436 results about "Message authentication code" patented technology

The invention relates to the technical field of information security, and discloses an authentication method and system based on a Ksession shared session key MAC, and the method comprises the steps: obtaining to-be-encrypted data in a power monitoring system, dividing the to-be-encrypted data into key data and real-time data, and encrypting the key data and the real-time data; the method comprises the following steps: dynamically generating a Ksession key by using an ECDH protocol and an identity-based IBC technology, generating a message authentication code by using the Ksession key, carrying out integrity and authenticity verification on data in transmission through the message authentication code, transmitting encrypted data through a TLS / SSL protocol, and destroying the Ksession key at the end of a session; a quantum security digital certificate is generated by fusing quantum key distribution and a quantum security signature algorithm, and verification of the digital certificate is realized through a multi-party verification mechanism. The quantum security technology and the advanced encryption theory are integrated, and qualitative leap is achieved in the aspects of identity authentication, data encryption, integrity verification and access control.

The embodiment of the invention discloses a database integrity verification method, device and system, a medium and equipment, and the method comprises the steps: firstly, injecting a section enhancement code at a preset tangency point position of a database; then, when a modification operation for the database is received, executing the section enhancement code to generate a verification hash value corresponding to the modification operation; and further, calling a password service of a trusted third party, and performing data signature on the target data corresponding to the modification operation by the verification hash value through the password service. And finally, verifying the database data based on a hash operation message authentication code obtained by verifying the hash value and the data signature so as to determine whether the database is tampered or not.

The invention discloses a meteorological data transmission method based on an edge protection gateway algorithm, and belongs to the technical field of data transmission, and the method comprises the steps: building communication connection with meteorological observation equipment through a serial port service controller, carrying out the standardization processing of data, and carrying out the fragmentation storage and backup; generating a random seed by using a hardware random number generator, generating a round key through a key expansion function, performing encryption operation on the grouped data, and calculating a message authentication code; sending a password suite list to establish handshake connection, exchanging a key through elliptic curve operation, segmenting compressed data into records, and adding an authentication tag for transmission; identity authentication is carried out by adopting a digital certificate, and security protection is carried out on data through a firewall state table and a feature matching algorithm. Through the scheme of the application, the security of meteorological observation data transmission can be improved, data leakage, tampering and attacking are prevented, and the security and reliability of meteorological data are guaranteed.

A method for provisioning a device-bound, replay-protected software image may include obtaining, from a provisioning system, a software image and a digital signature associated with the software image. The method may include applying a hash function to the software image and a hash message authentication code (HMAC) to generate a hash of the software image. The HMAC may include an authentication code derived from first data provided by a root of trust (RoT). The first data may include a nonce generated by the RoT or system information associated with the RoT. The method may include verifying, using a public key of the provisioning system, the digital signature. The method may include, responsive to the verification of the digital signature, causing the software image to execute.

The invention relates to the technical field of communication security, in particular to a communication encryption method and device, equipment, a storage medium and a computer program product. The method comprises the following steps: dynamically generating a main session key between two communication parties based on a preset key negotiation protocol; dynamically generating sub-keys according to a preset time interval based on the main session key and the key sequence; performing encryption processing on each data block in the communication data stream based on the sub-key and the encryption strategy; generating a message authentication code for each encrypted data block; adding timestamp information based on the message authentication code, and introducing a random offset into the timestamp information; and the encrypted data blocks, the message authentication code and the timestamp information are packaged into the target data message, so that the transmission security of the communication data is improved.

The invention relates to the technical field of industrial wireless networks, in particular to an industrial wireless network security communication method based on a national cryptographic algorithm, which comprises the following steps that: identity authentication is required before equipment accesses the network, and gateway equipment and field equipment finish bidirectional identity authentication through the national cryptographic algorithm SM2. The secure communication method provided by the invention comprises three stages of identity authentication, key negotiation and data encryption and decryption, identity authentication is carried out by adopting a national cryptographic algorithm SM2, and transmitted data is encrypted and data integrity is verified by adopting a hash-based message authentication code SM3 (HMAC-SM3) and an SM4 block cipher algorithm (SM4). According to the secure communication method, how to save the storage space and the communication overhead of a WIA-FA network is considered, and meanwhile, a set of secure transmission protocol which is autonomously controllable on the industrial wireless network standard and the cryptographic algorithm is realized, so that the security, the reliability and the controllability in the industrial communication process are fundamentally guaranteed.

The invention discloses a geographic data processing system based on a cryptographic technology, and relates to the technical field of data security, the system comprises a server side and a client side, the server side comprises hardware equipment burnt with a binary unit and a binary unit message authentication code; the binary unit is generated by jointly compiling a source code of a space coordinate conversion processing algorithm and a source code of at least one cryptographic algorithm, and the binary unit comprises a space coordinate conversion interface and an encryption interface; the client comprises an identity verification interface, an integrity verification interface, a decryption interface, a space coordinate-based conversion interface, an encryption interface, an identity authentication interface, an integrity verification interface and a decryption interface. The server side and the client side jointly complete safety protection on input and output geographic data based on the cryptographic technology; the geographic data is subjected to space coordinate conversion and encryption processing at the server side, and a processing result is returned to the client side for decryption processing. According to the invention, the security of the geographic processing process data is improved.

The invention relates to a symmetric searchable encryption method and device for big data based on an inverted dictionary, and the method comprises the steps: receiving file data and a target password uploaded by a user in a C / S distributed structure, and controlling a user manager to extract at least one keyword in plaintext data through employing a TF-IDF algorithm and Kmeans clustering combination method, so as to build the inverted dictionary; the method comprises the following steps: encrypting file data by using a preset AES algorithm to obtain encrypted file data, constructing encryption chain tables by using the preset AES algorithm and the like, adding an HMAC message verification code at the tail end of each encryption chain table, and performing noise filling on the encryption chain tables through a target password to generate a node sequence and an index sequence; and querying a file name corresponding to the target keyword through the target password by using the cloud server. Therefore, the problems that extra communication and storage expenses are easily increased, the response speed is low, and a data owner needs to be online for a long time in a single-write multi-read scene when a server performs inert calculation are solved.

A device according to one embodiment may comprise: a memory including an Enclave Page Cache (EPC) and a partial memory distinguished from the EPC; a storage distinguished from the memory; and a processor, which receives a lookup request including an object key from a user, retrieves the object key from a table stored in the EPC, retrieves the object key from a table of a log-structured merge-tree stored in the storage if the object key is not retrieved from the table stored in the EPC, acquires a reference message authentication code and a value corresponding to the object key from the storage if the object key is retrieved from the target table of the log-structured merge-tree stored in the storage, and verifies the integrity of the value on the basis of the reference message authentication code.

A method performed by a UE. The method incudes generating a SUCI comprising: i) an encrypted part in which a Mobile Subscription Identification Number of a SUPI is encrypted and ii) a clear-text part comprising: a) a Mobile Country Code of the SUPI, b) a Mobile Network Code of the SUPI, c) a public key identifier for a public key of a home network of the user equipment, and d) an encryption scheme identifier that identifies an encryption scheme used by the UE to encrypt the Mobile Subscription Identification Number in the SUCI. The method also includes transmitting the SUCI to an authentication server in the home network for forwarding of the SUCI to a de-concealing server capable of decrypting the Mobile Subscription Identification Number.

The invention provides a single packet authentication method, electronic equipment and a storage medium, and the method comprises the steps that an SDP client encrypts to-be-verified service request information by adopting a single packet encryption key pre-distributed by an SPA key distribution center to obtain a service request ciphertext, the service request information is used for requesting to access a target service resource through an SDP gateway, and the service request ciphertext is sent to the SPA key distribution center; the method comprises the following steps: performing HMAC operation on user information and a service request ciphertext corresponding to an SDP client by adopting a single-packet authentication key pre-distributed by an SPA key distribution center to obtain a to-be-verified message authentication code, generating a single-packet authentication knocking message according to the user information, the service request ciphertext and the to-be-verified message authentication code, and sending the single-packet authentication knocking message to an SDP controller. According to the application, the pre-distributed single-packet encryption key and the single-packet authentication key are used for single-packet authentication, and the user does not need to keep the key by himself, so that the problems that the key is easy to leak and the user operation is complicated are solved, and the usability is high.

The invention relates to the technical field of information retrieval, and provides a privacy information retrieval system and method based on a block chain and function secret sharing, and the method comprises the steps: carrying out the encryption and keyword extraction of a data document; generating a Bloom filter index table between the keyword and the document based on the keyword trap door; uploading the encrypted file and the Bloom filter index table to a DSSP end, and transmitting the hash value of the encrypted file and the Bloom filter index table to a block chain for on-chain storage; storing the encrypted file in a distributed storage node under the chain according to the divided share; and the block chain calculates data of each column of the Bloom filter index table through consensus to obtain a message verification code, and the message verification code is stored on the block chain. According to the method, the index is constructed through symmetric encryption and the Bloom filter, and block chain evidence storage and FSS distributed storage are combined, so that data privacy protection and index credibility are realized. Through verification and tampering prevention, the problem that the existing FSS lacks verification and auditing mechanisms is solved.

A pseudonymisation method is disclosed. The pseudonymisation method comprises receiving a data subject identifier from a first data controller, the first data controller having a first data controller identifier, computing a pseudonym seed based on the data subject identifier using a cryptographic mixing function based on a pseudonym seed generation key, and computing a global pseudonym as a first hash-based message authentication code on the pseudonym seed with a global pseudonym key.

Provided are a universal flash storage (UFS) device for preventing a replay attack, a method of operating the same, and a UFS system. The UFS device including: a memory including a replay protection memory block (RPMB) region, the RPMB region including one or more index fields storing a second write failure index; and a memory controller including at least one controller memory storing one or more instructions, wherein the memory controller is configured to execute the one or more instructions to cause the UFS device to: receive, from an external device, an RPMB write request including a first write failure index, meta information, and a first message authentication code generated based on the first write failure index and the meta information, and determine whether to perform an authentication operation on the external device based on the first write failure index and the second write failure index.

Imaging devices, host devices, and a method are disclosed. In one example, an image sensor includes a first register, a second register, a communication interface, and a controller. The first register storing a first key. The second register storing a counter value. The communication interface configured to communicate with a host device. The controller configured to control the communication interface to receive a request from the host device, change the counter value to generate an updated counter value, and generate a message authentication code based on the first key and the updated counter value in response to receiving the request from the host device.

An application device sends a key request packet to a quantum device, where the key request packet includes a user identifier corresponding to the application device, a first public key, and a first message authentication code value. If verification performed on the first message authentication code value succeeds, the quantum device sends a key response packet to the application device, where the key response packet includes a first ciphertext and a second message authentication code value. If verification performed on the second message authentication code value succeeds, the application device decrypts the first ciphertext by using a first private key, to obtain quantum key information allocated by the quantum device to the application device. The first public key and the first private key are from a key pair obtained by the application device by running a post-quantum key generation algorithm.

The invention discloses a Modbus protocol security enhancement method in a multicast communication scene, which comprises the following steps: when a master node initiates an identity authentication request, the master node calculates a first message authentication code of a first random number according to a session key; wherein the session key is obtained according to random numbers pre-generated by the master node and the slave node; broadcasting and sending the encrypted session key and the first message authentication code to each slave node; the slave node decrypts the encrypted session key, and calculates a second message authentication code of the first random number according to the obtained session key; when the message authentication codes are the same, authenticating the identity of the main node; the slave node calculates a third message authentication code of the second random number by using the session key, and sends the third message authentication code to the master node; the main node uses the session key to calculate and obtain a fourth message authentication code of each second random number; and when the message authentication codes are the same, authenticating the identity of the corresponding slave node. According to the invention, the identity verification efficiency is improved, and the safety and reliability are improved.

The invention discloses a network edge calculation method and a communication device, and relates to the technical field of network communication, and the method comprises the following calculation steps: inputting original data into a calculation processing module, and outputting processed data, encrypted data, a hash value of the encrypted data, an authentication code of a message and a verification result. And transmitting the encrypted data, the hash value of the encrypted data, the authentication code of the message and the verification result to a cloud server. The method has the advantages that the received data is changed firstly, so that the encryption efficiency and security of the data are improved, the data are encrypted in an encryption mode, the confidentiality of the data is guaranteed, the integrity verification of the data is carried out through the hash function and the message authentication code, and the security of the data is improved. According to the data transmission method and device, the data are ensured not to be tampered in the transmission process, all-directional protection of the data is achieved, meanwhile, the received data are verified in a verification mode so as to ensure the authenticity of the data, and dual guarantee of data transmission and verification is achieved.

The invention discloses a QKD system authentication method and device based on fusion of QRNG and PQC, and belongs to the technical field of information security, and the method comprises the following steps: S1, constructing a key encryption module based on QRNG and PQC, and when a QKD system starts a key negotiation process, carrying out identity verification based on a digital certificate to determine a negotiation object; s2, generating an encrypted random number based on a QRNG in a key encryption module, and obtaining a shared key between negotiation objects based on the encrypted random number and a PQC in a key encryption algorithm; and S3, generating a message authentication code based on the shared key, and performing authentication based on the message authentication code. The technical problem that the complexity is difficult to reduce while the security is improved in the prior art is solved, and the flexibility and expandability of authentication are also improved.

The invention provides a Modbus protocol security enhancement method and system in a unicast communication scene, and relates to the technical field of industrial control networks. Comprising the following steps: sharing a first ciphertext and a second ciphertext between a master node and a slave node; the master node generates a first message authentication code according to the second ciphertext, a preset key and the first random number, and sends the first message to the slave node by using the target function code; the slave node authenticates the identity of the master node according to the first message authentication code, the first ciphertext, the preset key and the second random number; when the slave node successfully authenticates the identity of the master node, the slave node generates a second message authentication code according to the first ciphertext, the preset key and the second random number, and sends a second message to the master node by using the target function code; and the master node authenticates the identity of the slave node according to the second message authentication code, the second ciphertext, the preset key and the first random number. Therefore, the validity of the identities of the two communication parties can be ensured, and the integrity and confidentiality of the data in the transmission process are guaranteed.

As automotive security concerns are rising, the Controller Area Network (CAN)—the de facto standard of in-vehicle communication protocol—has come under scrutiny due to its lack of encryption and authentication. Several vulnerabilities, such as eavesdropping, spoofing, and replay attacks, have shown that the current implementation needs to be extended. Both academic and commercial solutions for a secure CAN have been proposed, but OEMs have not yet integrated them into their products. The main reasons for this lack of adoption are their heavy use of limited computational resources in the vehicle, increased latency that can lead to missed deadlines for safety-critical messages, as well as insufficient space available in a CAN frame to include a Message Authentication Code (MAC). By making a trade-off between security and performance, this disclosure overcomes the aforementioned problems of a secure CAN.

The invention provides an AES (Advanced Encryption Standard)-based data enhancement encryption method, system and equipment and a medium, and belongs to the technical field of data security. The method comprises the following steps: receiving plaintext data to be encrypted and a password provided by a user; deriving a master key and an HMAC key from the password and the randomly generated salt value by using a key derivation function; randomly generating an initialization vector, and encrypting the plaintext data through the master key by using an AES encryption mode to obtain encrypted ciphertext data; performing message authentication code calculation on the ciphertext data, the initialization vector and the salt value through an HMAC key to generate an HMAC check value; and combining the salt value, the initialization vector, the ciphertext data and the HMAC verification value into a final output encrypted data packet. According to the method, a series of enhancement mechanisms such as strong key derivation, random salt values, message authentication codes and initialization vectors are introduced, so that the security and integrity of data are further improved.

Systems and methods for memory replay protection are disclosed. In an example, a system in the form of a device includes a processor, and a replay protection circuit coupled to the processor and including a memory interface circuit, wherein the replay protection circuit is configured to generate a message authentication code (MAC) from at least one block of data and to access the at least one of block of data via the memory interface circuit using ciphertext that is generated by the replay protection circuit in response to a plaintext memory address received from the processor.

The present disclosure provides systems and methods for providing secure CAN communications. Exemplary embodiments of the present disclosure provide secure CAN communication between vehicle components. According to an embodiment, a method for providing may include: generating, by at least one processing unit of a transmitter, a one-time password (OTP); acquiring, by at least one processing unit of the transmitter, a master key provided in advance to the transmitter and the receiver; deriving, by at least one processing unit of the transmitter, a shared key based on the OTP and the master key; generating, by at least one processing unit of the transmitter, a message authentication code (MAC) based on the derived shared key; attaching, by at least one processing unit of the transmitter, the MAC to the message; and transmitting the attached message to the receiver via the CAN bus by at least one processing unit of the transmitter.

The invention relates to the field of information security, in particular to a data security processing method, a computer program product, electronic equipment and a storage medium. The data security processing comprises the steps of obtaining to-be-transmitted target data; encrypting to-be-transmitted target data by using the key to obtain a ciphertext; packaging the ciphertext, the serial number and the truncation message authentication code to obtain a message frame; the truncation message authentication code is generated based on the ciphertext, the serial number and the key; and sending the message frame to a receiving end, so that the receiving end verifies and decrypts the message frame, and the data security can be improved.

According to the communication method and the communication device, in a user equipment parameter updating process, a data management network element can take the head of a UPU container as a new type of data set to be stored in a UPU list or can additionally add a field in the UPU list to store the head of the UPU container, and provides the UPU list comprising the head of the UPU container to an authentication network element, so that the UPU container can be authenticated. Therefore, the authentication network element can obtain the message authentication code used for performing integrity protection on the UPU list according to the UPU list comprising the head of the UPU container, and the obtained message authentication code can perform integrity protection on the head of the UPU container, so that the security of information transmission is improved; and the integrity of the first header can be protected on the premise of reducing the change of the message format as much as possible.

Methods and systems for personalizing contactless cards are provided. An exemplary method includes: preinstalling, by a server, an applet on the contactless card; assigning, by the server, a first unique identifier to the contactless card; pre-provisioning, by the server, a first unique derived key to the contactless card; generating, by the server a first nonce; generating, by the server, a data file containing script for updating the contactless card and further containing a message authentication code (MAC); transmitting, by the server, the data file and the first nonce to the contactless card; validating, by the contactless card, the MAC based on the first unique derived key and the first nonce; and personalizing the contactless card by the preinstalled applet executing the script.

The invention discloses an inter-vehicle bidirectional authentication and key agreement method and system, and relates to the technical field of Internet of Vehicles information security, and the method comprises the steps: a registration stage: a vehicle and a trusted mechanism derive a temporary session key based on ECDH and HKDF, and achieve the secure interaction; the trusted institution generates a basic identity label, a part of private key, a signature and a basic certificate for the vehicle, and encrypts and transmits the basic identity label, the part of private key, the signature and the basic certificate to the vehicle; the vehicle generates a hardware fingerprint and extracts a secret key by using the embedded PUF, and part of the private key is encrypted and then is locally and safely stored with the basic certificate; in the authentication stage, the two communication parties dynamically recover part of private keys through PUF, and generate dynamic pseudo names, temporary ECDH key pairs and cryptographic evidence; and calculating a cross item and a binding item by interaction parameters of the two parties, negotiating a unique session key, and completing bidirectional confirmation through a message authentication code. According to the method and the device, efficient, physical attack-resistant and privacy-protecting V2V security mutual recognition and key agreement are realized in a resource-limited vehicle-mounted environment.

The invention relates to the technical field of data transmission, and particularly discloses a data transmission security protection system adapted to a communication base station, which comprises a sending end, a communication base station, a receiving end and a block chain verification unit, the sending end is in communication connection with the receiving end through a network transmission interface of the communication base station, and the sending end and the receiving end are both connected with the block chain verification unit. Through cooperative operation of a sending end, a communication base station, a receiving end and a block chain verification unit, in terms of data integrity verification, a dual mechanism combining a message authentication code technology and a digital signature is adopted, the message authentication code technology can quickly check whether data is tampered or not, the digital signature ensures that a data source is real and non-repudiation, and common tampering attacks are effectively resisted; and meanwhile, a block chain distributed account book technology is introduced, safe storage and reliable verification are provided for important data transmission records by utilizing decentralization and tamper-resistant characteristics of the block chain distributed account book technology, and even if data are tampered, the tampered data can be timely perceived through an original hash value, so that the data integrity protection capability is greatly improved.

The invention relates to an anti-quantum anonymity two-factor authentication key negotiation method, and belongs to the technical field of information security. The negotiation process comprises the following steps: a client U sends login request information to a server S based on an intelligent card issued by the server S, wherein the login request information comprises a first ciphertext C1, a random number R and a first message check code F1; the server S verifies the received login request information, generates a session key and sends a response message to the client U, and the response message comprises a second ciphertext C2 and a second message check code F2; the client U verifies the received response message, obtains the session key, generates a third message verification code F3 and sends the third message verification code F3 to the server S; and the server S verifies whether the negotiation is successful based on the third message verification code F3. According to the method, two-way authentication and two-way confirmation are achieved through three message verification codes, on the premise that digital authentication infrastructure does not need to be transformed, client information identity is hidden, identity authentication and key negotiation of digital financial payment are achieved, and better safety and good usability are achieved.