190 results about "Transport Layer Security" patented technology

Systems and methods are provided for a scalable load balancer to enable client certificate access control using mutual transport layer security authentication comprising hardware configured to receive trust store files including a certificate authority (CA) bundle and a certificate revocation list (CRL), generate a single trust store file based on the trust store files, distribute a snapshot of the single trust store file to one or more nodes of the scalable load balancer, verify, using the snapshot, a client certificate from a client device by searching for a trusted CA from the CA bundle in the snapshot, determine whether the CRL contained in the snapshot includes the client certificate, and upon verifying the client certificate and determining that the CRL does not contain the client certificate, transmit connection data from the client device to an application target.

Techniques and architecture are described for eliminating double encryption in zero-trust network access authenticated sessions. The techniques include an endpoint client-based proxy of a network receiving, from a browser, a request to access a protected private service. The endpoint client-based proxy pauses access of the browser to the protected private service and establishes a transport layer security (TLS) connection between the endpoint client-based proxy and a zero-trust network access (ZTNA) gateway. The ZTNA gateway determines whether the protected private service uses a secure transport mechanism and establishes either a null cipher encrypted tunnel between at least the endpoint client-based proxy and the ZTNA gateway or a non-null cipher encrypted tunnel between at least the endpoint client-based proxy and the ZTNA gateway. The endpoint client-based proxy resumes access of the browser to the protected private service.

Embodiments include methods. electronic device, storage medium, and computer program to implement parallel Data-gram Transport Layer Security (DTLS) connections over a stream control transmission protocol (SCTP) association. In one embodiment, a method at a first network node for encoding user messages for secure transmission to a second network node comprises: initiating a Datagram Transport Layer Security (DTLS) connection over a stream control transmission protocol (SCTP) association through a DTLS handshake using an existing Authenticated Chunks for SCTP (SCTP-AUTH) key from an existing DTLS connection over the SCTP association that transmits user messages: deriving a new SCTP-AUTH key from the initiated DTLS connection: transmitting further user messages through the initiated DTLS connection with the new SCTP-AUTH key: and closing the existing DTLS connection over the SCTP association upon confirmation that SCTP packets encrypted with the existing DTLS connection and SCTP packets authenticated by the existing SCTP-AUTH key have been delivered.

The embodiment of the invention discloses a data transmission method and device, a storage medium and equipment, which can be applied to various scenes such as cloud technology, artificial intelligence, intelligent traffic and auxiliary driving. Sending a handshake request to the server through a special transport layer security protocol between the small program end and the server; a dynamic key returned by the server according to the handshake request and an encrypted string obtained through encryption processing based on the dynamic key are received through a dedicated transport layer security protocol; obtaining target data to be sent, and encrypting the target data through the dynamic key to generate a corresponding ciphertext; and sending the ciphertext and the encrypted string to a server through a general transport layer security protocol, so that the server performs second decryption processing on the ciphertext according to a dynamic key recovered by performing first decryption processing on the encrypted string to obtain target data. Therefore, the dynamic key is prevented from being transmitted in a plaintext form, the dynamic key is prevented from being cracked, and the security of data transmission is improved.

Systems and methods for implementing a service identity platform with cloud-based Public Key Infrastructure (PKI) include providing security as a service via a cloud-based system for a plurality of tenants, wherein the cloud-based system includes a plurality of components communicatively coupled and adapted to communicate with one another based on mutual Transport Layer Security (mTLS) authentication; responsive to a new component requiring deployment within the cloud-based system, performing an enrollment process for the new component; and subsequent to the enrollment process, utilizing the new component within the cloud-based system for providing security as a service.

Disclosed in the embodiments of the present application are a data transmission method, an apparatus, a storage medium and a device, which can be applied to various scenarios such as cloud technology, artificial intelligence, smart traffic and aided driving. The method comprises: by means of a dedicated transport layer security protocol between an applet and a server, sending a handshake request to the server; by means of the dedicated transport layer security protocol, receiving a dynamic key returned, on the basis of the handshake request, by the server and an encrypted string obtained on the basis of the dynamic key; acquiring data to be transmitted, and using the dynamic key to encrypt the data, so as to obtain a ciphertext; and, by means of a universal transport layer security protocol, sending the ciphertext and the encrypted string to the server, so that the server obtains the dynamic key on the basis of decrypting the encrypted string, and decrypts the ciphertext on the basis of the dynamic key to obtain decrypted data.

This disclosure describes a technique to fingerprint TLS connection information to facilitate bot detection. The notion is referred to herein as “TLS fingerprinting.” Preferably, TLS fingerprinting herein comprises combining different parameters from the initial “Hello” packet send by the client. In one embodiment, the different parameters from the Hello packet that are to create the fingerprint (the “TLS signature”) are: record layer version, client version, ordered TLS extensions, ordered cipher list, ordered elliptic curve list, and ordered signature algorithms list. Preferably, the edge server persists the TLS signature for the duration of a session.

Methods, systems, and apparatuses are described herein for protecting sensitive data even when Transport Layer Security (TLS) communication sessions are compromised. A computing device may send, via a web browser plugin of a web browser application executing on the computing device and to one or more remote servers, a request for a server secret that comprises a device fingerprint, an identification of the web browser application, and an identification of the web browser plugin. The computing device may receive the server secret and a public certificate associated with the remote server. The computing device may establish, via the web browser application, a TLS session with the one or more remote servers. The computing device may generate a session key. The computing device may receive data comprising unencrypted data and encrypted data. The computing device may decrypt the encrypted data based on the session key.

Methods, systems, and devices for data processing are described. A server host may receive a request to access a web domain associated with a tenant of a multi-tenant cloud platform. The server host may retrieve a digital certificate and an encrypted private key associated with the tenant, where the digital certificate includes a public key associated with the tenant. The server host may obtain a symmetric key that is wrapped using an asymmetric public key associated with the server host. The wrapped symmetric key may be provisioned by a symmetric key distribution service. The server host may transmit a request that includes the encrypted private key and the wrapped symmetric key. The server host may receive a response that includes a cryptographic signature associated with the private key of the tenant. The server host may provide the digital certificate and the cryptographic signature to a client device associated with the request.

Various embodiments of the present technology generally relate to systems and methods for preventing malicious service access over long-lived connections. In certain embodiments, a network traffic analysis system may comprise one or more processors, and a memory having stored thereon instructions. The instructions, upon execution, may cause the one or more processors to receive, from a first network function (NF) on a 5G network, a copy of a message sent over a long-lived connection between the first NF and a second NF on the 5G network, the copy of the message including details for a transport layer security (TLS) certificate involved in the long-lived connection. The network traffic analysis system may compare the details against a list of revoked certificates to determine whether the TLS certificate has been revoked, and when the TLS certificate has been revoked, send a notification directing the first NF to close the long-lived connection.

The invention is suitable for the technical field of battery data transmission encryption, and provides a data battery multi-stage hybrid encrypted battery data link, which comprises a battery management system, a transmission layer security channel and a cloud data processing layer, according to the battery management system, an SM4 hardware encryption chip is integrated at a battery BMS end, and original data such as voltage / temperature and the like are encrypted in real time; the transport layer secure channel dynamically negotiates a session key through an SM2 algorithm, and establishes a secure channel to transmit a ciphertext data packet; the cloud data processing layer generates a hash value for the received data by using SM3, and verifies the data integrity; preferably, the battery management system comprises a data acquisition module, an SM4 hardware encryption chip and an encrypted data packet packaging module. According to the invention, through the SM2 / SM4 / SM3 three-level combination encryption technology, light-weight national-security compliance is realized on the hardware layer, an anti-quantum attack channel is constructed on the transmission layer, the data is ensured to be complete and credible on the cloud layer, and a full-stack security protection system covering'end-management-cloud 'is formed.

Examples described herein relate to an interface that is to receive data for transmission and based on indication of failure of receipt of one or more packets that carry segments of the data, cause re-transmission of solely one or more of the multiple packets that comprise a segment of the data referenced by the indication of failure of receipt of one or more packets. In some examples, the interface is to encrypt the data using an encryption engine and to segment the data for transmission using one or more packets. In some examples, the interface is to receive the data and an indication of which segment of the data to re-transmit; encrypt the data; segment the encrypted data into one or more packets; and based on the indication of which segment of the data to re-transmit, transmit solely one or more of the multiple packets that comprise a segment of the data referenced by the indication of failure of receipt of one or more packets.

The invention relates to intra-network computing operations using encrypted communications. Examples described herein relate to an interface and a circuit module coupled to the interface. The circuitry module may provide an endpoint for transport layer security (TLS) over a remote direct memory access (RDMA) connection with a first network interface device, provide an endpoint for TLS over an RDMA connection with a second network interface device, provide a transport layer endpoint for packets received from the first network interface device, and provide a transport layer endpoint for packets received from the second network interface device. And providing a transport layer endpoint for a packet received from the second network interface device.

The invention relates to the field of electric vehicle charging control, and particularly provides a system, method, device and equipment for safe communication between a charging pile and a BMS and a storage medium, the system comprises a bidirectional authentication module, a communication encryption module, a verification module and an optimization module; the bidirectional authentication module is used for constructing a bidirectional authentication protocol between the charging pile and a battery management system (BMS) based on the hardware security module and authenticating the identity; the communication encryption module is used for customizing an integrated transport layer security protocol line through an open source tool and encrypting security communication data; the verification module is used for designing a three-level verification mechanism, blocking a malicious firmware injection path and verifying a secure communication process; and the optimization module is used for optimizing the key process by adopting a redundant backup scheme deployed in a containerization manner. Through the system, the effect of a safe communication process between the charging pile and the BMS can be realized.

Examples described herein relate to a Transport Layer Security (TLS) offload engine to: based on detection of encrypted data unassociated with a previously detected data header: search for one or more data headers; identify at least two candidate data headers for validation; and based on receipt of an indication that the at least two candidate data headers are valid, perform decryption of received data in one or more packets. In some examples, the TLS offload engine is to: based on receipt of an indication that one or more of the at least two candidate data headers is not a valid header, search for two or more other candidate data headers.

The invention discloses an AI-driven transport layer security protocol adaptive optimization system, which relates to the technical field of traffic data access and comprises a data access module, a state sensing module, a risk assessment module, an optimization transmission module and an adaptive encryption module. The data access module is used for capturing an original data flow from a network and a host in real time; the state sensing module is used for receiving the original data stream and setting a feature engineering state index; the risk assessment module is used for quantitatively assessing the safety score of the current state according to the current traffic environment state; the self-adaptive encryption module is used for constructing a password strategy library and generating an encryption configuration strategy according to a current traffic state; and the optimization transmission module is used for constructing a parameter intelligent optimization model and controlling algorithm interaction to generate performance scheduling optimization actions.

A method for authenticating an application program interface (API) invoker enhances secure communication between API invokers and a Common Application Program Interface Framework (CAPIF). The method involves sending authentication information from the API invoker to the CAPIF function, which authenticates the invoker's identity. The process includes obtaining enrollment information to establish a secure transport layer security (TLS) connection with the CAPIF function. Advanced authentication mechanisms leverage an authentication and key management for applications (AKMA) anchor key, enabling secure derivation and verification of application function keys (KAF). Additionally, the CAPIF function uses received authentication data to retrieve API invoker configuration information, onboard signing keys, and certificates. These elements facilitate secure API access and interaction while ensuring compliance with authentication protocols.

A user equipment (UE) is configured to generate a first credential based on a second credential, wherein the second credential is used for primary authentication between the UE and a core network, generate an identifier corresponding to the first credential and perform, after the primary authentication, an authentication procedure with an edge configuration server (ECS) for access to an edge data network based on transport layer security (TLS)-pre-shared key (PSK) protocols using the first credential.

Aspects of the subject disclosure may include, for example, deploying a reverse proxy server in front of a first type of web servers and a second type of web servers, where the first type of web servers is compliant with a current version of payment card industry data security standard (PCI DSS) and supports a first version of a transport layer security (TLS) protocol, and where the second type of web servers supports one or more TLS protocols that are older than the first version of TLS protocol, detecting, using the reverse proxy server, a TLS protocol version used in an incoming request, and determining, using the reverse proxy server, routing of the incoming request to one of the first type of web servers and the second type of web servers at least based on the detected TLS protocol version. Other embodiments are disclosed.

The method provides an automated and scalable system for the generation, distribution, management of symmetric pre-shared keys (PSKs) to applications executing on headless and mobile devices. It helps achieve device protection, application security, and data protection with data authenticity and confidentiality in intra-device, inter-device, device-to-edge, and device-to-cloud communications. It helps Transport Layer Security (TLS) enabled applications dynamically acquire and renew PSKs and use identity hints for PSK based authentication ceremony during a TLS handshake. It helps manage and distribute API shared secrets and API access tokens required for authenticated API requests and API security. It helps applications (producers, brokers, and consumers of content) with PSKs for supply chain tamper resistance. It helps real-time low-latency applications with selective encryption of partial messages.

A method and system for detecting encrypted distributed denial of service (DDOS) attacks are provided. The system includes monitoring encrypted transactions related traffic; deriving from the encrypted transactions rate-based parameters and rate-invariant parameters, wherein the rate-based parameters and rate-invariant parameters are associated with transport layer security (TLS) fingerprints; comparing values of the rate-based parameters and the rate-invariant parameters respectively to at least one rate-based anomaly threshold and at least one rate-invariant anomaly threshold; and declaring a detected encrypted DDOS attack when both the rate-based anomaly threshold and the rate-invariant anomaly threshold are exceeded.

A quantum-resistant security enhancement method for a transport layer security protocol, comprising: (011) acquiring a first quantum key and a quantum key identifier from a serving node; (012) performing post-quantum cryptographic encryption on the quantum key identifier to obtain a first encryption result, and sending the first encryption result to a network device; (013) decrypting a received second encryption result to obtain a second decryption result; (014) obtaining a first terminal handshake key and a first network device handshake key on the basis of the first encryption result and the second decryption result; and (015) generating a second terminal handshake key and a second network device handshake key on the basis of the first quantum key, the first terminal handshake key, the first network device handshake key, the first encryption result and the second decryption result, so as to encrypt communication between the terminal and the network device.

Methods, systems, and apparatuses are described herein for protecting sensitive data even when Transport Layer Security (TLS) communication sessions are compromised. A computing device may send, via a web browser plugin of a web browser application executing on the computing device and to one or more remote servers, a request for a server secret that comprises a device fingerprint, an identification of the web browser application, and an identification of the web browser plugin. The computing device may receive the server secret and a public certificate associated with the remote server. The computing device may establish, via the web browser application, a TLS session with the one or more remote servers. The computing device may generate a session key. The computing device may receive data comprising unencrypted data and encrypted data. The computing device may decrypt the encrypted data based on the session key.

An example operation includes one or more of establishing a secure channel between a host platform and a vehicle based on a transport layer security (TLS) handshake between the host platform and the vehicle, downloading an authorization code to the vehicle through the secure channel between the host platform and the vehicle, receiving the authorization code from a mobile application installed on a mobile device, generating a mobile application certificate for the mobile device and transmitting the mobile application certificate to the mobile application on the mobile device, and establishing a secure connection between the host platform and the mobile application on the mobile device based on the mobile application certificate.

The embodiment of the invention relates to a key generation method and device, a computer program product and electronic equipment, and relates to the technical field of network and security, and the method comprises the steps: adding a quantum security key exchange password group in an encrypted communication request sent by a client based on a quantum security transport layer security protocol, algorithm information in the quantum security key exchange password group is configured; adding an anti-quantum signature algorithm in the encrypted communication request, and selecting a key negotiation algorithm in the encrypted communication request to determine a first key exchange field corresponding to the client; selecting a key negotiation algorithm in a response message sent by the server in response to the encrypted communication request to determine a second key exchange field corresponding to the server; and performing key negotiation according to the first key exchange field and the second key exchange field to generate a session key. The security of the protocol can be improved.

A system for classifying network traffic retrieves first packet data from a network session between a client device and server. The first packet data includes a first set of Internet Protocol (IP) packets and timestamps, and calculates a first latency between: (i) a first timestamp of a first IP packet for initiating an encrypted connection, and (ii) a second timestamp of a second IP packet for acknowledging receipt of an IP packet. The system calculates a second latency between the first timestamp and a third timestamp of a third IP packet for establishing a connection. The system calculates a third latency between a third timestamp and a fourth timestamp of a fourth IP packet for accessing application data. The system also provides as input to machine learning model, the first, second, and third latencies, and generates and transmits an alert based upon an output of the machine learning model.

A method of data processing is described. The method includes receiving, at a server host, a request to access a web domain associated with a tenant of a multi-tenant cloud platform; retrieving, from a database, a tenant private key and a certificate associated with the tenant, where the tenant private key is encrypted with a secret key derived from a key agreement public key associated with the tenant and a private key provisioned to a key protection component of the server host; providing, to the key protection component, the encrypted tenant private key and the key agreement public key; receiving, from the key protection component, an API response including a signature associated with the tenant private key; and providing, to a client device associated with the request to access the web domain of the tenant, the certificate and the signature, where the certificate is used to verify the signature.

In various embodiments, the kernel uses the NIC to communicate encrypted data over the TCP connection. The kernel causes the NIC to encrypt the first data according to a hardware-based transport layer security (TLS) offload mode to generate a first transport control protocol (TCP) packet. The kernel computes first legacy information in response to the first TCP packet failing to reach the first device over the first TCP connection; the kernel assigns the first TCP connection to a software-based TLS offload mode, rather than a hardware-based TLS offload mode, based on the first legacy information. The kernel then encrypts the second data according to the software-based TLS offload mode to generate a second TCP packet, and then the kernel causes the NIC to transmit the second TCP packet to the first device over the first TCP connection.

A method and system for authenticating application program interface (API) invokers using a common application program interface framework (CAPIF) is provided. The method includes establishing by a CAPIF core function (CCF) a secure Transport Layers Security (TLS) connection with at least one API invoker, on receiving a connection request from the at least one API invoker to access at least one service API on a CAPIF-2e interface. Further, the method includes determining by the CCF at least one security method to be used by the at least one API invoker for a CAPIF-2e interface security (C2eIS) of the at least one API invoker for accessing the at least one service API on a CAPIF-2e interface. The method further includes enabling the C2eIS by an API exposing function (AEF) the at least one API invoker based on the determined at least one security method.

Methods and devices for supporting authentication of a first Transport Layer Security (TLS) device, wherein a second TLS device receives from the first TLS device a message indicative of the credential type that the first TLS devices will provide to be authenticated, i.e., Verifiable Credential (VC)-based certificate. The second TLS device then receives, from the first TLS device, a first VC and a first Verifiable Presentation (VP) proof which the second TLS device uses for authenticating the first TLS device.