115 results about "Keystore" patented technology

The invention discloses a method and a device for realizing key import and key use. When a secret key import interface of the SDK is called by an upper-layer application, a certificate chain generated by the secret key library is sent to the push service, and a first encryption result, a first random number, a second encryption result and label data returned by the push service are sent to the secret key library for verification; if the verification is passed, the master key identifier and a master key obtained by decrypting the second encryption result through the key library are correspondingly stored in the key library; when a key encryption interface of the SDK is called by an upper-layer application, encrypting data to be processed by using a first working key returned by a key library to obtain a first data ciphertext to be processed, and sending the first data ciphertext to be processed, preset data and a second random number to a push service; receiving a processing result ciphertext and a third random number returned by the push service; and decrypting the processing result ciphertext by using a fourth working key returned by the key library, and performing subsequent operation according to a processing result obtained by successful decryption.

A system for controlling access to cryptographic resources is disclosed. The system may receive a request to transfer cryptographic resources between users, including a user identifier and a first cryptographic signature. The system may verify the signature and retrieve an encrypted private key from a key vault using the user identifier. A command to sign the request may be transmitted over a private network to a signature device, which may generate a second cryptographic signature using the decrypted private key. The system may receive the second signature, generate a blockchain operation based on the request and signature, and transmit the operation to a blockchain node for commitment. The system may also handle new account generation, storing encrypted keys in jurisdiction-specific databases, and validating blockchain operations against request parameters.

The application discloses a method and device for realizing high-speed operation of an algorithm based on a multi-level field cache, which comprises the following steps: a configuration management CPU sends algorithm parameters to an FPGA chip and saves the algorithm parameters in a RAM; a service processing CPU creates a handle and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle; the configuration management CPU sends a key library to the FPGA chip; the service processing CPU sends a to-be-operated message to the FPGA chip; an algorithm scheduling module performs fragmentation judgment, and performs subsequent processing according to a sequence judgment result; a password operation module takes the received key, an initialization vector or an intermediate chain variable and the to-be-operated message as input, performs password operation, and outputs a calculation result and an operated intermediate chain variable; whether the to-be-operated message is the last data fragment is judged according to a tail fragment identifier, and subsequent processing is performed according to a tail fragment judgment result. The application can reduce the communication interface and CPU access times, realize high-speed operation of a password algorithm, and improve the overall performance of a password service system.

The invention discloses an internet-of-things communication encryption system for CPU card management, and relates to the technical field of internet-of-things encryption, the internet-of-things communication encryption system comprises an initialization module, a card issuing module, a card reading module and a platform end, a distributed key library is constructed, and according to an authority control mechanism of an alliance chain of the distributed key library, the card issuing module and the card reading module are encrypted. The platform secret key, the manufacturer secret key, the tenant secret key and the project secret key are stored in an isolated mode and are only authorized to be used by the corresponding platform, the manufacturer, the tenant and the project, and under the condition that permission of the opposite side is not obtained, the secret keys cannot be called in an unauthorized mode. The design of segmented keys is adopted, so that a platform, a manufacturer, a tenant and a project respectively hold independent key segments, the problem caused by leakage of a single key is reduced to the minimum, even if an attacker gets one key, the attacker cannot read data of a CPU card, and the data of the CPU card cannot be read by the attacker. Even if an attacker cracks the platform key, the attacker cannot communicate with the initialization device, the card issuing device and the card reading device.

The disclosed technology teaches a method for managing user access to one of a set of decentralized networked nodes that share a private permissioned blockchain data structure or a decentralized personal ledger, to which access has been limited to users authorized by one of the set of decentralized networked nodes.

A safety control method for preventing illegal modification of a motorcycle is characterized by comprising the following steps: 1, constructing a motorcycle modification prevention control management system; 2, binding of the whole vehicle is completed, and the diagnostic tool generates a key set and sends the key set to a corresponding key library; 3, before the motorcycle is powered on, the encryption module obtains motor equipment information of the motor controller and carries out encoding encryption; 4, the battery encryption module decrypts the encrypted data of the motor; 5, the battery encryption module carries out decoding and legality authentication on the decryption data of the motor controller; 6, the battery encryption module obtains the battery equipment information of the battery system and carries out coding encryption; 7, the encryption module decrypts the battery encryption data; 8, the encryption module carries out decoding and legality authentication on the battery decryption data; 9, the motor controller and the battery system are successfully matched, and the motorcycle is normally powered on to work. The method has the advantages that unauthorized equipment can be prevented from getting on the vehicle for use and a user can be prevented from illegally refitting the vehicle, and equipment safety of the user is protected.

The invention relates to the technical field of digital identity authentication, and discloses a digital identity encryption authentication method, which comprises the following steps of: acquiring a user identity information feature data set, and generating a master key library through multi-dimensional encryption preprocessing; extracting fragment verification features of each master key library to determine an authentication rule; and constructing a multi-level authentication chain and a verification node, and obtaining a node authentication state through bidirectional verification. In an effective authentication state, the master key library is subjected to association authentication according to permission levels; and in the invalid authentication state, identifying the abnormal verification node, calculating the authentication offset of the master key library under the abnormal verification node, and reconstructing the path of the abnormal verification node based on the authentication offset until the authentication is completed. Wherein the generation of the master key library relates to encryption, confusion and format standardization of various types of data; fragment verification feature extraction comprises key fragment sorting and the like; the authentication rule is determined based on the dynamic feature priority; and exception processing is combined with historical tracing and offset calculation. According to the method, the authentication security and the dynamic adaptability are improved.

In some implementations, a system may configure a set of compliance requirements for a secure communication service. The system may configure a key rotation component and a key fallback component. The system may store a key, generated by the key rotation component, using a key store. The system may periodically update, using the key rotation component, the key in the key store in accordance with the set of compliance requirements. The system may maintain, in connection with periodically updating the key, at least one fallback key using the key fallback component. The system may receive a request for a communication using the key. The system may determine whether the key is a valid current key or a valid fallback key. The system may communicate using the key based on determining whether the key is the valid current key or the valid fallback key.

A system for controlling access to cryptographic resources is disclosed. The system may receive a request to transfer cryptographic resources between users, including a user identifier and a first cryptographic signature. The system may verify the signature and retrieve an encrypted private key from a key vault using the user identifier. A command to sign the request may be transmitted over a private network to a signature device, which may generate a second cryptographic signature using the decrypted private key. The system may receive the second signature, generate a blockchain operation based on the request and signature, and transmit the operation to a blockchain node for commitment. The system may also handle new account generation, storing encrypted keys in jurisdiction-specific databases, and validating blockchain operations against request parameters.

An identity service in a cloud environment is communicatively coupled to a proxy key vault in the cloud environment and to an external key manager (EKM) located outside of the cloud environment. The identity service receives a token request for a communication credential from the proxy key vault and verifies the request based on a client credential associated with the proxy key vault. The identity service generates the client credential and signs the communication credential with a private key associated with the EKM. The identify service transmits the signed communication credential to the proxy key vault. The communication credential can be used to substantiate cryptographic operation requests to the EKM.

The invention provides a space mobile equipment identity verification method and device, electronic equipment and a storage medium, and relates to the technical field of information security. The invention discloses a space mobile device identity verification method, which comprises the following steps: acquiring a motion track of a target space mobile device; decoding the motion track by using a preset decoding algorithm to obtain a to-be-verified key; and matching the to-be-verified key with an identity key pre-stored in a key library, and obtaining an identity verification result of the target space mobile device according to a matching result. According to the technical scheme provided by the embodiment of the invention, the motion track of the target space mobile device is captured, the key information embedded in the track is identified and decoded by using the preset decoding algorithm to obtain the to-be-verified key, and the to-be-verified key is compared with the pre-stored identity key to realize identity verification. The method does not need to depend on network connection or hardware equipment support, is not easy to crack, and is good in anti-interference capability and safety performance.

The invention relates to the field of quantum security and block chains, in particular to a quantum security communication method and system for a block chain network. A first computing device and a second computing device which are connected with each other are arranged in the block chain network; a first key pair generated based on a post-quantum encryption algorithm and a second key pair generated based on a traditional encryption algorithm are stored in a key library of a first quantum security service layer deployed on a first computing device. The method comprises the following steps: when a first computing device initiates a target transaction to a second computing device, performing quantum encryption algorithm signature and traditional encryption algorithm signature on the target transaction by using a private key of a first key pair and a private key of a second key pair respectively. And the second computing device receives the target transaction and the signature data, and performs signature verification on the corresponding signature data by using the public key of the first key pair and the public key of the second key pair. And if the signature verification fails, rejecting the target transaction.

The invention discloses an identity authentication method and device, a storage medium and electronic equipment, and belongs to the technical field of information and network security. The to-be-authenticated user information comprises encryption information generated according to a first biological feature of a to-be-authenticated user, a first Ukey identifier written in a used Ukey, a first local symmetric key and a server encryption public key; extracting a first Ukey identifier, a first local symmetric key and a first biological feature from the encrypted information; taking the first Ukey identifier as an index, and respectively searching a second local symmetric key and an encrypted biological feature from a second local symmetric key library and an encrypted biological feature library; and according to the extracted first local symmetric key and the first biological feature, and the searched second local symmetric key and the encrypted biological feature, identity authentication is performed on the user to be authenticated, so that multi-level security protection can be provided in the identity authentication process, and the method is suitable for various complex network environments.

The invention discloses a key negotiation method, system and device and electronic equipment. The method comprises the following steps: obtaining a quantum key generated by a quantum key service platform; key negotiation processing is carried out on the quantum key through a border gateway protocol, a target key corresponding to the first router device is generated, and the target key is a key obtained after key negotiation is carried out on the first router device and a second router device through the border gateway protocol; the first router equipment and the second router equipment are any router equipment in a network forwarding layer; a quantum key library is determined according to the target key, and the quantum key library is a key database obtained after key negotiation is carried out on all router devices in a network forwarding layer through a border gateway protocol. According to the invention, the technical problems of low point-to-point key negotiation efficiency, high cost and complex network protocol due to limited application of a quantum key distribution technology in related technologies are solved.

The present application provides a quantum encryption communication data protection method in a public-private integrated network communication system. A key management platform is used to generate, in real time, a session key actually used for operation, and the session key is encrypted using a key pre-filled in a preset key library of two parties participating in a call as a protection key, and a key ciphertext is generated and issued to both parties in the call, so as to implement transcoding from a private network talkback terminal to a gateway side, and perform encrypted transmission of corresponding data from the gateway side to a public network talkback terminal, as well as support reverse data transmission from the public network talkback terminal to the private network talkback terminal. The present application further provides a public-private integrated network gateway and a public-private integrated network communication system. The present application has the advantages of: improving security relative to directly using a preset shared key library, solving the problem of repeated use of a key in a talkback handheld terminal, and implementing one-time key negotiation and one-time key functionality.

The application relates to the technical field of network communication, and discloses a communication channel dynamic encryption method and device, which comprises the following steps: collecting communication scene related information and security state related information to obtain an evaluation result; selecting a corresponding encryption scheme based on the evaluation result to establish an encryption link; transmitting an updated key library by using the encryption link to complete seamless updating of the key library; and binding the encryption scheme and session information and optimizing session parameters based on the encryption link and the updated key library to obtain encrypted transmission of communication data. The communication channel dynamic encryption method and device are characterized in that, through three-dimensional evaluation of data sensitivity, network security level and historical interaction security record and dynamic adaptation of the encryption scheme, high-sensitivity data, dangerous network environment and other scenes can be subjected to high-intensity encryption with high pertinence, low-sensitivity data and safe network environment can be subjected to moderate encryption strength, transmission efficiency caused by excessive encryption is avoided, and security risks caused by insufficient encryption strength are reduced.

The invention provides a resource transfer information processing method and a related device. The method is performed by a first processing node. The method comprises the following steps: identifying a receiver of resource transfer information as a second processing node, and generating receiver information according to the second processing node; obtaining a target multi-party symmetric key from a first multi-party symmetric key library of the first processing node; generating a target multi-party symmetric key identifier for the target multi-party symmetric key; encrypting the resource transfer information by using the target multi-party symmetric key to obtain encrypted resource transfer information; and binding and recording the encrypted resource transfer information, the receiver information and the target multi-party symmetric key identifier to the block chain. According to the resource transfer method and device, the resources can be effectively transferred under the conditions that normal operation of the block chain is not influenced and details of the data are not exposed, and privacy and security in the resource transfer process are improved under the condition that continuous detection of a third party is not influenced.

The invention relates to the technical field of digital integrated circuit design, in particular to an SM4 encrypted circuit assembly line optimization method and device, equipment and a medium. The method comprises the following steps: acquiring the total number of rounds of encryption operation; based on the total number of rounds of encryption operation, the target SM4 encryption circuit is divided into a plurality of encryption assembly lines, and each encryption assembly line comprises at least one round of encryption operation; the method comprises the steps of obtaining a sub-key corresponding to each encryption operation round from a preset multi-round key library, dividing an encryption assembly line corresponding to each encryption operation round into a plurality of sub-assembly line stages, and controlling the plurality of sub-assembly line stages to execute corresponding encryption operations based on the sub-key corresponding to each encryption operation round. Therefore, by optimizing the pipeline architecture design, the subkey generation mechanism and the task scheduling strategy, the problem of performance reduction caused by data dependence in a hardware pipeline is solved, and the performance and the resource utilization rate of the SM4 hardware accelerator are improved.

Encryption system with an application-specific integrated circuit (ASIC) which has a permanent memory for the non-volatile storage of the operating system (OS) of a processor and software modules for encrypting the data memory of the processor and which has a hardware-implemented encryption algorithm, characterized in that a security module (SM) is integrated in the ASIC for autonomous booting of the operating system (OS), consisting of: - a symmetric cryptosystem (SK) for processing symmetric keys, - an asymmetric cryptosystem (AK) for the use of public and private keys, - a module for generating cryptographic hash functions (KH), - a module for the secure exchange of keys using hardware-implemented key exchange protocols (SP), - a key storage (SS) for the secure storage of root keys (WS), which are protected by appropriate measures in the physical structures of the ASIC and - a key management system (SMS) for the secure introduction of authenticated-encrypted key packets, and that the security module (SM) communicates with a central processing unit (CPU) via a communication interface (CS1), and that the central processing unit (CPU) communicates with at least one internal storage (IS) and one external storage (ES), as well as with at least one internal persistent storage (IP) and one external persistent storage (EP), such that the operating system (OS) is loaded by a second-stage bootloader (SSB) stored in the external persistent storage (EP), and then the operating system (OS) loads the applications, the second-stage bootloader (SSB) itself being decrypted and loaded by a first-stage bootloader (FSB) stored in the internal persistent storage (IP), and a public key (PUBOS) to verify the operating system (OS).and a symmetric key (KOS) to decrypt the operating system (OS), and that the contents of the internal memory (IS) and the external memory (ES) are decrypted by the security module (SM) during read accesses by the central management unit (CMU) or other modules integrated on the ASIC, and re-encrypted during write accesses by the same.

The disclosed technology teaches a method for managing user access to one of a set of decentralized networked nodes that share a private permissioned blockchain data structure or a decentralized personal ledger, to which access has been limited to users authorized by one of the set of decentralized networked nodes.

A method and system for providing containerized applications with updated secret values has been developed. An update to a secret from a first secret value to a second secret value is detected at a secrets vault. A configuration map associated with the secret is identified. The configuration map includes a first non-secret that is associated with the first secret value. A second non-secret that is associated with the second secret value is generated. The first non-secret is replaced with the second non-secret in the configuration map. The replacement of the first non-secret with the second non-secret in the configuration map results is an event. A reloader issues a restart signal to a containerized application associated with the secret in response to the event. The secret at the containerized application is updated from the first secret value to the second secret value during a restart process.

This invention relates to the field of digital identity authentication technology and discloses a digital identity encryption authentication method. The method includes the following steps: acquiring a user identity information feature dataset and generating a master key library through multi-dimensional encryption preprocessing; extracting fragmented verification features from each master key library to determine authentication rules; constructing a multi-level authentication chain and verification nodes, and obtaining the node authentication status through bidirectional verification. In a valid authentication state, the master key library is associated with authentication according to permission levels; in an invalid authentication state, abnormal verification nodes are identified, the authentication offset of their respective master key libraries is calculated, and the abnormal verification node paths are reconstructed based on this until authentication is completed. The master key library generation involves multiple types of data encryption, obfuscation, and format standardization; fragmented verification feature extraction includes key fragment sorting; authentication rule determination is based on dynamic feature priority; and anomaly handling combines historical tracing and offset calculation. This method improves authentication security and dynamic adaptability.

The disclosed technology teaches a method for revocation of user credentials for controlling user access to a private permissioned blockchain data structure or decentralized personal ledger, comprising an administrative logic configured to de-configure user private keys from keystores of respective users. The administrative logic further comprises a revocation logic configured to receive a unique identifier linked to a keystore of a particular user in response to the keystore, and the revocation logic is further configured to revoke access of the keystore based on the unique identifier.

Providing secure secrets for encryption consistency enables rotating security measures (e.g., encryption access keys in users' certificate) for encrypted data at rest, without either needing to retain any prior certificates or requiring decryption and re-encryption. This provides enhanced security over some prior art methods (old keys may be discarded) and enhanced speed over the other prior art methods (no decryption / re-encryption needed). Examples generate a primary encryption key, which is retained on a secure remote computing node, such as in a key vault, and is not shared outside the key vault. Access to the primary encryption key is restricted to users who possess the current encryption access key, which is rotated on some trigger event. The remote node receives incoming messages to encrypt or decrypt files and performs the encryption / decryption using the primary - but only if a message contains the current encryption access key. Rotating the encryption access key preserves security.

Techniques are provided for generating and using a multi-signature token for electronic message validation according to the one or more embodiments as described herein. Specifically, a multi-signature token may be generated that includes at least two digital signatures and information (e.g., user information). Each of the at least two digital signatures may be generated using a private key of at least two key pairs that are maintained on a plurality of keystores that have at least two different implementations (e.g., security protocols). If the at least two digital signatures are valid, the multi-signature token may be determined to be valid and the client request may optionally be performed. If at least one of the at least two digital signatures is invalid, the client request is optionally not performed.

The invention discloses a supply chain integrated collaborative management system based on a cloud platform, which belongs to the technical field of supply chain management, and comprises a supply application platform processor, a multi-tenant key library management service, a digital twinning collaborative optimization module, a federal learning decision engine, an intelligent contract execution layer and an application interface layer, the problems of data splitting, low cooperation efficiency, low demand prediction precision and rigid logistics planning in the prior art are solved, and a distributed data warehouse, multi-dimensional supplier matching, a hierarchical demand prediction model and a block chain traceability technology are integrated. Breakthrough is realized through three major innovation mechanisms: firstly, a cross-subject real-time collaborative environment is constructed by adopting a digital twinning technology, and the problem of poor collaboration of links of a traditional supply chain is solved; secondly, data fusion is carried out by using federal learning, and the data value mining capability is improved on the premise of protecting data privacy; and thirdly, an intelligent contract is introduced to realize automatic disposal of abnormal events, and timeliness and toughness of supply chain risk response are enhanced.

Systems and techniques are provided for generating cryptographic keys. For instance, a process may include generating a plurality of master keys based on a plurality of generated random numbers, a second number, and a nonce number; storing a master key, of the plurality of master keys, along with a generated random number of the plurality of generated random numbers, the second number, and the nonce number used to generate the master key in a one-time programmable memory; generating public key-private key pairs for the plurality of master keys; transmitting public keys of the plurality of public key-private key pairs for audit; destroying an audited master key, along with the generated random number, second number, and the nonce number used to generate the audited master key, based on the audit; and storing a non-audited public key-private key pair corresponding to the master key that were not destroyed based on the audit.

The present invention discloses a data security reading and writing method and device in a Hongmeng system device, and relates to the field of information security. The scheme stores the generated root key and the application identifier in a key library, and stores the encryption key obtained by processing the root key in a key asset library; during the user operation, the encryption key stored in the key asset library is used to encrypt the second type of data, and the encryption and decryption interface is called to encrypt the first type of data, and the encrypted data is stored in a key value database. The present application stores the root key and the encryption key in different databases, the root key is stored in the key library and cannot be exported, the encryption key is stored in the key asset library, different keys are used for encryption and decryption processing according to different user data, and big data is stored in the key value database, which can effectively protect the security of keys and user data in the Hongmeng system and is easy to use.

The invention relates to the technical field of secure network communication, and discloses an industrial encryption communication method and system fusing a national cryptographic algorithm and a dynamic key mechanism, and the method comprises the steps: a transmitting end obtains a network layer data packet, analyzes a specific field of an IP head of the network layer data packet, and obtains a current timestamp; based on the specific field and the timestamp, a dynamic key sequence number is calculated through a preset key sequence number generation algorithm; extracting a corresponding encryption key and an initialization vector from a pre-stored key library which is the same as the receiving end according to the serial number; and encrypting the data load by using the CTR working mode of the SM4 algorithm, adding a timestamp to the head of the encrypted load, and sending the encrypted load. And the receiving end extracts the timestamp to perform timeliness verification, and calculates the same key sequence number based on the same field and the timestamp to complete decryption. The method realizes a one-time pad dynamic key mechanism, has the advantages of high encryption strength, good compatibility and the like, and is particularly suitable for an industrial control communication environment with high requirements on real-time performance and reliability.

The invention discloses a key library generation method and device, equipment and a storage medium. In the scheme, a mode of presetting a key library and statically configuring is not adopted, the key library is automatically created through the initial strategy file and the attribute value of each attribute variable, and the triple information of each key in the key library is automatically generated; a corresponding secret key can be directly obtained and processed based on the triple information; if an encryption algorithm or a hardware cipher machine needs to be replaced, a new key library and a configuration file do not need to be manually regenerated, only the attribute value of the attribute variable needs to be changed, the new key library and the triple information can be automatically created, the key library management mode greatly simplifies the generation process of the key library, the downtime is reduced, and the key library management efficiency is improved. And the error probability is reduced, so that efficient and safe management of the key library is realized.