88 results about "Revocation list" patented technology

Systems and methods are provided for a scalable load balancer to enable client certificate access control using mutual transport layer security authentication comprising hardware configured to receive trust store files including a certificate authority (CA) bundle and a certificate revocation list (CRL), generate a single trust store file based on the trust store files, distribute a snapshot of the single trust store file to one or more nodes of the scalable load balancer, verify, using the snapshot, a client certificate from a client device by searching for a trusted CA from the CA bundle in the snapshot, determine whether the CRL contained in the snapshot includes the client certificate, and upon verifying the client certificate and determining that the CRL does not contain the client certificate, transmit connection data from the client device to an application target.

The invention relates to a safe dynamic loading method for a peripheral adaptive plug-in in an embedded low-resource environment, and belongs to the technical field of plug-in loading. The method comprises the following steps: executing digital signature identity authentication and lightweight increment integrity verification; analyzing the metadata, and distributing a physical isolation memory area by utilizing a memory management unit; initializing and analyzing the peripheral dependency list in the isolation memory, dynamically generating an encryption capability token bound with an isolation domain identifier, and embedding a monitoring hook to verify the authority of the token; performing lightweight behavior auditing during operation, triggering a response mechanism based on a result, and checking a certificate state by using a pre-downloaded certificate revocation list incremental data packet when the system is idle; verifying the new-version plug-in independently, pausing the old-version capture state snapshot, switching the peripheral control right to the new-version plug-in through the atomic operation sequence, recovering the token and safely erasing the memory. The whole mechanism ensures high-security isolation and dynamic protection. The efficient and safe loading and operation of the peripheral adaptive plug-in under the embedded low-resource environment are realized.

The invention discloses a cross-chain-based adaptive identity revocation method and system, and belongs to the technical field of block chains. The cross-chain-based self-adaptive identity revocation system comprises an application chain, a super chain, trusted hardware and an automatic agent node, the application chain provides an initiator and a receiver for a cross-chain transaction, realizes identification of cross-chain operation of a user through an intelligent contract, and transmits the cross-chain operation to the automatic agent node; the superchain periodically issues revocation list information to the automatic proxy node through a heartbeat mechanism; the automatic agent nodes are provided with the trusted hardware, provide a trusted execution environment for an identity revocation mechanism and are used for verifying heartbeat information, synchronizing time and executing identity revocation operation at the same time. The system is suitable for financial transactions, supply chain management and internet of things identity authentication scenes in a multi-chain environment, and the security, transparency and revocation efficiency of a cross-chain system are effectively improved.

The invention discloses a lattice-based hybrid revocable attribute encryption and decryption method and system, and the method comprises the steps: generating a common parameter and a master key according to an initialization algorithm, and constructing a binary tree structure; a binary tree leaf node is distributed to a user based on the binary tree structure, a user private key is generated in combination with a user attribute set and the master key, and the user private key comprises a path node key component; constructing a user revocation list according to the access strategy, and embedding a ciphertext in the user revocation list; verifying that the attribute set meets the access strategy and checking whether the secret key is consistent with the ciphertext version, and if yes, using the updated secret key to complete decryption. And through a key and ciphertext updating algorithm, the decryption capability of a specified attribute is periodically revoked to realize indirect attribute revocation.

The invention provides a management method and device for preventing BMS firmware from being flashed, and relates to the technical field of asymmetric encryption, and the method comprises the steps: generating a unique response, and reconstructing an equipment root key, so as to establish a trusted firmware execution environment and complete firmware digital signature verification; digital certificate exchange and bidirectional verification of the BMS and the diagnostic instrument are carried out in the trusted firmware execution environment, a dynamic session key is generated, and a challenge response mechanism is executed to ensure that firmware flashing operation is only authorized in the trusted communication environment; performing hash check, control flow monitoring and access auditing by using the security reference data based on the dynamic session key, performing real-time hardware processing when an exception is detected, and recording a security event at the same time; and the BMS uploads the log and attack behavior characteristics corresponding to the security event to a cloud platform, and the cloud platform analyzes and generates a detection rule or certificate revocation list and issues and updates the detection rule or certificate revocation list. Through the dynamic BMS firmware flashing protection method, the safety of the BMS firmware is improved.

The invention discloses an attribute-based Internet of Vehicles dual access control data sharing method, which comprises the following steps of: generating an attribute key by a user, and generating an agent key by using the attribute key; an owner of the data encrypts the data by using an attribute-based encryption algorithm according to a defined semi-hidden access structure, and the encryption process is divided into an offline stage and an online stage in consideration of limited computing power of a vehicle end; the cloud server filters out false information sent by the malicious user; (access control is performed on a download request sent by a user who wants to access data, so that EDOS attack is denied; only the user meeting the access strategy can decrypt the ciphertext, and the decryption stage is also divided into an outsourcing decryption stage and a user decryption stage; the malicious user is revoked, and after the malicious user is revoked, only the ciphertext related to the revocation list needs to be updated, and the whole ciphertext does not need to be updated. According to the invention, safe data sharing in the Internet of Vehicles can be realized, and wide application of the Internet of Vehicles is promoted.

The invention discloses a user revocable attribute keyword search-based encryption method and system with integrity verification, in the encryption system, a system parameter setting module generates a public parameter, a main private key, a binary tree, a revocation list and a message authentication key; the key generation module generates a public and private key pair of a user and updates binary tree state information; the ciphertext generation module generates a ciphertext and a message authentication code; the trap door generation module generates a search trap door; the updating module generates an updated timestamp ciphertext and a conversion key; the verification module generates an intermediate ciphertext after judging that the search result is complete, the revocation module updates a revocation list according to the revoked user, and the decryption module decrypts to obtain plaintext information according to the private key of the user. According to the invention, fine-grained data access control and result integrity verification in the cloud environment can be realized, and the identity of the user can be revoked at the same time.

The invention discloses a mutual trust authentication and key negotiation method for a vehicle and a roadside unit, relates to identity authentication of a communication entity of the Internet of Vehicles, and belongs to the field of information security of the Internet of Vehicles. The method comprises the following steps: presetting a trusted center key, and embedding an unclonable device into the communication entity; after the registration response is received, the communication entity stores the triad in a memory of the communication entity; the method comprises the following steps: constructing authentication messages based on an identity label, a password, a timestamp and an elliptic curve public key cryptographic algorithm of a communication entity, and realizing communication entity identity mutual trust authentication and session key negotiation through interaction of the authentication messages and verification of a to-be-verified parameter; after the identity mutual trust authentication is passed, the receiving communication entity verifies the integrity of the received key message; the trusted center can track the identity of a false message sender; and the communication entity adds the false identity of the false message sender to the incremental false identity revocation list of the false message sender to complete revocation of the false message sender, so that the authentication efficiency of the vehicle and the road side unit is improved.

Some embodiments provide proxies or other servers in a computing network with independent certificate chains which facilitate mitigation of certificate problems. Independence criteria are enforced against two or more installed certificate chains on a given server, identifying and avoiding dependencies such as cross-certification, shared certificate authorities, shared revocation lists, or shared certificate status protocol endpoints between the certificate chains. Some embodiments serve independent certificates concurrently in an active-active certificate server configuration. The certificate chains' coexistence and their independence from one another facilitates transitioning the network from a failing issuer or a failed chain to a chain that works better, thereby improving network resilience and limiting damage from certificate problems. By dynamically updating certificate bindings, some embodiments also facilitate safe deployment of new certificates during migration from one issuer to another. Certificate distributions are computed from issuer ratios, network topology, or both.

The invention relates to the technical field of cryptography, and discloses a time-limited key and message dependent open group signature method based on a lattice password. The method comprises the steps that a user interacts with a group administrator and joins in a group, and a private key of each group member is related to an authorization time period set; group members can generate group signatures in an authorized time period on behalf of the whole group; the group administrator can add the revocation element into the revocation list, and revokes the signature authority of the group member in the corresponding authorized time period; a verifier can verify the group signature through the revocation list; a group administrator can track all group signatures; the open authority may track a group signature for a corresponding message after obtaining an admitter-generated tag about the message. According to the method, a non-interactive and revocable message-dependent open group signature method is realized by combining a modified time-limited key method, and the anonymity and signature efficiency of a signer are enhanced.

This network node comprises: a reception unit that acquires a certificate revocation list (CRL); a control unit that identifies a device in which a certificate has expired on the basis of the CRL, and identifies an opposing entity having said device as a communication destination; and a transmission unit that transmits, to the opposing entity, a setting for excluding said device from the communication destination.

The application discloses a kind of enhanced security revocable anonymous authentication method of Internet of Things, including the following steps, S1: system initialization, for generating public parameters and user registration;S2: authentication between user and gateway, for identity authentication and session key establishment;S3: password update and revocation, authorized user can update password, gateway can revoke malicious user.It is beneficial to generate a pseudonym using the random number of gateway, provide a safe and effective identity privacy protection scheme, perfectly solve the problem of anonymity and message unlinkability.Add an effective revocation mechanism, when malicious user appears, gateway will record it to revocation list, and gateway does not provide key generation service for the user, so as to realize user revocation, realize identity authentication, anonymity, unlinkability, password update and revocation, etc.Security requirements such as.

A method for efficient certificate revocation support is provided for digital services and offline operation, where the digital services use certificates to provide authorization and / or prove identity or authorization in a public key infrastructure, for mobile services, or for V2X services. The method involves a revocation authority entity creating a certificate revocation list, reducing the size of the created certificate revocation list, and distributing the reduced certificate revocation list online using centralized revocation propagation to at least all relevant nodes of a target network.Before entering offline mode, at least one of the relevant nodes of the target network is adapted to receive the distributed reduced certificate revocation list in order to check locally whether it is affected by an invalidation or not, and, if so, to request an explicit non-revocation certificate from the revocation authority entity.

A revocation determination method involves acquiring an electronic certificate, acquiring a certificate revocation list including one or more invalid certificates that are revoked electronic certificate, and determining, based on a serial number and one or more condition information items, whether the acquired electronic certificate is valid or invalid, the serial number being included in the acquired certificate revocation list, the one or more condition information items being indicated in one or more extension regions included in the acquired certificate revocation list.

A method for securely updating a firmware (FW) of a component of an information handling system (IHS) includes: receiving an update package for the component; analyzing the update package to extract at least a manifest and an FW update file associated with the component; making a first determination that the manifest is authenticated; making, based on the first determination, a second determination that a key revocation criterion is met, in which the key revocation criterion specifies that a certificate revocation list (CRL) does not specify an authentication key to be used to authenticate an updated FW of the component; updating, based on the second determination, the FW of the component using the FW update file, in which, after being updated, the component has the updated FW; and initiating notification of a user of the IHS about the updated FW of the component.

The application provides a kind of anonymous identity authentication and supervision method on X.509 compatible blockchain, and each user party calculates the middleware that is legally held according to its own private key and the legal certificate held by itself and generates the first zero-knowledge proof;Combined with Merkle tree and accumulator, the identity certificate identification number of itself is proved to the service party that it is not in the revocation list of service party to obtain the second zero-knowledge proof, and multiple secret values and public values are generated;Request is sent to the service party and the first zero-knowledge proof, the second zero-knowledge proof and the public value are provided, and the service party is authenticated, if the three are verified, the request sent by the user party is responded to.The application uses standard X.509 specification certificate anonymous access service party Various services provide basic privacy protection, while designing a proof scheme supporting large-scale certificate revocation, greatly reducing the zero-knowledge proof overhead of generating proof not in the revocation list.

The embodiment of the invention provides a revocable attribute-based encryption method based on a block chain and policy hiding, and belongs to the technical field of data security. Comprising the following steps: constructing an access strategy, generating a symmetric key, encrypting a data file and the symmetric key, and outputting an intermediate ciphertext; replacing an access strategy in the intermediate ciphertext through a Bloom filter, outputting a final ciphertext and a ciphertext header component, and storing a hash value of the final ciphertext to a block chain BC; verifying a decryption token for applying for accessing the data file by the data user DU; if the verification is passed, judging whether the attribute set of the data user DU is in a revocation list; under the condition that the attribute set is not in the revocation list, verifying whether the attribute meets an access strategy or not; if yes, executing an outsourcing decryption operation, and returning a part of decryption result to the data user DU; verifying the correctness of the partial decryption result according to a hash value stored on the block chain BC; and if the verification is passed, final decryption is carried out to obtain a plaintext data file.

A method for authorizing a payment modality is provided. A payment device can receive a set of cryptographic access components from an authorization instrument of a payer corresponding to the payment modality. If the cryptographic access components are quantum-aware, the payment device can obtain a post-quantum cryptographic algorithm (e.g., SABER, Kyber, Enhanced McEliece, or RLCE) from a context-specific non-critical extension in a private Object Identifier (OID) namespace. The device can validate a root of trust specified in a Trust Anchor Locator (TAL) record, confirm that a respective certificate, Certificate Revocation List (CRL), or TAL is specified in at least one Manifest record, confirm that a hash matches a recorded hash in a respective Manifest, and confirm that a respective CRL or Manifest is fresh. The device can encrypt an authorization request using a cryptographic key validated by the cryptographic access components, root of trust, hash, or respective CRL or Manifest

The application relates to a revocable access control method based on cloud edge cooperation, which comprises the following steps: a blockchain execution system is set, and global parameters are generated; a data owner is set, and a public key and a master key are generated; an edge node executes a setting algorithm, and outputs a public key and a master key of the edge node; a user decryption key is composed of the key of the data owner and the key of the edge node; the data owner firstly executes partial encryption of data according to an access strategy and plaintext information, generates partial ciphertext, and then the edge node performs secondary encryption on the partial ciphertext to obtain final ciphertext; the blockchain performs key legality checking on the user decryption key, and the user with the key passing the checking can continue to access the data; the edge node firstly performs semi-decryption on the final ciphertext to obtain semi-decrypted ciphertext, and then the user performs final decryption on the semi-decrypted ciphertext to obtain correct plaintext; after the revocation operation is executed, the ciphertext is updated by using an updated revocation list and the key, and the updated ciphertext is stored in the cloud.

A method at a computing device within an Intelligent Transportation System (ITS), the method including: receiving a first message, the first message including at least tailoring information for a first ITS endpoint and intended journey details for the first ITS endpoint; storing all or a subset of data from the first message; obtaining a full certificate revocation list; creating a tailored certificate revocation list based on data in the first message and the full certificate revocation list, the tailored certificate revocation list containing certificates or identifiers of certificates for ITS endpoints that may be encountered by the first ITS endpoint when navigating a route provided in the intended journey details; and providing the tailored certificate revocation list to the first ITS endpoint.

Disclosed in the present application are a certificate revocation list (CRL) updating method and a related apparatus. The method comprises: acquiring reference information, wherein the reference information comprises at least one of revocation records to be processed of a first CRL, certificate types of revoked certificates, the number of times the first CRL is accessed, a preset update cycle of the first CRL, and an update timeliness level of the first CRL that is configured by a user, and each revocation record comprises a certificate revoked after the first CRL is issued; and when the reference information satisfies update conditions, updating the first CRL to obtain a second CRL. The flexibility of certificate revocation list updating is improved. In addition, the interval between an issuance moment of the first CRL and an issuance moment of the second CRL is less than the preset update cycle of the first CRL, thereby improving the timeliness of certificate revocation list updating, and helping to improve the security of communication.

The invention relates to the technical field of secure communication, and discloses a mobile intelligent node dynamic networking security control system, which comprises a group division module, a key management module, a member access module, a secure communication module, a tracking and revocation module and a controller module. The group division module realizes self-adaptive stable clustering by adopting a K-Means algorithm and combining Z-score standardization on the basis of feature vectors of the speed, the position, the type and the direction of the mobile node; the key management module initializes and maintains a post-quantum lattice base group public key, a member private key and a tracking key in each cluster; the member access module completes hardware identity binding and distributes signature private keys through PUF challenge-response and zero-knowledge proof; the secure communication module performs anonymous signature and verification on the service message by adopting a quantum group signature scheme after the lattice difficulty problem; and the tracking and revocation module opens a group signature to position a signer by using the tracking key, and maintains a revocation list to timely eliminate failure nodes.

The invention discloses a method and a system for safely sharing data in an untrusted cloud environment. The method comprises the following steps: 1) when a trusted program is started for the first time, initializing a service key RKEY and a revocation list in a trusted execution environment TEE memory; encrypting the RKEY and storing the encrypted RKEY in a storage program; loading the encrypted RKEY into the TEE memory and decrypting the RKEY when the RKEY is not started for the first time, and loading the revocation list into the TEE memory and decrypting the revocation list; 2) the trusted program generates an identity ID, an identity key IKEY and an authentication report TCERT for a to-be-registered user; encrypting the IKEY by using the RKEY, and storing the encrypted IKEY in a storage program; 3) the trusted program generates an ABE master key pair for the user, and binds the MSK with the ID of the user; 4) the trusted program generates a private key SK for the user and binds the private key SK with the ID of the user; and 5) the trusted program decrypts the ciphertext by using the SK after receiving the data decryption request of the user.

The invention relates to a multi-authorization-mechanism traceable lightweight searchable attribute-based encryption method, belongs to the technical field of network and information security, and aims to realize flexible access control of data needing to be shared in an encryption and decryption mode. Comprising the steps of system initialization, key generation, data encryption, trap door generation and retrieval, decryption, key tracking and permission revocation. According to the method, multiple authorizations are combined, and the security of the secret key is improved through multi-party collaborative management of the secret key; meanwhile, the tracking of the secret key and the revocation of the user permission are realized by utilizing symmetric encryption and a revocation list; a flexible multi-keyword retrieval function is realized based on a polynomial equation; in the encryption, decryption and ciphertext retrieval processes, the calculation overhead is constant, the calculation burden is not increased along with the increase of the number of the attributes, and the length of the ciphertext is kept constant, so that the storage and communication overhead of the ciphertext is effectively reduced; the method is suitable for a data sharing application scene with limited equipment computing power and storage resources.

The invention discloses a distributed anonymous certificate authentication method and device supporting multiple CAs, a medium and equipment, and the method comprises the steps: sending the identity attribute of a user to each certificate issuing mechanism, and receiving corresponding anonymous certificates generated after each distributed certificate issuing mechanism signs the identity attribute of the user which does not belong to a revocation list; sending the identity identifier of the user to a supervision mechanism, and encrypting the identity identifier by using the public key according to the supervision mechanism to determine an identity escrow ciphertext; sending each anonymous voucher to a verifier, and completing batch legality verification of each anonymous voucher together with the verifier in a zero-knowledge certification environment to obtain a message verification result of each anonymous voucher; sending the identity trusteeship ciphertext to a supervision mechanism, and determining a decryption plaintext of the supervision mechanism to the identity trusteeship ciphertext; according to the method, a distributed signing and issuing mechanism which does not need credible initialization is designed, multi-CA cooperative work is supported, a single-point fault is avoided, and the decentralization degree and robustness of the system are improved.

The invention relates to a fine-grained data dynamic access control method based on attribute-based encryption. The method comprises the steps of obtaining to-be-shared data, and performing symmetric encryption on the to-be-shared data according to a randomly generated symmetric encryption key to obtain a data ciphertext; based on an access control strategy, encrypting the symmetric encryption key by using an ABE encryption algorithm to obtain a convertible ciphertext header; in response to the obtained data access request, performing user identity verification according to a user identity public key and an access data identifier in the data access request based on a current system state version number, a revocation list and metadata of to-be-shared data in the smart contract of the block chain to obtain a verification result; and if the verification result is that the verification is passed, obtaining a corresponding convertible ciphertext header according to the access data identifier, and performing re-encryption processing on the convertible ciphertext header according to the proxy re-encryption private key, the current system state version number and the revocation list to obtain a new ciphertext header. By adopting the method, large-scale and frequent permission change can be dealt with.

The invention discloses a privacy-enhanced access control method for medical data sharing, which is characterized in that an efficient and privacy-protected attribute revocation mechanism is innovatively added on the basis of an original decentralized multi-authority attribute verification and strategy hiding mechanism, and an attribute revocation list (ARL) based on a Merkle tree and corresponding ZKP constraints are introduced, so that the privacy-protected access control method for medical data sharing is realized. Fine-grained dynamic authorization is supported, the security problem that user permission changes along with time in a medical environment is effectively solved, and triple privacy security of user attributes, access strategies and attribute validity states is ensured. Through cooperative work of a system initialization stage, a strategy deployment stage, an access request submission stage, an access control decision stage and a data access stage, strong privacy protection, decentralized architecture, fine-grained control and dynamic authorization in medical data sharing are realized; the problems of single-point failure, privacy disclosure and strategy stiffness in a traditional scheme are effectively solved, and a safe and reliable technical basis is provided for cross-institution medical cooperation.

Methods and systems are provided for securing distributed shares of an electronic wallet. An example method includes provisioning a plurality of devices each hosting an e-wallet share with enhanced privacy identification (EPID) private keys for the e-wallet share. A signature is posted for the e-wallet share to a blockchain. A determination is made as to whether the e-wallet share is compromised, and, if so, posting a revocation list comprising the signature for the e-wallet share to a blockchain.

The invention discloses a remote key injection method and system based on asymmetric cryptography. The method comprises the following steps: establishing a three-level CA system, presetting a certificate, and strictly defining a theme identifier and an expansion key usage of the terminal certificate; both the device side and the server side verify the certificate chain and the extended key usage of the opposite side, actively acquire and verify the certificate revocation list of the intermediate CA of the opposite side, and perform anti-replay certificate state verification in combination with the OCSP; the two parties are bound with a specified communication party by comparing the certificate theme identifier with a preset authorization list; the two parties generate a temporary key pair, and an initial key is securely transmitted by adopting an asymmetric cryptography mechanism; and S4, the device end decrypts to obtain the initial key and securely stores the initial key. Through bidirectional peer-to-peer deep verification, service binding and forward security key negotiation mechanisms, the problems of insufficient authentication strength, easy replay attack, lack of forward security and poor flexibility in the prior art are solved.

The invention discloses a single sign-on access control method based on attribute encryption in cloud storage, and relates to the technical field of information security, and the method comprises the steps: S1, generating a system public parameter and a master key, and enabling an attribute authority to generate own public and private keys; s2, the user registers to an authentication server, and the authentication server issues a token to the user; s3, the authentication server generates a corresponding decryption key for each user; s4, the data owner formulates an access strategy, encrypts the message according to the access strategy and the system public parameters, calculates and uploads a ciphertext to the storage server; s5, the user sends a decryption request to the storage server, and a plaintext is obtained through decryption; s6, the attribute authority updates the ciphertext and the decryption key; the authentication server maintains a user revocation list. According to the method, dynamic fine-grained access control is realized on the premise that information such as user attributes is not leaked, the problem of privacy leakage caused by multiple times of registration of the user is relieved through a single sign-on method, and the method has high efficiency.