44 results about "Registration authority" patented technology

The invention provides a credible identity authentication method and system with privacy protection and traceability, and the method comprises the steps: S1, defining roles in an identity authentication process and a supervision traceability process and the function division of each role, including a user, a registration organization RA, a certificate issuer Issuer, a service provider SP and a supervision committee RegComm; s2, realizing an identity authentication process through a real name authentication verification process, an anonymous identity certificate signing and issuing process and a user identity authentication proving process; wherein in the anonymous identity certificate issuing process, a certificate issuer Issuer issues a verifiable anonymous identity certificate to a user through a formula according to a real name authentication verification result of a registration authority RA; and S3, realizing a supervision and tracing process through user secret distribution and a user information tracing process. According to the invention, an identity authentication process based on zero-knowledge proof and verifiable secret sharing is realized, a supervision and tracing process is introduced, and practical application requirements of privacy protection and traceability can be met at the same time.

The invention discloses a data fine-grained access control method, system and device and a medium, mainly relates to the technical field of access control, and is used for solving the problems of identity and attribute separation, low strategy updating efficiency and insufficient auditing capability in the existing scheme. Comprising the steps that a data user generates a distributed digital identity document containing at least one role attribute through a distributed digital identity system, and the distributed digital identity document is subjected to uplink storage after being audited by a registration mechanism; the data provider generates an ABE private key according to the main public key and an access control strategy, encrypts the ABE private key by using the DID public key of the data user, and sends the encrypted ABE private key to the data user; the data user obtains an ABE private key by using the DID private key; decrypting the ABE ciphertext on the block chain by using the ABE private key to obtain a symmetric key; and obtaining the original data in the trusted data space through symmetric key decryption.

The invention discloses an unmanned aerial vehicle identity authentication and key negotiation system and method. The system comprises a trusted registration mechanism, an unmanned aerial vehicle, a cloud server and a mobile terminal, in a system initialization stage, a trusted registration mechanism publicly releases a single hash function and a symmetric encryption / decryption algorithm; in a mobile terminal registration stage, a trusted registration mechanism verifies a registration request of a user; in the unmanned aerial vehicle registration stage, the unmanned aerial vehicle sends its identity ID to the trusted registration mechanism to request registration, and the trusted registration mechanism distributes a unique challenge and random number to the unmanned aerial vehicle after receiving the identity ID; in the user login stage, a user ID, a password and biological characteristics are input into the mobile terminal, and the mobile terminal verifies the user identity through pre-stored parameters; in the identity authentication and key negotiation stage, mutual authentication is carried out among the mobile terminal, the cloud server and the unmanned aerial vehicle, and a session key for future encrypted communication is negotiated.

The invention discloses a medical system identity authentication and key negotiation system and method based on associated data encryption, and the system comprises a registration mechanism, a wearable device, a mobile terminal, and a medical server, and the registration mechanism completes the registration of a sensor device, the mobile terminal, and the medical server through a secure channel. And the sensor equipment, the mobile terminal and the medical server communicate with one another through an unsafe wireless public channel. In the initialization stage, the registration mechanism generates a master key for the medical server and selects a long-term identity ID and a temporary identity ID for the wearable device; in a mobile terminal registration stage, a registration mechanism stores and sends a secret certificate; in the user login stage, identity information is calculated, and service is provided according to a user request; in the identity authentication and key negotiation stage, mutual authentication among the mobile terminal, the medical server and the wearable device is executed, and session keys for future encrypted communication are negotiated and stored.

The present disclosure relates to a method for secure, traceable and privacy-preserving with anonymity revocation digital currency transfer to at least a first user from a second user among a plurality of banked and unbanked users by using a distributed ledger comprising a plurality of ledger nodes, wherein said users perform Digital Currency transfers by adding transactions on this ledger using user devices configured to be connected to said nodes, to a registration authority and to a revocation authority, said authorities owning each one a public / private key pair, comprising:an enrollment phase, performed by a user device of said first user, comprising:sending to the registration authority evidence of the first user's identity,generating a first user identification key pair comprising a first user identification public key and a first user identification secret key,sending to the registration authority said generated first user identification public key,receiving from the registration authority a signed token generated by the registration authority after the registration authority verified first user's identity based on said evidence, said signed token being generated by signing with the registration authority secret key a token comprising said first user identification public key and said first user's identity encrypted with said revocation authority public key,a transaction phase, performed by said user device of said first user, comprising: participating with said second users in a Digital Currency transfer transaction to be added to the distributed ledger,wherein said signed token enables the revocation authority to revoke first user's anonymity by retrieving first user's identity.

A method at a network element, the method comprising receiving at the network element at at least one message, the at least one message being one or both of the following: an update status information message from an update server; and an anomaly detection status information message from an anomaly detection server; determining a dynamic cybersecurity posture indication for an intelligent transportation system entity based on receiving the at least one message; and providing the dynamic cybersecurity posture indication for the intelligent transportation system entity to a registration authority, wherein the dynamic cybersecurity posture indication can be included in a certificate associated with the intelligent transportation system entity.

The invention discloses a privacy protection and traceable anonymous bidirectional authentication method for heterogeneous Internet of Vehicles, which comprises the following steps: generating public and private keys based on a key generation center, a private key generator and a trusted registration mechanism, and constructing a heterogeneous password system; the vehicle completes key registration by fusing the certificateless public key system, and the roadside unit completes key registration based on the identity public key system; the vehicle registers and uses the pseudonym to communicate with the roadside unit; and the vehicle and roadside unit bidirectional authentication verifies the legality of the opposite side through a hash function and a temporary value, and finally generates a session key. According to the invention, by providing traceable pseudonym and anonymous authentication communication for each vehicle, the privacy of the vehicle can be effectively protected, and an attacker can be prevented from tracking the identity information of the vehicle. Based on various security hypotheses, the method meets various security attributes including anonymity, unlinkability, perfect forward security, security of known temporary information specific to sessions and the like, and the security of data transmission of the Internet of Vehicles can be improved.

The invention discloses a vehicle-mounted ad hoc network identity authentication method and system based on a block chain, and the method comprises the steps: a registration mechanism carries out the validity verification of vehicle information according to a registration request, obtains a public key if the verification succeeds, generates a corresponding call public key list, adds an accumulator, updates the value of the accumulator, and carries out the verification of the vehicle information; and then generating an update message from the updated value of the accumulator, the value of the accumulator before updating and vehicle information, and sending the update message to a block chain, and calculating and broadcasting a new member witness value and the updated value of the accumulator to all vehicles by the block chain according to the update message. The security and efficiency of identity authentication are improved, the validity verification of the vehicle identity is completed in the preprocessing stage, the authentication time delay of the vehicle is reduced, meanwhile, the vehicle only needs to store the member witness value and the value of the accumulator, the bidirectional authentication of subsequent communication can be completed on the premise of protecting privacy, the overhead of the block chain is taken into account, and the authentication efficiency of the vehicle is improved. Therefore, efficient and safe identity authentication is realized.

A method of providing domain name system (“DNS”) eligibility is provided. The method includes obtaining, at an eligibility service comprising at least one electronic server computer communicatively coupled to a computer network, a request of an eligibility proof from a DNS client; validating, by the eligibility service, the request; providing, by the eligibility service, the eligibility proof to the DNS client; obtaining, by the eligibility service, the eligibility proof, wherein the eligibility proof is related to a registration of a domain name by the DNS client with a DNS registry; validating, by the eligibility service, the eligibility proof; applying, by the eligibility service, a promotion credit to an account of the DNS client; and providing, by the eligibility service, a confirmation of the promotion credit to the DNS client.

The present invention discloses a secure and efficient authentication method for smart devices based on a consortium chain. The method is as follows: Step 1: A registration agency generates a challenge set and sends it to a sensor device. The sensor device calculates a response using a PUF and maps it to an elliptic curve group element. The final information is stored on the consortium chain; Step 2: The sensor device generates a signature and constructs a zero-knowledge proof, ensures message integrity and authentication by using the Fiat-Shamir heuristic transformation, and sends the generated proof to an edge device; Step 3: The edge device uses the received pseudonym and proof to verify the identity of the sensor device and the legitimacy of the message. After successful verification, the edge device adds the pseudonym to the used list and records the verification result in the consortium chain to ensure data transparency and immutability. The present invention enhances the security of device authentication and is suitable for scenarios such as the industrial Internet of Things that require high security and privacy protection.

The invention provides a digital certificate reliability level identification and verification method and device and electronic equipment, and relates to the technical field of information security, and the method comprises the steps that a registration mechanism obtains a digital certificate request sent by an applicant; the registration institution determines the type and the reliability level of the digital certificate based on the digital certificate request, and identifies the identity of the applicant; the certificate authority embeds a dominant reliability level identification extension item in the digital certificate based on the digital certificate type and the reliability level thereof; wherein the dominant reliability level identifier extension item comprises a digital certificate reliability level identifier, an identity authentication field, a password component identifier, a certificate purpose identifier and a conformity auditing identifier; and the certificate issuing mechanism carries out digital signature on the digital certificate containing the dominant reliability level identification extension item to obtain the digital certificate with the dominant reliability level identification. According to the invention, the method eliminates the dependence on an external certificate strategy file through embedding the structured RCStatements extension item in the digital certificate, and avoids the risk of file failure.

The present invention discloses a V2C post-quantum authentication and key negotiation method based on RLWE. During system initialization, a master key, public key, hash function, and related parameters are selected. During the registration phase, the vehicle and cloud server CS register with a registration authority RA. During the login phase, the vehicle and CS log in to the local system. During the authentication and key negotiation phase, the vehicle and CS perform identity authentication and key negotiation through the RA, negotiating a session key for subsequent secure communication without revealing their true identity. During the identity and password update phase, users can directly update their identity and password without going through the RA. The present invention is based on ring fault-tolerant learning RLWE and a hash method design, effectively reducing the computational and communication overhead of the AKA process, resisting attacks by quantum adversaries, and ensuring the confidentiality of the true identity of legitimate vehicles. Furthermore, the "fuzzy verifier + honeyword" technology is used in the AKA process to resist signal leakage and key guessing attacks, ensuring key security.

The invention discloses a blind signature and chameleon Hash-based dual-certificate DID management method and system, and the method comprises a registration stage, a verification stage and an updating stage: the registration stage: a user terminal sends a registration message, a blind message and an original identity Hash value as identity Hash, a registration mechanism generates a blind signature after verification, issues a registration certificate, and sends the registration certificate to a user terminal; the user terminal locally generates a verifiable certificate after blind verification; in the verification stage, the server calls the smart contract, and verifiable certificate validity is verified based on a chameleon hash function; in the updating stage, the user terminal generates a new verifiable certificate by using the chameleon Hash controllable collision characteristic, and chain identification updating is completed after verification of the intelligent contract. According to the method, authority is split through a double-certificate architecture, blind signature and chameleon hash technologies are fused, autonomous control of user identities, privacy protection and flexible updating are realized, and verification security and efficiency are improved.

A system for managing domain registrations configured to connect to a blockchain wallet running on a client device. The blockchain wallet includes associated keys for a blockchain system. The system is further configured to inspect the blockchain wallet for a first non-fungible token (NFT) associated with a first domain name, and check with a domain name service (DNS) registry on whether the first domain name is registered at the DNS registry. The DNS registry is configured to receive registration information associated with one or more domains. In response to the first domain name being registered at the DNS registry, performing one or more of (i) expiring the first NFT in the blockchain wallet, (ii) adding a second NFT to the blockchain wallet, (iii) adding a fungible token to the blockchain wallet, (iv) removing the first NFT from the blockchain wallet, or (v) exchanging the first NFT for the fungible token.

A computer-implemented method for granting a requester with permission to join a first network. The first network includes a set of bridge nodes and a set of devices controllable by one or more of the set of bridge nodes. Each bridge node is also a corresponding node in the blockchain network. The method is performed by a registration institution and includes generating a first blockchain transaction. The first blockchain transaction includes an input that includes a signature of a first public key linked to the registration authority. The first blockchain transaction also includes a first output, the first output including a first certificate, the first certificate including an identifier assigned to the requester. The method further includes transmitting the first block chain transaction to the block chain network to include it in the block chain.

Example embodiments of the present disclosure relate to devices, methods, apparatuses and computer readable media supporting network slice or tenant specific automated certificate management configurations. A network slice certificate orchestrator may be configured to receive from a management system certification authority configuration indicative of a certification authority configured for one or more network slices, and transmit to a registration authority or a certification authority a certificate request with respect to a network function allocated to one of the one or more network slices along with information of the certification authority configured for the one or more network slices.

Digital certificates are generated for devices by a Certificate Authority (CA), which communicates with devices via another entity—registration authority (RA)—so that the CA and RA cannot associate certificates with devices. Each certificate is associated with a public signature key, and with a public encryption key used by CA to encrypt the certificate to hide it from the RA. Both keys are derived by CA from a single key. For example, the signature key can be derived from the public encryption key rather than generated independently. However, high security is obtained even when the CA does not sign the encrypted certificate. Reduced bandwidth and computational costs are obtained as a result. Other embodiments are also provided.

The application discloses an anti-DoS authentication method and system based on pre-verification on the edge side of an Internet of Things, which comprises the following steps: firstly, a registration institution in the Internet of Things receives a registration request sent by a terminal device for registration and calculates a plurality of group verification points; secondly, the registration institution creates and initializes a dynamic time window Bloom filter, maps the group verification points, and simultaneously, the dynamic time window Bloom filter is sent to an edge server, and the edge server receives a to-be-authenticated message sent by the terminal device and analyzes the to-be-authenticated message; then, the edge server judges whether a timestamp of the terminal device message exists in a current valid time window, and if yes, an aggregated hash value is calculated as a query key for matching query; finally, when the query result is nonexistence, the to-be-authenticated message is an illegal request; otherwise, signature data is subjected to a password school authentication, and message authentication of the terminal device is completed. The application can significantly reduce the probability of illegal requests entering a high-overhead verification stage.

The invention provides a method for realizing key and certificate initialization and electronic equipment. The method comprises the following steps: acquiring a serial number; generating a public key and a private key which are arranged in pairs by using a preset encryption algorithm, and generating a certificate generation request in combination with the public key; the preset encryption algorithm comprises an elliptic curve encryption algorithm, and the public key is stored in the certificate generation request; sending the serial number and the certificate generation request to a registration mechanism; wherein the certificate generation request comprises a driving instruction, and the driving instruction is used for driving the registration mechanism to verify legality, and after legality, the registration mechanism sends the certificate generation request to a certificate issuing mechanism, and the registration mechanism receives a certificate generated by the certificate issuing mechanism; storing the private key, and obtaining a certificate from the registration mechanism; and verifying the certificate by using the private key, and storing the certificate after verification. The method is high in safety and high in speed.

A method for facilitating certificate signing requests with a registration authority is disclosed. In at least one embodiment, a registration authority computer can receive a certificate signing request associated with a token requester. The registration authority can authenticate the identity of the token requester and forward the certificate signing request to a certificate authority computer. A token requester ID and a signing certificate can be provided by the certificate authority computer and forwarded to the token requester. The token requester can utilize the token requester ID to generate a digital signature for subsequent token-based transactions.

The invention is applicable to the technical field of Internet of Things security, and relates to a high-concurrency PKI certificate processing method and system, a client sends a certificate application request to a registration mechanism module, and the registration mechanism module receives the application and generates a transaction identifier; the registration mechanism module calls an AI module to perform risk assessment on the application; the registration mechanism module packages the request content and sends the packaged request content to message-oriented middleware supporting asynchronous distribution, and the AI module analyzes the real-time flow to perform flow limiting judgment; the issuing mechanism module asynchronously pulls message queue data from the message middleware and verifies the message queue data; the AI module executes signing and issuing behavior analysis, and each module in the system records logs and constructs an auditable log chain; the issuing mechanism module transfers the abnormal message into a dead message queue, and the compensation center module processes the dead message queue; and the certificates which are signed and issued successfully / unsuccessfully are returned to the client, and the registration mechanism module archives the transaction. According to the method, the stability, the safety and the auditing performance of the system in a high-concurrency and complex environment are effectively improved.

The present invention relates to a scalable certificate management system, method, and non-transitory computer readable medium for securely providing certificates. The system can include one or more application platforms running a registration authority that are communicatively connected to one or more computing engines that perform cryptographic computations requested by the registration authority, one or more application platforms running an enrollment certificate authority that are communicatively connected to one or more computing engines that perform cryptographic computations requested by the enrollment certificate authority, one or more application platforms running a pseudonym certificate authority that are communicatively connected to one or more computing engines that perform cryptographic computations requested by the pseudonym certificate authority, and one or more application platforms running a first and second linking rights authority that are communicatively connected to one or more computing engines that perform cryptographic computations requested by the linking rights authority.

The invention belongs to the technical field of artificial intelligence, and discloses a safety communication system and method of a generative artificial intelligence enabled internet of things, and the system comprises a registration authority which is responsible for registering an internet of things user and internet of things equipment; the Internet of Things user registers with the registration authority by using the smart phone, interacts with the edge artificial intelligence after logging in, and controls the remote intelligent device through the edge artificial intelligence; the intelligent device is used for collecting data in the environment and transmitting the data to the edge artificial intelligence and the Internet of Things user after mutual authentication; the edge artificial intelligence is an edge server close to the intelligent equipment, and an artificial intelligence application is deployed in the edge server and is fusion of edge calculation and artificial intelligence. According to the invention, the secure communication between the Internet of Things user and the remote intelligent device is mainly realized, and a weak physical unclonable function is embedded in the remote intelligent device in order to protect the physical security of the remote intelligent device.

This network node includes: a transmission unit that transmits an initial registration request to a registration authority in a Certificate Management Protocol (CMP) via an Application Programming Interface (API) based on a Representational State Transfer (REST) architecture; and a reception unit that receives a response to the initial registration request from the registration authority via the API. The transmission unit transmits a certificate request to an authentication authority in CMP via the API, and the reception unit receives a certificate response from the authentication authority via the API.

The invention provides a dynamic group time base one-time password method and system with an optimized registration strategy. The method mainly comprises the steps that a registration mechanism sets security parameters, the maximum number of group members and the total number of verification stages, and generates a private key and a group public key; the registration mechanism receives registration, generates a certificate required by authentication by using the submitted group member identity information and the verification point, and returns the certificate; the group members generate a dynamic group time base one-time password by using the secret seed and the current time in combination with the certification returned by the registration mechanism; the verifier verifies the password, and the password of the user is combined with the group public key for verification. According to the method, a group member can generate a dynamic group time base one-time password containing an anonymous identity ciphertext and a proof, and a verifier completes authentication judgment without networking, so that the unity of anonymity, traceability, revocable and offline verification capability in dynamic group authentication is realized.

The application discloses a network element registration method and device, equipment and a storage medium, relates to the technical field of communication, and is used for improving the accuracy of network element registration. The method comprises the following steps: obtaining registration information and a target network element type of a target network element, the registration information comprising at least one of the following: number segment information, location information, and internet protocol (IP) information; determining the registration authority of the target network element according to the registration information and the target network element type of the target network element, the registration authority of the target network element being any one of the following: allowed to be registered and allowed to be discovered, allowed to be registered and not allowed to be discovered, and not allowed to be registered; and in the case that the registration authority of the target network element is allowed to be registered and allowed to be discovered or allowed to be registered and not allowed to be discovered, completing the registration of the target network element. The application is applied to a scenario of managing the registration of network elements.

A system or method that uses a subscriber identity module (SIM) as a pseudonymous certification authority (PCA) to anonymize a device having the SIM and reduce tracking of the device. The system or method can include one or more processors, which can verify a device identity presented by the device, where the SIM functions as a registration authority, and further issue a new certificate in response to a certificate signing request (CSR) submitted by the device, where the SIM functions as a certification authority (CA). In some embodiments, the SIM is an applet stored within the device. In some embodiments, the SIM functions as a PCA to generate a short-term end entity certificate dedicated to signing broadcast messages. Other embodiments are also disclosed.

The invention discloses an asynchronous Internet of Vehicles authentication and key negotiation method based on a block chain. The method comprises the following steps: selecting related parameters, a key, a hash function and block chain configuration in a network; the vehicle and the cloud server are registered through a registration mechanism, and a public key and registration information are uploaded on the block chain; the vehicle initiates an authentication request to a road side unit (RSU), and the RSU performs identity authentication by using a block chain network and returns a response; after identity verification is passed, session key negotiation is carried out between a vehicle and an RSU through a block chain network, after key negotiation is completed, message authentication and key sharing are carried out through the block chain network, the security of the key negotiation process is ensured, and the security of the key negotiation process is ensured by using the decentration characteristic of the block chain. According to the invention, the single-point fault problem of a traditional centralized system is effectively avoided, and the safety and reliability of the system are improved.

Systems, methods, and computer-readable storage media for enabling secure transfer of Internet domains between registrars. An example method can include receiving, at a registry, a request from a first registrar for information associated with an object recorded in the registry and registered by the first registrar, then generating, at the registry, an authorization code, the authorization code having an expiration. The registry can then transmit, to the first registrar, the authorization code, which in turn can be given to the registrant. The registrant can forward the authorization code to the second registrar, and the registry can receive, from a second registrar before the expiration has been reached: the authorization code and a transfer request for the object, the transfer request identifying a transfer of the object from the first registrar to the second registrar. At that point the registry can verify the authorization code authorize the transfer request of the object from the first registrar to the second registrar.

To provide an information processing apparatus and a control method of the information processing apparatus capable of improving usability when requesting issuance of an electronic certificate suitable for the purpose of the electronic certificate.SOLUTION: The multifunction peripheral 101 has a CPU201 in which a protocol to be used in an issuance request for a digital certificate is set for each purpose of the digital certificate according to an input by a user, an instruction for the issuance request for the digital certificate is received in association with the purpose of the digital certificate according to an input by the user, and the issuance request for the digital certificate is transmitted to the certificate / registration authority 102 using the protocol set for the purpose of the digital certificate associated with the instruction.SELECTED DRAWING: Figure 1