309 results about "Shared secret" patented technology

The invention discloses a national secret algorithm data encryption transmission method and system. The method comprises the steps of obtaining to-be-encrypted data and network parameters, establishing a Bayesian network probability ablation model, performing Monte Carlo sampling ablation national secret encryption and evaluating attack risks, and generating a probability security encryption strategy; and extracting a Brinell feature set, constructing a long and short-term memory network time prediction model, and optimizing by using a simulated annealing algorithm to obtain an optimal encryption parameter configuration sequence. Generating a key pair according to the sequence and SM2, establishing a shared key by means of an elliptic curve Diffie-Hellman protocol, deriving an SM4 session key through SM3, and establishing a hybrid encryption key system; constructing a teacher and student network model, optimizing multi-thread scheduling through adversarial distillation training and a retrieval enhancement technology, and generating a multi-thread parallel encryption architecture; and network parameters are monitored in real time, a reinforcement learning adaptive decision engine is constructed, a strategy is dynamically adjusted, and adaptive encryption transmission is completed. According to the invention, the optimal balance between the security and the efficiency in the data encryption transmission process is realized.

The invention provides an inter-micro-service dynamic secure communication method and device based on chaos cryptography. The method comprises the steps that a service provider instance registers a public key and chaos initial parameters to a service registration center; before calling, the service consumer instance acquires a public key and a chaos initial parameter of a target service provider instance from a service registration center; the service consumer instance performs key negotiation with the acquired public key by using a private key of the service consumer instance to determine a shared key; performing key derivation on the shared key and the chaotic initial parameter to generate an initial key; respectively using the initial keys to initialize the chaotic system so as to generate synchronous encryption key streams; and the two communication parties perform real-time stream encryption and decryption on the communication data between the micro-services by using the encryption key stream. The unpredictability of a chaotic system and modern cryptography can be combined, and a micro-service design mode is deeply integrated, so that a lightweight and high-security communication security mechanism which does not need to share a key in advance and can be adaptive to dynamic change of service is realized.

The invention discloses a channel security transmission method for protecting data privacy of an edge gateway of the Internet of Things, and relates to the technical field of security and privacy protection of the Internet of Things, and the method comprises the steps: constructing an edge gateway security architecture, generating a quantum key through a QKD module based on the constructed edge gateway security architecture, and generating sensitivity data through an IPS vNSF; calculating noise based on the sensitivity data, generating disturbance data based on the noise, calculating a shared key, generating an encryption key in combination with the quantum key and the shared key, segmenting the encryption key through Shamir secret sharing, and encrypting and decrypting the key; encrypting the noise by using the decrypted key, generating global noise based on the encrypted noise, and calculating secondary disturbance data based on the global noise; and generating coded data based on the secondary disturbance data, and generating reconstruction data based on the coded data. According to the invention, the comprehensive security authority of the edge gateway in the aspects of key security and privacy protection intensity is improved.

Provided are communication methods and communication devices. One method comprises: on the basis of a shared key, a first device generates a first key; the first device receives a second random number of a second device; on the basis of the first key, the first device generates first authentication information of the first device; and the first device sends a first message to the second device, the first message comprising the first authentication information, and the first authentication information being generated according to one or more of the following information: device information, service-related information, an identifier of a device forwarding the first message, and a first random number and a second random number of the first device.

A system performs a set of cryptographic operations at least by utilizing an API to cause execution of a set of one or more secure element (SE) applications within the SE platform runtime environment of a first computing entity. The set of cryptographic operations include generating a first shared secret, generating a ciphertext at least by encapsulating the first shared secret with a first public key associated with a second computing entity in accordance with an encapsulation algorithm, and transmitting the ciphertext from the first computing entity to the second computing entity. The second computing entity derives the first shared secret by decapsulating the ciphertext with a private key corresponding to the first public key. The first computing entity and the second computing entity then exchange at least one encrypted message, encrypted with an encryption key that includes, or is based at least in part on, the first shared secret.

A computer-implemented method of generating shares of a shared secret, wherein each of a group of participants has a respective first secret share of the shared secret, wherein the method is performed by a first participant of the group and comprises: generating a respective blinding share of a shared blinding secret, obtaining at least a threshold number of respective intermediary shares from each of the first group of participants, wherein each respective intermediary share is generated based on a respective blinding share and a respective first secret share; generating an intermediary value based on each of the obtained intermediary shares; and generating a respective second secret share of the shared secret, wherein the respective second secret shared is generated based on the intermediary value and the respective blinding share.

An access control system is disclosed for controlling access to a resource. A request is received by a location attribute policy (LAP) server to access an encrypted resource. The LAP server accesses a resource policy that identifies requirements for granting access to the encrypted resource, such as a list of attributes of the requestor that are required and a dynamic attribute requirement of the requestor. The LAP server receives a cryptographic proof from the computing device that the requestor possesses the attributes and validates the proof based at least on information obtained from a trusted ledger. Once the proof is validated, the LAP server provides a shared secret associated with the dynamic attribute requirement to a decryption algorithm. The decryption algorithm uses the dynamic attribute shared secret in combination with one or more attribute shared secrets from the requestor to generate a decryption key for the encrypted resource.

A method for transmitting secured Ethernet frames on a communication line, the method including the following in a transmitter module: receiving an Ethernet frame comprising payload data from a network layer; retrieving a secure policy, defining the type of security to be applied to the Ethernet frame; producing an initialization vector based on an encryption counter and a physical address of the transmitter module; creating an authentication tag by applying an authentication algorithm on the secure policy, the initialization vector and the payload data using a shared key and the initialization vector; adding the secure policy, the initialization vector and the authentication tag to the payload data to create a secured Ethernet frame; and sending the secured Ethernet frame to a data link layer for transmission on the communication line.

The invention relates to a time-sensitive network end-to-end secure communication method, and belongs to the technical field of communication. According to the method, a TSN terminal system of Linux is used for realizing bidirectional identity authentication and key agreement based on an SM2 cryptographic algorithm, and an SM4-CCM algorithm is used for realizing time-sensitive network security communication and data integrity verification; the SM2 national secret algorithm is an asymmetric encryption algorithm, a signature pair is generated based on an elliptic curve discrete logarithm problem, the two parties negotiate a shared key through elliptic curve point operation, a public key of a receiver is used for encryption, and only a private key can be used for decryption; sM4-CCM is a combination of an SM4 block cipher algorithm and a CCM mode, and is used for providing confidentiality, integrity and authenticity of data; according to the CCM mode, through combination of CTR encryption and CBC-MAC authentication, efficient authentication encryption is realized. The method can be used for real-time secure communication in a high-reliability industrial scene.

The invention discloses a BMS Bluetooth secure communication method and system based on SM2 key agreement, and the method comprises the following steps: constructing a BMS Bluetooth secure communication architecture composed of a battery analog front end (AFE), a low-power-consumption Bluetooth SOC and a secure coprocessor, and writing an SM2 static private key and a device ID in a secure storage unit; after a user terminal initiates a BLE connection request, a security coprocessor sends a wake-up instruction and generates a temporary SM2 private key dT, and then point multiplication operation is executed to generate a temporary public key PT; and sending to a user terminal through a BLE link, performing format analysis and elliptic curve equation verification, executing an SM2 key agreement protocol after confirming that the information is legal, calculating to obtain a shared key material Z, performing re-verification, and if the verification is effective, establishing an AES encryption communication link, monitoring abnormity, clearing sensitive information and performing whole-process closed-loop management on the dynamic session key K. According to the invention, the security and reliability of BMS Bluetooth communication can be improved.

The invention relates to the technical field of quantum security computing communication, and discloses a cluster state-based third-party quantum summation method with a bidirectional identity authentication mechanism, which comprises the following steps of: firstly, realizing bidirectional identity authentication between a participant and a third party in a quantum channel by pre-sharing secret identity information and a hash function in combination with a decoy photon technology; and impersonation and man-in-the-middle attack are fundamentally eradicated. And after the authentication is passed, the participant randomly executes measurement or reflection operation on the particle to which the participant belongs, so that an encrypted private key can be generated under the assistance of a third party, and external eavesdropping and internal participant attack can be jointly detected according to an operation combination to form multi-level security protection. Finally, the third party can only calculate the bitwise modular binary sum of the private bit string of each party, and cannot obtain any single input value. According to the method, authentication and calculation are organically fused, unconditional security is guaranteed, and meanwhile, the quantum capability requirements of participants are remarkably reduced.

This invention discloses a method and system for ciphertext quantum key management and relay. The method includes sending routing control information to relay nodes to relay quantum key ciphertext received from connected QKD devices to destination nodes according to the routing control information; sending first encryption information corresponding to each relay node on the relay path to the destination node, so that the destination node converts the XOR value of the quantum key ciphertext based on each of the first encryption information to obtain a first key ciphertext; the quantum key ciphertext is obtained by the QKD device encrypting its generated quantum key using a local key encryption key, the first encryption information carrying a first key encryption key that is the same as the key encryption key corresponding to each relay node, and the first key ciphertext being the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node; this invention can reduce the risk of quantum key leakage.

The invention discloses a data development, transmission and optimization storage method based on big data processing. The method comprises the following steps: acquiring original key data and processing the original key data to generate a state activation vector; constructing a full-state space structure of the finite-state transduction device; executing state observability cutting processing to obtain an observable state subspace; establishing a semantic mapping relation and determining a legal state transduction path sequence; executing data transmission processing on the target data according to the legal state transduction path sequence; recording a time slice identifier, a key derived fragment and a historical path access mark, and establishing a binding relationship; executing path uniqueness verification processing, judging a failure legal state transduction path sequence and stopping data transmission; and after failure, state observability cutting processing is executed again until the data closed-loop transmission process is completed. According to the method, a shared key driven finite state transduction method is adopted, rapid, safe and stable safe closed-loop transmission of data is realized, and the method has the advantages of unique path and dynamic encryption.

The application provides a third-party-based key exchange method and system, a trusted third party and an entity, wherein the trusted third party only participates in identity authentication of the entity and assists in negotiation of a key between the two entities, and cannot obtain a shared key between the two entities, effectively solving the problem that the trusted third party cannot avoid obtaining the exchanged key in the existing key exchange scheme based on the trusted third party, and ensuring that the finally exchanged key is only owned by the two entities participating in the key exchange. In addition, in the application, the trusted third party can also provide a random number to participate in the final key generation, thereby ensuring the strength of the final key, meeting the requirement that the trusted third party needs to manage the strength of the exchanged key in a specific application scenario, and enhancing the management and control capability of the system.

The embodiment of the invention provides a communication method, device and system, electronic equipment, a computer readable storage medium and a computer program product. Relates to the communication field. The method comprises the following steps: performing an encrypted call with a second terminal according to a shared key with the second terminal; determining a first encryption result; a first request is sent to the first node, so that the first node sends a second request to the second node, the first encryption result is used for the second node to perform legal verification on the first terminal, a second encryption result is sent to a third terminal through the first node when the first terminal is verified to be legal, and the second encryption result is used for the third terminal to determine a shared key; the shared key is used for the third terminal to carry out encrypted communication with at least one of the first terminal and the second terminal. According to the invention, in the encrypted call between the first terminal and the second terminal, the secret key distributed to the third terminal by the second node is forwarded through the first node, so that secure communication is established between different terminals, and the security of transmission between the terminals is effectively ensured.

The invention discloses a digital certificate signing and issuing method and device and a digital certificate verification method and device. The method comprises the steps that a certificate application request submitted by a user is received, and the certificate application request comprises a shared key received by the user in the digital certificate application process; determining an issuing CA corresponding to the certificate application request, and determining an encryption key corresponding to the issuing CA from a key relationship library; encrypting the shared key according to the encryption key to obtain an encrypted shared key, and adding the encrypted shared key to a private extension field in the certificate application request to obtain an updated target certificate application request; and signing the target certificate application request through the signing and issuing CA to generate a corresponding digital certificate. According to the method and the device, the technical problem that the certificate private key is easy to be illegally used after being leaked due to the fact that digital certificate verification in related technologies only depends on verification of validity of the certificate private key and an effective certificate holder identity dynamic verification mechanism is lacked is solved.

This application provides a dynamic path generation method, relating to the field of information security, and applicable to the fintech field. The dynamic path generation method includes: responding to a connection request initiated by a client, negotiating and generating a shared key with the client; temporarily generating the shared key during each negotiation; performing a hash operation on the shared key to obtain a hash value; truncating a predetermined number of bits from the hash value as a dynamic path identifier; concatenating the dynamic path identifier and a resource base path to obtain a dynamic path; the dynamic path pointing to a specific resource stored on the server. This application also provides a dynamic path generation apparatus, device, and program product, as well as a resource access method and apparatus.

In one aspect, a movable barrier operator is provided having a motor, a transmitter, a receiver, and a controller. The controller is configured to receive through the receiver a first public key from a remote control; determine a second public key and a second private key; and determine a shared secret session key using the second private key and the first public key. The controller is configured to operate the transmitter and receiver to bidirectionally communicate with the remote control so that the movable barrier operator can learn a fixed code and a changing code of the remote control. The bidirectional communications are encrypted using the shared secret session key. Upon the movable barrier operator successfully learning the remote control, the movable barrier operator transmits a long-term key to the remote control that is used to encrypt subsequent communications between the movable barrier operator and the remote control.

This application discloses a method, apparatus, electronic device, and medium for collaborative key exchange. In this application, upon receiving a peer random number public key from a peer key device, the peer random number public key and a first random number public key are sent to a second communicating party. The first random number public key is calculated by the first communicating party using an elliptic curve cryptography algorithm. The second communicating party calculates its own random number public key based on the peer random number public key, the first random number public key, and a second sub-private key, and then sends its own random number public key and intermediate parameters to the first communicating party. The first communicating party calculates a shared key based on its own random number public key, intermediate parameters, and the first sub-private key, and then sends its own random number public key to the peer key device.

A method for authentication between a first party and a second party is disclosed. This method comprises generating a current shared key by exchanging one or more messages between the first party and the second party, and authenticating the current shared key based on a previously authenticated shared key. In some examples, the current shared key may be authenticated based on both the previously authenticated shared key and the current shared key, and / or on at least one secret value obtained by the first party and / or the second party. In some examples, authenticating the current shared key comprises exchanging one or more messages between the first party and the second party, at least one of which is generated based on one or more of the current shared key, the previously authenticated shared key, and at least one secret value. In some examples, if it is determined that the current shared key is authenticated, the current shared key may be stored for use as the previously authenticated shared key when authenticating a new current shared key.

The present disclosure provides a method of performing user authentication in a quantum communication system. More specifically, the method includes transmitting an information sequence including at least one data block on the quantum channel, wherein based on a preshared key and at least one key generated based on the preshared key, a checking sequence for a quantum bit error rate (QBER) estimation is determined from each of the at least one data block, wherein the preshared key is used to select a location of a sequence included in the at least one data block; performing the user authentication based on a portion of the checking sequence; and performing a QBER estimation based on a result of the user authentication and a remaining checking sequence excluding the portion of the checking sequence. A user authentication error rate and a QBER estimation error rate are used for the QBER estimation.

The invention discloses a wireless terminal security management and control method and system, and relates to the technical field of power system communication security. The method comprises the following steps: in a communication connection establishment stage, establishing a shared key through WAPI bidirectional authentication and post quantum key encapsulation, and initializing a physical layer waveform parameter synchronization mechanism; in the security situation assessment stage, collected equipment characteristics, near field communication and electromagnetic environment data are fused, quantitative analysis is performed through a neural network and an attack graph model, and a dynamic security threat level is obtained; in the security policy execution stage, the security policy and physical layer parameters are adaptively adjusted according to the threat level and the channel assessment result to form closed-loop management and control. According to the method, the problems of single protection means, response lag and lack of quantum safety capability of a traditional scheme in complex environments such as a new energy station are solved, and active, accurate and self-adaptive wireless terminal safety protection is realized.

Techniques for utilizing post-quantum pre-shared key (PPK) identifiers (PPK_ID) to determine control association key(s) (CAK(s)) and / or secure association key(s) (SAK(s)) utilized in MACsec sessions are described herein. A key server (KS) and a non-key server (NKS) may advertise capabilities indicating an ability to utilize PPKs as CAKs and / or SAKs in MACsec sessions. The KS may leverage a quantum key distribution (QKD) service to determine a PPK_ID and a PPK, which may be utilized as a CAK for a MACsec session with the NKS. The PPK_ID may be transmitted to the NKS, where the NKS may retrieve the PPK from the QKD, and a new group connectivity association may be established using the PPK as the CAK. In some examples, the KS may be configured to refresh the PPK as the CAK for instantiating subsequent MACsec sessions. Additionally, the KS may be configured to distribute a SAK in a similar manner.

Method for distributing pairs of secure secret keys intended to secure communications between a first communication station (S1) and a second communication station (S2), said method comprising the following steps: exchanging, via a quantum channel (CQ1) linking a satellite (Sat) to said first communication station (S1), a first secret key; exchanging, via a quantum channel (CQ2) linking said satellite (Sat) to said second communication station (S2), a second secret key; receiving, in said satellite, a communication request between the first and second communication stations issued by said first or second communication station, referred to as the transmitting station; encrypting, in said satellite, the first secret key (by a symmetric encryption method which uses the second secret key (,in order to generate a first encrypted message ( ) and transmit said first encrypted message to said second communication station (S2) via an authenticated channel ( , called first authenticated channel. [Fig. 3A],

The application provides a data security encryption method and a smart wearable device, and the method comprises the following steps: performing a hash operation based on a current timestamp and a shared key to obtain a first key seed, performing a hash operation based on the first key seed and a data sequence to be transmitted to determine a second key seed; determining a mapped key symbol sequence based on the second key seed and a preset ring modulus, mapping the data sequence to be transmitted in the preset ring modulus to obtain a data symbol sequence; calculating a Lee distance bit by bit based on the mapped key symbol sequence and the data symbol sequence to obtain a Lee distance sequence, encrypting the Lee distance sequence and the mapped key symbol sequence on the preset ring modulus based on the Lee distance sequence to obtain an encrypted ciphertext symbol sequence; and generating a transmission data packet based on the encrypted ciphertext symbol sequence and the current timestamp and sending the transmission data packet to a receiving end. The application realizes the dynamic key and the anti-cracking capability without relying on a complex key agreement protocol, and improves the data transmission security.

Example embodiments of the present disclosure provide secured controller area network (CAN) communications among vehicle components. According to embodiments, a method for providing may include: generating, by at least one processing unit of a sender, a one-time passcode (OTP); obtaining, by the at least one processing unit of the sender, a master key pre-provisioned to the sender and the receiver; deriving, by the at least one processing unit of the sender, a shared key based on the OTP and the master key; generating, by the at least one processing unit of the sender, a message authentication code (MAC) based on the derived shared key; appending, by the at least one processing unit of the sender, the MAC to a message; and transmitting, by the at least one processing unit of the sender, the appended message to a receiver via a CAN bus.

The invention discloses a data security management method and device based on a cloud edge collaborative architecture, terminal equipment and a storage medium, and belongs to the field of data security, and the method comprises the steps: responding to a data management request initiated by second edge equipment, encrypting a shared key, and generating a management key; analyzing the data management request to obtain management content, response time and a device identifier of the target edge device, and sending the shared key, the management key and the management content to the target edge device according to the management content, so that the target edge device generates a processing result according to the management content, the processing result is encrypted, and an encrypted transmission packet is generated and transmitted to the second edge device; and the management key is sent to the second cloud device, so that the second cloud device generates decryption key information and transmits the decryption key information to the second edge device, and after the second edge device receives the decryption key information, the processing result is obtained based on the response aging decryption. By implementing the application, the defect that key management and data transmission do not form a closed loop in the prior art can be solved.

A method for establishing secure communication between a first device and a second device. The method includes generating ephemeral keys at the first device, encapsulating a public key of the second device to generate a first cipher key and a first shared secret key, transmitting a first message to the second device including the ephemeral public key and the first cipher key, receiving a second message from the second device containing a second cipher key, decapsulating the second cipher key to achieve a second shared secret key, receiving and decapsulating a third cipher key to achieve a third shared secret key, deriving a final encryption key using the first, second, and third shared secret keys, and establishing secure communication by encrypting communication using the final encryption key. The method further includes verifying the final encryption key with the second device through hash exchange.

To provide an encryption communication system capable of notifying a user of a storage amount of encryption keys.SOLUTION: An encryption communication system includes an application execution environment, an encryption / decryption execution environment, and a key exchange node. The encryption / decryption execution environment encrypts transmission data and decrypts encrypted reception data while consuming the encryption key. The key exchange node generates an encryption key and shares the encryption key with a communication partner. The key exchange node controls whether or not to generate a cryptographic key based on the stored amount of cryptographic keys. The application execution environment includes a stored key amount notification function unit and a band control function unit. The stored key amount notification function unit notifies the stored amount of cryptographic keys. The band control function part receives the notification and automatically executes control of a communication band different for each communication content on the basis of the priority set for each communication content. The band control function unit automatically changes the control content of the communication band according to the notification content without a user's operation.SELECTED DRAWING: Figure 9