113 results about "Key sharing" patented technology

To share encrypted data more securely. After a pair of an identification token 131 and key disclosure permission information 134 transmitted from a first client terminal 102 is verified by a verification unit 106, a key registration unit 107 registers a record 122 including the key 133 and the key disclosure permission information 134 in a database 121 of a key sharing server 101 and transmits key identification information 135 for identifying the record to the first client terminal 102. The first client terminal 102 transmits data 139 including encrypted data 138 obtained by encrypting transmission data by using a cipher key 136 for data encryption after first processing output by a cipher key first processing unit 109, a cipher key 137 for data decryption after first processing output by the cipher key first processing unit 109, and the key identification information 135 obtained from the key registration unit 107, to a second client terminal 103. The second client terminal 103 makes an inquiry to a key disclosure unit 110 by using the key identification information 135 acquired from the received data 139 and an identification token 132 of the terminal itself. The key disclosure unit 110 acquires the pair of key 133 and key disclosure permission information 134 corresponding to the key identification information 135, from the database 121, and notifies, when the identification token 132 is included in a key disclosure permissible range indicated by the key disclosure permission information 134, the second client terminal of the key 133. The second client terminal 103 uses the notified key 133 to generate a cipher key 140 for data decryption after second processing on the basis of the cipher key 137 for data decryption after first processing acquired from the data 139 and uses the cipher key 140 for data decryption after second processing to execute decryption on the encrypted data 138 in the data 139.

The invention provides a digital asset decentralized management method and system, and the method comprises the steps: enabling legal members in a group to jointly participate in the generation of an initial authorization key according to a preset distributed key generation protocol, dividing the key into a plurality of fragments through a threshold key sharing scheme, and storing the fragments in different member nodes; after the consensus is reached, the member node reconstructs a complete authorization key according to the request content, signs the key by adopting an aggregation signature scheme, generates an authorization certificate, and returns the certificate to the request node; a key cache mechanism is introduced, a member node maintains a local cache and stores historical authorization keys in the latest period of time, when a new authorization request is processed, available keys are searched from the local cache, and the available keys are directly used if hit.

Backup and recovery of multi-party computation (MPC) security data utilized to secure digital assets and transactions thereof can enhance user confidence and user experience in digital asset transactions. Example MPC security data can include cryptographic keys and key shares utilized with a N×M MPC signature and validation framework. A computing device participating in generation of MPC secure data can retain a segment of the MPC secure data and can encrypt and store an encrypted segment at a second device. A recovery service or recovery application at the second device can facilitate recovery of the MPC secure data segment at the computing device, or at an additional device not involved in generation of the MPC secure data. The recovery service or application can facilitate recovery of the MPC secure data segment even in the event the computing device is lost.

The invention discloses a key sharing and security detection scheme based on an intelligent electric meter, and aims to solve the problems that an untrusted electric meter in an intelligent power grid is difficult to identify effectively, the detection scale is uncontrollable and the communication security is insufficient. According to the scheme, the elliptic curve cryptography, the threshold secret sharing mechanism and the physical unclonable function are combined, and hardware-level binding of the unique identity of the equipment and the secret key is achieved in the registration stage. Through a threshold password mechanism, a plurality of intelligent electric meters cooperatively participate in key reconstruction and encryption communication, and the intelligent electric meters can still work normally when part of the electric meters fail or are broken through. The center node can actively identify a fault or a malicious ammeter and dynamically adjust a communication strategy according to the integrity and correctness of the feedback information. Meanwhile, the scheme supports dynamic identity updating and integrity verification, and effectively resists modeling attacks, Sybil attacks, replay attacks and DoS / DDoS attacks. According to the invention, secure identity authentication, reliable key distribution and efficient anomaly detection are realized, and the security of smart grid terminal communication is improved.

Techniques and methods are described to generate a shared secret key using channel characteristics between a transmitting device and a receiving device. A public key is transmitted to a communication device over a first wireless channel and a second wireless channel that is different from the first wireless channel. From the communication device, a first signal and a second signal both carrying the public key are received over the first wireless channel and the second wireless channel, respectively. Based on the first signal and the public key, a first channel response is calculated and, based on the second signal and the public key, a second channel response is calculated. The secret key is determined based on the first and second channel response. In this way, the generation of a channel-based shared secret key becomes more secure and robust against eavesdropping of illegitimate users, allowing for secure communication.

The present application relates to the field of cloud computing, and discloses a key exchange method and apparatus. The method is applied to a first communication party, the first communication party holds a first fixed private key fragment, and a server having a cooperative relationship with the first communication party holds a second fixed private key fragment. The method comprises: receiving a first fixed public key and a first ephemeral public key sent by a second communication party; generating a first key fragment on the basis of the first fixed public key, the first ephemeral public key and the first fixed private key fragment; sending a key exchange parameter to the server, wherein the key exchange parameter is related to the first fixed public key and the first ephemeral public key; receiving a second key fragment sent by the server, wherein the second key fragment is generated on the basis of the key exchange parameter and the second fixed private key fragment; and generating a shared key on the basis of the first key fragment and the second key fragment, wherein the shared key is used for deriving a session key for communication between the first communication party and the second communication party. The present application is used for effectively protecting private keys, thereby improving safety.

Methods, systems, and devices for key management are described. A party having a key share of multiple key shares of a cryptographic key may encrypt a key share via a public threshold encryption key. The party may transmit, in accordance with a multi-party computation (MPC) operation, requests to multiple parties having private key shares of a private threshold decryption key corresponding to the public threshold encryption key. The party may receive multiple partial decryption results from a subset of the parties having the private key shares of the private threshold decryption key. The party may combine the partial decryption results to generate the key share and execute a portion of the MPC operation using the generated key share. Executing the portion of the MPC operation may cause a key share refresh operation for the key share of the cryptographic key.

The invention relates to an one-round password-based authentication and key sharing method with resilience to pre-computation attacks and with communication round efficiency, and the method includes: allowing a client to generate a first hash key, a second hash key, and a random number exponent that is a private salt by using a public parameter and a password and to register the PW-authentication value information including a commitment value generated by the first hash key, the second hash key, and the random number exponent in a server; allowing the client to generate the second hash key by using the password, to generate a client random number exponent, to generate a client temporary public key by using the second hash key and the client random number exponent, and to deliver the client temporary public key to the server; allowing the server to generate a server random number exponent, to generate a ciphertext of a server temporary public key by using the server random number exponent and the PW-authentication value information, and to deliver the ciphertext to the client; allowing the client to generate the first hash key by using the password, to decrypt the ciphertext, and to acquire the server temporary public key; allowing the client to generate the temporary common key by using the server temporary public key and the client random number exponent; and allowing the server to generate the temporary common key by using the client temporary public key and the server random number exponent.

An apparatus for a vehicle includes interface circuitry and storage circuitry. The interface circuitry is configured to receive, from a device, a signal comprising information indicative of a digital key protocol to enable a key sharing flow between the apparatus and a device. The storage circuitry is configured to store the information.

The present disclosure provides a multi-device assistive identity verification method and system. The method includes: receiving an identity key allocation request and an identity key sharing request of a user; and allocating and storing an identity key, and sending the identity key to the user and a sharer. The method further includes: when a transaction request of the user is received, inviting the user and the sharer to assist in confirmation, and comparing tokens to perform identity verification.

The invention relates to the technical field of near field communication, in particular to an NFC card encryption transaction process based on certificate exchange. The existing NFC card encryption transaction process has the problems of insufficient security, weak tamper-proof capability, limited applicability and the like. According to the invention, by introducing a dynamic key negotiation mechanism based on certificate exchange, the security, flexibility and communication efficiency of NFC card encryption transaction are improved. The technical scheme of the invention mainly comprises the following steps of: using a temporary key pair, generating a pair of new keys in each transaction, and avoiding a fixed key; verifying the identity through a public key certificate based on a secret key exchange mechanism of the certificate; the dynamic generation of the AES session key improves the communication efficiency through a key sharing protocol. Through the technical scheme, the security is remarkably improved, the key management is simplified, the communication efficiency is improved, the identity verification is enhanced, the application range is expanded, the implementation cost is reduced, and a comprehensive security guarantee is provided for the encrypted transaction of the NFC card.

The invention discloses a unified password service method and system supporting cross-level sharing. The method comprises the following steps: generating a root key in a hardware security module HSM cluster; generating a key encryption key KEK in the HSM cluster based on the root key; generating a data encryption key DEK based on the KEK; the API gateway receives an encryption request sent by the service application, and performs identity authentication and authority authentication; the cryptographic operation service instance calls a key management service (KMS); the KMS obtains the stored corresponding encrypted DEK and the associated KEKID from a distributed database according to the target key ID; decrypting the encrypted DEK by using the KEK corresponding to the KEKID through the HSM; the KMS encrypts the plaintext data by using the plaintext DEK to obtain ciphertext data; the superior tenant grants the access permission of the target key to the corresponding subordinate tenant through the key sharing interface, and a sharing relation is recorded in a key permission table; according to the invention, key plaintext storage and exposure risks are fundamentally eliminated.

An apparatus for a digital vehicle key sharing server includes interface circuitry and processing circuitry. The processing circuitry is configured to obtain, via the interface circuitry, a request for sharing a digital vehicle key for one or more vehicles to a second device from a first device. The processing circuitry is further configured to determine whether the second device specified by the request is a user device or a server. The processing circuitry is also configured to process the request for sharing the digital vehicle key based at least in part on whether the second device specified by the request is a user device or a server.

A communication system according to one aspect of the present disclosure is a communication system that includes a plurality of communication apparatuses, wherein each of the communication apparatuses includes an application program configured to perform encrypted communication with another communication apparatus; and a switching unit configured to switch a key sharing scheme for generating a shared key to be used for the encrypted communication, and the switching unit is configured to switch to another key sharing scheme when the shared key cannot be generated by the key sharing scheme being used at present.

A communication system according to one embodiment is a communication system including a plurality of communication apparatuses, in which each communication apparatus includes: an application program configured to perform encrypted communication with another communication apparatus; a protocol conversion unit configured to transmit a message representing a predetermined procedure when a key request for a shared key to be used in the encrypted communication is received from the application program; a state management unit configured to receive a message from the protocol conversion unit to manage an execution state of the procedure, and to transmit the message to a protocol driver supporting a predetermined key sharing protocol; and a protocol driver configured to request a key sharing system that executes the key sharing protocol, to generate the shared key, when the message is received from the state management unit.

This application provides a dynamic path generation method, relating to the field of information security, and applicable to the fintech field. The dynamic path generation method includes: responding to a connection request initiated by a client, negotiating and generating a shared key with the client; temporarily generating the shared key during each negotiation; performing a hash operation on the shared key to obtain a hash value; truncating a predetermined number of bits from the hash value as a dynamic path identifier; concatenating the dynamic path identifier and a resource base path to obtain a dynamic path; the dynamic path pointing to a specific resource stored on the server. This application also provides a dynamic path generation apparatus, device, and program product, as well as a resource access method and apparatus.

To provide a method for exchanging an encryption key when the number of a plurality of frequency channels changes, via which a connection was established.SOLUTION: When a communication device 102 and another communication device 103, which have already established a connection via a first frequency channel over a first link 104, establish a connection via a second frequency channel over a second link 105, a first key for encrypting unicast communication using the second frequency channel is generated through key sharing processing executed with the other communication device 103 via the first frequency channel, a second key for encrypting broadcast communication or multicast communication using the second frequency channel is shared with the other communication device 103 via the first frequency channel, and the first key generated with the first frequency channel and the second key are set as an encryption key for the second frequency channel.SELECTED DRAWING: Figure 1

To provide an authentication of a person capable of performing accurate measurement and declaration thereof in a quantum communication network of a quantum entanglement swapping node, etc., a method and a system for performing key sharing with the person by an unprecedented protocol.SOLUTION: In a system which performs a quantum communication, an authentication unit 17 controls a light separation section 21, and a first intra-node user 11 and a second intra-node user 13 respectively output a first photon signal and a second photon signal. A third intra-node user 15 detects the first photon signal and the second photon signal which pass the light separation section 21 and notifies the first intra-node user 11 and the second intra-node user 13 of a detection result. The authentication unit 17 notifies the first intra-node user 11 and the second intra-node user 13 of control information of the light separation section. The first intra-node user 11 and the second intra-node user 13 use the detection result and the control information to authenticate the third intra-node user 15.SELECTED DRAWING: Figure 1

The present disclosure provides methods systems and apparatuses for use in the secure agreement of group keys in which the group key(s) are shared between multiple end-point devices, said multiple-endpoint devices being used to create the group key(s) that is / are distributed in such a manner that no other untrusted part of the system has access to sufficient information to be able to derive or determine the group key(s) and / or portions of said group key(s). This is achieved by pairs of endpoint devices agreeing pairwise keys between themselves, wherein an intermediary device that distributes encryption keys to the endpoint devices over quantum communication channels does not have sufficient information to be able to derive the identity of the pairwise keys.

Provided are a digital key sharing method, a digital key authentication method, and a computing device. The digital key sharing method is executed by a first device and includes: sending to a second device a digital key creation request that includes valid space information for a digital key, so as to generate the digital key at the second device; receiving a digital key signature request from the second device, wherein the digital key signature request includes data to be signed of the digital key, and said data includes the valid space information; and on the basis that the signing of the digital key signature request is completed, sending a digital key import request to the second device, so as to indicate the second device to save the generated digital key. Therefore, the security of a digital key can be improved in a spatial dimension.

The present disclosure relates generally to data access control solutions. In particular, techniques are provided to implement a secure and distributed file storage scheme and in particular, a managed access system using a blockchain. In some aspects, a process of the disclosed technology includes operations for associating a first key share with a first copy of a file, wherein the first copy of the file is stored by a first party, associating a second key share with a second copy of the file, and recording versioning information corresponding with the file on a distributed ledger accessible by the first party and the second party. In some aspects, the process can further include operations for managing access to the file using the first key share and the second key share. Systems and machine-readable media are also provided.

The present invention discloses a data aggregation method for protecting privacy, including: 1. Parameter generation stage: the system generates public parameters and forwards them to all users through a cloud server; 2. Key generation stage: the user executes the Diffie-Hellman key generation algorithm to generate two pairs of keys, and forwards the public key pair to other users through the cloud server; 3. Key sharing stage: the user uses the threshold Shamir secret sharing algorithm to share his own private key, uses the AES symmetric encryption algorithm to encrypt the private key share, and forwards the ciphertext to other users through the cloud server; 4. Encrypted data stage: the user encrypts data using a double mask encryption technology, and sends the ciphertext and random number to the cloud server and the next user respectively; 5. Aggregation decryption stage: the cloud server decrypts the ciphertext to obtain the sum of the data of all online users. This method can not only reduce the resource overhead of the user end, but also support user disconnection.

The utility model relates to the technical field of conference sound pickups, in particular to an intelligent conference recorder which comprises a conference recorder outer shell. A dual-mode Bluetooth module board, a power supply, a cascade output interface, a cascade input interface, a cascade detection circuit, an IO (input / output) matching circuit, a recording key circuit and a DSP (digital signal processor) module board used for encoding audio signals are mounted in the conference recorder outer shell, and dual-mode Bluetooth and one-key local recording functions are added on the basis of a traditional conference recorder. Meanwhile, the system also supports ultra-long-distance recording, and can be matched with client application software in actual use to simplify related document processing work after a conference, such as conference content arrangement, conference content translation and conference content summarization, so that the workload of personnel can be saved, the conference efficiency can be improved, and the conference cost can be saved; in addition, one-key sharing of conference related content is supported, and the working efficiency is improved. The intelligent conference recorder is simple in structure, low in cost and easy to implement and popularize.

The present invention provides a linear key sharing method for five participants, comprising the following steps: Step 1: Based on the access structure, query the corresponding linear capacity domain; Step 2: Establish a corresponding integer programming model based on the polar direction vector of the linear capacity domain and the input subkey size vector, and determine the combination coefficients used in the final method based on the feasible solution of the integer programming; Step 3: Based on the optimal solution of the integer programming, combine the methods corresponding to the polar direction vectors, and the combined method becomes the final linear key sharing method. The method of the present invention is applicable to any access structure and any integer subkey size vector for the five participants, and can obtain a relatively optimal master key size.

A method for sharing a digital key (116) for a vehicle (102) includes the steps of: providing an assignment instruction (118) to a receiving device (110) to allow the start of key sharing; calling a function (120) for transmitting information related to security for a key sharing sequence; and sending the provided assignment instruction (118) using the called function (120).

To provide a system, method and apparatus for multi-factor authentication of a transaction received at a client device by using a personal identification number (PIN) in combination with a non-contact card.SOLUTION: The system includes a transaction device 222, a non-contact card 205, and an authentication server 223. The transaction device receives an input PIN from a user and transmits it to the non-contact card. The non-contact card performs PIN verification by comparing the received input PIN with a stored PIN. If the comparison result indicates a match, encryption logic generates an encryption code and transmits the encryption code to the transaction device. The transaction device transmits the received encryption code to the authentication server. Upon receiving the encryption code, the authentication server generates an expected encryption code using a counter, key, shared secret and the like associated with the non-contact card, and determines whether the generated encryption code matches a unique digital signature provided by the received encryption code. The authentication server then returns to the transaction device an authentication status indicating whether the transaction is approved or denied.SELECTED DRAWING: Figure 2B

The invention provides a digital key connection method and device, a vehicle and a storage medium, the method is applied to the technical field of digital keys, and in response to an operation triggered by a user for digital keys, the number of current digital keys is judged based on an operation result; a target digital key connection mode corresponding to the vehicle is determined according to the number of the digital keys, the target digital key connection mode is a single connection mode or a multi-connection mode, and different digital key connection modes correspond to broadcast modes of different key connection broadcasts; and judging whether the current digital key connection mode of the vehicle is the target digital key connection mode or not, and adjusting the vehicle into the target digital key connection mode when the current digital key connection mode and the target digital key connection mode are different, so that the vehicle is connected with the digital key according to the target digital key connection mode. Therefore, the digital key connection mode is dynamically regulated and controlled by accurately identifying the key connection demand, and unnecessary power consumption waste is avoided on the premise of guaranteeing the availability and flexibility of the key sharing function.

The application discloses a kind of high-performance blockchain consensus algorithm, the method includes: in current block period, based on preset clustering algorithm, all senior consensus nodes in the senior consensus group to be clustered are clustered to obtain m signature groups;Based on BLS aggregation signature, determine two deputy leader nodes in each signature group and the group signature block corresponding to each deputy leader node, that is, obtain 2m deputy leader nodes and 2m group signature blocks;Based on the coin protocol of verifiable key sharing, the leader node is elected from the deputy leader node and the block corresponding to each leader node, that is, obtain m leader nodes and m blocks;The credit value of each node in the blockchain network is obtained, and the new senior consensus group to be clustered is determined, steps 1 to 4 are continued to be executed, to realize blockchain consensus.The consensus algorithm of the application has high consensus efficiency, high scalability, high block efficiency, high chain quality and other performances.

The present invention relates to the field of information security, and specifically refers to an RSA multiple blind signature method and system based on identity authentication. The method includes RSA initialization, CA public key certificate registration, public key certificate exchange, public key acquisition and verification, information encryption, signature initiation and multiple signatures, signature reception and verification, information sending, and information reception. The present invention uses the RSA algorithm to encrypt information, and at the same time adopts the CA authentication and local public key sharing mechanism to realize the authentication of message signatures, preventing impersonation of signature initiation and impersonation of signatures; the present invention adopts a scatter-type signature and identity authentication mechanism to realize the traceability of incorrect signatures and prevent the overall signature from failing due to a single incorrect signature, which can effectively replace the aggregate signature, and the time complexity only changes from 1 to O(n); the system includes a key generation tool, a data encryption and decryption module, a data signature and verification module, a trusted certification authority CA, an information storage device, and a transaction processor.

A system for managing and using digital financial assets, such as cryptocurrency uses multiple independent devices that mutually cooperate to control cryptocurrency assets in a secure manner. Each of these devices may store a unique private key associated with the cryptocurrency assets, which may be configured such that a certain minimum number of these private keys are required to transfer the cryptocurrency assets. The use of multiple private keys spread across multiple distinct devices may reduce the likelihood of loss stemming from a hardware failure or reduce the likelihood of an attacker successfully gaining access to the cryptocurrency assets. In addition, selection of the devices to be used for storing these private keys, as well as how many private keys are required to authorize a transaction, may be tailored to balance a user's preferences for reliability of access versus security and for third-party custody versus self-custody.