101 results about "Message integrity" patented technology

Original content of an email message is verified upon receipt of the email message at a receiver mail server prior to presenting the email message to a recipient. Determination of original content is made by comparing a verification hash value to a calculated hash value of the received email message. When the verification hash value does not match the calculated hash value, an invalidity warning is presented to the recipient with an option to view the invalid email message.

The invention discloses a secure transmission system based on a multimedia short message, and relates to the technical field of communication and network security, and the system comprises a protocol stack security reinforcement module which carries out the hierarchical reconstruction of an MMS protocol stack, comprises a preprocessing layer, is used for intercepting and filtering illegal characters, and verifies the legality of a message structure through a finite-state machine; the analysis layer is used for pre-judging memory requirements based on message types and lengths by adopting a dynamic memory allocation strategy; the execution layer is integrated with a null pointer checking mechanism, and the validity of a pointer is forcibly verified before a protocol stack calls a function; the encryption and signature module is used for carrying out end-to-end encryption on a message body and metadata by adopting a hybrid encryption algorithm and carrying out message integrity verification through a lightweight hash tree; and the vulnerability real-time monitoring module is embedded into an abnormal behavior detection model based on machine learning and is used for dynamically identifying memory occupation abnormity and illegal instruction calling high-risk operation when the protocol stack runs.

This disclosure describes systems, methods, and devices related to enhanced wireless frame security. A device may utilize a Galois Message Authentication Code with a 256-bit key (GMAC-256) as an integrity protocol for block acknowledgment (BA) and block acknowledgment request (BAR). The device may generate a packet number (PN) and Message Integrity Code (MIC) using GMAC-256 for integrity design in the BA and BAR. The device may include a key identification (ID) indication in a BA control or BAR control field for the BA and BAR. The device may

The invention discloses a malicious node detection and protection method, device and equipment, and the method comprises the steps: determining the forwarding success rate, the message integrity, the energy level and the resource score of each node based on the monitoring data of each node in a network, the energy level represents the activeness and the electric quantity state of the node, and the resource score represents the transmission capability of the node; based on the forwarding success rate, the message integrity and the energy level of each node, a comprehensive trust value of each node is determined, and the comprehensive trust value represents the credibility of the node; and inputting the comprehensive trust value, the message integrity and the resource score of each node into a pre-trained classification decision model, and dividing each node into a trusted node and a non-trusted node based on an output classification result. According to the method, the non-trusted nodes can be identified before malicious behaviors are completely exposed, so that the overall security of the network is improved.

The embodiment of the invention provides a wireless communication method, wireless communication equipment, a computer readable storage medium and a computer program product. According to the wireless communication method, an extended message integrity check (MIC) field is generated for a frame header field which is not protected by additional authentication data (AAD), and an MPDU frame is inserted, so that the reliability of a frame header is improved, and meanwhile, when MPDU retransmission is carried out, only the extended MIC field is calculated and updated, and the communication efficiency is improved.

A method for checking end-to-end SBI message integrity includes receiving a first traffic feed from a first NF, the first traffic feed including copies of SBI messages transmitted from the first NF to an SCP. The method further includes receiving a second traffic feed from a second NF, the second traffic feed including copies of SBI messages received by the second NF from the SCP. The method further includes identifying, from the first traffic feed, a copy of a first SBI message transmitted by the first NF to the SCP. The method further includes identifying, from the second traffic feed, a copy of a second SBI message received by the second NF from the SCP and that is associated with the copy of the first SBI message. The method further includes performing, using the message copies, an end-to-end SBI message integrity check for the first SBI message.

A process includes accessing a first message that is sent from an access point device. The first message includes data representing a second message that is sent by a client device. The second message is part of an exchange of messages between the client device and the access point device associated with authentication of the client device and a derivation of a first key used to encrypt and decrypt data communicated between the client device and the access point device. The second message includes a first message integrity check value. The process includes identifying, based on the second message, a pre-shared key corresponding to the client device. The identification of the pre-shared key includes determining a second message integrity check value based on a candidate pre-shared key of a plurality of candidate pre-shared keys; comparing the second message integrity check value with the first message integrity check value; and based on a result of the comparison, selecting the given candidate pre-shared key as the pre-shared key. The process includes determining a user role based on the pre-shared key. The process includes causing a third message to be sent to the access point device, where the third message includes data representing the pre-shared key and data representing the user role.

This disclosure describes systems, methods, and devices related to using encrypted 802.11 association. A device may identify a beacon received from an access point (AP), the beacon including an indication of an authentication and key manager (AKM); transmit, to the AP, an 802.11 authentication request including an indication of parameters associated with the AKM; identify an 802.11 authentication response received from the AP based on the 802.11 authentication request, the 802.11 authentication response including a message integrity check (MIC) using a key confirmation key (KCK) and an indication that the parameters have been selected by the AP; transmit, to the AP, an 802.11 association request encrypted by a security key based on an authenticator address of the AP; and identify an 802.11 association response received from the AP based on the 802.11 association request, the 802.11 association response encrypted by the security key.

A communication system is provided in which access points (APs) communicate with stations (STAs). An AP may communicate with a STA according to a multiple basic service set identifier (M-BSSID) scheme. The AP may transmit an initial control frame (ICF) to STAs associated with different BSSIDs of the AP. The AP may integrity protect the ICF by generating one or more control message integrity checks (CMICs) and inserting the CMIC(s) into the ICF. The AP may generate a common CMIC shared across BSSIDs using a control frame integrity group temporal key (CIGTK) that is BSSID-specific or BSSID-independent. A BSSID-independent CIGTK may be a newly defined or may be a beacon integrity group temporal key (BIGTK). As another example, the AP may generate different CMICs in the ICF for each BSSID using different BSSID-specific CIGTKs for each BSSID.

The invention discloses an alliance chain-based safe and efficient authentication method for intelligent equipment, which comprises the following steps that: 1, a registration mechanism generates a challenge set and sends the challenge set to sensor equipment, the sensor equipment calculates a response by utilizing PUF (Physical Unclonable Function) and maps the response into an elliptic curve group element, and final information is stored on an alliance chain; step 2, the sensor device generates a signature and constructs a zero-knowledge proof, message integrity and identity verification are ensured by using Fiat-Shamir heuristic conversion, and the generated proof is sent to the edge device; and step 3, the edge device verifies the identity of the sensor device and the legality of the message by using the received pseudonym and proof, and after verification succeeds, the edge device adds the pseudonym into a used list and records a verification result into an alliance chain so as to ensure data transparency and non-tampering property. According to the invention, the security of equipment authentication is enhanced, and the method is suitable for scenes requiring high security and privacy protection, such as the industrial Internet of Things.

The invention relates to a communication system with header and acknowledgement integrity protection. A communication system is provided in which an access point (AP) communicates with a station (STA). The AP and STA may transmit an integrity protection frame. The AP and STA may perform an integrity check on the integrity protection frame. The AP and STA may transmit an integrity protection block acknowledgement (BA) frame in response to receiving the integrity protection frame. The AP and STA may perform an integrity check on the integrity protection BA frame. Padding may be inserted into the integrity protection frame and / or BA frame to accommodate processing delays associated with generating and verifying message integrity checks (MICs) in the frame and / or BA frame. An integrity check may be performed on a corresponding BA frame before, after, or before and after transmission of the frame.

The present invention proposes a method for provisioning a credential to a user equipment (10) in a private telecommunications network, the private telecommunications network including a credential holder and a gNB / AMF or eNB / MME, the method comprising: a) sending a provisioning request (40) from the user equipment (10) to the gNB / AMF or eNB / MME (11); b) establishing a PLS key (41) between the user equipment (10) and the gNB / AMF or eNB / MME (11) by physical layer security; c) providing a PLS key to the user equipment (10) via a PLS key; d) transmitting 43 a message from the user equipment 10 to the gNB / AMF or eNB / MME 11, the message including data permitting identification of the user of the user equipment 10 and / or the user equipment 10 and the master key, the message being integrity and confidentiality protected by a PLS key or a key derived from the PLS key; e) transmitting 44 a message from the gNB / AMF or eNB / MME 11 to the credential holder 12, the message including data permitting identification of the user of the user equipment 10 and / or the user equipment 10 and the master key, the message being integrity and confidentiality protected by a PLS key or a key derived from the PLS key. f) verifying in the credential holder (12) the data that allows identifying the user of the user equipment (10) and / or the user equipment (10); g) if the verification is positive, assigning in the credential holder (12) a unique subscription identifier to the user equipment (10) and generating corresponding keys, security parameters, and key derivation functions; h) transmitting the unique subscription identifier from the credential holder (12) to the gNB / AMF or eNB / MME (11). i) transmitting the unique subscription identifier, security parameters, and key derivation function from the gNB / AMF or eNB / MME (11) to the user equipment (10) in a message integrity and confidentiality protected by a PLS key or a key derived from the PLS key (47); j) generating a final key at the user equipment (10), the final key being a credential including the unique subscription identifier, security parameters, and final key (48);Including.

The invention discloses an identity authentication method in a vehicle-mounted self-organizing network, which relates to the field of vehicle-mounted self-organizing networks, and comprises the following steps: a trusted center TA generates elliptic curve cryptography parameters, a master key and a public key, and defines a hash function and a symmetric encryption and decryption algorithm; the vehicle Vi and the roadside unit RSUi respectively register to the trusted center TA; after the vehicle Vi logs in and enters the communication range of the roadside unit RSUi, bidirectional authentication is carried out between the vehicle Vi and the trusted center TA and between the vehicle Vi and the roadside unit RSUi; the vehicle Vi broadcasts the message by using the temporary key, and receives the vehicle to carry out timeliness, identity validity and message integrity verification; the roadside unit RSUi detects malicious broadcast and submits related information to the trusted center TA, and the trusted center TA decrypts the related information and then obtains a real identity and implements tracking; according to the method, efficient security authentication, privacy protection and authorization tracking of malicious nodes are realized, and the security, privacy and real-time communication efficiency of the vehicle-mounted ad hoc network are improved.

A system is presented for verifying the human sender of an electronic message using biometrics and securely transmitting the verification status to recipients. The sender registers an email account and provides a biometric sample. A public / private key pair is generated to encrypt a unique account identifier. When sending a message, the user authenticates with biometrics. The account identifier is encrypted with the private key and transmitted with the email. The receiving server decrypts the identifier using the sender's public key and verifies it matches the sender address. If matched, the message is tagged as verified. The invention prevents email spoofing by binding the user's identity to their account with biometrics. Encrypted verification data prevents tampering. Recipients can trust message integrity as the expected human sender is cryptographically verified.

The present invention provides a 5G message transmission method, apparatus, electronic device, and storage medium, including: receiving an HTTP / 2 message, determining whether the current framed message in the HTTP / 2 message is the last framed message based on a structure; if it is determined to be the last framed message, assembling the framed message and verifying the message integrity. By proposing a method for framing and assembling HTTP / 2 messages and retransmitting them for 5G communications, the present invention enables a server to quickly assemble a complete message body after receiving a framed message, immediately freeing up memory space occupied by the message, and completing message validity and integrity verification.

In a counter mode with encrypted block link message authentication code protocol (CCMP) encryption encapsulation, a station (STA) may incrementally increase a packet number (PN). The STA may construct additional authentication data (AAD) based on a plain text medium access control (MAC) protocol data unit (MPDU) header and an association with authentication medium access control (aaMAC) address. The STA may construct a random number based on the aaMAC address, the PN, and the priority value of the MPDU. The STA may form an encrypted message integrity code (MIC) based on the ADD and the random number. The STA may form an encrypted MPDU based on the MPDU header, the ciphertext, the MIC, and the CCMP header. The STA may then transmit the encrypted MDPU. The aaMAC address may be different from a multi-link device (MID) MAC address. The STA may be in non-multilink operation (MLO) communication with an access point (AP).

This disclosure describes systems, methods, and devices related to padding control frame. A device may receive a minimum medium access control protocol data unit (MPDU) start spacing field specifying a minimum spacing duration required between transmissions of protected control frames. The device may transmit a protected control frame including padding after a message integrity code (MIC), the padding comprising a number of bytes indicated by a peer station based on binary convolutional coding (BCC) encoding. The device may apply additional padding for a specified padding duration for MIC verification based on the received minimum MPDU start spacing field.

The invention discloses an Ethernet message integrity checking method in the technical field of aeronautical communication. The method comprises the following steps: acquiring an Ethernet message; filling counter data recorded by the global sending counter and a current timestamp in the Ethernet message to obtain a to-be-sent message; controlling the message sending end to send the to-be-sent message to a message receiving end; and checking the counter data and the current timestamp of the to-be-sent message based on the sending timestamp of the received message published by the message receiving end and the global receiving sequence number identifier, and receiving or discarding the to-be-sent message sent by the message sending end according to the checking result. The technical problem that the integrity of the aviation data message in the transmission process cannot meet the actual application requirement in the prior art can be solved.

Methods and device architectures for improving the energy efficiency of end devices in a wireless mesh network. In an example, an end device of the network includes a wireless transceiver, a first processing core configured to implement a media access control layer (MAC), and a second processing core configured to implement a physical layer (PHY). The PHY operates to receive a first data poll message from the MAC and transmit the message to an external device via the wireless transceiver. The PHY further operates to receive an acknowledge message including a frame pending value. If the frame pending value indicates that the external device does not have buffered data for the end device, the PHY generates a second data poll message based on the first data poll message, including incrementing one or more of a sequence number field value, a frame counter field value, and a message integrity check field of the first data poll message, thereby enabling the MAC to remain in a low power state while the PHY transmits the second data poll message.

An embodiment is a method performed by a wireless device to secure a control frame. The method includes generating the control frame, wherein the control frame includes a key ID field that appears before at least one field included in a body of the control frame and a message integrity check (MIC) field that appears after the at least one field, wherein the key ID field carries a key ID and a packet number, wherein the MIC field carries an authentication value for checking an integrity of the control frame. The method further includes transmitting the control frame.

This disclosure provides methods, components, devices and systems for secure control frames in wireless communications. Some aspects more specifically relate to security for control frames based on one or more fields included in the control frames. In some examples, a frame is transmitted with a control message integrity check (MIC) field (CMF) that includes an identifier of a security key, at least a portion of a packet number (PN), and at least a portion of an integrity check computed based on one or more portions of the frame including the control information and the security key. The CMF may be transmitted is separate parts, such as a first portion of the CMF that includes the identifier of the security key and at least the portion of the PN, and a second portion of the CMF that includes at least a truncated portion of the integrity check.

This disclosure provides methods, components, devices and systems for beacon extension design. A wireless station may receive one or more beacon containers including a beacon extension container and may communicate one or more messages based on segments of the one or more beacon containers that are relevant for the wireless station. Each segment may correspond to a respective device type. Each segment may include a frame check sequence and a message integrity code corresponding to each respective segment. The wireless station may receive a first beacon container according to a first periodicity and a second beacon container according to a second periodicity. The first and second periodicities may have different values based on the device type of the wireless station. The beacon containers may include type-specific segments corresponding to the device type. Each type-specific segment may include parameters or updated information for the wireless station.

The present invention discloses a secure and efficient authentication method for smart devices based on a consortium chain. The method is as follows: Step 1: A registration agency generates a challenge set and sends it to a sensor device. The sensor device calculates a response using a PUF and maps it to an elliptic curve group element. The final information is stored on the consortium chain; Step 2: The sensor device generates a signature and constructs a zero-knowledge proof, ensures message integrity and authentication by using the Fiat-Shamir heuristic transformation, and sends the generated proof to an edge device; Step 3: The edge device uses the received pseudonym and proof to verify the identity of the sensor device and the legitimacy of the message. After successful verification, the edge device adds the pseudonym to the used list and records the verification result in the consortium chain to ensure data transparency and immutability. The present invention enhances the security of device authentication and is suitable for scenarios such as the industrial Internet of Things that require high security and privacy protection.

The present application discloses a malicious node detection method and apparatus, a malicious node defense method and apparatus, and a device. The malicious node detection method comprises: on the basis of monitoring data of nodes in a network, determining forwarding success rates, message integrity, energy levels and resource scores of the nodes, wherein the message integrity represents the integrity of data packets forwarded by the nodes, the energy levels represent the activity levels and states of charge of the nodes, and the resource scores represent the transmission capabilities of the nodes; determining comprehensive trust values of the nodes on the basis of the forwarding success rates, message integrity and energy levels of the nodes, wherein the comprehensive trust values represent the credibility of the nodes; and inputting the comprehensive trust values, message integrity and resource scores of the nodes into a pre-trained classification decision model, and classifying the nodes into trusted nodes and untrusted nodes on the basis of the outputted classification results. In the present application, untrusted nodes can be identified before malicious behavior is fully exposed, thereby improving the overall security of a network.

The invention relates to a communication system with control frame protection. A communication system is provided in which an access point (AP) communicates with a station (STA). The AP may communicate with the STA according to a multi-basic service set identifier (M-BSSID) scheme. The AP may transmit an initial control frame (ICF) to an STA associated with a different BSSID of the AP. The AP may integrity protect the ICF by generating one or more control message integrity checks (CMICs) and inserting the CMICs into the ICF. The AP may use a BSSID-specific or BSSID-independent Control Frame Integrity Group Temporary Key (CIGTK) to generate a common CMIC that is shared across the BSSID. The CIGTK independent of the BSSID may be a newly defined Beacon Integrity Group Temporary Key (BIGTK), or may be a Beacon Integrity Group Temporary Key (BIGTK). As another example, the AP may generate a different CMIC for each BSSID in the ICF using a different BSSID-specific CIGTK for each BSSID.

A method for checking end-to-end SBI message integrity includes receiving a first traffic feed from a first NF, the first traffic feed including copies of SBI messages transmitted from the first NF to an SCP. The method further includes receiving a second traffic feed from a second NF, the second traffic feed including copies of SBI messages received by the second NF from the SCP. The method further includes identifying, from the first traffic feed, a copy of a first SBI message transmitted by the first NF to the SCP. The method further includes identifying, from the second traffic feed, a copy of a second SBI message received by the second NF from the SCP and that is associated with the copy of the first SBI message. The method further includes performing, using the message copies, an end-to-end SBI message integrity check for the first SBI message.

The invention discloses a user identity verification method and device, equipment, a storage medium and a product, and relates to the technical field of secure digital identity verification, and the method comprises the steps: storing biological characteristic data in an SIM card with high performance, and when a user needs to perform identity verification, sending the biological characteristic data to the SIM card; the platform side can read the biological characteristic data in the SIM card in various modes to realize complex biological characteristic data comparison; when the SIM card feeds back data, the biological characteristic metadata and the biological characteristic vector are encrypted in different modes in a segmented manner, so that secret key updating is realized in a biological characteristic information encryption process with a relatively high security requirement, and the security is improved; and meanwhile, signature verification and MAC message check codes are added to the whole data ciphertext, so that the message integrity and non-repudiation are ensured.

Disclosed are a method and apparatus for enhanced security in a wireless LAN system. A method performed by a first station (STA) in a wireless LAN system, according to an embodiment of the present disclosure, may comprise the steps of: constructing additional authentication data (AAD) on the basis of one or more fields or subfields of a medium access control (MAC) header of an MAC protocol data unit (MPDU); and transmitting, to a second STA, a physical layer PDU (PPDU) including the MPDU configured on the basis of the AAD. The MPDU includes a message integrity check (MIC) field, and a value of the MIC field may be based on at least the AAD. The one or more fields or subfields of the MAC header may include one or more of a duration / identifier (ID) field or at least a part of a high throughput (HT) control field.

Methods and device architectures for improving the energy efficiency of end devices in a wireless mesh network. In an example, an end device of the network includes a wireless transceiver, a first processing core configured to implement a media access control layer (MAC), and a second processing core configured to implement a physical layer (PHY). The PHY operates to receive a first data poll message from the MAC and transmit the message to an external device via the wireless transceiver. The PHY further operates to receive an acknowledge message including a frame pending value. If the frame pending value indicates that the external device does not have buffered data for the end device, the PHY generates a second data poll message based on the first data poll message, including incrementing one or more of a sequence number field value, a frame counter field value, and a message integrity check field of the first data poll message, thereby enabling the MAC to remain in a low power state while the PHY transmits the second data poll message.