1868 results about "Key management" patented technology

The invention relates to the technical field of intelligent security operation and maintenance, in particular to an artificial intelligence network security system based on multi-modal large model training, which comprises a server fault diagnosis module, a network attack detection module, an endpoint security monitoring module, a key management optimization module and a threat analysis feedback module. According to the method, the fault prediction accuracy is improved through multi-dimensional data analysis, service interruption caused by sudden hardware faults is reduced, the network access frequency, source and instruction features are evaluated based on the server abnormality, the attack detection accuracy is improved, the misjudgment risk is reduced, the endpoint equipment execution behavior, resource calling and behavior sequence are extracted, and the service performance of the terminal equipment is improved. Fine-grained security monitoring is realized, attack traceability is enhanced, a key strategy is dynamically adjusted, security adaptability is improved, strategy lag risk is reduced, multi-level data is integrated to calculate threat behavior and attack fitting degree, threat assessment fineness and response speed are enhanced, and global security situation awareness is improved.

The invention discloses a data access permission control method and system based on a block chain, and relates to the technical field of block chains, the system is composed of a plurality of function modules, and the system comprises a hierarchical permission module which adopts a role hierarchical strategy and defines the access granularity of a role through an intelligent contract; the dynamic permission adjustment module is used for dynamically adjusting the permission range by analyzing user behaviors in real time through machine learning according to the principle of following the minimum permission in the permission distribution process; attribute encryption and zero-knowledge proof are introduced, an access key is dynamically generated according to user attributes, and sensitive information is hidden in the verification process; the multi-chain collaboration module is used for coding an intelligent contract through an authority rule, automatically executing access request verification, storing encrypted data through a private chain, managing an index and an access strategy through an alliance chain, isolating a storage domain from an access domain, and carrying out process traceability on a data request through a cross-chain verification mechanism; and the key management module is used for generating a true random number private key by adopting a hardware security unit.

The invention relates to a secure communication method between an edge server and terminal equipment. The secure communication method comprises the following steps: establishing a physical layer channel state information database, generating a multi-dimensional feature vector and encoding the multi-dimensional feature vector into a terminal equipment identifier, generating an identity authentication request by the terminal equipment, and performing hash operation to obtain a first hash value; the identity authentication request and the first hash value are sent to the edge server, the edge server verifies the identity authentication request and queries a corresponding device key, performs hash operation to obtain a second hash value, generates an authentication response message after successfully comparing the second hash value with the first hash value, encrypts the authentication response message by using the device key, and sends the encrypted authentication response message to the edge server; and sending the encrypted authentication response message to the terminal equipment. And the terminal equipment decrypts by using the equipment key to obtain the session key, and communicates with the edge server based on the session key. By using the physical layer channel information and the equipment hardware characteristics, the security communication method fusing dynamic identity authentication and efficient key management improves the security, reliability and anti-attack ability of communication between the edge server and the terminal equipment.

The invention discloses a computer network data secure transmission system and method, and particularly relates to the technical field of network data secure transmission, and the system comprises a dynamic key management module which generates a key seed through a quantum random number generator, generates a dynamic key bound with a data packet in combination with a timestamp, and transmits the dynamic key to a server; after being encrypted by a receiving end public key, the data are transmitted through an independent verification channel; the dual-path transmission control module is used for establishing dual channels of a main path and a shadow path, a data packet of the main path is embedded into a random camouflage protocol header to simulate a non-sensitive protocol, and a blank data packet is filled in the shadow path to maintain traffic characteristics; according to the real-time verification engine, a receiving end constructs an encrypted hash tree to achieve fragment-level integrity verification, and meanwhile, requests key state three-state verification from the key management module. Through key dynamic generation and separation transmission, dual-path adaptive fragmentation distribution, fragmentation hash tree reconstruction and key linkage verification, and abnormal triggering fragmentation level retransmission, the problems of long-term effectiveness of a static key, predictable transmission path and verification lag are solved.

The invention relates to the technical field of vehicle regulation level MCU chip safety, and discloses a vehicle regulation MCU chip safety starting method and system based on a national secret algorithm, and the method comprises the following steps: taking a built-in BootROM of a chip as a root of trust, initializing a hardware safety module HSM, and loading a bootloader; the invention further discloses a vehicle regulation MCU chip safe starting system based on the national secret algorithm. The vehicle regulation MCU chip safe starting system comprises a safe starting management module, a secret key management and storage module, a firmware integrity verification module, a trusted execution environment module and an anomaly detection and defense module. According to the invention, through supporting cross-platform adaptation of ARMTrustZone and RISC-VPMP architectures, firmware version rollback protection and starting process isolation are introduced, and integrity measurement is carried out during operation, so that comprehensive safety protection of the vehicle-mounted MCU system in starting, updating and operation processes is realized.

The invention relates to the technical field of cloud computing financial security, and provides a financial data encryption transmission and storage method. The method is characterized by comprising the following steps of: executing sensitivity-driven data grading fragmentation on a user terminal; dynamic elliptic curve encryption is carried out on transmission data through a two-channel encryption engine, and fully homomorphic encryption is carried out on storage data; dynamically distributing the fragments to heterogeneous cloud nodes by the multi-cloud routing based on reinforcement learning; a distributed key management matrix is constructed, key fragments are dispersed and stored in a block chain and a hardware security module, and reconstruction is activated through biological characteristics. The method has the advantages that full-link ciphertext operation is realized, and the plaintext exposure risk is eliminated; ciphertext state financial calculation is supported; single point failure is resisted; the APT attack is defended dynamically; and the quantum security evolution capability is realized. The method is suitable for mobile banks, cross-border payment and other scenes.

A method performed by a user equipment to establish a secured connection with an application entity in an enterprise network. The method comprises sending an establishment request to a secure access secure edge (SASE) entity: receiving an establishment response from the application entity if the SASE entity determines to allow the establishment request and authorizes Generic Bootstrapping Architecture / Authenticated Key Management for Application (GBA / AKMA) platform to share a session key with the application entity; and establishing a connection with the application entity based on the session key.

The invention relates to the technical field of cloud computing, in particular to a network data encryption and privacy protection system in a cloud environment, which comprises a key management unit driven by a wolf pack algorithm, an encryption algorithm optimization unit, a privacy protection strategy dynamic adjustment unit and a safety monitoring and abnormity response unit. The invention discloses a cloud environment network data encryption and privacy protection system constructed based on a wolf pack algorithm. High-security keys are dynamically generated and distributed through a key management unit, security performance and resource consumption are balanced through an encryption algorithm optimization unit, multi-target dynamic gaming and compliance guarantee are achieved through a privacy protection strategy unit, distributed attack detection and cooperative defense are completed through a security monitoring unit, and the security performance is improved through a cooperative feedback mechanism between the units. Intelligent encryption protection, dynamic strategy adjustment and efficient attack response of the full life cycle of the data in the cloud environment are realized, and the system security, the resource utilization rate and the compliance capability are remarkably improved.

The invention relates to the technical field of Internet of Things, and discloses a multi-factor dynamic authentication Internet of Things network security access platform, which adopts a multi-factor authentication mechanism, combines biological characteristics, behavior characteristics and environment characteristics of equipment, performs identity verification through biological recognition, equipment fingerprints and behavior analysis, and utilizes a dynamic authentication strategy. Detecting an abnormal IP behavior and triggering a security policy by adopting a dynamic IP binding technology, combining with equipment fingerprint identification and learning and analyzing an equipment network behavior mode; a dynamic key management mechanism is adopted, and keys are automatically generated, distributed and updated according to different devices, application scenes and communication requirements; machine learning and artificial intelligence technologies are utilized to comprehensively analyze historical access data, abnormal behavior modes, environment security states and the like of equipment, and the security risk of equipment access is automatically evaluated if suspicious equipment is detected. The method has the advantage of improving the security of the Internet of Things.

The invention relates to a secure communication method for an edge node and terminal equipment based on dynamic key negotiation. The method comprises the following steps: the terminal equipment sends an initial signal when initiating a communication request; the edge node generates a scenarized first key negotiation parameter and feeds back the scenarized first key negotiation parameter after passing dual identity and state verification; after the terminal device decrypts the parameter, a dynamic entropy value is collected by combining a network adaptive sensor, and a second key negotiation parameter associated with the first parameter feature is generated; the two parties calculate session keys based on an ECDH algorithm, and the consistency of the keys is ensured through dynamic entropy verification and Hash comparison; and after the key negotiation succeeds, entering a hierarchical encrypted data transmission stage, and dynamically updating a session key based on a multi-dimensional trigger mechanism. According to the method, through hardware credibility verification, a scenarized key strategy, dynamic entropy enhancement and national secret algorithm adaptation, dynamic management of keys and adaptive matching of terminal resources are achieved, attacks such as equipment counterfeiting and parameter tampering are effectively resisted, and the high-security and compliance requirements in the fields of industrial control and the like are met.

A method for managing a storage system includes initiating, by a hardware resource manager, a boot-up of a storage controller managing the storage system comprising a plurality of storage devices, making a determination, by the storage controller, that the storage controller is in a secured mode, based on the determination: identifying a security state of each of the plurality of storage devices, determining that a storage device of the plurality of storage devices is in an unsecured state, and based on the unsecured state, sending, by the storage controller, a security operation request for securing the storage device, obtaining a secure state response from the hardware resource manager corresponding to securing the storage device, and based on the secure state response, resuming operation of the storage controller based on the secure mode.

A key management device according to an embodiment includes one or more hardware processors configured to function as a determination unit, a generation unit, and a supply unit. The determination unit determines a type of request data requested by a request message transmitted from an application that performs encrypted data communication. The generation unit generates a response message including at least one of a random number and an encryption key shared by quantum key distribution (QKD) via a communication network according to a type of the request data. The supply unit supplies the response message to the application.

The invention discloses a lightweight hopping key encryption system based on a national cryptographic algorithm, relates to the technical field of data communication encryption, and solves the problem that an initial key and a hopping key are difficult to generate; a key hopping mode is difficult to analyze so as to detect an abnormal state; intelligent contract automatic key management is difficult to carry out; plaintext data is difficult to encrypt according to the analysis security index; the data verification index is difficult to analyze for data verification after the hopping key is decrypted; the operation state is difficult to monitor in real time to detect an attack mode; and the defense capability and the key hopping validity are difficult to assess, and the overall security assessment value is difficult to assess. According to the method, the state cryptographic algorithm is applied, the hopping key mechanism is combined, the key hopping rule is automatically executed by using the intelligent contract, and the overall security assessment value is comprehensively assessed by monitoring the running state.

In a method for controlling access to customer data of a multi-tenant software as a service (SaaS) system, a SaaS agent at a user endpoint sends a request for storage credentials to a SaaS agent facing application interface (API) of a SaaS system cloud. The storage credentials provide access to a SaaS encrypted data store of the multi-tenant SaaS system. The SaaS agent receives the storage credentials from the SaaS agent facing API, and the SaaS agent uses the storage credentials to store customer data in the SaaS encrypted data store. A customer-controlled encryption key is maintained on a customer-controlled cloud hosting a key management system (KMS). The customer-controlled cloud is in communication with the SaaS agent facing API.

The invention discloses an edge computing-based industrial Internet of Things equipment data encryption transmission method, which comprises the following steps of: constructing an edge node alliance comprising at least two cross-regional edge gateways, completing bidirectional identity authentication through an alliance root certificate, and establishing an encrypted communication link; industrial equipment collects original data and then transmits the original data to an edge gateway which the industrial equipment belongs to, and the gateway extracts data features and divides the data features into a core control level, a process parameter level, a common monitoring level and a security level; differential encryption strategies are adopted for different levels of data; each edge gateway uploads the encrypted data to a distributed key management node, and obtains and synchronizes a periodically updated key chain; during cross-region transmission, performing secondary packaging and encryption to generate a data packet containing identifications such as a security level and the like; and the receiving end verifies the legality of the node, decrypts and verifies the integrity of the data, distributes the data if the decryption is passed, and blocks the alarm if the decryption The method is suitable for scenes such as single-area monitoring and multi-area manufacturing, data security and transmission efficiency balance are achieved, and all-weather stable transmission is guaranteed.

Provided in the present application are a server, a terminal and a security system. The server comprises an authentication and key management module, a secure multi-party computation engine and a secure-channel management module, wherein the authentication and key management module is used for performing identity verification on a terminal, generating a first private key corresponding to the terminal and a first public key corresponding to the first private key, and generating a first session key on the basis of a second public key of the terminal and the first private key; the secure multi-party computation engine is used for verifying fingerprint information of the terminal and cooperating with a plurality of terminals to perform identity verification on a server; and the secure-channel management module is used for establishing a secure channel with the terminal, encrypting communication data on the basis of the first session key, and using the secure channel to send the encrypted communication data to the terminal. The solution of the present application can effectively solve the security problem of communication between a terminal and a server, and has the advantages of high flexibility and a low cost.

Various aspects of the present disclosure relate to an authentication server function (AUSF) that receives an authentication request from a security anchor function (SEAF), and transmits a data request for authentication data to unified data management (UDM). The AUSF can receive the authentication data from the UDM for primary authentication, and set an expiration time for security information associated with the primary authentication being successful. The AUSF can then transmit an authentication message of authentication information that includes the security information and the expiration time to an authentication and key management for applications (AKMA) anchor function (AAnF) that registers the expiration time. The AUSF can also initiate reauthentication based at least in part on expiry of the authentication information.

The invention discloses a data asset secure storage method based on a block chain technology, and the method comprises the following steps: data preprocessing and fragmentation storage: carrying out the preprocessing of to-be-stored original data assets, extracting metadata information, and generating a unique hash identifier; through multi-chain collaborative storage, dynamic hierarchical encryption and cross-chain redundant backup, the security of data assets is remarkably improved, fragment storage is combined with a heterogeneous block chain network, the data storage efficiency is improved, and single-point failure and centralized attack risks are avoided; the anti-cracking capability is enhanced through dynamic encryption and distributed key management; a cross-chain synchronization mechanism ensures high availability of data, so that the data can be efficiently circulated in different block chains; the operation and maintenance cost is reduced through automatic verification and recovery driven by the intelligent contract, the auditing tracking and life cycle management functions meet the compliance requirement, and the method is suitable for data storage scenes in the high-sensitivity fields of finance, medical treatment and the like.

Techniques for dynamic database redaction using protected encryption secret material are described. A masking policy is defined that includes a reference to a secret material stored by a secrets manager service. The masking policy further identifies a pseudonymous redaction function that utilizes a cryptographic function requiring such a secret material. The secrets manager service is configured to grant access to the secret material by an entity of the database service that executes queries, such as a leader node of a cluster. For a particular query, the cluster obtains the secret material from the secrets manager service in a secure manner, uses the secret material for applying the cryptographic function to values for redaction purposes, and deletes any copies of secret material thereafter.

The invention relates to the technical field of data encryption, and discloses a data encryption method, encryption equipment and a storage medium. In the method, an encryption device obtains to-be-encrypted data uploaded by a terminal, and extracts a plurality of data features from the to-be-encrypted data, the data features including a data sensitive feature, a business risk feature and a user behavior feature; performing quantitative scoring on the plurality of data features to obtain a plurality of feature scores, and calculating a total data score according to the plurality of feature scores; inputting the total data score into a preset trained decision tree model to determine the security level of the to-be-encrypted data; according to the security level, determining a target encryption algorithm from a preset corresponding relationship between the security level and the encryption algorithm; and encrypting the to-be-encrypted data according to the target encryption algorithm and the dynamically generated encryption key. By means of the method, the problems that differential protection is difficult to achieve according to data characteristics in a related encryption method, and security risks are caused by key management staticization are solved.

The invention discloses a dynamic NFT-based attribute-based encrypted medical data sharing method, which comprises the following steps that: firstly, a user submits identity authentication information to a trusted digital identity platform, and applies for an attribute certificate from an institution to which the user belongs; secondly, the key management system completes system initialization and generates a master key and a public key, the medical data owner generates an attribute-based encrypted ciphertext according to the access strategy and casts a dynamic NFT according to the smart contract, and when the medical data demander conforms to the access strategy, the medical data owner issues a sub-NFT of the dynamic NFT to the medical data demander through the smart contract; and then the medical data demander applies for a master key from the key management system and decrypts the ciphertext. And finally, the medical data owner changes the access strategy and re-judges whether the medical data demander conforms to the access strategy. According to the invention, the data access control does not depend on a fixed strategy any more, and the controllability and security of the data access control are enhanced.

The invention relates to the technical field of data security, and particularly provides a data auditing and approving method and device, which is applied to a scene that multi-role collaborative decryption is required for multi-level approval, and comprises the following steps: S1, data fragmentation and hybrid encryption; s2, performing dynamic key management; s3, attribute base access control; and S4, block chain evidence storage and auditing. Compared with the prior art, dynamic key generation, hierarchical encryption storage, fine-grained permission control and real-time permission revocation can be realized through a credible key management mechanism, and data whole-process security processing under data privatization data auditing is met.

The invention discloses a stable transmission method for server data encryption and rapid authentication, and belongs to the technical field of data security. The method comprises the following steps: dividing data into three levels of core sensitive data, important data and common data by utilizing a semantic analysis model; performing encryption protection on different levels of data by adopting a hierarchical encryption strategy; a master key is generated based on a chaotic system, a session key is generated in combination with a timestamp and a device fingerprint and is regularly alternated, and secure distribution is performed through a trusted execution environment and a block chain; multi-modal features are fused, the identity is verified through zero-knowledge proof, and the authentication strength is adjusted through dynamic risk assessment. The method is suitable for cloud computing, the Internet of Things and a distributed storage system, through deep fusion of a multi-level hybrid encryption algorithm, a dynamic key management mechanism and a self-adaptive authentication strategy, data security encryption, rapid authentication and stable transmission are achieved, and security, efficiency and adaptability are improved.

The invention particularly relates to an object storage data encryption method based on a large model. According to the object storage data encryption method based on the large model, user data is partitioned and compressed, and a deep learning large model is trained by using historical data accumulated by a cloud storage provider and known security threats; according to a large model prediction result, selecting an optimal encryption algorithm and a key management strategy; encrypting the preprocessed data, and storing the encrypted data and metadata in a cloud storage system; and when the user needs to access the data, reading the metadata, obtaining the decryption key, and recovering the original data. The object storage data encryption method based on the large model is efficient, safe and flexible, the optimal encryption strategy can be intelligently selected according to changes of data characteristics and the safety environment, dynamic encryption is achieved, therefore, the safety and privacy of data are remarkably improved, and the requirements of a modern object storage system can be met.

The invention discloses a privacy protection method, system and device for block chain network node audit management, and the method specifically comprises the steps: generating a node anonymous voucher for a candidate node, carrying out the privacy authentication, mapping the sensitive information of the authenticated candidate node into an irreversible cryptographic hash value, and storing the irreversible cryptographic hash value in a distributed key management node; constructing a dynamic credible auditing group, selecting verification nodes from the candidate nodes, and performing uplink evidence storage after BLS aggregation signature; performing privacy aggregation calculation on the node behavior data of the verification node to generate an audit score ciphertext; fine-grained access control is realized through attribute-based encryption, and a node reputation level is dynamically bound through an auditing strategy; adaptive noise is added to an audit result by adopting a differential privacy mechanism, and the epsilon-differential privacy constraint condition is met by dynamically adjusting the noise amount; in the reward and punishment execution stage, a ring signature and a stealth address technology are combined, so that reward and punishment records are unhooked from real identities of nodes, and meanwhile, the trade traceability is ensured.

The invention relates to an alliance chain identity privacy protection method and system based on multi-level group signature and distributed key management, and belongs to the field of block chain technology, network and information security. According to the method, a multi-level group signature structure is adopted, anonymous identity verification is achieved in the transaction process, privacy protection is further enhanced through zero-knowledge proof, anonymous identity verification is achieved in the transaction process, it is ensured that privacy of participants is not leaked, a homomorphic encryption algorithm is used in the signature and verification process of transaction data, and the transaction data are subjected to identity authentication. And privacy leakage is prevented. And meanwhile, the Shamir secret sharing algorithm divides the master key and stores the master key in a plurality of sub-group members in a distributed manner, so that the anti-attack capability and the key security are enhanced. According to the method, a dynamic group member management and double signature verification mechanism is further introduced, so that the flexibility and the overall security are improved. The method has significant advantages in the aspects of identity anonymity, data integrity and efficiency, and is suitable for alliance chain application scenarios with high privacy and security requirements.

The invention relates to the field of hardware encryption, and discloses a geological disaster monitoring scene-based low-power-consumption hardware encryption system, which comprises a layered architecture module for constructing a terminal sensing layer and a cloud platform layer, generating a three-dimensional risk thermodynamic diagram, and carrying out short-term early warning model and emergency deduction; the encryption and decryption module is used for carrying out multi-dimensional identity verification based on protocol layering and national secret algorithm fusion, carrying out dynamic management and eavesdropping monitoring on a secret key, optimizing a data processing flow, and establishing a secure channel to dynamically negotiate whether encryption or decryption is needed; the key management module is used for implementing a triple binding mechanism, carrying out processing and risk assessment on the monitoring data, and carrying out key backup and recovery by adopting a dynamic key period according to a generated risk level; and the safety protection module is used for performing intelligent management on the power consumption of the system based on the active state of the system, selecting a compression strategy according to the data type by adopting a dynamic compression algorithm, performing safety monitoring on hardware and firmware, performing intrusion monitoring on the system and performing automatic repair.

The invention relates to a method and system for encrypting and isolating storage data of a credential mobile terminal, and belongs to the technical field of information. The method comprises the following steps: encrypting and partitioning the whole storage area, and setting an access strategy according to user permission; when a user requests to access, executing multi-factor authentication containing a password and an external hardware certificate, and adding biological characteristic authentication; after the authentication is passed, an encryption key is taken from the domestic security chip; and encrypting and decrypting data by using the secret key, and opening corresponding partition access according to authority. The system comprises a storage partition module, an identity authentication module, a key management module, an encryption and decryption module and an authority control module and is used for executing the method. The method also comprises the steps of equipment startup trusted boot and firmware upgrade verification, is based on a custom curing system, and is compatible with Android 10 +. The problems of poor hardware controllability and positioning security risk of the creative mobile terminal are solved, and full-link data security protection is realized.

The invention provides an import and export trade data exchange system, which comprises a policy negotiation module, a key management module, a protocol conversion module and an anti-degradation transmission module, wherein the policy negotiation module is used for dynamically generating an encryption policy matrix of multiple systems according to encryption capability parameters of participating systems; the key management module is used for generating a cross-system dynamic key based on the encryption strategy matrix; the cross-system dynamic key is generated through cryptographic operation fusing a source system private key and a target system public key; the protocol conversion module is used for analyzing an original protocol message into a field set, mapping a field type to a target protocol specification through a quantum state superposition model, and generating an encrypted message compatible with a target system; and the anti-degradation transmission module is used for carrying out anti-degradation secure transmission processing on the encrypted message to obtain an anti-degradation encrypted data stream. By adopting the system, the security, compatibility and reliability of the data in the exchange transmission process can be ensured.

A security verification method, apparatus, medium, device and product for a large model service relate to the technical field of computers, receive an encryption service request, acquire a private key of a client from a key management service running in a trusted execution environment through an encryption and decryption service running in the trusted execution environment, decrypt the encryption service request based on the private key, and verify the security of the encryption service request. The method comprises the following steps: decrypting a service request of a user, sending the decrypted service request to a large model service to obtain a reasoning result of the large model service, encrypting the reasoning result through a public key of a client, and returning the encrypted reasoning result to the client, so that the service request of the user can be visible in a plaintext in a trusted execution environment; the security of the user data is greatly ensured, and the problem of user data leakage can be avoided through the public and private key pair of the user dimension. In addition, the key management service and the encryption and decryption service both run in the trusted execution environment, so that attacks from an IaaS layer can be shielded.