821 results about "Shared secret" patented technology

The invention discloses an industrial internet data security communication method based on hybrid anti-quantum cryptography, which relates to the technical field of data communication, and comprises the following steps: acquiring a key pair and an anti-quantum security certificate; sending a connection request to data receiver equipment to complete certificate credibility authentication, and sending an anti-quantum security certificate of the equipment; receiving a shared key seed sent by the data receiver equipment; decrypting the encapsulated ciphertext to obtain a shared key seed, and generating a corresponding shared key according to the same shared key generation algorithm as the data receiver equipment; the method comprises the following steps of: signing original data by using a signature private key, splicing a signature and the original data to obtain spliced data, encrypting the spliced data by using a shared key based on an AES-256-GCM algorithm to obtain an encrypted ciphertext and an ML-DSA signature, and sending the encrypted ciphertext to data receiver equipment. According to the method, the key distribution step is simplified, the signature verification calculation overhead is optimized, and the data communication efficiency is improved.

The invention discloses an anti-quantum security identity authentication method and system, a medium and equipment. The method comprises the following steps: S1, a client, a service server and a key distribution center perform key configuration by adopting a digital signature algorithm; s2, the client sends an authentication request to the authentication server, and receives an authentication response with a bill granted bill returned by the authentication server; s3, the client sends a bill request to the bill issuing server, and receives a bill response with the service bill returned by the bill issuing server; s4, the client generates a client key exchange public key by adopting a first key exchange algorithm and sends an access request, the service server calculates a shared key and a ciphertext after receiving the public key, generates an access response comprising the ciphertext and identity information encrypted by using the shared key, and returns the access response to the client; and S5, the client receives the access response and obtains the shared key, and performs encrypted communication with the service server by using the shared key. The method has forward safe quantum attack resistance and strong identity authentication.

The invention discloses an interface authentication method, system and device based on a national cryptographic algorithm and a medium, belongs to the technical field of computer security, and aims to solve the technical problem of how to realize identity authentication, data encryption, integrity verification and replay attack protection of interface interaction and meet the security requirement of a key information system. According to the technical scheme, the method comprises the following steps: system initialization: a server and a client respectively generate SM2 key pairs, the client and the server exchange public keys through a secure channel, and a mapping relation between the public key of the opposite side and an identity label is stored; session key negotiation: exchanging a temporary public key based on an SM2-ECDH algorithm, calculating a shared secret value, and deriving an SM4 session key through a KDF; the client side carries out SM3 hash and SM2 signature on request parameters, and the server side verifies the signature and verifies a timestamp and a random number to resist replay attacks; and session key updating: triggering key updating according to a preset condition, and encrypting the new key negotiation message by using the original session key.

A computer-implemented method of identifying a denial-of-service attack during a threshold signature scheme, wherein each participant has respective shares of first and second shared secrets, wherein the method is performed by a first participant of the group and comprises: calculating a first target share; calculating a target value based on the first target share and a first predetermined amount of other target shares; calculating a target public key corresponding to the target value; calculating a first verification share based on the first share of the first shared secret and a public key corresponding to the second shared secret; calculating a verification public key based on at least the first verification share and a second predetermined amount of other verification shares; and determining whether at least one other participant is attempting a denial-of-service attack based on whether the verification public key matches the target public key.

The invention discloses an anti-quantum security data transmission authentication method based on an SLH-DSA, and aims to cope with communication security challenges in a quantum computing environment. The device generates a key pair locally in a registration phase and applies for an anti-quantum identity certificate from a certificate agent. In the authentication stage, a user exchanges an identity certificate and a key parameter to realize identity authentication and negotiate a shared key. In the data transmission stage, a session key is dynamically derived by using a shared key, data is encrypted in combination with a national secret symmetric encryption algorithm SM4, and integrity verification is performed by using an anti-quantum signature algorithm. The method gives consideration to security, lightweight and performance, has quantum attack resistance and forward security, is suitable for application scenarios with high data security requirements, such as industrial Internet of Things and smart power grids, and has good application prospects and popularization values.

The invention discloses a data protection method for fusing a quantum key in a TLS, and relates to the technical field of quantum secret communication. According to the method, a quantum key is combined with a pre-shared key to perform identity authentication, and a pre-shared key database is continuously updated, so that the problem that a public key identity authentication system is easily attacked by quantum computing and the problem that the security is reduced due to repeated use of the pre-shared key in the existing method are solved; meanwhile, according to the method, a session key used in the communication process is generated by taking the quantum key as a key material through a preset key generation algorithm, so that the use of an unsafe traditional key exchange algorithm is avoided, and the security of data transmission is enhanced.

The invention discloses a high-load data steganography method, system and device and a medium, and the method comprises the steps: obtaining secret data of a power system, and converting the secret data into a novenary sequence; a quantum key distribution system is utilized to generate a shared key, the novenary sequence is encrypted through an encryption key, encrypted information is obtained, and the shared key comprises the encryption key and a mapping key; determining a corresponding first unit matrix from a preset mapping library based on the mapping key, and performing non-overlapping tiling on the first unit matrix in a two-dimensional plane to obtain a second-order reference matrix; and scanning a preset carrier image into a non-overlapping first pixel pair sequence according to a Hilbert curve, and embedding the encrypted information into the first pixel pair sequence by using the second-order reference matrix to obtain a steganographic image, so that the data transmission security can be improved.

An apparatus and system for privacy protection for Ambient Internet-of-Things (A-IoT) devices are disclosed. A-IoT devices transmit obfuscated identifiers (OIDs) instead of actual identifiers, which are de-obfuscated by the network to retrieve the original identifiers. The device identifiers are obfuscated using shared secret parameters and periodically updated configurations. Hash-based lightweight privacy mechanisms, temporary identifiers (TempIDs), and pseudonym generation may be used to ensure secure communication and prevent replay attacks.

The present invention relates to method for changing the value of one or more privacy parameters, such as a MAC address, of target stations within a BSS, at both an AP station and a non-AP station associated with the AP station. The two stations share a pseudo-random function to generate the new values of the privacy parameters from a shared key and a shared parameter whose value varies over time. The methods comprise for each station: obtaining the shared key and parameter value; communicating, with the other station, a request for changing the values of the privacy parameters at a target time; calculating the new values by using the shared key and the current value of the shared parameter as inputs of the shared function; and replacing, in a registry, the current values of the privacy parameters of the target station by the calculated new values at the target time.

The invention discloses a data security transmission method and system with anti-quantum security, and relates to the technical field of data transmission, and the method comprises the steps: obtaining information which comprises an identity identifier, a temporary public key, a temporary secret value and a validity period demand of a user; generating a public key and a private key of the user based on an ML-DSA signature algorithm; sending an authentication request to a CA authentication center according to the information and a public key of the user, and receiving a certificate authenticated, signed and issued by the CA authentication center; exchanging and verifying the credentials of each other with other users; and after the certificate verification is passed, responding to the data transmission instruction, calling and executing a temporary shared key generation module, outputting a temporary shared key, and then sending data to other users or receiving data from other users based on an SM4 algorithm and an ML-DSA signature algorithm according to the temporary shared key. According to the invention, the cost and risk during upgrading and updating of the system are reduced.

The invention discloses a blockchain-based intelligent video monitoring data storage security sharing method for an iron and steel plant. The method comprises the following steps of: generating a public key PKS and a master key TMK based on an attribute encryption algorithm; distributing shares of the shared key S by constructing a matrix and defining a function, wherein the shares are distributed in different rows of the matrix; re-encrypting the data by using a hybrid proxy re-encryption algorithm based on a ciphertext strategy; secure data storage and access control are realized based on a secure storage mode of revocable attribute-based encryption RABE and a block chain; and in combination with a block chain technology, a consensus algorithm is adopted to verify transactions, so that the security and robustness of the system are enhanced. According to the invention, the utilization rate of the data is improved, the cooperation efficiency is enhanced, the security and transparency of the video monitoring data are improved, and the cost of information transmission and storage is reduced. The distributed storage and access control of the data are realized, the confidentiality and integrity of the cloud center data are ensured, and the security and efficiency of the steel plant video monitoring system in the storage and transmission process are enhanced.

The invention provides a secure communication method and system based on a QRNG and a Beidou positioning terminal. A sending end and a receiving end of communication preset a pre-shared initial key, and a space-time reference parameter group is obtained through Beidou positioning; a secret key packaging secret key is generated by using a national secret SM4 algorithm; monitoring time-space parameter deviation in a communication process in real time, and triggering a key updating protocol when the time-space parameter deviation exceeds a threshold value; and after the receiving end verifies the Hash verification value, decrypting to obtain the primary encryption key, and restoring the plaintext data. According to the system, the generated true random number sequence is used as an encryption key, so that the unpredictability and randomness of the key are fundamentally enhanced, and quantum computing attack and man-in-the-middle attack are effectively resisted. The use of the pre-shared key mechanism and the key packaging key improves the response speed and efficiency of the communication system. And meanwhile, the position parameter and the timestamp are deeply fused to the key generation process, so that the spatio-temporal information is more difficult to counterfeit, and the defense capability of the system is further improved.

Presented herein are systems and methods of generating security-aware tokens. A token may include (i) a first signature encrypted by the second service and (ii) an identification of the plurality of databases accessible using the first token. When a processor determines that the token is valid, the processor may generate a second signature using an encryption key of the first service and a third signature using the shared key of the second service. Thereby a second token derivative of the first token can be created to include (i) the second signature of the first service, (ii) the third signature generated from the shared key of the second service, and (iii) the identification of the plurality of databases accessible using the second token.

A method, a system, and a computer program product for transmission of information over a network. A validity token is generated based on a received contactless card identifier associated with a contactless card. The validity token is generated upon validating the contactless card using the contactless card identifier, and transmitted to a first computing device. A second computing device is identified based on an information request received from the first computing device. The information request includes a first public key associated with the first computing device and the validity token. An encrypted response to the request and a second public key associated with the second computing device are sent to the first computing device. The second computing device generates the encrypted response and encrypts it using a shared key generated using the first public key. The first computing device decrypts the response upon generation of the shared key using the second public key.

The invention discloses an encrypted communication method for a client and a server and a related device. The method comprises the following steps: respectively configuring shared keys for the client and the server based on quantum key distribution equipment; performing key negotiation based on an anti-quantum cryptography algorithm between the client and the server based on the encrypted communication of the shared key to obtain a negotiation session key; and carrying out encrypted communication of service data information between the client and the server based on a shared key before the negotiation session key is obtained, and carrying out encrypted communication of the service data information between the client and the server based on the negotiation session key after the negotiation session key is obtained. Compared with the prior art, communication data are protected by using QKD (quantum key distribution) and PQC (quantum cryptography resisting), and both cost and time are taken into account.

The invention discloses a national secret algorithm data encryption transmission method and system. The method comprises the steps of obtaining to-be-encrypted data and network parameters, establishing a Bayesian network probability ablation model, performing Monte Carlo sampling ablation national secret encryption and evaluating attack risks, and generating a probability security encryption strategy; and extracting a Brinell feature set, constructing a long and short-term memory network time prediction model, and optimizing by using a simulated annealing algorithm to obtain an optimal encryption parameter configuration sequence. Generating a key pair according to the sequence and SM2, establishing a shared key by means of an elliptic curve Diffie-Hellman protocol, deriving an SM4 session key through SM3, and establishing a hybrid encryption key system; constructing a teacher and student network model, optimizing multi-thread scheduling through adversarial distillation training and a retrieval enhancement technology, and generating a multi-thread parallel encryption architecture; and network parameters are monitored in real time, a reinforcement learning adaptive decision engine is constructed, a strategy is dynamically adjusted, and adaptive encryption transmission is completed. According to the invention, the optimal balance between the security and the efficiency in the data encryption transmission process is realized.

The invention provides a key dynamic management method and system, and the method comprises the steps: responding to a communication request sent by a vehicle end, and carrying out the validity verification of a vehicle end certificate through a public key of an intermediate certificate authority; after the verification is passed, according to the current network quality parameter and the communication data sensitivity level, determining the target length of the secret key according to a secret key length modulation strategy; and deriving a shared key with a target length through an encryption algorithm by using the vehicle end public key and the cloud end private key, and sending the shared key and the cloud end certificate to the vehicle end. Therefore, the shared key is dynamically adjusted according to the network quality parameter and the communication data sensitivity level, so that the security and efficiency of data transmission can be effectively ensured, and the management complexity is reduced.

Systems, devices, and methods are provided for cryptographic co-dependent across multiple roots of trust. A device may comprise two or more co-dependent roots of trust, such as a trusted execution environment (TEE) of a main application processor and a cryptographic subsystem comprising a cryptographic processor. A server may validate digital signatures generated by each co-dependent root of trust that is known for the device and then provide the device with cryptographic material that can be used to establish a shared secret. The shared secret may be used by the device to request the performance of a sensitive operation.

The invention discloses an iframe two-way encryption communication method and system based on a network target range, and belongs to the technical field of network security. In the aspect of data communication of iframes of a front-end platform and a third-party platform, security is enhanced, a digital certificate is generated through an ECDH key pair, and a foundation is laid for identity verification; then TCP handshake is simulated to establish a reliable channel, and two-way identity authentication resisting replay attack is achieved through two-way certificate verification and random number exchange; then negotiating a shared key by using ECDH, deriving a dynamic session key through an HKDF algorithm, and ensuring forward confidentiality; and finally, real-time data encryption and integrity verification are carried out by adopting AES-GCM, and the anti-leakage capability is continuously improved through a timing key rotation mechanism. The whole process fuses the characteristics of quantum computing resistance, low resource consumption, efficient transmission and the like, an end-to-end secure communication normal form is provided for Web application, and cross-session key confusion is prevented.

The invention relates to the technical field of power data transmission, and discloses a power data key negotiation and symmetric encryption method, system and device and a medium, and the method comprises the steps: obtaining target power data, and carrying out the first preprocessing of the target power data; performing second preprocessing on the target power data; obtaining a target statistical feature of the gray matrix according to the first preprocessing result, and generating a first replacement structure in combination with a target shared key obtained after the second preprocessing; and encrypting the target power data according to the first replacement structure. According to the invention, the security of the power data is greatly improved. In the power data transmission process, through the method of the invention, it can be ensured that data is not stolen or tampered in the transmission process, and the risk of data leakage is effectively prevented. Meanwhile, the implementation steps of the method are simple and clear, the method is easy to popularize and apply in various power systems, and a powerful guarantee is provided for stable operation of the power systems.

The invention relates to the technical field of electric power communication security, in particular to a power grid data secure transmission system and method based on quantum cryptography and a medium, comprising: a power grid data access module extracts identities of a power grid data request end and a target response end; the quantum key distribution module obtains an original shared key pre-stored by the two communication parties, and generates a quantum key according to the one-time session password and the original shared key; the communication security management module analyzes the shared key information from the quantum key received by the target response end to obtain analyzed shared key information, and performs communication security verification on the original shared key and the analyzed shared key information; and the power grid security communication module encrypts the to-be-transmitted power grid data when the communication security verification result is that the verification is passed, and transmits the power grid encrypted data to the target response end. Through cooperation mechanisms such as quantum key dynamic distribution and security verification, security protection of power grid data transmission is realized, and power grid data communication security is improved.

The invention provides an anti-quantum fuzzy keyword processing method and system and electronic equipment, and relates to the technical field of networks and security. The method comprises the following steps: a client performs wildcard character extension on a keyword set based on a target shared key, generates an encryption index, performs authentication encryption on file identifiers by using the target shared key, forms an encrypted file identifier set, constructs an index table, and uploads the index table and the encrypted file set to a cloud server. The server generates a second wildcard character set according to the query keyword and a fault-tolerant threshold value, generates a trap door set based on the same target shared key and a pseudo-random function and sends the trap door set to the cloud server, and the cloud server traverses the index table, compares the index table with the trap door set and sends the trap door set to the server; and finding out the matched target encryption index and the associated target encryption file identifier and returning the matched target encryption index and the associated target encryption file identifier to the server, and decrypting and acquiring the target file from the cloud server by the server. In this way, high-safety, high-efficiency and extensible privacy protection search service is achieved.

Techniques and architecture are described for reauthentication of two IPsec peers, during a key refresh process. The peers may reauthenticate each other based upon a shared secret, which in configurations, is a PPK. In configurations the PPKs are stirred (mixed with DH / ECDH) during key derivation while refreshing the session keys during IKE_v2 and IPsec rekey. This may involve communicating the PPK-ID from a rekey initiator to a rekey responder by adding a PPK_ID payload in the rekey message exchange. This enables stronger quantum safe session keys, when dynamic PPK is used or when the manual PPK is rotated frequently. In configurations, the knowledge of the shared PPK is proved by having both peers exchange authentication payloads signed with a PPK. This involves exchanging a IKEv2 NOTIFY payload “AUTH_PPK” to carry PPK-signed authentication data. This serves the purpose of frequent re-authentication of the peers as part of the key refreshes.

The invention discloses a distributed key generation method and device based on an SM2 algorithm, a medium and equipment. The method comprises the following steps: determining a class group encryption key, a class group decryption key and a corresponding first zero knowledge proof through public parameters generated based on the SM2 distributed key; each participant shares respective secret share based on the class group encryption key, the class group decryption key and the first zero-knowledge proof, and creates a second zero-knowledge proof indicating that sharing is correct; each parameter party collects honest distribution shares and decryption shares based on the second zero knowledge proof, calculates a part of private keys and a part of public keys according to the decrypted secret shares, and creates a third zero knowledge proof indicating correct decryption; according to the third zero knowledge proof, partial public keys of participants correctly executing decryption operation are determined to reconstruct a global public key, the secret is shared by using a polynomial, each participant can contribute a part of shares, and a distributed secret key is generated without any credible setting.

The invention provides an inter-micro-service dynamic secure communication method and device based on chaos cryptography. The method comprises the steps that a service provider instance registers a public key and chaos initial parameters to a service registration center; before calling, the service consumer instance acquires a public key and a chaos initial parameter of a target service provider instance from a service registration center; the service consumer instance performs key negotiation with the acquired public key by using a private key of the service consumer instance to determine a shared key; performing key derivation on the shared key and the chaotic initial parameter to generate an initial key; respectively using the initial keys to initialize the chaotic system so as to generate synchronous encryption key streams; and the two communication parties perform real-time stream encryption and decryption on the communication data between the micro-services by using the encryption key stream. The unpredictability of a chaotic system and modern cryptography can be combined, and a micro-service design mode is deeply integrated, so that a lightweight and high-security communication security mechanism which does not need to share a key in advance and can be adaptive to dynamic change of service is realized.

The invention discloses an authenticable key exchange method and application based on SM2 signature. The method comprises the following steps: a communication participant negotiates to select an elliptic curve and a base point and discloses parameters; each participant generates a private key and a corresponding public key, and the public keys are exchanged through a communication channel; carrying out key negotiation based on elliptic curve point multiplication operation to generate a shared key; each participant signs the related information of the shared key or the public key by using an SM2 signature method to generate a signature result; and the participant verifies the validity of the signature by using the public key of the opposite side through exchanging the signature result and related parameters, thereby realizing identity authentication and key integrity verification. According to the SM2 signature method, a public key and signature parameters are generated through elliptic curve point multiplication operation, and signature and verification are achieved based on the asymmetric relation between a private key and the public key. According to the invention, communication party identity authentication, data integrity verification and key confidentiality protection are realized, and the security and efficiency of key exchange in a cloud computing environment are improved.

Systems, apparatuses, methods, and computer program products are disclosed for authentication of devices. An example method includes an authentication technique utilizing authentication tokens. Authentication tokens may be bit strings associated with time intervals and may be derived from quantum particles. Quantum particles may be obtained by two or more devices in a continuous stream via quantum key distribution. Devices throughout a distributed system may read the quantum particles at previously established time intervals, obtain bit strings, and use the bit strings as authentication tokens to perform one, multiple, and / or continuous authentication processes. Each device may have access to matching authentication tokens without exchanging any authentication tokens between devices and, therefore, the authentication tokens may be used as shared secrets to facilitate a more secure connection between devices.

The invention belongs to the technical field of federated learning and Internet of Vehicles crossing, and particularly relates to an asynchronous federated learning method for realizing lightweight privacy protection in Internet of Vehicles. Public key exchange is carried out between the station and the base station to calculate a shared secret key; the vehicle updates a local model by using the global model parameters, and performs training by using local data; random number generation is carried out based on the shared secret key and the training round, and the vehicle adds the random number to the gradient of the trained local model parameter to realize local model parameter encryption; the RSU forwards the vehicle information and the training round to a base station, the base station searches a shared secret key corresponding to the vehicle information, and the sum of random numbers is calculated in combination with the training round; the RSU carries out decryption aggregation on the encrypted gradient information based on the sum of the random numbers, and global model parameters are updated; and the RSU broadcasts the global model parameters, the vehicle updates the local model by using the global model parameters, and then the next round of training is continued until the training is finished.

The invention discloses a QKD system authentication method and device based on fusion of QRNG and PQC, and belongs to the technical field of information security, and the method comprises the following steps: S1, constructing a key encryption module based on QRNG and PQC, and when a QKD system starts a key negotiation process, carrying out identity verification based on a digital certificate to determine a negotiation object; s2, generating an encrypted random number based on a QRNG in a key encryption module, and obtaining a shared key between negotiation objects based on the encrypted random number and a PQC in a key encryption algorithm; and S3, generating a message authentication code based on the shared key, and performing authentication based on the message authentication code. The technical problem that the complexity is difficult to reduce while the security is improved in the prior art is solved, and the flexibility and expandability of authentication are also improved.

Embodiments described herein provide for a non-transitory machine-readable medium storing instructions to cause one or more processor to perform operations to share a set of keys used to communicate with a wireless accessory device. By sharing the set of keys, functionality of the wireless accessory device can be delegated by an owner to other individuals.