131 results about "Pre-shared key" patented technology

The invention provides a real estate full life cycle intelligent management method and system based on Internet of Things perception, and the method comprises the steps: distributing a unique hardware identifier of equipment, combining a lightweight digital certificate with a pre-shared key to achieve two-factor authentication, and storing a root certificate in a cloud end; an access authentication process is optimized, an identity label and a certificate signature request need to be submitted when a node accesses for the first time, a temporary session key is generated after the gateway verifies, and abnormal access is immediately isolated and reported; data integrity verification is implemented, and after a sensor collects data, an abstract is generated and data encryption transmission is carried out; after decryption, the receiving end recalculates the abstract for comparison, and if not, the abstract is discarded and nodes are marked to be abnormal; a data anomaly detection model is constructed, energy consumption fluctuation is determined based on historical data, a frequency baseline is collected, data reasonability is monitored in real time, secondary authentication is triggered when the data is abnormal, and node data access is suspended if the data fails; a hierarchical key system is established, hardware is solidified by a root key, session keys are alternated for 24 hours, and data encryption keys are dynamically derived and distributed through encryption channels.

The invention provides an IKE (Internet Key Exchange) protocol security enhancement method based on PUF (Physical Unclonable Function) dynamic authentication and a post-quantum mixed key, which organically combines a PUF, a post-quantum cryptographic algorithm (PQC, especially Kyber KEM) and an improved Internet Key Exchange Protocol (IKE) to realize key exchange of post-quantum security and enhanced identity authentication. The method comprises the following steps: generating a dynamic pre-shared key (PSK) by utilizing the PUF; the method comprises the following steps: integrating a Kyber KEM to an IKE protocol, and replacing traditional Diffie-Hellman key exchange; the PUF-driven dynamic PSK is used as an identity authentication method of the IKE; meanwhile, Kyber KEM and ECDH are adopted for key exchange, and a final session key is generated through joint participation of a Kyber negotiation key, an ECDH negotiation key and PSK derived by PUF; and an IKE protocol process is optimized, and Kyber key exchange and PUF (Physical Unclonable Function) authentication are completed in an IKESAINIT stage and an IKEINTERMEDIATE stage. According to the method, key exchange is post-quantum secure, identity authentication is also post-quantum secure, and the final key integrates three key components of Kyber, ECDH and PUF, so that triple security assurance is provided.

The described techniques address issues to achieve key agreement without the need to exchange separate key agreement messages and, consequently, meets the stringent starting time requirements for real-time control systems. This is achieved using a group-wide key counter, with each node storing the latest value of this counter that was observed via the last received secured message. This counter value increases monotonically, and nodes maintain synchronization by transmitting this counter value (or a representation of the counter value) in each secured message. The use of key counters may be extended to guard against weak replay attacks via the implementation of a live membership tracking solution, which defines one or more membership groups. Each node within a membership group may request, or “challenge” other nodes with the same membership group at any time to verify their online status, and this online status may be maintained over time.

The invention provides an inter-micro-service dynamic secure communication method and device based on chaos cryptography. The method comprises the steps that a service provider instance registers a public key and chaos initial parameters to a service registration center; before calling, the service consumer instance acquires a public key and a chaos initial parameter of a target service provider instance from a service registration center; the service consumer instance performs key negotiation with the acquired public key by using a private key of the service consumer instance to determine a shared key; performing key derivation on the shared key and the chaotic initial parameter to generate an initial key; respectively using the initial keys to initialize the chaotic system so as to generate synchronous encryption key streams; and the two communication parties perform real-time stream encryption and decryption on the communication data between the micro-services by using the encryption key stream. The unpredictability of a chaotic system and modern cryptography can be combined, and a micro-service design mode is deeply integrated, so that a lightweight and high-security communication security mechanism which does not need to share a key in advance and can be adaptive to dynamic change of service is realized.

A method and apparatus are provided for automatically distributing pre-shared keys (PSKs) in a secure communication network. A first security association (SA) or secured message (SM) is created between two endpoints based on a first PSK. Then, one or more subsequent PSKs are distributed between the endpoints with secure communication support by the first SA or SM. Based on one of the subsequent PSKs, a second security association is formed between the endpoints. Messages between the endpoints can then be transmitted with secure communication support by the second SA or SM.

The invention relates to a security data isolation and information exchange method and system based on a lightweight protocol, belongs to the technical field of industrial automation control system security, and solves the technical problems of low transmission efficiency, high analysis overhead, high security risk and high resource consumption of an existing method. Comprising the following steps: collecting and preprocessing original plaintext data at an industrial control network side; an external unit identifier, a timestamp and a pre-shared key on the industrial control network side are used as encryption factors, lightweight stream cipher encryption and packaging are carried out on the preprocessed data, and a lightweight protocol data packet is generated; through a special physical isolation device, the light-weight protocol data packet subjected to deep detection is unidirectionally isolated and ferried from an industrial control network side to an internal network side; performing post-processing on the received lightweight protocol data packet at the intranet side to restore original data; and delivering the restored original plaintext data to an intranet service application. And safe and efficient information data exchange is realized.

A system and method for authenticating user access to a wireless network in which the wireless network is configured to support the use of individual pre-shared keys (PSKs) for verification even when operating under the Wi-Fi Protected Access Version 3 (WPA3) security protocol. Using the Wi-Fi Protected Access Version 2 (WPA2) security standard, the wireless network is designed to compile a lookup table linking the Media Access Control (MAC) address of a wireless device with a user-provided PSK. Subsequently, the network is able to authenticate the device under the WPA3 standard by extracting the user PSK from the lookup table using its MAC address and, in turn, performing the Simultaneous Authentication of Equals (SAE) secure key exchange protocol. Accordingly, wireless devices previously authorized for access under the WPA2 standard using a PSK can be efficiently transitioned for connection to the same network using the same PSK under the WPA3 standard.

The method provides an automated and scalable system for the generation, distribution, management of symmetric pre-shared keys (PSKs) to applications executing on headless and mobile devices. It helps achieve device protection, application security, and data protection with data authenticity and confidentiality in intra-device, inter-device, device-to-edge, and device-to-cloud communications. It helps Transport Layer Security (TLS) enabled applications dynamically acquire and renew PSKs and use identity hints for PSK based authentication ceremony during a TLS handshake. It helps manage and distribute API shared secrets and API access tokens required for authenticated API requests and API security. It helps applications (producers, brokers, and consumers of content) with PSKs for supply chain tamper resistance. It helps real-time low-latency applications with selective encryption of partial messages.

Disclosed in the embodiments of the present application are a secure communication method and apparatus based on a lightweight key algorithm, and a medium. The method comprises: generating a first temporary key on the basis of a pre-shared key, a first random number and a lightweight key algorithm; generating a first encryption result and a first message signature on the basis of the first temporary key, a session serial number, the first random number and identity identification information; on the basis of the first random number, the identity identification information, the first encryption result and the first message signature, generating a key negotiation request and sending same to a second Internet-of-Things device; receiving a negotiation reply message, and performing qualification authentication on the negotiation reply message; and if the qualification authentication is passed, generating a secure key on the basis of the first random number, a second random number, the pre-shared key and the lightweight key algorithm, encrypting a message to be sent, so as to generate an encrypted message, and sending the encrypted message to the second Internet-of-Things device. By means of implementing the method in the embodiments of the present application, the security of communication can be ensured, so as to make a communication process more flexible and efficient.

A method (400) is disclosed. The method includes establishing (402), at an Open Radio Access Network (O-RAN)-Radio Unit Controller (O-RU Controller), a session with an O-RU. In response to establishment of the session, the method includes configuring (404), at the O-RU controller one or more Media Access Control security (MACsec) configuration parameters for the O-RU. The one or more MACsec configuration parameters comprises at least a pre-shared key. The method also includes generating (406), at the O-RU controller, using a random number generator, at least one of a Secure Authentication Key (SAK) and a Key Encryption Key (KEK) based on the pre-shared key. Moreover, the method includes transmitting (408), from the O-RU controller to the O-RU, at least one of the one or more MACsec configuration parameters and the at least one of the SAK and the KEK.

An electronic device (such as an access point or a local electronic device in a common environment with a second electronic device) that performs authentication to a network is described. During operation, the electronic device may receive, from an authentication computer, authentication information. For example, the authentication information may include a dynamic pre-shared key (DPSK) associated with the second electronic device. Then, the electronic device may receive, from the second electronic device, an authentication request. Next, at least while communication with the authentication computer is available, the electronic device may perform authentication of the second electronic device to a network based at least in part on the authentication information.

The invention discloses a dynamic encryption authentication method for data communication equipment and a related device, and relates to the technical field of network security, and the method comprises the steps that an authentication server establishes an encryption communication channel based on a transport layer security protocol between a user terminal and the data communication equipment; on the channel, the authentication server receives the static identity credential of the user terminal for first verification; and after the verification is passed, the dynamic password is sent to the user terminal through the short message gateway, and the dynamic password submitted by the user terminal is subjected to second verification. When the user terminal initiates a control instruction, the authentication server sends a challenge value to the user terminal; the user terminal calculates a challenge value by using the pre-shared key, generates a response code and returns the response code to the authentication server; the authentication server verifies the validity of the response code, and forwards the control instruction to the target data communication equipment after the verification is passed; and the data communication device executes the instruction and records an execution event in a security audit log. According to the invention, the data transmission security and authentication efficiency of the data communication equipment in different network environments can be effectively improved.

Computer-implemented procedure, executed by a sync client (320), which includes: Receiving a request from a first application on a local device (302) to open a document which has a document identifier and is associated with a first file stored on a server (206), wherein the request includes the document identifier and a user identifier; Determine that a second file stored on the local device (302) is associated with the document identifier and that a user associated with the user identifier is authorized to access the second file; Sending (524) a list comprising one or more applications that are on the local device (302) and that are capable of opening the second file, based on the determination to the first application; Receiving (534) a specification of a second application selected from the list (528), from the first application; and Sending (536) a message to open the second file with the second application; including determining whether the user is authorized to access the second file: Received (606) from the first application, an authentication request containing an initial one-time key; Calculate (608) an initiation hash based on the first one-time key and a pre-shared key; Sending the initiation hash to the first application for verification; Received (614), from the first application, of an acknowledgment hash; and Verify (616) that the confirmation hash matches an independently calculated confirmation hash; wherein the first application is a browser (312) or a browser extension (324) associated with the browser (312).

The present disclosure provides a method of performing user authentication in a quantum communication system. More specifically, the method includes transmitting an information sequence including at least one data block on the quantum channel, wherein based on a preshared key and at least one key generated based on the preshared key, a checking sequence for a quantum bit error rate (QBER) estimation is determined from each of the at least one data block, wherein the preshared key is used to select a location of a sequence included in the at least one data block; performing the user authentication based on a portion of the checking sequence; and performing a QBER estimation based on a result of the user authentication and a remaining checking sequence excluding the portion of the checking sequence. A user authentication error rate and a QBER estimation error rate are used for the QBER estimation.

The embodiment of the application provides a kind of based on pre-shared key authentication method, device and equipment, in the above-mentioned pre-shared key authentication method, device sends key acquisition request to first server, then receives the ciphertext of pre-shared key sent by first server, then the ciphertext of pre-shared key is decrypted, the plaintext of pre-shared key is obtained, and then according to the plaintext of pre-shared key, identity authentication or encryption and decryption service is carried out with second server, so that it can be realized by one first server with security authentication and authentication mechanism to store the ciphertext of pre-shared key encrypted by the key of equipment side, so that the security of pre-shared key is greatly improved, and in the above-mentioned method, key and ciphertext are separated, and first server does not have decryption capability (because first server does not have decryption key), so that the risk of pre-shared key leakage in first server end can be avoided.

An access point (AP), a method performed by the AP and a client (STA) for establishing a wireless connection are provided. Wherein the method executed by the AP comprises: providing a plurality of wireless networks having the same SSID and different BSSIDs, the plurality of wireless networks including a first wireless network supporting only a Wi-Fi protected access (WPA) protocol, a second wireless network supporting WPA and WPA2 protocols, and a third wireless network supporting WPA2 and WPA3 protocols; and in response to receiving an access request from the STA, establishing a wireless connection with the STA using the first wireless network, the second wireless network and the third wireless network in sequence, in which the first wireless network records a unique mapping relationship between the STA and a private pre-shared key (PSK) used by the STA during establishment of the wireless connection with the STA using the first wireless network, and the second wireless network records a unique mapping relationship between the STA and the private pre-shared key (PSK) used by the STA during establishment of the wireless connection with the STA using the third wireless network. To use the private PSK in the unique mapping relationship during establishment of a wireless connection with the STA using the second wireless network and the third wireless network.

Out-of-band quantum key distribution using cellular SMS can include receiving, from a user device, a client identifier that identifies the user device and a first key identifier that identifies a first key having a first key value that is a first quantumly generated random bit string. A second key that includes a second key value can be requested and received from the key service, the second key value including a second quantumly generated random bit string. The second key value can be provided to a short message service center for delivery to the user device. An operation can be performed on the first key value and the second key value to obtain a copy of a pre-shared key, which can be used when exchanging encrypted communications with the user device.

Techniques for utilizing post-quantum pre-shared key (PPK) identifiers (PPK_ID) to determine control association key(s) (CAK(s)) and / or secure association key(s) (SAK(s)) utilized in MACsec sessions are described herein. A key server (KS) and a non-key server (NKS) may advertise capabilities indicating an ability to utilize PPKs as CAKs and / or SAKs in MACsec sessions. The KS may leverage a quantum key distribution (QKD) service to determine a PPK_ID and a PPK, which may be utilized as a CAK for a MACsec session with the NKS. The PPK_ID may be transmitted to the NKS, where the NKS may retrieve the PPK from the QKD, and a new group connectivity association may be established using the PPK as the CAK. In some examples, the KS may be configured to refresh the PPK as the CAK for instantiating subsequent MACsec sessions. Additionally, the KS may be configured to distribute a SAK in a similar manner.

A method for establishing connections and forming groups in an edge computing system includes detecting and identifying devices attempting to connect to the network using a processor. The method involves authenticating detected devices with a common pre-shared key (PSK) stored in memory, forming groups of connected devices based on predefined criteria, and sharing the PSK within each group via a secured channel. It also includes creating a subnetwork or private LAN for each subscriber using network configuration data, assigning virtual pre-shared keys (vPSKs) to devices based on service requirements, determining device capabilities by analyzing received device-specific information, and identifying supported applications based on device capabilities and application compatibility data stored in memory.

In one aspect, a method for packet orchestration to provide data encryption at the internet protocol (IP) layer, includes the step of providing a quantum secure pre-shared key derivation scheme for a data link layer bulk encryption algorithm, meaning the ability to setup a separate communication channel, via the SSH protocol, and leverage ECDH over said channel to share pre-shared keys. The method includes the step of providing a set of software-based network bridges. The method includes the step of assigning a set of network ports to specific bridges, wherein the set of network ports implement segmentation and isolation based on an organizational policy.

The present invention relates to a method for secure Application-to-Person, A2P, short messaging service, SMS, communication at a network node. The method comprises receiving an A2P SMS from an A2P sender for delivery to a subscriber and determining that the A2P SMS requires secure A2P SMS delivery to the subscriber. The method also comprises encrypting a payload of the A2P SMS using at least one pre-shared key, PSK, and an encryption algorithm, wherein the at least one PSK and the encryption algorithm have been securely provided to a SIM associated with the subscriber. The method further comprises encoding the encrypted A2P SMS payload to obtain an encoded A2P SMS payload and relaying the encoded A2P SMS payload to the SIM. A method for communication at a subscriber device comprising a SIM associated with a subscriber.

A server configured to provide a pre-shared key “PSK” with a first user node, to allow a first user node and a second user node to share a PSK, the server comprising:a network interface; an authentication unit; an encryption unit; a key management system and a quantum key distribution unit,the authentication unit being configured to receive a request for authentication, via the network interface, of a first channel between a first user node and the server,the quantum key distribution unit being configured to allow a quantum key to be distributed between the first user node and the server, the quantum key being sifted using communication over the authenticated first channel to establish a first quantum key for the first user and server,the key management system being configured to provide a first PSK for the first user to allow the first user to authenticate with the second user,the encryption unit being configured to encrypt the first PSK with the quantum key to send to the first user node via the network interface.

In some examples, a system receives, from an identity and access management server, information of whether a portal for obtaining pre-shared keys (PSKs) is enabled. Responsive to receiving an indication that the portal for obtaining PSKs is enabled, the system adds, to a policy, a service set identifier (SSID) that is associated with use of a multi-pre-shared key (MPSK) arrangement. The system retrieves, in response to the policy, a reference useable by wireless devices to obtain respective PSKs of the wireless devices, and outputs a representation of the reference to share with the wireless devices to obtain from the portal the respective PSKs by the wireless devices for connecting to the WLAN.

Various aspects of the present disclosure relate to establishing security in a common application programming interface framework. An apparatus for wireless communication implements a first common application programming interface (API) framework (CAPIF) core function (CCF). The apparatus receives a first signaling indicating a first authentication request corresponding to an API invoker, the first authentication request including one or more of an API invoker identifier (ID) of the API invoker, an API exposing function (AEF) information, or service API information. The apparatus transmits, to a second CCF, a second signaling indicating a second authentication request, wherein the second authentication request includes one or more of the API invoker ID, an API invoker uniform resource indicator (URI), the indication of the AEF, the service API information, a pre-shared key for the AEF, or a root certifying authority (CA) for a certificate of the API invoker.

The present invention proposes a lightweight data security transmission method and system for wireless sensor networks. The method includes the following steps: upon network access, a central node distributes a pre-shared key, initialization vector, node sequence number, and packet sequence number to wireless sensor network nodes, and sets a corresponding key update interval and key retention time based on network scale and node performance; after network node deployment, the network nodes directly synchronize with the central node to calculate the initialization seed required for the key sequence generation algorithm; the sender and receiver implement full-duplex secure encrypted communication based on the synchronized session key; and the sender or receiver updates the session key after a preset key update interval to ensure key freshness. While ensuring secure data transmission, the present invention effectively reduces network overhead by reducing the number of interactions. It also requires low computing power and storage space on network nodes, achieving the advantages of both security and lightweightness.

Described herein are technologies for application authentication and / or data encryption without stored pre-shared keys. In one resource controller, a processing device receives an application identifier (ID) from the application. The processing device provides a current nonce responsive to the application ID and provides the application access to the system resource responsive to determining that a hash of a current key received from the application equals a current tag. The current key is generated by the application based on code of the application and the current nonce. The current tag was previously provided from the application to the resource controller. The current tag can also be hashed by the application using the current key.

The present application provides a shared key update method and system, the method is applied in a shared key update system, the shared key update system includes an Internet of Things device and a key management server, the method includes: the Internet of Things device sends an encryption request to the key management server; the key management server receives the encryption request and generates a new shared key when the verification is successful; the key management server sends an encrypted reply to the Internet of Things device; the Internet of Things device receives the encrypted reply and decrypts it to obtain a new shared key; the Internet of Things device uses the new shared key to update the shared key when the verification is successful. It can be seen that the implementation of this implementation method can effectively ensure that the Internet of Things device can continuously update the corresponding pre-shared key, thereby greatly avoiding the situation where the update cannot be performed and the problem that a large number of Internet of Things devices use the same pre-shared key.

Example embodiments of the present disclosure are directed to mixing pre-shared keys with post-quantum cryptography. A method comprises sending a key exchange request to a second apparatus, wherein the key exchange request comprises at least a first public key generated using a post-quantum cryptography (PQC) key generation mechanism (KEM), and information indicating that a post-quantum pre-shared key (PPK) is used; receiving a response from the second apparatus, wherein the response to the key exchange request comprises at least a first responder ciphertext generated based on the first public key using the PQC KEM by the second apparatus and information indicating that a PPK is used; and generating a seed key based on a first PQC KEM shared secret extracted from the first responder ciphertext, wherein the seed key is used to derive one or more intermediate cryptographic keys which are then mixed with the PPK using a pseudorandom function to derive one or more cryptographic keys used for security and authenticity of the communication between the first apparatus and the second apparatus.

The invention discloses a forward security zero round-trip time authentication method and system based on a hash function, and the method comprises the steps: generating a first random number, a first private key and a corresponding public key through a client, encrypting application data through combining with a temporary session key, and constructing a protocol request message for transmission; the server generates a second random number, a second private key and a public key after verification, returns a protocol response message, and negotiates a shared key based on temporary private keys of the two parties; the two parties derive a new pre-shared key, a temporary session key and a session key using the shared key and a hash function. And the temporary private key is discarded after being used, so that the historical session still has forward security even if the key is leaked for a long time, and 0-RTT data transmission is supported at the same time. According to the invention, the shared key based on temporary private key negotiation is introduced, and the hash function is combined to derive and dynamically update the pre-shared key and the temporary session key, so that authentication key exchange with forward security and 0-RTT low-delay characteristics is realized.

The present disclosure provides a method of performing user authentication in a quantum communication system. More specifically, the method comprises: transmitting an information sequence comprising at least one data block to a receiving end on a quantum channel, based on (i) a pre-shared key between the transmitting end and the receiving end and (ii) at least one key generated based on the pre-shared key, determining, from each of the at least one data block, a check sequence for quantum bit error rate (QBER) estimation for determining whether eavesdropping exists on the quantum channel, in which the pre-shared key is used to select a position of a sequence for user authentication among sequences included in a specific data block related to user authentication among the at least one information block; performing user authentication with the receiving end based on a portion of the check sequence determined from each of the at least one data block; and performing a QBER estimation with the receiving end based on i) a result of the user authentication and (ii) a remaining check sequence excluding a portion of the check sequence determined from each of the at least one data block. (i) a user authentication error rate calculated based on a portion of a check sequence for user authentication and determined from each of the at least one data block, and (ii) a QBER estimation error rate calculated based on a remaining check sequence excluding the portion of the check sequence determined from each of the at least one data block is used for the QBER estimation.