120 results about "Key server" patented technology

A server can receive a device public key and forward the device public key to a key server. The key server can perform a first elliptic curve Diffie-Hellman (ECDH) key exchange using the device public key and a network private key to derive a secret X1. The key server can send the secret X1 to the server. The server can derive an ECC PKI key pair and send to the device the server public key. The server can conduct a second ECDH key exchange using the derived server secret key and the device public key to derive a secret X2. The server can perform an ECC point addition using the secret X1 and secret X2 to derive a secret X3. The device can derive the secret X3 using (i) the server public key, a network public key, and the device private key and (ii) a third ECDH key exchange.

The invention discloses a method for applying an anti-quantum certificate to a TLS1.2 handshake process, which realizes the application of an MLDSA anti-quantum signature algorithm and an MLKEM anti-quantum key encapsulation mechanism in the handshake process by expanding a cipher suite and a signature algorithm field of a TLS1.2 protocol. The method specifically comprises the following steps: defining a cipher suite supporting MLKEM and an MLDSA signature algorithm enumeration value; the client declares algorithm support in ClientHello, and the server responds and returns a certificate chain containing the double-antibody quantum certificate; after the client verifies the certificate, the pre-master key is encapsulated by using MLKEM, and the server de-encapsulates the derived session key; and the two parties send Finished messages to each other to complete handshake. According to the scheme, on the premise that a TLS1.2 basic framework is not changed, the communication security is enhanced through double-resistance quantum algorithm integration, international and national cryptographic algorithms are supported, quantum computing attacks can be resisted, meanwhile, adaptation of the international and national cryptographic algorithms is supported, compatibility with an existing system is ensured, the security risk of a traditional cryptographic algorithm in a quantum environment is solved, and the security risk of the traditional cryptographic algorithm in the quantum environment is reduced. And a standardized solution is provided for anti-quantum upgrade of the TLS1.2 protocol.

A server and a device can conduct mutually authenticated post-quantum cryptography (PQC) key encapsulation mechanisms (KEM) that also support forward secrecy. The device can store a trusted server public key (PK.server) and the server can store a trusted device public key (PK.device). The device can generate (i) a first KEM ciphertext and (ii) a first key with PK.server and encrypt an ephemeral public key (ePK.device) using the first key. The server can generate (i) a second KEM ciphertext and (ii) a second key with ePK.device. The server can generate (i) a third KEM ciphertext and (ii) a third key with PK.device. The server can encrypt an ephemeral public key (ePK.server) using the first, second, and third keys. The device can generate (i) a fourth KEM ciphertext and (ii) a fourth key with ePK.server. The device can encrypt application data using at least the first, second, third, and fourth keys.

A data owner can provide shares of a cryptographic key to N key servers. The N key servers can store the shares of a cryptographic key from the data owner such that T shares of the cryptographic key can be used to reconstruct the cryptographic key. A client computer can send a blinded query to T key servers of the N key severs, wherein the T key servers can encrypt a blinded query of a client computer using the share of the cryptographic key to determine a partial encryption. The client computer can receive T partial encryptions, assemble T partial encryptions to form an encrypted blinded query, and deblind the encrypted blinded query. The client computer can then use the encrypted query to perform a search on encrypted data of a remote database server using a searchable symmetric encryption scheme.

The embodiment of the invention provides a communication encryption method, computer equipment and a storage medium, relates to the technical field of information security, and can provide a safer communication process. Comprising the following steps: a server receives a first key acquisition request sent by a first terminal, and acquires a first composite key from a plurality of composite keys; wherein the composite key is a key obtained after fusion processing based on multiple types of quantum keys. And the server obtains a second composite key matched with the user information of the first terminal from the plurality of composite keys. And sending the second composite key to the server, so that the server encrypts the first composite key through the second composite key to obtain the encrypted first composite key. And the server sends the encrypted first composite key to the first terminal, so that the first terminal encrypts or decrypts communication data with the second terminal based on the first composite key after decrypting the encrypted first composite key.

Systems and methods are disclosed for computer attestation by generating, in a software enclave on a native application or browser and from a host device, a key generation request to a secure key client to generate a key pair; performing a multi-party key generation operation between the secure key client on the native application or browser and a secure key server; and storing a first private key share and public key on the secure key client, wherein a second private key share and a public key are stored on the secure key server and wherein the public key is sent from the secure key server to a host server for storage.

The present invention discloses a shared encryption and decryption method and device, and relates to the field of network security technology, wherein the shared encryption method comprises: receiving a data encryption request sent by a first system; obtaining a first ZMK ciphertext and a ZPK ciphertext from the first system, encrypting the first ZMK ciphertext with the LMK of a shared encryption machine cluster, and then encrypting it with the first SPK of a first encryption machine associated with the first system; decrypting the first ZMK ciphertext with the first SPK to obtain a second ZMK ciphertext; sending the ZPK ciphertext, the second ZMK ciphertext and data to be encrypted to the shared encryption machine cluster, the shared encryption machine cluster encrypts the data to be encrypted, and obtains an encrypted data ciphertext; receiving the encrypted data ciphertext provided by the shared encryption machine cluster; and sending the encrypted data ciphertext to a second key server associated with the second system. The present invention can ensure the security between various systems when shared encryption is implemented.

An application server has a custodian application running thereon. The server receives a command to instantiate a cryptographic microservice application on the application server. In response, the server instantiates the cryptographic microservice application. The cryptographic microservice application builds a secure enclave on the application server and, within the secure enclave, a cryptogram that represents a virtual fingerprint of the cryptographic microservice application. The server transmits the cryptogram to an authentication computing system. The server receives a digitally signed certificate from the authentication computing system and a data encryption key encrypted with a master tenant key from the custodian application. The server transmits a request to the authentication computing system. The request includes the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key. The server then receives the decrypted data encryption key from the authentication computing system.

Methods and systems for personalizing contactless cards are provided. An exemplary method includes: preinstalling, by a server, an applet on the contactless card; assigning, by the server, a first unique identifier to the contactless card; pre-provisioning, by the server, a first unique derived key to the contactless card; generating, by the server a first nonce; generating, by the server, a data file containing script for updating the contactless card and further containing a message authentication code (MAC); transmitting, by the server, the data file and the first nonce to the contactless card; validating, by the contactless card, the MAC based on the first unique derived key and the first nonce; and personalizing the contactless card by the preinstalled applet executing the script.

The invention discloses a signal encryption method and device based on quantum key distribution, and relates to the technical field of satellite navigation, and the method comprises the steps: building a quantum key distribution system based on a plurality of interconnected quantum key servers, and enabling a user communication terminal to be connected with a nearby quantum key server; the communication relay unit performs basis vector comparison on the quantum state data of the satellite and the ground station through a key distribution protocol to generate a quantum key; the key distribution unit dynamically updates the quantum key and distributes the quantum key to the user communication terminal; the user communication terminal encrypts the satellite navigation data by using the quantum key to obtain an encrypted data packet, and sends the encrypted data packet to the receiving end through the communication relay unit; and the receiving end decrypts the encrypted data packet based on the quantum key to obtain the satellite navigation data. According to the method, the generation rate of the quantum key can be improved, the anti-interference performance of the quantum key distribution system in a complex environment is enhanced, and the stability and reliability of the quantum key distribution system are ensured.

The embodiment of the present disclosure discloses a data fusion system. A specific implementation of the system includes: a key server, a computing server and at least two data collection servers, wherein each data collection server generates a data mask sequence and a disturbance perception data sequence; the key server performs obfuscation processing on each data mask to obtain at least two obfuscated data mask sequences; the key server performs obfuscation processing on at least two disturbance perception data sequences to obtain at least two obfuscated perception data sequences, and sends at least two obfuscated perception data sequences to the computing server to generate at least two target obfuscated perception data sequences; the computing server constructs a data fusion obfuscation circuit, and inputs at least two target obfuscated perception data sequences, at least two obfuscated data mask sequences and an initial perception target true value sequence into the obfuscation circuit; and generates a data fusion result. This implementation improves the security of the perception data of each data provider.

A method is disclosed. The method includes receiving a first interaction request to transfer a first interaction amount from a sender to a receiver. The first interaction request comprise a sender identifier, a receiver identifier, the first interaction amount, and a condition. The computer generates a smart contract this information, and then hashes the to form a first hash key. The computer incorporates the information, and the first hash key into a first block in a blockchain. The computer receives a second interaction request from the receiver device to transferring a second amount from the receiver to a third party, the second interaction request comprising the receiver identifier, a second interaction amount, and a third party identifier. The computer hashes this information to form a second hash key. The server computer incorporates this information and the second hash key into a second block in the blockchain.

The invention belongs to the field of information security, and particularly relates to an information security storage method, which comprises the following steps of: receiving uploaded original file data, and dynamically segmenting the original file data into a plurality of data fragments; adding a key to each data fragment in the encryption pool by using a random encryption algorithm to obtain an encrypted fragment; establishing a key group corresponding to each encryption fragment, and uploading a key field encrypted by the key group to a special key server; the file is dynamically segmented for fragmented storage, the file is stored in a multi-level encryption mode, when leakage occurs in any link, the other levels of encryption means can still prevent leakage of the file, and the reliability of file storage is ensured. An attacker permeates the system for a long time, fragments and keys are slowly collected, defense is expanded from a fragment dispersion space dimension to a key timeliness time dimension through dynamic rotation, fragment integrity and key timeliness need to be met at the same time during cracking, and file storage safety is improved.

An application server has a custodian application running thereon. The server receives a command to instantiate a cryptographic microservice application on the application server. In response, the server instantiates the cryptographic microservice application. The cryptographic microservice application builds a secure enclave on the application server and, within the secure enclave, a cryptogram that represents a virtual fingerprint of the cryptographic microservice application. The server transmits the cryptogram to an authentication computing system. The server receives a digitally signed certificate from the authentication computing system and a data encryption key encrypted with a master tenant key from the custodian application. The server transmits a request to the authentication computing system. The request includes the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key. The server then receives the decrypted data encryption key from the authentication computing system.

The invention discloses a lattice-based updatable private key password protection secret sharing method. The method comprises the steps of system initialization, a secret recovery method and a secret key share updating method. According to the method, a zero update technology is adopted, password protection secret sharing dynamic key update is achieved, key share update is achieved between servers, the correctness of key update is verified through a Lagrange interpolation polynomial, the key does not affect the value of a master key, the application range is expanded, and the method is suitable for popularization and application. According to the invention, quantum resistance, continuous leakage resistance and online password guess attack resistance are realized, authentication with a plurality of key servers can be carried out securely, an encryption key for decrypting cloud privacy data is reconstructed, user privacy is effectively guaranteed, secure storage and controllable access of data are realized, and key privacy protection is provided for a cloud storage technology. The method has the advantages of being good in robustness, high in secret key updating efficiency, high in reliability, wide in application range and the like, and can be applied to the technical field of privacy of password protection secret sharing.

The invention provides a security verification method and system in an API request process, and relates to the technical field of network security, and the method comprises the steps: receiving an API call instruction and an HTTP request sent by a browser; generating a server public key and a symmetric key; generating a digital envelope according to the symmetric key and a server private key corresponding to the server public key; sending the symmetric key, the server public key and the digital envelope to a browser, and decrypting to obtain a digital digest; generating browser information; generating a second digital signature of the HTTP request in combination with the digital digest, the browser information, the request information and the request method; the browser information and the HTTP request with the second digital signature as a request header are sent to a server for verification; and under the condition that the HTTP request passes verification, performing a service processing flow on the HTTP request, otherwise, terminating the service processing flow. And the replay attack prevention efficiency and effectiveness are improved.

The invention belongs to the technical field of computer storage, and particularly discloses a decentralized data encryption and deduplication storage method based on coding matrix secret sharing, and the method comprises the steps: carrying out the blocking processing of to-be-stored data, and generating a plurality of data blocks; based on the content fingerprints of the plurality of data blocks, cooperatively generating an encrypted coding matrix through a plurality of decentralized key servers; encrypting the plurality of data blocks based on the encryption coding matrix to generate a plurality of ciphertext blocks; and storing the plurality of ciphertext blocks in a distributed storage system, and deleting duplicated data based on the content fingerprints corresponding to the plurality of ciphertext blocks respectively. The method can improve the expansibility and performance of the system, ensures the security and storage reliability of the data, and is suitable for a large-scale distributed storage environment.

The invention relates to the technical field of network and information security, and discloses a cloud-side collaborative ubiquitous network ciphertext data security management system, which comprises a user side module, an edge node module, a cloud server module, a key server module and a backup and integrity verification module. The user side performs local de-duplication by using the simple tag and generates an attribute ciphertext and a multi-level de-duplication tag; the edge node judges duplication and then forwards; the cloud side matches the label in parallel to realize unique storage. The backup module fragments the ciphertext according to a Shamir secret sharing threshold value and carries out distributed encryption backup; and the integrity verification module adopts lattice signature based on learning with an error problem, cloud, edge and end multi-point verification, and dynamic access is realized in combination with a reputation threshold value. The system gives consideration to confidentiality, duplicate removal efficiency, disaster recovery capability and anti-quantum integrity, and is suitable for large-scale data scenes of the Internet of Vehicles, the Internet of Things and the like.

A system encrypts and decrypts e-mail, messages, and other digital data. By using quantum random number generators, the system has improved data security. Using a quantum random number, an agent (at a sender side) generates an encryption key which is used to automatically encrypt a message. The encryption key is stored at a key server. The encrypted message will be sent by an application using its standard transmission means such as SMTP, SMS, and others. The encrypted message can be automatically unencrypted by using an agent (at a recipient side) and retrieving the key from the key server. The system also provides an optional double encryption, where the message is encrypted with a user-generated password before being encrypted using the encryption key.

A security client of a mobile computing platform transmits a request for the secret key to a key server. The request includes environmental data characterizing a current state of the environment of the node and establishes a cryptographic heartbeat with the key server. The security client receives a secret key from the key server, stores the secret key in volatile memory and decrypts the encrypted file using the secret key to create a decrypted file in the volatile memory. The security client monitors a time since a last authenticated heartbeat message was received. Responsive to the time exceeding a predetermined timeout window or responsive to receiving a message from the key server indicating that authorization to the decrypted file is revoked or responsive to determining that the node is not in an authorized environment, the security client deletes the secret key from the volatile memory and closes the decrypted file.

A server issues challenge data and transmits the challenge data to a client. The client stores encrypted group data including a plurality of encrypted data encrypted with a server key, and parameter data A, in a memory, receives the challenge data, generates response data using a response key on the client side, and transmits the response data, the encrypted group data, and the parameter data A to the server. The server selects encrypted data to be used from the received encrypted group data, based on the received parameter data A, sets a response key on the server side, based on the selected encrypted data and data decrypted with the server key, verifies the received response data, based on the challenge data and the response key on the server side, and notifies a result of the verification to the client. The client receives the notification.

A method of a decryptor including receiving, from an encryptor of an electronic device, a core dump that has been encrypted with a symmetric key generated by the encryptor, and core dump metadata, extracting crash metadata from the core dump metadata, transmitting the crash metadata to a remote key server for regenerating the symmetric key, obtaining, from the remote key server, a regenerated symmetric key based the crash metadata, and decrypting the core dump based on the regenerated symmetric key and the crash metadata.

A tracking device can provide a hashed identifier to a mobile device, for instance within an advertisement packet. The mobile device can query each of a plurality of entities with the hashed identifier to identify an entity associated with the hash key used to generate the hashed identifier. In some embodiments, the mobile device can query a centralized key server, which in turn can query the plurality of entities to identify the entity associated with the hash key. The mobile device can then receive a public key from the identified entity, can determine a location of the mobile device, and can encrypt the location with the public key. The mobile device can then provide the hashed identifier and the encrypted location to the identified entity, which can provide the encrypted location to an owner of the tracking device for decryption using a private key corresponding to the public key.

Techniques for utilizing post-quantum pre-shared key (PPK) identifiers (PPK_ID) to determine control association key(s) (CAK(s)) and / or secure association key(s) (SAK(s)) utilized in MACsec sessions are described herein. A key server (KS) and a non-key server (NKS) may advertise capabilities indicating an ability to utilize PPKs as CAKs and / or SAKs in MACsec sessions. The KS may leverage a quantum key distribution (QKD) service to determine a PPK_ID and a PPK, which may be utilized as a CAK for a MACsec session with the NKS. The PPK_ID may be transmitted to the NKS, where the NKS may retrieve the PPK from the QKD, and a new group connectivity association may be established using the PPK as the CAK. In some examples, the KS may be configured to refresh the PPK as the CAK for instantiating subsequent MACsec sessions. Additionally, the KS may be configured to distribute a SAK in a similar manner.

Methods for quantum key distribution are disclosed including forming a quantum production key package with a production file name; forming a first quantum sacrificial key package with a first sacrificial file name associated with a portion of the first production file name; sending the quantum sacrificial key package to a sacrificial key server; and sending the quantum production key package to computer devices to set up a quantum key encryption tunnel between the computer devices. The quantum production key packages are received by computer devices that send the production file name to the sacrificial key server to receive the sacrificial return key. The sacrificial return key is used to decrypt the quantum production key package with the quantum production keys. A first quantum production key is retrieved to encrypt and decrypt data at each computer device.

The invention discloses a lightweight hybrid defense method and system for federated learning gradient leakage, and the method comprises the steps: firstly calculating the importance of model parameters based on local data through employing Fisher information, and generating a local important parameter mask; a plurality of clients jointly determine a global encryption parameter set, important parameters are reserved locally as personalized knowledge, and other non-key parameters are classified into a noise area; the client performs homomorphic encryption on the global encryption parameter set by using the public key, adds differential privacy noise to the parameters in the noise area, and uploads the processed parameters; the system adopts a double-server architecture, an aggregation server aggregates encryption parameters and noise parameters respectively, a key server is responsible for decrypting the aggregated encryption parameters and merging the encrypted parameters with the noise parameters, and through selective encryption and personalized parameter reservation, the calculation and communication overhead is remarkably reduced, and the system has the advantages of being high in security and high in reliability. And meanwhile, relatively high model accuracy and strong privacy protection capability are still kept in a non-independent identically distributed data environment.

The invention discloses a direct communication-based data transmission method, which comprises the following steps that: each of a plurality of terminals initiates an identity authentication request to an aggregation security gateway, the aggregation security gateway constructs a topological connection relationship based on the terminals passing the identity authentication, and the terminals establish connection according to the topological connection relationship to form a communication network; the method comprises the following steps: in a communication network, acquiring a symmetrical communication key file 1 from a key server by two mutually connected terminals through an aggregation security gateway; the sending terminal determines a communication route, processes the service data mes, generates a sending data packet MES and sends the sending data packet MES to the receiving terminal; the receiving terminal carries out decryption and verification operation on the sending data packet MES, after verification is passed, service data mes' are obtained, and service processing operation is executed. A full-link safety guarantee system from identity authentication, connection establishment, secret key management to data transmission is built, and essential improvement of safety is achieved while high communication efficiency is guaranteed.

The invention provides a cloud service-based intelligent device key management system, which comprises a plurality of terminal devices, and is characterized in that the terminal devices are configured to perform encryption through public keys according to device serial numbers and timestamp data to generate real-time keys; each terminal device comprises a first storage module and a second storage module, and the first storage module is configured to store first key data reported successfully; the second storage module is configured to store the second key data which fails to be reported; the cloud server is configured to verify the real-time secret key through the public key and generate a secret key verification result; the secret key verification result is used for marking success or failure of real-time secret key reporting; and the key server is configured to store the successfully reported key data. According to the system, the problems of single derived key path, lack of a key log tracing function and incapability of real-time risk blocking in the existing key management technology are solved.

Methods, systems, and devices for data processing are described. A server host may receive a login request that includes a clear text password for an account associated with a tenant of a multi-tenant cloud platform. The server host may retrieve an encrypted payload associated with the account. The encrypted payload may include a hash value of a user-configured password for the account and an indication of a hashing algorithm used to transform the user-configured password into the hash value. The server host may obtain a wrapped symmetric key provisioned by a symmetric key distribution service. The server host may transmit a request that includes the encrypted payload, the clear text password, and the wrapped symmetric key. The server host may receive a response that indicates whether a hash value of the clear text password from the login request corresponds to the hash value of the user-configured password.

The present invention discloses a federated learning system and method based on differential privacy to prevent poisoning attacks. The system includes a key center, a server S1, and a server S2. Server S1 and a user negotiate to obtain a symmetric key. Server S1 generates Gaussian noise, encrypts it with the symmetric key, and sends it to the user. Normal users send local model parameters trained by noise perturbation to server S2, while malicious users upload random numbers as local model parameters to server S2. Servers S1 and S2 exchange information to complete model parameter verification and aggregation. Server S1 sends the aggregated model parameters to each user. The system determines whether the model has converged. If so, the process ends. If not, the above steps are repeated until the model converges. The present invention enables the server to verify whether the model parameters have been poisoned without infringing user privacy, and reduces computing and communication overhead.