introduced, and integrity measurement is carried out during operation, so that comprehensive safety protection of the vehicle-mounted MCU system in starting, updating and operation processes is realized.

The invention relates to the technical field of cloud computing financial security, and provides a financial data encryption transmission and storage method. The method is characterized by comprising the following steps of: executing sensitivity-driven data grading fragmentation on a user terminal; dynamic elliptic curve encryption is carried out on transmission data through a two-channel encryption engine, and fully homomorphic encryption is carried out on storage data; dynamically distributing the fragments to heterogeneous cloud nodes by the multi-cloud routing based on reinforcement learning; a distributed key management matrix is constructed, key fragments are dispersed and stored in a block chain and a hardware security module, and reconstruction is activated through biological characteristics. The method has the advantages that full-link ciphertext operation is realized, and the plaintext exposure risk is eliminated; ciphertext state financial calculation is supported; single point failure is resisted; the APT attack is defended dynamically; and the quantum security evolution capability is realized. The method is suitable for mobile banks, cross-border payment and other scenes.

The invention relates to an intelligent device safe networking method and system based on a dynamic secret key, and the method comprises the steps: obtaining a device identifier and an initial secret key of an intelligent device, recording a current timestamp when the intelligent device is started, and generating a dynamic secret key through a Hash algorithm in combination with the device identifier and the initial secret key; generating a corresponding networking request based on the dynamic key, and sending the dynamic key and the networking request to a corresponding gateway; verifying the received networking request and the dynamic key through the gateway to obtain a verification result, and sending the verification result to the intelligent device; and generating a corresponding session key through the intelligent device according to a preset Diffie-Hellman algorithm in combination with the verification result, performing encrypted communication with the gateway based on the session key, and sending corresponding encrypted data to the gateway. According to the invention, flexible key management and efficient encryption communication can be realized.

The invention discloses a hardware cryptographic module based on a domestic commercial cryptographic algorithm and an implementation method of the hardware cryptographic module. The hardware cryptographic module comprises a security chip, a central control unit, a memory unit, a key management module, an encryption and decryption module, a multi-interface support unit, a bus interface unit and an indicator light module, the implementation method comprises the following steps: activating multi-layer encryption when a module is started, verifying the integrity of a master key through an SM3 algorithm, and ensuring the secure storage and management of the key; generating a session key by using an SM2 algorithm, and distributing the session key through a secure channel; performing multi-level encryption and decryption operation on the data, and introducing multiple authentication in key access; according to the invention, through multilayer encryption and multi-factor authentication, the security of key management is significantly enhanced, and through optimizing encryption and decryption processes and hardware configuration, the problem of performance bottleneck in a high-load environment is effectively solved, and efficient and safe operation of the system in a complex application scene is ensured.

The invention relates to the technical field of network security, and discloses a network information security encryption method, which comprises the following steps: step 1, a sender generates a pair of post-quantum asymmetric keys including a public key and a private key, the public key is used for encrypting a symmetric key, and the private key is used for decrypting the encrypted symmetric key; the sender sends the public key to the receiver through the secure channel, and verifies the authenticity of the public key of the receiver; and step 2, the sender generates a dynamic symmetric key based on a device identifier and a current timestamp, and the device identifier is used for uniquely identifying the device generating the key. A unique and unpredictable dynamic symmetric key is generated by combining a device identifier and a timestamp, the security problem that a traditional static key is easy to crack and abuse in long-term use is solved, in addition, a dynamic update triggering mechanism based on a time interval and a data volume is supported, key management has high flexibility and security, and the security of the key management is improved. And the encryption requirements in different network environments are met.

A method performed by a user equipment to establish a secured connection with an application entity in an enterprise network. The method comprises sending an establishment request to a secure access secure edge (SASE) entity: receiving an establishment response from the application entity if the SASE entity determines to allow the establishment request and authorizes Generic Bootstrapping Architecture / Authenticated Key Management for Application (GBA / AKMA) platform to share a session key with the application entity; and establishing a connection with the application entity based on the session key.

Disclosed in the present invention are a cross-domain identity authentication method and system based on a quantum key distribution network. The method comprises: sending a key negotiation request to a corresponding quantum key management system, and forwarding the key negotiation request to a quantum key generation system by means of the quantum key management system, such that the quantum key generation system establishes a relay key negotiation link between quantum key terminals and generates symmetric authentication keys; receiving an authentication request sent by means of a corresponding user-side terminal, and allocating identifiers of the authentication keys to the user-side terminal on the basis of the authentication request; and receiving login request information sent by means of the corresponding user-side terminal, and responding to the user-side terminal with constructed token ciphertext on the basis of the login request information, so as to forward the token ciphertext to a cross-domain identity authentication service system when the user-side terminal accesses the cross-domain identity authentication service system. The present invention solves the centralization problem that is present in cross-domain identity authentication, thus improving the confidentiality and integrity of authentication credential data distribution.

The invention relates to the technical field of cloud computing, in particular to a network data encryption and privacy protection system in a cloud environment, which comprises a key management unit driven by a wolf pack algorithm, an encryption algorithm optimization unit, a privacy protection strategy dynamic adjustment unit and a safety monitoring and abnormity response unit. The invention discloses a cloud environment network data encryption and privacy protection system constructed based on a wolf pack algorithm. High-security keys are dynamically generated and distributed through a key management unit, security performance and resource consumption are balanced through an encryption algorithm optimization unit, multi-target dynamic gaming and compliance guarantee are achieved through a privacy protection strategy unit, distributed attack detection and cooperative defense are completed through a security monitoring unit, and the security performance is improved through a cooperative feedback mechanism between the units. Intelligent encryption protection, dynamic strategy adjustment and efficient attack response of the full life cycle of the data in the cloud environment are realized, and the system security, the resource utilization rate and the compliance capability are remarkably improved.

The invention relates to the technical field of Internet of Things, and discloses a multi-factor dynamic authentication Internet of Things network security access platform, which adopts a multi-factor authentication mechanism, combines biological characteristics, behavior characteristics and environment characteristics of equipment, performs identity verification through biological recognition, equipment fingerprints and behavior analysis, and utilizes a dynamic authentication strategy. Detecting an abnormal IP behavior and triggering a security policy by adopting a dynamic IP binding technology, combining with equipment fingerprint identification and learning and analyzing an equipment network behavior mode; a dynamic key management mechanism is adopted, and keys are automatically generated, distributed and updated according to different devices, application scenes and communication requirements; machine learning and artificial intelligence technologies are utilized to comprehensively analyze historical access data, abnormal behavior modes, environment security states and the like of equipment, and the security risk of equipment access is automatically evaluated if suspicious equipment is detected. The method has the advantage of improving the security of the Internet of Things.

The invention relates to a secure communication method for an edge node and terminal equipment based on dynamic key negotiation. The method comprises the following steps: the terminal equipment sends an initial signal when initiating a communication request; the edge node generates a scenarized first key negotiation parameter and feeds back the scenarized first key negotiation parameter after passing dual identity and state verification; after the terminal device decrypts the parameter, a dynamic entropy value is collected by combining a network adaptive sensor, and a second key negotiation parameter associated with the first parameter feature is generated; the two parties calculate session keys based on an ECDH algorithm, and the consistency of the keys is ensured through dynamic entropy verification and Hash comparison; and after the key negotiation succeeds, entering a hierarchical encrypted data transmission stage, and dynamically updating a session key based on a multi-dimensional trigger mechanism. According to the method, through hardware credibility verification, a scenarized key strategy, dynamic entropy enhancement and national secret algorithm adaptation, dynamic management of keys and adaptive matching of terminal resources are achieved, attacks such as equipment counterfeiting and parameter tampering are effectively resisted, and the high-security and compliance requirements in the fields of industrial control and the like are met.

The invention discloses a hybrid encryption method based on an industrial bus, and the method comprises the following steps: S1, generating an initial session key through a multiple elliptic curve algorithm, and generating an initial key pair through a pseudo-random number generator; s2, encrypting the control data by using a first-level key; s3, generating a secondary key to encrypt common transmission data; s4, dynamically generating a third-level temporary session key by using a pseudo-random number generator, and encrypting real-time transmission data of a large data volume; s5, realizing collaborative key generation and synchronous updating of a plurality of communication nodes through a distributed key management system; s6, periodically utilizing a probability density regression forest algorithm to dynamically update the key, and triggering key re-negotiation when communication abnormity is detected; and S7, integrating a classifier based on the combination of a deep forest and a gradient boosting decision tree, automatically classifying the data and dynamically adjusting an encryption strategy. According to the method, a multiple elliptic curve algorithm, dynamic key management and the like are combined, and efficient encryption in industrial bus communication is achieved.

A method for managing a storage system includes initiating, by a hardware resource manager, a boot-up of a storage controller managing the storage system comprising a plurality of storage devices, making a determination, by the storage controller, that the storage controller is in a secured mode, based on the determination: identifying a security state of each of the plurality of storage devices, determining that a storage device of the plurality of storage devices is in an unsecured state, and based on the unsecured state, sending, by the storage controller, a security operation request for securing the storage device, obtaining a secure state response from the hardware resource manager corresponding to securing the storage device, and based on the secure state response, resuming operation of the storage controller based on the secure mode.

The invention provides a safety protection algorithm design method for an industrial control system, which is used for determining a safety protection target and range, determining a key component and a business process and defining a protection boundary. And then risk assessment and threat modeling are carried out, potential threat and attack vectors are identified, and asset vulnerability and risk influence are assessed. Designing a security protection algorithm framework, selecting proper security technology and algorithm, and determining architecture and module composition. Identity authentication modules, data encryption and integrity protection modules, intrusion detection and defense modules and the like are designed in detail, and authentication modes, key management modules, integrity verification modules, intrusion detection algorithms, response strategies and the like are designed. And then realizing and integrating an algorithm, and programming in the system to realize and guarantee the cooperative work among the modules. And the performance and the security of the algorithm are optimized through a function and security test. And finally, deploying the algorithm to the industrial control system, continuously monitoring the operation state and the security situation of the industrial control system, dynamically adjusting the strategy and parameters, and effectively guaranteeing the security of the industrial control system.

Operations of a digital signature manager may include detecting, in a certificate repository on a first virtual cloud network, set of one or more new certificate authority (CA) certificates; transmitting, to a key management service hosted on a second virtual cloud network, a CA dataset that includes the set of one or more new CA certificates; receiving, from the key management service, a digital signature of the CA dataset generated based at least on a global private key stored on the second virtual cloud network in a private key repository associated with the key management service; and storing the digital signature in the certificate repository in a data structure that associates the digital signature with the CA dataset.

A key management device according to an embodiment includes one or more hardware processors configured to function as a determination unit, a generation unit, and a supply unit. The determination unit determines a type of request data requested by a request message transmitted from an application that performs encrypted data communication. The generation unit generates a response message including at least one of a random number and an encryption key shared by quantum key distribution (QKD) via a communication network according to a type of the request data. The supply unit supplies the response message to the application.

The invention discloses a lightweight hopping key encryption system based on a national cryptographic algorithm, relates to the technical field of data communication encryption, and solves the problem that an initial key and a hopping key are difficult to generate; a key hopping mode is difficult to analyze so as to detect an abnormal state; intelligent contract automatic key management is difficult to carry out; plaintext data is difficult to encrypt according to the analysis security index; the data verification index is difficult to analyze for data verification after the hopping key is decrypted; the operation state is difficult to monitor in real time to detect an attack mode; and the defense capability and the key hopping validity are difficult to assess, and the overall security assessment value is difficult to assess. According to the method, the state cryptographic algorithm is applied, the hopping key mechanism is combined, the key hopping rule is automatically executed by using the intelligent contract, and the overall security assessment value is comprehensively assessed by monitoring the running state.

In a method for controlling access to customer data of a multi-tenant software as a service (SaaS) system, a SaaS agent at a user endpoint sends a request for storage credentials to a SaaS agent facing application interface (API) of a SaaS system cloud. The storage credentials provide access to a SaaS encrypted data store of the multi-tenant SaaS system. The SaaS agent receives the storage credentials from the SaaS agent facing API, and the SaaS agent uses the storage credentials to store customer data in the SaaS encrypted data store. A customer-controlled encryption key is maintained on a customer-controlled cloud hosting a key management system (KMS). The customer-controlled cloud is in communication with the SaaS agent facing API.

The invention discloses an edge computing-based industrial Internet of Things equipment data encryption transmission method, which comprises the following steps of: constructing an edge node alliance comprising at least two cross-regional edge gateways, completing bidirectional identity authentication through an alliance root certificate, and establishing an encrypted communication link; industrial equipment collects original data and then transmits the original data to an edge gateway which the industrial equipment belongs to, and the gateway extracts data features and divides the data features into a core control level, a process parameter level, a common monitoring level and a security level; differential encryption strategies are adopted for different levels of data; each edge gateway uploads the encrypted data to a distributed key management node, and obtains and synchronizes a periodically updated key chain; during cross-region transmission, performing secondary packaging and encryption to generate a data packet containing identifications such as a security level and the like; and the receiving end verifies the legality of the node, decrypts and verifies the integrity of the data, distributes the data if the decryption is passed, and blocks the alarm if the decryption The method is suitable for scenes such as single-area monitoring and multi-area manufacturing, data security and transmission efficiency balance are achieved, and all-weather stable transmission is guaranteed.

The invention discloses a password resource allocation method and system based on an attention mechanism and a residual network, and relates to the field of password allocation based on a deep Q network. The method and the device aim at meeting high-concurrency and multi-task complex network decision-making requirements. The password service scene covers multiple task types, including encryption and decryption operation, large-scale signature verification, key management and cross-service security calculation. The tasks put forward extremely high real-time performance and accuracy requirements for computing resources, communication bandwidth and task scheduling of the system. According to the method, the deep reinforcement learning method is introduced, the characteristics of different password service tasks are dynamically adapted, intelligent decision making can be carried out based on the real-time system state and service requirements, and therefore the resource utilization efficiency is remarkably improved. Meanwhile, by optimizing task path planning, system time delay is reduced, load balancing is achieved, and the performance stability and task response capacity of the password service in a high-concurrency scene are effectively guaranteed.