201 results about "Key sharing" patented technology

To share encrypted data more securely. After a pair of an identification token 131 and key disclosure permission information 134 transmitted from a first client terminal 102 is verified by a verification unit 106, a key registration unit 107 registers a record 122 including the key 133 and the key disclosure permission information 134 in a database 121 of a key sharing server 101 and transmits key identification information 135 for identifying the record to the first client terminal 102. The first client terminal 102 transmits data 139 including encrypted data 138 obtained by encrypting transmission data by using a cipher key 136 for data encryption after first processing output by a cipher key first processing unit 109, a cipher key 137 for data decryption after first processing output by the cipher key first processing unit 109, and the key identification information 135 obtained from the key registration unit 107, to a second client terminal 103. The second client terminal 103 makes an inquiry to a key disclosure unit 110 by using the key identification information 135 acquired from the received data 139 and an identification token 132 of the terminal itself. The key disclosure unit 110 acquires the pair of key 133 and key disclosure permission information 134 corresponding to the key identification information 135, from the database 121, and notifies, when the identification token 132 is included in a key disclosure permissible range indicated by the key disclosure permission information 134, the second client terminal of the key 133. The second client terminal 103 uses the notified key 133 to generate a cipher key 140 for data decryption after second processing on the basis of the cipher key 137 for data decryption after first processing acquired from the data 139 and uses the cipher key 140 for data decryption after second processing to execute decryption on the encrypted data 138 in the data 139.

The invention provides a digital asset decentralized management method and system, and the method comprises the steps: enabling legal members in a group to jointly participate in the generation of an initial authorization key according to a preset distributed key generation protocol, dividing the key into a plurality of fragments through a threshold key sharing scheme, and storing the fragments in different member nodes; after the consensus is reached, the member node reconstructs a complete authorization key according to the request content, signs the key by adopting an aggregation signature scheme, generates an authorization certificate, and returns the certificate to the request node; a key cache mechanism is introduced, a member node maintains a local cache and stores historical authorization keys in the latest period of time, when a new authorization request is processed, available keys are searched from the local cache, and the available keys are directly used if hit.

The invention discloses a blockchain and homomorphic encryption-based power data privacy protection method and system, and belongs to the technical field of power data privacy protection, and the method comprises the steps that a data provider encrypts power data by using Paillier homomorphic encryption, uploads a ciphertext hash value to a blockchain, carries out the digital signature of a ciphertext, divides a key, and carries out the encryption of the key; enabling each data demander to receive the ciphertext, the signature and the key fragment; and the data demander performs cooperative decryption after performing data source and integrity verification to obtain a plaintext. Through distributed storage of a key sharing scheme, the security of the key is remarkably improved, single-point faults are avoided, the fault tolerance of the whole system is improved, and the flexibility of data transaction is optimized; for a mass data transaction process, the encryption and decryption efficiency is improved, the data processing speed and performance are improved, the real-time performance of data transaction is ensured, the resource consumption is reduced, and the user experience is improved.

Methods, systems, and devices for data management are described. A datacenter may include one or more servers and an offline key storage system. The datacenter may receive, via a server and from a multi-party computation (MPC) coordinator, a first request to access a key share associated with an MPC node. The server may transmit a second request for the key share associated with the MPC node via a first cross domain communication path to an offline key storage system. The offline key storage system may verify a digital signature included with the second request. The offline key storage system may transmit a response including the key share that is encrypted using an encryption key associated with the MPC node to the server via a second cross domain communication path. The server may transmit a communication including the encrypted key share to the MPC coordinator.

A system includes a primary asset custody subsystem in a first cloud computing data center and a backup asset custody subsystem in a second cloud computing data center different from the first cloud computing data center. The primary subsystem includes a plurality of primary multi-party computation (MPC) clusters, where each primary MPC cluster is allocated to an asset owner and includes a primary MPC client and a plurality of primary MPC nodes. The backup subsystem includes a plurality of backup MPC clusters corresponding to the plurality of primary MPC clusters, where each backup MPC cluster is allocated to the asset owner of its corresponding primary MPC cluster and includes a backup MPC client and a plurality of backup MPC nodes. The backup MPC client sends an export public key from each backup MPC node to the primary MPC client, where each export public key is part of a corresponding export public key-export private key pair. The primary MPC client sends each export public key to a corresponding primary MPC node, and in response, receives from each primary MPC node a corresponding encrypted private key share encrypted with a corresponding export public key. The primary MPC client then sends the encrypted private key shares to the backup MPC client, which transmits the encrypted private key shares to corresponding backup MPC nodes. Each backup MPC node decrypts a corresponding encrypted private key share using the export private key from the corresponding export public key-export private key pair to obtain a corresponding backup private key share which can be used if the backup subsystem takes over operation, and to store the decrypted corresponding backup private key share.

The embodiment of the invention relates to the field of intelligent keys, and discloses a digital key sharing method and device based on a digital key cloud platform and a medium. The method comprises the following steps that: friend equipment acquires a digital key sharing request initiated by vehicle owner equipment, analyzes the sharing request, adds a public key of the friend equipment into the sharing request, and updates the sharing request into a signature request; the vehicle owner equipment acquires the signature request, signs the public key by using a private key of the vehicle owner equipment, replaces the public key with the signed public key, adds the signed public key into the signature request, and updates the signature request into an activation request; and the friend equipment acquires the activation request and sends the signed public key to a digital key cloud platform to register as an activated state, the shared key of the friend equipment takes effect, and digital key sharing is completed. By means of the method, unified sharing management of the digital keys can be achieved, and the flexibility and convenience of sharing use of the digital keys are improved.

Backup and recovery of multi-party computation (MPC) security data utilized to secure digital assets and transactions thereof can enhance user confidence and user experience in digital asset transactions. Example MPC security data can include cryptographic keys and key shares utilized with a N×M MPC signature and validation framework. A computing device participating in generation of MPC secure data can retain a segment of the MPC secure data and can encrypt and store an encrypted segment at a second device. A recovery service or recovery application at the second device can facilitate recovery of the MPC secure data segment at the computing device, or at an additional device not involved in generation of the MPC secure data. The recovery service or application can facilitate recovery of the MPC secure data segment even in the event the computing device is lost.

A communication system according to one embodiment is a communication system including a plurality of communication apparatuses, in which each communication apparatus includes: an application program configured to perform encrypted communication with another communication apparatus; a protocol conversion unit configured to transmit a message representing a predetermined procedure when a key request for a shared key to be used in the encrypted communication is received from the application program; a state management unit configured to receive a message from the protocol conversion unit to manage an execution state of the procedure, and to transmit the message to a protocol driver supporting a predetermined key sharing protocol; and a protocol driver configured to request a key sharing system that executes the key sharing protocol, to generate the shared key, when the message is received from the state management unit.

Methods, systems, and devices for data management are described. A custodial token platform may communicate with a client to support a multi-party computation (MPC) signature for a message. A central coordinator may receive, from the client, a request to sign a message using respective key shares generated by MPC nodes. The key shares may be generated in accordance with an access structure, where the access structure is configured based on a respective set of parameters for the MPC nodes. The central coordinator may transmit a request to execute a MPC signature using a respective key share. The central coordinator may maintain data associated with execution of the MPC signature function by a subset of the MPC nodes using the respective key shares. Additionally, the central coordinator may transmit, to the client, a result of execution of the MPC signature function by the subset of the MPC nodes.

The invention discloses a key sharing and security detection scheme based on an intelligent electric meter, and aims to solve the problems that an untrusted electric meter in an intelligent power grid is difficult to identify effectively, the detection scale is uncontrollable and the communication security is insufficient. According to the scheme, the elliptic curve cryptography, the threshold secret sharing mechanism and the physical unclonable function are combined, and hardware-level binding of the unique identity of the equipment and the secret key is achieved in the registration stage. Through a threshold password mechanism, a plurality of intelligent electric meters cooperatively participate in key reconstruction and encryption communication, and the intelligent electric meters can still work normally when part of the electric meters fail or are broken through. The center node can actively identify a fault or a malicious ammeter and dynamically adjust a communication strategy according to the integrity and correctness of the feedback information. Meanwhile, the scheme supports dynamic identity updating and integrity verification, and effectively resists modeling attacks, Sybil attacks, replay attacks and DoS / DDoS attacks. According to the invention, secure identity authentication, reliable key distribution and efficient anomaly detection are realized, and the security of smart grid terminal communication is improved.

A sender system 2 is equipped with an optical transmitter 20 that transmits an encoded optical signal 40 at a predetermined strength via a line-of-sight (LOS) communication channel 4, and a key distillator 21 that generates a cryptographic key from a random bit sequence outputted by the optical transmitter 20 through a key distillation processing via an authenticated public communication channel 5. A legitimate receiver system 3 is equipped with an optical receiver 30 that receives the optical signal 40 from the optical transmitter 20 via the LOS communication channel 4, and a key distillator 31 that generates a cryptographic key from the random bit sequence outputted by the optical receiver 30 through the key distillation processing via the authenticated public communication channel 5.

Techniques and methods are described to generate a shared secret key using channel characteristics between a transmitting device and a receiving device. A public key is transmitted to a communication device over a first wireless channel and a second wireless channel that is different from the first wireless channel. From the communication device, a first signal and a second signal both carrying the public key are received over the first wireless channel and the second wireless channel, respectively. Based on the first signal and the public key, a first channel response is calculated and, based on the second signal and the public key, a second channel response is calculated. The secret key is determined based on the first and second channel response. In this way, the generation of a channel-based shared secret key becomes more secure and robust against eavesdropping of illegitimate users, allowing for secure communication.

The present application relates to the field of cloud computing, and discloses a key exchange method and apparatus. The method is applied to a first communication party, the first communication party holds a first fixed private key fragment, and a server having a cooperative relationship with the first communication party holds a second fixed private key fragment. The method comprises: receiving a first fixed public key and a first ephemeral public key sent by a second communication party; generating a first key fragment on the basis of the first fixed public key, the first ephemeral public key and the first fixed private key fragment; sending a key exchange parameter to the server, wherein the key exchange parameter is related to the first fixed public key and the first ephemeral public key; receiving a second key fragment sent by the server, wherein the second key fragment is generated on the basis of the key exchange parameter and the second fixed private key fragment; and generating a shared key on the basis of the first key fragment and the second key fragment, wherein the shared key is used for deriving a session key for communication between the first communication party and the second communication party. The present application is used for effectively protecting private keys, thereby improving safety.

Methods, systems, and devices for key management are described. A party having a key share of multiple key shares of a cryptographic key may encrypt a key share via a public threshold encryption key. The party may transmit, in accordance with a multi-party computation (MPC) operation, requests to multiple parties having private key shares of a private threshold decryption key corresponding to the public threshold encryption key. The party may receive multiple partial decryption results from a subset of the parties having the private key shares of the private threshold decryption key. The party may combine the partial decryption results to generate the key share and execute a portion of the MPC operation using the generated key share. Executing the portion of the MPC operation may cause a key share refresh operation for the key share of the cryptographic key.

The invention relates to an one-round password-based authentication and key sharing method with resilience to pre-computation attacks and with communication round efficiency, and the method includes: allowing a client to generate a first hash key, a second hash key, and a random number exponent that is a private salt by using a public parameter and a password and to register the PW-authentication value information including a commitment value generated by the first hash key, the second hash key, and the random number exponent in a server; allowing the client to generate the second hash key by using the password, to generate a client random number exponent, to generate a client temporary public key by using the second hash key and the client random number exponent, and to deliver the client temporary public key to the server; allowing the server to generate a server random number exponent, to generate a ciphertext of a server temporary public key by using the server random number exponent and the PW-authentication value information, and to deliver the ciphertext to the client; allowing the client to generate the first hash key by using the password, to decrypt the ciphertext, and to acquire the server temporary public key; allowing the client to generate the temporary common key by using the server temporary public key and the client random number exponent; and allowing the server to generate the temporary common key by using the client temporary public key and the server random number exponent.

An apparatus for a vehicle includes interface circuitry and storage circuitry. The interface circuitry is configured to receive, from a device, a signal comprising information indicative of a digital key protocol to enable a key sharing flow between the apparatus and a device. The storage circuitry is configured to store the information.

The present disclosure provides a multi-device assistive identity verification method and system. The method includes: receiving an identity key allocation request and an identity key sharing request of a user; and allocating and storing an identity key, and sending the identity key to the user and a sharer. The method further includes: when a transaction request of the user is received, inviting the user and the sharer to assist in confirmation, and comparing tokens to perform identity verification.

A method includes encoding a data segment into a set of encoded data slices using erasure coding; storing, in storage units of a storage network, the set of encoded data slices, in accordance with a shared key-based encryption system (SKBES) having keys shared with the storage units; retrieving, at a periodic rate and in accordance with the SKBES, the set of encoded data slices from the storage units of the storage unit to verify whether individual slices of the set of encoded data slices have been corrupted. When one of the set of encoded data slices stored in one of the storage units has been corrupted, rebuilding the one of the set of encoded data slices by: retrieving the decode threshold number of other slices of the set of encoded data slices, in accordance with the SKBES; reconstructing the one of the set of encoded data slices based on the erasure encoding, to generate a reconstructed data slice; and storing, in accordance with the SKBES, the reconstructed data slice in the one of the storage units.

The invention relates to the technical field of near field communication, in particular to an NFC card encryption transaction process based on certificate exchange. The existing NFC card encryption transaction process has the problems of insufficient security, weak tamper-proof capability, limited applicability and the like. According to the invention, by introducing a dynamic key negotiation mechanism based on certificate exchange, the security, flexibility and communication efficiency of NFC card encryption transaction are improved. The technical scheme of the invention mainly comprises the following steps of: using a temporary key pair, generating a pair of new keys in each transaction, and avoiding a fixed key; verifying the identity through a public key certificate based on a secret key exchange mechanism of the certificate; the dynamic generation of the AES session key improves the communication efficiency through a key sharing protocol. Through the technical scheme, the security is remarkably improved, the key management is simplified, the communication efficiency is improved, the identity verification is enhanced, the application range is expanded, the implementation cost is reduced, and a comprehensive security guarantee is provided for the encrypted transaction of the NFC card.

The invention discloses a unified password service method and system supporting cross-level sharing. The method comprises the following steps: generating a root key in a hardware security module HSM cluster; generating a key encryption key KEK in the HSM cluster based on the root key; generating a data encryption key DEK based on the KEK; the API gateway receives an encryption request sent by the service application, and performs identity authentication and authority authentication; the cryptographic operation service instance calls a key management service (KMS); the KMS obtains the stored corresponding encrypted DEK and the associated KEKID from a distributed database according to the target key ID; decrypting the encrypted DEK by using the KEK corresponding to the KEKID through the HSM; the KMS encrypts the plaintext data by using the plaintext DEK to obtain ciphertext data; the superior tenant grants the access permission of the target key to the corresponding subordinate tenant through the key sharing interface, and a sharing relation is recorded in a key permission table; according to the invention, key plaintext storage and exposure risks are fundamentally eliminated.

Aspects presented herein provide an improved secret key sharing scheme based on positioning measurements in which network device pairs may extract SKs from channels associated with positioning and use the SKs to secure some unsecure channels and further improve the security of other channels such as PDSCH and PUSCH from the PHY security perspective. In an aspect, a UE performs one or more positioning measurements based on a set of signals from at least one network node, where the one or more positioning measurements are associated with at least one of a location of the UE or a location of the at least one network node. The UE selects a secret key for communication with the at least one network node based on the one or more positioning measurements. The UE communicates with the at least one network node based on the secret key.

An apparatus for a digital vehicle key sharing server includes interface circuitry and processing circuitry. The processing circuitry is configured to obtain, via the interface circuitry, a request for sharing a digital vehicle key for one or more vehicles to a second device from a first device. The processing circuitry is further configured to determine whether the second device specified by the request is a user device or a server. The processing circuitry is also configured to process the request for sharing the digital vehicle key based at least in part on whether the second device specified by the request is a user device or a server.

A communication system according to one aspect of the present disclosure is a communication system that includes a plurality of communication apparatuses, wherein each of the communication apparatuses includes an application program configured to perform encrypted communication with another communication apparatus; and a switching unit configured to switch a key sharing scheme for generating a shared key to be used for the encrypted communication, and the switching unit is configured to switch to another key sharing scheme when the shared key cannot be generated by the key sharing scheme being used at present.

A communication system according to one embodiment is a communication system including a plurality of communication apparatuses, in which each communication apparatus includes: an application program configured to perform encrypted communication with another communication apparatus; a protocol conversion unit configured to transmit a message representing a predetermined procedure when a key request for a shared key to be used in the encrypted communication is received from the application program; a state management unit configured to receive a message from the protocol conversion unit to manage an execution state of the procedure, and to transmit the message to a protocol driver supporting a predetermined key sharing protocol; and a protocol driver configured to request a key sharing system that executes the key sharing protocol, to generate the shared key, when the message is received from the state management unit.

This application provides a dynamic path generation method, relating to the field of information security, and applicable to the fintech field. The dynamic path generation method includes: responding to a connection request initiated by a client, negotiating and generating a shared key with the client; temporarily generating the shared key during each negotiation; performing a hash operation on the shared key to obtain a hash value; truncating a predetermined number of bits from the hash value as a dynamic path identifier; concatenating the dynamic path identifier and a resource base path to obtain a dynamic path; the dynamic path pointing to a specific resource stored on the server. This application also provides a dynamic path generation apparatus, device, and program product, as well as a resource access method and apparatus.

To provide a method for exchanging an encryption key when the number of a plurality of frequency channels changes, via which a connection was established.SOLUTION: When a communication device 102 and another communication device 103, which have already established a connection via a first frequency channel over a first link 104, establish a connection via a second frequency channel over a second link 105, a first key for encrypting unicast communication using the second frequency channel is generated through key sharing processing executed with the other communication device 103 via the first frequency channel, a second key for encrypting broadcast communication or multicast communication using the second frequency channel is shared with the other communication device 103 via the first frequency channel, and the first key generated with the first frequency channel and the second key are set as an encryption key for the second frequency channel.SELECTED DRAWING: Figure 1

To provide an authentication of a person capable of performing accurate measurement and declaration thereof in a quantum communication network of a quantum entanglement swapping node, etc., a method and a system for performing key sharing with the person by an unprecedented protocol.SOLUTION: In a system which performs a quantum communication, an authentication unit 17 controls a light separation section 21, and a first intra-node user 11 and a second intra-node user 13 respectively output a first photon signal and a second photon signal. A third intra-node user 15 detects the first photon signal and the second photon signal which pass the light separation section 21 and notifies the first intra-node user 11 and the second intra-node user 13 of a detection result. The authentication unit 17 notifies the first intra-node user 11 and the second intra-node user 13 of control information of the light separation section. The first intra-node user 11 and the second intra-node user 13 use the detection result and the control information to authenticate the third intra-node user 15.SELECTED DRAWING: Figure 1

The invention discloses a verifiable security federal learning method for an unreliable user. The method comprises three types of entities: an authority, a cloud server and a user. The method comprises the following five stages: (S100) a zero stage: an initialization stage; (S200) a first stage: a key sharing stage; (S300) a second stage: a mask input stage; (S400) a third stage: a mask elimination and aggregation stage; and (S500) a fourth stage: a verification stage. And in each stage, the number of online users is not less than a threshold value t, and otherwise, calculation is stopped. According to the method, the verifiability of a calculation result can be further guaranteed while the adverse effect of the gradient of an unreliable user on a global model is relieved and the data privacy of the user is protected.

The present disclosure provides methods systems and apparatuses for use in the secure agreement of group keys in which the group key(s) are shared between multiple end-point devices, said multiple-endpoint devices being used to create the group key(s) that is / are distributed in such a manner that no other untrusted part of the system has access to sufficient information to be able to derive or determine the group key(s) and / or portions of said group key(s). This is achieved by pairs of endpoint devices agreeing pairwise keys between themselves, wherein an intermediary device that distributes encryption keys to the endpoint devices over quantum communication channels does not have sufficient information to be able to derive the identity of the pairwise keys.