212 results about "Root certificate" patented technology

The invention discloses a bidirectional authentication secure mobile communication method and system based on a public key digital fingerprint, and belongs to the technical field of communication security. The method specifically comprises the following steps: S1, digital certificate application and issuing: a mobile terminal and a service server respectively use an encryption algorithm to generate an asymmetric key pair which comprises a public key and a private key, an entity submits a CSR file which comprises a public key, entity identity information and an extension field to a CA, and the CA strictly audits the entity identity and issues a digital certificate; and performing digital signature on the public key and the entity information by using a CA private key after the auditing is passed. Two-way identity authentication is achieved, communication safety is improved, a traditional scheme only supports one-way authentication of a client to a server and is prone to phishing attack and identity false use, digital certificates are exchanged before communication between a mobile terminal and a service server, the legality of the certificates is verified through a public key of a CA root certificate, and the authenticity of the identities of the two parties is ensured. A bidirectional authentication mechanism effectively prevents man-in-the-middle attack and identity counterfeiting problems, and the security risk is greatly reduced.

The invention provides a real estate full life cycle intelligent management method and system based on Internet of Things perception, and the method comprises the steps: distributing a unique hardware identifier of equipment, combining a lightweight digital certificate with a pre-shared key to achieve two-factor authentication, and storing a root certificate in a cloud end; an access authentication process is optimized, an identity label and a certificate signature request need to be submitted when a node accesses for the first time, a temporary session key is generated after the gateway verifies, and abnormal access is immediately isolated and reported; data integrity verification is implemented, and after a sensor collects data, an abstract is generated and data encryption transmission is carried out; after decryption, the receiving end recalculates the abstract for comparison, and if not, the abstract is discarded and nodes are marked to be abnormal; a data anomaly detection model is constructed, energy consumption fluctuation is determined based on historical data, a frequency baseline is collected, data reasonability is monitored in real time, secondary authentication is triggered when the data is abnormal, and node data access is suspended if the data fails; a hierarchical key system is established, hardware is solidified by a root key, session keys are alternated for 24 hours, and data encryption keys are dynamically derived and distributed through encryption channels.

The invention discloses an edge computing-based industrial Internet of Things equipment data encryption transmission method, which comprises the following steps of: constructing an edge node alliance comprising at least two cross-regional edge gateways, completing bidirectional identity authentication through an alliance root certificate, and establishing an encrypted communication link; industrial equipment collects original data and then transmits the original data to an edge gateway which the industrial equipment belongs to, and the gateway extracts data features and divides the data features into a core control level, a process parameter level, a common monitoring level and a security level; differential encryption strategies are adopted for different levels of data; each edge gateway uploads the encrypted data to a distributed key management node, and obtains and synchronizes a periodically updated key chain; during cross-region transmission, performing secondary packaging and encryption to generate a data packet containing identifications such as a security level and the like; and the receiving end verifies the legality of the node, decrypts and verifies the integrity of the data, distributes the data if the decryption is passed, and blocks the alarm if the decryption The method is suitable for scenes such as single-area monitoring and multi-area manufacturing, data security and transmission efficiency balance are achieved, and all-weather stable transmission is guaranteed.

Embodiments are directed to a virtual microcontroller for device authentication in a confidential computing environment. An embodiment includes a processor to implement a service trust domain (TD) as a virtual microcontroller (VMC) trust domain (VMC-TD) for a device, where the VMC-TD is to support protocols for device authentication, device measurement, and device management; and receive a VMC certificate chain that is endorsed by a startup service component comprising at least one of a trusted module of the confidential computing environment, the VMC certificate chain comprising a root certificate of the startup service component, a startup services module signing certificate, and a full VMC certificate comprising the initial VMC certificate and a TD report comprising a measurement of the device.

The embodiment of the invention provides a system mutual recognition method, device and equipment for the Internet of Vehicles, and the method comprises the steps: obtaining a trusted root certificate of a platform, inputting a trusted root certificate list and a corresponding root certificate of each trusted domain, and updating the trusted root certificate list in real time; analyzing the trusted root certificate list, extracting a root certificate of each trust domain and the trusted root certificate list, and performing verification; providing a certificate verification service protocol based on all trust domains; receiving a construction request protocol of the equipment, analyzing the construction request protocol, and returning a response message of which a response protocol contains a certificate trust state so as to indicate the equipment to analyze the response message and confirm whether the queried certificate is trusted or not; the method is simple in process, supports efficient mutual recognition among multiple PKI systems, and solves the problems that the cost of interactive network resources of existing Internet of Vehicles equipment is large, and the efficiency of issuing a trusted root certificate list is low.

The invention relates to the technical field of communication, in particular to a communication method and system, electronic equipment and a storage medium. The communication method comprises the steps that a first communication end sends a connection request to a second communication end; the second communication end verifies the first identity certificate based on the root certificate, verifies the first signature information based on the first public key when the verification is passed, and generates a second temporary public key and a second temporary private key when the verification is passed; the second communication end generates a public session key based on the first temporary public key and the second temporary private key, and sends a request response to the first communication end; and the first communication terminal verifies the second identity certificate based on the root certificate, verifies the second signature information based on the second public key when the verification is passed, and generates a public session key based on the first temporary private key and the second temporary public key when the verification is passed. Through the process, the security of establishing the secure data transmission channel can be improved.

The data processing method comprises the following steps: a second client extracts a public key of a second user from an identity certificate of the second user, performs hierarchical encryption on data by using the public key of the second user to obtain a ciphertext, and stores the ciphertext and the identity certificate of the second user in a block chain network; and the first client obtains the ciphertext and the identity certificate of the second user from the block chain network, and verifies the legality of the identity certificate of the second user by using the root certificate. And when the verification is passed, the first client extracts the first derived information from the identity certificate of the first user and extracts the second derived information from the identity certificate of the second user. Wherein the derivation information indicates a derivation path of the identity certificate. And the first client determines a private key of the second user according to the derived information and the private key of the first user, and decrypts the ciphertext according to the private key of the second user to obtain data. According to the method, an authentication mechanism of an identity certificate is used for carrying out identity authentication on a public key, the identity trust problem is solved, and the visibility of data divided according to levels is realized.

The invention relates to the technical field of information security, in particular to a cluster self-discovery method suitable for a cloud server cipher machine, which comprises the following steps: when physical equipment of the cloud server cipher machine leaves a factory, a certificate management module generates an equipment certificate and a root CA certificate in combination with an enterprise CA system, and stores the equipment certificate and the root CA certificate; after the virtual cipher machine is created and started, the key management service module combines with the certificate management module to generate a virtual machine certificate, and stores the virtual machine certificate, the storage device certificate and the root CA certificate together; the cluster management service module enables the master node of the virtual cipher machine to discover the slave node of the virtual cipher machine in the same network domain through UDP broadcast, and executes three-level verification on the slave node of the virtual cipher machine from three aspects of an equipment certificate, a virtual machine certificate and an authentication signature; and the virtual cipher machine master node synchronizes the cluster master key to the virtual cipher machine slave node passing verification. According to the invention, hierarchical identity isolation and verification of the cloud server cipher machine host and the virtual cipher machine can be realized, and the security of cluster self-discovery and authentication stages is ensured.

The invention relates to the technical field of block chain data storage and traceability tracking, in particular to a document printing and traceability tracking system based on a block chain. Comprising an off-line certificate generation unit used for generating an off-line cryptographic certificate based on technical parameters analyzed from an external printing request; the dynamic anchoring control unit is used for monitoring system state parameters and carrying out dynamic anchoring strategy calculation based on the system state parameters so as to generate an anchoring triggering decision; the aggregation anchoring unit is used for responding to the anchoring triggering decision, aggregating a plurality of offline cryptographic certificates to generate an aggregation root certificate, and broadcasting a block chain transaction containing the aggregation root certificate; and the verification traceability unit is used for acquiring the aggregation root certification on the block chain and executing cryptographic verification in combination with the offline data to obtain a final verification result. According to the invention, the core pain point that the system is unavailable due to the performance bottleneck of the block chain in a high-concurrency scene in the prior art is solved, and the continuity and reliability of services are ensured.

The invention discloses a firmware non-inductive upgrading method of an ARM platform and an ARM server system for firmware non-inductive upgrading, and the method comprises the following steps: a computing subsystem CSS initiates a UEFI firmware upgrading request, loads a UEFI firmware upgrading package into a memory, notifies a system control processor SCP to carry out UEFI firmware upgrading, and sends the UEFI firmware upgrading package to a server; the memory address of the SCPUEFI firmware upgrade package stored in the memory is informed to the system control processor; the system control processor SCP verifies the validity of a root certificate of the FLASH, a sub-certificate of the UEFI firmware upgrade package and a firmware signature of the UEFI firmware upgrade package layer by layer through certificate hash of an algorithm module of the security module and an OTP module so as to verify the validity of the UEFI firmware upgrade package, if verification succeeds, the UEFI firmware upgrade package is used for flashing the FLASH so as to carry out firmware upgrade, and if verification succeeds, the system control processor SCP carries out firmware upgrade. If verification fails, UEFI firmware upgrading is not executed, the security module comprises an algorithm module and an OTP module, and certificate hash of a FLASH root certificate is stored in the OTP module. According to the invention, the security of the firmware certificate chain can be ensured while non-inductive upgrading is carried out on the firmware.

A network is described. The network is a peer-to-peer network of nodes. The nodes maintain a distributed ledger. The distributed ledger includes a list of transactions. The list of transactions includes various transactions for maintaining a decentralized root store between the nodes. The decentralized root store includes a list of certificate authorities which are trusted by the nodes in the network. The root certificates may be retrieved from the distributed ledger, validated, and then used to access the certificate authorities.

A method for providing a secure onboarding of a component from at least one first host device into a second host device includes verifying the integrity, authenticity and / or execution environment of the first host device by an orchestrator; providing a trusted root certificate to the second host device by the orchestrator; providing an onboarding identity by the orchestrator to the first host device, when the integrity, the authenticity and / or the execution environment of the first host device has been verified; receiving the onboarding identity from the orchestrator by the first host device and assigning the onboarding identity to the component; providing the assigned onboarding identity to the second host device; and securely onboarding the component from the first host device into the second host device based on the assigned onboarding identity and the provided trusted root certificate.

Exemplary embodiments of the present invention provide a method 200 for carrying out by a communication device to identify a user of a service. The method 200 comprises receiving 210 service data indicative of a service requested by a user terminal device. The service data is signed with a private key of a digital vehicle key of the user terminal device. Furthermore, the method 200 comprises obtaining 220 a root certificate and verifying 230 the service data based on the root certificate. The method 200 further comprises obtaining 240 identification data indicative of the identity of the user of the digital vehicle key. The method 200 further comprises determining 250 the identity of a user of the digital vehicle key based on the verified service data and identification data.

The invention relates to an Internet of Things terminal identity authentication method based on a digital certificate, which comprises the following steps: firstly, a digital certificate system is utilized to sign and issue certificates in an Internet of Things system, the certificates comprise a root certificate, at least one intermediate certificate and a terminal certificate, and a first terminal and a second terminal respectively and correspondingly sign and issue a first terminal certificate and a second terminal certificate; generating a public key and a private key for the certificate, and signing the certificate by using the private key; then, the first terminal requests identity authentication from the second terminal and sends a first terminal certificate, and the second terminal confirms that the request and the first terminal certificate are successfully received; the second terminal establishes a certificate chain of the first terminal certificate and a certificate chain of the second terminal certificate; verifying signer signatures of the terminal certificate and the intermediate certificate in the two certificate chains and self-signatures of the intermediate certificate and the root certificate; finally, Hash comparison is carried out to judge whether the intersection has a problem; a challenge-response mechanism is utilized to judge a private key holding problem; the method can improve security and management flexibility.

The invention provides an SIP (Session Initiation Protocol) authentication method based on a post quantum and national secret mixed signature algorithm, which is applied to an SIP client, and comprises the following steps: sending a first registration message to an SIP server, the first registration message comprising a target authentication control parameter, so that the SIP server generates a first reply message according to the target authentication control parameter; receiving a first reply message; obtaining a first mixed signature certificate of the SIP client according to the first reply message, generating a first random number, and performing mixed signature on the first random number to generate a first signature value; sending a second registration message to the SIP server, so that the SIP server verifies the first mixed signature certificate by adopting a pre-stored root certificate of the SIP client, and verifies the first signature value; and receiving second reply information, and indicating whether the SIP client is successfully verified or not. By integrating a post-quantum algorithm, SIP authentication has the characteristic of quantum attack resistance.

Systems and methods for streamlined platform attestation are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor. The memory may have program instructions stored thereon that, upon execution, cause the IHS to: read root certificates for a plurality of components of the IHS; and embed the root certificates for the plurality of components into a platform certificate.

This application discloses a digital certificate verification method and apparatus. The method includes: A first device receives a first link certificate and a first digital certificate that are sent by a second device, and verifies validity of the first digital certificate based on a root certificate trusted by the first device and the first link certificate. In this application, the first device and the second device do not need to confirm a root certificate trusted by a peer device, and the first device does not need to additionally upload another certificate or perceive a case in which at least two root certificates coexist. The first device may verify the validity of the first digital certificate based on the root certificate trusted by the first device and the received first link certificate. Therefore, the method is simple and easy to implement and has a wide application scope.

The invention discloses a software license generation method and system based on certificate chain verification and a storage medium. The method comprises the steps that a certificate authorization center creates a certificate chain of a software product and issues a root CA certificate, a secondary CA certificate and a terminal signature certificate; a software developer signs to form a software license; the software developer puts the root CA certificate and the second-level CA certificate in a software product and installs the root CA certificate and the second-level CA certificate in executable hardware of a user side together with a software license; authorization verification is carried out when the software product is started, the software product is normally used if the authorization verification is passed, or the software product automatically ends running; and when the software license is about to expire or has a demand, requesting a software developer to re-issue the software license. The method has the advantages that offline software license inspection is supported, and when the signature private key of the software license is changed, a software product does not need to be changed.

The invention discloses a device verification method and an electronic device, and relates to the technical field of device verification, and the device verification method comprises the steps: responding to a condition that an authentication structure file signature accords with a protocol specification requirement of an authentication platform, carrying out the analysis of an authentication structure, and obtaining a terminal entity certificate, an encrypted device private key and a target verification code; verifying the encrypted device private key based on the unique identifier of the target device; in response to verification passing, decrypting the encrypted device private key to obtain a plaintext device private key; verifying the digital signature of the terminal entity certificate by using the authentication platform root certificate public key; in response to verification passing, generating a random number; obtaining a signature result of the response data packet; and if the authentication platform root certificate public key of the terminal entity certificate verifies the signature result successfully, determining that the target equipment passes the verification. The technical problem that an attacker simulates legal verification response and forges verification pass in the related technology is solved, and the technical effect of improving the equipment verification reliability is achieved.

The invention provides a safe starting method and device, electronic equipment, a chip and a medium. The method comprises the following steps: acquiring a public key serial number, an authentication path and a root public key based on a root certificate of a first mirror image; verifying a serial number of a first public key and a public key serial number in the OTP of the equipment, and if verification is passed, determining a first root hash value through a Merkel tree structure according to the authentication path and the root public key; verifying the certificate chain according to the first root hash value, and if verification is passed, extracting a signature public key in the certificate chain; whether the first hash value of the first mirror image is consistent with a second hash value is compared, if yes, the signature of the first mirror image passes verification, and the second hash value is a hash value obtained by decrypting the signature of the first mirror image through a signature public key; and verifying the signature of the second mirror image through the signature public key until the equipment is completely started. Through the technical scheme provided by the invention, the problem that the equipment is difficult to start safely is solved, and the reliability of safe starting of the equipment is improved.

Provided in the embodiments of the present disclosure is an authentication method. The method is executed by a first root certificate authority (CA), and comprises: generating a first type of certificate on the basis of a transport layer security (TLS) protocol, wherein the first type of certificate is a certificate of an entity in a first security domain where the first root CA is located.

The present disclosure provides a method for receiving wireless power from a wireless power transmitter, carried out by a wireless power receiver in a wireless power transmission system, and a device using same, the method comprising: transmitting an authentication request message to a wireless power transmitter, the authentication request message being a message requesting a part among a root certificate, a manufacturer certificate, and a product certificate; receiving an authentication response message from the wireless power transmitter, the authentication response message being a message including the part; and determining whether all the pre-verified certificates corresponding to the part are present in a wireless power receiver.

Systems and methods for onboard vehicle certificate distribution are provided. A system can include a plurality of devices including a master device for authenticating processes and one or more requesting devices. The master device can include a master host security service configured to authenticate the one or more processes of the system. The master host security service can run a certificate authority to generate a root certificate and a private root key corresponding to the root certificate. A respective host security service can receive a request for a process manifest for a requesting process of a respective device from a respective orchestration service. The respective host security service can generate the process manifest for the requesting process and provide the process manifest to the requesting process. The requesting process can use the process manifest to communicate with the certificate authority to obtain an operational certificate based on the root certificate.

Embodiments of the present disclosure relate to a network access control method, apparatus and device, and a storage medium. The network access control method includes: receiving a certificate verification request sent by a terminal, and returning a certificate verification response to the terminal, wherein the certificate verification response carries a preset server certificate, the certificate verification response is used for instructing the terminal to verify the preset server certificate based on a root certificate installed in the terminal, and identity verification information of the root certificate is partially or fully different from identity verification information of the preset server certificate; and receiving a verification result returned by the terminal for the preset server certificate, and in a case where the verification result indicates that certificate verification succeeds, determining that the terminal has a security risk and interrupting a network access communication link of the terminal. In the embodiments of the present disclosure, when the terminal successfully verifies the preset server certificate, the terminal may be prevented from accessing a network by interrupting the network access communication link with the terminal, thereby improving the security of the network.

The invention discloses a DDS Security certificate secure creation and deployment method, which comprises the following steps of: initializing a certificate management service (CMS), establishing a secure channel with a trusted execution environment (TEE), and loading a preset DDS identity CA root certificate from the TEE; an application package manager APM analyzes the application configuration information, carries an application identity ID, and initiates a certificate creation request to a CMS; the CMS constructs certificate information, and sends a certificate creation request carrying the certificate information and an application identity (ID) to the trusted execution environment; public and private keys are generated in the TEE, a certificate is created and signed, and the created application identity certificate is returned to the CMS; the certificate management service verifies and stores the certificate, and returns an identity certificate and a CA root certificate to the APM; and the APM installs the identity certificate to a specified folder of the application installation directory. According to the invention, the establishment and deployment of the identity certificate are realized based on the CMS and the TEE, the certificate management process is simplified, and the deployment efficiency is improved.

A method for certificate chain validation is disclosed for memory-efficient execution inside a secure execution environment of a hardware security module (HSM), despite very limited memory being inside the HSM. This is achieved by allocating enough HSM memory for at least the root certificate, a signer certificate, and a certificate to be validated, and replacing the signer certificate as the certificate chain is traversed. Revalidation of data is implemented by computing secure tags that enable the HSM to quickly recognize previously validated data. Chain validation is only considered provisional until checked against a CRL, which can be provided to the HSM in a streaming fashion, and each received serial number in the CRL is checked against the list of serial numbers representing the provisionally verified chain.

The disclosed technology teaches a method of operating an inspection proxy for encrypted sessions between users in an organization serviced by the inspection proxy and cloud-based services accessed by the users. The method comprises providing the inspection proxy comprising an intermediate certificate authority that holds a certificate authority (CA) certificate that browsers, operated by the users in the organization, recognize to be authorized to sign end-entity certificates, by virtue of being chained to a root certificate recognized by the browsers.

The invention provides a cloud service authentication method and a cloud service system, the method is applied to the cloud service system, and the cloud service system comprises at least one trust anchor and a plurality of application configurations; the method comprises the steps that a request of a first user for obtaining a temporary certificate is received, the request comprises a client certificate of the first user and information of a first role requested by the first user, and the client certificate of the first user comprises a subject identifier of the first user; determining that the first user accesses the cloud service system according to the client certificate of the first user and the root certificate in the first trust anchor; according to the main body identifier of the first user, determining the permission of the first user to obtain the first application configuration; acquiring the permission of the first user to use the first role in the first application configuration; acquiring a temporary voucher; and sending the temporary credential to the first user. According to the embodiment of the invention, the risk that illegal applications invade cloud resources can be reduced.

Provided are a CA consensus method, an apparatus, and a node. The method comprises: obtaining a final voting result for a voting event on the basis of voting results of a plurality of first CAs; and when the final voting result indicates that the voting event passes, executing a first operation, wherein the first operation comprises registration of a CA, revocation of a CA, or update of a root certificate. In this way, a decision can be jointly made by a plurality of CAs without relying on a central CA, thereby improving the degree of decentralization of DPKI systems, and thus improving the overall security of the DPKI systems.

The present application discloses an identity authentication method, device, storage medium, electronic device and computer program product, which belong to the field of automobile technology. The identity authentication method is applied to automobiles, including: when the automobile receives an identity authentication request sent by a device to be authenticated, seed data is generated and sent to the device to be authenticated, so that the device to be authenticated returns a ciphertext and a target authorization certificate according to the seed data; the device to be authenticated is authenticated according to the target authorization certificate, the root certificate, the ciphertext and the seed data, thereby eliminating the need to fix the symmetric password into the code programs of the two parties to the authentication, reducing the risk of password leakage and improving the reliability and security of the authentication.