155 results about "Pre-shared key" patented technology

A method for establishing connections and forming groups in an edge computing system includes detecting and identifying devices attempting to connect to the network using a processor. The method involves authenticating detected devices with a common pre-shared key (PSK) stored in memory, forming groups of connected devices based on predefined criteria, and sharing the PSK within each group via a secured channel. It also includes creating a subnetwork or private LAN for each subscriber using network configuration data, assigning virtual pre-shared keys (vPSKs) to devices based on service requirements, determining device capabilities by analyzing received device-specific information, and identifying supported applications based on device capabilities and application compatibility data stored in memory.

The invention provides a real estate full life cycle intelligent management method and system based on Internet of Things perception, and the method comprises the steps: distributing a unique hardware identifier of equipment, combining a lightweight digital certificate with a pre-shared key to achieve two-factor authentication, and storing a root certificate in a cloud end; an access authentication process is optimized, an identity label and a certificate signature request need to be submitted when a node accesses for the first time, a temporary session key is generated after the gateway verifies, and abnormal access is immediately isolated and reported; data integrity verification is implemented, and after a sensor collects data, an abstract is generated and data encryption transmission is carried out; after decryption, the receiving end recalculates the abstract for comparison, and if not, the abstract is discarded and nodes are marked to be abnormal; a data anomaly detection model is constructed, energy consumption fluctuation is determined based on historical data, a frequency baseline is collected, data reasonability is monitored in real time, secondary authentication is triggered when the data is abnormal, and node data access is suspended if the data fails; a hierarchical key system is established, hardware is solidified by a root key, session keys are alternated for 24 hours, and data encryption keys are dynamically derived and distributed through encryption channels.

The invention provides an IKE (Internet Key Exchange) protocol security enhancement method based on PUF (Physical Unclonable Function) dynamic authentication and a post-quantum mixed key, which organically combines a PUF, a post-quantum cryptographic algorithm (PQC, especially Kyber KEM) and an improved Internet Key Exchange Protocol (IKE) to realize key exchange of post-quantum security and enhanced identity authentication. The method comprises the following steps: generating a dynamic pre-shared key (PSK) by utilizing the PUF; the method comprises the following steps: integrating a Kyber KEM to an IKE protocol, and replacing traditional Diffie-Hellman key exchange; the PUF-driven dynamic PSK is used as an identity authentication method of the IKE; meanwhile, Kyber KEM and ECDH are adopted for key exchange, and a final session key is generated through joint participation of a Kyber negotiation key, an ECDH negotiation key and PSK derived by PUF; and an IKE protocol process is optimized, and Kyber key exchange and PUF (Physical Unclonable Function) authentication are completed in an IKESAINIT stage and an IKEINTERMEDIATE stage. According to the method, key exchange is post-quantum secure, identity authentication is also post-quantum secure, and the final key integrates three key components of Kyber, ECDH and PUF, so that triple security assurance is provided.

The invention discloses a data protection method for fusing a quantum key in a TLS, and relates to the technical field of quantum secret communication. According to the method, a quantum key is combined with a pre-shared key to perform identity authentication, and a pre-shared key database is continuously updated, so that the problem that a public key identity authentication system is easily attacked by quantum computing and the problem that the security is reduced due to repeated use of the pre-shared key in the existing method are solved; meanwhile, according to the method, a session key used in the communication process is generated by taking the quantum key as a key material through a preset key generation algorithm, so that the use of an unsafe traditional key exchange algorithm is avoided, and the security of data transmission is enhanced.

A method for automated device provisioning and management in an edge computing system includes retrieving self-provisioning parameters and device credentials from a database using a processor. The method involves adding a new device, determining if the allowed device limit for a group is exceeded, removing devices if necessary, and adding devices through a top-off process if the limit is not exceeded. It forms trusted and self-service device groups, monitors and manages devices based on policies, changes services or applications, dynamically changes device group associations, and assigns virtual pre-shared keys (vPSKs) to private LANs. The method also includes creating private LANs and virtual private clouds (vPCs), sharing device credentials with upstream services, and generating and using virtual networks (vNets) for device provisioning and management.

The invention designs a multi-device interconnection control system and a method thereof, and relates to the technical field of Internet of Things platforms, the system is based on a B / S architecture, comprises a device management end and an application server end, can collect and uniformly manage terminal device information, and can realize multi-device interconnection control through a configuration database, a controller format file, a configuration report and a software library. The system realizes equipment identification, software version control and configuration parameter management, comprises the following technologies: establishing a TLS / SSL encryption channel, performing identity verification by using a pre-shared key and an OAuth 2.0 authorization framework, supporting various PnP protocols and plug-in processing, adopting a digital twin technology, monitoring equipment states by a heartbeat mechanism and the like, and further provides a RESTFulAPI interface and a remote firmware upgrading function. And external system access request routing and protocol conversion are realized through the API gateway. According to the technical scheme, the challenge of multi-device interconnection in the prior art is effectively solved.

The invention provides a key authentication method and device and electronic equipment, and relates to the technical field of network security. In the application, firstly, user information is determined in a key authentication request sent by a user side, whether the user information is bound with a pre-shared key is judged, then when it is determined that the user information is not bound with the pre-shared key, whether an initial key sent by the user side is matched with a first key is judged, and if yes, the pre-shared key is sent to the user side. If yes, registering the first pre-shared key for the user side, and binding the first pre-shared key with the user information, so that the pre-shared key can be registered and authenticated based on the same signal, and the efficiency of user identity authentication is improved.

Systems and methods for implementing two-way tire pressure monitoring system (TPMS) learning and authenticated pairing. A random value may be used to determine a test value and a pairing PIN by use of a HMAC (Hash-based Message Authentication Code) function and a pre-shared key that is accessible to a TPMS sensor and a vehicle (e.g., controller system thereof). The random value and test value may be broadcasted by the TPMS sensor and received by the vehicle. The vehicle may calculate the pairing PIN using the random value and the pre-shared key.

Various arrangements for wireless network provisioning using a pre-shared key (PSK) are presented. A plurality of wireless network access profiles that indicate a plurality of PSKs may be stored. An access point may receive, from a wireless device, a first value based at on the PSK. The access point can transmit the first value to a cloud-based provisioning system. A plurality of values based on the plurality of PSKs of the plurality of wireless network access profiles may be created and a match between a second value of the plurality of values and the transmitted first value may be identified. A third value may be provided to the access point based on the PSK of the wireless network access profile of the plurality of wireless network access profiles used to generate the value. Network access can then be granted based on the third value.

The described techniques address issues to achieve key agreement without the need to exchange separate key agreement messages and, consequently, meets the stringent starting time requirements for real-time control systems. This is achieved using a group-wide key counter, with each node storing the latest value of this counter that was observed via the last received secured message. This counter value increases monotonically, and nodes maintain synchronization by transmitting this counter value (or a representation of the counter value) in each secured message. The use of key counters may be extended to guard against weak replay attacks via the implementation of a live membership tracking solution, which defines one or more membership groups. Each node within a membership group may request, or “challenge” other nodes with the same membership group at any time to verify their online status, and this online status may be maintained over time.

Method and system for to establishing session keys for protecting communication between nodes in a communication network. A mutual authentication is performed between a responding device and a trusted authentication service. Parameters used in the authentication are shared with one or more initiating nodes, clients, that are allowed to communicate with the responding device if authentication was successful. A secure session key is created independently by the device and clients using authentication parameters and pre-shared keys. Session keys created can be used to protect subsequent actual data communication. The described solution is not tied to any specific underlying transport protocol.

The invention provides an inter-micro-service dynamic secure communication method and device based on chaos cryptography. The method comprises the steps that a service provider instance registers a public key and chaos initial parameters to a service registration center; before calling, the service consumer instance acquires a public key and a chaos initial parameter of a target service provider instance from a service registration center; the service consumer instance performs key negotiation with the acquired public key by using a private key of the service consumer instance to determine a shared key; performing key derivation on the shared key and the chaotic initial parameter to generate an initial key; respectively using the initial keys to initialize the chaotic system so as to generate synchronous encryption key streams; and the two communication parties perform real-time stream encryption and decryption on the communication data between the micro-services by using the encryption key stream. The unpredictability of a chaotic system and modern cryptography can be combined, and a micro-service design mode is deeply integrated, so that a lightweight and high-security communication security mechanism which does not need to share a key in advance and can be adaptive to dynamic change of service is realized.

A method and apparatus are provided for automatically distributing pre-shared keys (PSKs) in a secure communication network. A first security association (SA) or secured message (SM) is created between two endpoints based on a first PSK. Then, one or more subsequent PSKs are distributed between the endpoints with secure communication support by the first SA or SM. Based on one of the subsequent PSKs, a second security association is formed between the endpoints. Messages between the endpoints can then be transmitted with secure communication support by the second SA or SM.

The invention relates to a security data isolation and information exchange method and system based on a lightweight protocol, belongs to the technical field of industrial automation control system security, and solves the technical problems of low transmission efficiency, high analysis overhead, high security risk and high resource consumption of an existing method. Comprising the following steps: collecting and preprocessing original plaintext data at an industrial control network side; an external unit identifier, a timestamp and a pre-shared key on the industrial control network side are used as encryption factors, lightweight stream cipher encryption and packaging are carried out on the preprocessed data, and a lightweight protocol data packet is generated; through a special physical isolation device, the light-weight protocol data packet subjected to deep detection is unidirectionally isolated and ferried from an industrial control network side to an internal network side; performing post-processing on the received lightweight protocol data packet at the intranet side to restore original data; and delivering the restored original plaintext data to an intranet service application. And safe and efficient information data exchange is realized.

A system and method for authenticating user access to a wireless network in which the wireless network is configured to support the use of individual pre-shared keys (PSKs) for verification even when operating under the Wi-Fi Protected Access Version 3 (WPA3) security protocol. Using the Wi-Fi Protected Access Version 2 (WPA2) security standard, the wireless network is designed to compile a lookup table linking the Media Access Control (MAC) address of a wireless device with a user-provided PSK. Subsequently, the network is able to authenticate the device under the WPA3 standard by extracting the user PSK from the lookup table using its MAC address and, in turn, performing the Simultaneous Authentication of Equals (SAE) secure key exchange protocol. Accordingly, wireless devices previously authorized for access under the WPA2 standard using a PSK can be efficiently transitioned for connection to the same network using the same PSK under the WPA3 standard.

The method provides an automated and scalable system for the generation, distribution, management of symmetric pre-shared keys (PSKs) to applications executing on headless and mobile devices. It helps achieve device protection, application security, and data protection with data authenticity and confidentiality in intra-device, inter-device, device-to-edge, and device-to-cloud communications. It helps Transport Layer Security (TLS) enabled applications dynamically acquire and renew PSKs and use identity hints for PSK based authentication ceremony during a TLS handshake. It helps manage and distribute API shared secrets and API access tokens required for authenticated API requests and API security. It helps applications (producers, brokers, and consumers of content) with PSKs for supply chain tamper resistance. It helps real-time low-latency applications with selective encryption of partial messages.

Disclosed in the embodiments of the present application are a secure communication method and apparatus based on a lightweight key algorithm, and a medium. The method comprises: generating a first temporary key on the basis of a pre-shared key, a first random number and a lightweight key algorithm; generating a first encryption result and a first message signature on the basis of the first temporary key, a session serial number, the first random number and identity identification information; on the basis of the first random number, the identity identification information, the first encryption result and the first message signature, generating a key negotiation request and sending same to a second Internet-of-Things device; receiving a negotiation reply message, and performing qualification authentication on the negotiation reply message; and if the qualification authentication is passed, generating a secure key on the basis of the first random number, a second random number, the pre-shared key and the lightweight key algorithm, encrypting a message to be sent, so as to generate an encrypted message, and sending the encrypted message to the second Internet-of-Things device. By means of implementing the method in the embodiments of the present application, the security of communication can be ensured, so as to make a communication process more flexible and efficient.

A process includes accessing a first message that is sent from an access point device. The first message includes data representing a second message that is sent by a client device. The second message is part of an exchange of messages between the client device and the access point device associated with authentication of the client device and a derivation of a first key used to encrypt and decrypt data communicated between the client device and the access point device. The second message includes a first message integrity check value. The process includes identifying, based on the second message, a pre-shared key corresponding to the client device. The identification of the pre-shared key includes determining a second message integrity check value based on a candidate pre-shared key of a plurality of candidate pre-shared keys; comparing the second message integrity check value with the first message integrity check value; and based on a result of the comparison, selecting the given candidate pre-shared key as the pre-shared key. The process includes determining a user role based on the pre-shared key. The process includes causing a third message to be sent to the access point device, where the third message includes data representing the pre-shared key and data representing the user role.

A method (400) is disclosed. The method includes establishing (402), at an Open Radio Access Network (O-RAN)-Radio Unit Controller (O-RU Controller), a session with an O-RU. In response to establishment of the session, the method includes configuring (404), at the O-RU controller one or more Media Access Control security (MACsec) configuration parameters for the O-RU. The one or more MACsec configuration parameters comprises at least a pre-shared key. The method also includes generating (406), at the O-RU controller, using a random number generator, at least one of a Secure Authentication Key (SAK) and a Key Encryption Key (KEK) based on the pre-shared key. Moreover, the method includes transmitting (408), from the O-RU controller to the O-RU, at least one of the one or more MACsec configuration parameters and the at least one of the SAK and the KEK.

An electronic device (such as an access point or a local electronic device in a common environment with a second electronic device) that performs authentication to a network is described. During operation, the electronic device may receive, from an authentication computer, authentication information. For example, the authentication information may include a dynamic pre-shared key (DPSK) associated with the second electronic device. Then, the electronic device may receive, from the second electronic device, an authentication request. Next, at least while communication with the authentication computer is available, the electronic device may perform authentication of the second electronic device to a network based at least in part on the authentication information.

The invention discloses a dynamic encryption authentication method for data communication equipment and a related device, and relates to the technical field of network security, and the method comprises the steps that an authentication server establishes an encryption communication channel based on a transport layer security protocol between a user terminal and the data communication equipment; on the channel, the authentication server receives the static identity credential of the user terminal for first verification; and after the verification is passed, the dynamic password is sent to the user terminal through the short message gateway, and the dynamic password submitted by the user terminal is subjected to second verification. When the user terminal initiates a control instruction, the authentication server sends a challenge value to the user terminal; the user terminal calculates a challenge value by using the pre-shared key, generates a response code and returns the response code to the authentication server; the authentication server verifies the validity of the response code, and forwards the control instruction to the target data communication equipment after the verification is passed; and the data communication device executes the instruction and records an execution event in a security audit log. According to the invention, the data transmission security and authentication efficiency of the data communication equipment in different network environments can be effectively improved.

Computer-implemented procedure, executed by a sync client (320), which includes: Receiving a request from a first application on a local device (302) to open a document which has a document identifier and is associated with a first file stored on a server (206), wherein the request includes the document identifier and a user identifier; Determine that a second file stored on the local device (302) is associated with the document identifier and that a user associated with the user identifier is authorized to access the second file; Sending (524) a list comprising one or more applications that are on the local device (302) and that are capable of opening the second file, based on the determination to the first application; Receiving (534) a specification of a second application selected from the list (528), from the first application; and Sending (536) a message to open the second file with the second application; including determining whether the user is authorized to access the second file: Received (606) from the first application, an authentication request containing an initial one-time key; Calculate (608) an initiation hash based on the first one-time key and a pre-shared key; Sending the initiation hash to the first application for verification; Received (614), from the first application, of an acknowledgment hash; and Verify (616) that the confirmation hash matches an independently calculated confirmation hash; wherein the first application is a browser (312) or a browser extension (324) associated with the browser (312).

The invention provides an intelligent reflector auxiliary challenge response physical layer authentication method and device, and the method is applied to a base station, and comprises the steps: transmitting a pilot signal to a user side through a target channel, so as to achieve the channel pre-sharing between the base station and the user side; under the condition that the transmitting power budget of the base station changes, a challenge signal is sent to the user side according to channel configuration information randomly selected from different pieces of channel configuration information; receiving an encryption response signal sent by the user side; and decrypting the encrypted response signal according to the randomly selected channel configuration information to obtain decrypted information, and performing identity authentication on the user side according to the decrypted information and the randomly selected channel configuration to obtain an authentication result. According to the method disclosed by the invention, the channel configuration assisted by the intelligent reflecting surface is used as the pre-shared key, so that the authentication problem caused by noise interference and inaccurate channel estimation in the prior art is effectively solved, and the authentication efficiency and the transmission security of the wireless communication physical layer are improved.

The present disclosure provides a method of performing user authentication in a quantum communication system. More specifically, the method includes transmitting an information sequence including at least one data block on the quantum channel, wherein based on a preshared key and at least one key generated based on the preshared key, a checking sequence for a quantum bit error rate (QBER) estimation is determined from each of the at least one data block, wherein the preshared key is used to select a location of a sequence included in the at least one data block; performing the user authentication based on a portion of the checking sequence; and performing a QBER estimation based on a result of the user authentication and a remaining checking sequence excluding the portion of the checking sequence. A user authentication error rate and a QBER estimation error rate are used for the QBER estimation.

The embodiment of the application provides a kind of based on pre-shared key authentication method, device and equipment, in the above-mentioned pre-shared key authentication method, device sends key acquisition request to first server, then receives the ciphertext of pre-shared key sent by first server, then the ciphertext of pre-shared key is decrypted, the plaintext of pre-shared key is obtained, and then according to the plaintext of pre-shared key, identity authentication or encryption and decryption service is carried out with second server, so that it can be realized by one first server with security authentication and authentication mechanism to store the ciphertext of pre-shared key encrypted by the key of equipment side, so that the security of pre-shared key is greatly improved, and in the above-mentioned method, key and ciphertext are separated, and first server does not have decryption capability (because first server does not have decryption key), so that the risk of pre-shared key leakage in first server end can be avoided.

An access point (AP), a method performed by the AP and a client (STA) for establishing a wireless connection are provided. Wherein the method executed by the AP comprises: providing a plurality of wireless networks having the same SSID and different BSSIDs, the plurality of wireless networks including a first wireless network supporting only a Wi-Fi protected access (WPA) protocol, a second wireless network supporting WPA and WPA2 protocols, and a third wireless network supporting WPA2 and WPA3 protocols; and in response to receiving an access request from the STA, establishing a wireless connection with the STA using the first wireless network, the second wireless network and the third wireless network in sequence, in which the first wireless network records a unique mapping relationship between the STA and a private pre-shared key (PSK) used by the STA during establishment of the wireless connection with the STA using the first wireless network, and the second wireless network records a unique mapping relationship between the STA and the private pre-shared key (PSK) used by the STA during establishment of the wireless connection with the STA using the third wireless network. To use the private PSK in the unique mapping relationship during establishment of a wireless connection with the STA using the second wireless network and the third wireless network.

Out-of-band quantum key distribution using cellular SMS can include receiving, from a user device, a client identifier that identifies the user device and a first key identifier that identifies a first key having a first key value that is a first quantumly generated random bit string. A second key that includes a second key value can be requested and received from the key service, the second key value including a second quantumly generated random bit string. The second key value can be provided to a short message service center for delivery to the user device. An operation can be performed on the first key value and the second key value to obtain a copy of a pre-shared key, which can be used when exchanging encrypted communications with the user device.

Techniques for utilizing post-quantum pre-shared key (PPK) identifiers (PPK_ID) to determine control association key(s) (CAK(s)) and / or secure association key(s) (SAK(s)) utilized in MACsec sessions are described herein. A key server (KS) and a non-key server (NKS) may advertise capabilities indicating an ability to utilize PPKs as CAKs and / or SAKs in MACsec sessions. The KS may leverage a quantum key distribution (QKD) service to determine a PPK_ID and a PPK, which may be utilized as a CAK for a MACsec session with the NKS. The PPK_ID may be transmitted to the NKS, where the NKS may retrieve the PPK from the QKD, and a new group connectivity association may be established using the PPK as the CAK. In some examples, the KS may be configured to refresh the PPK as the CAK for instantiating subsequent MACsec sessions. Additionally, the KS may be configured to distribute a SAK in a similar manner.

A method for preparing contents to be provided from a hardware security module, HSM, to an integrated Secure Element, iSE, comprising: • a) provide in the HSM a pre-shared key, PSK, which is derived from a universal key-derivation constant, KDC, permanently stored in the iSE, and a first seed (SI), wherein the KDC is identical for a multitude of multiple iSEs, and the first seed (51) is specific or unique for a specific contents provider (CP) of said contents; • b) in the HSM, provide a second seed (S2) which is specific or unique for the iSE, and from the PSK and the second seed, apply a CEK-key-derivation scheme so as to derive a code encryption key, CEK; • c) in the HSM, encrypt the code package with the code encryption key, CEK, and by applying a code encryption scheme, so as to generate an encrypted code package (OS packet); • d) in the HSM, generate a header including the second seed (S2) and, if required: information on the code encryption scheme of step c) or / and information on the CEK-key-derivation scheme of step b); • e) in the HMS, encrypt the header with the PSK, or with a header encryption key derived from the PSK, and by applying a header encryption scheme, so as to generate an encrypted header (Header); • f) in the HSM, merge the encrypted code package (OS packet) and the encrypted header (Header) so as to create a binary large object, BLOB, to be transferred to the iSE.

A method for establishing connections and forming groups in an edge computing system includes detecting and identifying devices attempting to connect to the network using a processor. The method involves authenticating detected devices with a common pre-shared key (PSK) stored in memory, forming groups of connected devices based on predefined criteria, and sharing the PSK within each group via a secured channel. It also includes creating a subnetwork or private LAN for each subscriber using network configuration data, assigning virtual pre-shared keys (vPSKs) to devices based on service requirements, determining device capabilities by analyzing received device-specific information, and identifying supported applications based on device capabilities and application compatibility data stored in memory.