44 results about "Public-key cryptography" patented technology

The invention relates to the technical field of information security, in particular to an anti-quantum computing public key cryptography method and system. The method comprises the following steps: acquiring a large prime number p and constructing a multivariable polynomial ring; randomly generating a group of polynomial coefficients, generating a polynomial embedding rule public key, and generating a multivariable polynomial ring embedding public key; the method comprises the following steps: acquiring a quantum computer message, performing polynomial space mapping conversion and message public key encryption, and meanwhile, generating a quantum message public key encrypted ciphertext by introducing a polynomial perturbation term and a transcendental coding term; the quantum message public key encryption ciphertext and the corresponding polynomial ring embedded public key are transmitted to a quantum message decryption party for inversion decryption processing, and a quantum computer message decryption plaintext is generated; and performing anti-quantum computing security analysis on the encryption and decryption processes, and regenerating a multivariable polynomial ring dynamic public key. According to the method, the attack of quantum computing can be effectively resisted, so that the security of quantum information transmission is guaranteed.

The disclosed systems and methods are directed to an implementation of time-based authentication with a contactless card based on remotely provisioned timing data. In one described implementation the timing information is provided by an external agent such as a client device and / or a remote verification server associated with the user account. The timing information is then incorporated into a cryptogram generation process executing on the contactless card, resulting in creation of an encrypted time-based token. The authentication request message that includes the time-based authentication token, may be further supplemented by the inclusion of the timing information separately encoded using, for example, public key cryptography. This modification of the authentication request message generated by the contactless card, enables an additional time-based filtering mechanism that may be performed by a third-party client device.

The present invention realizes a remote signature system in which identity verification is performed for each signing request by combining the remote signature system with public key cryptography. A terminal device (2) comprises a means for generating a key pair for authentication to perform the public key cryptography. A generated secret key is stored in the terminal device (2), and a generated public key is transmitted to the tamper resistant device (5) and is stored in relation with the corresponding signature key. The tamper resistant device comprises a signature key storage means (12) for storing the signature key, a decryption key and signature key identification information as pairs for each user. When requesting a digital signing, a signing request including the signature key identification information, plaintext verification information, and a crypto token including the encrypted verification information and the encrypted signature object data is created and is transmitted to the tamper resistant device (5). The tamper resistant device accesses to the signature key storage means (12) and searches both the decryption key and the signature key. The tamper resistant device decrypts the crypto token using the searched decryption key, and verifies consistency between the decrypted verification information and the plaintext verification information. If they do not match each other, the signing request is excluded from the digital signing.

A computer-implemented method and system for managing an authentication between user devices and authentication servers, is disclosed. The computer-implemented method includes: obtaining user credentials associated with users; retrieving information associated with device fingerprints corresponding to the user devices; generating cipher messages by at least one of: creating random numbers and encrypting the random numbers with keys derived from at least one of: the first and second index; transmitting the one or more user identities, the first index, the second index, and the cipher messages, to authentication servers; dynamically generating the private keys from private key variables; generating authentication responses by decoding authentication based questions obtained from the authentication servers, using cipher messages and the private keys; and transmitting the authentication responses to the authentication servers for adapting the authentication servers to authenticate the user devices.

The invention discloses a mutual trust authentication and key negotiation method for a vehicle and a roadside unit, relates to identity authentication of a communication entity of the Internet of Vehicles, and belongs to the field of information security of the Internet of Vehicles. The method comprises the following steps: presetting a trusted center key, and embedding an unclonable device into the communication entity; after the registration response is received, the communication entity stores the triad in a memory of the communication entity; the method comprises the following steps: constructing authentication messages based on an identity label, a password, a timestamp and an elliptic curve public key cryptographic algorithm of a communication entity, and realizing communication entity identity mutual trust authentication and session key negotiation through interaction of the authentication messages and verification of a to-be-verified parameter; after the identity mutual trust authentication is passed, the receiving communication entity verifies the integrity of the received key message; the trusted center can track the identity of a false message sender; and the communication entity adds the false identity of the false message sender to the incremental false identity revocation list of the false message sender to complete revocation of the false message sender, so that the authentication efficiency of the vehicle and the road side unit is improved.

This information processing device is provided with: a storage unit for storing a unique number for specifying a vehicle or an in-vehicle electronic device; a vehicle selection unit that selects a vehicle to which the update software is applied; a key generation unit that generates a key using, as a public key, at least one of the unique numbers of the selected vehicle and the in-vehicle electronic device mounted on the vehicle; an encryption unit that encrypts the update software using the key and generates encrypted update software; and a distribution unit that distributes the encrypted update software to the vehicle.

A cryptographic cold storage apparatus and system. Embodiments of the present disclosure provide for a cold storage apparatus configured to generate a private key, compute an associated PK / PKY and display the latter on a visual display screen. An associated interface apparatus is configured to retrieve the PK / PKH optically and store it in memory. The interface apparatus is configured to produce an associated message and render it at a visual display. The cold storage apparatus may retrieve the message optically, and cryptographically sign the message utilizing one or more public key cryptography methods. The cold storage apparatus produces a graphical output comprising the signed message and renders it at the visual display. The interface apparatus retrieves the signed message and verifies that the cold storage apparatus signed the message, utilizing the public key cryptography methods.

The invention discloses a digital certificate request file generation and verification method supporting an anti-quantum algorithm. The method comprises the following steps that T1, a user generates a traditional public key password signature key pair, an anti-quantum password signature key pair and an anti-quantum password encryption temporary key pair; t2, the user calculates a hybrid public key, performs hybrid signature on the hybrid public key, generates a hybrid signature certificate request file, and sends the hybrid signature certificate request file to the certificate issuing system; t3, the user calculates a temporary key request message, performs hybrid signature on the temporary key request message, generates an anti-quantum encryption temporary key request file of the hybrid signature, and sends the anti-quantum encryption temporary key request file to the certificate issuing system; t4, the certificate issuing system verifies the mixed signature certificate request file; and T5, the certificate issuing system verifies the anti-quantum encryption temporary key request file of the mixed signature. The method not only has the capability of resisting the quantum computing attack, but also can ensure the compatibility with the existing traditional PKI facility, and meanwhile, the security of the certificate request process is remarkably improved.

The invention discloses an anti-quantum public key cryptographic operation method and device based on a reconfigurable technology, and belongs to the technical field of electronic circuits and quantum encryption. The anti-quantum public key cryptographic operation device based on the reconfigurable technology comprises a first processing module used for determining a first cryptographic algorithm and a first rule associated with first target information according to the acquired first target information; the second processing module is used for performing a series of operations according to the first target information, a first cryptographic algorithm and a first rule sent by the first processing module to obtain a first operation result; the algorithm development and verification module is used for providing a reconfigurable operation module resource interface to complete development and verification of a cryptographic algorithm and compiling the cryptographic algorithm into a machine code; and the storage module is used for storing data and files including the compiled cryptographic algorithm, the first target information, the first cryptographic algorithm, the first rule, data in operation and operation result data.

The disclosed systems and methods are directed to an implementation of time-based authentication with a contactless card based on remotely provisioned timing data. In one described implementation the timing information is provided by an external agent such as a client device and / or a remote verification server associated with the user account. The timing information is then incorporated into a cryptogram generation process executing on the contactless card, resulting in creation of an encrypted time-based token. The authentication request message that includes the time-based authentication token, may be further supplemented by the inclusion of the timing information separately encoded using, for example, public key cryptography. This modification of the authentication request message generated by the contactless card, enables an additional time-based filtering mechanism that may be performed by a third-party client device.

The application is suitable for the field of information security technology, and provides a certificateless signature generation method and system based on SM9, which comprises the following steps: step S100, system initialization, selecting a master private key from the system, and calculating a master public key according to the master private key; step S200, extracting a partial private key, extracting the partial private key as a partial private key of a signer through the master private key; step S300, setting a secret value, selecting a signer secret value; and step S400, setting a public key. The application is based on the SM9 signature structure, then the certificateless cryptography, and an improved certificateless signature of SM9 is proposed. Compared with the traditional public key cryptography system, the application effectively guarantees the integrity and authenticity of data in the transmission process, fills the gap of the domestic identity cryptography system, and lays a solid underlying cryptography foundation for the application level security.

The application provides a power plant data security processing method, and belongs to the technical field of power Internet of Things security and privacy computing, which can at least partially solve the problems of complex certificate management of power plant monitoring system, large data aggregation calculation overhead and privacy leakage risk of cloud analysis in the prior art. The application comprises: generating a double-factor private key based on a certificateless public key cryptography system; serializing and encoding multi-dimensional operation data into a single integer using the Chinese remainder theorem; performing homomorphic encryption and signature on the encoded data using the double-factor private key, verifying the signature in batches on the edge side and aggregating in the ciphertext state; loading a neural network model adapted to homomorphic encryption on the cloud to perform ciphertext domain reasoning on the aggregated ciphertext; and decrypting the operation state analysis result on the authorized side. The application realizes ciphertext availability of power plant core data while ensuring data transmission integrity and confidentiality, and reduces communication and calculation overhead.

An information processing system includes: an information processing apparatus that holds, out of a private key and a public key of public key cryptography assigned to the information processing apparatus, the public key, and is shipped in a locked state in which startup by an operating system (OS) is prohibited; and a higher-level apparatus connectable to the information processing apparatus via an interface of Universal Serial Bus (USB) Type-C. The information processing apparatus includes: a main control unit that executes processes based on the OS and Basic Input / Output System (BIOS); and a sub-control unit that is capable of operating in a state in which power is not supplied to the main control unit, and releases the locked state if mutual validity of the information processing apparatus and the higher-level apparatus is verified based on the private key and the public key using the USB Type-C.

The application belongs to the technical field of trusted authentication, and discloses a remote user trusted authentication system, method and medium in an Internet of Things environment. The system comprises a registration center (RC), which is a trusted server and is used for safely registering or initializing other entities; an intelligent device, which is arranged in an environment and is used for collecting and transmitting data; a gateway, which supports interconnection between different protocol networks and has computing and storage capabilities; a user, who accesses remote intelligent devices through a login device; and the login device, which is used for user trustworthiness verification. The login device includes but is not limited to a mobile device, an intelligent card and a PC. Through the system and method, the trusted authentication of remote users can be realized, and safe communication between the user and the intelligent device is established. Meanwhile, the application can also solve the problems of public key cryptography complexity, user authentication vulnerability and symmetric cryptography limitations.

The invention provides a bidirectional authentication method and related equipment, and relates to the field of network technology and security technology. The method comprises the following steps: a first communication device sends a first time-varying parameter and a first device identifier to an authentication center; receiving first authentication data; based on the first physical unclonable function chip, verifying the first authentication data, and generating second authentication data under the condition that the verification of the first authentication data is passed; sending the second authentication data to the second communication device; receiving third authentication data; and verifying the third authentication data, and when the verification of the third authentication data is passed, the bidirectional authentication of the first communication device and the second communication device is successful. According to the method, bidirectional authentication of two communication parties can be realized without sharing a key in advance, quantum computing threat faced by a public key password can be handled, the problem of traditional symmetric key management is solved by utilizing a physical unclonable function, communication equipment can be prevented from being counterfeited, and the authentication security is improved.

Systems, methods, and computer-readable storage media of wrapping digital assets. One method includes receiving, from a central provider system, a digital asset signed by a central private key associated with a digital asset on a central ledger, and verifying the digital asset based on a central public key. The method further includes updating the digital asset including an assignee field, and receiving an attribute for a second assignee of the digital asset. The method further includes wrapping utilizing the private key of the public and private key pair, the digital asset with the attribute and receiving environmental data. The method further includes determining the at least one condition of the attribute is satisfied, and updating the assignee field.

Systems, methods, and computer-readable storage media of exchanging digital assets using a public key cryptography framework. One method includes encrypting at least one digital asset on an internal ledger and storing the encrypted at least one digital asset on an internal ledger. The method further includes receiving a signed exchange request signed by a first key corresponding with an encrypted digital asset on the internal ledger and providing, to an inter-provider ledger, a second key based on interfacing with the inter-provider ledger based on establishing a first data feed. The method further includes determining the signed exchange request was verified. The method further includes updating a central ledger by interfacing with of the central ledger via an application programming interface (API) based on establishing a second data feed and wherein at least one of a plurality of fields of the encrypted digital asset is a universal field.

This invention relates to a method and system for email data security based on identifier public-key cryptography, belonging to the field of information security technology. The method includes: the sender encrypting email attachments using a symmetric key to obtain ciphertext for the attachments; obtaining the recipient's identifier public key based on the recipient's email address; encrypting the email body using the symmetric key to obtain ciphertext for the body; generating email ciphertext structure data by creating a digital envelope based on the sender's identifier private key's signature of the body, the ciphertext, and key factors of the symmetric key encapsulated in the recipient's identifier public key, and sending this data to the recipient; the recipient obtaining the signature, ciphertext, and digital envelope based on the ciphertext structure data, and decrypting the digital envelope using the recipient's identifier private key to obtain the symmetric key; decrypting the ciphertext using the symmetric key to obtain the email body and verifying the signature using the sender's identifier public key; and decrypting the ciphertext for the attachments to obtain the email attachments. This invention achieves end-to-end security for email data, solving server-side performance bottlenecks and key management security issues.

A cryptographic cold storage apparatus and system. Embodiments of the present disclosure provide for a cold storage apparatus configured to generate a private key, compute an associated PK / PKY and display the latter on a visual display screen. An associated interface apparatus is configured to retrieve the PK / PKH optically and store it in memory. The interface apparatus is configured to produce an associated message and render it at a visual display. The cold storage apparatus may retrieve the message optically, and cryptographically sign the message utilizing one or more public key cryptography methods. The cold storage apparatus produces a graphical output comprising the signed message and renders it at the visual display. The interface apparatus retrieves the signed message and verifies that the cold storage apparatus signed the message, utilizing the public key cryptography methods.

The invention relates to a mail data security method and system based on an identification public key password, and belongs to the technical field of information security. The method comprises the following steps: a sender encrypts a mail attachment by using a symmetric key to obtain an attachment ciphertext; obtaining a receiver identification public key based on the receiver email address; encrypting the mail text based on the symmetric key to obtain a text ciphertext; based on the signature of the sender identification private key to the text, the text ciphertext and the digital envelope obtained by encapsulating the key factor of the symmetric key by the receiver identification public key, generating mail ciphertext structure data, and sending the mail ciphertext structure data to the receiver; the receiver obtains the signature, the body ciphertext and the digital envelope based on the mail ciphertext structure data, and decrypts the digital envelope based on the receiver identification private key to obtain the symmetric key; decrypting the body ciphertext based on the symmetric key to obtain the mail body, and verifying the signature through the sender identification public key; and decrypting the attachment ciphertext to obtain the mail attachment. According to the invention, the end-to-end security of the mail data is realized, and the problems of server performance bottleneck and key management security are solved.

The invention relates to the field of network security, and provides a public key password management method, system and device, electronic equipment and a storage medium, the method is applied to a password module, and the password module is arranged on a user side and integrated in an SIM card or a terminal; the method comprises the following steps: receiving a key parameter sent by an application; based on the key parameter and a locally stored root key seed, recovering to obtain a private key, and performing cryptographic operation by using the private key; the root key seed is a pre-generated fixed random number used for generating a key pair; and returning an operation result to the application and deleting the private key corresponding to the key parameter under the condition that the password operation is completed. According to the public key password management method provided by the invention, the password module does not need to store the key, the cost of the password module is reduced, and the key management efficiency of a digital identity scene is improved.

Systems, methods, and computer-readable storage media of exchanging digital assets using a public key cryptography framework. One method includes encrypting at least one digital asset on an internal ledger and storing the encrypted at least one digital asset on an internal ledger. The method further includes receiving a signed exchange request signed by a first key corresponding with an encrypted digital asset on the internal ledger and providing, to an inter-provider ledger, a second key based on interfacing with the inter-provider ledger based on establishing a first data feed. The method further includes determining the signed exchange request was verified. The method further includes updating a central ledger by interfacing with of the central ledger via an application programming interface (API) based on establishing a second data feed and wherein at least one of a plurality of fields of the encrypted digital asset is a universal field.

The application discloses a vehicle and roadside unit mutual trust authentication and key negotiation method, relates to vehicle networking communication entity identity authentication, and belongs to the field of vehicle networking information security. The method pre-sets a trusted center key, and embeds an unclonable device into a communication entity. After receiving a registration response, the communication entity stores a three-tuple in a memory thereof. An authentication message is constructed based on the identity identification of the communication entity, a password, a time stamp and an elliptic curve public key cryptography algorithm. The mutual trust authentication of the identity of the communication entity and the session key negotiation are realized through the interaction of the authentication message and the verification of the to-be-verified parameters. After the mutual trust authentication of the identity is passed, the received key message is verified by the receiving communication entity. The trusted center can track the identity of a false message sender. The communication entity adds the pseudo identity identification of the false message sender to an incremental pseudo identity identification revocation list, and completes the revocation of the false message sender, thereby improving the authentication efficiency of the vehicle and the roadside unit.

Provided are methods and apparatus for performing a contract-based transaction of a specified number of assets represented in a digital form. In an example, a computer-implemented method can include (i) receiving, at a computing device and from a contract originator user, information describing: (a) commitments for a contract, where the commitments comprise at least a transfer of a specified number of assets represented in a digital form, (b) conditions for a contract, and (c) an additional participant of the contract; (ii) saving, to a contract proposal data structure, information describing: (a) contract data comprising a universally unique transaction reference, (b) a list of participants by public cryptographic key, and (c) a commitment group comprising an expiration date and one or more commitments; and (iii) electronically sending the contract proposal data structure to the additional participant of the contract, wherein the contract proposal data structure is encrypted using public key cryptography.

The present invention relates to a registration code generation and verification method and system based on elliptic curve short signature, belonging to the field of information security technology. The registration code generation method includes: generating a machine code based on the hardware information of the device on which the software is installed and the identification information of the software; generating a random elliptic curve key pair, and performing a short signature on the machine code based on the private key in the key pair to obtain a corresponding signature value (r, s); and generating a registration code based on the signature value (r, s). The verification method includes: generating a machine code corresponding to the device running the software; restoring the registration code to be verified to obtain a signature value (r′, s′); and verifying the registration code based on the machine code and the signature value (r′, s′). The registration code of the present invention is generated based on elliptic curve public key cryptography and a short signature algorithm. The length of the registration code is similar to that of a traditional registration code, and the registration code is bound to the running device to prevent the software from being used on unauthorized devices. This effectively shortens the length of the registration code while achieving copyright protection for the software.

To provide a public key cryptography and system based on isogeny with which data sizes are suppressed and safety is enhanced.SOLUTION: Provided is an encrypting communication system adopting, as system parameters, integers a' and b', and dA,1=2a'-3b', dA,2=3b', d1=22a'+2a'3b'+32b', d2=32b', a=3a', p=2a*3f-1, and generation sources P0, Q0 of E0[2a]. The communication system includes a key generation unit for selecting a regular diagonal matrix A of 2×2 on Z / 2aZ and generating dA,1-isogenies φA,1:E0→EA' and PA'=φA,1(P0) and QA'=φA,1(Q0) from dA,1 and P0, Q0, and selecting dA,2-isogenies φA,2:EA'→EA, thereby generating a public key pk=(EA, RA, SA)((RA, SA)T=A(PA=φA,2(PA'), QA=φA,2(QA'))T and a secret key sk=(A, EA', PA', QA').SELECTED DRAWING: Figure 7

The application provides a bidirectional authentication method and related equipment, and relates to the fields of network technology and security technology.The method comprises the following steps: a first communication device sends a first time-varying parameter and a first device identifier to an authentication center; receives first authentication data; and verifies the first authentication data based on a first physically unclonable function chip, generates second authentication data in the case that the first authentication data is verified, sends the second authentication data to a second communication device, receives third authentication data, verifies the third authentication data, and the bidirectional authentication of the first communication device and the second communication device is successful in the case that the third authentication data is verified.The application can realize the bidirectional authentication of the two communication parties without sharing the key in advance, can cope with the quantum computing threat faced by the public key cryptography, solves the problem of traditional symmetric key management by using the physically unclonable function, and can prevent the communication device from being imitated, so that the security of the authentication is improved.

The present invention belongs to the field of computer security and discloses a lightweight public-key cryptographic calculation method for small-scale Internet of Things (IoT) terminals. The terminal generates a private key using a random number generator; the terminal interacts with an edge computing node to obtain a pre-calculated table for scalar multiplication, which is an i-multiplication point pre-calculated table stored in advance in the edge computing node or calculated in real time by the edge computing node; the terminal obtains all required multiplication point values ​​and obtains the final public-key cryptography through multiplication point addition. By using simplified pre-calculated tables for fixed and non-fixed points, the present invention reduces the computational complexity of scalar multiplication in public-key cryptography, effectively resolving the problem that scalar multiplication in ECC encryption consumes memory and computing power, making it difficult to apply to resource-constrained small-scale terminal devices. These terminal devices can also perform secure transmission using the ECC public-key cryptographic algorithm, resolving the security issue of small-scale terminal devices being unable to apply more secure public-key cryptographic algorithms.

The present invention belongs to the field of power information technology, and particularly relates to a network-source boundary switch and its communication method. The network-source boundary switch includes a quantum distribution unit. The method includes: the quantum distribution unit receives a communication request message carrying quantum identity number information sent by a photovoltaic power generation source, and this communication request message is encrypted using a public key; the quantum distribution unit decrypts this communication request message using a private key to obtain the quantum identity number information, and queries this quantum identity number information in a pre-stored list of power generation device identifiers; if this quantum identity number information exists, the quantum distribution unit returns an allowed communication request message to the photovoltaic power generation source. The network-source boundary switch in the embodiment of the present invention can encrypt the communication process, thereby ensuring the communication security between the photovoltaic power generation source and the distribution line.