АУТЕНТИФИКАЦИЯ ПРОЦЕССОВ И РАЗРЕШЕНИЯ НА РЕСУРСЫ

Изобретение относится к технологиям сетевой связи. Технический результат заключается в повышении безопасности передачи данных. Система содержит: один или более процессоров; запоминающее устройство, подключенное к одному или более процессорам с возможностью осуществления связи; и компонент аутентификации процессов, сохраненный в запоминающем устройстве и содержащий инструкции, которые при их исполнении одним или более процессорами предписывают одному или более процессорам: принимать исполняемый файл, который включает в себя цифровую подпись; выбирать открытый ключ расшифрования, соответствующий закрытому ключу шифрования, использованному для генерирования цифровой подписи; аутентифицировать исполняемый файл посредством проверки цифровой подписи с помощью открытого ключа расшифрования; создавать процесс для исполнения аутентифицированного исполняемого файла и назначать этому процессу совместно измерение и уровень на основе открытого ключа расшифрования, причем уровень представляет собой один ...

ФОРМИРОВАНИЕ КЛЮЧА В ЗАВИСИМОСТИ ОТ ПАРАМЕТРА

Изобретение относится к области вычислительной техники для аутентификации пользователя. Технический результат заключается в повышении эффективности аутентификации пользователя. Технический результат достигается за счёт получения первого криптографического ключа; использования первого криптографического ключа и множества идентификаторов ограничения, в котором идентификатор ограничения множества идентификаторов ограничения указывает по меньшей мере одно из: идентификационную информацию зоны ключа из множества зон ключа, где указанный ключ может быть использован, географическое положение, время или идентичность пользователя, для получения второго криптографического ключа. 3 н. и 14 з.п. ф-лы, 24 ил.

МНОГОФАКТОРНАЯ ЗАЩИТА КОНТЕНТА

... 1. Реализуемый в вычислительном окружении способ защиты контента, содержащий этапы, на которых ! на получателе (108), в котором доступ к по меньшей мере некоторому контенту, используемому получателем (108), регулируется сервером (110) доступа, причем сервер (110) доступа выполнен с возможностью управления пользованием управляемым контентом о стороны получателя посредством взаимодействия с доверенным агентом (112), привязанным к получателю (108), принимают контент (104) от издателя (102), причем контент (104) зашифрован по ключу (107) контента, при этом контент (104) связан с информацией (122) политики, причем информация (122) политики содержит ! ключ контента (107) для дешифрования контента (104), и ! причем информация (122) политики зашифрована по ключу (109) сервера доступа, что позволяет серверу доступа (110) дешифровать информацию (122) политики, ! на получателе (108) принимают от сервера доступа (110) ключ контента (107), причем ключ контента (107) зашифрован по ключу (110) доверенного ...

СЕТЬ И СПОСОБ ДЛЯ ИНИЦИАЛИЗАЦИИ КЛЮЧА ДЛЯ ЛИНИИ ЦЕНТРА УПРАВЛЕНИЯ БЕЗОПАСНОСТЬЮ

... 1. Сеть, содержащая: ! новый узел (106), содержащий специфический для узла материал криптографического ключа, причем этот новый узел выполнен с возможностью задания криптографического ключа на основе специфического для узла материала криптографического ключа, ! первый узел (102), требующий криптографический ключ для инициализации защиты сети, и ! средство для обеспечения (108) отсутствующего криптографического ключа в первый узел из запоминающего устройства, отличного от нового узла, причем отсутствующий криптографический ключ равен упомянутому криптографическому ключу, причем ! запоминающее устройство является защищенным сервером (210), содержащим материал криптографического ключа, соответствующий новому узлу (106), причем ! средство обеспечения (108) выполнено с возможностью загрузки отсутствующего криптографического ключа из защищенного сервера (210), причем ! новый узел (106) может вычислять разные криптографические ключи, отличительной чертой каждого из которых служит индекс ключа, ...

ВЗАИМНАЯ МОБИЛЬНАЯ АУТЕНТИФИКАЦИЯ С ИСПОЛЬЗОВАНИЕМ ЦЕНТРА УПРАВЛЕНИЯ КЛЮЧАМИ

... 1. Способ аутентификации, содержащий этапы:отправляют сообщение вызова с мобильного шлюза на потребительское устройство, причем сообщение вызова отправляется в ответ на сообщение запроса связи, при этом потребительское устройство сконфигурировано для использования в качестве платежного устройства;принимают сообщение ответа на вызов от потребительского устройства в мобильном шлюзе в ответ на сообщение вызова; иотправляют сообщение ответа на вызов от мобильного шлюза центру управления ключами, при этом центр управления ключами сконфигурирован с возможностью управления сеансовыми ключами для связи с потребительским устройством, при этом центр управления ключами осуществляет верификацию сообщения ответа на вызов и позволяет осуществить транзакцию связи между первым объектом и потребительским устройством, если сообщение ответа на вызов является достоверным.2. Способ по п.1, в котором центр управления ключами отправляет сеансовый ключ мобильному шлюзу и потребительскому устройству, причем сеансовый ...

АУТЕНТИФИКАЦИЯ ПРОЦЕССОВ И РАЗРЕШЕНИЯ НА РЕСУРСЫ

ФОРМИРОВАНИЕ КЛЮЧА В ЗАВИСИМОСТИ ОТ ПАРАМЕТРА

Изобретение относится к области аутентификации пользователей. Технический результат – повышение эффективности аутентификации. Способ аутентификации для обеспечения доступа к одному или более вычислительным ресурсам провайдера вычислительных ресурсов содержит этапы, на которых принимают сообщение и подпись сообщения от стороны аутентификации, формируют частично на основании принятого сообщения ожидаемую подпись по меньшей мере путем вызова хэш-функции кода аутентификации сообщений множество раз таким образом, что один вызов хэш-функции кода аутентификации сообщений включает в себя ввод в хэш-функцию кода аутентификации сообщений, который основан по меньшей мере частично на секретном сертификате, совместно используемом со стороной аутентификации, причем секретный сертификат принят от главного источника ключей и соответствует зоне ключа, один другой вызов хэш-функции кода аутентификации сообщений включает в себя результат предыдущего вызова хэш-функции кода аутентификации сообщений в качестве ...

СИСТЕМА И СПОСОБ ДЛЯ РАСПРОСТРАНЕНИЯ ОСНОВАННОГО НА ИДЕНТИФИКАЦИОННОЙ ИНФОРМАЦИИ КЛЮЧЕВОГО МАТЕРИАЛА И СЕРТИФИКАТА

СПОСОБ ОБЕСПЕЧЕНИЯ РЕЖИМОВ ОБСЛУЖИВАНИЯ С ОГРАНИЧЕННОЙ ЗАЩИТОЙ ДАННЫХ В МАГИСТРАЛЬНЫХ ИНФОРМАЦИОННО ЗАЩИЩЕННЫХ СИСТЕМАХ СВЯЗИ

В магистральной информационно-защищенной системе связи режим обслуживания с ограниченной защитой данных в периоды ограниченного обслуживания или процессорного сбоя всем подсистемам, использующим шифрующие ключи, включая устройства сопряжения пульта оператора (УСП) и пункты связи, посылается сообщение о переходе соответственно в режим обслуживания с ограниченной защитой данных или в режим процессорного сбоя. По получении сообщения о переходе в режим обслуживания с ограниченной защитой данных пункты связи вводят по меньшей мере один ключ ограниченного обслуживания. Одновременно устройства сопряжения пульта оператора также вводят по меньшей мере один ключ ограниченного обслуживания. По получении сообщения о переходе в режим процессорного сбоя устройства сопряжения пульта оператора вводят по меньшей мере один ключ процессорного сбоя. Одновременно пункты связи также вводят по меньшей мере один ключ процессорного сбоя. Пункты связи и УСП используют ключи ограниченного обслуживания или процессорного ...

ПОРТАТИВНАЯ БЕЗОПАСНАЯ ВЫЧИСЛИТЕЛЬНАЯ СЕТЬ

... 1. Способ (200) для создания безопасной онлайн среды для вычислительного устройства, соединенного с не заслуживающей доверие сетью, используя заслуживающее доверие вычислительное устройство, соединенное с заслуживающей доверие сетью, содержащий:инсталлирование прокси сервера на первом вычислительном устройстве из набора заслуживающих доверие вычислительных устройств, которые используют одну или более заслуживающих доверие сетей для онлайн доступа (204);генерирование одного или более совместно используемых ключей шифрования для первого вычислительного устройства и портативного устройства хранения (206);инициирование контакта с первым вычислительным устройством от второго вычислительного устройства, которое обращается к не заслуживающей доверие сети (208), содержащее инициирование протокола прокси сервера от портативного устройства хранения, используя второе вычислительное устройство, по не заслуживающей доверие сети (210); исоздание безопасного соединения между вторым вычислительным устройством ...

СИСТЕМА, УСТРОЙСТВО И СПОСОБ ОБЕСПЕЧЕНИЯ ИНФОРМАЦИИ О ПАССАЖИРАХ ИЛИ ПОЛЬЗОВАТЕЛЯХ

СПОСОБ МОБИЛЬНОЙ СВЯЗИ И МОБИЛЬНАЯ СТАНЦИЯ

... 1. Способ мобильной связи, в котором мобильная станция осуществляет хэндовер из исходной базовой станции радиосвязи хэндовера в целевую базовую станцию радиосвязи хэндовера посредством интерфейса через центр коммутации, включающий:шаг (А), на котором в целевой базовой станции радиосвязи хэндовера из центра коммутации получают первый ключ, предназначенный для формирования определенного ключа, используемого при осуществлении связи между целевой базовой станцией радиосвязи хэндовера и мобильной станцией; ишаг (В), на котором в мобильной станции при приеме сигнала команды на осуществление хэндовера из исходной базовой станции радиосвязи хэндовера формируют первый ключ, предназначенный для формирования определенного ключа, используемого при осуществлении связи между целевой базовой станцией радиосвязи хэндовера и мобильной станцией, на основании параметра, получаемого путем увеличения параметра, включенного в сигнал команды на осуществление хэндовера и используемого при создании первого ключа ...

ФОРМИРОВАНИЕ КЛЮЧА В ЗАВИСИМОСТИ ОТ ПАРАМЕТРА

... 1. Компьютерно-реализуемый способ предоставления услуг, содержащий:под управлением одной или более компьютерных систем, функционирующих на основе выполняемых команд,прием от стороны аутентификации электронной кодированной информации, содержащей сообщение, подпись сообщения и набор из одного или более ограничений относительно ключей, полученных на основе совместно используемого со стороной аутентификации секретного сертификата, причем подпись может быть определена путем применения хэш-функции кода аутентификации сообщений к сообщению, секретному сертификату и набору из одного или более ограничений, а также может быть неопределяемой при наличии только хэш-функции кода аутентификации сообщений без набора из одного или более ограничений;получение ключа, сгенерированного, по меньшей мере, частично, при помощи, по меньшей мере, поднабора из набора из одного или более ограничений;вычисление при помощи одной или более компьютерных систем значения хэш-функции кода аутентификации сообщений посредством ...

СИСТЕМА НА ОСНОВЕ РАСШИРЯЕМОГО МУЛЬТИМЕДИЙНОГО ФОРМАТА И СПОСОБЫ ЕЕ ПРИМЕНЕНИЯ

СПОСОБ ЗАГРУЗКИ МУЛЬТИМЕДИЙНОЙ ИНФОРМАЦИИ В ПОРТАТИВНЫЙ НОСИТЕЛЬ ДАННЫХ И ПОРТАТИВНЫЙ НОСИТЕЛЬ ДАННЫХ

... 1. Способ загрузки мультимедийной информации (М) в память (14) портативного носителя данных (10), подключенного к внешнему устройству оператора (24), отличающийся тем, что включает следующие этапы: получают на носитель данных (10) задание по загрузке от устройства оператора (24), устанавливают канал передачи закодированных данных (50) между носителем данных (10) и заслуживающим доверие нелокальным сервером (30), на котором хранится мультимедийная информация (М), осуществляют передачу закодированной мультимедийной информации (М) через канал передачи данных (50) и запись мультимедийной информации (М) в память (14) носителя данных (10). 2. Способ по п.1, отличающийся тем, что обмен информацией между носителем данных (10) и сервером (30) осуществляют посредством, по меньшей мере, одного Интернет-протокола из группы TCP/IP, UDP/IP, IPSec, TLS, SSL и HTTP. 3. Способ по п.1 или 2, отличающийся тем, что между носителем данных (10) и сервером (30) обеспечивают согласование кодирующего ключа (К), ...

Verfahren zur Erzeugung und Registrierung von Grundschlüsseln

Geheimübertragungsschlüsselverteilungssystem

Verfahren und Vorrichtung zur Generierung einer Berechtigungsinformation für ein Berechtigungssystem

Die Erfindung betrifft ein Verfahren und eine Vorrichtung zur Generierung einer Berechtigungsinformation für ein Berechtigungssystem. Zur Generierung der Berechtigungsinformation wird ein sich nicht reproduzierbar verändernder Parameter verwendet. Dadurch wird ein späteres Rekonstruieren der Berechtigungsinformation verhindert, da zu einem späteren Zeitpunkt keine Rückschlüsse auf den im Rahmen der Generierung der Berechtigungsinformation verwendeten Parameterwert gezogen werden können.

Verriegelungs- und Entriegelungssystem und Schlüsseleinheit

Ein Verriegelungs- und Entriegelungssystem (1) beinhaltet ein mobiles Endgerät (20) und eine in einem Fahrzeug oder einer Einrichtung vorgesehene Schlüsseleinheit (12). Das mobile Endgerät (20) beinhaltet eine Übertragungseinheit, die erste Authentisierungsinformationen und ein erstes Anforderungssignal an die Schlüsseleinheit (12) überträgt. Die Schlüsseleinheit (12) beinhaltet eine Empfangseinheit, die die ersten Authentisierungsinformationen und das erste Anforderungssignal von dem mobilen Endgerät (20) empfängt, eine erste Authentisierungseinheit (1245), die eine Authentisierung des mobilen Endgeräts (20) basierend auf den ersten Authentisierungsinformationen in einem Fall durchführt, in dem die Authentisierungsinformationen empfangen wurden, eine erste Authentisierungseinheit (1245), die die Authentisierung des mobilen Endgeräts (20) in einem Fall, in dem die erste Authentisierungseinheit (1245) die Authentisierung des mobilen Endgeräts (20) einmal basierend auf den ersten Authentisierungsinformationen ...

Kodierungschlüsselaustauschprotokoll

TRANSAKTIONSZERTIFIZIERUNG

VERWALTUNG VON VERSCHLÜSSELTEN MEDIEN-SCHLÜSSELN

System und Vorrichtung zum Personalisieren von Chipkarten

Datenauthentifizierungsverfahren und Agent basiertes System

Device key security

Cryptoinformation repeater,subscriber terminal connected thereto,and cryptocommunication method

Distribution of enciphering keys

A method of distributing through a communications network enciphering keys for a secure communications session via said network between first and second terminals (2a,2b) corresponding first and second terminal keys (Ka,Kb) comprising: storing said first and second terminal keys (Ka,Kb) remotely to said terminals (2a,2b); providing a number (RAND); generating first and second corresponding partial keys (Kpa,Kpb) each comprising a corresponding function of said number (RAND) and a corresponding one of said terminal keys (Ka,Kb) ; and dispatching the first partial key (Ka) towards the second terminal (2b), and vice-versa.

Identity confidentiality using public key encryption in radio communication

The radio communication system has at least one first radio station such as a base station (30) and a plurality of second radio stations such as mobile stations (31 - 33). The base station (30) at least possesses a public key, and each of the mobile stations (31 - 33) possesses a public-key cryptography function for ciphering the public key and an identity for identifying itself. An identity confidentiality method includes steps of generating a time-varying public key at the base station, and repeatedly broadcasting, from the base station, the generated time-varying public key to all the mobile stations so that the mobile stations can cipher the respective identities with the broadcasted time-varying public key.

Method and system for contained cryptographic separation

To provide for cryptographic separation, embodiments of the invention employ containment mechanisms provided by trusted operating systems to ensure that plaintext data which must be encrypted in accordance with a security policy (or, in reverse, ciphertext data which is to be decrypted) is processed by a suitable encryption routine before being sent onwards for transmission, storage, or the like. Such containment mechanisms usually include mandatory system access control rules which specify to which system resources the output of a system resource (such as an application) may be supplied. By specifying a suitable set of such rules, then mandatory encryption can be enforced at the operating system kernel level.

Identifier based encryption

First data to be sent by a first party (20) to a second party (30) is encrypted using an encryption key that is formed using at least a hash value generated by hashing at least one condition that serves as an identifier of an intended recipient (30) of the first data i.e. using identifier-based encryption (IBE) In one embodiment, the first data is encrypted by an encryption process that uses both said encryption key and public data provided by a trusted party (40) and derived thereby using private data. In another embodiment, the encryption key is generated by a keyed hash of the at least one condition, the key used in the keyed hash being a secret shared with a trusted party (40), and the encryption key being used in a symmetric-key encryption process to encrypt the first data. Preferably, the conditions themselves are not sent with the encrypted first data in which case the data recipient (30), when requesting a decryption key from the trusted party (40), sends the conditions along with ...

Data transfer system

A data transfer system comprising a host device and a data transfer device. The host device generates an encryption key or a decryption key based upon information unique to a removable data storage item onto which data are to be stored or from which data are to be retrieved. The encryption key or decryption key is the delivered by the host device to the data transfer device. Data to be stored to the removable data storage item or alternatively data retrieved from the removable data storage item are received by the data transfer device, which encrypts or decrypts the data using the encryption key or decryption key received from the host device. The main embodiment relates to the removable data storage item being a tape cartridge and the data transfer device being a tape drive. The unique information may be a tape cartridge serial number and the tape drive may maintain a database of unique information for each of a plurality of tape cartridges in a storage system. The host device may further ...

A cryptographic key sharing method

A system for sharing secure keying information with a new device not of a secure wireless network. The keying information may be used for encryption and provided to the new device in a manner which is not susceptible to exposure outside of the secure network. The keying information shared with the new device may be regarded as a birth key. Upon appropriate provision of the birth key, the new device may request with a birth key encrypted message via a communication mode exposed to potential adversaries to be added to the secure network.

Methods and apparatus for secure communication

A method of sending data in a secure communication system comprises receiving and storing a first private key share, obtaining a public key of an intended recipient of the data from an identity of the recipient according to an identity based public key cryptography protocol (IDPKC), encrypting the data using the obtained public key, communicating with a security mediator (SEM) to cooperatively sign the encrypted data using the first private key share and a second private key share held by the security mediator, and transmitting the signed encrypted data. A corresponding method of decrypting the signed encrypted data is also disclosed (fig. 5). In embodiments the Sakai-Kasahara Key Encryption in Multimedia Internet Keying (MIKEY-SAKKE) protocol is used. The invention enables immediate key revocation and key renewal. The encrypted data may be a shared secret value (SSV) for establishing a symmetric key. A key management entity obtains the private key and generates the first and second private ...

Securely transferring user information between applications

Detecting triggering events for distributed denial of service attacks

Software encryption

Encryption for message queues

A targeted, topic-based encryption in a publish-subscribe message queue. Topic-based encryption driven by encryption policies for both storing and receiving messages uses activity tracking and logging to ensure confidentiality of certain topics associated with stored encrypted messages. Authentication of both publisher and consumer ensure encryption and decryption keys are used in confidence.

Secure packet radio network.

A packet radio network comprises at least one work operatorstation and a number of user stations. The user stations transmit message data to one another, either directly or via intermediate stations. When stations are first activated, they transmit key request messages to the network operator station. Other, authenticated stations in the network will not communicate with the new station, but will pass the key request message to the network operator station. The network operator station transmits the necessary keys back to the new station via the other stations to permit the new station to operate. Each user station transmits key probe signals from time to time which advise other stations of its public key.

Secure packet radio network

Secure packet radio network

PROCEDURE FOR THE CODING OF DATA

PROCEDURE FOR STORING AND DISTRIBUTING CODING KEYS

SYSTEM AND PROCEDURE FOR THE EFFICIENT ONE AUTHENTIFIKATION OF KNOTS OF A MEDICAL WIRELESS AD-HOC-NETWORK

PROCEDURE, DEVICE AND SYSTEM FOR THE SUPPLY OF CODING KEYS IN A SATELLITE COMMUNICATIONS NETWORK WORK

PROCEDURE FOR BRINGING A SERVICE KEY INTO A TERMINAL AND DEVICES FOR THE EXECUTION OF THE PROCEDURE

SAFE DATENÜBERTRAGUNGSSYSTEM

SECURED KEY EXCHANGE WITH MUTUAL ONES AUTHENTIFIZIERUNG

DEVICE AND PROCEDURE FOR THE DISTRIBUTION OF DOCUMENTS

System and method for non-replayable communication sessions

Systems, methods, and non-transitory computer-readable storage media for a non-replayable communication system are disclosed. A first device associated with a first user may have a public identity key and a corresponding private identity. The first device may register the first user with an authenticator by posting the public identity key to the authenticator. The first device may perform a key exchange with a second device associated with a second user, whereby the public identity key and a public session key are transmitted to the second device. During a communication session, the second device may transmit to the first device messages encrypted with the public identity key and/or the public session key. The first device can decrypt the messages with the private identity key and the private session key. The session keys may expire during or upon completion of the communication session.

Cloud-based data protection service

A cloud-based data protection service is disclosed. In an embodiment, the data protection service may support backup of data sets from one or more sites associated with one or more organizations. In an embodiment, deduplication of backup data across multiple sites of an organization and/or multiple sites associated with different organizations may be supported. In an embodiment, backup data may be post-processed in the cloud to insert fingerprints corresponding to data blocks that did not change since a previous backup was performed, to scan the backup for security threats such as viruses, other malware, personally identifiable information, etc. In an embodiment, restore may be supported from the cloud, where restore blocks may be larger than backup data blocks. In another embodiment, restore may be based on blocks that have changed since the most recent backup (or a user-selected backup).

System and method for providing security in data communication systems

System for protected storage and management in a ttp server

Secure packet radio network

Methods and systems for supplying encryption keys

A method and apparatus for new key derivation upon handoff in wireless networks

A method and system for preserving privacy during data aggregation in a wireless sensor network

A computer-based system and method for secured privacy preservation scheme while data aggregation in a non-hierarchical wireless sensor network that lacks peer- to-peer communication between the communicating sensor nodes is disclosed. The method and system adopts formation of. self-adaptive efficient cluster formation for robust privacy preservation in the network by grouping the multiple sensor nodes in the network to form multiple clusters that enables low computation overhead and high scalability in the network. The method and system of the invention discloses an effective twin-key management scheme that provides establishment of secure communication among the sensor nodes and the secure communication between at least one sensor node with the sever node performing the function data aggregation of the data collected by the sensor nodes.

Key management in a communication network

A method and apparatus for key management in a communication network. A Key Management Server (KMS) receives from a first device a request for a token associated with a user identity, the user identity being associated with a second device. The KMS then sends the requested token and a user key associated with the user to the first device. The KMS subsequently receives the token from the second device. A second device key is generated using the user key and a modifying parameter associated with the second device. The modifying parameter is available to the first device for generating the second device key. The second device key is then sent from the KMS to the second device. The second device key can be used by the second device to authenticate itself to the first device, or for the first device to secure communications to the second device.

Method and system for providing a secure secrets proxy

A secure secrets proxy is instantiated in a first computing environment and includes secure secrets proxy authentication data for identifying itself to a secrets distribution management system in a second computing environment as a trusted virtual asset to receive and cache secrets data in a secure secrets cache outside the second computing environment. The secure secrets proxy requests one or more secrets to be cached and is then provided data representing the requested secrets in the secure secrets cache. The secure secrets proxy then receives secrets application request data from a second virtual asset instantiated in the first computing environment requesting one or more secrets be applied to second virtual asset data. The secure secrets proxy then obtains the required secrets from the secure secrets cache and coordinates the application of the secrets to the second virtual asset data.

Random Cipher Pad cryptography

Methods for a server include defining a starting element and an element step size. A pad mapping is applied to a data Random Cipher Pad (RCP) to obtain a Key RCP using each element of the Data RCP once in a predetermined non-sequential order. The starting element and the element step size are combined with the Data RCP. The Data RCP is encrypted using the Key RCP to produce a subsequent Data RCP. The subsequent Data RCP is transmitted to another computer. Methods for clients include applying a pad mapping to a Data RCP to obtain a Key RCP using each element of the Data RCP once in a predetermined non-sequential order to develop the Key RCP. The Key RCP is encrypted using the Data RCP to produce a subsequent Key RCP. A data structure is encrypted using the Data RCP to produce an encrypted data structure.

Parameter based key derivation

PARAMETER BASED KEY DERIVATION Systems and methods for authentication generate keys from secret credentials shared between authenticating parties and authenticators. Generation of the keys may involve utilizing specialized information that, as a result of being used to generate the keys, renders the generated keys usable for a smaller scope of uses than the secret credential. Further, key generation may involve multiple invocations of a function where each of at least a subset of the invocations of the function results in a key that has a smaller scope of permissible use than a key produced from a previous invocation of the function. Generated keys may be used as signing keys to sign messages. One or more actions may be taken depending on whether a message and/or the manner in which the message was submitted complies with restrictions of the key's use.

System and apparatus for smart card personalization

Key management between a cable telephony adapter and associated signaling controller

Mechanism for efficient private bulk messaging

METHOD OF ENABLING SECURE TRANSFER OF A PACKAGE OF INFORMATION

The present invention relates to a method of enabling secure transfer of a package of information in a digital communications network from a sender to a receiver. According to the method a package of information is encrypted and provided to the receiver. A third party is provided with an encryption key having such a format that it is unable to decrypt said package of information. The encryption key is, upon positive identification of the receiver, providable from said third party to the receiver, and enables, with the involvement of a supplementary encryption key of the receiver, decryption of the package of information.

SYSTEM FOR SECURE ELECTRONIC INFORMATION TRANSMISSION

A method for secure electronic information exchange between a sender and a recipient. The method includes generating a message at a first entity, generating a message encryption key, encrypting the message using the message encryption key, wrapping the message encryption key using a key agreement algorithm, generating a Java archive file including the encrypted message, the wrapped message encryption key and cryptographic algorithm code including decryption algorithm and key agreement algorithm code, encoding the Java archive file, embedding the encoded Java archive file in an HTML file, and sending the HTML file as an e-mail attachment to said recipient.

LOADING MEDIA DATA INTO A PORTABLE DATA CARRIER

The invention relates to a method for loading media data (M) into a memory of a portable data carrier (10), which is connected to an external operator device (24). According to the invention, the data carrier (10) receives a loading instruction, an encrypted data channel (50) is established between the data carrier (10) and a trustworthy, non-local server (30) on which the media data (M) exists, and the media data (M) are transmitted while encrypted over the data channel (50) and written into the memory of the data carrier (10). A data carrier (10) and a computer program product comprise corresponding features. In addition, an operator device (24) and a computer program product are provided, which are designed for providing a user interface for initiating said method for loading the media data (M). The invention provides a technique for loading media data (M) into a portable data carrier (10) that prevents an unauthorized copying of the media data (M).

ELECTRONIC ACCESS CONTROL SYSTEM AND METHOD

Disclosed is a new and flexible approach for managing physical security in an electronic lock-and-key system. The novel approach does away with cabling or other direct connecting between locks (2) and a system management center. The (physical) keys (3) serve to disseminate access control and other information within the system in a snowball-like way, using an adapted, but simple networking protocol. Whenever appropriate, cryptographic schemes are applied to protect the system.

CRYPTOGRAPHIC SYSTEM FOR DIRECT BROADCAST SATELLITE NETWORK

CRYPTOGRAPHIC SYSTEM FOR DIRECT BROADCAST SATELLITE NETWORK A three key cryptographic system is used in the transmission of digitized signals to a plurality of receivers, each having a unique address number and a factory stored signature key which is a function of the address number. At the transmission end, a common key is generated and used to encrypt the signals to be transmitted. The signature key is generated for each receiver unit by encrypting the address number of the unit using a secret master key. The common key is then encrypted for use by each receiver using the generated signature key for that receiver. A data stream is inserted into the horizontal blanking intervals of the composite video signal. The data stream includes the encrypted signals receivable by all receivers and addressed ii portions, each receivable by a different receiver, containing the encrypted common key for that receiver. The receiver decrypts the common key with the stored signature key and uses it to decrypt ...

METHOD OF DISTRIBUTING AND UTILIZING ENCIPHERING KEYS

PHN 10.652 02.02.1984 "Method of distributing and utilizing enciphering keys". In a communication network with cryptographically protected connections a unique key is used for each connection between two subscribers, so that when one or more keys fall into the hands of an unauthorized person it has no consequences for the protection of the remaining connections. In a network comprising N subscribers -this implies that each participant must have N-1 keys for communication with the other participants. Such a set of N-1 keys is obtained by putting a column from a NxN key matrix (main diagonal empty) at the disposal of each participant. During the connection set-up the correct unique key is automatically selected by interchange of the column number. The key matrices used in the network can be regularly replaced without it being necessary to interrupt the operation of the network.

DATA ARCHIVING SYSTEM

An encrypted file storage solution consists of a cluster of processing nodes, external data storage, and a software agent (the "File System Watcher"), which is installed on the application servers. Cluster sizes of one node up to many hundreds of nodes are possible. There are also remote "Key Servers" which provide various services to one or more clusters. The preceding describes a preferred embodiment, though in some cases it may be desirable to "collapse" some of the functionality into a smaller number of hardware devices, typically trading off cost versus security and fault-tolerance.

SYSTEM AND METHOD FOR STORAGE AND RETRIEVAL OF CRYPTOGRAPHIC KEYS

A system and method for managing cryptographic keys on a recipient system. A key ring file is opened on the recipient system and at least a recipient private key of a cryptographic key pair associated with a particular entity is received. The recipient private key is saved in the key ring file such that the key is identifiably associated with the entity.

METHOD AND SYSTEM FOR MANAGING AUTHENTICATION AND PAYMENT FOR USE OF BROADCAST MATERIAL

A METHOD OF ENCRYPTING AND TRANSFERRING DATA BETWEEN A SENDER AND A RECEIVER USING A NETWORK

BUILT-IN MANUFACTURER'S CERTIFICATES FOR A CABLE TELEPHONY ADAPTER TO PROVIDE DEVICE AND SERVICE CERTIFICATION

System for using a manufacturer issued certificate to authenticate a CTA device during registration with an IP telephony network. In response to providing the manufacturer issued certificate, the issuance of another certificate allows the CTA to be provisioned by a specific IP telephony network. The system includes a method of operating a cable telephony adapter in an IP telephony network. The method includes steps of storing a manufacturer issued certificate in the cable telephony adapter, providing the manufacturer issued certificate to the telephony network, receiving a network issued certificate, and registering for telephony services with the telephony network using the network issued certificate.

SECURITY SYSTEMS AND METHODS FOR ENCODING AND DECODING DIGITAL CONTENT

SYSTEM, METHOD AND ARCHITECTURE FOR SECURE SHARING OF CUSTOMER INTELLIGENCE

A key master service capable of operating on a service provider in a network enables is disclosed. The key master enables authorized parties to securely exchange client information without compromising client security. One feature of the key master service is the generation of a unique key for each client. All parties in an authorized universe access, exchange and modify client information by referencing the universal key, rather than using known client identifiers. Client information is further secured by advantageously applying an obfuscation function to the data. Obfuscated client information is stored together with the universal key as keyed client data at the client and/or server, where it may be directly accessed by the service provider or third parties. Because client information is stored and exchanged without the ability to discern either the client identity or the nature of the information, such information is secured against malicious third-party interception.

KEY ESTABLISHMENT AND DATA SENDING METHOD AND APPARATUS

The present application discloses a data sending method for solving the problem of low data security in an existing data exchange process. The method includes: writing, by a data transaction platform, a data transaction agreement achieved between a first user and a second user into a block chain and storing the agreement; receiving, by a data exchange platform, a first key sent by a first terminal and used for decrypting encrypted first data, the first terminal being a terminal corresponding to the first user; sending, by the first terminal, the encrypted first data to a second terminal, the second terminal being a terminal corresponding to the second user; sending, by the data exchange platform, the first key to the second terminal; and decrypting, by the second terminal, the received encrypted first data based on the first key to obtain the first data. The present application further discloses a data sending apparatus.

POLICY-ENABLED ENCRYPTION KEYS HAVING EPHEMERAL POLICIES

Examples described herein relate to apparatuses and methods for evaluating an encryption key based on policies for a policy operation, including, but not limited to, aggregating existing policies for evaluating at least one key attribute of the encryption key, executing a policy replacement operation replacing at least one existing policy with at least one ephemeral policy, and evaluating the at least one key attribute based, at least in part, on the at least one ephemeral policy.

SUBSCRIPTION CONCEALED IDENTIFIER

A method performed by an authentication server (14) in a home network (3) of a user equipment (1), UE, for obtaining a subscription permanent identifier, SUPI. The method comprises: - receiving a subscription concealed identifier, SUCI, which comprises an encrypted part in which at least a part of the SUPI is encrypted, and a clear-text part which comprises a home network identifier and an encryption scheme identifier that identifies an encryption scheme used by the UE to encrypt the SUPI in the SUCI, - determining a de-concealing server (19) to use to decrypt the encrypted part of the SUCI; - sending the SUCI to the de-concealing server (19), and - receiving the SUPI in response. Methods performed by a UE and a de-concealing server are also disclosed. Furthermore, UEs, de-concealing servers, authentication servers, computer program (133) and a memory circuitry (12) are also disclosed.

SYSTEM AND METHOD FOR SECURE ACCESS

The present invention provides a method and system for secure access to computer equipment. An embodiment includes a secure access controller connected to a link between a transceiver (such as a modem) and the computer equipment. Public and private keys are used by the secure access controller and a remote user. The keys are provided to the secure access controller by an authentication server. Once the transceiver establishes a communication link with the user, the access controller uses these keys to authenticate packets issued by the user to the computer equipment. If the packet is authenticated, the access controller passes the packet to the computer equipment. Otherwise, the packet is discarded. Another embodiment includes a secure access controller having a plurality of ports for connection to a plurality of different pieces of computer equipment. The secure access controller thus intermediates communications between the modem and the plurality of different pieces of computer equipment ...

METHOD FOR TRANSMITTING DIGITAL DATA IN A LOCAL NETWORK

... ²The aim of this invention is on one hand, to allow the reading of a content ²stored by a ²digital video recorder from a decoder of the local network regardless of the ²time ²elapsed between storage and reading, and on the other hand to prevent the ²transfer ²or improper copying of the content stored from one network to another.²This aim is achieved by a method for transmitting digital data in a local ²network ²comprising members constituted by at least one first multimedia unit (DVR) ²having ²content (C) storage means (HD) and at least one second multimedia unit (STB1, ²STB2, STB3) intended to restore the content (C), said first multimedia unit ²being ²connected on one hand to a broadcasting server (SD) of encrypted digital ²audio/video data (D) and on the other hand to the second multimedia unit ²(STB1, ²STB2, STB3), each member possessing a security module (SM0, SM1, SM2, SM3) ²including a network key (Kr), said first multimedia unit (DVR) receives and ²decrypts ²the encrypted data forming ...

CLOUD ENCRYPTION KEY BROKER APPARATUSES, METHODS AND SYSTEMS

Computer-implemented systems and methods are disclosed herein for use in cryptographic operations over a cloud-based service. The cloud-based service securely stores and transmits parts of encryption/decryption keys. Split key processing can include splitting the key in two and storing one of them on a remote secure server.

TIERED KEY COMMUNICATION SYSTEM AND METHOD IN SUPPORT OF CONTROLLED VENDOR MESSAGE PROCESSING

A computer-implemented system processes secure electronic documents from one or more content providers in accordance with subscriber instructions has a processor and modules operative within the processor. A monitoring module obtains a provider GUID, a subscriber GUID, and a transaction ID from public metadata associated with a transaction received from a particular content provider. A determination module determines any designees of the subscriber and contact information one or more of the subscriber and any designees. A transaction module distributes a transaction addressed to at least one of the subscriber and any designees. Each distributed transaction includes data that is used for management, tracking, and alerting. Also described is a station for constructing transactions for distribution to subscribers through such a system, and management of local-advertising to users of such a system. An end-to-end system and method are described.

SYSTEM AND METHOD OF ENFORCING A COMPUTER POLICY

A method and system of enforcing a computer policy uses a central server to manage user profiles, policies and encryption keys. The server securely supplies the keys to client devices only after checking that the policy has been complied with. The checks include both the identity of the user and the machine identity of the client device. The keys are held in a secure environment of the client device, for example in a Trusted Platform Module (TPM), and remain inaccessible at all times to the end user. Theft or loss of a portable client device does not result in any encrypted data being compromised since the keys needed to decrypt that data are not extractable from the secure environment.

METHODS AND APPARATUS FOR USE IN SHARING CREDENTIALS AMONGST A PLURALITY OF MOBILE COMMUNICATION DEVICES

Techniques for use in sharing a plurality of credential objects of a user account amongst a plurality of mobile devices operative in a wireless network are described. In one illustrative example, a network infrastructure (e.g. a cloud) stores a plurality of encrypted credential objects in association with the user account. Each encrypted credential object is encrypted with a credential key. The network infrastructure also stores a plurality of encrypted forms of the credential key in association with the user account. Each encrypted form of the credential key is encrypted with a respective one of a plurality of device keys. Each device key is stored at respective one of the mobile devices. The network infrastructure provides, to the mobile devices, access to the encrypted credential key and the encrypted credential objects.

SYSTEM AND METHOD OF LAWFUL ACCESS TO SECURE COMMUNICATIONS

The present disclosure relates to systems and methods for secure communications. In some aspects, an initiator KMS receives, from an initiator UE, one or more values used in generation of an encryption key, which includes obtaining at least one value associated with a RANDRi. The initiator KMS sends the at least one value associated with the RANDRi to a responder KMS. The responder KMS generates the encryption key using the one or more values.

SECURITY SYSTEMS AND METHODS FOR ENCODING AND DECODING DIGITAL CONTENT

Systems and methods may be provided for masking data on public networks. At a publishing node, the system may monitor data input fields in a webpage, and intercept and encode content, such as text, images, and video input at the data input fields, prior to the content being posted online on a public service provider's website. A policy may be defined to control which users are permitted access to a key to decode the encoded content. The policy may defer to a third party policy node in determining key access. An account for a controlling entity, such as a guardian or employer, may be configured to control the encoding status of posts made by another, and decoding key access. A privacy agent may process input field content to try to detect encoding markers in the input field content, which marks content to be encoded. A third party key server may be used to store decoding keys. A URI reference to the decoding key may be used to access the decoding key by a node attempting to view the decoded ...

MUTUAL MOBILE AUTHENTICATION USING A KEY MANAGEMENT CENTER

A system, method, and server computer configured to authenticate a consumer device. The consumer device is authenticated via a mobile gateway using challenge-response authentication. If the consumer device is successfully authenticated, a secure channel is established between the consumer device and a first entity. The secure channel allows for secure communication between the consumer device and the first entity.

CIPHER-KEY DISTRIBUTION SYSTEM

A cipher-key distribution system has a common file for storing public information and first and second subsystems. The first subsystem has a reader for reading the public information out of the common file, a random number generator for generating random numbers and a first cipher-key generator for generating a cipher-key on the basis of receiving party identifying information given from outside, a random number generated by the random number generator and the public information read out by the reader. The first subsystem also has a secret information store for generating and holding the secret information of the communicating party using this subsystem, a key distributing code generator for generating a key distributing code and a transmitter for transmitting the key distributing code and the information for identifying the communicating party. The second subsystem has a receiver for receiving the key distributing code and the identifying information from the transmitter, a secret information ...

APPARATUS AND METHOD FOR ESTABLISHING A CRYPTOGRAPHIC LINK BETWEEN ELEMENTS OF A SYSTEM

A secure cryptographic network is established among operational units in a system. A public key cryptosystem is initially used to establish secure communication links. Then, each secure communication link will be provided with a unique private encryption key from a private key cryptosystem. Every operational unit in the system will comprise a secure chip integrated circuit. These secure chips will comprise a programmable processor and a read--only memory. A plurality of personalization stations are used to provide each secure chip with a public/private encryption or signature key pair. The secure chips will execute a program from the read-only memory on the secure chips to verify that the public/private key pair has been received from an authorized source. Each secure chip will also be provided with a chain of authentication certificates originating from a trusted authority. The public signature key of the trusted authority will be programmed into the read-only memory of the secure chip ...

Procédé de traitement, sous enclave, de données informatiques chiffrées au moyen d'une application chiffrée contenant du code source, avec audit préalable de celui-ci.

L'invention concerne un procédé de traitement de données ( 12 ) informatiques contenues dans un premier conteneur ( 16 ) chiffré, au moyen d'une application ( 14 ) tierce déterminée par un code source contenu dans un deuxième conteneur ( 18 ) chiffré, ce traitement étant conduit au sein d'une enclave ( 5 ) cryptographique dans laquelle les conteneurs ( 16 , 18 ) sont déchiffrés, le code source audité et, lorsqu'il ne comprend pas de commande décrétée interdite, compilé pour permettre l'exécution de l'application ( 14 ) sur les données ( 12 ).

IMPROVED PROTECTION IN DATA TRANSFER

СПОСОБ И УСТРОЙСТВО ДЛЯ ИЗГОТОВЛЕНИЯ НОВОГО КЛЮЧА ПРИ ПЕРЕДАЧЕ ОБСЛУЖИВАНИЯ B БЕСПРОВОДНЫХ СЕТЯХ

Предоставляется новый подход к управлению ключами для обеспечения безопасности передачи обслуживания связи между терминалом доступа и двумя точками доступа. Когда терминал доступа перемещается от текущей точки доступа к новой точке доступа, терминал доступа отправляет короткий запрос передачи обслуживания новой точке доступа. Короткий запрос передачи обслуживания может включать в себя ID терминала доступа; он не включает в себя ID точки доступа. Новая точка доступа потом может отправить устройству аутентификации ее идентификатор и идентификатор терминала доступа. Используя ранее сформированный главный промежуточный ключ, идентификатор точки доступа и идентификатор терминала доступа, устройство аутентификации может сформировать главный сеансовый ключ. Главный сеансовый ключ потом с помощью устройства аутентификации может быть отправлен точке доступа. Терминал доступа независимо формирует такой же новый защитный ключ, с помощью которого он может надежно взаимодействовать с новой точкой доступа ...

СПОСОБ ШИФРОВАНИЯ И ПЕРЕДАЧИ ДАННЫХ МЕЖДУ ОТПРАВИТЕЛЕМ И ПОЛУЧАТЕЛЕМ С ИСПОЛЬЗОВАНИЕМ СЕТИ

Изобретение касается способа шифрования и передачи данных между отправителем и получателем с использованием сети, обеспечивающего таким образом безопасную передачу данных. Способ включает прием сервером идентификатора получателя (S4A, S4B) от отправителя; создание ключа шифрования, предназначенного для данной конкретной передачи (S7B); шифрование данных с использованием этого ключа шифрования (S8B); доступ сервера к индивидуальной информации получателя согласно принятому идентификатору получателя, и шифрование, с использованием индивидуальной информации получателя, указанного ключа шифрования (S11В); передача зашифрованных данных и зашифрованного ключа шифрования по сети для приема получателем (S11В); получение сервером от получателя зашифрованного ключа шифрования; доступ сервера к индивидуальной информации получателя для расшифровывания зашифрованного ключа шифрования; и расшифровывание зашифрованных данных с использованием расшифрованного ключа шифрования.

Efficient key management system and method

Method, system and equipment for distributing cipher key

The embodiment of the invention provides a cipherkey distribution method, a system and equipment thereof. In the process of calculating Kab of a shared cipherkey between a customer node and third-party equipment, the method introduces a variable parameter to a cipherkey material to calculate the Kab, instead of only adopting a fixed invariable parameter in order that once Kab is leaked, the method can also simply update the Kab in time through replacing the variable parameter, thereby improving the security of information transmission. In addition, in the specific realization, the method for carrying out security protection and security validation on the information is adopted to effectively prevent causing threat on information security by falsifying information, re-discharging attack and the like, thereby further improving the security of information transmission.

APPARATUS AND METHOD FOR GENERATING KEY, AND APPARATUS AND METHOD FOR ENCRYPTION

Method and arrangement in a telecommunication system

The invention relates to a method and arrangement in a telecommunication system. The security key, K_eNB, for protecting RRC/UP traffic between a User Equipment, UE (11) and a serving eNodeB (12) is established by a method and an arrangement in a Mobility Management Entity (13), MME, and in said UE (11), of an Evolved Packet System, EPS. The MME and the UE derives the security key, K_eNB, from at least an NAS uplink sequence number, NAS_U_SEQ, sent from the UE to the MME, and from an Access Security Management Entity-key, K_ASME, shared between the MME and the UE.

Method and apparatus for a content protecting and packaging system for protecting a content package

An apparatus for providing an improved content protecting and packaging system for protecting content may include an extractor for extracting a content package into a plurality of content segments including a first portion and a second portion. An enveloper may envelop each of the content segments in the first portion separately to thereby create one or more protected content segments. Further, a packager may package the protected content segments with the second portion of the content segments into a protected content package, which may then be uploaded to a distributor for distribution to user terminals. A corresponding method and computer program product are also provided.

Secure configuration of a wireless sensor network

A method for secure configuration of a sensor system involves identifying a new sensor not activated within the sensor system, the new sensor including a new sensor identifier, establishing a first transmission link between the new sensor and a sensor controller, transmitting the new sensor identifier between the sensor and the sensor controller, generating a key pair for the sensor controller, the key pair including a controller public key and a controller private key, generating a key pair for the new sensor, the key pair including a sensor public key and a sensor private key, transmitting the controller public key to the new sensor and the sensor public key to the sensor controller, and generating a pairwise key within the sensor controller and the new sensor.

Perimeter encryption method and system

A method and system for consistent format preserving encryption (C-FPE) are provided to protect sensitive data while the sensitive data is in a domain while allowing encrypted sensitive data to be treated inside the domain as if it were the unencrypted sensitive data. The method includes inserting a transparent coupling into a data flow at a perimeter of the domain, and translating a sensitive data element from an unprotected data element to a protected data element using the transparent coupling such that the sensitive data element is a protected data element within the domain.

Key Distribution Scheme for Networks of Information

A method for control ling information object ( 102 ) usage in a network of information ( 100 ) wherein information objects ( 102 ) are identified by information object identities and locations of the information objects ( 102 ) are indicated by location pointing information, the method comprising receiving ( 5 b ) an encrypted information object ( 102 ), sending ( 7 ) to a resolution node (D 200 ) a request for location pointing information of a key issuing node (D300), the request comprising an identity of the received information object ( 102 ), receiving ( 8 ) the location pointing information of the key issuing node (D 300 ), sending ( 9 ) to the key issuing node (D 300 ) a request for an access key ( 104 ) for decrypting the encrypted information object ( 102 ), the request comprising the identity of the received information object ( 102 ), receiving ( 11 ) the access key ( 104 ), and decrypting ( 12 ) the received encrypted information object ( 102 ) with the received access key ( 104 ).

Security of a multimedia stream

A method including receiving encrypted multimedia information of a multimedia broadcast multicast service streaming session, wherein the multimedia information is encrypted using an encryption key. An indication allowing to switch the receiving of the encrypted multimedia information to a peer-to-peer streaming session is received and receiving of the encrypted multimedia information from the multimedia broadcast multicast service streaming session to the peer-to-peer streaming session is switched. Encrypted multimedia information of the peer-to-peer streaming session is received.

Method and system for optimizing authentication procedures in media independent hanodver services

A method and system for establishing security association mechanism between a Mobile Node (MN) and a plurality of Point of Services (PoS) are provided. The method includes sending a first request from primary PoS to secondary PoS. The primary PoS then receives a first response along with a derived first key. The first key is derived at the secondary PoS. The method further includes receiving a second request from the MN at the primary PoS. The method then derives a second key based on a MN identity and the derived first key. Thereafter, the method sends a second response along with a second key from the primary PoS to the MN. Further, the method establishes communication between the MN and secondary PoS based on the second key received by the MN and the second key generated at the secondary PoS.

Transaction verification on rfid enabled payment and transaction instruments

A display enabled RFID tag (DERT) receives transaction details from the reader. DERT verifies that the details match their counterparts in the reader public key certificate. The process is aborted in case of a mismatch. DERT extracts and displays user-verifiable data. It then enters a countdown stage that lasts for a predetermined duration. A user observes the transaction information and, if the transaction amount and other details are deemed correct, presses an accept button provided on the DERT before the timer runs out. DERT signs the time-stamped transaction statement and sends it to the reader. This signed statement is then sent to the payment gateway and eventually to the financial institution that issued the payment DERT.

Key Agreement and Transport Protocol

A key establishment protocol includes the generation of a value of cryptographic function, typically a hash, of a session key and public information. This value is transferred between correspondents together with the information necessary to generate the session key. Provided the session key has not been compromised, the value of the cryptographic function will be the same at each of the correspondents. The value of the cryptographic function cannot be compromised or modified without access to the session key.

Communication apparatus, control method for communication apparatus, and program

A communication apparatus of the present invention is a communication apparatus that communicates with a plurality of other communication apparatuses, and starts processing for setting an address for the communication apparatus using encrypted communication when encrypted communication with the plurality of communication apparatuses becomes possible by sharing encryption keys for encrypting communication with the other communication apparatuses.

Security usb storage medium generation and decryption method, and medium recorded with program for generating security usb storage medium

The present invention relates to a security USB storage medium generation and decryption method, and a medium having the record of a program for the generation of a security USB storage medium. The generation method of the present invention is for a USB host constituted by a USB connection port, an input interface, an output interface, a storage unit and a host control unit to code a USB storage medium constituted by a USB interface, a storage region and a USB control unit so as to generate a security USB storage medium, the method comprising the steps of: in the host control unit, outputting through the output interface information that requests for the input of a 1st user password to be set, when the connection of the USB interface to the USB connection port is detected; generating a random key and a disk key based on a 1st user password that is input from the input interface in response to the request for the input of the 1st user password; hashing the 1st user password and the random key after the random key and the disk key are generated, so as to generate a 1st encryption and decryption key; and generating a security volume header by dividing the storage region into a header and a body using the 1st encryption and decryption key, encrypting a 1st data and then storing the data in the header, and also generating a security volume body by encrypting a 2nd data using the disk key and then storing the data in the body. In this manner, no one is allowed to read the content stored in the USB storage medium through a disk dump for example without inputting a user password that was input during the generation of security volume, thereby increasing the security of the USB storage medium.

Apparatus and method for generating a key for broadcast encryption

An apparatus and method for generating a key for a broadcast encryption. The apparatus includes a node secret generator for managing a user that receives broadcast data in a tree structure and for generating a unique node secret for each node in the tree structure. The apparatus also includes an instant key generator for temporarily generating an instant key used at all nodes in common in the tree structure, and a node key generator for generating a node key for each node by operating the node secret generated at the node secret generator and the instant key generated at the instant key generator. Thus, key update can be efficiently achieved.

Method and devices for secure communications in a telecommunications network

A secure communications method is provided for use in a telecommunications network, wherein a transaction between an entity A and an entity B of the network comprises: entity A sending an authorization request to an Authorization Server S, in which request the entity A identifies itself and authenticates itself; the entity A declares to the Authorization Server its intention to communicate with a certain entity B; the Authorization Server determines a secret key that it shares with the entity B; the Authorization Server generates a session key and sends it to the entity A; the session key being a one-way function of the secret key and also being a function of an integer (transaction number) allocated to the transaction; the Authorization Server also generates a transaction identifier that is a function depending at least on the transaction number in non-invertible manner.

Method for Obtaining Information of Key Management Server, and Method, System and Device for Monitoring

The present invention discloses a method for obtaining key management server information, and an intercepting method, system and device, including: in the process of a user equipment registering an IP multimedia subsystem (IMS), storing the KMS information corresponding to the user equipment in a preset IMS core network network element; and when a lawful intercepting device monitors a session initiated by the user equipment, intercepting a session request signaling sent by the user equipment, and obtaining an identification information of the user equipment from the session request signaling, and searching the KMS information corresponding to the user equipment from the preset IMS core network network element according to the identification information of the user equipment. The technical solution of the present invention makes the requirement of lawful intercepting be met without depending on security of the signaling plane when a plurality of KMSs are deployed in the IP multimedia subsystem.

Method of securing communication

A method for securing data to be transmitted between a plurality of devices which includes exchanging encryption keys between first and second devices of the plurality of devices, selecting digital rights management (DRM) features for the data which is to be transmitted from the first device, encrypting the data to be transmitted and the selected digital rights management features using at least one distinct key, transmitting the encrypted data and the selected DRM features to the second device and a third device, and decrypting the encrypted data on the second device using the exchanged encryption keys and displaying the data according to the selected DRM features.

Secure management of keys in a key repository

A method for managing keys in a computer memory including receiving a request to store a first key to a first key repository, storing the first key to a second key repository in response to the request, and storing the first key from the second key repository to the first key repository within said computer memory based on a predetermined periodicity.

Root node and a computer readable medium

A wireless mesh network includes a plurality of nodes to which a device key is assigned. The device key belongs to one of a plurality of groups. In a root node, a correspondence relationship between the nodes and the device key thereof, and a correspondence relationship between past join nodes and a device key thereof, are stored. When a new node in the wireless mesh network is detected as a past join node, the device key assigned to the past join node is assigned to the new node again. When the new node is not the past join node, a new device key is assigned to the new node. A cipher text is generated by encrypting a message using device keys assigned to the nodes and the new node. If the number of groups to which the device keys belong is fewer, a size of the cipher text is smaller.

Encryption information transmitting terminal

The communication unit transmits and receives a communication message. The authentication processor performs an authentication process for establishing the network connection by transmitting and receiving an authentication message to and from an authentication server through the communication unit. The encryption information generator generates an encryption key shared with the authentication server when the authentication process is successfully completed. The first message generator generates a first communication message instructing the destination device to acquire the encryption key from the authentication server. The second message generator generates a second communication message including data to be transmitted to the destination device. The communication unit transmits the first communication message to the destination device, encrypts the second communication message with the encryption key, and transmits an encrypted second communication message to the destination device.

Securely enabling access to information over a network across multiple protocols

There is disclosed a method that includes providing encrypted information to a plurality of receiving devices, and transmitting by one of a multicast and broadcast a release key to the plurality of receiving devices to enable access to the encrypted information, wherein the release key is received at or about the same time by the plurality of receiving devices. The release key may be transmitted and or received over a multicast or broadcast network. The release key may be transmitted and/or over a distributed network. The transmission of the release key may be synchronized using a timing mechanism.

Method and system for establishing security connection between switch equipments

A method and a system for establishing a security connection between switch equipments are disclosed in the present invention. The system includes the first switch equipment and the second switch equipment; the first switch equipment sends the switch key negotiation activation packet and the switch key negotiation response packet to the second switch equipment; the second switch equipment sends the switch key negotiation request packet to the first switch equipment. The embodiments of the present invention provide a security policy for data security transmission between switch equipments by establishing shared switch key between each two switch equipments, thus guaranteeing the confidentiality of the data transmission process between switch equipments in the data link layer. The calculation burden of switch equipment and the delay of the data packets transmitted from the transmission end to the reception end can be reduced and the efficiency of network transmission can be improved.

Two-party private estimation of dataset similarity

A two-party approximation protocol is transformed into a private approximation protocol. A first input x∈{0, 1, . . . , M} n and a second input y∈{0, 1, . . . , M} n of a two party approximation protocol approximating a function of a form f(x, y)=Σ j=1 n g(x j , y j ) is received. Variable B is set as a public upper bound on f(x, y). Variable l is set l=O*(1). The following is performed until ∑ j = 1 l  z j ≥ l t or B<1, where t is an arbitrary number: (1) a private importance sampling protocol with the first input x, the second input y, and a third input 1 k , is executed independently for j∈[l], where k is a security parameter, an output of the private importance sampling protocol is shares of I j ∈[n]∪{⊥}; (2) l coin tosses z 1 , . . . , z l are independently generated where z j =1 iff I j ≠⊥; and (3) B is divided by 2 if ∑ j = 1 l  z j ≥ l t or B<1 is not satisfied. When ∑ j = 1 l  z j ≥ l 8 or B<1 a private (ε, δ)-approximation Ψ protocol for f(x, y)=Σ j=1 n g(x j , y j ) is outputted where Ψ = 2  B l  ∑ j = 1 l  z j , ε is an arbitrary number, and δ=exp(−k).

Method and system for encrypting data delivered over a network

Systems and methods are provided for delivering e-mail, typically with time relevant content, to users, whose e-mail addresses are encrypted. Specifically, the e-mails are administered by a host or home server that is transparent to the e-mail addresses of the computers and e-mail clients, that electronic communications are being sent to and received from.

Systems and Methods for Secure Handling of Data

The methods and systems described herein provide for secure implementation of external storage providers in an enterprise setting. Specifically, the present invention provides for allowing the secure use of processes that may transmit files to external storage providers or access files from an external storage provider. In some arrangements, process, such as an untrusted process, may request access to a file. A security agent may intercept the request and encrypt the file. The file can then be transmitted to the external storage provider. A user may subsequently request access to the file. A security agent may intercept a message in connection with this request, determine whether the user is authorized to access the file, and decrypt the file.

Secure key management in conferencing system

A method for managing a conference between two or more parties comprises an identity based authenticated key exchange between a conference management element and each of the two or more parties seeking to participate in the conference. Messages exchanged between the conference management element and the two or more parties are encrypted based on respective identities of recipients of the messages. The method comprises the conference management element receiving from each party a random group key component. The random group key component is computed by each party based on a random number used by the party during the key authentication operation and random key components computed by a subset of others of the two or more parties seeking to participate in the conference. The conference management element sends to each party the random group key components computed by the parties such that each party can compute the same group key.

Peer-to-Peer Trusted Network Using Shared Symmetric Keys

A unique, strong, shared, symmetric network-wide key (or a limited number of group-wide keys) is generated by a central authority and initially provisioned to nodes in a network, which use it for ensuing traffic encryption. Nodes establish trust by sending each other authentication messages encrypted with the shared secret key, and thereupon adding each other to their respective trust lists. Also, an optional rekeying scheme whereby an existing shared secret key can be replaced by a new secret key that is introduced by the central authority and automatically propagated from node to node through the network.

Media Agnostic, Distributed, and Defendable Data Retention

A data protector is described. In an implementation, the data protector promotes and enforces a data retention policy of a data consumer. In an implementation, the data protector limits access to sensitive data to the data consumers. A key manager provides a time-limited encryption key to the data protector. Responsive to collection of the time-limited encryption key from the key manager and sensitive data from a data provider, the data protector encrypts the sensitive data with the time-limited encryption key effective to produce encrypted sensitive data. In some embodiments, the data protector' provides a data consumer with access to the encrypted sensitive data and the key manager provides the data consumer with access to the time-limited encryption key to decrypt the encrypted sensitive data. The key manager deletes the time-limited encryption key in compliance with the data retention policy of the data consumer.

Systems and methods for secure communication using a communication encryption bios based upon a message specific identifier

An apparatus and methods of securely communicating a message between a first device and a second device using a message specific identifier is disclosed. The method begins by receiving an encryption key request from a sending device, where the encryption key request is based upon the message specific identifier, which is associated with a plurality of attributes associated with the message and the sending device. In more detail, the message specific identifier may be an information-based indicator that is unique with respect to the message and the sending device. The method parses the encryption key request and the message specific identifier to provide an intermediate argument used to enter a current random character set that is periodically generated and stored into memory. The intermediate argument helps identify which type of encryption method is desired for use in encryption key generation. An encryption key is constructed using the intermediate argument as an entry point to the current random character set. A data structure is stored associated with the message specific identifier, a random character set identifier for the current random character set, and an identifier of the encryption method used before the key is transmitted back to the device.

Using A Single Certificate Request to Generate Credentials with Multiple ECQV Certificates

A method and apparatus are disclosed for using a single credential request (e.g., registered public key or ECQV certificate) to obtain a plurality of credentials in a secure digital communication system having a plurality of trusted certificate authority CA entities and one or more subscriber entities A. In this way, entity A can be provisioned onto multiple PKI networks by leveraging a single registered public key or implicit certificate as a credential request to one or more CA entities to obtain additional credentials, where each additional credential can be used to derive additional public key-private key pairs for the entity A.

Method for Generating Cryptographic Half-Keys, and Associated System

A method for generating cryptographic half-keys makes it possible to generate n pairs (K i 1 , K i 2 ), 1≦i≦n, of cryptographic half-keys, each of said pairs making it possible to reconstruct an access key K PL specific to a secure apparatus, said method comprising at least the following steps: generating and storing, with the help of a management center distinct from said apparatus, a first series of n half-keys K i 1 on a recording medium; supplying the apparatus with said recording medium so as to generate, with the help of said local key K PL and of the n half-keys K i 1 stored on said medium, a second series of n half-keys K i 2 making it possible to form said n pairs (K i 1 , K i 2 ). The method applies notably to the creation of several keys for access to a secure apparatus.

Enabling users to select between secure service providers using a key escrow service

Systems and methods are described herein for enabling users to select from available secure service providers (each having a Trusted Service Manager (“TSM”)) for provisioning applications and services on a secure element installed on a device of the user. The device includes a service provider selector (“SPS”) module that provides a user interface for selecting the secure service provider. In one embodiment, the SPS communicates with a key escrow service that maintains cryptographic keys for the secure element and distributes the keys to the user selected secure service provider. The key escrow service also revokes the keys from deselected secure service providers. In another embodiment, the SPS communicates with a central TSM that provisions applications and service on behalf of the user selected secure service provider. The central TSM serves as a proxy between the secure service providers and the secure element.

APPARATUS AND METHOD FOR SECURE COMMUNICATION

A method and apparatus are for transferring a client device certificate and an associated encrypted client private key to a client device from a secure device. The secure device receives over a secure connection, a secure device certificate, a secure device private key and a plurality of client device certificates. Each client certificate is associated with a bootstrap public key but is not assigned to any particular client device. A plurality of encrypted client private keys is also received. Each of the encrypted client private keys comprises a client private key associated with one of the client device certificates encrypted with the bootstrap public key. The plurality of client device certificates is stored. The encrypted client private keys are stored in double encrypted protected form. A client device certificate and an associated encrypted client private key are transferred to a client device that has successfully registered with the secure device. 1. A method used in a secure device having secure storage , comprising:receiving from a secure server over a secure connection a secure device certificate, a secure device private key, and a plurality of client device certificates, wherein each client certificate is not assigned to any particular client device;receiving from the secure server over the secure connection a plurality of encrypted client private keys, wherein each of the encrypted client private keys comprises a client private key associated with one of the client device certificates key-encrypted with a bootstrap public key;storing the plurality of client device certificates;storing the plurality of encrypted client private keys in protected form; andtransferring an assigned client device certificate and an associated encrypted client private key to a client device that successfully registers with the secure device using an identification of the bootstrap public key.2. The method according to claim 1 , wherein the step of storing the plurality of ...

System and method for pseudo-random polymorphic tree construction

Disclosed herein are systems, methods, and non-transitory computer-readable storage media for obfuscating data via a pseudo-random polymorphic tree. A server, using a seed value shared with a client device, generates a tag stream according to a byte-string algorithm. The server passes the tag stream and the data to be transmitted to the client device through a pseudo-random polymorphic tree serializer to generate a pseudo-random polymorphic tree, which the server transmits to the client device. The client device, using the same seed and byte-string algorithm, generates the same tag stream as on the server. The client passes that tag stream and the received pseudo-random polymorphic tree through a pseudo-random polymorphic tree parser to extract the data. Data to be transmitted from the server to the client device is hidden in a block of seemingly random data, which changes for different seed values. This approach obfuscates data and has low processing overhead.

Demand based encryption and key generation and distribution systems and methods

Systems and methods providing a key management platform that generates and distributes demand-based encryption and decryption keys are described.

Systems and methods for secure communication using a communication encryption bios based upon a message specific identifier

An apparatus and methods of securely communicating a message between a first device and a second device using a message specific identifier is disclosed. The method begins by assembling the message specific identifier from one or more attributes associated with the message and the first device. An encryption key request is transmitted to a server, wherein the encryption key request is based upon the message specific identifier. An encryption key is received from the server, wherein the encryption key is based on the message specific identifier and a random character set. The message is encrypted using the received encryption key and the encrypted message is sent to the second device.

AUTHENTICATION DEVICE, AUTHENTICATION METHOD AND COMPUTER READABLE MEDIUM

There is provided an authentication device in which a network access authenticating unit executes a first network access authentication process with a communication device; master key generator generates a first master key shared with the communication device in accordance with a result of the first network access authentication process; an application-oriented encryption key generator generates a first encryption key for an application, which is shared with the communication device, on the basis of the first master key; a master key identifier determiner determines an identifier of the first master key; and an application-oriented encryption key identifier determiner determines an identifier of the first encryption key for the application in accordance with the identifier of the first master key. 1. An authentication device comprising:a network access authenticating unit configured to execute a first network access authentication process with a communication device;a master key generator configured to generate a first master key shared with the communication device in accordance With a result of the first network access authentication process;an application-oriented encryption key generator configured to generate a first encryption key for an application, which is shared with the communication device, on the basis of the first master key;a master key identifier determiner configured to determine an identifier of the first master key; andan application-oriented encryption key identifier determiner configured to determine an identifier of the first encryption key for the application in accordance with the identifier of the first master key.2. The authentication device according to claim 1 , wherein the network access authenticating unit executes a second network access authentication process with the communication device claim 1 ,the master key generator generates a second master key shared with the communication device in accordance with a result of the second ...

System and method of enforcing a computer policy

A method and system of enforcing a computer policy uses a central server to manage user profiles, policies and encryption keys. The server securely supplies the keys to client devices only after checking that the policy has been complied with. The checks include both the identity of the user and the machine identity of the client device. The keys are held in a secure environment of the client device, for example in a Trusted Platform Module (TPM), and remain inaccessible at all times to the end user. Theft or loss of a portable client device does not result in any encrypted data being compromised since the keys needed to decrypt that data are not extractable from the secure environment.

Digital right management method, apparatus, and system

A digital right management method, including: generating, by a first user equipment having access right to shared digital contents, a common public key based on one or more public keys of one or more second user equipments intended to share the digital contents, respectively; encrypting, by the first user equipment, a key of the digital contents with the common public key to generate a ciphertext of the key of the digital contents; generating, by the first user equipment, from the ciphertext a new authorization certificate corresponding to the digital contents; and transmitting, by the first user equipment, the new authorization certificate and the digital contents to the second user equipments to instruct the second user equipments to share the digital contents in accordance with the new authorization certificate.

Encryption key management

An encryption key fragment is divided into a number of encryption key fragments. Requests to store different ones of the encryption key fragments are transmitted to different computer memory storage systems. An individual request to store an encryption key fragment includes one of the encryption key fragments and bears an access control hallmark for regulating access to the encryption key fragment.

Transaction Verification on RFID Enabled Payment and Transaction Instruments

A display enabled RFID tag (DERT) receives transaction details from the reader. DERT verifies that the details match their counterparts in the reader public key certificate. The process is aborted in case of a mismatch. DERT extracts and displays user-verifiable data. It then enters a countdown stage that lasts for a predetermined duration. A user observes the transaction information and, if the transaction amount and other details are deemed correct, presses an accept button provided on the DERT before the timer runs out. DERT signs the time-stamped transaction statement and sends it to the reader. This signed statement is then sent to the payment gateway and eventually to the financial institution that issued the payment DERT. 1. A method for securing the communication of a wireless , interface-constrained device comprising:providing the wireless, interface-constrained device with a passive display and capability of generating a random pass code for device pairing and running a secret based key agreement protocol;generating and displaying a pass code in wireless, interface-constrained device;prompting a user of a paired device to enter the pass code; andusing the pass code to perform an authenticated key agreement protocol to establish a common key between the wireless, interface-constrained device and paired device and to confirm its possession by both the wireless, interface-constrained device and the paired device.2. A wireless , interface-constrained device adapted for communication with a paired device comprising:a passive display;a memory for storing a random pass code for device pairing;a circuit for communicating with the paired device; anda processor coupled to the display, the memory and the circuit for communicating, the processor for running a secret based key agreement protocol, for generating and displaying a pass code in the display, for sending a prompt to a user of the paired device to enter the pass code, and for using the pass code to perform an ...

SYSTEM AND METHOD FOR SECURING PRIVATE KEYS ISSUED FROM DISTRIBUTED PRIVATE KEY GENERATOR (D-PKG) NODES

A system and method where the “dealer” of a split Master Secret becomes the Master Key Server, whose role is to initially compute the Master Secret, create and distribute shares of the Master Secret to two Distributed Private Key Generators (D-PKG), initialize and route the inter-process communication between the nodes, co-ordinate and computationally participate in the User System's IBE Private Key generation process. 1. A method comprising:selecting a value for x of 2 to q-1;at a Master Key Server, extracting D-PKG IBE Private Keys;issuing the IBE Private Keys to the D-PKG nodes;at the D-PKG nodes, storing their IBE Private Keys;generating a straight line f(X)=mX+x, where m (the slope) is chosen at random;{'sub': 1', '2', '3, 'dividing x into 3 shares, x, xand x;'}{'sub': 1', '2', '3, 'using a different m, breaking a random value r into three shares, r, rand r;'}{'sub': 2', '2, 'at the Master Key Server, distributing to the two D-PKG nodes xand rto'}{'sub': 3', '3', '1', '1, 'one D-PKG node and xand rto another D-PKG, keeping xand rfor itself.'}2. The method of further comprising:at the Master Key Server, generating a request to Authentication System to enroll the D-PKG nodes in the Authentication System Directory;at the Master Key Server, applying an HMAC signature to the request;at the Master Key Server, sending the request to the Authentication Service at the Authentication Service, verifying the HMAC signature of the request;at the Authentication Service, contacting both DPK-G nodes and Master Key Server with a request for shares of the Master Public Key{'sub': i', 'i', '1, 'at the Master Key Server and D-PKG nodes, calculating R=xPand pass this to the Authentication System as a response'} {'br': None, 'i': R=', 'R', 'R', '+R, 'sub': 1', '2', '3, '3−3'}, 'at the Authentication System, combining shares to obtain the Master Public Keyat the Authentication System, recording the location of the Distributed Private Key Generators, and the Master Public Key into the ...

Information system and method incorporating a portable digital media device

A method of reading a readable element, such as a two dimensional bar code or an RFID chip, that has encrypted information with a portable device, such as a digital media device or RFID reader, includes storing a decryption key in the portable device, and scanning the readable element with the portable device. The method further includes communicating with a remote server storing a decryption key database, validating the decryption key stored in the portable device, and decrypting information from the readable element using the portable device. The decrypted information may then be displayed.

Homomorphic evaluation including key switching, modulus switching, and dynamic noise management

Homomorphic evaluations of functions are performed. The functions include operation(s). Variants of key switching and modulus switching are described and are performed prior to or after the operation(s). A key switching transformation converts a ciphertext with respect to a first secret key and a first modulus to a ciphertext with respect to a second secret key and a second modulus. A key switching transformation converts a first version of a ciphertext with respect to a first secret key and with some number r bits of precision to a second version of the selected ciphertext with respect to a second keys and with some other number r′ bits of precision. The ciphertexts may be operated on as polynomials represented using evaluation representation, which has benefits for multiplication and automorphism. Further, ciphertexts are associated with an estimate of noise, which is used to determine when to perform modulus switching on the ciphertexts.

Method for synchronous encryption between a client and a licensing agent

A licensing system is disclosed for performing synchronous encryption with a client over an IP-compliant network. In disclosed embodiments, the system includes a licensing agent configured to pass a data structure unencrypted in an initial communication between the licensing agent/client pair and pass a first key to said client responsive to an initial communication. The licensing agent then receives the data structure from the client having designated fields encrypted according to the first key. The licensing agent then sends a second key to the client for use in subsequent communications.

Method and system for traffic engineering in secured networks

Aspects of a method and system for traffic engineering in an IPSec secured network are provided. In this regard, a node in a network may be authenticated as a trusted third party and that trusted third party may be enabled to acquire security information shared between or among a plurality of network entities. In this manner, the trusted third party may parse, access and operate on IPSec encrypted traffic communicated between or among the plurality of network entities. Shared security information may comprise one or more session keys utilized for encrypting and/or decrypting the IPSec secured traffic. The node may parse IPSec traffic and identify a flow associated with the IPsec traffic. In this manner, the node may generate and/or communicate statistics pertaining to said IPSec secured traffic based on the flow with which the traffic is associated.

DATA TRANSMISSION SYSTEM

A cipher key is generated by first information shared in secrete between a data transmitting unit and a data receiving unit second information derived from duplication control information of transmit data and third, information which is time change information shared between the data transmitting unit and the data receiving unit to cipher data by a CPU by using the above-mentioned cipher key to transmit, from the data transmitting unit to the data receiving unit , transmit data in which the duplication control information and the time change information are added to the ciphered data.

Quantum key distribution

Methods and apparatus for quantum key distribution are described, in particular including methods and networks 300 arranged to improve and/or ensure the security of data transmitted thereby by (i) ensuring a certain level of loss within at least part of the network, (ii) placing a penultimate and an endpoint nodes in situated in a secure second enclave, (iii) analysing a transmitted bit stream to ensure that it does not provide an unacceptable amount of information about the key that may be generated therefrom, and/or (iv) varying the order in which bits are used to generate a key.

Key agreement in wireless networks with active adversaries

A network and related methods for transmitting processes in a network secretly and securely is described. The network use keys, through path-key establishment and a key pool bootstrapping, to ensure that packets are transmitted and received properly and secretly in the presence of one or more adversarial nodes.

AUTHENTICATION IN COMMUNICATIONS NETWORKS

The invention relates to a method of authenticating a user equipment in a communications network. The method involves sending a message from a network entity to the user equipment. This message includes a set of options for an authentication procedure for authenticating an internet protocol communication over a first interface between the user equipment and the network entity; said options including a “shared key”-based authentication procedure. The method also involves selecting an option from the set. In the event that the “shared-key”-based authentication procedure is selected, a shared secret from a security key established in a generic bootstrapping architecture (GBA) is generated over a second interface between the user equipment and a bootstrapping service function. The shared secret is then used to compute and verify authentication payloads in the key-based authentication procedure for the communication over the first interface. 1. A method of authenticating a user equipment in a communications network , the method comprising:sending a message from a network entity to the user equipment including a set of options for an authentication procedure for authenticating an internet protocol communication over a first interface between the user equipment and the network entity said options including a “shared key”-based authentication procedure;selecting an option from the set and in the event that the “shared-key”-based authentication procedure is selected, generating a shared secret from a security key established in a generic bootstrapping architecture (GBA) over a second interface between the user equipment and a bootstrapping service function; andusing the shared secret to compute and verify authentication payloads in the key-based authentication procedure for the communication over the first interface.2. A method according to claim 1 , wherein the user equipment transmits a notification to the network entity indicating its capability of supporting ...

Access Control Method and Related Wireless Communication System

An access control method for a wireless client in a wireless communication system is disclosed. The access control method comprises receiving a distinguish signal from a wireless key distributor when the wireless client approaches the wireless key distributor; activating a application unit of the wireless client upon reception of the distinguish signal, wherein the application unit is associated with the distinguish signal; sending an access information request to the wireless key distributor; receiving access information from the wireless key distributor; configuring the wireless client with the access information; and using the access information to access a wireless access appoint.

Key management system

Embodiments are directed towards enabling cryptographic key management without disrupting cryptographic operations. Embodiments may be employed to generate cryptographic keys based on at least one key parameter that may be provided by an administrator. The administrator may generate key managers and key request users that may be linked to particular cryptographic keys. The cryptographic keys may be stored on key exchange servers separate from the key management server. Responsive to a request for a cryptographic key, the key exchange servers may authenticate the key request user associated with the request. The key request may be validated based on at least one key parameter and a portion of the key request. The key exchange server may generate the requested cryptographic keys providing them to the key request user over the network.

KEY AGREEMENT AND TRANSPORT PROTOCOL

A key establishment protocol includes the generation of a value of cryptographic function, typically a hash, of a session key and public information. This value is transferred between correspondents together with the information necessary to generate the session key. Provided the session key has not been compromised, the value of the cryptographic function will be the same at each of the correspondents. The value of the cryptographic function cannot be compromised or modified without access to the session key. 1. A method of symmetric key agreement between a first communication device and a second communication device in a data communication system , each of said first communication device and said second communication device having a master key K , said method comprising:said first communication device generating a first value X and providing said first value X to said second communication device;said second communication device generating a second value Y and computing a shared key k by operating a keyed cryptographic function on a combination of said first value X and said second value Y, said second communication device using said master key K as an input to said keyed cryptographic function;said second communication device providing said second value Y to said first communication device; andsaid first communication device computing said shared key k by operating said keyed cryptographic function on said combination of said first value X and said second value Y, said first communication device using said master key K as an input to said keyed cryptographic function.2. The method of further comprising:said second communication device applying a cryptographic hash function to a combination of said first value X, said second value Y, and identification information of one of said first communication device and said second communication device to yield a first hash value, said second communication device using said shared key k computed by said second communication ...

SECURE UNLOCKING AND RECOVERY OF A LOCKED WRAPPED APP ON A MOBILE DEVICE

A security-wrapped app that is locked and inaccessible is unlocked and recovered using a secure and user-friendly protocol. Apps that are security wrapped are passphrase protected. The app security keystore on the device becomes locked. The keystore is encrypted with a recovery key which is only in an encrypted form on the device and cannot be decrypted or otherwise accessed by the user. As such, the user cannot unlock the keystore on the device and therefore is not able to unlock the app. The app can be unlocked using a recovery mechanism that is highly secure in all communications between the mobile device and the service provider server. At the same time the recovery mechanism is easy for the end user to carry out. 1. A method of unlocking a secured app on a mobile device , the method comprising:encrypting a one-time passphrase with a first public key;displaying encrypted one-time passphrase and an encrypted recovery key on the mobile device;inputting the encrypted recovery key into the secured app;receiving the one-time passphrase from a user;decrypting the encrypted recovery key; andunlocking a keystore on the mobile device using the decrypted recovery key.2. A method as recited in further comprising:displaying a screen for the user to input a new, long-term passphrase.3. A method as recited in further comprising:deleting unencrypted one-time passphrase.4. A method as recited in wherein a user communicates encrypted recovery key and encrypted one-time passphrase to the server.5. A method as recited in wherein the encrypted recovery key and encrypted one-time passphrase are decrypted using the private key on the server.6. A method as recited in wherein the recovery key is encrypted using the one-time passphrase on the server.7. A method of wrapping and initially launching an app to prepare the app for an unlocking procedure claim 1 , the method comprising:receiving a public key from a server wherein the server stores a corresponding private key;receiving a user ...

METHOD OF ANONYMOUS ENTITY AUTHENTICATION USING GROUP-BASED ANONYMOUS SIGNATURES

Methods for anonymous authentication and key exchange are presented. In one embodiment, a method includes initiating a two-way mutual authentication between a first entity and a second entity. The first entity remains anonymous to the second entity after performing the authentication. The method also includes establishing a mutually shared session key for use in secure communication between the entities, wherein the initiating and the establishing are in conjunction with direct anonymous attestation (DAA). 1. A method of two-way mutual authentication and key sharing between a first entity and a second entity , the first entity remaining anonymous to the second entity after performing the authentication and key sharing comprising:selecting a first random value;sending a first message, having at least a first key-exchange-protocol public key generated based at least in part on the first random value, from the first entity to the second entity;generating, by the first entity in response to receiving a second message from the second entity, a shared value based at least in part on the first random value and a second key-exchange-protocol public key associated with the second entity;generating a mutually shared session key and a message authentication code (MAC) key based at least in part on the shared value;verifying a public key certificate associated with the second entity;verifying, by using the MAC key, the MAC of the second entity's public key certificate; andverifying a first digital signature from the second message based at least in part on a combination of the key-exchange-protocol public keys retrievable from the first digital signature, wherein the first digital signature is associated with the second entity and is retrievable using the second key-exchange-protocol public key from the second entity's public key certificate.2. The method of claim 1 , further comprising:generating, by using a Direct Anonymous Attestation (DAA)-based private key of the first ...

Format-preserving cryptographic systems

Key requests in a data processing system may include identifiers such as user names, policy names, and application names. The identifiers may also include validity period information indicating when corresponding keys are valid. When fulfilling a key request, a key server may use identifier information from the key request in determining which key access policies to apply and may use the identifier in determining whether an applicable policy has been satisfied. When a key request is authorized, the key server may generate a key by applying a one-way function to a root secret and the identifier. Validity period information for use by a decryption engine may be embedded in data items that include redundant information. Application testing can be facilitated by populating a test database with data that has been encrypted using a format-preserving encryption algorithm. Parts of a data string may be selectively encrypted based on their sensitivity.

CONFIDENTIAL PROVISIONING OF SECRET KEYS OVER THE AIR

A method and apparatus for personalizing a smart card coupled with a communication device of a user who is a subscriber of a first telecommunication network and wishes to become a subscriber of a second telecommunication network is disclosed. A first authentication key is stored in both the smart card and in an first application server included in the first telecommunication network. A secure session is established with a second application server included in the second telecommunication network via the first telecommunication network by negotiating with the first application server and the second application server in order that the smart card and the second application server agree on an second authentication key. Shared values and shared functions according to a secure multiparty computation protocol are used to compute a second authentication key which replaces the first authentication key in the smart card. 1. A method for personalizing a smart card coupled with a communication device of a user being a subscriber of a first telecommunication network and wishing to become a subscriber of a second telecommunication network , a first authentication key being stored in the smart card and in an first application server included in the first telecommunication network , the method comprising the following steps in the smart card:establishing a secure session with a second application server included in the second telecommunication network via the first telecommunication network;negotiating with the first application server and the second application server in order that the smart card and the second application server agree on an second authentication key, by exchanging messages referring to shared values and shared functions by means of a secure multiparty computation protocol involving the smart card, the first application server and the second application server, and computing the second authentication key depending on at least a shared value and a shared function; ...

Mobile communication method and mobile management node

In an attach process executed as a relay node RN, the wasteful use of a resource is avoided. A mobile communication method according to the present invention includes a step of transmitting, by a radio base station DeNB, “(S1) Initial UE message” indicating the attach process executed as the relay node RN to a mobile management node MME in response to “Attach Request (RN)” received from the relay node RN having a secure channel established between the relay node RN and USIM-RN, a step of starting, by the mobile management node MME, “EPS-AKA” between the relay node RN and the USIM-RN in response to the “(S1) Initial UE message”, and a step of failing in the “EPS-AKA” when it is determined that the USIM-RN cannot be used for the attach process executed as the relay node RN.

IN-VEHICLE CONTENT DELIVERY SYSTEM OPERABLE IN AUTONOMOUS MODE AND NON-AUTONOMOUS MODE

Multimedia content may be delivered to content consumer devices via a content-delivery network. Encrypted content and cryptography keys for decrypting the content may be distributed from a data center to various nodes of the content-delivery network, each node acting as a semi-independent content-delivery system. Each content-delivery system is capable of delivering received content to end-users and implementing a key-management scheme to facilitate secure content-delivery and usage tracking, even when the content-delivery system is disconnected from the data center. In other words, the disclosed systems and methods facilitate the operation of nodes which may operate in “autonomous mode” when disconnected from a larger content-delivery network, thus maintaining content-delivery capabilities despite having little if any connectivity to external networks. 1. A system for providing an in-vehicle content-delivery service to mobile consumer devices , the system comprising: one or more processors;', 'one or more communication interfaces that are coupled to the one or more processors and that are configured to: (i) communicatively couple the content delivery system to one or more mobile consumer devices via an in-vehicle network for the vehicle, and (ii) communicatively couple the content delivery system to a license server that is external to the vehicle and that is configured to authorize or not authorize content-requests originating from the one or more mobile consumer devices; and', (i) detect a loss of a connection between the content delivery system and the license server;', '(ii) respond to the detected loss by operating as a proxy for the license server, including performing an authorization operation to determine a particular content-request from a particular mobile consumer device is authorized; and', '(iii) transmit content to the particular mobile consumer device in response to determining that the particular content-request from the particular mobile consumer ...

Secure secret recovery

A secret is sliced into a number of encrypted slices. The encrypted slices can be distributed amongst members of a group. The encrypted slices make recovery of the secret possible, but a group authority key is required for decryption. Thus, a number of slices are necessary, but still not sufficient, to recover the secret.

MANAGING SECURE DOCUMENT EXCHANGES

A method for secure document exchange includes receiving a request from a content owner to initiate a document request of particular information from a record provider to a service provider; sending to the record provider a request for documentation, the request comprising at least: the particular information for the record provider to send to the service provider; contact information of the service provider to receive the particular information; and an encryption key with which to encrypt particular information; and sending to the service provider a notification message, the notification message comprising at least a decryption key with which to decrypt the particular information from the record provider. 1. A method for secure document exchange , the method comprising:receiving a request from a content owner to initiate a document request; particular information for the record provider to send to a service provider;', 'contact information of the service provider to receive the particular information; and', 'an encryption key with which to encrypt particular information; and, 'sending to a record provider a request for documentation, the request comprising at leastsending to the service provider a notification message, the notification message comprising at least a decryption key with which to decrypt the particular information from the record provider.2. The method of claim 1 , further comprising:receiving a request for explicit consent from the record provider from the content owner;initiating a consent request from the content owner; andafter receiving explicit consent from the content owner, sending the explicit consent to the record provider.3. The method of claim 1 , further comprising:receiving confirmation from the service provider that the documentation was received from the record provider; andafter the confirmation from the service provider that the documentation was received from the record provider, sending a notification to the content owner ...

Security hierarchy on a digital transaction processing unit (dtpu)

A Digital Transaction Processing Unit (DTPU) operable to host one or more transaction applications for digitally transacting with a Digital Transaction Device (DTD), the DTPU including a security hierarchy for hosting the one or more transaction applications, wherein the security hierarchy is configured to host at least one transaction application for transacting in contact digital transactions.

Intelligent tracking system and methods and systems therefor

An intelligent tracking system generally includes one or more tracking devices, some of which may be passive tracking devices. Each passive tracking device includes one or more transceivers and is energized by an energizing signal. Some of these passive tracking devices may operate in a first communication mode or a second communication mode based on the energizing signal. Some tracking devices may include encryption modules or authentication modules. Some of these devices may incorporate a bulk acoustic wave oscillator.

INTELLIGENT TRACKING SYSTEM AND METHODS AND SYSTEMS THEREFOR

An intelligent tracking system generally includes one or more tracking devices, some of which may be passive tracking devices. Each passive tracking device includes one or more transceivers and is energized by an energizing signal. Some of these passive tracking devices may operate in a first communication mode or a second communication mode based on the energizing signal. Some tracking devices may include encryption modules or authentication modules. Some of these devices may incorporate a bulk acoustic wave oscillator. 1. An intelligent tracking system comprising:one or more passive tracking devices, wherein each passive tracking device includes one or more transceivers and is energized by an electromagnetic frequency, and wherein in response to being energized each passive tracking device transmits a short message;an exciter that emits the electromagnetic frequency that energizes the one or more passive tracking devices; anda tracker that receives short messages from the one or more passive tracking devices and confirms the presence of the one or more passive tracking devices in a vicinity of the tracker based on the received messages.2. The intelligent tracking system of claim 1 , wherein the short messages are Bluetooth low energy beacons.3. The intelligent tracking system of claim 2 , wherein each of the Bluetooth Low Energy beacons includes a respective device identifier of a respective passive tracking device of the one or more passive tracking devices that transmitted the Bluetooth Low Energy beacon.4. The intelligent tracking system of claim 1 , wherein each of the short messages includes a respective device identifier of a respective passive tracking device of the one or more passive tracking devices that transmitted the short message.5. The intelligent tracking system of claim 4 , wherein the respective passive tracking device encrypts the respective device identifier in the short message using a low power encryption algorithm.6. The intelligent tracking ...

Intelligent tracking system and methods and systems therefor

An intelligent tracking system generally includes one or more tracking devices, some of which may be passive tracking devices. Each passive tracking device includes one or more transceivers and is energized by an energizing signal. Some of these passive tracking devices may operate in a first communication mode or a second communication mode based on the energizing signal. Some tracking devices may include encryption modules or authentication modules. Some of these devices may incorporate a bulk acoustic wave oscillator.

Intelligent tracking system and methods and systems therefor

An intelligent tracking system generally includes one or more tracking devices, some of which may be passive tracking devices. Each passive tracking device includes one or more transceivers and is energized by an energizing signal. Some of these passive tracking devices may operate in a first communication mode or a second communication mode based on the energizing signal. Some tracking devices may include encryption modules or authentication modules. Some of these devices may incorporate a bulk acoustic wave oscillator.

METHOD AND SYSTEM FOR AUTHORIZATION USING A PUBLIC LEDGER AND ENCRYPTION KEYS

A method for conveying a data message using a public ledger includes: generating, by a generation module of a processing server, a data message, wherein the data message comprises one or more data values; electronically transmitting, by a transmitting device of the processing server, a data signal superimposed with the generated data message to a first computing system; receiving, by a receiving device of the processing server, a data signal superimposed with an encrypted message from the first computing system, wherein the encrypted message is generated via application of one or more encryption algorithms to the generated data message using at least one encryption key; appending, by the generation module of the processing server, an identification value to the encrypted message; and submitting, by the transmitting device of the processing server, the appended encrypted message to a public ledger associated with a second computing system. 1. A method for securely conveying a transaction message , comprising:applying, by a first computing system, one or more encryption algorithms to a data message using at least one encryption key to generate an encrypted message;transmitting, by the first computing system, the at least one encryption key to a third computing system different from a processing server, wherein the third computing system acts as a node in a blockchain network;receiving, by a receiving device of the processing server from the first computing system, a data signal superimposed with the encrypted message, wherein the processing server does not receive the at least one encryption key;appending, by the processing server, an identification value to the encrypted message;submitting, by the transmitting device of the processing server, the appended encrypted message to a second computing system, wherein the second computing system is a node in the blockchain network;adding, by the second computing system acting as a node in the blockchain network, the ...

SECURE ENABLEMENT OF PLATFORM FEATURES WITHOUT USER INTERVENTION

Systems, apparatuses, and methods for secure enablement of platform features without user intervention are disclosed. In one embodiment, a system includes at least a motherboard and a processor. The motherboard includes at least a socket and an authentication component. The authentication component can be a chipset, expansion I/O device, or other component. The processor is installed in the socket on the motherboard. During a boot sequence, the processor retrieves a key value from the authentication component and then authenticates the key value. Next, the processor determines which one or more features to enable based on the key value. Then, the processor programs one or more feature control registers to enable the one or more features specified by the key value. Accordingly, during normal operation of the system, the one or more features will be enabled. 1. A system comprising:a processor; andan authentication component; retrieve a key from the authentication component during a boot sequence;', 'authenticate the key;', 'determine, from the key, which of one or more features of the processor to enable responsive to determining the key has been authenticated; and', 'write to one or more feature control registers to enable the one or more features., 'wherein the processor is configured to2. The system as recited in claim 1 , wherein a first feature of the one or more features is overclocking the processor.3. The system as recited in claim 1 , wherein the processor is further configured to:determine from the key, which of one or more features of a motherboard to enable responsive to determining the key has been authenticated; andwrite to one or more feature control registers to enable the one or more features for the motherboard.4. The system as recited in claim 1 , wherein the processor is further configured to:enable a first set of features responsive to retrieving a first key value from the authentication component; andenable a second set of features responsive to ...

KEY AGREEMENT DEVICE AND METHOD

An initiating key-agreement device () and a responding key-agreement device () are provided, configured to generate a symmetric key shared between them. The devices are configured for generating in electronic form a private random value (), obtaining in electronic form a public set of bivariate polynomials () and computing a univariate polynomial () by summing the univariate polynomials obtained by substituting the private random value () into the polynomials of the public set (). The devices are configured to send their computed univariate polynomial to the other device, and to compute or reconstruct the shared symmetric key () by substituting its generated private random value () in the received univariate polynomial. 1. An initiating key-agreement device configured to generate a symmetric key shared with a responding key-agreement device , the shared symmetric key being for symmetric encryption and/or decryption of electronic messages , the initiating key-agreement device comprising [{'b': '112', 'generating in electronic form a first private random value (, s),'}, {'b': '122', 'sub': 'i', 'obtaining in electronic form a public set of bivariate polynomials (, f(,)), wherein a different commutative ring is associated with each polynomial of the public set of bivariate polynomials'}, {'b': 112', '122, 'sub': i', 'i, 'computing an initiating univariate polynomial by summing the univariate polynomials obtained by substituting the first private random value (, s) into the polynomials of the public set (, f(s,)), the initiating univariate polynomial univariate polynomial obtained by substituting the first private random value (s) into a particular polynomial of the public set (f(s,)) is reduced to a canonical form in the commutative ring associated with the particular univariate polynomial,'}], 'an initiating key data generator configured for'} sending the initiating univariate polynomial to the responding key-agreement device, and for', 'receiving from the responding ...

COMMUNICATION DEVICE, COMMUNICATION METHOD, READER/WRITER, AND COMMUNICATION SYSTEM

A control unit of a communication device decrypts, when receiving via an antenna from a reader/writer a cipher key encrypted with a key same as a common key recorded in a recording unit by the reader/writer, the encrypted cipher key with the common key recorded in the recording unit, and when receiving via the antenna from the reader/writer a readout target address specifying a region of a data readout source in the recording unit encrypted with a cipher key same as the cipher key by the reader/writer, decrypting the encrypted readout target address with the cipher key, and transmitting the data recorded in the region specified by the readout target address obtained through decryption of the regions of the recording unit to the reader/writer via the antenna. 1. (canceled)2. A communication method for a communication device , comprising:generating a first session key by encrypting at least a random value with a common key, the common key is shared with an information processing apparatus;in response to receiving a read command, transmitting a first message encrypted with the first session key, the read command including information addressing first data relating to the first message;generating a second session key by encrypting a seed value with the common key; andin response to receiving a write command, writing second data into a memory, the write command including the second message relating to the second data, at least a part of the second message encrypted with the second session key.3. The communication method according to claim 2 , wherein the seed value is different from the random value.4. The communication method according to claim 3 , wherein the random value is generated in the information processing apparatus.5. The communication method according to claim 4 , wherein the seed value is generated in the communication device.6. The communication method according to claim 5 , wherein the read command is received from the information processing apparatus.7. ...

ID-BASED CONTROL UNIT-KEY FOB PAIRING

A key fob includes a transceiver to send and receive signals, a memory to store a key fob identification (KFID), and a processor coupled to said transceiver and memory. The processor is to execute, along with a pairing device, an identification (ID) authenticated key agreement protocol based on the KFID to authenticate a pairing device and to generate a common secret encryption key known only by the processor and the pairing device. The Processor receives a control unit identification (CUID) encrypted by the pairing device with the common secret encryption key, execute along with the control unit associated with the CUID an ID authenticated key agreement protocol based on the CUID to authenticate the control unit, generates a second common secret encryption key known only by the processor and the control unit, and receives an operation key encrypted by the control unit with the second common secret encryption key. 18-. (canceled)9. A key fob , comprising:a transceiver to receive and send signals;a memory to store a key fob identification (KFID); and execute, along with a pairing device, an identification (ID) authenticated key agreement protocol based on the KFID to authenticate a pairing device and to generate a common secret encryption key known only by the processor and the pairing device;', 'receive, from the pairing device, a control unit identification (CUID) encrypted by the pairing device with the common secret encryption key;', 'execute along with the control unit associated with the CUID an ID authenticated key agreement protocol based on the CUID to authenticate the control unit and to generate a second common secret encryption key known only by the processor and the control unit; and', 'receive, from the control unit, an operation key encrypted by the control unit with the second common secret encryption key., 'a processor coupled to said transceiver and memory to10. The key fob of claim 9 , wherein ID authenticated key agreement protocol is based on ...

DATA TRANSMISSION METHOD, APPARATUS, AND SYSTEM

The present invention relates to a data transmission method, apparatus, and system. The method includes: obtaining, by a benefited device, a cooperative-layer key, performing encryption, or encryption and integrity protection processing on uplink data by using the cooperative-layer key at a cooperative layer to obtain first encrypted data, performing encapsulation processing on the first encrypted data to obtain first encapsulated data, and sending the first encapsulated data to a supporting device in a short-distance communication mode, so that the supporting device processes the first encapsulated data to obtain second encapsulated data and sends the second encapsulated data to a base station. In embodiments of the present invention, secure data transmission is implemented between the benefited device, the supporting device, and the base station in a cooperative communication process, which improves network security and reliability of data transmission. 1. A data transmission method , comprising:obtaining, by a benefited device, a cooperative-layer key, and performing encryption, or encryption and integrity protection processing on uplink data by using the cooperative-layer key at a cooperative layer to obtain first encrypted data;performing encapsulation processing on the first encrypted data to obtain first encapsulated data; andsending the first encapsulated data to a supporting device in a short-distance communication mode, so that the supporting device processes the first encapsulated data to obtain second encapsulated data and sends the second encapsulated data to a base station.2. The data transmission method according to claim 1 , wherein the obtaining claim 1 , by a benefited device claim 1 , a cooperative-layer key specifically comprises:performing authentication and key agreement with a network side to obtain a parent key, and obtaining, through calculation, the cooperative-layer key according to the parent key; orperforming authentication and key ...

Method and System for Group-oriented Encryption and Decryption with Selection and Exclusion Functions

A method and system for group-oriented encryption and decryption that supports the implementation of the designation and revocation functions of decryption users in a large-scale group. During the encryption, the system acquires a corresponding aggregate function according to an encryption mode; acquires any selected subset S and public parameters, and outputs an aggregate value of the subset S; generates a ciphertext of to-be-transmitted information according to the public parameters, a to-be-transmitted message and the aggregate value; acquires the encryption mode and the subset S comprised in the received ciphertext, operates the subset S and an identity of a current decryptor according to the encryption mode, and outputs a new subset S′; acquires an aggregate function corresponding to the encryption mode during the decryption; outputs an aggregate value of the new subset S′; and decrypts the received ciphertext according to the public parameters and the aggregate value, so as to obtain the to-be-transmitted information. 1. A method for performing group-oriented encryption and decryption with selection and exclusion functions , comprising:acquiring an encryption mode of a to-be-transmitted message, and setting an aggregation function corresponding to the encryption mode during encryption according to a preset mapping relationship between the encryption mode and the aggregation function;acquiring any selected subset S and public parameters, and outputting an aggregated value of the subset S by using the acquired aggregation function corresponding to the encryption mode during encryption, the subset S and the public parameters;generating a ciphertext of the to-be-transmitted message according to the public parameters, the to-be-transmitted message and the aggregated value of the subset S;receiving the ciphertext, acquiring the encryption mode and the subset S comprised in the received ciphertext, and operating the subset S and an identity of a current decryptor ...

Client-side security key generation

Techniques are provided for client-side security key generation. An initial request is received from an application executing on a client device. The application includes a security component includes security code. In response to the initial request, a key component is generated. The key component includes one or more parameters from which a valid security key can be generated at the client device by executing the security code. The key component is provided to the client device. A security key associated with a request from the client device to an application server is received. The security key is checked for validity. In response to determining that the security key is valid, processing of the request by the application server is caused.

Arbitrary base value for epid calculation

Systems and methods for using an arbitrary base value for EPID calculations are provided herein. A system to use arbitrary base values in enhanced privacy ID (EPID) calculation, where the system includes a microcontroller; and a memory coupled to the microcontroller; wherein the microcontroller is to: obtain an arbitrary value at a member device, the member device being a member of a group of member devices, each member device in the group of member devices having a unique private EPID key assigned from a pool of private keys, where any of the pool of private keys is able to sign content that is verifiable by a single group public key, and the arbitrary value being one of a time-based value or a usage-based value; construct an EPID base using the arbitrary value; and transmit content signed with the private key using the EPID base to a verifier.

METHOD FOR SECURE CONNECTION

The invention relates a method involving calling of hardware components (i.e. memory, keyboard, microphone, user interface, etc.) being controlled by software units from trusted execution environment []; and encryption of the input from these elements within the trusted execution environment []; and transmission of the said encrypted data preferably normalized methods to the application in the rich environment []; transmission of the said encrypted data to the receiver via the application in the rich environment [] via the methods of the application of the rich environment []; transmission of the said encrypted data using protocols/methods of the application running in the rich environment []; and at the receiving device being opened at the trusted execution environment [] and being displayed to the user as such. 1101102. The invention disclosed is a method a secure connection via a connectivity application [] within a trusted execution environment [] compromising;{'b': 104', '101', '103', '108', '102, 'a. Receiving of input from the sender [] via the connectivity application [] operating on, the rich environment [] where input elements [] being called from within the trusted execution environment [];'}{'b': 102', '107', '102, 'b. The input received within the trusted execution environment [] being subject to encryption [] within the trusted execution environment [];'}{'b': 102', '102', '102, 'c. The message transferred to outside of the trusted execution environment [] as encrypted and transfer of the message to the connectivity application [] as encrypted and being transferred to the receiver by the connectivity application [] by regular methods;'}{'b': 105', '102, 'd. The message transferred to the receiver [] being available in encrypted form; the available message being displayed in a way making available the user to distinguish; the message being transferred to the trusted execution environment [] and being decrypted within;'}{'b': 107', '110', '102, 'e. With ...

METHOD AND SYSTEM FOR AUTOMATICALLY MANAGING SECRET APPLICATION AND MAINTENANCE

Secret application and maintenance policy data is generated for different classes of data. The class of data to be protected is determined and the secret application and maintenance policy data for the determined class of the data to be protected is identified and obtained. Required secrets data representing one or more secrets to be applied to the data to be protected is obtained and then automatically scheduled for application to the data to be protected in accordance with the secret application and maintenance policy data for the determined class of the data to be protected. Maintenance of the one or more secrets is also automatically scheduled in accordance with the secret application and maintenance policy data for the determined class of the data to be protected. 1. A system for automatically managing secrets application and maintenance comprising:at least one processor; andat least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the at least one processors, perform a process for automatically managing secrets application and maintenance, the process for automatically managing secrets application and maintenance including:generating data classification data defining one or more classes of data;for each class of data, generating secret application and maintenance policy data including required secrets application data indicating required secret types to be applied to each class of data and secrets maintenance policy data indicating secret maintenance procedures for required secrets to be applied to each class of data;obtaining access to data to be protected;determining the class of the data to be protected;obtaining the secret application and maintenance policy data for the determined class of the data to be protected;analyzing the required secrets application data of the secret application and maintenance policy data for the determined class of the data to be ...

SYSTEMS AND METHODS FOR PERFORMING TRANSACTIONS WITH CONTACTLESS CARDS

Example embodiments of systems and methods for data transmission system between transmitting and receiving devices are provided. In an embodiment, each of the transmitting and receiving devices can contain a master key. The transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device, which can generate the diversified key based on the master key and can decrypt the data and validate the protected counter value using the diversified key. 145.-. (canceled)46. A method for transmitting data by a contactless card having a processor and a memory , the memory containing a card key , the method comprising:generating a cryptogram;encrypting the cryptogram using the card key;transmitting the encrypted cryptogram; andtransmitting a tap password, wherein the tap password comprises a plurality of taps of the contactless card on a receiving device.47. The method of claim 46 , further comprising claim 46 , prior to the transmission of the tap password claim 46 , receiving a request for the tap password from an application comprising instructions for execution on the receiving device.48. The method of claim 46 , wherein the plurality of taps comprises a sequence of taps.49. The method of claim 46 , wherein the plurality of taps comprises a two short taps and one long tap.50. The method of claim 49 , wherein each of the two short taps last less than one second.51. The method of claim 49 , wherein the long tap lasts more than one second.52. The method of claim 49 , wherein the two short taps and the one long tap may occur in any order.53. The method of claim 46 , wherein the tap password specifies an order for the plurality of taps.54. A data transmission system comprising:a contactless card comprising:a processor; anda memory, the memory of the contactless card containing a card key, generate a cryptogram,', 'encrypt the cryptogram,', 'transmit the encrypted cryptogram, and', ' ...

PROFILE INSTALLATION BASED ON PRIVILEGE LEVEL

A secure element (SE) determines a profile type and a privilege level. The privilege level, in some embodiments, is associated with a key used successfully by the SE to verify a cryptographic signature. In some embodiments, the privilege level is indicated by a privilege value read from an extension field of a root certificate. The SE determines, in some instances, whether to accept or reject a profile installation after comparing the profile type with the determined privilege level. Thus, a test server is allowed to provision a test profile to an SE even if the test server does not have commercial certification required of an electronic subscriber identity module (eSIM) server that provisions operational profiles. Because the test profile does not include credentials useful for network access, the lower-security test server does not create a risk of improper access to the network of a mobile network operator (MNO). 1. A method comprising: receiving a message including a signature;', 'verifying the signature with a key;', 'receiving profile metadata, wherein the profile metadata includes a profile type;', 'permitting download of a bound profile package (BPP) associated with the profile type; and', 'when installation of the profile type is permitted by a privilege level, 'rejecting download of the BPP.', 'when installation of the profile type is disallowed by the privilege level], 'by a secure element (SE)2. The method of claim 1 , further comprising: 'obtaining the key from a non-volatile memory of the SE, wherein the key was burned into the non-volatile memory at a time of SE manufacture.', 'before the verifying the signature with the key3. The method of claim 2 , wherein the privilege level is associated with the key.4. The method of claim 3 , wherein:i) the key is included in a plurality of keys,ii) a first key of the plurality of keys is associated with a high privilege level including installation of operational profiles,iii) a second key of the plurality of ...

METHOD AND ARRANGEMENT IN A TELECOMMUNICATION SYSTEM

A method in a User Equipment (UE) of an Evolved Packet System (EPS) establishes a security key (K_eNB) for protecting Radio Resource Control/User Plane (RRC/UP) traffic exchanged with a serving eNodeB. The method comprises sending a 1. A method in a base station for establishing a security key for protecting traffic between a User Equipment (UE) and the base station , the method comprising the following steps:receiving a derived security key from a mobility management entity, andsending, based on the received derived security key, a radio bearer establishment and/or a security configuration to the UE.2. The method of claim 1 , wherein the derived security key is received in an Initial Context Setup Request message.3. The method of claim 1 , wherein sending the radio bearer establishment and a security configuration comprises sending the radio bearer establishment and a security configuration in a same message or in different messages.4. The method of claim 1 , wherein the derived security key is derived based on a Non-Access Stratum (NAS) uplink sequence number and Access Security Management Entity-key.5. The method of claim 1 , further comprising sending an initial context setup complete message to the mobility management entity.6. A base station for establishing a security key for protecting traffic between a User Equipment (UE) and the base station claim 1 , the base station comprising:a receiver configured to receive a derived security key from a mobility management entity; anda transmitter configured to send, based on the received derived security key, a radio bearer establishment and/or a security configuration to the UE.7. The base station of claim 6 , wherein the derived security key is received in an Initial Context Setup Request message.8. The base station of claim 6 , wherein the transmitter is further configured to send the radio bearer establishment and the security configuration in a same message or in different messages.9. The base station of . ...

Network Connection Method, Mobile Terminal, Electronic Device, and Graphical User Interface

The present disclosure provides a network connection method, a mobile terminal, and an electronic device. The method includes: sending a wireless signal, detecting the wireless signal and indicating that the electronic device is discovered by the electronic device; obtaining a network connection confirm operation and providing a notification to the electronic device by the mobile terminal; decreasing, by the electronic device, a signal transmit power; prompting a user to move closer to the electronic device, indicating a detected signal strength of the electronic device, and sending a wireless network key to the electronic device by the mobile terminal, when a preset condition is met in a process in which the mobile terminal moves closer to the electronic device; and increasing, by the electronic device, the signal transmit power, and connecting to a wireless network. This method and apparatus can be used for artificial intelligence, smart home, Internet of Things, etc. 1. A method for connecting an electronic device to a wireless network with cooperation of a mobile terminal , wherein the method comprises:sending, by the electronic device, a wireless signal;detecting, by the mobile terminal, the wireless signal sent by the electronic device, and indicating that the electronic device is discovered;obtaining, by the mobile terminal, a network connection confirm operation performed on the mobile terminal, and providing a notification to the electronic device;decreasing, by the electronic device, a signal transmit power after receiving the notification;prompting, by the mobile terminal, a user to hold the mobile terminal and move closer to the electronic device; andindicating a detected signal strength of the electronic device in real time;sending, by the mobile terminal, a wireless network key to the electronic device when a preset condition is met and when the mobile terminal moves closer to the electronic device;increasing, by the electronic device, the signal ...

METHOD AND APPARATUS FOR ESTABLISHING TRUSTED CHANNEL BETWEEN USER AND TRUSTED COMPUTING CLUSTER

Some embodiments of the present specification provide a method and an apparatus for establishing a trusted channel between a user and a trusted computing cluster. According to the method, when a user wants to establish a trusted channel with a trusted computing cluster, the user only negotiates a session key with any first trusted computing unit in the cluster to establish the trusted channel. Then, the first trusted computing unit encrypts the session key using a cluster key common to the trusted computing cluster to which the first trusted computing unit belongs, and sends the encrypted session key to a cluster manager. The cluster manager transmits the encrypted session key in the trusted computing cluster, so that other trusted computing units in the cluster obtain the session key and join the trusted channel. Thus, the user establishes a trusted channel with the entire trusted computing cluster. 1. A method for establishing a trusted channel between a user and a trusted computing cluster , the trusted computing cluster including a plurality of trusted computing units each maintaining a first cluster key , the method comprising:obtaining a first session key through negotiation with a user, and establishing a first trusted channel with the user, the first session key configured to encrypt data to be transmitted through the first trusted channel;encrypting the first session key using the first cluster key to obtain a first encrypted key; andcausing the first encrypted key to be sent to a second trusted computing unit in the trusted computing cluster.2. The method according to claim 1 , wherein the obtaining the first session key through negotiation with the user includes:sending a first public key of a first key pair of the first trusted computing unit to the user, the first key pair including the first public key and a first private key, and obtaining a user public key provided by the user; andgenerating the first session key based on the first public key, the ...

SYSTEM AND METHOD FOR IMPLEMENTING A TWO-SIDED TOKEN FOR OPEN AUTHENTICATION

A system and method for implementing a two-side token for OAUTH are described. A first request for access by a partner app server to user account information owned by a host server is received at a host auth server. Upon receiving authorization to share the user account information, a response is returned to the partner app sever. The response includes an access token. In response to returning the response to the partner app server, an event is written to an event queue. The event provides an indication that the request for access was received and that the corresponding response with the access token was returned. The event, when read by a host app server, instructs the host app server to submit a second request to a partner auth server for a reciprocal access token. 1. A host authorization server system for implementing a two-side token for open authorization (OAUTH) comprising:a non-transitory memory storing instructions; and determining, in response to a first request from a partner application server for access to a first user account information for a user account maintained by a host server, an authorization to share the first user account information by the host server, wherein the first user account information includes multiple levels of access;', 'returning, upon determining the authorization to share the first user account information, an access token to the partner application server, wherein the access token is usable by the partner application server to access the first user account information at a first level of the multiple levels of access; and', 'causing, in response to returning the access token to the partner application server, a submission, from a host application server associated with the host authorization server to a partner authorization server associated with the partner application server, a second request for a reciprocal access token, wherein the reciprocal access token is usable by the host application server to access a second user ...

TECHNOLOGIES FOR LOW-LATENCY CRYPTOGRAPHY FOR PROCESSOR-ACCELERATOR COMMUNICATION

Technologies for secure data transfer include a computing device having a processor, an accelerator, and a security engine, such as a direct memory access (DMA) engine or a memory-mapped I/O (MMIO) engine. The computing device initializes the security engine with an initialization vector and a secret key. During initialization, the security engine pre-fills block cipher pipelines and pre-computes hash subkeys. After initialization, the processor initiates a data transfer, such as a DMA transaction or an MMIO request, between the processor and the accelerator. The security engine performs an authenticated cryptographic operation for the data transfer operation. The authenticated cryptographic operation may be AES-GCM authenticated encryption or authenticated decryption. The security engine may perform encryption or decryption using multiple block cipher pipelines. The security engine may calculate an authentication tag using multiple Galois field multipliers. Other embodiments are described and claimed. 1. An apparatus comprising:one or more processors coupled to or host one or more of a security engine circuitry, an initialization manager circuitry, and a transfer manager circuitry, wherein:the initialization manager circuitry to initialize the security engine circuitry with an initialization vector and a secret key;the transfer manager circuitry to initiate a data transfer operation between a trusted execution environment and an accelerator device in response to initialization of the security engine circuitry, wherein initiating the data transfer operation includes initiating a memory-mapped input/output (I/O) operation with an input data block; andthe security engine circuitry to perform an authenticated cryptographic operation associated with the data transfer operation.2. The apparatus of claim 1 , wherein in performing the authenticated cryptographic operation claim 1 , the security engine circuitry is further to:perform a cryptographic operation with a block ...

TRUSTED KERNEL STARTING METHOD AND APPARATUS

A trusted kernel starting method and apparatus are provided. The method includes: starting a security boot module boot loader; invoking the boot loader to measure, according to a first security algorithm, whether a platform configuration register (PCR) partition is trusted; if the PCR partition is trusted, invoking the boot loader to read kernel code into a memory, and invoking the boot loader to measure, according to a first complete algorithm and a kernel code standard measurement value prestored in the PCR partition, whether the kernel code is trusted; initializing, if the kernel code is trusted, the kernel code to trigger an initialized kernel to measure, according to a second complete algorithm, whether the boot loader is trusted; and starting the kernel if the boot loader is trusted. Kernel starting security is improved. 1. A trusted kernel starting method , comprising:starting a security boot loader;invoking the boot loader to measure, according to a first security algorithm, whether a platform configuration register (PCR) partition is trusted;invoking, if the PCR partition is trusted, the boot loader to read kernel code into a memory, and invoking the boot loader to measure, according to a first complete algorithm and a kernel code standard measurement value prestored in the PCR partition, whether the kernel code is trusted;initializing, if the kernel code is trusted, the kernel code to trigger an initialized kernel to measure, according to a second complete algorithm, whether the boot loader is trusted; andstarting the kernel if the boot loader is trusted.2. The trusted kernel starting method according to claim 1 , further comprising:acquiring a PCR partition standard measurement value prestored in an environment (ENV) partition; andwherein the invoking the boot loader to measure, according to the first security algorithm, whether the PCR partition is trusted comprises:invoking the boot loader to calculate a PCR partition actual measurement value according ...

GROUP BASED BOOTSTRAPPING IN MACHINE TYPE COMMUNICATION

A group key is computed based on unique identifications of each member device of a group of machine type communication devices, wherein communication with a network application function is performed by using a session identification of the group, and/or by using a session identification of a member device of the group, generated based on the session identification of the group and the unique identification of the member device. 1. A method comprising:computing a group key based on unique identifications of each member device of a group of machine type communication devices,wherein communication with a network application function is performed by using a session identification of the group, and/or by using a session identification of a member device of the group, generated based on the session identification of the group and the unique identification of the member device.2. The method of claim 1 , comprising:recognizing that a request has been received from a member device of the group which acts as a gateway device performing authentication and key agreement procedure for the group, wherein the computing of the group key is performed in response to the request;computing an authentication vector from the group key;computing a serial of individual keys for each member device of the group; andsending the authentication vector, the individual keys and a random value to a service function.3. The method of claim 1 , comprising:sending a random value to member devices of the group not acting as a gateway device performing authentication and key agreement procedure for the group, wherein the random value is generated in the context of an authentication vector computed from the group key; andreceiving key materials from the member devices computed based on the random value and the unique identifications of the member devices,wherein the group key is computed from the key materials of the member devices and the unique identification of the gateway device.4. The method of ...

Method and system for encrypting and decrypting a facial segment in an image

This disclosure relates to method and system for encrypting and decrypting a facial segment in an image with a unique server key. The method includes receiving an image from one of a plurality of users. The image includes a plurality of facial segments. The method further includes, for each facial segment from the plurality of facial segments, identifying a unique user associated with the facial segment using a facial recognition algorithm, encrypting the facial segment with a unique server key, generating a protection frame, unlockable with the unique server key, to cover the facial segment, and decrypting the facial segment while rendering the image for at least one of the plurality of users upon receiving the unique server key from the at least one of the plurality of users.

COMPUTER IMPLEMENTED SYSTEM AND METHOD FOR STORING DATA ON A BLOCKCHAIN

A method of storing data on a blockchain, such as the Bitcoin blockchain, is disclosed. The method comprises generating a plurality of blockchain transactions, wherein a plurality of the blockchain transactions each store therein a respective part (, ) of first data to be stored on the blockchain and second data () indicating that the parts of the first data are related to each other. 1. A method of storing data on a blockchain , the method comprising generating a plurality of blockchain transactions , wherein a plurality of said blockchain transactions each store therein a respective part of first data to be stored on the blockchain and second data indicating that said parts of said first data are related to each other.2. A method according to claim 1 , wherein a respective digital signature is applied to said parts of said first data.3. A method according to claim 2 , wherein at least some of said parts of said first data are each digitally signed by means of a single private key of a public-private key pair of a cryptography system.4. A method according to claim 2 , wherein at least some of said parts of said first data are each digitally signed by means of a respective private key of a public-private key pair of a cryptography system claim 2 , and private keys of said respective public-private key pairs are related to each other.5. A method according to claim 2 , wherein at least one of said digital signature is based on a cryptography system having a public-private key pair claim 2 , wherein a private key of the public-private key pair is based on a plurality of prime numbers and a corresponding public key is based on a product of a plurality of said prime numbers.6. A method according to claim 5 , wherein at least one said digital signature is a Rabin signature.7. A method according to wherein the second data includes data relating to recombination of said first data.8. A method according to wherein the first ...

AUTHENTICATION AND AUTHORIZATION IN PROXIMITY BASED SERVICE COMMUNICATION USING A GROUP KEY

A method of performing authentication and authorization in Proximity based Service (ProSe) communication by a requesting device which sends a request of a communication and a receiving device which receives the request from the requesting device, the method including deriving session keys Kpc and Kpi from an unique key Kp at the requesting and receiving devices, using the session keys Kpc and Kpi for ProSe communication setup and direct communication between the requesting and receiving devices, starting the direct communication with the requesting and receiving devices. The key Kpc is confidentiality key and the key Kpi is integrity protection key. 1. A first User Equipment (UE) for direct communication , the first UE comprising:at least one processor; and receive, from a network node, a message including a group key,', 'receive, from a second UE, an identifier related to the group key, wherein the identifier is received by the second UE from the network node,', 'identify the group key based on the identifier,', 'derive a first key and a second key based on the identified group key, and', 'perform the direct communication with the second UE, the direct communication being protected by the first key and the second key., 'at least one memory coupled to the at least one processor, the at least one memory storing instructions that, when executed by the at least one processor, cause the at least one processor to2. The first UE according to claim 1 , wherein the first key or the second key is an encryption key.3. The first UE according to claim 1 , wherein the UE and the second UE support Proximity Services (ProSe).4. The first UE according to claim 1 , wherein the UE and the second UE get an authorization from a network including at least a Proximity Services (ProSe) Function and a ProSe application server.5. A communication method of a first User Equipment (UE) for direct communication claim 1 , the communication method comprising:receiving, from a network node, a ...

Decentralized Token Table Generation

New tokenization tables are derived at intervals in order to increase the security of tokenized data that is transferred between two endpoints. Generation of the new tokenization tables is based on previous tokenization tables, which advantageously allows the generation process to be performed locally at the two endpoints independently of an external tokenization table provider. New tokenization tables can periodically be distributed to the endpoints as a new starting point for derivation. 1. A method for tokenizing data , comprising:generating, by a transmitting endpoint configured to tokenize data using a first token table accessible to both the transmitting endpoint and a receiving endpoint communicatively coupled to the transmitting endpoint, a second token table based on the first token table and a seed value, the second token table mapping one or more input values to different token values than the first token table;tokenizing, by the transmitting endpoint, input data by replacing a portion of the input data with the token value mapped to the portion of the input data by the second token table to produce tokenized data; andproviding, by the transmitting endpoint, the tokenized data and the seed value to a receiving endpoint, the receiving endpoint configured to generate the second token table based on the first token table and the seed value, wherein the receiving endpoint does not have access to the seed value before receiving the seed value from the transmitting endpoint.2. The method of claim 1 , wherein generating the second token table comprises performing a shuffle algorithm to generate a permutation of the token values in the first token table claim 1 , the permutation generated with the pseudo-random number generator and the seed value.3. The method of claim 2 , wherein the pseudo-random number generator is seeded using the seed value.4. The method of claim 1 , wherein the second token table is generated in response to determining that the transmitting ...

KEY MANAGEMENT FOR A RACK SERVER SYSTEM

A system and method for providing security key exchange and management prior to the operating system of the server and also provides for executing various security functions to prevent a virus or malicious software from propagating through the server and the network. The system and method utilize the BIOS firmware and baseboard management controller (BMC), which are more secure since they do not rely on open source code for software plug-ins from the user layer. As a result, a secure code can be created for key management with a globally unique identifier (GUID). The system and method provides for a network manager to easily and flexibly manage multiple security keys for a rack server system. 1. A system comprising:a processor;a baseboard management controller;a unified extensible firmware interface BIOS firmware; anda computer-readable memory storing instructions which, when executed by the processor, causing the processor to perform operations comprising:determining, via the unified extensible interface BIOS firmware, a status of a key management server;requesting a security key from the key management server;receiving the security key from the key management server; andtransmitting the security key to a baseboard management controller and the unified extensible interface BIOS firmware.2. The system of claim 1 , wherein when the status indicates that the key management server is operational claim 1 , transmitting claim 1 , via the unified extensible interface BIOS firmware claim 1 , a command to the baseboard management controller to request the security key from the key management server.3. The system of claim 2 , wherein the command from the baseboard management controller comprises a universally unique identifier.4. The system of claim 2 , wherein the unified extensible interface BIOS firmware polls the baseboard management controller to determine the status of the security key request.5. The system of claim 4 , wherein if the status of the security key request ...

SYSTEMS AND METHODS OF PER-DOCUMENT ENCRYPTION OF ENTERPRISE INFORMATION STORED ON A CLOUD COMPUTING SERVICE (CCS)

The technology disclosed relates to securely encrypting a document. In particular, it relates to accessing a key-manager with a triplet of organization identifier, application identifier and region identifier and in response receiving a triplet-key and a triplet-key identifier that uniquely identifies the triplet-key. Also, for a document that has a document identifier (ID), the technology disclosed relates to deriving a per-document key from a combination of the triplet-key, the document ID and a salt. Further, the per-document key is used to encrypt the document. 1. A computer-implemented method of monitoring and controlling exfiltration of documents stored on a cloud computing service (CCS) , the method including: a cloud computing service (CCS) application programming interface (API) in use; and', 'a function or an activity being performed via the CCS API on a document;, 'using a cross-application monitor to detect'}determining the function or the activity being performed via the CCS API by parsing a data stream based on the CCS API and identifying content in the document being transmitted to the CCS;applying a content inspection rule to find strings and interrelated strings in the content that are subject to content control; andencrypting the document responsive to finding the strings and interrelated strings subject to content control in the parsed stream.2. The computer-implemented method of claim 1 , further including:encrypting the document using a per-document key derived by applying a key derivation function (KDF) to a triplet-key, a document identifier (ID), and a salt.3. The computer-implemented method of claim 2 , further including:providing a triplet of an organization ID of an organization that uses the CCS, a CCS ID, and a region ID as input to a first key-manager; andin response to the input, the first key-manager generating the triplet-key.4. The computer-implemented method of claim 2 , further including:transmitting the encrypted document, ...

Method and apparatus for a blackbox programming system permitting downloadable applications and multiple security profiles providing hardware separation of services in hardware constrained devices

A method, apparatus, article of manufacture, and a memory structure for providing a security infrastructure that permits the programming of limited hardware resources that can accept newly downloaded applications and securely support a very large number of services offered by content providers each have the potential to utilize their own independent CAS/DRM system. The CE device owner can consume content from a variety of sources and enable switching among different and existing CAS/DRM security profiles as required by the content provider applications loaded in CE devices.

Automated Access, Key, Certificate, and Credential Management

Certain embodiments provide means for managing automated access to computers, e.g., using SSH user keys and other kinds of trust relationships. Certain embodiments also provide for managing certificates, Kerberos credentials, and cryptographic keys. Certain embodiments provide for remediating legacy SSII key problems and for automating configuration of SSH keys, as well as for continuous monitoring.

Remote access of transports

An example operation may include one or more of requesting, by a processor of a device, permissions to provide access to a transport to a diagnostic location from a network of a plurality of diagnostic locations, in response to receiving the permissions from the network of the plurality of the diagnostic locations, authenticating the diagnostic location, by the device, providing a pre-stored one-time access key to the transport to the diagnostic location, and receiving, by the device, diagnostics from the diagnostic location.

MANAGING USER-CONTROLLED SECURITY KEYS IN CLOUD-BASED SCENARIOS

A system for managing user-controlled security keys in cloud-based scenarios is provided. In some implementations, the system performs operations comprising receiving an information request from a user device via a network, and generating a database query based at least in part upon the information request. The operations can comprise generating a request for a secret key for decrypting encrypted data when the database query requests the encrypted data and/or generating a request for a secret key for encrypting data when the database query requests to encrypt data. The operations can also comprise providing the request to a security key management entity via a network, receiving secret key information from the security key management entity via the network, and using the secret key information to form decrypted data or encrypted data. Related systems, methods, and articles of manufacture are also described. 1. A system comprising:at least one hardware data processor; and generating, at a database server, a request for a secret key for decrypting encrypted data when a database query requests the encrypted data;', 'providing, by the database server, the request to a security key management entity via a network;', 'receiving, by the database server, secret key information from the security key management entity via the network; and', 'decrypting, at the database server, the encrypted data using the secret key information to form decrypted data., 'at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising2. The system of claim 1 , wherein the operations further comprise:generating, at the database server, a second request for a secret key for encrypting unencrypted data when the database query requests to encrypt the unencrypted data; andencrypting, at the database server, the unencrypted data using the secret key information to form second encrypted data when the database query requests to encrypt ...

Secure multi-party communication with quantum key distribution managed by trusted authority

Techniques and tools for implementing protocols for secure multi-party communication after quantum key distribution (“QKD”) are described herein. In example implementations, a trusted authority facilitates secure communication between multiple user devices. The trusted authority distributes different quantum keys by QKD under trust relationships with different users. The trusted authority determines combination keys using the quantum keys and makes the combination keys available for distribution (e.g., for non-secret distribution over a public channel). The combination keys facilitate secure communication between two user devices even in the absence of QKD between the two user devices. With the protocols, benefits of QKD are extended to multi-party communication scenarios. In addition, the protocols can retain benefit of QKD even when a trusted authority is offline or a large group seeks to establish secure communication within the group.

MULTIPLE ENCRYPTION KEYS FOR A VIRTUAL MACHINE

A method includes, with a computing system, exiting a context of a virtual machine, the exiting in response to a request from a guest operating system of the virtual machine to switch from a first encryption key identifier for the virtual machine to a second encryption key identifier for the virtual machine. The method further includes, with the computing system, loading the second encryption key identifier into a virtual machine control module of a virtual processor of the virtual machine and after loading the second encryption key identifier, entering the context of the virtual machine. 1. A method comprising:with a virtual machine, receiving a first encryption key identifier, the first encryption key identifier identifying a first encryption key for encryption by the virtual machine;with the virtual machine, requesting a second encryption key identifier, the second encryption key identifier identifying a second encryption key to be used for encryption by the virtual machine;associating the first encryption key identifier with a first process;associating the second encryption key identifier with a second process;executing the first process to cause data to be encrypted using the first encryption key; andexecuting the second process to cause data to be encrypted using the second encryption key.2. The method of claim 1 , further comprising claim 1 , with a computing system claim 1 , exiting a context of the virtual machine claim 1 , the exiting in response to the executing the second process.3. The method of claim 2 , further comprising claim 2 , with a computing system that supports the virtual machine claim 2 , loading the second encryption key identifier into a virtual machine control module associated with the virtual machine.4. The method of claim 3 , wherein the loading is in response to determining that the second encryption key identifier is valid for the virtual machine.5. The method of claim 2 , with the computing system claim 2 , after loading the second ...

MESSAGE DECRYPTION DEPENDENT ON THIRD-PARTY CONFIRMATION OF A CONDITION PRECEDENT

Message decryption dependent on third-party confirmation of a condition precedent is disclosed. A message is encrypted with a message encryption key to form an encrypted message. A message decryption key that is configured to decrypt the encrypted message is encrypted with a key of a first entity to which the message is to be disclosed upon occurrence of a condition precedent to form an encrypted message decryption key. The encrypted message decryption key is encrypted with a key of a second entity configured to confirm the occurrence of the condition precedent to form a double encrypted message decryption key. A condition identifier that identifies the condition precedent is generated. The encrypted message, the double encrypted message decryption key, and the condition identifier are sent to the first entity. 1. A method comprising:encrypting, by a computing device comprising a processor device, a message with a message encryption key to form an encrypted message;encrypting a message decryption key that is configured to decrypt the encrypted message with a key of a first entity to which the message is to be disclosed upon occurrence of a condition precedent to form an encrypted message decryption key;encrypting the encrypted message decryption key with a key of a second entity configured to confirm the occurrence of the condition precedent to form a double encrypted message decryption key;generating a condition identifier that identifies the condition precedent; andsending the encrypted message, the double encrypted message decryption key, and the condition identifier to the first entity.2. The method of further comprising sending a second entity identifier that identifies the second entity to the first entity.3. The method of wherein:encrypting the message decryption key configured to decrypt the encrypted message with the key of the first entity comprises encrypting the message decryption key configured to decrypt the encrypted message with the key of the first ...

Methods, systems, apparatus, and articles of manufacture to manage access to decentralized data lakes

An apparatus to manage a data lake is disclosed. A disclosed example apparatus includes a location selector to select an edge device to store the data lake, a key generator to, in response to an indication that a service is authorized to access the data lake, generate an encryption key corresponding to the data lake and generate a key wrapping key corresponding to the edge device, and a key distributor to wrap the encryption key using the key wrapping key, and distribute the encryption key and the key wrapping key to the edge device, the encryption key to enable the service on the edge device to access the data lake.

SECURELY RETRIEVING ENCRYPTION KEYS FOR A STORAGE SYSTEM

A computer-implemented method according to one embodiment includes receiving at an encryption daemon a key request from a storage device; implementing, by the encryption daemon, a secure communications channel between the encryption daemon and an encryption key server; sending the key request from the encryption daemon to the encryption key server, utilizing the secure communications channel; receiving, from the encryption key server at the encryption daemon, an encrypted response, utilizing the secure communications channel; decrypting, by the encryption daemon, the encrypted response to obtain the requested key, and sending the requested key from the encryption daemon to the storage device. 1. A computer-implemented method , comprising:receiving at an encryption daemon a key request from a storage device;implementing, by the encryption daemon, a secure communications channel between the encryption daemon and an encryption key server;sending the key request from the encryption daemon to the encryption key server, utilizing the secure communications channel;receiving, from the encryption key server at the encryption daemon, an encrypted response, utilizing the secure communications channel;decrypting, by the encryption daemon, the encrypted response to obtain the requested key; andsending the requested key from the encryption daemon to the storage device.2. The computer-implemented method of claim 1 , wherein the storage device includes a physical tape drive.3. The computer-implemented method of claim 1 , wherein the storage device includes a disk cache controller.4. The computer-implemented method of claim 1 , wherein the key request includes a request for an encryption key.5. The computer-implemented method of claim 1 , wherein the key request is received from the storage device using a hardwired connection.6. The computer-implemented method of claim 1 , wherein the key request is received from the storage device using an internal network connection claim 1 , ...

DATA STREAM IDENTITY

Systems and methods for managing data stream identity are provided. Ownership information regarding a data stream may be analyzed to identify at least one owner. The data stream may be filtered to identify at least one portion that is associated with the identified owner. A unique identifier may be assigned to the identified portion. The identified portion may be stored in memory in association with the assigned unique identifier and information regarding the identified owner. Access to the identified portion may be controlled based on settings set by the identified owner. 1. A method for managing data stream identity , the method comprising:analyzing ownership information regarding a data stream to identify at least one owner;filtering the data stream to identify at least one portion that is associated with the identified owner;assigning a unique identifier to the identified portion;storing the identified portion in memory in association with the assigned unique identifier and information regarding the identified owner; andcontrolling access to the identified portion based on settings set by the identified owner.2. The method of claim 1 , wherein the unique identifier is a private key.3. The method of claim 2 , wherein the private key is based on public key infrastructure (PKI).4. The method of claim 2 , wherein controlling access to the identified portion includes encrypting the identified portion.5. The method of claim 1 , further comprising generating the unique identifier.6. The method of claim 5 , further comprising registering the identified owner in association with entity identification information in memory claim 5 , wherein the unique identifier is generated upon registration.7. The method of claim 5 , wherein the identified owner is not associated with entity identification information in memory claim 5 , and wherein the unique identifier is a nonce identifier.8. The method of claim 1 , wherein the identified owner is associated with a plurality of ...

DOWNLOADABLE SECURITY AND PROTECTION METHODS AND APPARATUS

Methods and apparatus for control of data and content protection mechanisms across a network using a download delivery paradigm. In one embodiment, conditional access (CA), digital rights management (DRM), and trusted domain (TD) security policies are delivered, configured and enforced with respect to consumer premises equipment (CPE) within a cable television network. A trusted domain is established within the user's premises within which content access, distribution, and reproduction can be controlled remotely by the network operator. The content may be distributed to secure or non-secure “output” domains consistent with the security policies enforced by secure CA, DRM, and TD clients running within the trusted domain. Legacy and retail CPE models are also supported. A network security architecture comprising an authentication proxy (AP), provisioning system (MPS), and conditional access system (CAS) is also disclosed, which can interface with a trusted authority (TA) for cryptographic element management and CPE/user device authentication. 167.-. (canceled)68. Computerized apparatus for use in a content delivery network having a plurality of computerized client devices associated therewith , the computerized apparatus comprising:a computerized server apparatus, the computerized server apparatus configured to establish a security boundary around at least a portion of a requesting one of the plurality of computerized client devices, the security boundary allowing for the protection of both content and software images included therein;a digital content protection apparatus in communication with the computerized server apparatus, the digital content protection apparatus configured to generate at least one software image based on an evaluation; anda media provisioning apparatus in communication with the computerized server apparatus and the digital content protection apparatus, the media provisioning apparatus configured to initiate transmission of the at least one ...