СПОСОБ И УСТРОЙСТВО ДЛЯ ХРАНЕНИЯ И ВОССТАНОВЛЕНИЯКРИПТОГРАФИЧЕСКОГО СЕКРЕТНОГО КЛЮЧА

Изобретение относится к криптографическим системам. Техническим результатом является создание способа и устройства для хранения и восстановления секретного ключа в криптографической системе посредством параметризации секретного ключа, при которой используется меньший объем памяти и обеспечивается более высокая эффективность вычислений. Технический результат достигается тем, что устройство для восстановления секретного ключа криптосистемы содержит процессор, объем энергонезависимой памяти, оперативно связанной с упомянутым процессором, и набор параметров секретного ключа, хранимый в упомянутом объеме энергонезависимой памяти с использованием меньшего объема памяти, чем для полного набора параметров, используя китайскую теорему об остатках (КТО) {p,q,dp,dq,v}, и обеспечивающий более высокую эффективность вычислений, чем минимальный набор параметров {p,q}, причем секретный ключ может быть восстановлен из упомянутого хранимого набора параметров секретного ключа. 5 н. и 64 з.п. ф-лы, 8 ил.

ЗАЩИТА ДАННЫХ С ПЕРЕВОДОМ

Изобретение относится к области шифрования данных. Технический результат - обеспечивают механизм для передачи и маршрутизации зашифрованного идентификатора/номера счета через сеть обработки без необходимости обновления существующей инфраструктуры маршрутизации для обработки зашифрованных значений, что улучшает безопасность идентификатора/номера счета, так как идентификатор/номер счета может оставаться зашифрованным, пока сообщение запроса авторизации проходит через узлы сети при обработке. Способ защиты данных, ассоциированных с транзакцией, содержащий этапы, на которых: принимают посредством устройства доступа личный идентификационный номер (PIN) и уязвимые данные, включающие в себя идентификатор счета; шифруют посредством устройства доступа PIN, при этом шифрование PIN использует первый вариант ключа шифрования, основанный на исходном ключе; шифруют посредством устройства доступа уязвимые данные, включающие в себя идентификатор счета, при этом зашифрованный идентификатор счета имеет тот ...

ЗАЩИЩЕННОЕ УПРАВЛЕНИЕ КЛЮЧАМИ

Изобретение относится к вычислительной технике. Технический результат заключается в предоставлении возможности администрирования данных без возможности их просмотра. Облачная вычислительная система, обеспечивающая защищенное управление ключами, содержит вычислительную фабрику, содержащую первое множество вычислительных машин, причем каждая из первого множества вычислительных машин выполняет первый управляющий анклав и анклав арендаторов, и фабрику ключей, содержащую второе множество вычислительных машин, причем каждая из второго множества вычислительных машин выполняет второй управляющий анклав. 3 н. и 12 з.п. ф-лы, 3 ил.

Способ анонимного обмена данными в клиент-серверной архитектуре

Изобретение относится к вычислительной технике. Технический результат заключается в обеспечении анонимизации данных клиента при передаче данных в клиент-серверной архитектуре. Способ передачи данных в клиент-серверной архитектуре содержит этапы, на которых разделяют структуру данных на клиенте, предназначенную для отправки серверу, на по меньшей мере две подструктуры; отправляют первую подструктуру от клиента к серверу через узел сети со средством анонимизации, преобразуя данные этой подструктуры средством анонимизации, при этом указанный узел расположен в региональной сети, отличной от сети, в которой расположен сервер, и не находится в одном Интранете с сервером или клиентом; отправляют вторую подструктуру от клиента на узел сети со средством хранения, расположенный в региональной сети, отличной от сети, в которой расположен сервер, и не находящийся в одном Интранете с сервером или клиентом; получают сервером от узла сети со средством хранения вторую подструктуру; объединяют полученные ...

ФОРМИРОВАНИЕ КЛЮЧА В ЗАВИСИМОСТИ ОТ ПАРАМЕТРА

Изобретение относится к области вычислительной техники для аутентификации пользователя. Технический результат заключается в повышении эффективности аутентификации пользователя. Технический результат достигается за счёт получения первого криптографического ключа; использования первого криптографического ключа и множества идентификаторов ограничения, в котором идентификатор ограничения множества идентификаторов ограничения указывает по меньшей мере одно из: идентификационную информацию зоны ключа из множества зон ключа, где указанный ключ может быть использован, географическое положение, время или идентичность пользователя, для получения второго криптографического ключа. 3 н. и 14 з.п. ф-лы, 24 ил.

Способ передачи конфиденциальных данных

Изобретение относится к вычислительной технике. Технический результат заключается в обеспечении отправки критических данных на сервер. Способ отправки критических данных на сервер, в котором разделяют на клиенте структуру данных, предназначенную для отправки серверу, на подструктуру, содержащую критические данные (далее КД), подструктуру, не содержащую КД, подструктуру, содержащую КД, дополнительно разделяют на клиенте по меньшей мере на две подструктуры и отправляют полученные подструктуры последовательно на сервер через узел со средством преобразования, где средством преобразования узла осуществляют преобразование каждой полученной подструктуры данных, отправляют подструктуру, не содержащую КД, на сервер, объединяют на сервере подструктуры, разделенные ранее, в структуру данных. 15 з.п. ф-лы, 19 ил.

ФОРМИРОВАНИЕ КЛЮЧА В ЗАВИСИМОСТИ ОТ ПАРАМЕТРА

Изобретение относится к области аутентификации пользователей. Технический результат – повышение эффективности аутентификации. Способ аутентификации для обеспечения доступа к одному или более вычислительным ресурсам провайдера вычислительных ресурсов содержит этапы, на которых принимают сообщение и подпись сообщения от стороны аутентификации, формируют частично на основании принятого сообщения ожидаемую подпись по меньшей мере путем вызова хэш-функции кода аутентификации сообщений множество раз таким образом, что один вызов хэш-функции кода аутентификации сообщений включает в себя ввод в хэш-функцию кода аутентификации сообщений, который основан по меньшей мере частично на секретном сертификате, совместно используемом со стороной аутентификации, причем секретный сертификат принят от главного источника ключей и соответствует зоне ключа, один другой вызов хэш-функции кода аутентификации сообщений включает в себя результат предыдущего вызова хэш-функции кода аутентификации сообщений в качестве ...

СИСТЕМА И СПОСОБ ДЛЯ РАСПРОСТРАНЕНИЯ ОСНОВАННОГО НА ИДЕНТИФИКАЦИОННОЙ ИНФОРМАЦИИ КЛЮЧЕВОГО МАТЕРИАЛА И СЕРТИФИКАТА

БЕЗОПАСНЫЙ ТРАНСПОРТ ЗАШИФРОВАННЫХ ВИРТУАЛЬНЫХ МАШИН С НЕПРЕРЫВНЫМ ДОСТУПОМ ВЛАДЕЛЬЦА

ЗАЩИЩЕННОЕ И КОНФИДЕНЦИАЛЬНОЕ ХРАНЕНИЕ И ОБРАБОТКА РЕЗЕРВНЫХ КОПИЙ ДЛЯ ДОВЕРЕННЫХ СЕРВИСОВ ВЫЧИСЛЕНИЯ И ДАННЫХ

... 1. Способ управления данными резервной копии, содержащий этапы, на которыхпринимают 400, посредством по меньшей мере одного вычислительного устройства в первой области управления от по меньшей мере одного вычислительного устройства во второй области управления, шифрованные данные, сформированные путем шифрования данных полной резервной копии для заданного набора данных по меньшей мере одного вычислительного устройства во второй области управления согласно по меньшей мере одному алгоритму поискового шифрования на основе информации криптографических ключей,принимают 410, посредством по меньшей мере одного вычислительного устройства в первой области управления от по меньшей мере одного вычислительного устройства во второй области управления, шифрованные метаданные, сформированные путем анализа данных полной резервной копии и шифрования выхода анализа на основании информации криптографических ключей,принимают 420 данные секрета, позволяющие осуществлять видимый доступ к шифрованным данным, ...

ФОРМИРОВАНИЕ КЛЮЧА В ЗАВИСИМОСТИ ОТ ПАРАМЕТРА

... 1. Компьютерно-реализуемый способ предоставления услуг, содержащий:под управлением одной или более компьютерных систем, функционирующих на основе выполняемых команд,прием от стороны аутентификации электронной кодированной информации, содержащей сообщение, подпись сообщения и набор из одного или более ограничений относительно ключей, полученных на основе совместно используемого со стороной аутентификации секретного сертификата, причем подпись может быть определена путем применения хэш-функции кода аутентификации сообщений к сообщению, секретному сертификату и набору из одного или более ограничений, а также может быть неопределяемой при наличии только хэш-функции кода аутентификации сообщений без набора из одного или более ограничений;получение ключа, сгенерированного, по меньшей мере, частично, при помощи, по меньшей мере, поднабора из набора из одного или более ограничений;вычисление при помощи одной или более компьютерных систем значения хэш-функции кода аутентификации сообщений посредством ...

Gesicherte Module unter Verwendung eindeutiger Identifikationselemente

Verschiedene Ausführungsformen der Erfindung betreffen gesicherte Systeme und Module und genauer Systeme, Vorrichtungen und Module zum Erzeugen und Anwenden von Identifikationselementen, die eindeutig mit Modulen oder Elementen verknüpft sind. Diese eindeutigen Identifikationselemente sehen eine verbesserte, statistisch zufällige Quelle vor, von der Schlüssel abgeleitet werden können. Die Anwendung dieser Schlüssel über verschiedene Architekturen führt zu einer Verbesserung bei der Sicherheit von Daten, die in einem System ausgetauscht werden.

Verriegelungs- und Entriegelungssystem und Schlüsseleinheit

Ein Verriegelungs- und Entriegelungssystem (1) beinhaltet ein mobiles Endgerät (20) und eine in einem Fahrzeug oder einer Einrichtung vorgesehene Schlüsseleinheit (12). Das mobile Endgerät (20) beinhaltet eine Übertragungseinheit, die erste Authentisierungsinformationen und ein erstes Anforderungssignal an die Schlüsseleinheit (12) überträgt. Die Schlüsseleinheit (12) beinhaltet eine Empfangseinheit, die die ersten Authentisierungsinformationen und das erste Anforderungssignal von dem mobilen Endgerät (20) empfängt, eine erste Authentisierungseinheit (1245), die eine Authentisierung des mobilen Endgeräts (20) basierend auf den ersten Authentisierungsinformationen in einem Fall durchführt, in dem die Authentisierungsinformationen empfangen wurden, eine erste Authentisierungseinheit (1245), die die Authentisierung des mobilen Endgeräts (20) in einem Fall, in dem die erste Authentisierungseinheit (1245) die Authentisierung des mobilen Endgeräts (20) einmal basierend auf den ersten Authentisierungsinformationen ...

Technologien zum Verwalten einer flexiblen Host-Schnittstelle eines Netzwerkschnittstellen-Controllers

Technologien zum Verarbeiten von Netzwerkpaketen durch eine Host-Schnittstelle eines Netzwerkschnittstellen-Controllers (NIC) einer Computervorrichtung. Die Host-Schnittstelle ist dafür konfiguriert, durch eine Symmetric Multi-Purpose (SMP)-Anordnung der Host-Schnittstelle eine Nachricht aus einer Nachrichtenwarteschlange der Host-Schnittstelle abzurufen und durch einen Prozessorkern von mehreren Prozessorkernen der SMP-Anordnung die Nachricht zu verarbeiten, um eine Operation mit langer Latenz zu identifizieren, die an mindestens einem Abschnitt eines Netzwerkpaketes, das mit der Nachricht verknüpft ist, ausgeführt werden soll. Die Host-Schnittstelle ist des Weiteren dafür konfiguriert, eine andere Nachricht zu generieren, die einen Hinweis auf die identifizierte Operation mit langer Latenz sowie einen nächsten Schritt enthält, der nach Vollendung ausgeführt werden soll. Zusätzlich ist die Host-Schnittstelle dafür konfiguriert, die andere Nachricht zu einem entsprechenden Hardwareeinheiten-Disponierer ...

Managing encryption keys in a computer system

Password-based generation and management of secret cryptographic keys

Device key security

Method and apparatus to generate zero content over garbage data when encryption parameters are changed

Securely storing and access data

A method of allowing members of a group to access a plurality of data blocks stored at one or more storage locations, where each data block is associated with at least one of the members. The method comprises providing each of the group members with a shared secret (group key), storing at a storage location, in association with each data block, a tag, the tag having been generated using said shared secret and an identity of the member associated with the data block, sending a request from a group member to a storage location, the request containing the tag of another group member, and upon receipt of said request at the storage location, identifying said tag and sending to the requesting member the data block associated with the tag.

Security chip

Two kinds of security chip having a security interface are provided. One kind of the security chip comprises a processor module, a encrypt/decrypt module, a memory module, a power detecting module and a security I/O module, and all of the modules are connected with each other by a internal bus in the security chip; the other kind of the security chip comprises a processor module, a encrypt/decrypt module, a memory module, a power detecting module and a I/O interface module, all of the modules are connected with each other by the internal bus in the security chip, wherein, the security chip also comprises a security input module, a security output module and a south bridge interface module, and all of the modules are connected with each other by the internal bus in the security chip. With the security chip provided by the present invention, it is possible to encrypt/decrypt the I/O information of a information processing device, ensure the I/O information safety, thus prevent the information ...

System and method for key recovery

Data transfer system

A data transfer system comprising a host device and a data transfer device. The host device generates an encryption key or a decryption key based upon information unique to a removable data storage item onto which data are to be stored or from which data are to be retrieved. The encryption key or decryption key is the delivered by the host device to the data transfer device. Data to be stored to the removable data storage item or alternatively data retrieved from the removable data storage item are received by the data transfer device, which encrypts or decrypts the data using the encryption key or decryption key received from the host device. The main embodiment relates to the removable data storage item being a tape cartridge and the data transfer device being a tape drive. The unique information may be a tape cartridge serial number and the tape drive may maintain a database of unique information for each of a plurality of tape cartridges in a storage system. The host device may further ...

Method for secure data management in a computer network

Method of managing private Cryptographic keys

Secure communication in a nondeterministic network

Protecting personal information held by an Internet Service Provider

A service subscriber s personal details are protected from malicious attacks, e.g. by hackers . Real personal details of the user 10, e.g. an email address, password or credit-card number, are received from the service providerâ s system 100 over a network. Virtual personal details are generated based on the real personal details, preferably at a location 230 other than that of the service providerâ s system, and stored 120 on the service providerâ s system. The real personal details are encrypted and the encrypted details are stored 240 at a location other than that of the service provider. The real personal details are used in a transaction or operation, carried out by the service providerâ s system, at a location other than that of the service providerâ s system, e.g. to send email 130, 250 without the userâ s presence. In an embodiment, real personal details of a registered subscriber are used to regenerate virtual personal details for comparison with virtual details previously stored ...

Encrypted key stretching and checking using header, metadata or filenames

Performing key stretching on the security information to compute a key associated with the security information, computing a first check value associated with the key, and storing in at least one of a header, metadata, or filename with the encrypted file. The security information may be a passphrase or password to which salt is added, the check code may be stored as ASCII text in the filename. The method may help to reduce risk of rainbow tables being used on hashed encrypted passphrases. The check may be used in later user access to the file for verification.

Password-based generation and management of secret cryptographic keys

For password-based generation of a secret cryptographic key, a secret user value is provided at a user computer and a secret server value is provided at a server together with a check value (VC) based on the secret user value (S) and a user password (P). In response to input of a password (P) at the user computer, the user computer encodes the secret user value and the input password to produce a first value (V1) corresponding to the check value, and communicates this to the server via a network. In response, the server compares the first value and the check value to check whether the input password equals the user password. If so, the server encodes the first value and the secret server value (SK) to produce a second value (V2) and communicates this to the user computer. In response, the user computer generates the secret cryptographic key (K) by encoding the second value, the input password and the secret user value.

Data transfer device

Method for secure data management in a computer network

A set of servers for "machine-to-machine" communications using public key infrastructure

Data protection

A system comprising at least one IoT (Internet of Things) sensor, a database (DB) and one or more users connected via networks. The DB creates manufacturer and user public/private key pairs Mpub/Mpri and Upub/Upri respectively. Mpub is sent to the sensor 100/104 and Upri is sent to the user 102. Mpri and Upub are stored by the DB. The DB also stores user/sensor ownership claims. The sensor creates a first ‘readings key’ Saes (preferably a symmetrical key, preferably an AES (Advanced Encryption Standard) key) encrypts it with Mpub and transmits it to the DB 108, preferably with a sensor ID. The DB validates this message and, if successful, encrypts Upub using Saes and transmits it to the sensor 110. The sensor decrypts Upub, creates a second ‘readings key’ Raes encrypts it with Upub and transmits it to the DB 112. Subsequently sensor readings are encrypted with Raes and transmitted to the DB 114. Upon request the DB transmits the encrypted Raes and readings to the user, who decrypts Raes ...

Secure smartphone based access and start authorization system for vehicles

Securely transferring user information between applications

Securely storing and accessing data

Secure transfer of data between internet of things devices

Encryption techniques

A portable encryption format wraps encrypted files in a self-executing container that facilitates transparent, identity-based decryption for properly authenticated users while also providing local password access to wrapped files when identity-based decryption is not available.

Cryptographic key, or other secret material, recovery

Mobile device policy enforcement

Portable data stack holder

End-to-end encryption and backup in data protection environments

Software encryption

A device, requesting device, method and computer program

Secure secret recovery

A secret is sliced into a number of encrypted slices. The encrypted slices can be distributed amongst members of a group. The encrypted slices make recovery of the secret possible, but a group authority key is required for decryption. Thus, a number of slices are necessary, but still not sufficient, to recover the secret.

Method and apparatus for securing memory modules

A memory system for storing data that includes providing a memory module having one or more memory devices and a voltage regulator for controlling voltage levels supplied to the one or more memory devices, wherein the voltage regulator has a first state that permits write and read operations with the one or more memory devices, and a second state where the voltage regulator prevents at least read operations with the one or more memory devices the system configured to store an encryption key in ROM on the voltage regulator; copy the encryption key value from the ROM to a voltage regulator register; set a voltage regulator encryption timer for a period of time; and transition the voltage regulator to the second state in response to the voltage regulator encryption timer expiring.

Security management for networked client devices using a distributed ledger service

A method is implemented in a distributed ledger system storing security-related information for a plurality of network-enabled devices 10, such as Internet-of-Things (IoT) client devices or smart devices. An association is stored between one of the network-enabled devices 10 and an administrator device 20, a request 705 is received over a network to add an identified user computing device 21 as a user device for the network-enabled device, and it is determined that the request is authorized by the administrator device, possibly by requesting confirmation 710 and obtaining confirmation by receiving permissions 725 for the user device. A transaction or function call is executed 750 to add a record to the distributed ledger associating the user computing device as a user-device for the network-enabled device. The user and administrator devices may be mobile communications devices such as smartphones. In a further method (see Fig. 11), a record is maintained in the distributed ledger for a ...

Cryptographic system and method with key escrow feature

Cryptographic system and method with key escrow feature.

The invention provides a cryptographic system and method with key escrow feature that uses a method for verifiably splitting users, private encryption keys into components and for sending those componets to trusted agents chosen by the particular users, and provides a system that uses modern public key certificate management, enforced by chip device that also self-certifies.

SELECTIVE CONTROL OF GROUPS OF DETONATORS

Cryptographic system and method with key escrow feature

Cryptographic system and method with key escrow feature

SELECTIVE CONTROL OF GROUPS OF DETONATORS

SELECTIVE CONTROL OF GROUPS OF DETONATORS

PROCEDURE AND DEVICE FOR THE SAFE ONE KRYPTOSCHLÜSSELSPEICHERUNG AND - USE.

SYSTEM AND PROCEDURE FOR THE PROTECTION OF KEYS FOR MASTER CODING

ELECTRONIC CASINOSPIELSYSTEM WITH IMPROVED PLAY POSSIBILITIES, AUTHENTIFIZIERUNG AND SECURITY

Method for exchanging encrypted messages

Um ein Einmalschlüsselverfahren zum Austausch verschlüsselter Nachrichten zwischen zwei Kommunikationspartner praktikabler zu machen, ist vorgesehen dass in einer verschlüsselten Nachricht gleichzeitig ein nächster Schlüssel für das Einmalschlüsselverfahren übermittelt wird, der für die nächste zu versendende verschlüsselte Nachricht zum aktuellen Schlüssel für die Verschlüsselung der verschlüsselten Nachricht wird.

PROCEDURE FOR STORING AND DISTRIBUTING CODING KEYS

VERTEILTE DATENSPEICHERUNGSEINRICHTUNG

The invention relates to a distributed data memory unit comprising a plurality of memory units, each having memory means and an access controller, an authentication unit comprising memory means and a validation unit, an execution controller comprising an execution controller module and an access verification unit, the execution controller communicating with the memory units and the authentication unit. At least one unambiguous electronic cipher is stored in the memory means of the authentication unit, the access verification unit has an access controller module and a memory unit. A first unambiguous cipher, which corresponds to a stored cipher of the authentication unit is stored in the memory unit and an assignment table is stored in the memory means of the memory unit. The invention also relates to a method for operating a distributed data memory unit.

Method for exchanging encrypted messages

Um ein Einmalschlüsselverfahren zum Austausch verschlüsselter Nachrichten zwischen zwei Kommunikationspartner praktikabler zu machen, ist vorgesehen dass in einer verschlüsselten Nachricht gleichzeitig ein nächster Schlüssel für das Einmalschlüsselverfahren übermittelt wird, der für die nächste zu versendende verschlüsselte Nachricht zum aktuellen Schlüssel für die Verschlüsselung der verschlüsselten Nachricht wird.

Method of decrypting data stored on a storage device using an embedded encryption/decryption means

Secure file sharing over multiple security domains and dispersed communication networks

System and method of obtaining data in a system in which share volumes of the data are dispersed across a communication network. A first computer requesting the data forwards the request to a second computer. The second computer determines if another computer has reassembled the data, and if so, responds to the first computer that the request cannot be granted. Otherwise, the second computer enables the first computer to access personal information associated only with a user of the first computer that authorizes the user to access the data. The personal information is used to determine reassembly information necessary to reassemble the data. The reassembly information is used to reassemble the data. The personal information may then be destroyed. The reassembled data is dispersed across the communication network. New personal information is created for the user.

Processing data queries in a logically sharded data store

The present disclosure relates to processing data queries on a logically sharded data store. An example method generally includes receiving, from a client device, a query. The query generally comprises one or more data items and wherein at least one of the one or more data items comprises sensitive data. A query processor obtains, from a key management server, a cryptographic key to use to encrypt the record based on data derived from the one or more data items comprising sensitive data and a type of the sensitive data. The query processor generates an encrypted query based on the query and the obtained cryptographic key and executes the encrypted query against the logically sharded database.

Methods and systems for supplying encryption keys

Information distribution system and program for the same

System and method for wireless data protection

Disclosed herein are systems, methods, and non-transitory computer-readable storage media for wireless data protection utilizing cryptographic key management on a primary device and a backup device. A system encrypts a file with a file key and encrypts the file key twice, resulting in two encrypted file keys. The system encrypts each file key differently and stores a first file key on the primary device and transmits one of the encrypted file keys in addition to the encrypted file to a backup device for storage. On the backup device, the system associates the encrypted file key with a set of backup keys protected by a user password. In one embodiment, the system generates an initialization vector for use in cryptographic operations based on a file key. In another embodiment, the system manages cryptographic keys on a backup device during a user password change.

Efficient transmission of cryptographic information in secure real time protocol

Cryptographic system with concealed work factor

Encryption

Access control for encrypted data in machine-readable identifiers

Disclosed are various embodiments for providing access control to the underlying data of a single machine-readable identifier when read by various reader devices. A client device may receive a first cryptographic key associated with a first device profile and a second cryptographic key associated with a second device profile. Data provided through an ingestion process is formatted into at least a first portion of data and a second portion of data, where the first portion of data is intended for a first reader device and the second portion of data is intended for a second reader device. The first portion of data may be encrypted using the first cryptographic key while the second portion of data is encrypted using the second cryptographic key. A machine-readable identifier may be generated using the first portion of data as encrypted and the second portion of data as encrypted.

Parameter based key derivation

PARAMETER BASED KEY DERIVATION Systems and methods for authentication generate keys from secret credentials shared between authenticating parties and authenticators. Generation of the keys may involve utilizing specialized information that, as a result of being used to generate the keys, renders the generated keys usable for a smaller scope of uses than the secret credential. Further, key generation may involve multiple invocations of a function where each of at least a subset of the invocations of the function results in a key that has a smaller scope of permissible use than a key produced from a previous invocation of the function. Generated keys may be used as signing keys to sign messages. One or more actions may be taken depending on whether a message and/or the manner in which the message was submitted complies with restrictions of the key's use.

Secured computer system

There is provided a secured computer system, comprising a processing and memory unit (PMU) operatively connected to an input peripheral and an output peripheral. The PMU comprises a system memory comprising a protected memory and a shared memory, and a processor operatively coupled to the system memory, the processor including a set of instructions for enabling secure data storage and execution via the protected memory. The PMU further comprises an operating system and a group of modules executable by the operating system, each module in the group of modules having a designated secure region to be executed within the protected memory, the group of modules is configured to create authentication and share the input data securely via the shared memory accessible thereto using a composite key, the composite key generated within the group using data sharing mechanism between the designated secure regions enabled by the set of instructions.

Cryptographic system and method with key escrow feature

THIN DOCSIS IN-BAND MANAGEMENT FOR INTERACTIVE HFC SERVICE DELIVERY

Circuitry and processed carried out thereby are disclosed for transmitting video~on-demand and interactive service data and other service data on an MPEG multiplex and sending management and control data including conditional access EMM key data in-band in said MPEG multiplex in MPEG packets having the DOCSIS PID. Processes to send conditional access data by sending ECM messages containing control words encrypted with session keys in said MPEG multiplex and sending EMM messages containing session keys encrypted with private set top box users keys are disclosed. The EMM messages are sent in-band in MPEG packets having the DOCSIS PID to only the set top boxes that request them and which have ordered an encrypted service. A head end with routing/switching capability to route MPEG transport streams encapsulated in IP packets is also disclosed.

SYSTEMS AND METHODS FOR SECURING OFFLINE DATA

Described embodiments provide systems and methods for securing offline data for shared accounts of a shared computing device. Cache files can be generated for a plurality of users of an application executable on the device to store user data corresponding to individual users of the application. An encryption key can be generated for one or more of the cache files and the encryption key can be associated with at least one user of the application. The encryption key can be associated with a user identifier so that the encryption key is not accessible by other users of the computing device. The user data can be encrypted in one of the cache files with the encryption key. The encrypted user data can be presented to a user via the shared computing device based on receipt of a user identifier that enables access to the encryption key.

SYSTEM AND METHOD FOR STORAGE AND RETRIEVAL OF CRYPTOGRAPHIC KEYS

A system and method for managing cryptographic keys on a recipient system. A key ring file is opened on the recipient system and at least a recipient private key of a cryptographic key pair associated with a particular entity is received. The recipient private key is saved in the key ring file such that the key is identifiably associated with the entity.

INITIALIZING, MAINTAINING, UPDATING AND RECOVERING SECURE OPERATION WITHIN AN INTEGRATED SYSTEM EMPLOYING A DATA ACCESS CONTROL FUNCTION

Techniques are provided for initializing, maintaining, updating and recovering secure operation within an integrated system (200). The techniques, which employ a data access control function (240) within the integrated system (200), include authenticating by a current level of software a next level of software within an integrated system. The authenticating occurs before control is passed to the next level of software. Further, an ability of the next level of f software to modify an operational characteristic of the integrated system can be selectively limited via the data access control function (240). Techniques are also provided for initializing secure operation of the integrated system (200), for migrating data encrypted using a first key set to data encrypted using a second key set, for updating software and keys within the integrated system (200), and for recovering integrated system (200) functionality following a trigger event.

EFFICIENT TRANSMISSION OF CRYPTOGRAPHIC INFORMATION IN SECURE REAL TIME PROTOCOL

Efficient transmission of cryptographic information in secure real time protocol. A transmitting terminal may be used to encrypt data with a session key derived from a bit-stream. The bit-stream may be sent with header information to the receiving terminal. To conserve bandwidth, the information may be divided into portions, and each portion transmitted with an encrypted data packet. The receiving terminal may be used to recover the bit-stream from the information portions in the packet headers, and use the bit-stream to derive the session key. The session key may be used to decrypt the data.

SYSTEM AND METHOD FOR SECURE ACCESS MANAGEMENT

An access management system and method provisions credentials to access a resource, such as external web user accounts. Credentials are generated, encrypted and stored. To access the resource, encrypted credentials are decrypted, masked, and served to users, such that they are not visible to the user requiring access. The user is unaware of the credentials used to authenticate and unable to access the provisioned web resources outside set parameters.

MAINTAINING DATA CONFIDENTIALITY IN COMMUNICATIONS INVOLVING VOICE-ENABLED DEVICES IN A DISTRIBUTED COMPUTING ENVIRONMENT

The disclosed exemplary embodiments include computer-implemented systems, devices, apparatuses, and processes that maintain data confidentiality in communications involving voice-enabled devices operating within a distributed computing environment. By way of example, an apparatus may receive, from a communications system across a public communications network, a request for an element of data generated by the computing system based on first audio content obtained at a device. The apparatus may obtain the requested data element and further, may generate acoustic data representative of at least a portion of the requested data element. The apparatus may also generate an encrypted response to the received request that includes the acoustic data, and transmit the encrypted response to the device across the public communications network. The device may execute an application program that causes the device to decrypt the encrypted response and to perform operations that present the acoustic data ...

CRYPTOGRAPHIC OBJECT MANAGEMENT ACROSS MULTIPLE REMOTE SITES

A cryptographic object management system is provided that includes physically separated first and second object management sites. The first and second object management sites each respectively include HSMs, a HSM server connected to each of the HSMs, and a persistent layer connected to the HSM server. The HSM servers respectively manage operation of each of the HSMs. The HSM server of the first object management site includes an object manager module that manages and controls the cryptographic object management system. The persistent layers respectively store cryptographic objects for use by the HSMs. Each of the HSMs respectively performs crypto-processing on one or more of the cryptographic objects.

SYSTEMS AND METHODS FOR PRIVACY PRESERVING ACCURATE ANALYSIS OF NETWORK PATHS

Anonymizing systems and methods comprising a native configurations database including a set of configurations, a key management database including a plurality of private keys, a processor in communication with the native configurations database and the key management database, and a memory coupled to the processor. The set of configurations includes one or more ranges, wherein each range includes a contiguous sequence comprised of IP addresses, port numbers, or IP addresses and port numbers. The processor is configured to retrieve the set of configurations from the native configurations database, wherein the set of configurations includes a plurality of objects; retrieve a private key from the key management database; assign a unique cryptographically secure identity to each object; and anonymize the plurality of objects based on the cryptographically secure identities and the private key.

SYSTEM AND METHOD FOR SECURELY ACCESSING, MANIPULATING AND CONTROLLING DOCUMENTS AND DEVICES USING NATURAL LANGUAGE PROCESSING

A system and method for securing transaction between a user and an electronic device or an electronic document, where the device or document is accessible and controllable by a user with a user electronic device. A transaction request is initiated by the user electronic device, the electronic device is connectable to a network and the electronic document is accessible over the network. The system includes a smart box connectable to the network and having a processor and memory storing general purpose and special purpose software. One or more monitoring hots storable in the memory of the smart box are configured to collect data for the transaction request pertaining to at least one of the user,a process or a the transaction.

VIRTUAL CURRENCY SYSTEM

A system including a network connected to at least one mint computing device implementing a virtual currency mint. The network has a ring topology and includes computing devices that implement a plurality of nodes. The mint issues units of virtual currency to user accounts implemented by the nodes. Each of at least a portion of the nodes is configured to initiate (as a sender node) a transaction with a recipient node that transfers at least one unit of the virtual currency from a sender one of the user accounts to a recipient one of the user accounts. The recipient node validates the transaction, creates a receipt, performs an operation on the receipt to identify a storage node, and routes the receipt to the storage node. The storage node stores the receipt, identifies next storage nodes, and routes copies of the receipt to the next storage nodes for storage thereby. Also disclosed are methods for use with computing devices implementing a plurality of nodes of a ring-shaped overlay network ...

DYNAMIC GENERATION AND MANAGEMENT OF ASYMMETRIC CRYPTOGRAPHIC KEYS USING DISTRIBUTED LEDGERS

The disclosed exemplary embodiments include computer-implemented systems, apparatuses, and processes that dynamically generate and manage a distribution of asymmetric cryptographic keys using distributed ledgers. For example, an apparatus may extract, from a hierarchical data structure, an index value associated with a corresponding element of permissioning data. The apparatus may also extract, from a first element of a distributed ledger, cryptographic data that includes a first public cryptographic key associated with the hierarchical data structure. The apparatus may generate a second public cryptographic key based on the first public cryptographic key and the extracted index value, and encrypt information using the second public cryptographic key. The encrypted information may be associated with the corresponding element of permissioning data, and the second public cryptographic key may be discarded in response to the encryption of the information.

SYSTEM AND METHOD FOR CRYPTOGRAPHIC TRANSACTIONS

A system and method for handling crypto-asset transactions includes: receiving from a payment processing system an electronic transaction request including: a payment token corresponding to a payment identifier associated with the customer account, and a transaction amount in a fiat currency; determining current price data corresponding to a first crypto-asset and a second crypto-asset associated with the customer account; associating the electronic transaction request with at least one data processing task for executing at least one crypto-asset transaction; and when at least one crypto-asset confidence condition is satisfied based on the current price data of at least one of the first crypto-asset or the second crypto-asset, generating signals for providing, via the payment processing system, an indication that the electronic transaction request is authorized without waiting for confirmation of execution of the at least one crypto-asset transaction in the respective distributed ledger ...

SYSTEMS AND METHODS FOR FACILITATING DATA ENCRYPTION AND DECRYPTION AND ERASING OF ASSOCIATED INFORMATION

Various techniques provide systems and methods for facilitating data encryption/ decryption and almost immediate erasure of associated information. In one example, a method includes receiving first data in a first memory. The method further includes receiving a first key in a second memory. The method further includes generating, by a logic circuit, second data based on the first data and the first key. The method further includes providing the second data for transmission. The method further includes erasing the first data and/or the first key in one-half clock cycle of generating the second data. Related methods and devices are also provided.

POLICY-ENABLED ENCRYPTION KEYS HAVING EPHEMERAL POLICIES

Examples described herein relate to apparatuses and methods for evaluating an encryption key based on policies for a policy operation, including, but not limited to, aggregating existing policies for evaluating at least one key attribute of the encryption key, executing a policy replacement operation replacing at least one existing policy with at least one ephemeral policy, and evaluating the at least one key attribute based, at least in part, on the at least one ephemeral policy.

CONFIGURATOR KEY PACKAGE FOR DEVICE PROVISIONING PROTOCOL (DPP)

This disclosure provides systems, methods, and apparatus, including computer programs encoded on computer storage media, for enhancing a device provisioning protocol (DPP) to support multiple configurators. In one aspect, a first configurator device can export a configurator key package. In one aspect, the configurator key package may be used for backup and restore of the configurator keys. The configurator key package may include a configurator private signing key and, optionally, a configurator public verification key. A second configurator device may obtain the configurator key package and also may obtain decryption information which can be used to decrypt the configurator key package. Thus, in another aspect, both the first configurator device and the second configurator device can use the same configurator keys with the device provisioning protocol to configure enrollees to a network.

SYSTEM AND METHOD FOR SECURE APPLIANCE OPERATION

Secure control of network appliances uses a central hub connected to a plurality of network appliances or multiple hubs in a short-range wireless mesh network. The central hub controls communication with the appliances and also includes a cellular link for communication with a cellular network. Only the central hub can communicate with the Internet via the cellular link. User equipment (UE) contains an application program that works in conjunction with the central hub to control the appliances. Commands generated by the UE are sent either directly to the central hub or via the mesh network. Upon receipt of an authenticated command, the central hub propagates commands via the short-range wireless mesh network to the intended network appliance either directly or via the mesh network.

SYSTEMS, METHODS, AND DEVICES FOR SECURE BLOCKCHAIN TRANSACTION AND SUBNETWORKS

Provided herein is a system, device, method, and subnetwork for performing a secure blockchain transaction of a digital asset. The system includes a terminal for generating the blockchain transaction, the terminal configured to operate in a first mode and a second mode, and a switch connector for preventing the terminal from operating in the first mode and the second mode simultaneously. When the terminal is in the first mode, the terminal is connected via a network to a system provider server, the system provider server in communication with a plurality of blockchain devices. When the terminal is in the second mode, the terminal is in communication with a cold storage device. The cold storage device is configured to store a private key for signing the blockchain transaction. The terminal is configured to sign the blockchain transaction on the cold storage device using the private key.

METHODS AND SYSTEMS FOR CRYPTOGRAPHIC IDENTITY BASED NETWORK MICROSEGMENTATION

Methods and network interface devices for establishing a secure and authenticated network connection are provided. The method comprises: receiving, from a requesting entity, a destination IP address and a first certificate that is used to establish a secure network connection, wherein the first certificate comprises a first security attribute that is associated with a source destination IP address; identifying, with aid of one or more processors, a stored second security attribute associated with the destination IP address; and determining, with aid of the one or more processors, a policy action based at least in part on the first security attribute and the second security attribute.

SECURE ENABLING AND DISABLING POINTS OF ENTRY ON A DEVICE REMOTELY OR LOCALLY

A method is provided for remotely configuring a modem securely using an authentication token for use with a service provider. The method includes receiving an encrypted authentication token from the modem, the authentication token having at least one password and being encrypted according to a public key, transmitting the encrypted authentication token to an authentication server, receiving a decrypted authentication token from the authentication server, and configuring at least one modem interface at least in part using the authentication token.

INITIALIZING, MAINTAINING, UPDATING AND RECOVERING SECURE OPERATION WITHIN AN INTEGRATED SYSTEM EMPLOYING A DATA ACCESS CONTROL FUNCTION

Techniques are provided for initializing, maintaining, updating and recovering secure operation within an integrated system. The techniques, which employ a data access control function within the integrated system, include authenticating by a current level of software a next level of software within an integrated system. The authenticating occurs before control is passed to the next level of software. Further, an ability of the next level of software to modify an operational characteristic of the integrated system can be selectively limited via the data access control function. Techniques are also provided for initializing secure operation of the integrated system, for migrating data encrypted using a first key set to data encrypted using a second key set, for updating software and keys within the integrated system, and for recovering integrated system functionality following a trigger event.

METHOD AND SYSTEM FOR DATA BACKUP

ELECTRONIC PREEMPTIVE EVIDENTIARY ESCROW PLATFORM

The system and method described herein provide mechanisms by which connected devices and/or internal subsets of devices can be used to implement an electronic preemptive evidentiary escrow platform. Such a platform can be used, for example, as a preemptive defensive mechanism to prevent unauthorized access to information, while permitting authorized access with a minimum of additional burden. A compound message is partitioned into public summary data and private detail media/metadata. The public summary data is made readily available, while the private data is only made available to authorized entities upon occurrence of predefined condition(s). In at least one embodiment, one or more hardware devices can be automatically reconfigured upon occurrence of predefined condition(s) to allow authorized access to private data.

Cloud Storage Data Access Method, Apparatus and System Based on OTP

The present application relates to cloud storage technology and especially relates to a cloud storage data access method, apparatus and system based on OTP. This method includes: generating and storing true random numbers of a predetermined length and a random seed of a predetermined length composed of the true random numbers via a preset method; acquiring data from the random seed for several times and cascading the data acquired each time into a true random data string of no shorter than the length of plaintext; based on the true random data string, generating a true random cryptographic key of no shorter than the length of the plaintext, encrypting the plaintext using this cryptographic key and transmitting ciphertext to a cloud storage data center. This application also provides a cloud storage data access apparatus and system based on OTP. The method, apparatus and system introduced by this invention can generate and store sufficient true random cryptographic key with relatively small physical space occupancy in comparison with that of plaintext, thereby enabling OTP to be applied into cloud storage data security protection.

Method and system for enryption key versioning and key rotation in a multi-tenant environment

Various techniques and procedures related to encryption key versioning and rotation in a multi-tenant environment are presented here. One approach employs a computer-implemented method of managing encrypted data and their associated encryption keys. In accordance with this approach, a key splitting process securely stores a master key used to encrypt tenant-level encryption keys, a key versioning process is used to securely track updated encryption keys, and a key rotation process is used to rotate encrypted data to an updated version of a tenant-level encryption key.

Elliptic curve cryptograhy with fragmented key processing and methods for use therewith

A cryptography module includes a key store having a plurality of storage locations for storing a private key as k key fragments. One or more crypto-processing segments each operate based on corresponding ones of the k key fragments to process a message in accordance with elliptic curve digital signature algorithm (ECDSA) to produce a signed message.

Cryptography module for use with fragmented key and methods for use therewith

A cryptography module includes a key store having a plurality of storage locations for storing a key as k key fragments including a plurality of random key fragments and a remainder key fragment. One or more crypto-processing segments each operate based on corresponding ones of the k key fragments to process an input signal to produce an output signal.

Secure management of keys in a key repository

A method for managing keys in a computer memory including receiving a request to store a first key to a first key repository, storing the first key to a second key repository in response to the request, and storing the first key from the second key repository to the first key repository within said computer memory based on a predetermined periodicity.

Appending data to existing data stored in a dispersed storage network

A method begins by a processing module receiving a request to store data in dispersed storage network (DSN) memory and determining whether the data is to be appended to existing data. When the data is to be appended, the method continues with the processing module encoding, using an append dispersed storage error coding function, the data to produce a set of encoded append data slices, generating a set of append commands, wherein an append command of the set of append commands includes an encoded append data slice of the set of encoded append data slices and identity of one of a set of dispersed storage (DS) units, and outputting at least a write threshold number of the set of append commands to at least a write threshold number of the set of DS units.

Method and apparatus for cryptographic conversion in a data storage system

When data is encrypted and stored for a long time, encryption key(s) and/or algorithm(s) should be updated so as not to be compromised due to malicious attack. To that end, stored encrypted data is converted in the storage system with new set of cryptographic criteria. During this process, read and write requests can be serviced.

Peer integrity checking system

A distributed file integrity checking system is described. The described peer integrity checking system (PICS) may negate an attack by storing a properties database amongst nodes of a peer-to-peer network of hosts, some or all of which co-operate to protect and watch over each other.

Techniques for non repudiation of storage in cloud or shared storage environments

Techniques for non-repudiation of storage in cloud or shared storage environments are provided. A unique signature is generated within a cloud or shared storage environment for each file of the storage tenant that accesses the cloud or shared storage environment. Each signature is stored as part of the file system and every time a file is accessed that signature is verified. When a file is updated, the signature is updated as well to reflect the file update.

Method and apparatus for encrypting and processing data in flash translation layer

A method and apparatus for preventing a user from interpreting optional stored data information even when the user extracts the optional stored data, by managing data associated with a flash memory in a flash translation layer, the method comprising searching at least one page of the flash memory when writing data to the flash memory, determining whether authority information corresponding to respective searched pages includes an encryption storage function, generating, corresponding to respective searched pages, a page key according to an encrypting function when the authority information includes the encryption storage function encrypting the data using the generated page key and storing the encrypted data in the respective searched pages, and storing the data in the respective searched pages without encryption when the authority information does not include the encryption storage function.

Data interleaving scheme for an external memory of a secure microcontroller

The invention relates to methods of interleaving payload data and integrity control data in an external memory interfaced with a microcontroller to improve data integrity check, enhance data confidentiality and save internal memory. Data words and are received for storing in the external memory. Each data word is used to generate a respective integrity word, while an associated logic address is translated to two physical addresses in the external memory, one for the data word and the other for the integrity word. The two physical addresses for the data and integrity words are interleaved in the external memory, and sometimes, in a periodic scheme. In particular, each data word may be associated to an integrity sub-word included in an integrity word having the same length with that of a data word. The external memory may have dedicated regions for the data words and the integrity words, respectively.

Encoding/decoding circuit

An encoding/decoding operation portion includes an encoding/decoding operation circuit and an avoiding path for detouring the encoding decoding operation circuit and can select between encoding or decoding input data in the encoding/decoding operation circuit and detouring the encoding/decoding operation circuit to output the input data without change. Only one wire has to be provided from a selector to a key storage portion and an initialization-vector storage portion. With this construction, it is possible to realize an encoding/decoding circuit which can suppress an increase in the number of wires used to transmit a content of key data to the key storage portion and the initialization-vector storage portion and does not cause complication of circuit layout.

Protocol for Controlling Access to Encryption Keys

A secure remote-data-storage system stores encrypted data and both plaintext and encrypted keys at a server, where data at the server is inadequate to recover the plaintext of the encrypted data; and stores at least one encrypted key at a client system. To decrypt the data, the client must obtain a copy of the encrypted data from the server, and a key to decrypt its locally-stored encrypted key. Once decrypted, the locally-stored key can be used to decrypt the encrypted data, or to decrypt an encrypted key from the server, which may then be used decrypt the encrypted data.

Secure data recorder

A method and apparatus for securely encrypting data is disclosed. Conventional protections against the loss or theft of sensitive data such as full disk encryption are not effective if the device is, or has recently been, running when captured or found because the keys used for full disk encryption will still be in memory and can be used to decrypt the data stored on the disk. Some devices, such as devices which gather sensitive data in use, must run in environments in which they might be captured by a person seeking access to the sensitive data already recorded by the device. An encryption method is proposed in which files on a recorder's persistent memory are initialised with pseudo-random masking data whilst the recorder is in a relatively secure environment. One or more parameters which can be used to re-create the pseudo-random masking data are encrypted with a public key using a public-key encryption algorithm and stored on the recorder. The device's memory is then purged to remove the one or more parameters. Later, when miming in a relatively insecure environment, the sensitive data is encrypted ( 414 ) using a symmetric encryption algorithm, and combined ( 418 ) with the masking data previously stored in the storage file. When the encrypted files are transferred to a reader device with access to the corresponding private key, the masking data can be recreated, the symmetric encryption reversed and the sensitive data recovered. However, an adversary without the private key cannot recreate the masking data, and is thus unable to recover the sensitive data even with the symmetric encryption key which he might successfully extract from the recorder's volatile memory.

Enabling users to select between secure service providers using a key escrow service

Systems and methods are described herein for enabling users to select from available secure service providers (each having a Trusted Service Manager (“TSM”)) for provisioning applications and services on a secure element installed on a device of the user. The device includes a service provider selector (“SPS”) module that provides a user interface for selecting the secure service provider. In one embodiment, the SPS communicates with a key escrow service that maintains cryptographic keys for the secure element and distributes the keys to the user selected secure service provider. The key escrow service also revokes the keys from deselected secure service providers. In another embodiment, the SPS communicates with a central TSM that provisions applications and service on behalf of the user selected secure service provider. The central TSM serves as a proxy between the secure service providers and the secure element.

Cryptanalysis Method and System

A cryptanalysis method comprising: (A) Performing a ciphertext-only direct cryptanalysis of A5/1 and (B) Using results of Step (A) to facilitate the decryption and/or encryption of further communications that are consistent with encryption using the session key and/or decryption using the session key, wherein the cryptanalysis considers part of the bits of the session key to have a known fixed value, and wherein the cryptanalysis finds the session key. An efficient known plaintext attack on AS/2 comprises trying all the possible values for R 4, and for each such value solving the linearized system of equations that describe the output; The solution of the equations gives the internal state of RI, R 2, and R 3; Together with R 4, this gives the full internal state which gives a suggestion for the key.

Securing Data in a Dispersed Storage Network Using Shared Secret Slices

A method begins by dividing a data segment into data segment portions. The method continues by encoding the data segment portions to produce a plurality of sets of encoded data segment portions. A data segment portion is encoded by, first, selecting an encoding equation and an encoding constant(s). The encoding continues by setting a first variable to the data segment portion. The encoding continues by setting a second variable to one of a set of pillar numbers. The encoding continues by executing the encoding equation using the encoding constant, the first variable, and the second variable to produce one of the plurality of sets of encoded data segment portions. The method continues by arranging the plurality of sets of encoded data segment portions into a plurality of encoded data slices. The method continues by sending the plurality of encoded data slices to distributed storage units of a distributed storage network.

Session completion through co-browsing

A method, system and computer program product for session completion through co-browsing is claimed. The method can include establishing a content browsing session between a first computing device and a content server serving access to content to the first computing device and maintaining state data for the content browsing session. A co-browsing arrangement of the content can be created as between the first computing device and a second computing device and at least a subset of the state data can be cloned for use by the second computing device during co-browsing of the content. Thereafter, a modified form of the subset of the state data can be received from the second computing device resulting from the co-browsing of the content by the second computing device and the modified form of the subset of the state data can be provided to the first computing device for use during the content browsing session.

Encryption key management

An encryption key fragment is divided into a number of encryption key fragments. Requests to store different ones of the encryption key fragments are transmitted to different computer memory storage systems. An individual request to store an encryption key fragment includes one of the encryption key fragments and bears an access control hallmark for regulating access to the encryption key fragment.

Storage device, host device, and information processing method

A storage device includes a storage module, an authentication process execution module, an encryption processor and a security setting module. The storage module stores an encryption key, a flag indicating whether the encryption key can be used, a password used for authentication associated with the encryption key and the flag, and user data. The authentication process execution module uses a password to authenticate a connected host device. The encryption processor uses an encryption key stored being associated with a flag indicating permission to use the encryption key in accordance with an instruction from the host device, and encrypts user data received from the host device or decrypts the user data stored in the storage module. On encryption or decryption, the security setting module changes the setting of a flag stored being associated with the encryption key used for the encryption or the decryption.

SYSTEMS, METHODS AND APPARATUSES FOR THE SECURE TRANSMISSION OF MEDIA CONTENT

The systems, methods and apparatuses described herein permit encrypted media content to be displayed by a display device under control of a local device. The local device may comprise a computer processor to control playing of the encrypted media content and a first communication interface to transmit an association encryption envelope and, according to the control, the encrypted media content. The display device may comprise a second communication interface coupled to the first interface to receive the encrypted media content and the association encryption envelope, a decryption engine to decrypt the association encryption envelope using a private key of the display device to recover a symmetric encryption key used to encrypt the encrypted media content and decrypt the encrypted media content using the recovered symmetric encryption key, and a decoder to decode the decrypted media content for display on a display screen according to the control. 1. A system for displaying encrypted media content comprising: a computer processor configured to control playing of the encrypted media content;', 'a first communication interface configured to transmit an association encryption envelope and, according to the control, the encrypted media content; and, 'a local device, comprising a second communication interface coupled to the first interface configured to receive the encrypted media content and the association encryption envelope transmitted by the local device;', 'a decryption engine configured to decrypt, using a private key of the display device, the association encryption envelope to recover a symmetric encryption key used to encrypt the encrypted media content and decrypt the encrypted media content using the recovered symmetric encryption key; and', 'a decoder configured to decode the decrypted media content for display on a display screen according to the control., 'a display device, comprising2. The system of claim 1 , further comprising: [ generate the symmetric ...

Intercepting key sessions

In some implementations, a method for providing a session key to a third party includes identifying a private key associated with a public key certificate in response to an event. A session key for a communication session is based, at least in part, on the private key, an associated seed for a random number generator, and public keys assigned to user equipment participating in the communication session. The private key associated with the public key certificate is automatically transmitted to an interception authority. The interception authorities are configured to grant a third party access to the private key and the associated seed to in response to a request from a third party authorized to access the communication session.

Secure storage of secret data in a dispersed storage network

A method for secure storage of secret data begins with an originating device transforming the secret data to produce a plurality of secret data shares and encrypting the plurality of secret data shares using unique encryption values of trusted agent modules of a dispersed storage network (DSN) to produce a plurality of encrypted secret data shares for storage in storage nodes of the DSN. Retrieval of the secret data begins with the originating device sending a secret data retrieval request to the trusted agent modules and recovering, by the trusted agent modules, the plurality of encrypted secret data shares from the storage nodes. The method continues with the trusted agent modules decrypting the plurality of encrypted secret data shares using a decryption function corresponding to the unique encryption values and sending the plurality of secret data shares to the originating device.

Systems and methods for securing data in motion

The systems and methods of the present invention provide a solution that makes data provably secure and accessible—addressing data security at the bit level—thereby eliminating the need for multiple perimeter hardware and software technologies. Data security is incorporated or weaved directly into the data at the bit level. The systems and methods of the present invention enable enterprise communities of interest to leverage a common enterprise infrastructure. Because security is already woven into the data, this common infrastructure can be used without compromising data security and access control. In some applications, data is authenticated, encrypted, and parsed or split into multiple shares prior to being sent to multiple locations, e.g., a private or public cloud. The data is hidden while in transit to the storage location, and is inaccessible to users who do not have the correct credentials for access.

Communication apparatus and key managing method

According to an embodiment, a communication apparatus includes a key storage unit configured to store therein a cryptographic key; a receiving unit configured to receive a message; an analyzing unit configured to analyze whether the message includes an access request for the cryptographic key; a generating unit configured to, when the message includes the access request, generate request information used to request an access to the cryptographic key requested by the access request; and an access controller configured to control the access to the cryptographic key based on the request information.

ENCRYPTION PROCESSING DEVICE, ENCRYPTION PROCESSING METHOD, AND PROGRAMME

An encryption processing device including an encryption processing part configured to divide configuration bits of data to be data processed into plural lines, and to input, and to repeatedly execute data conversion processing applying a round function to each line of data as a round calculation; and a key scheduling part configured to output round keys to a round calculation executing unit in the encryption processing part. The key scheduling part is a replacement type key scheduling part configured to generate plural round keys or round key configuration data by dividing a secret key stored beforehand into plural parts. The plural round keys are output to a round calculation executing unit sequentially executing in the encryption processing part such that a constant sequence is not repeated. The encryption processing configuration has a high level of security and a high level of resistance to repeated key attacks or other attacks. 112-. (canceled)13. An encryption processing device comprising:an encryption processing part configured to divide configuration bits of data to be data processed into a plurality of lines, and to input, and to repeatedly execute data conversion processing applying a round function to each line of data as a round calculation; anda key scheduling part configured to output round keys to a round calculation executing unit in the encryption processing part;wherein the key scheduling part is a replacement type key scheduling part configured to generate a plurality of round keys or round key configuration data by dividing a secret key stored beforehand into a plurality of parts;and wherein the plurality of round keys or plurality of round keys generated from a combination of the round key configuration data are output to a round calculation executing unit sequentially executing in the encryption processing part such that a constant sequence is not repeated;and wherein a plurality of groups is set by classifying the plurality of round keys or ...

Image data processing device and image data processing program

A user key storage unit stores at least one user key corresponding to usage authorities of image data. A first encryption unit encrypts the image data using a first encryption key. A second encryption key creation unit creates a second encryption key assigned to each usage authority. A key-storage data creation unit creates a key-storage data for each usage authority by encrypting the first encryption key and authority information using the second encryption key. A user-supplementary data creation unit creates user-supplementary data for each user key. A device-supplementary data creation unit creates device-supplementary data for at least one usage authority and for at least one device key. A data output unit outputs encrypted image data with the key-storage data, the user-supplementary data and the device-supplementary data.

Object Signing Within a Cloud-based Architecture

This invention uses a cloud-based architecture to sign objects by dynamically creating a cloud-based virtual machine with the ability to sign objects, perform network and object isolation, and encrypt and store keys generated by an object signing agent. Multi-user authentication is supported along with mobile access.

SECURE DATA ACCESS IN A DISPERSED STORAGE NETWORK

A method begins by a dispersed storage (DS) processing module receiving an access request regarding a data object, where the access request includes a data object identifier, requestor information, and addressing information. The method continues with the DS processing module determining a base key identifier based on the access request and determining content specific information based on the access request. The method continues with the DS processing module retrieving a set of base key slices utilizing the base key identifier and decoding the set of base key slices in accordance with an error encoding function to recover a base key. The method continues with the DS processing module generating an access specific key based on the recovered base key and the content specific information and executing the access request regarding the data object utilizing the access specific key. 1. A method for execution by one or more processing modules of a storage device , the method comprises:receiving an access request regarding a data object, wherein the access request includes a data object identifier, requestor information, and addressing information;determining a base key identifier based on the access request;determining content specific information based on the access request;retrieving a set of base key slices utilizing the base key identifier;decoding the set of base key slices in accordance with an error encoding function to recover a base key;generating an access specific key based on the recovered base key and the content specific information; andexecuting the access request regarding the data object utilizing the access specific key.2. The method of claim 1 , wherein the determining the base key identifier comprises:determining a domain based on at least one of the addressing information and the requestor information, wherein the domain is one of a plurality of domains of memory of a dispersed storage network (DSN), wherein a plurality of base keys is assigned to the ...

Systems, methods, and mediums for secure information access

Systems, methods, and tangible computer-readable storage mediums for secure access to information are presented. More particularly, embodiments relate to encrypting at least part of the information using an information-specific key or a key symmetric to the information-specific key; encrypting the information-specific key using a first public key; encrypting a first private key; and storing in memory the encrypted information, encrypted first private key, and the encrypted information-specific key. Some further embodiments include: decrypting the first private key; decrypting the information-specific key using the first private key; and decrypting at least part of the information using the information-specific key.

Method and apparatus for securing memory modules

A memory system for storing data that includes providing a memory module having one or more memory devices and a voltage regulator for controlling voltage levels supplied to the one or more memory devices, wherein the voltage regulator has a first state that permits write and read operations with the one or more memory devices, and a second state where the voltage regulator prevents at least read operations with the one or more memory devices the system configured to store an encryption key in ROM on the voltage regulator; copy the encryption key value from the ROM to a voltage regulator register; set a voltage regulator encryption timer for a period of time; and transition the voltage regulator to the second state in response to the voltage regulator encryption timer expiring.

Secure secret recovery

A secret is sliced into a number of encrypted slices. The encrypted slices can be distributed amongst members of a group. The encrypted slices make recovery of the secret possible, but a group authority key is required for decryption. Thus, a number of slices are necessary, but still not sufficient, to recover the secret.

ENCRYPTION KEY MANAGEMENT FOR AN AUTOMATED WORKFLOW

Media, system, and method for providing encryption key management to an automated workflow within a group-based communication system. The automated workflow is encrypted using an organization-specific encryption key and is stored in a data store. Responsive to a triggering event, the encrypted workflow is retrieved from the data store to be decrypted and a corresponding decryption key is retrieved from a key store. The decrypted workflow performs a series of steps responsive to determining that a trigger condition has been met. The steps may be associated with at least one of sending a form and sending a message to a user within the group-based communication system. 1. One or more non-transitory computer-readable media storing computer-executable instructions that , when executed by a processor , perform a method for providing encryption key management to an automated workflow , the method comprising the steps of:responsive to determining that a trigger condition associated with the automated workflow has been satisfied, retrieving an organization-specific decryption key from a key server;retrieving, from a data store, an encrypted workflow associated with the automated workflow;automatically decrypting the encrypted workflow using the organization-specific decryption key to obtain a decrypted automated workflow;automatically initiating the decrypted automated workflow to perform at least one interaction with a user;receiving user input associated with the automated workflow;generating a workflow response based on the user input;encrypting, using an organization-specific encryption key, the workflow response;storing the encrypted workflow response in the data store; andin response to determining whether the decrypted automated workflow has been changed, re-encrypting the decrypted automated workflow to produce a re-encrypted automated workflow, and storing the re-encrypted automated workflow in the data store.2. The computer-readable media of claim 1 , wherein the ...

CONNECTED SECURE KEY REDISTRIBUTION SYSTEM AND METHOD

In one embodiment, a method for securely distributing secret keys for hardware devices is disclosed. A distributor server transmits to a provider server an order for hardware devices. Each hardware device has a unique identifier and at least one secret key for authentication. The provider server sends a database associated with the distributor, for each of the hardware devices, the unique identifier and an unencrypted version of the at least one secret key. In response to an order received by the distributor from a customer for a portion of the hardware devices, the distributor server provides the database the unique identifiers and an associated customer order identifier, and the distributor server provides a customer server the unique identifiers. In response to the customer logging into the database and providing the order information, the database provides the customer the unencrypted keys for the hardware devices to allow authentication. 1. A method for secure distribution of secret keys for hardware devices , the method comprising:a) a distributor server of a distributor transmitting to a provider server of a provider an order for hardware devices, wherein the provider is separate and distinct from the distributor, each hardware device has a unique identifier and at least one secret key, and the at least one secret key enables authentication of the hardware device;b) receiving from the provider server at a database associated with the distributor, for each of the hardware devices, the unique identifier and an unencrypted version of the at least one secret key (the unique identifiers and the unencrypted keys), the distributor not having general access to the unencrypted keys; i) the distributor server providing the database (1) the unique identifiers for the hardware devices of the ordered portion, and (2) an associated customer order identifier for the order; and', 'ii) the distributor server providing a customer server the unique identifiers for the hardware ...

SYSTEM AND METHODS FOR CONFIDENTIAL COMPUTING

Systems, apparatuses, methods, and computer-readable media for implementing confidential computing of one or more computing systems and/or devices using component authentication and data encryption with integrity and anti-replay mechanisms are disclosed. In some examples, the systems, apparatuses, methods, and computer-readable media described herein can perform various techniques, including one or more secure boot processes, component and data authentication, and data encryption with integrity and anti-replay, among other secure techniques. One implementation may include executing secure boot process based on authentication of a device identifier stored in a secure physical object of a processing device. Another implementation may include encrypting and storing a counter value corresponding to a cache line and generating an integrity tag value replacing error correction code bits associated with the cache line with the generated cache line tag value. 1. A method for secure computing , the method comprising:decrypting, by a processing device and using a private key of a first public/private key pair, an encrypted block of data received from a first computing device, the encrypted block of data comprising an identifier of the processing device;verifying the identifier of the processing device matches a value encoded based on a secure physical object of the processing device; andexecuting, by the processing device and based on verifying the identifier of the processing device and performing a digital signature verification of a secure program using a public key of a second public/private key pair, the secure program to secure boot the processing device, the second public/private key pair being different from the first public/private key pair.2. The method of claim 1 , wherein the encrypted block of data further comprises a hash of a session public key of a session key pair claim 1 , the method further comprising:matching a software verification value from a portion of ...

Secure Data Replication in a Storage Grid

A method for securing data in a storage grid is provided. The method includes generating a storage key from key shares of at least two storage clusters of a storage grid having at least three storage clusters and generating a grid key from the storage key and an external secret. The method includes encrypting data with the grid key to yield once encrypted data and encrypting the once encrypted data with the storage key to yield twice encrypted data. The method includes storing the twice encrypted data in a first storage cluster of the storage grid and storing the twice encrypted data in a second storage cluster of the storage grid, wherein at least one method operation is performed by a processor.

SYSTEMS AND METHODS FOR CENTRALLY MANAGED HOST AND NETWORK FIREWALL SERVICES

Systems and methods for a unified, cloud-managed platform for controlling enterprise network security are provided. According to one embodiment, a network of an enterprise is protected by a cloud-managed platform. An underlying architecture of the cloud-managed platform is abstracted by providing a portal through which modifications to security policies are expressed as business requirements of the enterprise. The security policies are automatically enforced regardless of location or endpoint. A policy digest, including information regarding the modifications and formatted according to a predefined format, generated and locally queued by the portal is retrieved. Security enforcement systems associated with the cloud-managed platform are configured to control communications to and from the network according to the security policies by generating API calls to the security enforcement systems and agents running on endpoints associated with the network are configured to control endpoint-to-endpoint connections according to the security policies based on the policy digest. 1. A method for protecting a network of an enterprise by a cloud-managed platform including one or more processors that are remote from the enterprise network , the method comprising:abstracting an architecture of a plurality of security enforcement systems associated with the cloud-managed platform by providing a portal through which modifications to a unified security policy are expressed as business requirements of the enterprise and without requiring explicit associations to be defined among a plurality of locations of the enterprise and security policies of the unified security policy; and retrieving a policy digest generated and locally queued by the portal, wherein the policy digest includes information regarding the modifications and is formatted according to a predefined format;', 'configuring the plurality of security enforcement systems to control communications to and from the network ...

Secure Public Cloud

In a method to utilize a secure public cloud, a computer receives a domain manager image and memory position-dependent address information in response to requesting a service from a cloud services provider. The computer also verifies the domain manager image and identifies a key domain key to be used to encrypt data stored in a key domain of a key domain-capable server. The computer also uses the key domain key and the memory-position dependent address information to encrypt a domain launch image such that the encrypted domain launch image is cryptographically bound to at least one memory location of the key domain. The computer also encrypts the key domain key and sends the encrypted domain launch image and the encrypted key domain key to the key domain-capable server, to cause a processor of the key domain-capable server to create the key domain. Other embodiments are described and claimed. 1. At least one computer-readable medium comprising instructions that , if executed by a processor , enable a computer to:receive a domain manager image and memory position-dependent address information in response to requesting a service from a cloud services provider;verify the domain manager image;identify a key domain key to be used to encrypt data stored in a key domain of a key domain-capable server, wherein the key domain comprises a plurality of memory locations of a memory of the key domain-capable server;use the key domain key and the memory-position dependent address information to encrypt a domain launch image such that the encrypted domain launch image is cryptographically bound to at least one memory location of the key domain;encrypt the key domain key; andsend the encrypted domain launch image and the encrypted key domain key to the key domain-capable server, to cause a processor of the key domain-capable server to execute an instruction to create the key domain.2. The at least one computer-readable medium of claim 1 , wherein:the memory position-dependent ...

SECURE BOOT WITH RESISTANCE TO DIFFERENTIAL POWER ANALYSIS AND OTHER EXTERNAL MONITORING ATTACKS

A method for device authentication comprises receiving, by processing hardware of a first device, a message from a second device to authenticate the first device. The processing hardware retrieves a secret value from secure storage hardware operatively coupled to the processing hardware. The processing hardware derives a validator from the secret value using a path through a key tree, wherein the path is based on the message, wherein deriving the validator using the path through the key tree comprises computing a plurality of successive intermediate keys starting with a value based on the secret value and leading to the validator, wherein each successive intermediate key is derived based on at least a portion of the message and a prior key. The first device then sends the validator to the second device. 1. A method for device authentication comprising:receiving, by processing hardware of a first device, a message from a second device to authenticate the first device;retrieving, by the processing hardware, a secret value from secure storage hardware operatively coupled to the processing hardware;deriving, by the processing hardware, a validator from the secret value using a path through a key tree, wherein the path is based on the message, wherein deriving the validator using the path through the key tree comprises computing a plurality of successive intermediate keys starting with a value based on the secret value and leading to the validator, wherein each successive intermediate key is derived based on at least a portion of the message and a prior key; andsending the validator to the second device.2. A method as in claim 1 , wherein the validator is exchanged between the first device and the second device as part of a challenge-response protocol.3. A method as in claim 2 , wherein the first device comprises a printer cartridge and the second device comprises a printer.4. A method as in claim 1 , wherein the path through the key tree identifies a plurality of ...

Key and Certificate Distribution Method, Identity Information Processing Method, Device, and Medium

Identity information processing method and apparatus are disclosed. The method includes: obtaining customized information of a user process on an integrated chip; determining a target operational firmware preloaded on a reconfigurable chip according to the customized information; generating first process identity information used for verifying the user process based on the target operational firmware and a fixed operational firmware of a non-reconfigurable chip; and providing the first process identity information to a privacy certificate issuing authority for performing firmware legitimacy verification of an operational firmware to determine that an identity of the user process is legitimate according to a result of the firmware legitimacy verification. Therefore, the first process identity information generated for the user process by the integrated chip can prove the legitimacy of the fixed operational firmware of the non-reconfigurable part of the firmware, and also prove the legitimacy of the target operational firmware of the reconfigurable part. 1. A method comprising:obtaining customized information of a user process on an integrated chip, wherein the integrated chip comprises a non-reconfigurable chip and a reconfigurable chip;determining a target operational firmware preloaded on the reconfigurable chip according to the customized information;generating first process identity information used for verifying the user process according to the target operational firmware and a fixed operational firmware of the non-reconfigurable chip; andproviding the first process identity information to a privacy certificate issuing authority for performing firmware legitimacy verification of the operational firmware to determine an identity of the user process to be legitimate according to a result of the firmware legitimacy verification.2. The method of claim 1 , wherein the operational firmware comprises one or more operational algorithms claim 1 , and the customized ...

Intelligent tracking system and methods and systems therefor

An intelligent tracking system generally includes one or more tracking devices, some of which may be passive tracking devices. Each passive tracking device includes one or more transceivers and is energized by an energizing signal. Some of these passive tracking devices may operate in a first communication mode or a second communication mode based on the energizing signal. Some tracking devices may include encryption modules or authentication modules. Some of these devices may incorporate a bulk acoustic wave oscillator.

Intelligent tracking system and methods and systems therefor

An intelligent tracking system generally includes one or more tracking devices, some of which may be passive tracking devices. Each passive tracking device includes one or more transceivers and is energized by an energizing signal. Some of these passive tracking devices may operate in a first communication mode or a second communication mode based on the energizing signal. Some tracking devices may include encryption modules or authentication modules. Some of these devices may incorporate a bulk acoustic wave oscillator.

Intelligent tracking system and methods and systems therefor

An intelligent tracking system generally includes one or more tracking devices, some of which may be passive tracking devices. Each passive tracking device includes one or more transceivers and is energized by an energizing signal. Some of these passive tracking devices may operate in a first communication mode or a second communication mode based on the energizing signal. Some tracking devices may include encryption modules or authentication modules. Some of these devices may incorporate a bulk acoustic wave oscillator.

WALLET RECOVERY METHOD

Systems and methods for blockchain wallet recovery, including: receiving a wallet recovery request from a user; sending a signed recovery transaction to the wallet, the signed recovery transaction comprising recovery instructions; and providing wallet access to the user, according to the recovery instructions, when a recovery condition is met. In examples, the recovery transaction is signed by a recovery key, different from a set of old wallet owner keys, that is associated with the wallet; the recovery instructions include new owner address(es) associated with a set of new owner keys; and providing wallet access includes activating the new owner addresses for the wallet after the recovery transaction is verified as signed by the recovery key. 1. A method comprising: with a third party system that manages a recovery account of a multi-owner wallet:receiving, from a requestor user device, a wallet recovery request for the multi-owner wallet, the multi-owner wallet associated with a set of owner accounts and the recovery account;verifying that a user identity identified in the wallet recovery request is an owner of the multi-owner wallet;after verifying the user identity, signing a challenge initiation request using a private key of the recovery account;transmitting the signed challenge initiation request to the multi-owner wallet, wherein the multi-owner wallet initiates a waiting period for wallet key replacement of the multi-owner wallet upon verification of the signed challenge initiation request, wherein the multi-owner wallet provides a user of the requestor device with access to the multi-owner wallet upon expiration of the waiting period, absent receipt of an abort message;monitoring to identify an abort condition during the waiting period; andin response to identifying the abort condition, transmitting to the multi-owner wallet an abort message signed by the private key of the recovery account.2. The method of claim 1 , wherein an abort condition includes at ...

FINE-GRAINED ENCRYPTED ACCESS TO ENCRYPTED INFORMATION

The present disclosure provides systems, methods, and computer-readable media for performing a fine-grained encrypted search of data stored in encrypted form. In one aspect, a system includes at least one processor and at least one memory having computer-readable instructions, which when executed by the at least one processor, configure the at least one processor to create an encrypted search database, perform an encrypted search of the encrypted search database based on one or more search terms, present a result of the encrypted search on an interface, and perform a further search of an encrypted data storage based on a response to the result. 1. A system comprising:at least one processor; and create an encrypted search database,', 'perform an encrypted search of the encrypted search database based on one or more search terms,', 'present a result of the encrypted search on an interface, and', 'perform a further search of an encrypted data storage based on a response to the result., 'at least one memory having computer-readable instructions, which when executed by the at least one processor, configure the at least one processor to2. The system of claim 1 , wherein the execution of the computer-readable instructions further configures the at least one processor to generate the encrypted search database by:converting incoming information to text;splitting the text into a plurality of chunks of text;encrypting the plurality of chunks of text; andstoring the plurality of chunks of text in a database to create the encrypted search database.3. The system of claim 2 , wherein the execution of the computer-readable instructions configures the at least one processor to claim 2 ,split the incoming information into a plurality of chunks of data;encrypt the plurality of chunks of data; andstore the plurality of chunks of data in the encrypted data storage.4. The system of claim 3 , wherein the execution of the computer-readable instructions configures the at least one processor ...

METHOD TO RECOVER DATA FROM A LOCKED DEVICE FOR UPLOAD TO A SERVICE

A method for recovering a digital file from a locked device is provided. An identity token is received at a recovery app on the locked device. The recovery app retrieves a digital file from the locked device and sends the digital file and the identity token to a service external to the device. 1. A method for recovering a digital file from a locked device comprising:receiving an identity token at a recovery app on the locked device;retrieving a digital file from the locked device at the recovery app; andsending the digital file and the identity token from the recovery app to a service external to the device.2. The method of claim 1 , wherein the service is a microservice running in infrastructure equipment coupled with the device.3. The method of claim 1 , wherein the service is a service running on a local host.4. The method of claim 1 , wherein the identity token comprises an attribute that distinguishes the identity token as a forensics identity token.5. The method of claim 4 , wherein digital files uploaded with the forensics identity token are labeled by the service as being uploaded during a forensics procedure rather than a normal upload procedure.6. The method of claim 1 , wherein the digital file is an encrypted digital file.7. The method of claim 6 , wherein a key needed to decrypt the encrypted digital file is managed by the service.8. The method of claim 7 , wherein the key is not accessible by the recovery app.9. The method of claim 1 , wherein the step of retrieving the digital file from the locked device comprises retrieving the digital file from encrypted storage on the locked device.10. The method of claim 1 , the method further comprising assigning an attribute to the digital file claim 1 , wherein the attribute indicates that the digital file is accessible by the recovery app.11. The method of claim 1 , the method further comprising the step of executing the recovery app when the locked device is rebooted.12. The method of claim 11 , wherein the ...

MOBILE DEVICE HAVING TRUSTED EXECUTION ENVIRONMENT

A mechanism for securing a mobile app for execution on a mobile device. The mechanism includes loading a non-trusted portion of the mobile app from a non-trusted application provider onto the mobile device, operating a key provisioning server to generate keys associated with a trusted execution environment, transmitting the keys associated with the trusted execution environment to the mobile device and to a key directory server, authenticate the mobile device, and upon authenticating the mobile device, transmitting a trusted portion of the mobile app including a trusted application to the mobile device, and installing the trusted portion of the mobile app on the mobile device thereby providing a trusted execution environment. Other systems and methods are disclosed. 1. A method for securing a mobile application for execution on a mobile device , comprising: load a non-trusted portion of the mobile application from a non-trusted application provider onto the mobile device;', 'load a trusted portion of the mobile application from a trusted application provider into the mobile device;', 'install the trusted portion of the mobile application on the mobile device thereby providing a trusted execution environment., 'the mobile device being configured to2. The method for securing the mobile application for execution on the mobile device according to claim 1 , wherein the loading of the trusted portion of the mobile application into the mobile device comprises the following steps:the mobile application generates a trusted execution environment id TEE ID from an identifier of the mobile application and a device fingerprint of the mobile device; said generated a trusted execution environment id TEE ID being transmitted by the mobile application to a key provisioning server;operating the key provisioning server to generate keys to be associated with the trusted execution environment id TEE ID and transmitting to a key director the trusted execution environment id TEE ID and ...

ELECTRONIC DEVICE USING HOMOMORPHIC ENCRYPTION AND ENCRYPTED DATA PROCESSING METHOD THEREOF

An electronic device includes a memory storing data from an external source, an application processing unit (APU) transmitting a secret key and public key generation command, an isolated execution environment (IEE) generating a secret key in response to the secret key generation command, generating a public key based on the secret key in response to the public key generation command, and storing the secret key, and a non-volatile memory performing write and read operations depending on a request of the APU. When the data are stored in the memory, the APU transmits a public key request to the IEE and in response the IEE transfers the public key to the APU through a mailbox protocol. The APU generates a ciphertext by performing homomorphic encryption on the data based on an encryption key in the public key, and classifies and stores the public key and the ciphertext in the non-volatile memory. 1. An electronic device comprising:a memory configured to store data received from an external source;an application processing unit (APU) configured to transmit a secret key generation command and a public key generation command;an isolated execution environment (IEE) configured to generate a secret key in response to the secret key generation command, to generate a public key based on the secret key in response to the public key generation command, and to store the secret key; anda non-volatile memory configured to perform a write operation and a read operation depending on a request of the APU,wherein, when the data are stored in the memory, the APU transmits a public key request to the IEE,wherein the IEE transfers the public key to the APU through a mailbox protocol in response to the public key request,wherein the APU generates a ciphertext by performing homomorphic encryption on the data based on an encryption key included in the public key, andwherein the APU classifies and stores the public key and the ciphertext in the non-volatile memory.2. The electronic device of ...

Oblivious Comparisons and Quicksort of Secret Shared Arithmetic Values in a Multi-Party Computing Setting

An oblivious comparison method takes as input two secret shared numerical values x and y and outputs a secret shared bit that is the result of the comparison of x and y (e.g. 1 if x Подробнее

SECURE DATA STORAGE FOR ANONYMIZED CONTACT TRACING

Disclosed are various embodiments for securely storing data while an application is executing in a background state. An application can receive a message containing data, wherein the message is received by the application while the application is executing in a background state. The application can then encrypt the data in the message using a public key accessible to the application to generate encrypted data. Next, the application can store the encrypted data in an alternate data store. Subsequently, the application can authenticate a user of the computing device and switch execution to the foreground in response. Then, the application can decrypt a secure data store using an application specific encryption key. Next, the application can decrypt the encrypted data using a respective private key for the public key to generate decrypted data. The application can then store the decrypted data in the decrypted secure data store. 1. A system , comprising:a computing device comprising a processor and a memory;a secure data store contained in the memory, the secure data store being encrypted by an application specific encryption key;an alternate data store contained in the memory; and receive a message containing data, wherein the message is received by the application while the application is executing in a background state;', 'encrypt the data in the message using a public key accessible to the application to generate encrypted data;', 'store the encrypted data in the alternate data store;', 'authenticate a user of the computing device;', 'switch execution to the foreground in response to authentication of the user;', 'decrypt the secure data store using the application specific encryption key in response to switching execution to the foreground;', 'decrypt the encrypted data using a respective private key for the public key to generate decrypted data; and', 'store the decrypted data in the decrypted secure data store., 'an application comprising machine-readable ...

Private key cloud storage

A system ( 1 ) for asymmetrical cryptography, comprising a device ( 10 ) and a network storage ( 30 ), wherein the device is communicatively connected to the network storage, wherein the network storage is configured to store a private key, wherein the device is configured to retrieve the private key from the network storage to perform a cryptographic operation using the private key in a secure execution environment ( 12 ) of the device, and wherein the secure execution environment is configured to only temporarily store the private key for the cryptographic operation.

Rolling biometric key exchange

Various embodiments are generally directed to techniques of generating a unique biometric key, hashing and salting the key, and storing it. Embodiments include techniques to analyze biological information associated with a user and determine one or more biological characteristics from the analyzed information. The biological characteristics may be used to generate a character string unique to the user, which may be used to generate the biometric key based on a cryptographic algorithm. The hash values, salt values, or the hash function may be changed at a predetermined interval.

Digital Identity Escrow Methods and Systems

An illustrative method includes an escrow system receiving an access request from a service provider system for the service provider system to have access to a digital identity of a user when the user attempts to access a service provided by the service provider system; transmitting, based on the access request, an authorization request to a computing device associated with the user, the authorization request prompting the user to authorize sharing of the digital identity with the service provider system, the transmitting of the authorization request comprising transmitting a push notification to the computing device, and receiving, from the computing device associated with the user, authorization data indicating that the user authorizes sharing of the digital identity with the service provider system. 1. A method comprising:receiving, by an escrow system, an access request from a service provider system for the service provider system to have access to a digital identity of a user when the user attempts to access a service provided by the service provider system;transmitting, by the escrow system based on the access request, an authorization request to a computing device associated with the user, the authorization request prompting the user to authorize sharing of the digital identity with the service provider system, the transmitting of the authorization request comprising transmitting a push notification to the computing device; andreceiving, by the escrow system from the computing device associated with the user, authorization data indicating that the user authorizes sharing of the digital identity with the service provider system.2. The method of claim 1 , further comprising providing claim 1 , by the escrow system based on the receiving the authorization data from the computing device associated with the user claim 1 , the service provider system with access to the digital identity.3. The method of claim 2 , wherein the providing of the service provider system ...

SYSTEMS AND METHODS FOR DISTRIBUTING AND SECURING DATA

A robust computational secret sharing scheme that provides for the efficient distribution and subsequent recovery of a private data is disclosed. A cryptographic key may be randomly generated and then shared using a secret sharing algorithm to generate a collection of key shares. The private data may be encrypted using the key, resulting in a ciphertext. The ciphertext may then be broken into ciphertext fragments using an Information Dispersal Algorithm. Each key share and a corresponding ciphertext. Fragment are provided as input to a committal method of a probabilistic commitment scheme, resulting in a committal value and a decommittal value. The share for the robust computational secret sharing scheme may be obtained by combining the key share, the ciphertext fragment, the decommittal value, and the vector of committal values. 1. (canceled)2. A method for verifying a share of data , the method comprising:receiving, from a storage device, a fragment comprising data to be verified, a decommittal value, and a plurality of committal values, wherein the data to be verified comprises a string of characters;determining a consensus committal value from the plurality of committal values;calculating a hash value using the string of characters;comparing the calculated hash value to the consensus committal value;in response to determining that the calculated hash value equals the consensus committal value, storing to memory an indication that the data to be verified is a valid share of data; andin response to determining that the calculated hash value does not equal the consensus committal value, storing to memory an indication that the data to be verified is not a valid share of data.3. The method of claim 2 , wherein determining the consensus committal value comprises identifying a most frequently occurring committal value of the plurality of committal values.4. The method of claim 2 , wherein determining the consensus committal value comprises:receiving an identification ...

RESILIENT SECRET SHARING CLOUD BASED ARCHITECTURE FOR DATA VAULT

A method of securely storing data including: providing, within a secure data storage system, a plurality of secret sharing methods for selection and identifying a striping policy for storage of the data, in accordance with input preferences. The data can be split into N secret shares according to a secret sharing method, the selection being determined by the striping policy, wherein a threshold number, T, of such shares is sufficient to recover the data, where T is less than N, generating metadata associated with the data, the metadata identifying the selected secret sharing method and storing the metadata within the secure data storage system and writing the secret shares to storage that includes storage outside the secure data storage system, such that, when at least T shares are retrieved, the metadata can be recalled to identify the selected secret sharing method for recovery of the data. 1. A method of securely storing data comprising:providing, within a secure data storage system, a plurality of secret sharing methods for selection;identifying a striping policy for storage of the data, in accordance with input preferences;splitting the data into a plurality, N, of secret shares according to a selected one of the plurality of secret sharing methods, the selection being determined by the striping policy, wherein a threshold number, T, of such shares is sufficient to recover the data, where T is less than N,generating metadata associated with the data, the metadata identifying the selected secret sharing method and storing the metadata within the secure data storage system;writing the secret shares to storage that includes storage outside the secure data storage system, such that, when at least T shares are retrieved, the metadata can be recalled to identify the selected secret sharing method for recovery of the data.2. The method of claim 1 , wherein the secret sharing methods include methods with relatively high security but relatively low resilience and ...

ACCREDITED CERTIFICATE ISSUANCE SYSTEM BASED ON BLOCK CHAIN AND ACCREDITED CERTIFICATE ISSUANCE METHOD BASED ON BLOCK CHAIN USING SAME, AND ACCREDITED CERTIFICATE AUTHENTICATION SYSTEM BASED ON BLOCK CHAIN AND ACCREDITED CERTIFICATE AUTHENTICATION METHOD BASED ON BLOCK CHAIN USING SAME

The present invention relates to an accredited certificate issuance system based on a block chain and an accredited certificate issuance method based on block chain using the same, and an accredited certificate authentication system based on a block chain and an accredited certificate authentication method based on a block chain using the same, which disenable a leak of a personal key for accredited certification by autonomously generating, storing and managing the personal key for accredited certification by means of a random number generator mounted in a terminal in which it is impossible to install a function or an additional program for physically accessing and reading the inside of a system; enable a public key for accredited certification, which requires maintenance, to be stored and managed in a block chain of electronic wallets mounted in block chain retention servers via a peer-to-peer (P2P) network-based distribution database, not in a server operated by an accredited certificate authority (CA), and thus incur almost no costs for maintenance by, if hacking occurs, preventing occurrence of costs for establishing an accredited certificate issuance system having an advanced security system interworking therewith so as to maximally prevent hacking, and costs for operating and maintaining the established accredited certificate issuance system; and can perform an accredited certification process even if ActiveX is not established. 1. A system for issuing a public certificate based on a blockchain , comprising:an information security device instructing its encryption engine to create a public key for the public certificate based on a private key for the public certificate stored and managed in a memory and transmit the created public key in response to a request for transmission of the public key, wherein the private key is acquired based on a random value generated from a random number generator and stored in the memory and then provided to a user;a user device ...

WIRELESS SECURITY PROTOCOL

This disclosure relates to a data storage device. A data port transmits data between a host computer system and the data storage device over a data channel. The device repeatedly broadcasts advertising packets over a wireless communication channel different from the data channel. Each advertising packet comprises a random value and a message authentication code calculated based on the random value and an identity key. The identity key is readable by a device to be connected and in proximity of the data storage device out of band of the data channel and the communication channel. The identity key enables the device to be connected to verify the message authentication code based on the random value and the identity key to thereby authenticate the data storage device. 1. A data storage device comprising a data path , a data store and an access controller , wherein: a data port configured to transmit data between a host computer system and the data storage device over a data channel, wherein the data storage device is configured to register with the host computer system as a block data storage device;', 'a non-volatile storage medium configured to store encrypted user content data; and', 'a cryptography engine connected between the data port and the storage medium and configured to use a cryptographic key to decrypt the encrypted user content data stored on the storage medium in response to a request from the host computer system;, 'the data path comprisesthe data store is configured to store an identity key; 'repeatedly broadcast advertising packets over a wireless communication channel different from the data channel, each advertising packet comprising a random value and a message authentication code calculated based on the random value and the identity key; and', 'the access controller is configured tothe identity key is readable by a device to be connected and in proximity of the data storage device out of band of the data channel and the communication channel, the ...

DECOUPLING IDENTITY FROM DEVICES IN THE INTERNET OF THINGS

This invention provides for data generated by intelligent devices exchanging information about their operation and performance over the so-called “Internet of Things” to be unidentified. Where particulars about an individual associated with a networked device are relevant to the operation and performance of the device, this invention provides for said particulars to be made available in digital certificates bound to the device. Data records generated by the device when operating with a certain individual are digitally signed at the time and later verified using said certificates, thus reliably conveying those particulars with the data. The identity of the individual is decoupled from the device and the data generated by the device. 1. A method for securely associating information about the user of a networked device with data produced by said device , the method comprising:securely storing a cryptographic Private Key in association with said device, and creating a Public Key Certificate corresponding to said Private Key, the Public Key Certificate containing information about said user, and the Public Key Certificate being signed by or on behalf of an organization attesting to the information;whereby at a time said device produces data about the operation of the device with said user, that data is digitally signed using said Private Key.2. The method of wherein the Private Key is stored within the device.3. (canceled)4. The method of wherein the Private Key is stored in a car key.5. The method of any of wherein the Public Key Certificate includes information about the device.68.-. (canceled)9. The method of wherein the data about the operation of the device is medical data.10. (canceled)11. The method of wherein the data about the operation of the device is locational data.1228.-. (canceled)29. A method for securely associating particulars about the user of a networked device with records generated by said device claim 1 , the method comprising:securely storing a ...

Systems, Methods and Apparatuses for the Application-Specific Identification of Devices

The systems, methods and apparatuses described herein provide a computing environment that manages application specific identification of devices. An apparatus according to the present disclosure may comprise a non-volatile storage storing identifier (ID) base data and a processor. The processor may be configured to validate a certificate of an application being executed on the apparatus. The certificate may contain a code signer ID for a code signer of the application. The processor may further be configured to receive a request for a unique ID of the application, generate the unique ID from the code signer ID and the ID base data and return the generated unique ID.

Multivariate Signature Method for Resisting Key Recovery Attack

A multivariate signature method for resisting key recovery attack, which establishes a new signature verification condition by adding additional value of signature. The verification condition implies verification of internal information x and y, thereby effectively resisting key recovery attack generated by the existence of equivalence key. Specifically, the method includes the three stages of data preprocessing, signature generation and signature verification. The invention is a signature authentication method based on polynomial equations of a plurality of variables in a finite field, which can effectively resist the key recovery attack, provide the basic technical support for the information security and the establishment of the trust system in the quantum computer era, and provide a secure digital signature option in the quantum era. The present invention is especially suitable for use under application condition which has limited storage and processing time, such as smart cards, wireless sensor networks and dynamic RFID tags. 1. A multivariate signature method for resisting Key Recovery Attack , characterized in that , the method comprises the steps of:Step 1: selecting system parameters:{'sup': n', 'm', 'n', 'm', '−1', '−1', 'n', 'm', '−1', '−1', 'n', '−1', '−1', '−1', '−1, 'sub': 1', '1', 'n', 'm', '1', 'n', '1', '1', 'n', 'n', '1', 'n', '1', 'n', '1', '1', 'n', 'n', '1', 'n, 'Taking a finite field F, positive integers n and m, a n-th extended field of F as F, a m-th extended field of F as F, taking a set of multivariable quadratic polynomial equations q(x, . . . , x), . . . , q(x, . . . , x) from Fto Fwhich is recorded as Q and then Q represents a center mapping of multivariate public key cryptographic system, where an input variable is n and an output variable is m, using Qfor the inverse polynomial of polynomial Q, where Qis held by a legitimate user, taking another reversible affine transformation S and T on Fand Fas a secret key and their inverse ...

Maintaining Operating System Secrets Across Resets

A device includes a reset resistant store and a trusted key service. The reset resistant store maintains data across various different device reset or data invalidation operations. The trusted key service maintains, for each of one or more operating systems that run on the device from a boot configuration, an encrypted key associated with the boot configuration. The device also has a master key that is specific to the device. Each of the keys associated with a boot configuration is encrypted using the master key. When booting the device, the boot configuration being run on the device is identified, and the key associated with that boot configuration is obtained (e.g., from the reset resistant store or the encrypted key vault). The master key is used to decrypt the obtained key, and the obtained key is used to decrypt secrets associated with the operating system run from the boot configuration. 1. A method implemented in a computing device , the method comprising:obtaining a master key associated with the computing device;identifying a current boot configuration of the computing device;obtaining an encrypted boot configuration specific key associated with the current boot configuration;using the master key to decrypt the encrypted boot configuration specific key; andusing the decrypted boot configuration specific key to decrypt data associated with a current operating system of the computing device running from the boot configuration.2. The method as recited in claim 1 , further comprising allowing changes to the data associated with the current operating system only if a policy associated with the boot configuration specific key is satisfied.3. The method as recited in claim 1 , further comprising maintaining the data associated with the current operating system across operating system re-installs and operating system resets.4. The method as recited in claim 1 , further comprising maintaining the decrypted boot configuration specific key in a Trusted Platform Module ...

SESSION KEY REPOSITORY

In one implementation, a system for a session key repository includes a monitor engine to monitor communication between a first computing device and a second computing device that is encrypted with a private key, an identification engine to determine a number of session keys and session IDs that correspond to the encrypted communication, a rules engine to determine a number of rules for storing and sharing the number of corresponding session keys and session IDs, a repository engine to send a portion of the number of session keys and session IDs to a network tool based on the number of rules and identification of the network tool. 1. A system for a session key repository , comprising:a monitor engine to monitor communication between a first computing device and a second computing device that is encrypted with a private key;an identification engine to determine a number of session keys and session IDs that correspond to the encrypted communication;a rules engine to determine a number of rules for storing and sharing the number of corresponding session keys and session IDs; anda repository engine to send a portion of the number of session keys and session IDs to a network tool based on the number of rules and identification of the network tool.2. The system of claim 1 , wherein the repository engine stores a number of captured packets (PCAPs) of the encrypted communication based on the number of rules.3. The system of claim 1 , comprising an encryption engine to decrypt portions of the encrypted communication with the corresponding stored session key and session ID.4. The system of claim 1 , wherein the monitor engine sends live communication to the network tool that is encrypted by the private key.5. The system of claim 4 , wherein the repository engine receives a request for a number of session keys corresponding to the live communication from the network tool and sends a portion of the requested number of session keys to the network tool based on the number of ...

CRYPTOGRAPHIC KEY MANAGEMENT

Cryptographic key provisioning by determining future cryptographic key demand according to historic key demand and key access requirements, determining cryptographic key provisioning resources for the future cryptographic key demand, and providing cryptographic keys, prior to the determined future cryptographic key demand using the cryptographic key provisioning resources. 1. A computer implemented method for cryptographic key provisioning , the method comprising:determining future cryptographic key demand according to historic key demand and key access requirements;determining cryptographic key provisioning resources for the future cryptographic key demand; andproviding cryptographic keys prior to the future cryptographic key demand using the cryptographic key provisioning resources.2. The computer implemented method according to claim 1 , further comprising:identifying non-compliant system activity associated with cryptographic key demand, wherein the non-compliant system activity is not associated with the future cryptographic key demand; andrefusing to provide a cryptographic key in response to the non-compliant system activity.3. The computer implemented method according to claim 1 , further comprising:provisioning cryptographic keys having a defined life-cycle, according to a user location.4. The computer implemented method according to claim 1 , further comprising:provisioning cryptographic keys according to a ranking function.5. The computer implemented method according to claim 4 , wherein the ranking function is selected from the group consisting of: active time of a requesting entity claim 4 , number of requests by the entity claim 4 , average key usage time claim 4 , and compliance level of the entity.6. The computer implemented method according to claim 1 , further comprising provisioning cryptographic keys according to a threshold limit.7. The computer implemented method according to claim 6 , wherein the threshold limit is based at least in part on a ...

SECURELY PROCESSING SECRET VALUES IN APPLICATION CONFIGURATIONS

Provided are techniques for securely processing secret values in application configurations. A configuration file for an application is retrieved from a first repository, where the configuration file stores a configuration value and a link to a secret value in a second repository. The secret value is retrieved from the second repository using the link. The configuration value is hashed to output a hashed configuration value and the secret value is hashed to output a hashed secret value. The hashed configuration value is signed, with a private key, to output a hashed and signed configuration value, and the hashed secret value is signed, with the private key, to output a hashed and signed secret value. The configuration value, the secret value, the hashed and signed configuration value, and the hashed and signed secret value are stored in a release file. The application is executed using the release file. 1. A computer-implemented method , comprising operations for:retrieving a configuration file for an application from a first repository, wherein the configuration file stores a configuration value and a link to a secret value in a second repository;retrieving the secret value from the second repository using the link to the secret value in the configuration file;hashing the configuration value to output a hashed configuration value and the secret value to output a hashed secret value; andsigning, with a private key, the hashed configuration value to output a hashed and signed configuration value and the hashed secret value to output a hashed and signed secret value; andstoring the configuration value, the secret value, the hashed and signed configuration value, and the hashed and signed secret value in a release file, wherein the configuration value and the secret value are environment variables; andexecuting the application using the release file.2. The computer-implemented method of claim 1 , wherein the configuration file stores a plurality of links claim 1 , and ...

STRONG RESOURCE IDENTITY IN A CLOUD HOSTED SYSTEM

Aspects of the present disclosure relate to systems and methods for providing strong resource identification. When a resource is created, saved, or re-based, a cryptographic key pair may be generated and associated with the resource. A public key of the cryptographic key pair may be used as a unique identifier. Information about the resource, such as the name of the resource and its actual location may be stored in an index based upon the resource's public key. Sharing the resource with other devices may comprise sending the resource's key, as opposed to information about the resource's actual location, to one or more recipient device. 1. A system comprising:at least one processor; andmemory storing instructions that, when executed by the at least one processor, perform a method comprising:generating a resource;generating a cryptographic key pair;associating a public key from the cryptographic key pair with the resource;storing the resource; andadding information about the resource to a resource index, wherein the resource is indexed by the public key associated with the resource.2. The system of claim 1 , wherein the information about the resource comprises information identifying an actual location of the resource.3. The system of claim 1 , wherein the method further comprises storing a private key from the cryptographic key pair in at least one of a private store and a key vault.4. The system of claim 1 , wherein associating the public key with the resource comprises adding the public key to the resource.5. The system of claim 1 , wherein associating the public key with the resource comprises adding information about the public key to metadata associated with the resource.6. The system of claim 1 , wherein the resource comprises at least one of:a document;a web page;a spreadsheet;a presentation;a data structure;a file; andan application.7. The system of claim 1 , wherein the method further comprises providing the public key claim 1 , wherein providing the public ...

MULTI-TENANT DATA PROTECTION IN A CENTRALIZED NETWORK ENVIRONMENT

Data can be protected in a centralized tokenization environment. A security value is received by a central server from a client device. The central server accesses a token table corresponding to the client device and generates a reshuffled static token table from the accessed token table based on the received security value. When the client device subsequently provides data to be protected to the central server, the central server tokenizes the provided data using the reshuffled static token table and stores the tokenized data in a multi-tenant database. By reshuffling token tables using security values unique to client devices, the central server can protect and store data for each of multiple tenants such that if the data of one tenant is compromised, the data of each other tenant is not compromised. 1. A method for securing data in a centralized environment comprising:receiving, by a central server from a client device associated with a user account, an encrypted security value, the client device configured to access the encrypted security value from a hardware security device separate from and coupled to the client device;in response to receiving a request to protect data from the client device, providing, by the central server, the encrypted security value previously provided by the client device and stored by the central server to the client device for decryption and receiving a decrypted security value from the client device in response;accessing, by the central server, a token table based at least in part on one or more characteristics of the client device and the decrypted security value, the token table mapping each of a plurality of input values to a different token value;tokenizing, by the central server, the data using the token table by querying the token table with a value of a portion of the data to identify a token value mapped to the value of the portion of the data and replacing the portion of the data with the identified token value; andproviding ...

BLOCK CHAIN-BASED NODE DEVICE, METHOD FOR OPERATING NODE DEVICE, AND DATA PROCESSING SYSTEM

The present invention relates to a block chain-based method of generating data block shared between a plurality of nodes. According to an example, the method for generating the data block may comprise a step for obtaining at least one binding data having public or private characteristics; a step for determining a binding key having a decoding permission level for each binding data; a step for encoding the binding data using the binding key; and a step for generating a data block including the encoded binding data, and at least a portion of the binding key. 1. A method for generating a data block which configures a block chain and is shared between a plurality of nodes comprises:a step for obtaining at least one binding data having public or private characteristics;a step for determining a binding key having a decoding permission level for each binding data;a step for encoding the binding data using the binding key; anda step for generating a data block including the encoded binding data, and at least a portion of the binding key.2. The method for generating a data block of the claim 1 , wherein the data block comprises:a header region including index information indicating the type of the at least one binding data;a public region into which a hash value of the at least one binding data stored in the data block is stored;a binding region in which the encoded binding data and at least a portion of the binding key are stored; anda private region in which encoded private data is stored.3. The method for generating a data block of the claim 2 , wherein the header region further comprises:at least more than one among a hash value of the encoded private region;at least a portion of a first public key that restricts access of an unauthorized node for the data block; anda count number of an integrity verification of the data block.4. The method for generating a data block of the claim 2 , wherein the public region comprises a public data including a type information ...

DATA ENCRYPTION AND DECRYPTION METHOD AND ENCRYPTION AND DECRYPTION DEVICE

An encryption method for data includes acquiring data to be encrypted and user information set relevant to the encryption, sending a key acquisition instruction to a terminal corresponding to the user information, receiving a key returned from the terminal corresponding to the user information, encrypting the data to be encrypted by using the key, and transmitting encrypted data to the terminal corresponding to the user information. 1. An encryption method for data comprising:acquiring data to be encrypted and user information set relevant to the encryption;sending a key acquisition instruction to a terminal corresponding to the user information based on the user information set relevant to the encryption;receiving a key returned from the terminal corresponding to the user information;encrypting the data to be encrypted by using the key; andtransmitting encrypted data to the terminal corresponding to the user information.2. The encryption method as claimed in claim 1 , wherein after the step of acquiring the data to be encrypted and the user information set relevant to the encryption claim 1 , the encryption method further comprises:acquiring user information of a local terminal that is set;acquiring eyeball information of a user of the local terminal based on the user information of the local terminal;the step of encrypting the data to be encrypted by using the key comprising:using the key and the eyeball information of the user of the local terminal to encrypt the data to be encrypted.3. The encryption method as claimed in claim 1 , wherein after the step of sending the key acquisition instruction to the terminal corresponding to the user information claim 1 , the encryption method further comprises:determining whether the key returned from the terminal corresponding to the user information is received within a predetermined time period;rejecting a data transmission operation if it is determined that the key returned from the terminal corresponding to the user ...

SECURE DOMAIN MANAGER

Particular embodiments described herein provide for an electronic device that can be configured to determine that a secure domain has been created on a device, where keys are required to access the secure domain, obtain the keys that are required to access the secure domain from a network element, and encrypt the keys and store the encrypted keys on the device. In an example, only the secure domain can decrypt the encrypted keys and the device is a virtual machine. 1. At least one machine readable medium comprising one or more instructions that when executed by at least one processor , cause the at least one processor to:determine that a secure domain has been created on a device in a cloud network, wherein keys are required to access the secure domain;obtain the keys that are required to access the secure domain from a network element; andencrypt the keys and store the encrypted keys on the device.2. The at least one machine readable medium of claim 1 , wherein only the secure domain can decrypt the encrypted keys.3. The at least one machine readable medium of claim 1 , wherein the device is a virtual machine.4. The at least one machine readable medium of claim 3 , further comprising one or more instructions that when executed by the at least one processor claim 3 , cause the at least one processor to:migrate the secure domain to a target device.5. The at least one machine readable medium of claim 4 , wherein the target device is verified by a platform manager before it can receive the secure domain.6. The at least one machine readable medium of claim 4 , wherein a secure channel of communication is created between the device and the target device.7. The at least one computer-readable medium of claim 4 , wherein speculative copies of unmodified evolved packet core pages are sent to the target device before suspension of the secure domain on the secure device.8. The at least one machine readable medium of claim 7 , wherein the virtual machine that includes the ...

Method and system for privacy preserving computation in cloud using fully homomorphic encryption

Certain embodiments relate to noise-free fully homomorphic symmetric key encryption (FHE) schemes without bootstrapping based on octonion algebra over finite fields and finite rings, this disclosure introduces. The FHE schemes may be secure in the ciphertext-only security model. Certain embodiments also relate to a method for a client to carry out privacy preserving computation in a server where the client upload her encrypted data and encrypted program to the server. The server may run the encrypted program on the encrypted data and return encrypted output to the client. The client may decrypt the encrypted output to get the actual output.

SYSTEM AND METHOD FOR AUTONOMOUS DYNAMIC PERSON MANAGEMENT

A system and method for persona management in online environments provides an identity by proxy with trusted parties having portions of the private cryptographic key of the consumer so that the private cryptographic key of the consumer may be generated. The system and method implements the persona management in online environments in one embodiment using an immutable ledger with decentralized transaction consensus and a process to share portions of the private cryptographic key with trusted third parties. 1. A method for persona management , comprising:storing an identity of a user in a location, the location storing a private cryptographic key associated with the identity of the user;generating a plurality of portions of the private cryptographic key, each portion of the private cryptographic key being encrypted for a trusted party to whom the encrypted portion of the private cryptographic key is being shared and each portion of the private cryptographic key being insufficient to generate the private cryptographic key;distributing the plurality of encrypted portions of the private cryptographic key to a plurality of different trusted parties;storing the distribution of each encrypted portion of the private cryptographic key to each trusted party in an immutable ledger having decentralized transaction consensus; andgenerating the private cryptographic key of the user using a subset of the plurality of encrypted portions of the private cryptographic key.2. The method of further comprising requesting claim 1 , by a new wallet of the user claim 1 , to regenerate the private cryptographic key of the user using a subset of the plurality of encrypted portions of the private cryptographic key.3. The method of claim 1 , wherein generating a plurality of portions of the private cryptographic key further comprising using a sharing process that generates the plurality of portions of the private cryptographic key.4. The method of claim 3 , wherein the sharing process is one of ...

ENCRYPTING OBJECT INDEX IN A DISTRIBUTED STORAGE ENVIRONMENT

A system receives data of one or more types from one or more sources having distinct identities for storing the data in a distributed storage system. The system stores metadata associated with storing the data in data structures in the distributed storage system. The system selects a portion of the data and a portion of the metadata associated with storing the data in the distributed storage system. The system compresses the selected portions of the data and the metadata, encrypts the compressed data and metadata using a single key or using a separate key for each data type, and stores the encrypted compressed data and metadata in the distributed storage system. The system also encrypts unencrypted metadata and associated data during defragmentation procedure. 1. A system comprising:a processor; andmachine readable instructions, stored on a tangible machine readable medium, when executed by the processor, configure the processor to:receive requests to store data in a distributed storage system implemented in a cloud computing system, the requests received at a first layer of servers in the distributed storage system, the first layer of servers configured to authenticate and authorize the requests;send the requests and data associated with the requests upon authentication and authorization of the requests to a second layer of servers in the distributed storage system, the second layer of servers configured to store data structures that include metadata associated with storing the data in a third layer of servers in the distributed storage system;compress the metadata associated with storing the data in the third layer of servers in the distributed storage system;encrypt the compressed metadata; andstore the encrypted compressed metadata in the third layer of servers in the distributed storage system.2. The system of wherein the machine readable instructions configure the processor to:compress at least a portion of the data when compressing the metadata;encrypt the ...

Key Encryption Methods, Apparatuses, and Systems

Key encryption methods, apparatuses and systems are disclosed in the embodiments of the present disclosure. A client does not store an encryption algorithm used for encrypting a key, but only stores an information header encrypted by the encryption algorithm, so that an attacker cannot directly obtain the encryption algorithm that is used for decrypting the information header even if the client is attacked, thus improving the security of the key in the client. When the key is needed to be used to encrypt obtained data, the client can use the stored first information header to request the key from the server, and the server having a higher security restores the key based on a stored first encryption algorithm. The client can encrypt the data using the key obtained from the server, so that the client can ensure the security of the obtained data without storing the encryption algorithm. 1. A method implemented by one or more processors of a client , the method comprising:sending a first information header used for requesting to obtain a key to a server, wherein the key is restored by the server from the first information header according a first encryption algorithm; andreceiving a second information header and the key from the server, and the second information header is obtained by the server after encrypting the key based on a second encryption algorithm.2. The method of claim 1 , wherein: before sending the first information header used for requesting to obtain the key to the server claim 1 , the method further comprising:determining whether an information header is stored locally.3. The method of claim 2 , wherein: if an information header is not stored locally claim 2 , the method further comprises:sending a key acquisition request to the server;obtaining the first information header and the key from the server; andstoring the first information header locally.4. The method of claim 2 , wherein: if an information header is stored locally claim 2 , the method ...

BUILDING OR ENCLOSURE TERMINATION CLOSING AND/OR OPENING APPARATUS, AND METHOD FOR OPERATING A BUILDING OR ENCLOSURE TERMINATION

The invention relates to a building or enclosure termination opening and/or closing apparatus () having communication signed or encrypted by means of a key, and to a method for operating such. To allow simple, convenient and secure use by exclusively authorised users, the apparatus comprises: a first and a second user terminal (), with secure forwarding of a time-limited key from the first to the second user terminal being possible. According to an alternative, individual keys are generated by a user identification () and a secret device key (). 1. A building or enclosure termination opening and/or closing apparatus comprising: a building or enclosure termination communication device configured to receive and/or transmit encrypted and/or signed messages, and', 'an individual authentication device for each building or enclosure termination opening and/or closing device which initiates the actuation signal on receipt of a valid authentication code generated from one or more code keys, and with, 'a building or enclosure termination opening and/or closing device comprising an actuator that can be actuated by an actuation signal to allow or block access through a building or enclosure termination,'} at least one second individual mobile user terminal is provided which comprises a user terminal communication device configured to transmit and/or receive encrypted and/or signed messages, a memory configured to store at least one temporary user key, and an encryption device configured to encrypt and/or sign messages with the at least one temporary user key, wherein the first individual mobile user terminal is configured to receive or to generate from user defaults information about a time limit for temporary authentication of a second user and to generate from that information about the time limit and from the individual user key a temporary user key that includes information about the individual user key and the time limit and to forward the temporary user key to the at ...

CLOUD BASED MULTI-KEY AUTHORIZATION BASED SYSTEM

Using various embodiments, methods and systems for securing user data are described. In one embodiment, a system includes a server side application accessing a service key from a conventional key vault and an escrowed key which can then be used to compute a key to the key using which information can be encrypted. Other embodiments include using a timer service to further safeguard secure user information. 1. A system , comprising:a memory device;a processing system, comprising at least one hardware core coupled to the memory device, wherein the processing system is configured to:retrieve a first key, the first key stored at first key management service;retrieve a second key, the second key stored at a second key management service;generate a third key, wherein the third key generated by associating the first key with the second key;encrypt a key blob using the third key, the key blob including a user key, wherein the user key is used to encrypt sensitive information, the sensitive information is data that needs to be protected; andstore the key blob, wherein the key blob is indexed using a first identifier.2. The system of claim 1 , further configured to:store a second identifier, wherein the second identifier includes the first identifier and identification information of the first and second keys, and wherein the second identifier is transmitted to a requestor that requires decrypting the sensitive information.3. The system of claim 1 , wherein the first key is a key related to a service or application claim 1 , and wherein the second key is an escrowed key.4. The system of claim 1 , wherein the first and second keys are associated by applying at least one of a logic operator or algorithm on the first and second keys to generate the third key.5. The system of claim 2 , further configured to:transmit the second identifier, upon verification that the second identifier was requested within a predetermined period of time.6. The system of claim 5 , wherein the second ...

BIOMETRICS-BASED REMOTE LOGIN

The invention relates to methods and devices for enabling authentication of a user based on biometric data. In an aspect of the invention, a method performed by a client device of enabling authentication of user of the client device with a network node over a secure communication channel based on biometric data is provided. 1. A method performed by a network node of enabling authentication of a user of a client device over a secure communication channel based on biometric data , comprising:receiving a request from the client device to enroll the biometric data of the user captured at the client device; andreceiving, from the client device, transformed biometric data, said biometric data having been transformed into non-invertible biometric data, a fuzzy vault containing a client-generated first secret key, the vault being locked using the biometric data of the user, a client-generated second secret key and a client-generated secret random number from which the second secret key is generated in combination with the first secret key.2. The method of claim 1 , further comprising:submitting, to the client device, a feature transformation key enabling the client device to transform the biometric data into non-invertible biometric data.3. The method of claim 2 , further comprising:receiving an indication from the client device that the feature transformation key failed to pass a randomness test, wherein the enrollment of the biometric data is terminated.4. The method of claim 1 , wherein the second secret key is generated by processing the first secret key and the secret random number in a pseudorandom function.5. The method of claim 1 , further comprising:storing the received transformed biometric data, fuzzy vault, second secret key and secret random number in a secure end-user database.6. The method of claim 1 , further comprising:receiving a request from the client device to authenticate the user;receiving, from the client device, transformed biometric data;acquiring ...

DE-DUPLICATION OF DATA STREAMS

A data segment is encrypted to produce an encrypted data segment, and a data tag associated with the data segment is generated. The encrypted data segment is encoded to generate a set of encoded data slices. At least a read-threshold number of encoded data slices are required to reconstruct the encrypted data segment. A set of write slice requests, which includes the set of encoded data slices and the data tag, is transmitted to a DSN memory. A determination is made, based on the data tag, whether a first encoded data slice of the set of encoded data slices is a duplicate of a second encoded data slice already stored within the DSN memory. If it is a duplicate, rather of storing the first encoded data slice, a reference to a location of the second encoded data slice is stored. 1. A method for use in a distributed storage network (DSN) , the method comprising:encrypting a data segment to produce an encrypted data segment;generating a data tag associated with the data segment;encoding the encrypted data segment to generate a set of encoded data slices including a plurality of encoded data slices, wherein at least a read-threshold number of the plurality of encoded data slices included in the set of encoded data slices is required to reconstruct the encrypted data segment;transmitting a set of write slice requests to a DSN memory, the set of write slice requests including the set of encoded data slices, and the data tag;determining, based on the data tag, whether a first encoded data slice of the set of encoded data slices is a duplicate of a second encoded data slice already stored within the DSN memory; andin response to determining that the first encoded data slice is a duplicate of the second encoded data slice, storing a reference to a location where the second encoded data slice is stored, instead of storing the first encoded data slice.2. The method of claim 1 , further comprising:generating a keymasking the key to generate a masked key; andincluding the masked ...

Blockchain infrastructure for securing and/or managing electronic artifacts

Briefly, example methods, apparatuses, and/or articles of manufacture are disclosed that may be implemented, in whole or in part, to facilitate and/or support one or more operations and/or techniques for blockchain infrastructure for securing and/or managing electronic artifacts, such as implemented in connection with one or more computing and/or communication networks and/or protocols.

SYSTEM AND METHOD FOR AUTHENTICATING USERS

A security application for a computing device, e.g., a mobile phone, allows generation of a secret according to a unique user input (e.g., user credentials). The secret is stored in a directory such that it is retrievable when the unique user input is received via a user interface of a device on which the security application executes or is coupled with. Responsive to receiving an identifier associated with the secret, the security application prompts, e.g., via a user interface of the mobile phone, entry of the unique user input; and, subsequently, verifies the unique user input. Following such verification, the security application provides the secret for use in encoding a communication with a remote computer-based station. Entry of the user credentials may be required prior to the security application generating the secret, and may be responsive to receipt of an invitation (e.g., from the remote computer-based station) to generate it. 1. A computing device , comprising a processor and a memory communicably coupled to the processor , said memory storing an application for execution by said processor , which application , when executed by said processor , configures said processor to:generate a secret in response to the computing device receiving a unique user input, and to store said secret at the computing device along with an identifier so as to be retrievable when said unique user input is again provided by a user of the computing device;upon receipt of a first communication including said identifier associated with the secret, prompt the user of the computing device for said unique user input;in response to receiving said unique user input, verify said unique user input; andin response to verifying said unique user input, transmit via a communication interface of the computing device to a remote computer-based station a second communication encoded using the secret, said second communication to authenticate the user to the remote computer-based station.2. The ...

SECURE STORAGE TECHNIQUES UTILIZING CONSORTIUM DISTRIBUTED LEDGERS

Techniques are disclosed for securely managing data. In one example, a service provider receives user image data and user biometric data associated with a user. The service provider generates a user profile cryptographic key based on hashing this data, which may be associated with a user identifier. The service provider may further generate a public/private key pair associated with the user identifier. The public key and the user profile cryptographic key are stored, in association with the user identifier, to a consortium blockchain network. The service provider then receives a request, signed with the private key, to store a document in association with the user identifier. The service provider generates a document cryptographic key of the document, and executes a request to store the document cryptographic key to the blockchain in association with the user profile cryptographic key, the request verified using the public key. 1. A service provider , comprising: communicate with user devices to collect user image data and user biometric data; and', 'generate user profiles based at least in part on the user image data and the user biometric data;, 'an onboarding system comprising an artificial intelligence module, the onboarding system configured to hashing data of the user profiles to generate user profile cryptographic keys;', 'hashing data of documents to generate document cryptographic keys;', 'generating user cryptographic keys, a user cryptographic key being operable for authenticating a user identifier of a user device to execute a transaction via a plurality of consortium member systems; and', 'responsive to a request, verifying an association between a particular user profile cryptographic key and a particular document cryptographic key, the association previously stored to the plurality of consortium member systems; and, 'perform cryptographic functions comprising, 'a cryptographic system configured toa consortium member management system configured to ...

CRYPTOGRAPHIC KEY GENERATION USING KUMMER VARIETIES

An authenticated, ID-based private/public key pair, with a self-certified public key, is generated using Kummer arithmetic without bilinear pairings. Two or more parties can generate such key pairs and use them as their respective long-term key pairs which, when combined with the parties' short-term key pairs, can allow the parties to establish an authenticated, short-term shared key. Some embodiments are suitable for connected vehicles communicating with each other and/or with other systems. Other features are also provided. 1. A method for generating a first private/public key pair by a first computer entity , wherein the first private/public key pair includes a first private key and a corresponding first public key , the method comprising:generating, by the first computer entity, the first private key, wherein the first private key depends on a first scalar, wherein generating the first private key comprises generating the first scalar by using private key material received from a certification authority (CA) and dependent on the CA's private key;generating, by the first computer entity, the first public key corresponding to the first private key and dependent on the private key material, wherein generating the first public key comprises computing, by the first computer entity, an element of a Kummer variety of a finite elliptic curve group, the element being dependent on the private key material.2. The method of wherein the element of the Kummer variety is:±V=[s]Gwherein s is the first scalar, and G is a public element of the elliptic curve.3. The method of wherein the element G has a prime order.4. The method of wherein the order of G corresponds to a predefined security level.5. The method of wherein each of the first private key and the private key material depend on an identity associated with the first computer entity.6. The method of wherein the elliptic curve is a Montgomery curve.7. The method of claim 1 , wherein the first private/public key pair is a ...

PRIVATE DATA SHARING SYSTEM

A novel architecture for a data sharing system (DSS) is disclosed and seeks to ensure the privacy and security of users' personal information. In this type of network, a user's personally identifiable information is stored and transmitted in an encrypted form, with few exceptions. The only key with which that encrypted data can be decrypted, and thus viewed, remains in the sole possession of the user and the user's friends/contacts within the system. This arrangement ensures that a user's personally identifiable information cannot be examined by anyone other than the user or his friends/contacts. This arrangement also makes it more difficult for the web site or service hosting the DSS to exploit its users' personally identifiable information. Such a system facilitates the encryption, storage, exchange and decryption of personal, confidential and/or proprietary data. 1155-. (canceled)156. A method for data exchange between a plurality of personal computing devices in which a third party receives , stores , and transmits data between each of said personal computing devices , comprising:providing a third party data sharing server in network communication with the personal computing devices;establishing an encryption/decryption module on each personal computing device;creating an original data file on one of said personal computing devices;generating a file encryption key and a file decryption key associated with the original data file using the encryption/decryption module;encrypting the original data file with the file encryption key to generate an encrypted original data file;encrypting the file decryption key with a first unique encryption key associated with a first recipient to produce a first encrypted file decryption key;encrypting the file decryption key with a second unique encryption key associated with a second recipient to produce a second encrypted file decryption key;transmitting the encrypted original data file, the first encrypted file decryption key, ...

SYSTEMS AND METHODS FOR REMOTE OWNERSHIP AND CONTENT CONTROL OF MEDIA FILES ON UNTRUSTED SYSTEMS

One example method includes receiving, by a client computing device, a request to open a superfile stored in a memory device at the client computing device, the superfile comprising encrypted content, the request comprising user credential information; in response to receiving the request to open the superfile, communicating, by the client computing device, a request to a remote server to access the superfile, the request including a credential associated with the user account; receiving, from the remote server, cryptographic information; decrypting, using the cryptographic information, the encrypted content; accessing and presenting the decrypted content; and maintaining communications with the remote server while the decrypted content is accessed. 1. A method comprising:receiving, by a client computing device, a request to open a superfile stored in a memory device at the client computing device, the superfile comprising encrypted content, the request comprising user credential information;in response to receiving the request to open the superfile, communicating, by the client computing device, a request to a remote server to access the superfile, the request including a credential associated with the user account;receiving, from the remote server, cryptographic information;decrypting, using the cryptographic information, the encrypted content;accessing and presenting the decrypted content; andmaintaining communications with the remote server while the decrypted content is accessed.2. The method of claim 1 , further comprising claim 1 , providing usage information associated with the superfile while the superfile is open and using the maintained communications with the remote server.3. The method of claim 2 , wherein the usage information indicates a portion of the decrypted content being presented or a user input associated with the decrypted content.4. The method of claim 1 , further comprising claim 1 , while the decrypted content is accessed:receiving modified ...

AUTHENTICATION USING KEY AGREEMENT

A client may transmit an authentication request to a server. the server may initiate a key agreement process using a short-lived private key generated at the server and a public key of the device, generate a shared secret, and derive a symmetric key. The symmetric key may be used to encrypt a random challenge. Further, the server initiates a key agreement process for the client using the partial private key that was generated for the client and the short-lived public key generated at the server. A partial key agreement result and the encrypted random challenge may be transmitted to the client. The client may complete the key agreement process using the partial key agreement result and a respective portion of the private key. The client may derive the encryption key and decrypt the random challenge. An indication of the random challenge may be transmitted to the server, which authenticates the client. 1. A method for authentication of a client to a server , comprising:receiving, at the server and from the client, an authentication request;generating, in response to receiving the authentication request, a short-lived asymmetric key pair on the server, the client being associated with a client public key;generating, based at least in part on receiving the authentication request, a symmetric key using the client public key and a short-lived private key of the short-lived asymmetric key pair;encrypting a random challenge using the symmetric key;generating a partial key agreement result using a first portion of a split private key, the server having transmitted a second portion of the split private key to the client, the split private key being associated with the client public key;transmitting the encrypted random challenge and the partial key agreement result to the client, wherein the client is configured to derive the symmetric key for decrypting the random challenge using the partial key agreement result; andauthenticating the client based at least in part on ...

SELF-SERVICE DEVICE ENCRYPTION KEY ACCESS

Disclosed are various embodiments for providing access to a recovery key of a managed device and rotating the recovery key after it has been accessed. In one example, among others, a system includes a computing device and program instructions. The program instructions can cause the computing device to store a first recovery key for a first managed computing device. The first recovery key is configured to access an encrypted data store of the first managed computing device. A request is received for the first recovery key from a second managed computing device. The first recovery key is transmitted for display on the second managed computing device. A key rotation command is generated for a command queue of the first managed computing device to rotate the first recovery key after transmitting the first recovery key. The second recovery key is received from the second computing device. 1. A system , comprising:a computing device; and generate a first recovery key from an encryption of a data store associated with the computing device;', 'transmit to a management service the first recovery key in an instance in which the data store has been encrypted;', 'decrypt the encrypted data store based on an input of the first recovery key to the computing device;', 'retrieve a first key rotation command from a command queue of the management service, the first key rotation command including an instruction to rotate the first recovery key;', 'generate a second recovery key based on rotating the first recovery key according to the instruction to rotate the first recovery key; and', 'transmit the second recovery key to the management service., 'program instructions executable in the computing device that, when executed by the computing device, cause the computing device to2. The system of claim 1 , wherein the instruction to rotate the first recovery key comprises executing an application programming interface command of an operating system for generating the second recovery key.3 ...

Providing a Cryptographic Information

Cryptographic information is compiled by: (a) determining a first portion of the cryptographic information based on an input and a randomness; (b) checking a rejection criterion based on the first portion; (b1) re-starting step (a) with a different randomness if the rejection criterion is fulfilled; (b2) if not all portions of the cryptographic information have been generated, determining a subsequent portion of the cryptographic information based on the input and the randomness and continuing with step (b) or, otherwise, continuing with step (c); (c) determining the first portion of the cryptographic information based on the input and the randomness; (d) conveying the respective portion of the cryptographic information; and (e) if not all portions of the cryptographic information have been generated, determining a subsequent portion of the cryptographic information based on the input and the randomness and continuing with step (d). 1. A method for compiling a cryptographic information , comprising:(a) determining a first portion of the cryptographic information based on an input and a randomness;(b) checking whether a rejection criterion based on the first portion of the cryptographic information is fulfilled; and(c) re-starting step (a) with a new randomness in the event the rejection criterion is fulfilled with respect to the first portion of the cryptographic information; and, (d1) determining a subsequent portion of the cryptographic information based on the input and the randomness for which the rejection criterion based on the first portion of the cryptographic information was not fulfilled,', '(d2) checking whether the rejection criterion is fulfilled based on the subsequent portion of the cryptographic information, and', '(d3) re-starting step (a) with a new randomness in the event the rejection criterion is fulfilled with respect to the respective subsequent portion of the cryptographic information; and, '(d) for each of any subsequent portion of the ...

Systems and methods for secure delivery of public keys for operating system drivers

In accordance with these and other embodiments of the present disclosure, an information handling system may include a processor and a basic input/output system (BIOS) comprising a program of instructions executable by the processor and configured to cause the processor to initialize one or more information handling resources of the information handling system. The BIOS may be further configured to authenticate a signature of a BIOS driver associated with an information handling resource of the information handling system, and, in response to authenticating the signature of the BIOS driver, extracting a vendor public key from the BIOS driver and storing the vendor public key to a key database of the BIOS, wherein the vendor public key may be used by an operating system to authenticate one or more signed operating system drivers signed with a private key corresponding to the vendor public key.

SYSTEM AND METHOD FOR CREATING AND PROTECTING SECRETS FOR A PLURALITY OF GROUPS

A method for protecting a first secrets file. The method includes an n-bit generator generating a secrets file name for the secrets file and generating a decoy file names for decoy files. The secrets file includes a secret. Each of the decoy files includes decoy file contents, are a same size as the secrets file, and is associated with a modification time within a range of modification times. The modification time of the secrets file is within the range of modification times. The secrets file and decoy files are stored in a secrets directory. 140-. (canceled)41. A method for creating a shared secret for use in communicating confidential information , the method comprising:receiving, via a member user interface, a group identification, user id, and user passcode;generating, by a n-bit generator using the group identification, user id, and user passcode as inputs, a first m-bit result, the first m-bit result including a file name and encryption key;generating, by the n-bit generator using a group-agreed seed as input, a second m-bit result, the second m-bit result including a shared secret;encrypting said shared secret using said encryption key to produce an encrypted shared secret;assigning the file name to the encrypted shared secret; andstoring the encrypted shared secret in a secrets directory under the assigned file name.42. The method of claim 41 , further comprising storing in the secrets directory one or more decoy files claim 41 , each of the decoy files being of similar size as the encrypted shared secret file.43. The method of claim 41 , wherein the shared secret comprises multiple shared secret elements.44. The method of claim 43 , wherein at least some of the shared secret elements are dynamic and others of the shared secret elements are static.45. The method of claim 44 , wherein one or more of the dynamic shared secret elements change each time the shared secret is accessed.46. The method of claim 41 , wherein encrypting the shared secret comprises ...

AUTOMATICALLY ALTERING AND ENCRYPTING PASSWORDS IN SYSTEMS

In an approach for changing a password. Aspects of an embodiment of the present invention include an approach for changing a password, wherein the approach includes a processor identifies a resource protected by a password. A processor discovers at least one information source containing information relevant to a process for changing the password of the resource. A processor constructs a set of procedures to change the password using the information relevant to the process for changing the password. A processor alters the password of the resource according to the constructed set of procedures. 1one or more computer processors, one or more computer readable storage media, and program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising:program instructions to identify a resource protected by a password;program instructions to discover at least one information source containing information relevant to a process for changing the password of the resource, wherein the at least one information source is unstructured information, wherein program instructions to discover the at least one information source containing information relevant to the process for changing the password of the resource includes program instructions to perform text analytics on the text of the at least one information source; program instructions to analyze the at least one information source;', 'program instructions to extract the information relevant to the process for changing the password from the at least one information source; and', 'program instructions to construct the set of procedures to change the password using the information relevant to the process for changing the password;, 'program instructions to construct a set of procedures to change the password using the information relevant to the process for changing the password, wherein program instructions to construct the set ...

ENCRYPTED COLLABORATION SYSTEM AND METHOD

A method of sharing collaborative data between registered users in an online collaboration system. The collaboration system has a server and one or more electronic user devices that are capable of data communication with the server over a data network. Each registered user is allocated a unique asymmetric key pair comprising a user public key and a user private key for encryption and decryption of shared data content. The server is able to modify uploaded encrypted data content to enable access by multiple authorised users, and is able to convert uploaded data content into alternative formats, typically to enable web-browser viewing. 1. A method of sharing collaborative data between registered users in an online collaboration system , the collaboration system comprising a server and one or more electronic user devices that are capable of data communication with the server over a data network , each registered user being allocated a unique asymmetric key pair comprising a user public key and a user private key for encryption and decryption , the method executed on the server by one or more processors comprising: encrypted data content generated by symmetric encryption of the data content with a data key, and', "an associated enveloped data key comprising encrypted versions of the data key generated by asymmetric encryption of the data key with the first user's public key and a server public key respectively;"], 'receiving encrypted data at the server over the data network from a first user via an electronic user device operated by the first user, wherein the encrypted data has been encrypted on the electronic user device and comprisesdecrypting the enveloped data key associated with the encrypted data content on the server using a server private key, wherein the server private key and the server public key form an asymmetric key pair;generating a new or modified enveloped data key for the encrypted data content comprising asymmetrically encrypted versions of the data ...

Methods Data Structures Circuits Devices Systems and Functionally Associated Machine Executable Code for Artificial Intelligence Based Situational Assessment

Disclosed herein are methods, structures, circuits, devices, systems and functionally associated computer executable code for artificial intelligence based situational assessment. According to some embodiments, there may be provided a location specific situational assessment system comprising a sensor interface to receive sensing related data from each of one or more location specific sensors directed towards and acquiring information from a respective coverage area of a specific location. 1. A location specific situational assessment system comprising:a sensor interface to receive sensing related data from each of one or more location specific sensors directed towards and acquiring information from a respective coverage area of a specific location;a processing platform including processing resources for running one or more agent applications and an agent application deployment controller, wherein said agent application deployment controller, responsive to location specific information embedded within data received from said one or more sensors, selects from a pool of agent application templates an agent application template corresponding to the location specific information and deployes within said processing platform of said system an agent application based on said selected agent application template; andwherein agent application deployment within said processing platform includes establishing data connectivity between the agent application being deployed and one or more system resources.2. The situational assessment system according to claim 1 , wherein said system resources with which connectivity is established is selected from the group consisting of: (a) a sensor feed; (b) another agent applications running on the computing platform; (c) system data storage; and (d) a neural network.3. The situational assessment system according to claim 2 , wherein access to one or more of said systems resources is secured and establishing connectivity between the agent ...

IMPROVED STORAGE SYSTEM

In a client server environment a method of securely storing data; said method comprising 1. In a client server environment a method of securely storing data for use at a second location; said method comprisingfor a first use of the method of securely storing the data at the second location by a user, executing the following steps:the user initiates a secure connection to a first device in the form of a server;a client device of the user at a second location is logged onto a secure user account;subsequently the server at the first location supplies a form for use by the user to format the data element to be secured;the user fills out the form with the data element to be secured;the user then opts to store the data element securely on their client device at the second location;the server at the first location then retrieves the data element from the second location and processes it;subsequently an encryption key is generated by the server at the first location and the key is linked to the secure user account;the key is then used to encrypt the data element to be protected and the resulting encrypted data element is stored on the client device of the user at the second location;and for a second use of the method, executing the following steps:the user starts a secure connection and the server then establishes a secure connection using the secure user account;during the course of second use the server at the first location presents the user with a form to collect the encrypted data element that the user has opted to encrypt and securely store on their client device at the second location in the past;the user is then given the option and chooses to use the encrypted data element already stored on the client device at the second location;the server at the first location retrieves the encrypted data element from the client device at the second location;the server then retrieves the decryption key from the associated secure user account and the data element is decrypted on ...

DATA PROCESSING METHOD AND DATA PROCESSING SYSTEM

A data processing method performed by a computer system including a first computer, a second computer, and a third computer includes a step of, by the first computer, encrypting first data with a first encryption key and transmitting the first data encrypted with the first encryption key to the third computer, a step of, by the second computer, encrypting second data with a second encryption key and transmitting the second data encrypted with the second encryption key to the third computer, and a step of, by the third computer, generating, with a key exchange key for exchanging the second encryption key for the first encryption key, the second data encrypted with the first encryption key from the second data encrypted with the second encryption key. 1. A data processing method performed by a computer system including a first computer including a first processor and a first memory connected to the first processor , a second computer including a second processor and a second memory connected to the second processor , and a third computer including a third processor and a third memory connected to the third processor , the data processing method comprising:a first step of, by the first processor, encrypting first data stored in the first memory with a first encryption key and transmitting the first data encrypted with the first encryption key to the third computer;a second step of, by the second processor, encrypting second data stored in the second memory with a second encryption key and transmitting the second data encrypted with the second encryption key to the third computer; anda third step of, by the third processor, generating, with a key exchange key for exchanging the second encryption key for the first encryption key, the second data encrypted with the first encryption key from the second data encrypted with the second encryption key.2. The data processing method according to claim 1 , further comprising a fourth step of claim 1 , by the third processor claim ...

Unified Addressable Memory

In one embodiment, a system includes a non-volatile memory that may serve as both the main memory system and the backing store (or persistent storage). In some embodiments, the non-volatile memory is divided into a main memory portion and a persistent portion. Data in the main memory operation may be encrypted using one or more first keys, and data in the persistent portion may be encrypted using one or more second keys, in an embodiment. The volatile behavior of main memory may be implemented by discarding the one or more first keys in a power down event or other event that indicates a loss of main memory data, while the one or more second keys may be retained. In one embodiment, the physical address space of the non-volatile memory may be a mapping from a second physical address space that is used within the system. 1. A system comprising:a non-volatile memory; and one or more agents configured to generate read and write memory operations that address locations in the non-volatile memory, the locations forming a main memory in the system;', 'a link control circuit coupled to the one or more agents and configured to read and write the locations in the non-volatile memory responsive to the read and write memory operations; and', 'a cryptographic circuit coupled to the one or more agents and the link controller, wherein the cryptographic circuit is configured to encrypt data written to the locations in response to write memory operations from the one or more agents, and wherein the cryptographic circuit is configured to decrypt data read from the locations in response to read memory operations from the one or more agents, and wherein the cryptographic circuit is configured to employ one or more keys for the encryption or decryption, and wherein the SOC is configured to discard the one or more keys responsive to an event that causes the content of the locations to be declared lost to implement volatile behavior of the main memory., 'a system on a chip (SOC) coupled to ...

RECONFIGURABLE DEVICE BITSTREAM KEY AUTHENTICATION

An embodiment of an electronic processing system may include a processor, persistent storage media communicatively coupled to the processor, a reconfigurable device communicatively coupled to the processor over a physically isolated trusted communication channel, a secure provisioner communicatively coupled to the processor and the reconfigurable device to provision a secure storage area and to securely store a remotely generated bitstream security key in the provisioned secure o storage area, and a device configurer to configure the reconfigurable device with a remotely generated bitstream and the remotely generated bitstream security key. Other embodiments are disclosed and claimed. 124-. (canceled)25. An electronic processing system , comprising:a processor;persistent storage media communicatively coupled to the processor;a reconfigurable device communicatively coupled to the processor over a physically isolated trusted communication channel;a secure provisioner communicatively coupled to the processor and the reconfigurable device to provision a secure storage area and to securely store a remotely generated bitstream security key in the provisioned secure storage area; anda device configurer to configure the reconfigurable device with a remotely generated bitstream and the remotely generated bitstream security key.26. The system of claim 25 , wherein the secure provisioner is further to:partition an enclave for the secure storage area;associate an enclave identifier with the enclave; andprovide the enclave identifier to the reconfigurable device over the physically isolated trusted communication path.27. The system of claim 26 , wherein the reconfigurable device comprises a field programmable gate array device and wherein the remotely generated bitstream is encoded with the enclave identifier and encrypted with the remotely generated bitstream security key.28. A configurable apparatus claim 26 , comprising:a configurable device;a secure provisioner ...

Method and system for secure and verifiable offline blockchain transactions

A method for performing secure, verifiable, offline blockchain transactions through a trusted execution environment and time-limited credentials includes: storing, in a trusted execution environment of a computing device, a cryptographic key pair comprised of a public key and a private key; transmitting, by a transmitter of the computing device, the public key to a gateway device in a blockchain network; receiving, by a receiver of the computing device, a time-limited credential from the gateway device; generating, by a processing device of the computing device, a blockchain data value, wherein the blockchain data value includes at least the time-limited credential, a transaction amount, and a destination address; digitally signing, by the trusted execution environment of the computing device, the generated blockchain data value using the private key; and transmitting, by the transmitter of the computing device, the signed blockchain data value to an external device.

BLOCKCHAIN-BASED SECURE PAYMENT SYSTEM

Methods and systems for securely conducting a transaction requiring approval via a personal device of a purchaser is provided. In some embodiments, under control of a payment application executing on the personal device of a purchaser, the method establishes secure connection to a payment terminal of a seller. The method receives via the secure connection transaction information generated by a point-of-sale system. The method prompts the purchaser to approve the transaction. Upon approval, the method sends via the secure connection with the payment terminal an indication of the approved transaction to a digital payment guardian system. Under control of the digital payment guardian system, the method adds the approved transaction to a distributed ledger upon receiving the approved transaction. The method settles the approved transaction and provides notification of the settlement to the point-of-sale system so that the point-of-sale system can close the transaction. 1. A method performed by one or more computing systems for securely conducting a transaction to help prevent fraudulent transactions , the method comprising: receiving via the secure connection transaction information generated by a point-of-sale system;', 'prompting the purchaser to approve the transaction;', 'upon approval, sending via the secure connection with the payment terminal an indication of the approved transaction to a digital payment system; and, 'under control of a payment application executing on a personal device of a purchaser, establishing a secure connection to a payment terminal of a seller;'} settling the approved transaction; and', 'providing notification of settlement to the point-of-sale system., 'under control of the digital payment system, upon receiving the approved transaction, adding the approved transaction to a distributed ledger;'}2. The method of wherein the settling of the transaction includes transferring a payment token to a purchaser wallet of the purchaser.3. The ...

OFFLINE CRYPTOCURRENCY WALLET WITH SECURE KEY MANAGEMENT

A method of performing cryptocurrency transactions requiring a private key includes: establishing a connection from a smart wallet to a user device; receiving a transaction request requiring the private key; disabling the connection; retrieving the private key to a private key memory; processing the transaction; clearing the private key memory; enabling the connection; and sending a completion message. A method of performing cryptocurrency transactions requiring a private key includes: establishing a connection from a user device to a smart wallet; receiving a transaction request requiring the private key; sending the transaction request to the smart wallet; determining that the smart wallet is disconnected from the user device; waiting for the smart wallet to reconnect; and receiving a response from the smart wallet. A smart wallet includes: a storage; a private key storage; and a communication module that is able to communicate with a user device across at least one channel. 1. A method of performing cryptocurrency transactions requiring a private key from a smart wallet , the method comprising:establishing a connection from the smart wallet device to a user device;receiving, at the smart wallet device, a transaction request from the user device requiring the private key;disabling in the smart wallet, a communication connection between the smart wallet and the user device to prevent external access to memory of the smart wallet;retrieving the private key stored in the smart wallet and sending it to a private key memory of the smart wallet;authorizing in the smart wallet the transaction using the private key in the private key memory of the smart wallet;clearing the private key memory;enabling the communication connection; andsending a transaction completion message from the smart wallet device to the user device.2. The method of further comprising decrypting the private key using a smart wallet private key.3. The method of claim 1 , wherein the private key is ...

BREAKDOWN-BASED PHYSICAL UNCLONABLE FUNCTION

A device and a method for implementing a physically unclonable function is disclosed. In one aspect, the device includes at least one electronic structure including a dielectric. A conductive path is formed at a random position through the dielectric due to an electrical breakdown of the dielectric, or the electronic structure is adapted for generating an electrical breakdown of the dielectric such that the conductive path is formed through the dielectric at a random position. The at least one electronic structure is adapted for determining a distinct value of a set comprising at least two predetermined values. The distinct value is determined by the position of the conductive path through the dielectric. 1. A method of implementing a physically unclonable function , the method comprisingproviding a device comprising at least one electronic structure, each electronic structure comprising a dielectric,generating an electrical breakdown of the dielectric such that a conductive path is formed, in each of the at least one electronic structure, through the dielectric at a random position,determining, for each of the at least one electronic structure, a distinct value of a set comprising at least two predetermined values, wherein the distinct value is determined by the position of the conductive path through the dielectric of the electronic structure.2. The method of claim 1 , wherein the device comprises an array of transistors claim 1 , and wherein generating the electrical breakdown comprises applying a high gate bias on each transistor to form a conductive path between a gate and randomly either a source or a drain of the transistor.3. The method of claim 1 , further comprising generating plasma damage in the at least one electronic structure.4. A PUF device for implementing a physically unclonable function claim 1 , the device comprising:at least one electronic structure, each electronic structure comprising a dielectric; anda conductive path through the dielectric ...

MANAGING USER-CONTROLLED SECURITY KEYS IN CLOUD-BASED SCENARIOS

A system for managing user-controlled security keys in cloud-based scenarios is provided. In some implementations, the system performs operations comprising receiving an information request from a user device via a network, and generating a database query based at least in part upon the information request. The operations can comprise generating a request for a secret key for decrypting encrypted data when the database query requests the encrypted data and/or generating a request for a secret key for encrypting data when the database query requests to encrypt data. The operations can also comprise providing the request to a security key management entity via a network, receiving secret key information from the security key management entity via the network, and using the secret key information to form decrypted data or encrypted data. Related systems, methods, and articles of manufacture are also described. 1. A system comprising:at least one hardware data processor; and generating, at a database server, a request for a secret key for decrypting encrypted data when a database query requests the encrypted data;', 'providing, by the database server, the request to a security key management entity via a network;', 'receiving, by the database server, secret key information from the security key management entity via the network; and', 'decrypting, at the database server, the encrypted data using the secret key information to form decrypted data., 'at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising2. The system of claim 1 , wherein the operations further comprise:generating, at the database server, a second request for a secret key for encrypting unencrypted data when the database query requests to encrypt the unencrypted data; andencrypting, at the database server, the unencrypted data using the secret key information to form second encrypted data when the database query requests to encrypt ...