680 results about "Key storage" patented technology

The invention relates to the technical field of sensing data security, and discloses a sensing data chip-level dynamic key negotiation method, which comprises the following steps of: acquiring a unique hardware identifier and key parameters of a sensor node, and generating a dynamic key seed matrix; after acquisition is completed, randomly intercepting data segments, performing median filtering and normalization preprocessing, extracting local statistical features and global features to generate a data feature sequence, and splicing the data feature sequence to a seed matrix to obtain a dynamic key generation matrix; a dynamic negotiation key is generated through standardization and SM3 Hash algorithm encryption, and is stored in a cloud and node security unit; during verification, dual verification is realized through hash comparison and plaintext bit-by-bit matching; and setting an environment parameter exception triggering mechanism, and updating the key if accumulative exception exceeds the limit. According to the method, hardware and dynamic data features are fused, and the key security and adaptability are improved.

A method for data processing, a readable medium, and an electronic device are provided. The method for data processing includes: receiving a data processing task; determining target data corresponding to the data processing task and a target first key corresponding to the target data; decrypting the target first key according to the first session key via a target computing node to obtain the first key, and decrypting the target data based on the first key to obtain the data to be processed; and determining a data processing result according to a target model and the data to be processed. The target computing node is executed in a trusted execution environment. The target model is obtained by decrypting an encrypted target model based on a model key, the model key is stored in a key management service, and the key management service is executed in the trusted execution environment.

The invention discloses a multi-NDP (Near-Data Processing) system read-write acceleration method based on a key value separation technology, and the method comprises the steps: when data is written, splitting a data key value pair written into a batch processing region of a multi-NDP system, determining target equipment, then carrying out key processing and value processing, carrying out key storage on keys, and carrying out data storage on the target equipment; a value corresponding to the key is added to a value log file of the target equipment; during data query, hash operation is carried out on a query key, target device position information of a corresponding value is obtained, then the master-slave multi-level hot cache is queried, and query retrieval of the corresponding value is carried out according to the obtained value position index. According to the method, the key value separation technology is introduced into the multi-NDP system, when the Compaction is executed, the execution time of the Compaction is shortened, the influence of the Compaction on the writing operation of the user is reduced, and the writing performance is greatly improved.

Operations of a digital signature manager may include detecting, in a certificate repository on a first virtual cloud network, set of one or more new certificate authority (CA) certificates; transmitting, to a key management service hosted on a second virtual cloud network, a CA dataset that includes the set of one or more new CA certificates; receiving, from the key management service, a digital signature of the CA dataset generated based at least on a global private key stored on the second virtual cloud network in a private key repository associated with the key management service; and storing the digital signature in the certificate repository in a data structure that associates the digital signature with the CA dataset.

The invention provides a firmware encryption method and system based on a device unique identifier and dynamic key verification, and relates to the technical field of firmware protection, and the method comprises the steps: obtaining a unique identifier of a device, the unique identifier being hardware feature information which cannot be modified; a dynamic key is generated based on the unique identifier and the random number, and the dynamic key is realized through an encryption algorithm and is regenerated every time the device is started or firmware is updated; the dynamic key is stored in a storage area protected by hardware, and the storage area is subjected to double protection of hardware isolation and logic encryption; and when the device is started, the dynamic key is regenerated, the unique identifier of the dynamic key and the unique identifier of the dynamic key stored in the storage area are compared and verified, if the dynamic key and the unique identifier are consistent, firmware operation is allowed, and otherwise, a safety response mechanism is triggered. According to the invention, the security and reliability of firmware protection can be improved.

Methods, systems, and devices for data management are described. A datacenter may include one or more servers and an offline key storage system. The datacenter may receive, via a server and from a multi-party computation (MPC) coordinator, a first request to access a key share associated with an MPC node. The server may transmit a second request for the key share associated with the MPC node via a first cross domain communication path to an offline key storage system. The offline key storage system may verify a digital signature included with the second request. The offline key storage system may transmit a response including the key share that is encrypted using an encryption key associated with the MPC node to the server via a second cross domain communication path. The server may transmit a communication including the encrypted key share to the MPC coordinator.

The invention discloses a homomorphic encryption-based quantum security key management method and system, and belongs to the technical field of data processing, and the method comprises the following steps: obtaining and evaluating equipment encryption feature parameters and communication environment parameters, and obtaining a quantum encryption demand analysis result; generating a quantum security key and a dynamic storage index; obtaining a performance indication parameter of the quantum security key, performing evaluation to obtain a quantum security key transmission performance demand index, synchronously obtaining a transmission quality parameter of each quantum security key transmission channel, and performing analysis to obtain a key transmission channel corresponding to the quantum security key; based on the dynamic storage index and a key transmission channel corresponding to the quantum security key, the quantum security key is stored to a central processing unit, and a quantum security key hiding risk index is evaluated, so that whether quantum security key updating management needs to be carried out or not is judged; the problem that key generation and storage strategies cannot be dynamically adjusted according to specific encryption requirements in the prior art is solved.

The invention relates to the technical field of information security, in particular to a database tamper-proofing method and system based on a trusted computing environment, and the method comprises the steps: S1, receiving data transmitted into the database by adopting a security protocol communication TLS, carrying out the preliminary verification and cleaning of the data, generating a verification key through a trusted computing module TPM, and storing the verification key in a secure storage area of the trusted computing module; s2, loading the verified data into a feasible computing environment TEE to generate an encryption key, and storing the encryption key in an internal storage area of the feasible computing environment TEE; s3, performing integrity verification on the encrypted data in the feasible computing environment TEE; and S4, leaving the checked data from the feasible computing environment TEE through the security protocol communication TLS, and transmitting the checked data to a tamper-proof database for storage. The data processing and storage operation is executed in the trusted computing environment, the integrity and non-tampering property of the operation record are ensured by using the tampering-proof database, and the credibility and safety of the whole data processing and storage system are improved in a combined mode.

The invention provides a chip security key protection method and system capable of resisting side channel attack, and relates to the technical field of chips, which comprises the following steps of: obtaining a key operation request, performing address space mapping based on a dynamic mapping rule to obtain encrypted key data, decrypting the encrypted key data, fragmenting key intermediate data, and allocating an independent processing channel to perform decoupling operation; and injecting a time-varying noise signal to cover the association between the key and the physical characteristics, and finally performing recombination and reverse conversion to generate a final key output. According to the method, side channel attacks such as power consumption analysis and electromagnetic analysis are effectively resisted, and the security of key storage and operation processes is improved.

A quantum-resistant encryption system for securing cloud data storage, consisting of: a quantum-resistant encryption unit consisting of a high-performance processor configured to encrypt data and a storage unit for storing encryption keys; a data processing unit operationally connected to the quantum-resistant encryption unit, wherein the data processing unit is configured to encode, format and structure data prior to encryption and uses a data processing circuit designed to optimize data for quantum-resistant encryption methods; a key management unit configured to generate, store and distribute quantum-safe encryption keys, wherein the key management unit includes a dedicated hardware-based key generation module that uses lattice-based cryptographic principles to ensure the quantum resilience of the keys, a secure key storage module for storing encryption keys and a key distribution module for securely transferring the keys to authorized users; a secure transmission unit operationally connected to the quantum-resistant encryption unit and the key management unit, wherein the secure transmission unit includes a quantum-safe transmission processor configured to ensure that encrypted data is securely transferred from the user's device to the cloud storage, using secure communication protocols that are resistant to quantum-based attacks; and a cloud storage unit configured to store the encrypted data, wherein the cloud storage unit comprises multiple hardware storage partitions, each partition encrypted with different quantum-resistant keys to ensure that the data remains secure even if one partition is compromised, and includes hardware-level security mechanisms that monitor and restrict access to the encrypted data.

The invention discloses a unified identity authentication and access control method for a power multi-service system based on a national secret algorithm. According to the invention, through systematic deployment of SM2, SM3 and SM4 cryptographic algorithms, a full-link security protection system from identity authentication to authority management is constructed. The unified identity authentication platform adopts a mode of combining a distributed micro-service architecture and a hardware encryption machine, so that the physical security of key storage and operation is guaranteed, and the stability and response speed of the system are improved through a master-slave synchronization mechanism and interface delay control. A multi-source identity information federation acquisition mechanism realizes real-time integration of static attributes and dynamic behavior data, abnormal characteristics of user operation can be accurately captured by combining a risk assessment matrix of an improved LSTM-attention mechanism, and an SM2 bidirectional dynamic authentication protocol is automatically triggered when a risk score exceeds a dynamic threshold. Closed-loop protection of collection-evaluation-authentication-auditing is formed, and security threats such as identity counterfeiting and authority crossing are effectively resisted.

In certain embodiments, verification operations are performed. A first device packaged with a second device may store a first key shard and a second key. The first key shard may be a same key shard as a corresponding key shard stored on the second device, where the second key is different from a corresponding key stored on the second device. Additionally, the first key shard and the corresponding key shard are associated with a user. In connection with a request from a web service, the first device or a computing device may generate a response to the request using the second key by identifying the second key using an identifier of the request. Furthermore, the first device or the computing device may send the response to the web service, where the web service confirms registration of the first key shard based on the response.

The invention discloses a secure storage method and device for power grid privileged access credentials and a storage medium. The method comprises the following steps: acquiring a privileged access credential, a target access resource and a target privileged access object of a power grid; performing hierarchical encryption processing to obtain a target encryption key of the target privileged access object; based on the target encryption key, performing hierarchical decryption processing on an initial password corresponding to the privileged access credential, an initial password corresponding to the target access resource and an initial password corresponding to the target privileged access object to obtain a target decryption key of the target privileged access object; and storing the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key in a data security access system of the power grid. The technical problem of low storage security of the power grid privilege access credential is solved.

The invention relates to the technical field of cloud host data security, in particular to a cloud host data access security processing method and system. According to the technical scheme, the method comprises the following steps of: key generation based on dynamic encryption and identity fusion: collecting multi-factor identity data of a user, extracting features, constructing and training a dynamic key generation model by utilizing a generative adversarial network, generating an encryption key through the model based on the real-time multi-factor identity data of the user, and an encryption channel based on elliptic curve cryptography is adopted to split the secret key and then distribute the secret key to the cloud host and the user side equipment. According to the invention, through key generation of dynamic encryption and identity fusion, key storage and management based on the block chain and key use behavior monitoring and anomaly detection based on artificial intelligence, the data access security of the cloud host is comprehensively improved, the risks of data leakage, tampering and abuse are effectively prevented, and the security of the cloud host is improved. And reliable protection and rapid abnormal response to the whole data access process are realized.

The embodiment of the invention discloses a real-time warehouse management method and equipment based on digital twinning, relates to the technical field of Internet of Things, and is used for solving the problems of low efficiency and high cost of existing warehouse management. The method comprises the following steps: constructing a digital twin storage model according to building data and Internet of Things data corresponding to a current storage scene; clustering and grouping the current goods according to the arrival scanning information of the current goods and the historical storage information to obtain key storage information of the current goods in each group; querying the digital twin storage model according to the key storage information to obtain storage area information corresponding to each group of current goods; according to the warehousing starting point position corresponding to each group of current goods, the position information of each warehousing area and the key storage information, a logistics warehousing path of each group of current goods is planned, an initial logistics warehousing path is obtained, scheduling optimization is performed on the initial logistics warehousing path based on a data twin warehousing model, and the logistics warehousing path of each group of current goods is obtained. And warehousing and storing the current goods of each group.

Some embodiments provide a method for a first data compute node (DCN) operating in a public datacenter. The method receives an encryption rule from a centralized network controller. The method determines that the network encryption rule requires encryption of packets between second and third DCNs operating in the public datacenter. The method requests a first key from a secure key storage. Upon receipt of the first key, the method uses the first key and additional parameters to generate second and third keys. The method distributes the second key to the second DCN and the third key to the third DCN in the public datacenter.

The invention relates to the technical field of CPU card security chips, and discloses a low-power-consumption design method and system for a CPU card security chip, and the method comprises the steps: carrying out the current waveform sampling of a secret key storage region, an encryption operation unit and an identity authentication processor of the CPU card security chip, recording current data when the CPU card security chip executes data encryption, identity authentication and security calculation to obtain a feature parameter set of the security function module; establishing an encryption operation power consumption model and an identity authentication power consumption model, and obtaining power consumption characteristic matrixes under different key lengths through piecewise linear fitting; classifying the security application tasks to obtain a multi-level security task classification table; according to the multi-level security task classification table, a differential power consumption attack protection strategy is executed, the working voltage and frequency configuration sequence of each security function module is calculated, the optimal balance of power consumption and performance is achieved under different key lengths, and the comprehensive performance of the CPU card security chip is improved.

Embodiments described herein provide systems and methods for secure and efficient user authentication across a variety of computing devices, such as desktops, laptops, smartphones, and tablets across operating systems such as Windows, MacOS, IOS, Android, and iPadOS. The system incorporates an authenticator application configured to communicate with internal or external user identifier scanners, such as RFID / NFC readers, fingerprint scanners, facial recognition cameras, and QR / Barcode scanners, using transport protocols like USB, BLE, or NFC. The authenticator application serves as a third-party passkey provider by interfacing with platform WebAuthn APIs, enabling WebAuthn-based authentication for native applications, browsers, and services, or alternatively as a browser extension, intercepting WebAuthn API calls directly within a browser environment. An authentication server, accessible over a network, verifies user identities by mapping unique identifiers to stored authenticators and requesting additional authentication factors as needed, such as a security PIN. Upon successful authentication, the server transmits passkeys and a session token to the authenticator application, enabling it to handle further authentication requests locally. The system supports advanced session management for shared device environments, allowing configurable passkey storage with options for one-time, time-based, or shift-based expiration, automatically clearing passkeys upon session completion. This design delivers a versatile, secure, and seamless authentication experience across diverse user environments.

Disclosed systems and techniques involve low-latency multi-key encryption processing in which block keys are precomputed based on multiple cryptographic keys, stored, and then selected for encryption or decryption of data during run-time cryptographic operations. The block keys may be precomputed, for each cryptographic key, in such quantities that allow uninterrupted flow of encryption or decryption operations. Replacement block keys may be concurrently generated to replace the blocks being consumed and authentication values may be computed or updated. Various described techniques allow parallel processing for efficient low-latency block key generation and cryptographic operations.

The invention discloses an encryption and decryption method, system, device and equipment and a storage medium, and relates to the technical field of data security of a storage system.The encryption and decryption method comprises the steps that a system password is received through an RAID controller, a derived password is generated in combination with a pre-stored random number salt value and an encryption key, and the derived password is sent to the RAID controller; and converting the password into a readable password conforming to the password rule of the self-encryption disk, and encrypting and storing the readable password so as to control the locking or unlocking of the self-encryption disk. According to the method, the salt value and the encryption key are stored in advance, so that the exposure of a plaintext password is avoided, the problems of performance bottleneck and key storage security risk caused by centralized encryption of a traditional RAID controller are solved, meanwhile, the encryption characteristic of the self-encryption disk is utilized, automatic encryption during data storage and automatic locking after power failure are realized, and the security of data storage is improved. The technical effects of reducing the calculation load, improving the key security and guaranteeing the end-to-end encryption of the data storage are achieved, so that RAID redundancy and the security mechanism of the self-encryption disk are deeply combined, and the data protection capability of the whole system is enhanced.

An apparatus configured to receive, from a provisioning server, a request to create at least one sub-profile of at least one profile stored within an embedded universal integrated circuit card of the apparatus; wherein the request comprises encrypted subscription data comprising a symmetric key between a service provider and a user of the apparatus; store the symmetric key within the embedded universal integrated circuit card of the apparatus; and create the at least one sub-profile of the at least one profile stored within the embedded universal integrated circuit card of the apparatus; wherein the at least one sub-profile of the at least one profile stored within the embedded universal integrated circuit card of the apparatus is configured to be used to authenticate the user of the apparatus to the service provider with use of the symmetric key without involvement of a mobile network operator.

The invention is suitable for the field of communication technology improvement, and provides an encryption communication method and system used between EtherCAT slave station nodes, an OTP / nonvolatile storage, an encryption scrambling unit and a decryption descrambling unit are integrated in an EtherCAT slave station chip of a coupler and an I / O module, and encryption / decryption of an EtherCAT message is achieved on the hardware level; xOR operation or an AES algorithm is adopted for encryption, and a secret key is stored in an unmodifiable storage unit; and meanwhile, a parallel architecture of an encrypted network and a standard network is constructed, so that the standard interaction between the slave station node and the master station is not influenced by encrypted communication. The system solves the contradiction of poor real-time performance of a private protocol and easy plaintext communication plagiarism in the prior art, realizes the effects of no real-time performance loss, strong communication exclusiveness and flexible compatibility, and is suitable for an EtherCAT high-speed backplane bus system under industrial 4.0.

A system for controlling access to cryptographic resources is disclosed. The system may receive a request to transfer cryptographic resources between users, including a user identifier and a first cryptographic signature. The system may verify the signature and retrieve an encrypted private key from a key vault using the user identifier. A command to sign the request may be transmitted over a private network to a signature device, which may generate a second cryptographic signature using the decrypted private key. The system may receive the second signature, generate a blockchain operation based on the request and signature, and transmit the operation to a blockchain node for commitment. The system may also handle new account generation, storing encrypted keys in jurisdiction-specific databases, and validating blockchain operations against request parameters.

The present invention realizes a remote signature system in which identity verification is performed for each signing request by combining the remote signature system with public key cryptography. A terminal device (2) comprises a means for generating a key pair for authentication to perform the public key cryptography. A generated secret key is stored in the terminal device (2), and a generated public key is transmitted to the tamper resistant device (5) and is stored in relation with the corresponding signature key. The tamper resistant device comprises a signature key storage means (12) for storing the signature key, a decryption key and signature key identification information as pairs for each user. When requesting a digital signing, a signing request including the signature key identification information, plaintext verification information, and a crypto token including the encrypted verification information and the encrypted signature object data is created and is transmitted to the tamper resistant device (5). The tamper resistant device accesses to the signature key storage means (12) and searches both the decryption key and the signature key. The tamper resistant device decrypts the crypto token using the searched decryption key, and verifies consistency between the decrypted verification information and the plaintext verification information. If they do not match each other, the signing request is excluded from the digital signing.

A distributed re-encryption apparatus comprises: a distributed re-encryption key storage part that stores shares obtained by secret-sharing a re-encryption key that re-encrypts a ciphertext into one encrypted with a different encryption key without decrypting the ciphertext; and a distributed re-encryption part that re-encrypts using the shares of the re-encryption key the ciphertext into one encrypted with a different encryption key without decrypting the ciphertext.

A storage device includes: a non-volatile memory for storing a firmware set including a firmware image encrypted using a symmetric key and an encrypted symmetric key generated by encrypting the symmetric key using a public key; and a storage controller for controlling the non-volatile memory, wherein the storage controller includes: a physically unclonable function (PUF) chip having a unique security key; and a one-time programmable (OTP) memory for storing an encrypted secret key generated by encrypting a secret key paired with the public key using the PUF chip, wherein a firmware image is obtained by loading the firmware set, providing the encrypted secret key to the PUF chip, receiving the secret key from the PUF chip, generating the symmetric key by decrypting the encrypted symmetric key using the secret key, and decrypting the encrypted firmware image using the symmetric key.

The invention discloses a data encryption method applicable to open source gap terminal equipment, which comprises the following steps of: firstly, establishing communication connection based on a gap distributed soft bus technology, and generating a trust relationship through identity identification authentication; during data transmission, a national cryptographic algorithm, a symmetric or asymmetric encryption algorithm, a hybrid encryption algorithm and the like are dynamically selected according to data types, importance, transmission scenes and equipment performance. After being encrypted, the data are transmitted to the target device through the soft bus, and the target device decrypts and verifies the data. And the terminal equipment is integrated with the hardware security module to realize hardware encryption and key storage. Security module adaptation development is carried out based on an HDF library, and one-time development and multi-terminal operation are achieved. In the encryption process, a fragmentation encryption strategy can be adopted, multiple devices can perform collaborative encryption and decryption, and the encryption efficiency is improved by defining the task priority and sequence and utilizing a distributed task scheduling mechanism and reasonably allocating resources.

Some embodiments are directed to a communication system comprising a one or more clients, a server and a middlebox. The middlebox may access to the multiple short-term server private keys of the server. The middlebox may recover a shared key that is negotiated between server and client by decapsulating encapsulation data using a stored client public key and a server private key from the key storage.

The invention discloses a key management system and method, a medium and a product, an offline key generation part and a key storage part are deployed, the offline key generation part stores a first initial key, and the key storage part stores a second initial key paired with the first initial key. According to the method and the device, an offline key generation part is used for generating an encrypted key based on a first initial key in an offline mode, a key storage part is used for decrypting the encrypted key by using a second initial key, and the decrypted key is written into a preset secure storage area. Generation, distribution and storage of the secret key are realized, so that the system cost is effectively reduced.

The embodiment of the invention discloses a key generation method and device, equipment, a medium and a product, and the method comprises the steps: generating a random key through an encryption machine under the condition that the total number of keys currently stored in a database is different from a preset target value; encrypting the random key through an encryption algorithm, and storing the encrypted random key as a key in the database; and returning to the step of generating the random key by using the encryption machine under the condition that the total number of the keys currently stored in the database is different from the preset target value until the total number of the keys is the same as the preset target value. According to the technical scheme, the total number of the keys stored in the database is judged based on the preset target value, and the random keys are generated by using the encryption machine until the total number of the keys is the same as the preset target value under the condition that the total number of the keys is different from the preset target value, so that the condition that repeated keys exist in the keys is avoided, and the user experience is improved. And the security and the accuracy of the secret key are improved.