20 results about "SAFER" patented technology

This invention relates to the field of security encryption management technology, and more particularly to a computer software security encryption management system and method. The method includes the following steps: acquiring software data and extracting privacy files; then performing interleaved layering transformations on the privacy files to generate basic encryption units; the basic encryption units are mapped through grid encoding to form an encrypted grid encoding matrix; a virtual identity index is generated based on this matrix; a fake retrieval channel is simulated based on the virtual identity index and the basic encryption units to monitor computer access to data; simultaneously, illegal attacks are induced and visitor behavior patterns are recorded; potential internal threats are deduced using the collected behavior patterns and fake retrieval channels; and the basic encryption units are progressively encrypted and solidified to improve the security and effectiveness of data protection, thus constructing a comprehensive security management system. This invention achieves a more flexible and secure computer software security encryption management method.

To share encrypted data more securely. After a pair of an identification token 131 and key disclosure permission information 134 transmitted from a first client terminal 102 is verified by a verification unit 106, a key registration unit 107 registers a record 122 including the key 133 and the key disclosure permission information 134 in a database 121 of a key sharing server 101 and transmits key identification information 135 for identifying the record to the first client terminal 102. The first client terminal 102 transmits data 139 including encrypted data 138 obtained by encrypting transmission data by using a cipher key 136 for data encryption after first processing output by a cipher key first processing unit 109, a cipher key 137 for data decryption after first processing output by the cipher key first processing unit 109, and the key identification information 135 obtained from the key registration unit 107, to a second client terminal 103. The second client terminal 103 makes an inquiry to a key disclosure unit 110 by using the key identification information 135 acquired from the received data 139 and an identification token 132 of the terminal itself. The key disclosure unit 110 acquires the pair of key 133 and key disclosure permission information 134 corresponding to the key identification information 135, from the database 121, and notifies, when the identification token 132 is included in a key disclosure permissible range indicated by the key disclosure permission information 134, the second client terminal of the key 133. The second client terminal 103 uses the notified key 133 to generate a cipher key 140 for data decryption after second processing on the basis of the cipher key 137 for data decryption after first processing acquired from the data 139 and uses the cipher key 140 for data decryption after second processing to execute decryption on the encrypted data 138 in the data 139.

The invention relates to a large model security reasoning method based on a trusted execution environment, a medium and equipment, and the method comprises the following steps: generating a trusted public and private key pair corresponding to a large model service provider through the trusted execution environment, in the public and private key pair, sending a public key to a user side, and sending the public key to the user side; the private key is persistently stored in a trusted execution environment through data sealing; receiving encrypted data and a digital envelope sent by a user side, the encrypted data being cue word data encrypted by a symmetric key, and the digital envelope being a symmetric key encrypted by the public key; obtaining an original cue word based on the encrypted data and the digital envelope through the trusted execution environment; and in the trusted execution environment, performing large model reasoning based on the original cue word, and sending a reasoning result encrypted by the symmetric key and a trusted execution environment signature to a user side. Compared with the prior art, the method has the advantages of being safer, more universal, more efficient and the like.

The embodiment of the invention provides a communication encryption method, computer equipment and a storage medium, relates to the technical field of information security, and can provide a safer communication process. Comprising the following steps: a server receives a first key acquisition request sent by a first terminal, and acquires a first composite key from a plurality of composite keys; wherein the composite key is a key obtained after fusion processing based on multiple types of quantum keys. And the server obtains a second composite key matched with the user information of the first terminal from the plurality of composite keys. And sending the second composite key to the server, so that the server encrypts the first composite key through the second composite key to obtain the encrypted first composite key. And the server sends the encrypted first composite key to the first terminal, so that the first terminal encrypts or decrypts communication data with the second terminal based on the first composite key after decrypting the encrypted first composite key.

Data stored in a memory circuit may be encrypted using client keys that need to be available for high-speed data processing and yet held securely to avoid unauthorized access to the encrypted data. A secure processor circuit in a processor-based system obtains client keys associated with client applications and generates secure key-encryption keys that are used to encrypt the client keys so the client keys can be securely stored in the memory circuit. In some examples, data keys for encrypting data blocks associated with the client application may be generated from the client key, encrypted by a data key-encryption key generated in the secure processor circuit, and stored in the memory circuit. In such examples, because the client keys and data keys are encrypted while in memory, they are safer from software attacks on the memory circuit, which improves the security of the encrypted data blocks.

The application provides an IPv6 message encryption and decryption method based on a quantum key application mechanism, which is realized by a sending end and a receiving end in cooperation, and the sending end and the receiving end exchange roles when transmitting back to realize the encryption transmission of messages in the opposite direction by the same processing procedure; the messages are directly encrypted by using quantum keys, and the message encapsulation uses the extensible characteristics of the IPv6 protocol, and a new extension message header is added in the header of the IPv6 message to record the parameters used for message encryption. The combination of the quantum key encryption and the message of the IPv6 is the innovation point in the application, the quantum key is directly used for encryption when the message is encrypted and decrypted, other key negotiation methods are not needed, and other network protocol negotiation keys are not needed, so that the scheme is safer and simpler. The application encapsulates the encrypted message by using the extensible characteristics of the IPv6 protocol, so that the encrypted message is still a standard IPv6 message, and the messages of the whole scheme follow the IPv6 protocol without additional protocol overhead.

Data stored in a memory circuit may be encrypted using client keys that need to be available for high-speed data processing and yet held securely to avoid unauthorized access to the encrypted data. A secure processor circuit in a processor-based system obtains client keys associated with client applications and generates secure key-encryption keys that are used to encrypt the client keys so the client keys can be securely stored in the memory circuit. In some examples, data keys for encrypting data blocks associated with the client application may be generated from the client key, encrypted by a data key-encryption key generated in the secure processor circuit, and stored in the memory circuit. In such examples, because the client keys and data keys are encrypted while in memory, they are safer from software attacks on the memory circuit, which improves the security of the encrypted data blocks.

The application relates to the technical field of computer security, in particular to a zero-trust security system and control method based on bidirectional authentication of subjects and data, which comprises a decentralized identity management module, which is used for generating decentralized digital identities for access subjects and data assets, and bidirectionally verifying the identities of the access subjects and the data assets; an AI dynamic trust evaluation module, which is used for continuously collecting multidimensional real-time data streams, and generating a dynamically updated comprehensive trust score through a deep learning model; a dynamic strategy generation and execution module, which is used for generating real-time access control strategies based on the comprehensive trust score and data asset attributes, and executing the real-time access control strategies; and a closed-loop feedback optimization module, which is used for dynamically optimizing parameters of the deep learning model through a reinforcement learning algorithm according to strategy execution effect data. Through bidirectional decentralized authentication of subjects and data, AI dynamic trust evaluation and reinforcement learning closed-loop optimization, the application realizes safer, smarter and more flexible fine-grained access control.

The present application relates to an attribute-based encryption method, system, device and storage medium. The method includes: receiving a data access request from a data user, the data access request includes a user ID of the data user and a requested ciphertext, the ciphertext includes access control layer information and encrypted data layer information; obtaining a user list, determining a conversion key corresponding to the data user from the user list according to the user ID, and decrypting the ciphertext once according to the conversion key to obtain a primary conversion ciphertext; sending the user ID and the primary conversion ciphertext to a trusted execution environment, so that the trusted execution environment decrypts the primary conversion ciphertext twice to obtain a secondary conversion ciphertext, and sending a decryption instruction carrying the secondary conversion ciphertext to the data user; wherein the decryption instruction is used to instruct the data user to decrypt the secondary conversion ciphertext three times to obtain the target data. The use of this method can more safely and conveniently realize controllable data user permissions.

This invention relates to a fine-grained, controllable blockchain rewriting method under cloud computing, featuring a hidden policy for user tracking, revocation, and attribute cancellation. The invention utilizes traceable and revocable ciphertext policy attribute-based encryption as its technical support. Only when the data modifier's attributes satisfy the access policy embedded in the transaction data written by the data owner in the block can the correct hash collision be found, thus modifying the data and achieving fine-grained, controllable, and rewriteable blockchain functionality. Secondly, by employing outsourced computing technology, some complex calculations are transferred to the data service manager under the cloud service provider, significantly improving algorithm efficiency and greatly reducing the burden on on-chain users. Simultaneously, the access policy written by the data owner in the block is partially hidden, making the controllable and rewriteable blockchain more secure and easier to expand in practical applications, effectively protecting privacy.

The present disclosure belongs to the field of artificial intelligence and specifically relates to a method, apparatus, and device for defending a large language model against malicious queries. The method comprises: obtaining a query; obtaining a set of candidate word-grams for the current word in the large language model's response to the query; adjusting the probability distribution of each word-gram in the candidate word-gram set toward a safer direction; and selecting the word-gram with the highest probability in the candidate word-gram set as the current word in the response. The present disclosure can provide a highly efficient method for defending against malicious queries without significantly impacting performance.

The present invention discloses a file review and output method based on digital certificates. An export device including an internal network area and an external network area is connected between a sending host and a receiving host. The internal network area includes an internal network CPU, an FPGA, a DDR and a commercial cryptographic module, and the external network area includes an external network CPU. One-way optical transmission is used between the internal and external network areas for communication. The file review and output includes an administrator, a reviewer and a user. The user and the reviewer are each equipped with a USB key, in which their respective certificate information is stored. The commercial cryptographic module includes a signature / verification algorithm, a hash algorithm and an asymmetric encryption and decryption algorithm. The commercial cryptographic module is equipped with the same cryptographic algorithm as the USB key. After registering user / reviewer information, applying for an export token, exporting a file identifier, exporting approval and creating an export channel, the file is finally output to the receiving host in a safer and more efficient manner.

To enable encrypted communication using a QKD network for a specific flow to be performed more securely and efficiently.SOLUTION: An information processing apparatus according to an embodiment includes a processing unit. The processing unit acquires, from at least one key management device that shares a second encryption key with another key management device by an encryption relay using a first encryption key, an accumulation amount of the second encryption key for each sharing destination. The processing unit thereafter notifies a control device of a specification rule for specifying a flow to be encrypted with the second encryption key, and acquires flow information of the flow to be encrypted from the control device. The processing unit also determines whether or not an accumulation amount of the second encryption key used between a first communication device and a second communication device is equal to or greater than the amount of communication data. When the accumulated amount of the second encryption key is equal to or greater than the amount of communication data, the processing unit issues an instruction to a key management device connected to the first communication device to provide the second encryption key to the first communication device.SELECTED DRAWING: Figure 6

The invention relates to a PET DICOM data encryption export method, a storage medium and equipment. The method comprises the following steps: determining PET DICOM data to be exported; determining whether anonymization and encryption are performed; under the condition of determining anonymization, determining an anonymization option, and performing anonymization processing on the PET DICOM data according to the anonymization option when the data is exported; under the condition that encryption is determined, an encryption password is determined, and the PET DICOM data is encrypted according to the encryption password when the data is exported; determining an export path and creating a temporary directory; the PET DICOM data subjected to anonymization processing are exported to a temporary directory; and performing compression and encryption processing on the PET DICOM data in the temporary directory to generate an Enc file, and exporting the Enc file to the target path. The method has the beneficial effect that the PET DICOM data can be exported more quickly and more safely.

To provide a communication device that can perform safer cipher communication.SOLUTION: A communication device comprises a control unit and a communication unit. The communication unit receives a cipher key and a key identifier of the cipher key, from a key management device that receives a cipher key from a quantum key delivery device via a closed network, transmits, via the closed network, the key identifier to a destination communication device connected to the closed network, and performs cipher communication with the destination communication device via a wide area network. The key management device may receive the cipher key from the quantum key delivery device through a leased line or closed network communication.SELECTED DRAWING: Figure 1

This invention discloses a data cache expiration handling system and method for quantum communication networks. The method includes: a client querying target data by inputting the primary key ID of the target data; comparing the expiration time of the primary key ID with the system time; if the expiration time of the primary key ID does not exceed the system time, returning the target data to the client; if the expiration time of the primary key ID exceeds the system time, obtaining a quantum key qk from the QK queue storing quantum keys to encrypt the target data to obtain encrypted target data; storing the quantum key qk and the encrypted target data in a database module, database R1, and database R2; and returning the encrypted target data to the client. This invention establishes synchronized data in databases R1 and R2, solving the memory overflow problem; it determines whether data is expired based on the expiration time of the quantum key, making cached data updates more reliable and secure; and it improves the user experience.

The invention relates to an attribute-based encryption method, system and device and a storage medium. The method comprises the steps that a data access request of a data user is received, the data access request comprises a user identifier of the data user and a requested ciphertext, and the ciphertext comprises access control layer information and encrypted data layer information; obtaining a user list, determining a conversion key corresponding to the data user from the user list according to the user identifier, and performing primary decryption on the ciphertext according to the conversion key to obtain a primary conversion ciphertext; sending the user identifier and the primary conversion ciphertext to a trusted execution environment, so that the trusted execution environment performs secondary decryption on the primary conversion ciphertext to obtain a secondary conversion ciphertext, and sending a decryption instruction carrying the secondary conversion ciphertext to the data user; wherein the decryption instruction is used for instructing the data user to decrypt the secondary conversion ciphertext for the third time, so as to obtain the target data. By adopting the method, the controllability of the data user authority can be realized more safely and conveniently.

Data stored in a memory circuit may be encrypted using client keys that need to be available for high-speed data processing and yet held securely to avoid unauthorized access to the encrypted data. A secure processor circuit in a processor-based system obtains client keys associated with client applications and generates secure key-encryption keys that are used to encrypt the client keys so the client keys can be securely stored in the memory circuit. In some examples, data keys for encrypting data blocks associated with the client application may be generated from the client key, encrypted by a data key-encryption key generated in the secure processor circuit, and stored in the memory circuit. In such examples, because the client keys and data keys are encrypted while in memory, they are safer from software attacks on the memory circuit, which improves the security of the encrypted data blocks.

The present invention discloses a secure communication method based on train identity, comprising: a key generation center generating public parameters based on security parameters; a train receiving the public parameters and ε1 and ε2, and generating a train pseudo-identity and a train private key based on t, ε1, ε2, the public parameters, and the train's true identity; the key generation center processing the legitimate train pseudo-identity, public parameters, and master key to obtain a train transmission key; processing the true identity, public parameters, and master key of the infrastructure to obtain a facility transmission key; offline processing of d, k, the public parameters, and the train transmission key to obtain offline stored partial ciphertext; the legitimate train receiving the offline stored partial ciphertext online and encrypting the information based on the train pseudo-identity, the offline stored partial ciphertext, the true identity of the infrastructure, and the public parameters to obtain ciphertext; and the trackside infrastructure decrypting the ciphertext based on the public parameters, the train pseudo-identity, and the facility transmission key to obtain plaintext. The present invention enables more secure and efficient transmission.

The present application relates to a method for Shamir threshold face information recognition encryption authentication and data security transmission, comprising the following steps: S11, encrypting the face information plaintext to form face information ciphertext; S12, dividing the encrypted face ciphertext using secret sharing technology to divide the encryption key, and dividing the user key into five key components according to the (3, 5) threshold scheme based on the threshold sharing strategy of polynomial; S13, sending the divided five key components to five key storage nodes through a key escrow system; further comprising: S21, sending a key component transmission request to the five key storage nodes through the key escrow system; S22, after receiving any three key components of the same key, the key is recovered using the Lagrange algorithm. The present application can greatly reduce the risk of key leakage, also makes the supervision department have a trace, and most importantly, the implementation of key recovery enables users to use their own keys more flexibly and safely in various application scenarios.