171 results about "Public key infrastructure" patented technology

A device access management server may facilitate secure access of a target device by an accessing device. The secure remote access of the target device by the accessing device may be facilitated by a public key infrastructure (PKI) certificate issued and / or validated by the device access management server.

Features for providing a secure method of symmetric encryption for private smart contacts among multiple parties in a private peer-to-peer network. The features include a master key representing a unique blockchain ledger. The master key may be shared among multiple participants in a private peer-to-peer network. Sharing of the master key may include communicating the master key in an encrypted message (e.g., email) using public key infrastructure (PKI). In some implementations, more complex distribution features may be includes such as quantum entanglement. The features support instantiation of a smart contract using a specific master key. The request may be submitted as an entry to the ledger with appropriate metadata and / or payload information for identifying and processing the request.

Systems and methods for implementing a service identity platform with cloud-based Public Key Infrastructure (PKI) include providing security as a service via a cloud-based system for a plurality of tenants, wherein the cloud-based system includes a plurality of components communicatively coupled and adapted to communicate with one another based on mutual Transport Layer Security (mTLS) authentication; responsive to a new component requiring deployment within the cloud-based system, performing an enrollment process for the new component; and subsequent to the enrollment process, utilizing the new component within the cloud-based system for providing security as a service.

This application is directed to managing custom memory functions in a memory device coupled to a host device in an electronic system. The memory device obtains an information item (e.g., program, data, metadata) used to implement a custom memory function. The memory device receives a host signature and a public key from the host device and authenticates the host signature using the public key. In accordance with an authentication of at least the host signature, the memory device executes the custom memory function based on the information item. In some embodiments, the host device selects a set of memory devices based on a first-come-first-serve order, and the custom memory function is executed at each of the set of memory devices in accordance with an authentication of at least a respective host signature issued by the host device.

The invention provides a secure communication method and device for an upper computer and an ECU (Electronic Control Unit), a storage medium and a program product, which are respectively applied to an upper computer end and an ECU end, and the method comprises the following steps: the upper computer obtains an encryption public key of the ECU and a decryption private key of the upper computer, generates a session key for data encryption and decryption, and sends the session key to the ECU; and the session key is subjected to double encryption by sequentially using an encryption public key of the ECU and a decryption private key of the ECU, and a communication ciphertext is generated and sent to the ECU end. And after receiving the communication ciphertext, the ECU end performs dual decryption by using the encryption public key of the upper computer and the decryption private key of the ECU end in sequence, so that the session key is recovered. And after the key negotiation is completed, the two parties encrypt and decrypt communication data through a symmetric encryption mode based on the session key. According to the invention, a hybrid encryption communication mechanism taking the public key infrastructure as the root of trust is constructed, confidentiality and integrity protection of communication data is realized, and the authentication capability of the identity of the communication entity is remarkably enhanced.

A method and apparatus for analyzing disparate certificates possibly issued by disparate sources within a disaggregated public key infrastructure is disclosed. In one embodiment, the system comprises a database having a certificate repository and a certificate ingestion interface module, communicatively coupled to the certificate repository, the certificate ingestion interface module for ingesting certificates issued by the disparate sources. The system further comprises an analytics engine, communicatively coupled to the certificate repository, for analyzing attributes of the ingested certificates, a reporting engine, communicatively coupled to the certificate repository, for visualizing and reporting results of the analytics engine via a reporting interface, and an administrative interface, communicatively coupled to the certificate repository, for managing the system.

Features for providing a secure method of symmetric encryption for private smart contacts among multiple parties in a private peer-to-peer network. The features include a master key representing a unique blockchain ledger. The master key may be shared among multiple participants in a private peer-to-peer network. Sharing of the master key may include communicating the master key in an encrypted message (e.g., email) using public key infrastructure (PKI). In some implementations, more complex distribution features may be includes such as quantum entanglement. The features support instantiation of a smart contract using a specific master key. The request may be submitted as an entry to the ledger with appropriate metadata and / or payload information for identifying and processing the request.

A method, system, and apparatus for managing digital certificates, managing a certificate authority (CA), and cross-referencing CA hierarchies. The method includes receiving, by a processor of a CA computing system, at least one of a digital certificate generation request and a digital certificate revocation from a user via a user computing device, the digital certificate generation request including a user public key and a user identity. The method further includes generating a digital certificate for the user and signing the digital certificate with a CA private key, wherein the CA private key is associated with a known CA public key. The method further includes publishing the digital certificate signed with the CA private key to a digital certificate blockchain, determining a certificate status of the digital certificate, and publishing an update to the digital certificate blockchain to reflect the certificate status of the digital certificate.

A computer-implemented method of registering a user identifier in a public key infrastructure comprising a trusted device and a server is provided. The method includes the steps: receiving the user identifier as an input to the trusted device; obtaining a hash value of the user identifier; the trusted device obtaining biometric data comprising a facial image of the user; generating a public key and a privacy preserving data structure using the biometric data, encrypting the user identifier using the public key, and storing the encrypted user identifier as metadata in the privacy preserving data structure, wherein a private key for decrypting the encrypted user identifier can be generated from the privacy preserving data structure using subsequently acquired biometric data comprising the facial image of the user; generating a device token corresponding to the trusted device and obtaining a hash value of the device token, the server storing the privacy preserving data structure uniquely indexed by the hash value of the device token while using the hash value of the user identifier as a primary key, and the trusted device storing the device token.

The system provided in the present application includes a public key infrastructure builder, a container image identity builder, a signature list builder, a container image verifier, a signature list and user certificates loader, and a container program verifier. The method provided in the present application is capable of conveniently authorizing container images and software running in the container, and verifying the container images and programs in the container at the right time, so as to ensure that container images running on the container platform are trusted, and the software running in the container is also trusted, thereby improving the security of the container platform.

Systems and methods for authenticating public key infrastructure certificate enrollment using certificate entitlement licenses. One example system includes a device manager including an electronic processor. The electronic processor is configured to receive a request for software for an electronic device including a unique electronic device identifier. The electronic processor is configured to determine, based on the request, whether the electronic device is entitled to participate in a certificate management service. The electronic processor is configured to, responsive to determining that the electronic device is entitled to participate in a certificate management service, transmit a certificate entitlement license request including the unique device identifier to a certificate entitlement license manager. The electronic processor is configured to receive, from the certificate entitlement license manager, a certificate entitlement license for the unique device identifier. The electronic processor is configured to deliver the certificate entitlement license based on the unique device identifier.

The invention discloses a federated learning privacy protection method based on a proxy data set, which is characterized in that agreements and multi-device participants reach consensus before federated learning, key elements of each link are clarified, the process is ensured to be standard and consistent, a foundation is laid for privacy protection and efficient training, and original data privacy is protected by constructing the proxy data set and a model. Data characteristics are simulated to ensure effective training, flexibility and adaptability are improved through proxy model optimization of participants, calculation complexity is reduced through logic optimization, training is accelerated, bandwidth consumption is reduced, efficiency is improved, communication security is ensured through establishment of public key infrastructure, data confidentiality, integrity and security audit are realized, and the method is suitable for popularization and application. By formulating an auditing strategy, data compliance and consistency are ensured, third-party auditing verification data are true and effective, federal learning transparency and credibility are enhanced, and safe and efficient data collaboration and learning are promoted.

A system for processing digital signatures includes a sender device and a receiver device. The sender device encrypts a plaintext message and transmits an encrypted ciphertext message to the receiver device. The receiver device receives and decrypts the encrypted ciphertext message into a coded plaintext message, which is then decoded to output a readable plaintext message to the receiver device substantially corresponding to the plaintext message at the sender device. The sender and receiver devices are in communication with a certificate authority of a public key infrastructure configured to generate a keypair including a public key and a private key. The sender encrypts the plaintext message, and the receiver device decrypts the encrypted ciphertext message, using a common coding scheme that is configured for a document containing the public key.

Techniques for signing internet data are disclosed. The techniques include accessing a plurality of internet data records. The techniques also include generating, using at least one electronic processor, leaf nodes from the plurality of internet data records, and constructing a recursive hash tree from the plurality of leaf nodes. The techniques also include deriving information sufficient to validate the root node, and publishing, in an internet public key infrastructure (PKI) as a synthesized public key, the information sufficient to validate the root node. The techniques also include providing, through the internet and as a signature on at least one of the plurality of internet data records, validation data including sibling path data from the recursive hash tree, such that an internet client validates the at least one of the internet data records using at least the validation data and the synthesized public key.

The invention discloses a security authentication system and method for data transmission of vehicle-mounted equipment, and the system comprises an identity authentication module which is used for issuing digital certificates to the vehicle-mounted equipment and a remote data center through a public key infrastructure system, and achieving the identity authentication; the data encryption module is used for encrypting the transmitted data by using a secure socket layer or transport layer security protocol to ensure the confidentiality of the data; the data integrity verification module is used for performing abstract calculation on the data by using a hash function in a data transmission process to generate a data fingerprint; the access control module is used for implementing a strict access control strategy in the remote data center and limiting the access authority to the vehicle data; and the log auditing module is used for deploying a log auditing system in the vehicle-mounted equipment and the remote data center and recording all operations and behaviors related to security authentication. According to the invention, the vehicle-mounted equipment can be ensured to have high security during data transmission.

The present invention discloses a method and system for securely aggregating power consumption plans of smart grids based on homomorphic encryption, which belongs to the field of smart grids. A distributed network is constructed based on blockchain technology, which can realize direct operation of ciphertext data and reliable storage of data. A certificate authorization and authentication mechanism is established through a public key infrastructure, and the privacy and integrity of power consumption plans are simultaneously guaranteed through efficient homomorphic encryption algorithms and homomorphic message authentication code technologies. The method supports the power system to adjust power generation according to power consumption information submitted by users on the basis of privacy protection, thereby promoting reliable and efficient power generation and scheduling.

The invention relates to the technical field of safe intelligent traffic, and discloses a lane line data safe transmission architecture, which comprises a multi-layer data safety protection system constructed between a terminal and a server, and comprises a data encryption layer for encrypting lane line data collected by the terminal through a preset key and transmitting the encrypted lane line data to the server; according to the data integrity verification layer, after the encrypted lane line data is transmitted to a server, verification elements of the encrypted lane line data are recorded based on the block chain data layer, and the data are automatically verified through a pre-compiled smart contract; and the data security communication layer is used for establishing encryption service and identity authentication from a terminal to a server through a TLS protocol in combination with a public key infrastructure of the block chain. According to the invention, a data security protection system including data encryption, data integrity and secure communication is constructed, so that the security and integrity of the lane line data are ensured, and the problems of data tampering and privacy disclosure in the lane line acquisition and transmission process are effectively prevented.

The invention discloses a medical information data intelligent encryption method based on a digital signature. The method comprises the following steps: S1, acquiring medical information data; s2, adopting a public key infrastructure and a hash function to generate a digital signature of the medical information data; s3, performing data anonymization and desensitization processing on the medical information data, and removing sensitive information through a privacy protection technology; s4, introducing a machine learning algorithm and a rule-based encryption strategy, dynamically analyzing the type, sensitivity and user behavior of the medical information data, and intelligently selecting an encryption algorithm; s5, adopting a symmetric encryption and asymmetric encryption combined method to quickly encrypt a large amount of medical information data; and S6, performing secure storage and transmission on the encrypted medical information data and the encrypted symmetric key, and recording the signature and encryption process of the medical information data by using a block chain technology. The system has the advantages of high security, high intelligence, comprehensive privacy protection and transparent data processing.

The invention relates to the technical field of block chains, and provides a cross-domain authentication method and device, electronic equipment and a storage medium, and the method comprises the steps: receiving an access credential sent by a vehicle when the vehicle is in a coverage range of a road side unit; the access credential comprises a hash value of the identity credential; based on the hash value in the access credential, querying the distributed account book recording the hash value of the identity credential to obtain a query result; and verifying the authentication validity of the vehicle based on the query result. According to the method, multiple road side unit nodes form an alliance chain and jointly maintain a distributed account book of an identity certificate hash value, a decentralized unified trust foundation is constructed, and trusted transmission and verification of vehicle identities are achieved; by using the access credential only comprising the hash value, the storage overhead and the authentication delay on the chain are remarkably reduced, the single-point fault problem of the traditional public key infrastructure is avoided, the long-term identity information of the vehicle is effectively protected by means of the unidirectivity of the hash function, and privacy leakage is prevented.

The invention relates to a power fault diagnosis method and system based on large model retrieval enhancement. The method comprises the following steps: firstly, initializing a federated network, and locally vectorizing multi-modal heterogeneous power data at each node to generate a private vector index; performing federated collaborative retrieval by combining the fault diagnosis request, the private vector index and the public key infrastructure to obtain a globally sorted knowledge fragment list; and finally, constructing a retrieval enhancement prompt according to the knowledge fragment list and the diagnosis request, and generating a fault diagnosis conclusion text by utilizing large language model reasoning. By adopting the method, dispersed multi-source knowledge can be effectively fused on the premise of ensuring the data privacy security of each node, so that the accuracy and reliability of fault diagnosis are improved.

A system for autonomous compliance with legal regulations in smart contracts; the system includes: a regulatory data collection unit comprising a network interface controller physically connected to an external communications port, a hardware-based public key infrastructure circuit configured to validate digital certificates of regulatory servers, and a direct memory access controller configured to transfer authenticated regulatory update packets from the network interface controller to a volatile buffer memory without processor intervention; a Compliance Code Conversion Unit with a hardware lexicon scanner implemented as a finite state machine and embedded in reconfigurable FPGA logic blocks, a microcontroller executing a hardware-based lexical analysis pipeline stored in firmware registers, and a translation cache memory configured to temporarily store tokenized compliance rules before writing them to a non-volatile instruction memory; a policy evaluation and enforcement unit comprising a transaction verification processor connected to a secure enclave memory, a hardware comparator circuit configured to compare transaction parameters with compliance thresholds stored in the secure enclave memory, and a logic gate circuit configured to generate execution gate signals that selectively allow, block, or modify smart contract execution signals transmitted to a blockchain execution processor; and an audit logging unit with a cryptographic hashing circuit configured to generate block hashes of enforcement records, a timestamp oscillator configured to generate temporal signatures of compliance enforcement actions, and a Merkle tree generation circuit configured to create tamper-proof hierarchical hash structures, with the enforcement records being passed to a decentralized storage interface for anchoring in the chain or distributed ledger.

Aspects of the present disclosure include a tokenless, network-attached, multi-factor authentication software based electronic access control logon system and methods of use thereof, and may provide equivalent in security to a Public Key Infrastructure smart card system. The logon system may allow tokenless, but authorized, entities to access secure systems, with the secure logon system not requiring placement of individual or organization identifying information on a physical object that may be removed from a restricted location. Aspects of the present disclosure may include maintaining user credentials within individually encrypted credential bins within a Credential Hardware Security Module (HSM) that is securely accessible by authorized endpoints in a distributed network. A successful logon may occur when an authorized user accesses the user's corresponding credential bin within the Credential HSM via an additionally authorized corresponding device, such that the device and user authentication may combine to provide multi-factor authentication.

A system for enhanced public key infrastructure is provided. The system includes a computer device. The computer device is programmed to receive a digital certificate including a composite signature field including a plurality of signatures. The plurality of signatures includes at least a first signature and a second signature. The computer device is also programmed to retrieve, from the digital certificate, a first key associated with the first signature from the digital certificate. The computer device is further programmed to retrieve the first signature from the composite signature field. In addition, the at least one computer device is programmed to validate the first signature using the first key.

Techniques for implementing a client-rooted decryption Public Key Infrastructure (PKI) to securely inspect encrypted traffic in cloud-based proxy environments are disclosed. A proxy node generates an intermediate Certificate Authority (CA) certificate signing request (CSR) and sends it to a client device equipped with a locally-managed root CA. The client device cross-signs the CSR, creating a client-specific intermediate CA certificate, which it returns to the proxy node. This client-specific intermediate CA certificate is scoped uniquely to the individual client device, significantly reducing the potential blast radius in case of CA key compromise. The proxy node uses the client-specific CA certificate to dynamically generate short-lived, scoped decryption certificates for inspecting encrypted traffic. This architecture provides client-level control of trust boundaries, enhanced traceability, reduced complexity, and improved scalability of encrypted traffic inspection, minimizing the operational risks associated with conventional centralized certificate management.

A device may determine that a network function of a network has been instantiated to facilitate communication via the network. The device may request a certificate authority to provide a certificate for the network function. The device may receive, from the certificate authority, the certificate. The device may generate a certificate profile to enable other network functions of the network to authenticate communications with the network function, wherein the certificate profile identifies: the certificate and a certification protocol. The device may provide, to the network function, the certificate profile to cause the network function to use the certificate to communicate with the other network functions.

A sequential authentication method based on an authentication chain using a public key infrastructure (PKI) is provided. The method comprises: receiving, by an nth party from an (n-1) th party, an (n-1) th modified public key; generating an nth private key and an nth public key which correspond to each other by the nth party; generating, by the nth party, an nth modified public key by concatenating the (n-1) th modified public key and the nth public key signed with the nth private key; the nth modified public key is transmitted by the nth party, where n is a natural number greater than 1, and when n = 2, the first modified public key is the first public key signed with the first private key.

A method for sequential authentication based on chain of authentication using public key infrastructure (PKI) is provided. The method includes generating, by a user, a first private key and a first public key corresponding to each other; generating, by an nth service provider, an nth private key and an nth public key corresponding to each other; transmitting, from the user to the nth service provider, a level n key; verifying, by the nth service provider, the level n key; generating, by the nth service provider, a level (n+1) key by concatenating the level n key and the nth public key signed with the nth private key; and transmitting, by the nth service provider, the level (n+1) key to the user, where n is a natural number, and when n=1, the level 1 key is the first public key signed with the first private key.

Systems, methods, network devices, and machine-readable media disclosed herein perform chosen ciphertext attack secure encryption given any public key infrastructure that has been established with only chosen plaintext attack security. The resulting chosen ciphertext attack secure encryption makes black-box use of the chosen plaintext attack secure scheme and other underlying primitives, and specifically new public keys do not need to be created or distributed.

A system for automated, middleware-based intelligent data mapping between heterogeneous enterprise resource planning (ERP) systems and cloud platforms, the system comprising the following: an ERP data acquisition unit with a variety of physical communication ports, selected from Ethernet and serial ports, a network interface controller physically connected to the communication ports, and a DMA (Direct Memory Access) controller configured to transfer raw ERP data packets into a volatile buffer memory without processor intervention; a Semantic Mapping Unit consisting of a Field Programmable Gate Array (FPGA) configured as a lexical analyzer to analyze ERP schema definitions and extract entity descriptors, and a Tensor Processing Unit (TPU) configured to evaluate the semantic similarity between heterogeneous schema elements based on ontological models stored in a non-volatile memory repository; a transformation logic unit comprising a parallelized vector processor configured to perform matrix-based transformations, field normalizations and structural reorganization of ERP data into a harmonized format, and a rule application circuit configured to perform compliance-based anonymization, unit conversions and value scaling prior to cloud distribution; a cloud interface unit comprising a protocol adapter bank with encoders, translators, and message queue writers, wherein the cloud interface unit is coupled with a cryptographic controller configured with a hardware public key infrastructure (PKI) circuit to generate digital signatures and verify integrity codes for all outgoing payloads; and a Feedback Learning Control Unit implemented in the firmware, wherein the engine is electrically coupled to the Semantic Mapping Unit and the Transformation Logic Unit and is configured to monitor error logs, success rates and acknowledgment codes received from the cloud platforms and to update the semantic and transformation rules stored in the non-volatile memory repository accordingly.

Techniques are disclosed for public key infrastructure (PKI) based session authentication. An example network device includes one or more processors and memory coupled to the one or more processors. The memory stores instructions that, upon execution, cause one or more processors to: receive, from a source client device, a packet including a header for routing the packet to a destination client device specified within the header and metadata distinct from the header, the metadata specifying public key infrastructure (PKI) information and identity context information identifying a user or device participating in a session between the source client device and the destination client device; verify, based on the PKI information within the metadata, the metadata; and in response to verifying the metadata, apply, based on the identity context information, one or more policy rules for the session associated with the packet.