142 results about "Transport Layer Security" patented technology

Systems and methods are provided for a scalable load balancer to enable client certificate access control using mutual transport layer security authentication comprising hardware configured to receive trust store files including a certificate authority (CA) bundle and a certificate revocation list (CRL), generate a single trust store file based on the trust store files, distribute a snapshot of the single trust store file to one or more nodes of the scalable load balancer, verify, using the snapshot, a client certificate from a client device by searching for a trusted CA from the CA bundle in the snapshot, determine whether the CRL contained in the snapshot includes the client certificate, and upon verifying the client certificate and determining that the CRL does not contain the client certificate, transmit connection data from the client device to an application target.

The embodiment of the invention discloses a data transmission method and device, a storage medium and equipment, which can be applied to various scenes such as cloud technology, artificial intelligence, intelligent traffic and auxiliary driving. Sending a handshake request to the server through a special transport layer security protocol between the small program end and the server; a dynamic key returned by the server according to the handshake request and an encrypted string obtained through encryption processing based on the dynamic key are received through a dedicated transport layer security protocol; obtaining target data to be sent, and encrypting the target data through the dynamic key to generate a corresponding ciphertext; and sending the ciphertext and the encrypted string to a server through a general transport layer security protocol, so that the server performs second decryption processing on the ciphertext according to a dynamic key recovered by performing first decryption processing on the encrypted string to obtain target data. Therefore, the dynamic key is prevented from being transmitted in a plaintext form, the dynamic key is prevented from being cracked, and the security of data transmission is improved.

Systems and methods for implementing a service identity platform with cloud-based Public Key Infrastructure (PKI) include providing security as a service via a cloud-based system for a plurality of tenants, wherein the cloud-based system includes a plurality of components communicatively coupled and adapted to communicate with one another based on mutual Transport Layer Security (mTLS) authentication; responsive to a new component requiring deployment within the cloud-based system, performing an enrollment process for the new component; and subsequent to the enrollment process, utilizing the new component within the cloud-based system for providing security as a service.

Disclosed in the embodiments of the present application are a data transmission method, an apparatus, a storage medium and a device, which can be applied to various scenarios such as cloud technology, artificial intelligence, smart traffic and aided driving. The method comprises: by means of a dedicated transport layer security protocol between an applet and a server, sending a handshake request to the server; by means of the dedicated transport layer security protocol, receiving a dynamic key returned, on the basis of the handshake request, by the server and an encrypted string obtained on the basis of the dynamic key; acquiring data to be transmitted, and using the dynamic key to encrypt the data, so as to obtain a ciphertext; and, by means of a universal transport layer security protocol, sending the ciphertext and the encrypted string to the server, so that the server obtains the dynamic key on the basis of decrypting the encrypted string, and decrypts the ciphertext on the basis of the dynamic key to obtain decrypted data.

This disclosure describes a technique to fingerprint TLS connection information to facilitate bot detection. The notion is referred to herein as “TLS fingerprinting.” Preferably, TLS fingerprinting herein comprises combining different parameters from the initial “Hello” packet send by the client. In one embodiment, the different parameters from the Hello packet that are to create the fingerprint (the “TLS signature”) are: record layer version, client version, ordered TLS extensions, ordered cipher list, ordered elliptic curve list, and ordered signature algorithms list. Preferably, the edge server persists the TLS signature for the duration of a session.

Methods, systems, and apparatuses are described herein for protecting sensitive data even when Transport Layer Security (TLS) communication sessions are compromised. A computing device may send, via a web browser plugin of a web browser application executing on the computing device and to one or more remote servers, a request for a server secret that comprises a device fingerprint, an identification of the web browser application, and an identification of the web browser plugin. The computing device may receive the server secret and a public certificate associated with the remote server. The computing device may establish, via the web browser application, a TLS session with the one or more remote servers. The computing device may generate a session key. The computing device may receive data comprising unencrypted data and encrypted data. The computing device may decrypt the encrypted data based on the session key.

The invention is suitable for the technical field of battery data transmission encryption, and provides a data battery multi-stage hybrid encrypted battery data link, which comprises a battery management system, a transmission layer security channel and a cloud data processing layer, according to the battery management system, an SM4 hardware encryption chip is integrated at a battery BMS end, and original data such as voltage / temperature and the like are encrypted in real time; the transport layer secure channel dynamically negotiates a session key through an SM2 algorithm, and establishes a secure channel to transmit a ciphertext data packet; the cloud data processing layer generates a hash value for the received data by using SM3, and verifies the data integrity; preferably, the battery management system comprises a data acquisition module, an SM4 hardware encryption chip and an encrypted data packet packaging module. According to the invention, through the SM2 / SM4 / SM3 three-level combination encryption technology, light-weight national-security compliance is realized on the hardware layer, an anti-quantum attack channel is constructed on the transmission layer, the data is ensured to be complete and credible on the cloud layer, and a full-stack security protection system covering'end-management-cloud 'is formed.

The invention relates to the field of electric vehicle charging control, and particularly provides a system, method, device and equipment for safe communication between a charging pile and a BMS and a storage medium, the system comprises a bidirectional authentication module, a communication encryption module, a verification module and an optimization module; the bidirectional authentication module is used for constructing a bidirectional authentication protocol between the charging pile and a battery management system (BMS) based on the hardware security module and authenticating the identity; the communication encryption module is used for customizing an integrated transport layer security protocol line through an open source tool and encrypting security communication data; the verification module is used for designing a three-level verification mechanism, blocking a malicious firmware injection path and verifying a secure communication process; and the optimization module is used for optimizing the key process by adopting a redundant backup scheme deployed in a containerization manner. Through the system, the effect of a safe communication process between the charging pile and the BMS can be realized.

The invention discloses an AI-driven transport layer security protocol adaptive optimization system, which relates to the technical field of traffic data access and comprises a data access module, a state sensing module, a risk assessment module, an optimization transmission module and an adaptive encryption module. The data access module is used for capturing an original data flow from a network and a host in real time; the state sensing module is used for receiving the original data stream and setting a feature engineering state index; the risk assessment module is used for quantitatively assessing the safety score of the current state according to the current traffic environment state; the self-adaptive encryption module is used for constructing a password strategy library and generating an encryption configuration strategy according to a current traffic state; and the optimization transmission module is used for constructing a parameter intelligent optimization model and controlling algorithm interaction to generate performance scheduling optimization actions.

A method for authenticating an application program interface (API) invoker enhances secure communication between API invokers and a Common Application Program Interface Framework (CAPIF). The method involves sending authentication information from the API invoker to the CAPIF function, which authenticates the invoker's identity. The process includes obtaining enrollment information to establish a secure transport layer security (TLS) connection with the CAPIF function. Advanced authentication mechanisms leverage an authentication and key management for applications (AKMA) anchor key, enabling secure derivation and verification of application function keys (KAF). Additionally, the CAPIF function uses received authentication data to retrieve API invoker configuration information, onboard signing keys, and certificates. These elements facilitate secure API access and interaction while ensuring compliance with authentication protocols.

A user equipment (UE) is configured to generate a first credential based on a second credential, wherein the second credential is used for primary authentication between the UE and a core network, generate an identifier corresponding to the first credential and perform, after the primary authentication, an authentication procedure with an edge configuration server (ECS) for access to an edge data network based on transport layer security (TLS)-pre-shared key (PSK) protocols using the first credential.

Aspects of the subject disclosure may include, for example, deploying a reverse proxy server in front of a first type of web servers and a second type of web servers, where the first type of web servers is compliant with a current version of payment card industry data security standard (PCI DSS) and supports a first version of a transport layer security (TLS) protocol, and where the second type of web servers supports one or more TLS protocols that are older than the first version of TLS protocol, detecting, using the reverse proxy server, a TLS protocol version used in an incoming request, and determining, using the reverse proxy server, routing of the incoming request to one of the first type of web servers and the second type of web servers at least based on the detected TLS protocol version. Other embodiments are disclosed.

The method provides an automated and scalable system for the generation, distribution, management of symmetric pre-shared keys (PSKs) to applications executing on headless and mobile devices. It helps achieve device protection, application security, and data protection with data authenticity and confidentiality in intra-device, inter-device, device-to-edge, and device-to-cloud communications. It helps Transport Layer Security (TLS) enabled applications dynamically acquire and renew PSKs and use identity hints for PSK based authentication ceremony during a TLS handshake. It helps manage and distribute API shared secrets and API access tokens required for authenticated API requests and API security. It helps applications (producers, brokers, and consumers of content) with PSKs for supply chain tamper resistance. It helps real-time low-latency applications with selective encryption of partial messages.

A method and system for detecting encrypted distributed denial of service (DDOS) attacks are provided. The system includes monitoring encrypted transactions related traffic; deriving from the encrypted transactions rate-based parameters and rate-invariant parameters, wherein the rate-based parameters and rate-invariant parameters are associated with transport layer security (TLS) fingerprints; comparing values of the rate-based parameters and the rate-invariant parameters respectively to at least one rate-based anomaly threshold and at least one rate-invariant anomaly threshold; and declaring a detected encrypted DDOS attack when both the rate-based anomaly threshold and the rate-invariant anomaly threshold are exceeded.

A quantum-resistant security enhancement method for a transport layer security protocol, comprising: (011) acquiring a first quantum key and a quantum key identifier from a serving node; (012) performing post-quantum cryptographic encryption on the quantum key identifier to obtain a first encryption result, and sending the first encryption result to a network device; (013) decrypting a received second encryption result to obtain a second decryption result; (014) obtaining a first terminal handshake key and a first network device handshake key on the basis of the first encryption result and the second decryption result; and (015) generating a second terminal handshake key and a second network device handshake key on the basis of the first quantum key, the first terminal handshake key, the first network device handshake key, the first encryption result and the second decryption result, so as to encrypt communication between the terminal and the network device.

An example operation includes one or more of establishing a secure channel between a host platform and a vehicle based on a transport layer security (TLS) handshake between the host platform and the vehicle, downloading an authorization code to the vehicle through the secure channel between the host platform and the vehicle, receiving the authorization code from a mobile application installed on a mobile device, generating a mobile application certificate for the mobile device and transmitting the mobile application certificate to the mobile application on the mobile device, and establishing a secure connection between the host platform and the mobile application on the mobile device based on the mobile application certificate.

A system for classifying network traffic retrieves first packet data from a network session between a client device and server. The first packet data includes a first set of Internet Protocol (IP) packets and timestamps, and calculates a first latency between: (i) a first timestamp of a first IP packet for initiating an encrypted connection, and (ii) a second timestamp of a second IP packet for acknowledging receipt of an IP packet. The system calculates a second latency between the first timestamp and a third timestamp of a third IP packet for establishing a connection. The system calculates a third latency between a third timestamp and a fourth timestamp of a fourth IP packet for accessing application data. The system also provides as input to machine learning model, the first, second, and third latencies, and generates and transmits an alert based upon an output of the machine learning model.

Methods and devices for supporting authentication of a first Transport Layer Security (TLS) device, wherein a second TLS device receives from the first TLS device a message indicative of the credential type that the first TLS devices will provide to be authenticated, i.e., Verifiable Credential (VC)-based certificate. The second TLS device then receives, from the first TLS device, a first VC and a first Verifiable Presentation (VP) proof which the second TLS device uses for authenticating the first TLS device.

A converged radio device (MS) is configured to perform communication in an internet protocol (IP) based network and authenticate with a switching and management infrastructure (SwMI) of a second network by using pre-existing radio authentication as a root of trust for an unauthenticated IP session established between the MS and a server associated with the SwMI. The MS receives a first challenge from the SwMI via the server, and determines a result of the first challenge using data derived from a certificate associated with the server. The MS transmits, to the SwMI via the server, a second challenge and the result of the first challenge. The MS authenticates the SwMI by verifying a result of the second challenge received from the SwMI via the server matches an expected result of the second challenge. Responsive to a mutual authentication, the MS performs communication in the radio network via the server.

Various methods, systems, and use cases for securely managing, generating, and controlling access to keys in a service mesh are discussed herein. In various examples, key protection operations include service mesh signing key protection and service mesh communication key protection, for a secure transport session between services such as conducted with mutual transport layer security (mTLS). For instance, such key protection operations may be used to establish communications between the service host and another entity within the service mesh, in a secure transport session, based on use of a private key (secured using a confidential computing technology) in a secure enclave or other secure compute environment to sign one or more keys for the secure transport session.

Provided in the embodiments of the present disclosure is an authentication method. The method is executed by a first root certificate authority (CA), and comprises: generating a first type of certificate on the basis of a transport layer security (TLS) protocol, wherein the first type of certificate is a certificate of an entity in a first security domain where the first root CA is located.

The invention discloses a photovoltaic data transmission encryption method based on cloud computing. The method comprises the following steps: acquiring photovoltaic data through a sensor and preprocessing the photovoltaic data; feature extraction is carried out on the preprocessed photovoltaic data, a random forest model is used for judging the sensitivity degree of different photovoltaic data, and the target is to predict the encryption requirements of the different photovoltaic data at the current moment; the method comprises the steps of encrypting power generation data by using an AES advanced encryption standard, encrypting environmental data by using a TLS transport layer security protocol, encrypting equipment state data by using RSA asymmetric encryption, and dynamically adjusting corresponding encryption levels based on encryption requirements of different photovoltaic data at the current moment; decrypting different types of photovoltaic data on the cloud platform, and storing the photovoltaic data in corresponding databases; generating a photovoltaic data correlation topological graph according to correlation strength among different statistical characteristic values in the photovoltaic data; based on the photovoltaic data correlation topological graph, analyzing the power generation data and the environmental data by using a time sequence prediction model, and predicting a future power generation amount change trend; a photovoltaic system operation optimization strategy is automatically generated according to a future power generation amount change trend and equipment state data; the method provides a scientific basis for optimizing the operation strategy of the photovoltaic system.

Embodiments of a device and method are disclosed. In an embodiment, a method of communications involves at a network device, receiving an authentication message from a client, at the network device, extracting a payload from the authentication message, and sending a copy of the payload to a Transport Layer Security (TLS) microserver of the network device for client certificate extraction, where the TLS microserver is implemented in a side signal channel.

Embodiments include methods, electronic device, storage medium, and computer program to implement parallel Data-gram Transport Layer Security (DTLS) connections over a stream control transmission protocol (SCTP) association. In one embodiment, a method at a first network node for encoding user messages for secure transmission to a second network node comprises: initiating a Datagram Transport Layer Security (DTLS) connection over a stream control transmission protocol (SCTP) association through a DTLS handshake using an existing Authenticated Chunks for SCTP (SCTP-AUTH) key from an existing DTLS connection over the SCTP association that transmits user messages: deriving a new SCTP-AUTH key from the initiated DTLS connection: transmitting further user messages through the initiated DTLS connection with the new SCTP-AUTH key: and closing the existing DTLS connection over the SCTP association upon confirmation that SCTP packets encrypted with the existing DTLS connection and SCTP packets authenticated by the existing SCTP-AUTH key have been delivered.

The invention discloses a TLS connection establishment method and device for a transparent encryption database proxy, and belongs to the technical field of database security and communication encryption, and the method is characterized in that a database protocol rule base is built in the proxy, so that the proxy has a protocol perception capability; simulating the server to return a positive response, and then establishing a first TLS connection as a TLS server; meanwhile, the proxy initiates TCP connection to the real database server, actively sends a negotiation request of a corresponding protocol, and serves as a TLS client to establish second TLS connection; and finally, binding the two TLS connection sessions to realize transparent forwarding of the data. The technical problem that an existing transparent encryption agent cannot work in the scene that the database forcibly opens the TLS is solved, coordination of transport layer security and field-level transparent encryption is achieved, and the security of database communication is comprehensively improved.

The invention relates to the technical field of data processing, in particular to a box-type substation intelligent integrated design method based on cloud data, and the method comprises the steps: carrying out the integrated storage of historical system diagram data, component data, cabinet type data and heat dissipation scheme data; through a machine learning algorithm, the relevance between the classified and sorted data is learned, and the machine learning algorithm is applied to the prediction model; training the prediction model, and outputting corresponding component data, cabinet type data and a heat dissipation scheme according to newly input system diagram data; in the data transmission process, encryption processing is carried out, and a transport layer security protocol is adopted for encryption processing. According to the method, the design process is simplified, the design accuracy and speed are improved, the matching and heat dissipation scheme of each component is optimized, the problem of parameter complex relevance is solved through systematic data analysis, meanwhile, the safety of data in the transmission and storage process can be ensured, and the reliability of the system is improved. Therefore, the design efficiency and quality of the box-type substation are comprehensively improved.

An apparatus comprises an Enrollment over Secure Transport (EST) client, the EST client being configured to: store a trust anchor; initiate a Transport Layer Security or Datagram Transport Layer Security (TLS / DTLS) handshake with an EST server; receive a TLS / DTLS EST server certificate from the EST server; perform validation of the TLS / DTLS EST server certificate using the trust anchor; and when validation fails, complete the TLS / DTLS handshake to establish a non-trusted TLS / DTLS session with the EST server.

The present technology pertains to automatically issuing a certificate for transport layer security (TLS) communications. The technology includes receiving, by a gateway and from a service, a request for a signed certificate for use in signing a key pair to be used in encrypting communications between a client and the service. The gateway can determine a certificate authority from which to retrieve the signed certificate, and retrieve the signed certificate from the certificate authority. The gateway can send the signed certificate and the private key to the service to be installed by the service for use in securing communications with the client device using the TLS protocol.

Embodiments of the present disclosure relate to inter-PLMN communications. A device is disclosed. The device includes means for initiating establishment of an N32-c transport layer security connection with an entity, the device being located in a first public land mobile network and the entity being located in a second public land mobile network; sending an N32-c handshake signaling message from the device to the entity over the N32-c transport layer security connection, the N32-c handshake signaling message including domain name information of the device to be used by the entity for establishing an N32-f transport layer security connection toward the device; receiving a reply from the entity, the reply including domain name information of the entity to be used by the device for establishing an N32-f transport layer security connection toward the entity; and establishing the N32-f transport layer security connection toward the entity using the domain name information received in the reply.

The invention discloses a remote verification method and device for confidential calculation, a first platform, first equipment, fourth equipment, a storage medium and a computer program product. The method comprises the steps that a first platform obtains first data and obtains second data, the first data comprises first evidence data related to a first trusted execution environment (TEE) of first equipment and first related data of a first transport layer security (TLS) certificate of the first TEE, and the first equipment is used for providing confidential computing service through the first TEE; the second data comprises certificate chain related data of the first TEE; verifying the first evidence data based on certificate chain related data of the first TEE to obtain a first verification result, and packaging the first verification result, the first evidence data and the first related data by using a first protocol to obtain third data; the third data is sent to the first device and a second device, the second device being a user of the confidential computing service.