38 results about "Keystore" patented technology

A system for controlling access to cryptographic resources is disclosed. The system may receive a request to transfer cryptographic resources between users, including a user identifier and a first cryptographic signature. The system may verify the signature and retrieve an encrypted private key from a key vault using the user identifier. A command to sign the request may be transmitted over a private network to a signature device, which may generate a second cryptographic signature using the decrypted private key. The system may receive the second signature, generate a blockchain operation based on the request and signature, and transmit the operation to a blockchain node for commitment. The system may also handle new account generation, storing encrypted keys in jurisdiction-specific databases, and validating blockchain operations against request parameters.

A system for controlling access to cryptographic resources is disclosed. The system may receive a request to transfer cryptographic resources between users, including a user identifier and a first cryptographic signature. The system may verify the signature and retrieve an encrypted private key from a key vault using the user identifier. A command to sign the request may be transmitted over a private network to a signature device, which may generate a second cryptographic signature using the decrypted private key. The system may receive the second signature, generate a blockchain operation based on the request and signature, and transmit the operation to a blockchain node for commitment. The system may also handle new account generation, storing encrypted keys in jurisdiction-specific databases, and validating blockchain operations against request parameters.

The application relates to the technical field of network communication, and discloses a communication channel dynamic encryption method and device, which comprises the following steps: collecting communication scene related information and security state related information to obtain an evaluation result; selecting a corresponding encryption scheme based on the evaluation result to establish an encryption link; transmitting an updated key library by using the encryption link to complete seamless updating of the key library; and binding the encryption scheme and session information and optimizing session parameters based on the encryption link and the updated key library to obtain encrypted transmission of communication data. The communication channel dynamic encryption method and device are characterized in that, through three-dimensional evaluation of data sensitivity, network security level and historical interaction security record and dynamic adaptation of the encryption scheme, high-sensitivity data, dangerous network environment and other scenes can be subjected to high-intensity encryption with high pertinence, low-sensitivity data and safe network environment can be subjected to moderate encryption strength, transmission efficiency caused by excessive encryption is avoided, and security risks caused by insufficient encryption strength are reduced.

The invention provides a resource transfer information processing method and a related device. The method is performed by a first processing node. The method comprises the following steps: identifying a receiver of resource transfer information as a second processing node, and generating receiver information according to the second processing node; obtaining a target multi-party symmetric key from a first multi-party symmetric key library of the first processing node; generating a target multi-party symmetric key identifier for the target multi-party symmetric key; encrypting the resource transfer information by using the target multi-party symmetric key to obtain encrypted resource transfer information; and binding and recording the encrypted resource transfer information, the receiver information and the target multi-party symmetric key identifier to the block chain. According to the resource transfer method and device, the resources can be effectively transferred under the conditions that normal operation of the block chain is not influenced and details of the data are not exposed, and privacy and security in the resource transfer process are improved under the condition that continuous detection of a third party is not influenced.

Encryption system with an application-specific integrated circuit (ASIC) which has a permanent memory for the non-volatile storage of the operating system (OS) of a processor and software modules for encrypting the data memory of the processor and which has a hardware-implemented encryption algorithm, characterized in that a security module (SM) is integrated in the ASIC for autonomous booting of the operating system (OS), consisting of: - a symmetric cryptosystem (SK) for processing symmetric keys, - an asymmetric cryptosystem (AK) for the use of public and private keys, - a module for generating cryptographic hash functions (KH), - a module for the secure exchange of keys using hardware-implemented key exchange protocols (SP), - a key storage (SS) for the secure storage of root keys (WS), which are protected by appropriate measures in the physical structures of the ASIC and - a key management system (SMS) for the secure introduction of authenticated-encrypted key packets, and that the security module (SM) communicates with a central processing unit (CPU) via a communication interface (CS1), and that the central processing unit (CPU) communicates with at least one internal storage (IS) and one external storage (ES), as well as with at least one internal persistent storage (IP) and one external persistent storage (EP), such that the operating system (OS) is loaded by a second-stage bootloader (SSB) stored in the external persistent storage (EP), and then the operating system (OS) loads the applications, the second-stage bootloader (SSB) itself being decrypted and loaded by a first-stage bootloader (FSB) stored in the internal persistent storage (IP), and a public key (PUBOS) to verify the operating system (OS).and a symmetric key (KOS) to decrypt the operating system (OS), and that the contents of the internal memory (IS) and the external memory (ES) are decrypted by the security module (SM) during read accesses by the central management unit (CMU) or other modules integrated on the ASIC, and re-encrypted during write accesses by the same.

The disclosed technology teaches a method for managing user access to one of a set of decentralized networked nodes that share a private permissioned blockchain data structure or a decentralized personal ledger, to which access has been limited to users authorized by one of the set of decentralized networked nodes.

A method and system for providing containerized applications with updated secret values has been developed. An update to a secret from a first secret value to a second secret value is detected at a secrets vault. A configuration map associated with the secret is identified. The configuration map includes a first non-secret that is associated with the first secret value. A second non-secret that is associated with the second secret value is generated. The first non-secret is replaced with the second non-secret in the configuration map. The replacement of the first non-secret with the second non-secret in the configuration map results is an event. A reloader issues a restart signal to a containerized application associated with the secret in response to the event. The secret at the containerized application is updated from the first secret value to the second secret value during a restart process.

This invention relates to the field of digital identity authentication technology and discloses a digital identity encryption authentication method. The method includes the following steps: acquiring a user identity information feature dataset and generating a master key library through multi-dimensional encryption preprocessing; extracting fragmented verification features from each master key library to determine authentication rules; constructing a multi-level authentication chain and verification nodes, and obtaining the node authentication status through bidirectional verification. In a valid authentication state, the master key library is associated with authentication according to permission levels; in an invalid authentication state, abnormal verification nodes are identified, the authentication offset of their respective master key libraries is calculated, and the abnormal verification node paths are reconstructed based on this until authentication is completed. The master key library generation involves multiple types of data encryption, obfuscation, and format standardization; fragmented verification feature extraction includes key fragment sorting; authentication rule determination is based on dynamic feature priority; and anomaly handling combines historical tracing and offset calculation. This method improves authentication security and dynamic adaptability.

Providing secure secrets for encryption consistency enables rotating security measures (e.g., encryption access keys in users' certificate) for encrypted data at rest, without either needing to retain any prior certificates or requiring decryption and re-encryption. This provides enhanced security over some prior art methods (old keys may be discarded) and enhanced speed over the other prior art methods (no decryption / re-encryption needed). Examples generate a primary encryption key, which is retained on a secure remote computing node, such as in a key vault, and is not shared outside the key vault. Access to the primary encryption key is restricted to users who possess the current encryption access key, which is rotated on some trigger event. The remote node receives incoming messages to encrypt or decrypt files and performs the encryption / decryption using the primary - but only if a message contains the current encryption access key. Rotating the encryption access key preserves security.

The invention discloses a supply chain integrated collaborative management system based on a cloud platform, which belongs to the technical field of supply chain management, and comprises a supply application platform processor, a multi-tenant key library management service, a digital twinning collaborative optimization module, a federal learning decision engine, an intelligent contract execution layer and an application interface layer, the problems of data splitting, low cooperation efficiency, low demand prediction precision and rigid logistics planning in the prior art are solved, and a distributed data warehouse, multi-dimensional supplier matching, a hierarchical demand prediction model and a block chain traceability technology are integrated. Breakthrough is realized through three major innovation mechanisms: firstly, a cross-subject real-time collaborative environment is constructed by adopting a digital twinning technology, and the problem of poor collaboration of links of a traditional supply chain is solved; secondly, data fusion is carried out by using federal learning, and the data value mining capability is improved on the premise of protecting data privacy; and thirdly, an intelligent contract is introduced to realize automatic disposal of abnormal events, and timeliness and toughness of supply chain risk response are enhanced.

Systems and techniques are provided for generating cryptographic keys. For instance, a process may include generating a plurality of master keys based on a plurality of generated random numbers, a second number, and a nonce number; storing a master key, of the plurality of master keys, along with a generated random number of the plurality of generated random numbers, the second number, and the nonce number used to generate the master key in a one-time programmable memory; generating public key-private key pairs for the plurality of master keys; transmitting public keys of the plurality of public key-private key pairs for audit; destroying an audited master key, along with the generated random number, second number, and the nonce number used to generate the audited master key, based on the audit; and storing a non-audited public key-private key pair corresponding to the master key that were not destroyed based on the audit.

The invention relates to the technical field of secure network communication, and discloses an industrial encryption communication method and system fusing a national cryptographic algorithm and a dynamic key mechanism, and the method comprises the steps: a transmitting end obtains a network layer data packet, analyzes a specific field of an IP head of the network layer data packet, and obtains a current timestamp; based on the specific field and the timestamp, a dynamic key sequence number is calculated through a preset key sequence number generation algorithm; extracting a corresponding encryption key and an initialization vector from a pre-stored key library which is the same as the receiving end according to the serial number; and encrypting the data load by using the CTR working mode of the SM4 algorithm, adding a timestamp to the head of the encrypted load, and sending the encrypted load. And the receiving end extracts the timestamp to perform timeliness verification, and calculates the same key sequence number based on the same field and the timestamp to complete decryption. The method realizes a one-time pad dynamic key mechanism, has the advantages of high encryption strength, good compatibility and the like, and is particularly suitable for an industrial control communication environment with high requirements on real-time performance and reliability.

The invention discloses a key library generation method and device, equipment and a storage medium. In the scheme, a mode of presetting a key library and statically configuring is not adopted, the key library is automatically created through the initial strategy file and the attribute value of each attribute variable, and the triple information of each key in the key library is automatically generated; a corresponding secret key can be directly obtained and processed based on the triple information; if an encryption algorithm or a hardware cipher machine needs to be replaced, a new key library and a configuration file do not need to be manually regenerated, only the attribute value of the attribute variable needs to be changed, the new key library and the triple information can be automatically created, the key library management mode greatly simplifies the generation process of the key library, the downtime is reduced, and the key library management efficiency is improved. And the error probability is reduced, so that efficient and safe management of the key library is realized.

Key vault access security migration is provided, including a computing device receiving key vault information. The key vault information is received from at least one entity operating a user computing device via an initialized release pipeline. Further, at least some of the key vault information is processed to determine a first access security model, including permissions to a cryptographic object for access to a respective technical resource. Data discovery determines cryptographic object permission and the computing device determines a role assignment that includes a security principal, at least one of a plurality of permissions, and the respective technical resource. Further, the computing device migrates access to the key vault for the entity from the first access security model to the second access security model. Access to the key is enabled as a function of the second access security model.

The invention discloses an equipment security authentication method and system. The device security authentication method is applied to a first terminal, and the method comprises the following steps: in response to a login request, calling a first quantum key device of the first terminal to generate first verification information, and sending the first verification information to a quantum cryptography service platform; login is completed according to the encrypted target key library, and the first terminal and the second terminal are both bound with the encrypted target key library. Thus, the dual-quantum key device of the first terminal and the dual-quantum key device of the second terminal cooperatively participate in identity authentication, and the validity verification of the quantum cryptography service platform is combined, so that a dual-hardware security guarantee is constructed, and the problem that a single identity authentication mode is easy to steal or pretend is effectively solved; the identity authentication security of new equipment login is improved to a certain extent, and the requirement that multiple pieces of equipment of a user safely use the same application is met.

This invention discloses a fingerprint module factory testing method, device, and computer-readable storage medium. The method includes: creating an initial password verification factor for the device in the fingerprint module's factory testing mode; setting the device's password to a preset keystore based on the initial password verification factor; when the device's password is successfully set, recording a test value of 1 through a corresponding system attribute; verifying the initial password verification factor and the keystore to obtain verification response body parameters; if the verification response body parameters are not empty, obtaining the verification token of the verification response body, and using the verification token to enable fingerprint verification of the device. This provides an efficient fingerprint module factory testing scheme, greatly simplifying the testing steps for fingerprint modules in smart devices, reducing labor and time costs, and improving productivity.

A user and business collaboration and document management solution is described. The solution utilizes the InterPlanetary File System (IPFS) or similar distributed and decentralized storage methods, in addition to the Publish / Subscribe (PubSub) message protocol or similar distributed messaging methods. As a fully decentralized and distributed solution, information is shared through cryptographically secure and resilient Web 3.0 mechanisms. The solution provides a number of secure collaboration services. Users can securely add, update, delete, archive and share documents on the IPFS file system. Local directory synchronization automates this task. A localized encryption key and secrets vault is used to protect data encryption keys, authentication credentials, and related secrets.

There are provided systems and methods for a secure data erasure framework using individualized encryption key management. A service provider, including an electronic transaction processor, may provide data management and secure erasure through individualized encryption keys that may be managed and deleted to render encrypted data unreadable. When a device interacts with a service provider and provides or generates user data, the user data may be stored in accordance with an encryption process that encrypts the data using an encryption key for a corresponding account. Thereafter, the encryption key may be stored by a key store and not replicated elsewhere. When data is needed, the key store may be used by a trusted decryption platform and not shared. As such, when data is required to be erased or deleted, the data may be removed from availability with the service provider by implementing a secure key deletion process.

A system and method for storing keys, secrets, and passwords securely in an off-chip keystore are provided. An off-chip keystore stores a plurality of ciphertext keys that include encrypted keys, secrets, and passwords. A programmable logic device, such as a system on a chip, is coupled to the off-chip keystore. The programable logic device enrolls a physical unclonable function (PUF) within the programmable logic device. The PUF generates a keystore encryption key (KEK) that a secure processor, such as a cryptographic engine, uses to encrypt a plaintext key into a ciphertext key, and decrypt the ciphertext key into the plaintext key. The ciphertext key is stored in the off-chip keystore. When the programmable logic device is powered down, the KEK is not stored within the programmable logic device, but is regenerated to decrypt cyphertext keys and encrypt plaintext keys once the programmable logic device is powered up.

The disclosed technology teaches a method for delegating user access to one of a set of decentralized networked nodes that share a private permissioned blockchain data structure or a decentralized personal ledger. The method also includes a credentialing logic configured to receive from one of a set of decentralized networked nodes, authority to access a network node to invoke services that conduct operations using a private permissioned blockchain data structure or decentralized personal ledger to which access has been limited to users authorized by one of the set of decentralized networked nodes; and an access delegation logic configured to create a delegation of at least some of the authority to access the network node for a limited duration of time and to send the delegation to a recipient identified to receive delegated authority.

Providing secure secrets for encryption consistency enables rotating security measures (e.g., encryption access keys in users' certificate) for encrypted data at rest, without either needing to retain any prior certificates or requiring decryption and re-encryption. This provides enhanced security and enhanced speed since no decryption / re- encryption is needed. Examples generate a primary encryption key, which is retained on a secure remote computing node, such as in a key vault, and is not shared outside the key vault. Access to the primary encryption key is restricted to users who possess the current encryption access key, which is rotated on some trigger event. The remote node receives incoming messages to encrypt or decrypt files and performs the encryption / decryption using the primary encryption key - but only if a message contains the current encryption access key. Rotating the encryption access key preserves security.

A method includes partitioning a set of historical device keys into a set of clusters, embedding the set of clusters to generate a set of device lockers, and receiving a request including an application identifier and metadata. The application identifier corresponds to an application installed on the second computing system and the metadata corresponds to the second computing system. The method also includes combining the application identifier and the metadata to generate a device key, determining that the set of device lockers includes a device locker that matches the device key, and, in response to determining that the set of device lockers includes the device locker that matches the device key, adding the device key to a cluster of the set of clusters corresponding to the device locker.

This invention discloses a data transmission integrity verification system and method based on a polynomial ring, relating to the field of data security technology. It includes two entities, User A and User B. User A sends data, and User B receives data. Both User A and User B include a symmetric key store, an integrity verification module, and a data transmission module. The data transmission module receives binary stream data and converts it into elements of a polynomial ring. Simultaneously, it converts the verified data back into a binary stream and sends it. The integrity verification module sequentially selects keys from the symmetric key store and performs data integrity verification using polynomial modulo operations. This invention differs from conventional cryptography, which is designed based on mathematical problems and is vulnerable to cryptanalysis based on artificial intelligence and quantum computing. It relies solely on mathematical principles to design the integrity verification mechanism, using the random selection of the basis of a polynomial ring for data integrity verification to resist various cryptographic attacks based on artificial intelligence and quantum computing.

The invention relates to the technical field of data management, in particular to a key management method and device, a terminal and a storage medium, and the method comprises the steps: generating a compressed package key library, and adding the compressed package key library into a pre-constructed key library list; determining a target compressed packet key library in the key library list, and performing identity authentication; generating a key file with key content in a key library of the target compressed package; and determining a target key file in the key file list, and encrypting the to-be-encrypted object based on the key content of the target key file. According to the method, the key file is generated in the compressed package key library, and the generated key file forms the list, so that unified management is realized, when the to-be-encrypted object is encrypted, the target key file is acquired from the compressed package key library, the encryption mode is simple, the compressed package key library can be opened only through identity authentication, and the encryption efficiency is improved. Therefore, encryption is facilitated, and the secret key is safely managed at the same time.

The invention discloses a secure transmission method and system for intelligent network connection vehicle data and electronic equipment, and relates to the field of vehicle data transmission, and the method comprises the steps: carrying out the real-time recognition and classification of collected multi-modal data, and distinguishing sensitive and non-sensitive data; sensitive data is subjected to special feature extraction and encryption to generate encrypted feature data, and non-sensitive data is subjected to standardization preprocessing to generate structured feature data; and adding security verification information and a full-life-cycle identifier to the processed data, and carrying out shunting processing according to the identifier. The encrypted feature data adopts an encrypted storage scheme matched with a vehicle-mounted key strategy, a cloud key library is synchronously updated, and storage and access states are monitored; structured feature data adopts an efficient storage scheme, a retention period is configured according to an identifier, and an access control and integrity verification mechanism based on a full-life-cycle identifier is established. According to the scheme, through classification processing and differential storage of the collected data, an access control and integrity verification mechanism is established in combination with the full-life-cycle identifier, and data security management is realized.

The present application relates to the technical field of data management, and particularly relates to a key management method and device, a terminal and a storage medium, the method comprising: generating a compressed package key library, adding the compressed package key library into a pre-constructed key library list; determining a target compressed package key library in the key library list, and performing identity authentication; generating a key file with key content in the target compressed package key library; determining a target key file in a key file list, and encrypting an object to be encrypted based on the key content of the target key file.The present application generates a key file in the compressed package key library, forms a list of the generated key files, realizes unified management, obtains a target key file from the compressed package key library when encrypting the object to be encrypted, and the encryption mode is simple; and only by identity authentication can the compressed package key library be opened, so that the key is safely managed while encryption is facilitated.

Methods and systems for validating key rotation requests for endpoint devices are disclosed. The key rotation requests may be signed by one or more signing systems according to a set of re-keying rules for the endpoint device. The set of the re-keying rules may indicate that key rotation requests may be valid if signed using at least two different keys. The set of the re-keying rules may also indicate that each of the at least the two different keys be from a different grouping of keys of multiple groupings of keys included in a secure key repository. Each grouping of keys may be associated with a different organization. Therefore, key rotation requests may be serviced if signatures associated with the key rotation requests meet the re-keying rules thereby decreasing a likelihood of compromise of the endpoint devices via compromise of a key.

The invention discloses an SSL VPN wireless communication encryption method and system based on a quantum key, and belongs to the technical field of quantum key distribution, and the method comprises the following steps: analyzing the balance degree of key resources and judging the state of the resources, thereby formulating a global key exchange interval strategy, achieving the distribution and prefetching of a key quota, and achieving the encryption of the key quota. According to the SSL VPN wireless communication encryption method based on the quantum key, a key time sequence risk index is analyzed to determine a key overlapping window adjustment strategy, the SSL VPN session distribution interface error rate and the key inventory level are monitored, whether rollback needs to be executed or not is judged, and a corresponding rollback strategy is formulated, the resource state is accurately judged, meanwhile, the SSL VPN session priority is divided, and the SSL VPN wireless communication encryption efficiency is improved. The multi-link linkage of the system effectively reduces the secret key supply interruption and encryption failure probability, enables the system to achieve self-adaptive adjustment in complex scenes such as supply and demand fluctuation and network abnormity, remarkably improves the anti-risk level, and guarantees the stability and reliability of quantum encryption communication.

The invention provides a mobile phone number management method and device, equipment and a storage medium, and the method is used for carrying out encryption storage on a mobile phone number, and comprises the steps: obtaining an encryption key of a current to-be-encrypted mobile phone number from a key library, encrypting the mobile phone number through the encryption key, and generating mobile phone number ciphertext data; and constructing an index for the mobile phone number ciphertext data, and synchronously storing the mobile phone number ciphertext data and the index. Compared with the traditional problem that the encrypted mobile phone number ciphertext cannot be directly subjected to fuzzy matching, the technical scheme of the invention realizes the index construction of the mobile phone number ciphertext, further realizes the efficient fuzzy matching of the mobile phone number ciphertext under the condition of not exposing the original mobile phone number, and improves the availability of the system.

The present application relates to the technical field of key transmission, and relates to a key transmission method, comprising: selecting a quantum initial state key pair and a quantum private key pair in a key library, and sending the quantum initial state key pair and the quantum private key pair to all participants; and sending a quantum initial state of the quantum key pair to participant C1 after encryption to form a first quantum transmission key; participant C1 performs decryption and measurement processing on the first quantum transmission key to obtain the quantum initial state key pair, performs unitary operation and encryption to obtain a second quantum transmission key, and sends the second quantum transmission key to participant C2; all participants are traversed, participant C1 receives a final quantum transmission key, and performs decryption and measurement processing on the final quantum transmission key to obtain a quantum final state key pair and a quantum key pair; and participant C1 compares a final hash value with an initial hash value to determine whether there is participant information forgery.