1098 results about "Shared secret" patented technology

A system and method that authenticates and secures communications between a wireless client device and a remote network component. The system includes a gateway component that establishes a secure communications channel with the remote network component. A client device application, corresponding to the wireless client device, receives local authentication credentials from the gateway component. The client device application uses the local authentication credentials to authenticate to the remote network component. The client device application then requests an exclusive local key from the remote network component, which transmits the exclusive local key to the gateway component, which then transmits the exclusive local key to the client device application. The client device application, having the exclusive local key, requests and receives cryptographic material from the remote network component. The client device application secures communications to the remote network component with a shared secret that includes the exclusive local key received from the gateway component and the cryptographic material received from the network component.

Disclosed in the present invention is a Chinese national cryptographic algorithm-based identity authentication and data encryption method for CoAP, comprising: pre-configuring identity authentication data of a client and a server; and performing identity authentication on the basis of the pre-configured information, determining the security of the client and the server, performing key agreement to obtain a session key, and if it is determined that the security meets a requirement, completing data transmission on the basis of the session key. According to the present invention, identity tables are established for a client and a server respectively, and important data can only be accessed by both the client and the server by looking up the tables; by means of a pre-shared key, SM4 and SM3 algorithms are used to complete bidirectional identity authentication and key agreement before data transmission between the client and the server, and by using only two handshake messages, the confidentiality of the important data and the integrity of messages during identity authentication can still be guaranteed; replay attacks are prevented by using timestamps and random numbers; and data transmission is performed by using an observer mode that reduces overhead to the greatest extent.

The invention discloses a data transmission protection method and a computer device. The method comprises the following steps: initializing a target system; disturbing an initial public key in the generated temporary key pair based on a preset differential privacy mechanism in initialization to obtain a first public key; the temporary key pair comprises an own private key and an initial public key; a first public key is exchanged through the initialized secure communication channel, and zero-knowledge proof information is generated; verifying the received first public key based on an initialized preset zero-knowledge proof system and zero-knowledge proof information, if the verification is passed, calculating a shared key according to the own private key and the received first public key, and obtaining a session key based on a key derivation function and the shared key; and encrypting to-be-transmitted original data based on the session key to obtain an encrypted data packet, and sending the encrypted data packet to a receiving end through the secure communication channel. According to the method, high efficiency, high security and high privacy of data transmission can be ensured.

A wireless access method includes the following steps. An access point obtains a personal identification number of a terminal device and broadcasts a beacon. The access point performs a terminal device authentication on a vendor specific information element of a probe request from the terminal device according to the personal identification number. When the terminal device authentication is successful, the access point performs a key calculation according to the personal identification number and the probe request to generate a pairwise transient key, a key encryption key and a group transient key and uses the key encryption key to encrypt a pre-shared key and the group transient key. The access point transmits a probe response to the terminal device. The access point installs the pairwise transient key and the group transient key to establish an encrypted transmission.

The invention discloses an industrial internet data security communication method based on hybrid anti-quantum cryptography, which relates to the technical field of data communication, and comprises the following steps: acquiring a key pair and an anti-quantum security certificate; sending a connection request to data receiver equipment to complete certificate credibility authentication, and sending an anti-quantum security certificate of the equipment; receiving a shared key seed sent by the data receiver equipment; decrypting the encapsulated ciphertext to obtain a shared key seed, and generating a corresponding shared key according to the same shared key generation algorithm as the data receiver equipment; the method comprises the following steps of: signing original data by using a signature private key, splicing a signature and the original data to obtain spliced data, encrypting the spliced data by using a shared key based on an AES-256-GCM algorithm to obtain an encrypted ciphertext and an ML-DSA signature, and sending the encrypted ciphertext to data receiver equipment. According to the method, the key distribution step is simplified, the signature verification calculation overhead is optimized, and the data communication efficiency is improved.

The invention discloses an anti-quantum security identity authentication method and system, a medium and equipment. The method comprises the following steps: S1, a client, a service server and a key distribution center perform key configuration by adopting a digital signature algorithm; s2, the client sends an authentication request to the authentication server, and receives an authentication response with a bill granted bill returned by the authentication server; s3, the client sends a bill request to the bill issuing server, and receives a bill response with the service bill returned by the bill issuing server; s4, the client generates a client key exchange public key by adopting a first key exchange algorithm and sends an access request, the service server calculates a shared key and a ciphertext after receiving the public key, generates an access response comprising the ciphertext and identity information encrypted by using the shared key, and returns the access response to the client; and S5, the client receives the access response and obtains the shared key, and performs encrypted communication with the service server by using the shared key. The method has forward safe quantum attack resistance and strong identity authentication.

The invention discloses an interface authentication method, system and device based on a national cryptographic algorithm and a medium, belongs to the technical field of computer security, and aims to solve the technical problem of how to realize identity authentication, data encryption, integrity verification and replay attack protection of interface interaction and meet the security requirement of a key information system. According to the technical scheme, the method comprises the following steps: system initialization: a server and a client respectively generate SM2 key pairs, the client and the server exchange public keys through a secure channel, and a mapping relation between the public key of the opposite side and an identity label is stored; session key negotiation: exchanging a temporary public key based on an SM2-ECDH algorithm, calculating a shared secret value, and deriving an SM4 session key through a KDF; the client side carries out SM3 hash and SM2 signature on request parameters, and the server side verifies the signature and verifies a timestamp and a random number to resist replay attacks; and session key updating: triggering key updating according to a preset condition, and encrypting the new key negotiation message by using the original session key.

A system and method for providing metered quantum entanglement-as-a-service are described. Entangled pair source nodes apply a unitary transformation to generated entangled quantum particles, such that the entangled quantum particles are transformed into a given one of a plurality of transformed states that are selected randomly or in a manner that is not readily apparent to customers. The transformed entangled quantum particles are distributed to recipients, such as customers. However, in order for the recipients to be able to use the received entangled particles to communicate shared information, such as a shared secret, the recipients require knowledge of the respective states of the entangled quantum particles resulting from the randomly selected transformations. The state information is metered out in response to receiving payment or other authorization indicating a recipient / customer has complied with terms of use of the quantum entanglement distribution service.

A computer-implemented method of identifying a denial-of-service attack during a threshold signature scheme, wherein each participant has respective shares of first and second shared secrets, wherein the method is performed by a first participant of the group and comprises: calculating a first target share; calculating a target value based on the first target share and a first predetermined amount of other target shares; calculating a target public key corresponding to the target value; calculating a first verification share based on the first share of the first shared secret and a public key corresponding to the second shared secret; calculating a verification public key based on at least the first verification share and a second predetermined amount of other verification shares; and determining whether at least one other participant is attempting a denial-of-service attack based on whether the verification public key matches the target public key.

The invention discloses an anti-quantum security data transmission authentication method based on an SLH-DSA, and aims to cope with communication security challenges in a quantum computing environment. The device generates a key pair locally in a registration phase and applies for an anti-quantum identity certificate from a certificate agent. In the authentication stage, a user exchanges an identity certificate and a key parameter to realize identity authentication and negotiate a shared key. In the data transmission stage, a session key is dynamically derived by using a shared key, data is encrypted in combination with a national secret symmetric encryption algorithm SM4, and integrity verification is performed by using an anti-quantum signature algorithm. The method gives consideration to security, lightweight and performance, has quantum attack resistance and forward security, is suitable for application scenarios with high data security requirements, such as industrial Internet of Things and smart power grids, and has good application prospects and popularization values.

The invention discloses a data protection method for fusing a quantum key in a TLS, and relates to the technical field of quantum secret communication. According to the method, a quantum key is combined with a pre-shared key to perform identity authentication, and a pre-shared key database is continuously updated, so that the problem that a public key identity authentication system is easily attacked by quantum computing and the problem that the security is reduced due to repeated use of the pre-shared key in the existing method are solved; meanwhile, according to the method, a session key used in the communication process is generated by taking the quantum key as a key material through a preset key generation algorithm, so that the use of an unsafe traditional key exchange algorithm is avoided, and the security of data transmission is enhanced.

The invention provides a key charging method and device based on quantum key protection. The method comprises the following steps: a charging client sends a key negotiation request to a local key server; the local key server obtains a first quantum key through the quantum key distribution network as a shared key and sends the shared key to the charging client and the target key server; the charging client sends a charging key acquisition request to the target key server; the target key server obtains the charging key and encrypts the charging key by using the shared key to generate a charging key ciphertext; the target key server sends the charging key ciphertext to the charging client; and the charging client writes the charging key ciphertext and the shared key into the key charging security medium to complete key charging, so that secure transmission and storage of the key among different security environments are ensured through the quantum key distribution network, and the charging key is encrypted by using the quantum key in the transmission process, so that the security of the key is ensured. And the security and reliability of key management are improved.

The invention discloses a high-load data steganography method, system and device and a medium, and the method comprises the steps: obtaining secret data of a power system, and converting the secret data into a novenary sequence; a quantum key distribution system is utilized to generate a shared key, the novenary sequence is encrypted through an encryption key, encrypted information is obtained, and the shared key comprises the encryption key and a mapping key; determining a corresponding first unit matrix from a preset mapping library based on the mapping key, and performing non-overlapping tiling on the first unit matrix in a two-dimensional plane to obtain a second-order reference matrix; and scanning a preset carrier image into a non-overlapping first pixel pair sequence according to a Hilbert curve, and embedding the encrypted information into the first pixel pair sequence by using the second-order reference matrix to obtain a steganographic image, so that the data transmission security can be improved.

An apparatus and system for privacy protection for Ambient Internet-of-Things (A-IoT) devices are disclosed. A-IoT devices transmit obfuscated identifiers (OIDs) instead of actual identifiers, which are de-obfuscated by the network to retrieve the original identifiers. The device identifiers are obfuscated using shared secret parameters and periodically updated configurations. Hash-based lightweight privacy mechanisms, temporary identifiers (TempIDs), and pseudonym generation may be used to ensure secure communication and prevent replay attacks.

Systems, methods and devices are described for establishing trusted connections among two or more therapy devices that form, or form part of, a medication therapy system. A medication delivery electronics may include a first communication interface, a connection manager, and a therapy management application. A first communication interface may be configured to establish and communicate over one or more communication links. A connection manager may be configured to generate a candidate shared secret key and provide the shared key to a first therapy device over a first communication link established by a first communication interface. A candidate shared key may be generated responsive to one or more shared secret parameters. A therapy management application may be configured to receive, using the first communication interface, the first therapy related information from the first therapy device over a first trusted communication link established by the first communication interface responsive to acceptance of a candidate shared secret.

The present invention relates to method for changing the value of one or more privacy parameters, such as a MAC address, of target stations within a BSS, at both an AP station and a non-AP station associated with the AP station. The two stations share a pseudo-random function to generate the new values of the privacy parameters from a shared key and a shared parameter whose value varies over time. The methods comprise for each station: obtaining the shared key and parameter value; communicating, with the other station, a request for changing the values of the privacy parameters at a target time; calculating the new values by using the shared key and the current value of the shared parameter as inputs of the shared function; and replacing, in a registry, the current values of the privacy parameters of the target station by the calculated new values at the target time.

The invention discloses a data security transmission method and system with anti-quantum security, and relates to the technical field of data transmission, and the method comprises the steps: obtaining information which comprises an identity identifier, a temporary public key, a temporary secret value and a validity period demand of a user; generating a public key and a private key of the user based on an ML-DSA signature algorithm; sending an authentication request to a CA authentication center according to the information and a public key of the user, and receiving a certificate authenticated, signed and issued by the CA authentication center; exchanging and verifying the credentials of each other with other users; and after the certificate verification is passed, responding to the data transmission instruction, calling and executing a temporary shared key generation module, outputting a temporary shared key, and then sending data to other users or receiving data from other users based on an SM4 algorithm and an ML-DSA signature algorithm according to the temporary shared key. According to the invention, the cost and risk during upgrading and updating of the system are reduced.

The invention provides an ultra-high-speed terminal access and cooperative authentication method and a program product in a satellite network, and the method comprises the steps: a ground control center responds to a registration request sent by an access point and an ultra-high-speed terminal, and configures an access point identity for the access point; configuring a long-term shared key, a terminal identity, a main public key, a generator on an elliptic curve and an index table for the ultra-high-speed terminal; when any first ultra-high-speed terminal flies to the air and does not deviate from the coverage range of the first access point in the access process, an access authentication request is sent to the ground control center through the first access point to complete access authentication; when the first ultra-high-speed terminal flies to the air and is about to deviate from the coverage range of the first access point in the access process, an access authentication request is sent to the ground control center through the multiple access points on the route of the first ultra-high-speed terminal, cooperative authentication is completed to access the ground control center, and the ultra-high-speed terminal can flexibly and rapidly access the ground control center.

The invention discloses a blockchain-based intelligent video monitoring data storage security sharing method for an iron and steel plant. The method comprises the following steps of: generating a public key PKS and a master key TMK based on an attribute encryption algorithm; distributing shares of the shared key S by constructing a matrix and defining a function, wherein the shares are distributed in different rows of the matrix; re-encrypting the data by using a hybrid proxy re-encryption algorithm based on a ciphertext strategy; secure data storage and access control are realized based on a secure storage mode of revocable attribute-based encryption RABE and a block chain; and in combination with a block chain technology, a consensus algorithm is adopted to verify transactions, so that the security and robustness of the system are enhanced. According to the invention, the utilization rate of the data is improved, the cooperation efficiency is enhanced, the security and transparency of the video monitoring data are improved, and the cost of information transmission and storage is reduced. The distributed storage and access control of the data are realized, the confidentiality and integrity of the cloud center data are ensured, and the security and efficiency of the steel plant video monitoring system in the storage and transmission process are enhanced.

The invention provides a secure communication method and system based on a QRNG and a Beidou positioning terminal. A sending end and a receiving end of communication preset a pre-shared initial key, and a space-time reference parameter group is obtained through Beidou positioning; a secret key packaging secret key is generated by using a national secret SM4 algorithm; monitoring time-space parameter deviation in a communication process in real time, and triggering a key updating protocol when the time-space parameter deviation exceeds a threshold value; and after the receiving end verifies the Hash verification value, decrypting to obtain the primary encryption key, and restoring the plaintext data. According to the system, the generated true random number sequence is used as an encryption key, so that the unpredictability and randomness of the key are fundamentally enhanced, and quantum computing attack and man-in-the-middle attack are effectively resisted. The use of the pre-shared key mechanism and the key packaging key improves the response speed and efficiency of the communication system. And meanwhile, the position parameter and the timestamp are deeply fused to the key generation process, so that the spatio-temporal information is more difficult to counterfeit, and the defense capability of the system is further improved.

Presented herein are systems and methods of generating security-aware tokens. A token may include (i) a first signature encrypted by the second service and (ii) an identification of the plurality of databases accessible using the first token. When a processor determines that the token is valid, the processor may generate a second signature using an encryption key of the first service and a third signature using the shared key of the second service. Thereby a second token derivative of the first token can be created to include (i) the second signature of the first service, (ii) the third signature generated from the shared key of the second service, and (iii) the identification of the plurality of databases accessible using the second token.

A method, a system, and a computer program product for transmission of information over a network. A validity token is generated based on a received contactless card identifier associated with a contactless card. The validity token is generated upon validating the contactless card using the contactless card identifier, and transmitted to a first computing device. A second computing device is identified based on an information request received from the first computing device. The information request includes a first public key associated with the first computing device and the validity token. An encrypted response to the request and a second public key associated with the second computing device are sent to the first computing device. The second computing device generates the encrypted response and encrypts it using a shared key generated using the first public key. The first computing device decrypts the response upon generation of the shared key using the second public key.

A communication system according to one embodiment is a communication system including a plurality of communication apparatuses, in which each communication apparatus includes: an application program configured to perform encrypted communication with another communication apparatus; a protocol conversion unit configured to transmit a message representing a predetermined procedure when a key request for a shared key to be used in the encrypted communication is received from the application program; a state management unit configured to receive a message from the protocol conversion unit to manage an execution state of the procedure, and to transmit the message to a protocol driver supporting a predetermined key sharing protocol; and a protocol driver configured to request a key sharing system that executes the key sharing protocol, to generate the shared key, when the message is received from the state management unit.

The invention discloses an encrypted communication method for a client and a server and a related device. The method comprises the following steps: respectively configuring shared keys for the client and the server based on quantum key distribution equipment; performing key negotiation based on an anti-quantum cryptography algorithm between the client and the server based on the encrypted communication of the shared key to obtain a negotiation session key; and carrying out encrypted communication of service data information between the client and the server based on a shared key before the negotiation session key is obtained, and carrying out encrypted communication of the service data information between the client and the server based on the negotiation session key after the negotiation session key is obtained. Compared with the prior art, communication data are protected by using QKD (quantum key distribution) and PQC (quantum cryptography resisting), and both cost and time are taken into account.

The invention discloses a national secret algorithm data encryption transmission method and system. The method comprises the steps of obtaining to-be-encrypted data and network parameters, establishing a Bayesian network probability ablation model, performing Monte Carlo sampling ablation national secret encryption and evaluating attack risks, and generating a probability security encryption strategy; and extracting a Brinell feature set, constructing a long and short-term memory network time prediction model, and optimizing by using a simulated annealing algorithm to obtain an optimal encryption parameter configuration sequence. Generating a key pair according to the sequence and SM2, establishing a shared key by means of an elliptic curve Diffie-Hellman protocol, deriving an SM4 session key through SM3, and establishing a hybrid encryption key system; constructing a teacher and student network model, optimizing multi-thread scheduling through adversarial distillation training and a retrieval enhancement technology, and generating a multi-thread parallel encryption architecture; and network parameters are monitored in real time, a reinforcement learning adaptive decision engine is constructed, a strategy is dynamically adjusted, and adaptive encryption transmission is completed. According to the invention, the optimal balance between the security and the efficiency in the data encryption transmission process is realized.

The invention provides a key dynamic management method and system, and the method comprises the steps: responding to a communication request sent by a vehicle end, and carrying out the validity verification of a vehicle end certificate through a public key of an intermediate certificate authority; after the verification is passed, according to the current network quality parameter and the communication data sensitivity level, determining the target length of the secret key according to a secret key length modulation strategy; and deriving a shared key with a target length through an encryption algorithm by using the vehicle end public key and the cloud end private key, and sending the shared key and the cloud end certificate to the vehicle end. Therefore, the shared key is dynamically adjusted according to the network quality parameter and the communication data sensitivity level, so that the security and efficiency of data transmission can be effectively ensured, and the management complexity is reduced.

Systems, devices, and methods are provided for cryptographic co-dependent across multiple roots of trust. A device may comprise two or more co-dependent roots of trust, such as a trusted execution environment (TEE) of a main application processor and a cryptographic subsystem comprising a cryptographic processor. A server may validate digital signatures generated by each co-dependent root of trust that is known for the device and then provide the device with cryptographic material that can be used to establish a shared secret. The shared secret may be used by the device to request the performance of a sensitive operation.

The invention discloses an iframe two-way encryption communication method and system based on a network target range, and belongs to the technical field of network security. In the aspect of data communication of iframes of a front-end platform and a third-party platform, security is enhanced, a digital certificate is generated through an ECDH key pair, and a foundation is laid for identity verification; then TCP handshake is simulated to establish a reliable channel, and two-way identity authentication resisting replay attack is achieved through two-way certificate verification and random number exchange; then negotiating a shared key by using ECDH, deriving a dynamic session key through an HKDF algorithm, and ensuring forward confidentiality; and finally, real-time data encryption and integrity verification are carried out by adopting AES-GCM, and the anti-leakage capability is continuously improved through a timing key rotation mechanism. The whole process fuses the characteristics of quantum computing resistance, low resource consumption, efficient transmission and the like, an end-to-end secure communication normal form is provided for Web application, and cross-session key confusion is prevented.

The invention relates to the technical field of power data transmission, and discloses a power data key negotiation and symmetric encryption method, system and device and a medium, and the method comprises the steps: obtaining target power data, and carrying out the first preprocessing of the target power data; performing second preprocessing on the target power data; obtaining a target statistical feature of the gray matrix according to the first preprocessing result, and generating a first replacement structure in combination with a target shared key obtained after the second preprocessing; and encrypting the target power data according to the first replacement structure. According to the invention, the security of the power data is greatly improved. In the power data transmission process, through the method of the invention, it can be ensured that data is not stolen or tampered in the transmission process, and the risk of data leakage is effectively prevented. Meanwhile, the implementation steps of the method are simple and clear, the method is easy to popularize and apply in various power systems, and a powerful guarantee is provided for stable operation of the power systems.

The invention relates to the technical field of electric power communication security, in particular to a power grid data secure transmission system and method based on quantum cryptography and a medium, comprising: a power grid data access module extracts identities of a power grid data request end and a target response end; the quantum key distribution module obtains an original shared key pre-stored by the two communication parties, and generates a quantum key according to the one-time session password and the original shared key; the communication security management module analyzes the shared key information from the quantum key received by the target response end to obtain analyzed shared key information, and performs communication security verification on the original shared key and the analyzed shared key information; and the power grid security communication module encrypts the to-be-transmitted power grid data when the communication security verification result is that the verification is passed, and transmits the power grid encrypted data to the target response end. Through cooperation mechanisms such as quantum key dynamic distribution and security verification, security protection of power grid data transmission is realized, and power grid data communication security is improved.