189 results about "Key server" patented technology

Methods, systems, and devices for data processing are described. A server host may receive a login request that includes a clear text password for an account associated with a tenant of a multi-tenant cloud platform. The server host may retrieve an encrypted payload associated with the account. The encrypted payload may include a hash value of a user-configured password for the account and an indication of a hashing algorithm used to transform the user-configured password into the hash value. The server host may obtain a wrapped symmetric key provisioned by a symmetric key distribution service. The server host may transmit a request that includes the encrypted payload, the clear text password, and the wrapped symmetric key. The server host may receive a response that indicates whether a hash value of the clear text password from the login request corresponds to the hash value of the user-configured password.

The invention provides a key charging method and device based on quantum key protection. The method comprises the following steps: a charging client sends a key negotiation request to a local key server; the local key server obtains a first quantum key through the quantum key distribution network as a shared key and sends the shared key to the charging client and the target key server; the charging client sends a charging key acquisition request to the target key server; the target key server obtains the charging key and encrypts the charging key by using the shared key to generate a charging key ciphertext; the target key server sends the charging key ciphertext to the charging client; and the charging client writes the charging key ciphertext and the shared key into the key charging security medium to complete key charging, so that secure transmission and storage of the key among different security environments are ensured through the quantum key distribution network, and the charging key is encrypted by using the quantum key in the transmission process, so that the security of the key is ensured. And the security and reliability of key management are improved.

A server can receive a device public key and forward the device public key to a key server. The key server can perform a first elliptic curve Diffie-Hellman (ECDH) key exchange using the device public key and a network private key to derive a secret X1. The key server can send the secret X1 to the server. The server can derive an ECC PKI key pair and send to the device the server public key. The server can conduct a second ECDH key exchange using the derived server secret key and the device public key to derive a secret X2. The server can perform an ECC point addition using the secret X1 and secret X2 to derive a secret X3. The device can derive the secret X3 using (i) the server public key, a network public key, and the device private key and (ii) a third ECDH key exchange.

The invention discloses a method for applying an anti-quantum certificate to a TLS1.2 handshake process, which realizes the application of an MLDSA anti-quantum signature algorithm and an MLKEM anti-quantum key encapsulation mechanism in the handshake process by expanding a cipher suite and a signature algorithm field of a TLS1.2 protocol. The method specifically comprises the following steps: defining a cipher suite supporting MLKEM and an MLDSA signature algorithm enumeration value; the client declares algorithm support in ClientHello, and the server responds and returns a certificate chain containing the double-antibody quantum certificate; after the client verifies the certificate, the pre-master key is encapsulated by using MLKEM, and the server de-encapsulates the derived session key; and the two parties send Finished messages to each other to complete handshake. According to the scheme, on the premise that a TLS1.2 basic framework is not changed, the communication security is enhanced through double-resistance quantum algorithm integration, international and national cryptographic algorithms are supported, quantum computing attacks can be resisted, meanwhile, adaptation of the international and national cryptographic algorithms is supported, compatibility with an existing system is ensured, the security risk of a traditional cryptographic algorithm in a quantum environment is solved, and the security risk of the traditional cryptographic algorithm in the quantum environment is reduced. And a standardized solution is provided for anti-quantum upgrade of the TLS1.2 protocol.

A server and a device can conduct mutually authenticated post-quantum cryptography (PQC) key encapsulation mechanisms (KEM) that also support forward secrecy. The device can store a trusted server public key (PK.server) and the server can store a trusted device public key (PK.device). The device can generate (i) a first KEM ciphertext and (ii) a first key with PK.server and encrypt an ephemeral public key (ePK.device) using the first key. The server can generate (i) a second KEM ciphertext and (ii) a second key with ePK.device. The server can generate (i) a third KEM ciphertext and (ii) a third key with PK.device. The server can encrypt an ephemeral public key (ePK.server) using the first, second, and third keys. The device can generate (i) a fourth KEM ciphertext and (ii) a fourth key with ePK.server. The device can encrypt application data using at least the first, second, third, and fourth keys.

A data owner can provide shares of a cryptographic key to N key servers. The N key servers can store the shares of a cryptographic key from the data owner such that T shares of the cryptographic key can be used to reconstruct the cryptographic key. A client computer can send a blinded query to T key servers of the N key severs, wherein the T key servers can encrypt a blinded query of a client computer using the share of the cryptographic key to determine a partial encryption. The client computer can receive T partial encryptions, assemble T partial encryptions to form an encrypted blinded query, and deblind the encrypted blinded query. The client computer can then use the encrypted query to perform a search on encrypted data of a remote database server using a searchable symmetric encryption scheme.

The embodiment of the invention provides a communication encryption method, computer equipment and a storage medium, relates to the technical field of information security, and can provide a safer communication process. Comprising the following steps: a server receives a first key acquisition request sent by a first terminal, and acquires a first composite key from a plurality of composite keys; wherein the composite key is a key obtained after fusion processing based on multiple types of quantum keys. And the server obtains a second composite key matched with the user information of the first terminal from the plurality of composite keys. And sending the second composite key to the server, so that the server encrypts the first composite key through the second composite key to obtain the encrypted first composite key. And the server sends the encrypted first composite key to the first terminal, so that the first terminal encrypts or decrypts communication data with the second terminal based on the first composite key after decrypting the encrypted first composite key.

Systems and methods are disclosed for computer attestation by generating, in a software enclave on a native application or browser and from a host device, a key generation request to a secure key client to generate a key pair; performing a multi-party key generation operation between the secure key client on the native application or browser and a secure key server; and storing a first private key share and public key on the secure key client, wherein a second private key share and a public key are stored on the secure key server and wherein the public key is sent from the secure key server to a host server for storage.

The present invention discloses a shared encryption and decryption method and device, and relates to the field of network security technology, wherein the shared encryption method comprises: receiving a data encryption request sent by a first system; obtaining a first ZMK ciphertext and a ZPK ciphertext from the first system, encrypting the first ZMK ciphertext with the LMK of a shared encryption machine cluster, and then encrypting it with the first SPK of a first encryption machine associated with the first system; decrypting the first ZMK ciphertext with the first SPK to obtain a second ZMK ciphertext; sending the ZPK ciphertext, the second ZMK ciphertext and data to be encrypted to the shared encryption machine cluster, the shared encryption machine cluster encrypts the data to be encrypted, and obtains an encrypted data ciphertext; receiving the encrypted data ciphertext provided by the shared encryption machine cluster; and sending the encrypted data ciphertext to a second key server associated with the second system. The present invention can ensure the security between various systems when shared encryption is implemented.

An application server has a custodian application running thereon. The server receives a command to instantiate a cryptographic microservice application on the application server. In response, the server instantiates the cryptographic microservice application. The cryptographic microservice application builds a secure enclave on the application server and, within the secure enclave, a cryptogram that represents a virtual fingerprint of the cryptographic microservice application. The server transmits the cryptogram to an authentication computing system. The server receives a digitally signed certificate from the authentication computing system and a data encryption key encrypted with a master tenant key from the custodian application. The server transmits a request to the authentication computing system. The request includes the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key. The server then receives the decrypted data encryption key from the authentication computing system.

The present invention relates to a method for sharing control authority of an IoT device, which belongs to the field of IoT technology. The function is that a master user shares the control authority of an IoT device with a non-master user, and the steps are as follows: the IoT device generates an encryption code and reports it to a cloud server; the cloud server uses the encryption code to encrypt the master user ID and the sharing information of the control authority to generate an authority access key; the non-master user requests the authority access key from the server, and the server feeds back the authority access key to the non-master user after receiving the request; the non-master user logs in to the IoT device using the authority access key to obtain the control authority. The method allows the IoT device to also perceive the user's control authority, thereby realizing direct control without the need for cloud server transfer, improving the user experience and reducing the risk of being illegally controlled.

Methods and systems for personalizing contactless cards are provided. An exemplary method includes: preinstalling, by a server, an applet on the contactless card; assigning, by the server, a first unique identifier to the contactless card; pre-provisioning, by the server, a first unique derived key to the contactless card; generating, by the server a first nonce; generating, by the server, a data file containing script for updating the contactless card and further containing a message authentication code (MAC); transmitting, by the server, the data file and the first nonce to the contactless card; validating, by the contactless card, the MAC based on the first unique derived key and the first nonce; and personalizing the contactless card by the preinstalled applet executing the script.

The embodiment of the invention provides a data transmission method and a related device, and the data transmission method comprises the steps that after a terminal and an edge agent establish secure connection, the edge agent sends key information corresponding to the terminal to a server, and the server determines a first key between the terminal and the edge agent according to the key information, the server decrypts the data sent by the terminal and forwarded by the edge agent through the first key, and the edge agent does not need to encrypt and decrypt the data sent by the forwarded terminal, so that the loss of computing resources of the edge agent is reduced, and the throughput of the edge agent is improved.

The invention discloses a signal encryption method and device based on quantum key distribution, and relates to the technical field of satellite navigation, and the method comprises the steps: building a quantum key distribution system based on a plurality of interconnected quantum key servers, and enabling a user communication terminal to be connected with a nearby quantum key server; the communication relay unit performs basis vector comparison on the quantum state data of the satellite and the ground station through a key distribution protocol to generate a quantum key; the key distribution unit dynamically updates the quantum key and distributes the quantum key to the user communication terminal; the user communication terminal encrypts the satellite navigation data by using the quantum key to obtain an encrypted data packet, and sends the encrypted data packet to the receiving end through the communication relay unit; and the receiving end decrypts the encrypted data packet based on the quantum key to obtain the satellite navigation data. According to the method, the generation rate of the quantum key can be improved, the anti-interference performance of the quantum key distribution system in a complex environment is enhanced, and the stability and reliability of the quantum key distribution system are ensured.

The embodiment of the present disclosure discloses a data fusion system. A specific implementation of the system includes: a key server, a computing server and at least two data collection servers, wherein each data collection server generates a data mask sequence and a disturbance perception data sequence; the key server performs obfuscation processing on each data mask to obtain at least two obfuscated data mask sequences; the key server performs obfuscation processing on at least two disturbance perception data sequences to obtain at least two obfuscated perception data sequences, and sends at least two obfuscated perception data sequences to the computing server to generate at least two target obfuscated perception data sequences; the computing server constructs a data fusion obfuscation circuit, and inputs at least two target obfuscated perception data sequences, at least two obfuscated data mask sequences and an initial perception target true value sequence into the obfuscation circuit; and generates a data fusion result. This implementation improves the security of the perception data of each data provider.

A method is disclosed. The method includes receiving a first interaction request to transfer a first interaction amount from a sender to a receiver. The first interaction request comprise a sender identifier, a receiver identifier, the first interaction amount, and a condition. The computer generates a smart contract this information, and then hashes the to form a first hash key. The computer incorporates the information, and the first hash key into a first block in a blockchain. The computer receives a second interaction request from the receiver device to transferring a second amount from the receiver to a third party, the second interaction request comprising the receiver identifier, a second interaction amount, and a third party identifier. The computer hashes this information to form a second hash key. The server computer incorporates this information and the second hash key into a second block in the blockchain.

The invention belongs to the field of information security, and particularly relates to an information security storage method, which comprises the following steps of: receiving uploaded original file data, and dynamically segmenting the original file data into a plurality of data fragments; adding a key to each data fragment in the encryption pool by using a random encryption algorithm to obtain an encrypted fragment; establishing a key group corresponding to each encryption fragment, and uploading a key field encrypted by the key group to a special key server; the file is dynamically segmented for fragmented storage, the file is stored in a multi-level encryption mode, when leakage occurs in any link, the other levels of encryption means can still prevent leakage of the file, and the reliability of file storage is ensured. An attacker permeates the system for a long time, fragments and keys are slowly collected, defense is expanded from a fragment dispersion space dimension to a key timeliness time dimension through dynamic rotation, fragment integrity and key timeliness need to be met at the same time during cracking, and file storage safety is improved.

A method (200) for the maintenance of a motor vehicle (105) by a service provider (135) comprises steps of authenticating (210) a user (110) associated with the motor vehicle (105) to a mobile device (120); granting (215) an access authorization based on a digital key (115) stored on the mobile device (120); wherein the access authorization entitles the service provider (135) to access predetermined vehicle data stored at a location (125, 130) external to the motor vehicle (105); transmitting (220) the access authorization to a key server (115); and transmitting (230) the vehicle data to the service provider (135).

An application server has a custodian application running thereon. The server receives a command to instantiate a cryptographic microservice application on the application server. In response, the server instantiates the cryptographic microservice application. The cryptographic microservice application builds a secure enclave on the application server and, within the secure enclave, a cryptogram that represents a virtual fingerprint of the cryptographic microservice application. The server transmits the cryptogram to an authentication computing system. The server receives a digitally signed certificate from the authentication computing system and a data encryption key encrypted with a master tenant key from the custodian application. The server transmits a request to the authentication computing system. The request includes the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key. The server then receives the decrypted data encryption key from the authentication computing system.

The invention discloses a lattice-based updatable private key password protection secret sharing method. The method comprises the steps of system initialization, a secret recovery method and a secret key share updating method. According to the method, a zero update technology is adopted, password protection secret sharing dynamic key update is achieved, key share update is achieved between servers, the correctness of key update is verified through a Lagrange interpolation polynomial, the key does not affect the value of a master key, the application range is expanded, and the method is suitable for popularization and application. According to the invention, quantum resistance, continuous leakage resistance and online password guess attack resistance are realized, authentication with a plurality of key servers can be carried out securely, an encryption key for decrypting cloud privacy data is reconstructed, user privacy is effectively guaranteed, secure storage and controllable access of data are realized, and key privacy protection is provided for a cloud storage technology. The method has the advantages of being good in robustness, high in secret key updating efficiency, high in reliability, wide in application range and the like, and can be applied to the technical field of privacy of password protection secret sharing.

The invention provides a security verification method and system in an API request process, and relates to the technical field of network security, and the method comprises the steps: receiving an API call instruction and an HTTP request sent by a browser; generating a server public key and a symmetric key; generating a digital envelope according to the symmetric key and a server private key corresponding to the server public key; sending the symmetric key, the server public key and the digital envelope to a browser, and decrypting to obtain a digital digest; generating browser information; generating a second digital signature of the HTTP request in combination with the digital digest, the browser information, the request information and the request method; the browser information and the HTTP request with the second digital signature as a request header are sent to a server for verification; and under the condition that the HTTP request passes verification, performing a service processing flow on the HTTP request, otherwise, terminating the service processing flow. And the replay attack prevention efficiency and effectiveness are improved.

The invention belongs to the technical field of computer storage, and particularly discloses a decentralized data encryption and deduplication storage method based on coding matrix secret sharing, and the method comprises the steps: carrying out the blocking processing of to-be-stored data, and generating a plurality of data blocks; based on the content fingerprints of the plurality of data blocks, cooperatively generating an encrypted coding matrix through a plurality of decentralized key servers; encrypting the plurality of data blocks based on the encryption coding matrix to generate a plurality of ciphertext blocks; and storing the plurality of ciphertext blocks in a distributed storage system, and deleting duplicated data based on the content fingerprints corresponding to the plurality of ciphertext blocks respectively. The method can improve the expansibility and performance of the system, ensures the security and storage reliability of the data, and is suitable for a large-scale distributed storage environment.

The invention relates to the technical field of network and information security, and discloses a cloud-side collaborative ubiquitous network ciphertext data security management system, which comprises a user side module, an edge node module, a cloud server module, a key server module and a backup and integrity verification module. The user side performs local de-duplication by using the simple tag and generates an attribute ciphertext and a multi-level de-duplication tag; the edge node judges duplication and then forwards; the cloud side matches the label in parallel to realize unique storage. The backup module fragments the ciphertext according to a Shamir secret sharing threshold value and carries out distributed encryption backup; and the integrity verification module adopts lattice signature based on learning with an error problem, cloud, edge and end multi-point verification, and dynamic access is realized in combination with a reputation threshold value. The system gives consideration to confidentiality, duplicate removal efficiency, disaster recovery capability and anti-quantum integrity, and is suitable for large-scale data scenes of the Internet of Vehicles, the Internet of Things and the like.

A system encrypts and decrypts e-mail, messages, and other digital data. By using quantum random number generators, the system has improved data security. Using a quantum random number, an agent (at a sender side) generates an encryption key which is used to automatically encrypt a message. The encryption key is stored at a key server. The encrypted message will be sent by an application using its standard transmission means such as SMTP, SMS, and others. The encrypted message can be automatically unencrypted by using an agent (at a recipient side) and retrieving the key from the key server. The system also provides an optional double encryption, where the message is encrypted with a user-generated password before being encrypted using the encryption key.

A system uses a keyboard application to encrypt and decrypt e-mail, messages, and other digital data. By using quantum random number generators, the system has improved data security. Using a quantum random number, an agent (at a sender side) generates an encryption key which is used to automatically encrypt a message. The encryption key is stored at a key server. The encrypted message will be sent by an application using its standard transmission techniques such as SMTP, SMS, and others. The encrypted message can be automatically unencrypted by using an agent (at a recipient side) and retrieving the key from the key server. The system also provides an optional double encryption, where the message is encrypted with a user-generated password before being encrypted using the encryption key.

A security client of a mobile computing platform transmits a request for the secret key to a key server. The request includes environmental data characterizing a current state of the environment of the node and establishes a cryptographic heartbeat with the key server. The security client receives a secret key from the key server, stores the secret key in volatile memory and decrypts the encrypted file using the secret key to create a decrypted file in the volatile memory. The security client monitors a time since a last authenticated heartbeat message was received. Responsive to the time exceeding a predetermined timeout window or responsive to receiving a message from the key server indicating that authorization to the decrypted file is revoked or responsive to determining that the node is not in an authorized environment, the security client deletes the secret key from the volatile memory and closes the decrypted file.

A server issues challenge data and transmits the challenge data to a client. The client stores encrypted group data including a plurality of encrypted data encrypted with a server key, and parameter data A, in a memory, receives the challenge data, generates response data using a response key on the client side, and transmits the response data, the encrypted group data, and the parameter data A to the server. The server selects encrypted data to be used from the received encrypted group data, based on the received parameter data A, sets a response key on the server side, based on the selected encrypted data and data decrypted with the server key, verifies the received response data, based on the challenge data and the response key on the server side, and notifies a result of the verification to the client. The client receives the notification.

A method of a decryptor including receiving, from an encryptor of an electronic device, a core dump that has been encrypted with a symmetric key generated by the encryptor, and core dump metadata, extracting crash metadata from the core dump metadata, transmitting the crash metadata to a remote key server for regenerating the symmetric key, obtaining, from the remote key server, a regenerated symmetric key based the crash metadata, and decrypting the core dump based on the regenerated symmetric key and the crash metadata.

A tracking device can provide a hashed identifier to a mobile device, for instance within an advertisement packet. The mobile device can query each of a plurality of entities with the hashed identifier to identify an entity associated with the hash key used to generate the hashed identifier. In some embodiments, the mobile device can query a centralized key server, which in turn can query the plurality of entities to identify the entity associated with the hash key. The mobile device can then receive a public key from the identified entity, can determine a location of the mobile device, and can encrypt the location with the public key. The mobile device can then provide the hashed identifier and the encrypted location to the identified entity, which can provide the encrypted location to an owner of the tracking device for decryption using a private key corresponding to the public key.

Techniques for utilizing post-quantum pre-shared key (PPK) identifiers (PPK_ID) to determine control association key(s) (CAK(s)) and / or secure association key(s) (SAK(s)) utilized in MACsec sessions are described herein. A key server (KS) and a non-key server (NKS) may advertise capabilities indicating an ability to utilize PPKs as CAKs and / or SAKs in MACsec sessions. The KS may leverage a quantum key distribution (QKD) service to determine a PPK_ID and a PPK, which may be utilized as a CAK for a MACsec session with the NKS. The PPK_ID may be transmitted to the NKS, where the NKS may retrieve the PPK from the QKD, and a new group connectivity association may be established using the PPK as the CAK. In some examples, the KS may be configured to refresh the PPK as the CAK for instantiating subsequent MACsec sessions. Additionally, the KS may be configured to distribute a SAK in a similar manner.