ОБРАБОТКА ПЕРЕКЛЮЧЕНИЯ ШИФРОВАНИЯ

Изобретение относится к системе и способу обработки транзакций. Технический результат заключается в повышении безопасности финансовых транзакций. Способ содержит этапы, на которых принимают на серверном компьютере из терминала конверт, связанный с транзакцией, причем конверт включает в себя незашифрованные подробные данные транзакции, метку, извлеченную из ключа, связанного с терминалом, и идентификатор счета, и, по меньшей мере, первую часть подробных данных транзакции, конвертируют метку в идентификатор счета, верифицируют то, что идентификатор счета связан с действительным счетом и проводят проверку транзакции, причем проверка гарантирует то, что конверт не был модифицирован между терминалом и серверным компьютером. 2 н. и 18 з.п. ф-лы, 12 ил.

СПОСОБ АКТИВАЦИИ ФУНКЦИЙ PKI НА ИНТЕЛЛЕКТУАЛЬНОЙ КАРТЕ

Изобретение относится к интеллектуальным картам и коммуникационным сетям, в частности к мобильному телефону. Техническим результатом является создание способа активации (разблокирования) доступа к функциям, записанным на интеллектуальной карте, обеспечивающим повторное использование интеллектуальных карт при смене пользователя. Технический результат достигается тем, что сервер генерирует одноразовый активизирующий код, посылает его пользователю интеллектуальной картой, установленной в сотовом телефоне, и когда пользователь вводит активизирующий код в свой сотовый телефон, введенный код передается на сервер для его верификации, при положительном ее результате сервер передает на телефон команду на обеспечение доступа, которая открывает доступ к соответствующей части функций интеллектуальной карты, причем часть функций может содержать, например, PKI-функции, которые были скрыты и недоступны для пользователя до этого момента, после этого пользователь может выбрать свой собственный PIN-код для ...

БЕСПРОВОДНОЕ УСТРОЙСТВО, СПОСОБ ЗАПРОСА ПОЛЬЗОВАТЕЛЬСКОГО КЛИЕНТА УПРАВЛЕНИЯ ДОСТУПОМ И СПОСОБ ВЫПОЛНЕНИЯ КЛИЕНТА УПРАВЛЕНИЯ ДОСТУПОМ

Изобретение относится к беспроводной связи, а именно к способу для безопасной передачи клиента управления доступом. Техническим результатом является повышение безопасности. Способ содержит запрос пользовательского клиента управления доступом из беспроводной сети, при этом запрос связан с первым подтверждающим сертификатом; прием пользовательского клиента управления доступом и второго подтверждающего сертификата, при этом первый и второй подтверждающий сертификаты выданы доверенной структурой; и сохранение пользовательского клиента управления доступом в безопасном элементе, если второй подтверждающий сертификат действителен; причем пользовательский клиент управления доступом сохраняют в индивидуальном сегменте из числа множества сегментов, из которых состоит безопасный элемент, и последующие модификации сохраненного пользовательского клиента управления доступом могут быть выполнены только с использованием второго подтверждающего сертификата; а доступ к беспроводной сети ограничен (i) доступом ...

СПОСОБ И УСТРОЙСТВО ДЛЯ ОБЕСПЕЧЕНИЯ СЕКРЕТНОСТИ ПОДЛИННОЙ ИДЕНТИФИКАЦИОННОЙ ИНФОРМАЦИИ ПОЛЬЗОВАТЕЛЯ В ИСХОДНОМ СИГНАЛЬНОМ СООБЩЕНИИ

Изобретение относится к системам беспроводной связи и предназначено для обеспечения секретности подлинной идентификационной информации пользователя в исходном сигнальном сообщении доступа в системе беспроводной связи. Технический результат - повышение помехозащищенности. Беспроводной приемо-передающий модуль (WTRU) включает в себя уровень протокола сходимости пакетных данных (C-PDCP) плоскости управления (C-plane), который выполняет шифрование сигнального сообщения. Уровень C-PDCP активизируется после включения питания модуля WTRU, и исходные параметры безопасности загружаются на уровень C-PDCP. Исходное сигнальное сообщение подключения для подсоединения сети и идентификационная информация пользователя шифруются с использованием исходных параметров безопасности, даже прежде подтверждения подлинности модуля WTRU. Исходные параметры безопасности, включающие в себя ключ шифрования (СК), могут генерироваться из широковещательной передачи системной информации из сети. Ключ СК может быть открытым ...

СПОСОБ ПОВЫШЕНИЯ ОГРАНИЧЕНИЯ ДОСТУПА К ПРОГРАММНОМУ ОБЕСПЕЧЕНИЮ

... 1. Способ повышения ограничения доступа к программному обеспечению, в котором приложение формирует динамический код аутентичности, где доступ к приложению ограничен путем запроса личного идентификационного номера (ПИН-кода) пользователя, содержащий следующие стадии: ! использование устройства, имеющего память, в котором приложение хранится в указанной памяти; ! запрос пользователя на ввод оригинального ПИН-кода, в котором оригинал не хранится в памяти, и любая информация об оригинальном ПИН-коде не хранится в памяти; ! использование оригинального ПИН-кода в качестве начального числа, чтобы создать истинный шифровальный ключ; ! использование истинного шифровального ключа, чтобы зашифровать секретные данные приложения в криптограмму; ! хранение криптограммы в памяти; ! и в котором: ! приложение доступно любому пользователю в любое время, по запросу от пользователя ПИН-кода, в котором требуемый ПИН-код не подтверждается приложением; ! использование запрошенного ПИН-кода без какой-либо проверки ...

АУТЕНТИФИКАЦИЯ И АКТУАЛИЗАЦИЯ ГЕНЕРАЦИЙ КЛЮЧЕЙ СЕАНСА МЕЖДУ ПРЕДОСТАВЛЯЮЩИМ УСЛУГИ СЕТЕВЫМ УЗЛОМ И,ПО МЕНЬШЕЙ МЕРЕ, ОДНИМ КОММУНИКАЦИОННЫМ ОКОНЕЧНЫМУСТРОЙСТВОМ С ИДЕНТИФИКАЦИОННОЙ КАРТОЙ

... 1. Способ генерации ключа сеанса для дешифрования данных услуги, посланных от предоставляющего услуги сетевого узла (DN) через коммуникационную сеть на, по меньшей мере, одно коммуникационное оконечное устройство (MS), отличающийся тем, что, по меньшей мере, один посланный от предоставляющего услуги сетевого узла (DN) ключ доступа (BAK-I) и, по меньшей мере, одно посланное значение последовательности (SEQ) сохраняются на идентификационной карте (UICC) коммуникационного оконечного устройства (MS), что значение достоверности (MAC-I) вычисляется в предоставляющем услуги сетевом узле (DN) и вместе с данными услуги и последующим значением последовательности (nSEQ) посылается на коммуникационное оконечное устройство (MS), что после приема данных, принятое значение достоверности (MAC-I) сравнивается с вычисленным на идентификационной карте (UICC) значением достоверности (SD-MAC-I), что на идентификационной карте (UICC) принятое последующее значение последовательности (nSEQ) сравнивается с сохраненным ...

СПОСОБЫ И СИСТЕМЫ ДЛЯ СОЗДАНИЯ УДОСТОВЕРЕНИЙ ЛИЧНОСТИ, ИХ ПРОВЕРКИ И УПРАВЛЕНИЯ ИМИ

Изобретение относится к области создания и проверки удостоверения личности. Техническим результатом является улучшение защиты удостоверения личности. В способе предоставления услуг идентификации: осуществляют прием данных удостоверения личности для физического лица, для которого провайдер удостоверений личности выдал удостоверение личности; генерируют транзакцию для сохранения идентификатора, представляющего данные удостоверения личности, в структуре данных на блокчейне распределенной системы; посылают транзакцию по меньшей мере в один узел распределенной системы; и генерируют идентификационный маркер, включающий в себя идентификатор, представляющий данные удостоверения личности. В способе проверки удостоверения личности: осуществляют прием данных, извлекаемых из идентификационного маркера, причем извлекаемые данные включают в себя идентификатор, представляющий данные удостоверения личности; определяют, хранится ли на блокчейне распределенной системы структура данных, содержащая извлекаемый ...

КЛЮЧИ

... 1. Способ распределения ключа, способ содержит этапы, на которых ! упаковывают ключ с использованием сигнатуры, основанной на присущем свойстве жетона безопасности, при этом сигнатура создана посредством последовательного направления когерентного луча на каждую из множества областей поверхности жетона безопасности, составления набора, содержащего группы элементов данных, из сигналов, полученных, когда когерентный луч рассеивается от различных областей жетона безопасности, причем различные группы элементов данных относятся к рассеянию от соответствующих различных областей жетона безопасности, и обработки набора групп элементов данных; ! передают упакованный ключ по местонахождению получателя, и ! распаковывают ключ с использованием сигнатуры, основанной на присущем свойстве жетона безопасности, причем упомянутая сигнатура создана посредством последовательного направления когерентного луча на каждую из множества областей поверхности жетона безопасности, составления набора, содержащего группы ...

ВЗАИМНАЯ АУТЕНТИФИКАЦИЯ ПРОГРАММНЫХ УРОВНЕЙ

СПОСОБ ВЫПОЛНЕНИЯ ФИНАНСОВОЙ ТРАНЗАКЦИИ ЧЕРЕЗ НЕЗАЩИЩЕННУЮ ИНФРАСТРУКТУРУ СВЯЗИ ОБЩЕГО ПОЛЬЗОВАНИЯ И УСТРОЙСТВО ДЛЯ ЭТОГО

... 1. Способ выполнения финансовой транзакции через незащищенную инфраструктуру связи общего пользования, содержащий этапы, на которых:собирают данные, относящиеся к указанному типу финансовой транзакции;создают маркер транзакции, включающий в себя собранные данные и/или данные, полученные из собранных данных;шифруют маркер транзакции;создают сообщение протокола финансовой транзакции, включающее в себя зашифрованный маркер транзакции, который зависит от выбранного канала передачи, по которому сообщение должно быть передано; ипередают сообщение протокола финансовой транзакции с помощью выбранного канала передачи и посредством незащищенной инфраструктуры связи общего пользования адресату, где сообщение протокола финансовой транзакции будет дополнительно обрабатываться.2. Способ по п.1, в котором этап сбора данных, относящихся к указанному типу транзакции, включает в себя подэтап, на котором собирают данные аутентификации, которые после этого шифруются, и маркер транзакции, созданный после этого ...

СИСТЕМА И СПОСОБ НАДЕЖНОЙ ПРОВЕРКИ ДОСТОВЕРНОСТИ ТРАНЗАКЦИЙ

... 1. Серверный компьютер, содержащий:процессор; исчитываемый компьютером носитель, связанный с процессором, причем считываемый компьютером носитель включает в себя код, исполняемый процессором, для реализации способа, содержащего:прием первого сообщения запроса авторизации, содержащего первое значение верификации;определение, является ли достоверным первое значение верификации;создание второго сообщения запроса авторизации, содержащего второе значение верификации; иотправку второго сообщения запроса авторизации на компьютер эмитента.2. Серверный компьютер по п. 1, в котором первым значением верификации является динамическое значение верификации.3. Серверный компьютер по п. 1, в котором вторым значением верификации является статическое значение верификации.4. Серверный компьютер по п. 1, дополнительно содержащий:отправку индикатора достоверности во втором сообщении запроса авторизации на серверный компьютер, причем индикатор достоверности указывает, является ли достоверным первое значение ...

СИСТЕМА И СПОСОБ ОБЕСПЕЧЕНИЯ КОНФИДЕНЦИАЛЬНОСТИ ИНФОРМАЦИИ, ИСПОЛЬЗУЕМОЙ ВО ВРЕМЯ ОПЕРАЦИЙ АУТЕНТИФИКАЦИИ И АВТОРИЗАЦИИ, ПРИ ИСПОЛЬЗОВАНИИ ДОВЕРЕННОГО УСТРОЙСТВА

... 1. Система обеспечения конфиденциальности информации, передаваемой для контроля операций, используя доверенное устройство, содержит:I. контроллер операций, предназначенный, по меньшей мере, для:а) идентификации пользователя сервиса;б) передачи запроса конфиденциальной информации, необходимой для выполнения процедуры контроля операции, на сторону сервера безопасности;в) получение конфиденциальной информации, необходимой для выполнения процедуры контроля операции, от сервера безопасности;г) выполнения процедуры контроля операции с использованием полученной конфиденциальной информации;при этом контроллер операций связан, по меньшей мере, с сервером безопасности;II. сервер безопасности, предназначенный, по меньшей мере, для:а) получения от контроллера операций запроса конфиденциальной информации, необходимой для выполнения процедуры контроля операции;б) выбора доверенного устройства, ассоциированного с идентифицированным пользователем сервиса;в) передачи запроса конфиденциальной информации, ...

Vorrichtung zur sicheren Fernkopierübertragung und sicherer Fernkopierer

Sicherheits- und Privatsphärenverbesserungen für Sicherheitseinrichtungen

Zugangskontrollvorrichtung und Verfahren zur Authentisierung einer Zugangsberechtigung

Verfahren und Vorrichtung zur Authentisierung einer Zugangsberechtigung mittels eines Zugangskontrollsystems (100), wobei das Zugangskontrollsystem (100) ein Terminal (120) und einen ID-Token (110) umfasst, die zur Kommunikation miteinander über einen gesicherten Kanal in Form einer Sitzung ausgelegt sind, wobei für die Wiederherstellung der Sitzung zwischen Terminal (120) und ID-Token (110) ein durch den ID-Token (110) verschlüsselter Sitzungskontext (CKS) eines Sitzungskontextes (KSK) des ID-Tokens (110) der Sitzung erzeugt und in dem Terminal (120) zusammen mit einem zugeordneten Sitzungskontext (TSK) des Terminals (120) und einem Attribut (KID) des ID-Tokens (110) gespeichert wird, ohne dass der ID-Token (110) den Sitzungskontext (KSK) selbst speichert.

Verfahren und Vorrichtung zur Anordnung von digitalen Zertifikaten auf einem Hardware-Token

VERFAHREN UND VORRICHTUNG ZUR MANIPULATIONSSICHEREN SPEICHERUNG VON DATEN IN NAND-FLASH SPEICHER

Ein Verfahren (100) zum manipulationssicheren Speichern von Daten in einem NAND-Flash Speicher umfasst das Empfangen (102) von zu speichernden Daten in einem NAND-Flash Controller und das Anordnen (104) der empfangenen Daten in Seiten von Blöcken des NAND-Flash Speichers. Jede in den NAND-Flash Speicher zu programmierende Seite oder jeder Block wird individuell verschlüsselt (108), wobei die Verschlüsselung unter Verwendung eines einzigartigen Schlüssels erfolgt, der dem das Verfahren ausführenden System eindeutig zugeordnet ist. Für die verschlüsselte Seiten bzw. Blöcke werden Fehlerkorrekturdaten berechnet (110), die zusammen mit den verschlüsselten Seiten bzw. Blöcke in den NAND-Flash Speicher programmiert werden.

Authentifizierung von Teilnehmeranschlüssen

Distributed single sign-on

A user computer (2, fig. 1) connects via a network (3, fig. 1) to verifier servers (4, fig. 1) and authentication servers (5, fig. 1). Respective cryptographic shares of password data, dependent on a predetermined user password, are provided at the authentication servers. A plurality of password data shares is needed to determine if the password matches a password attempt. Respective cryptographic shares of secret data, enabling determination of a username for a verifier server, are provided at the authentication servers. A plurality of secret data shares is needed to reconstruct the secret data. The user computer communicates 32, via the network, with a minimum threshold number of the authentication servers and the password data shares of those servers are used to determine if 33 the user password matches an input password attempt 31. If so, the user computer receives 35 secret data shares from respective authentication servers. On receipt of said shares, the user computer reconstructs ...

Authentication system and method

QRyptoLogin

Data communication system

In a data communication system a plurality of users are equipped with respective devices for computation and authentication of message authenticators. Each device stores a common oryptographic function; a common secret key and a respective non-secret offset for the key. They are programmed to perform the functions of: (i) computing and outputting an authenticator for an entered message using the cryptographic function and key combined with the respective offset; and (ii) computing an authenticator for an entered message using the cryptographicfunction and key combined with any entered offset, comparing that authenticator with one received with the message and displaying a "pass or "fail" decision. The devices are incapable of displaying or otherwise outputting any authenticator computed using any offset other than its respective stored offset, however. In this way it can be ensured that a transmitted authenticator can act as a verifiable "signature" to a message uniquely identifying the ...

Methods and systems for flexible delegation

Securely storing and access data

A method of allowing members of a group to access a plurality of data blocks stored at one or more storage locations, where each data block is associated with at least one of the members. The method comprises providing each of the group members with a shared secret (group key), storing at a storage location, in association with each data block, a tag, the tag having been generated using said shared secret and an identity of the member associated with the data block, sending a request from a group member to a storage location, the request containing the tag of another group member, and upon receipt of said request at the storage location, identifying said tag and sending to the requesting member the data block associated with the tag.

AUTHENTICATION SYSTEM BETWEEN A CARD READER AND A CARD EXCHANGER DATA

Authentication method

An authentication comprises: receiving at least one request for an action in relation to an electronic device, wherein performance of the action requires verification of an association of a group of IDs specified by the request; verifying, via cryptographic verification, whether the group of IDs specified by the request match a cryptographically attested group of IDs associated with the electronic device, to determine whether the at least one request for an action is an authentic request; and, having determined the at least one request for an action is an authentic request, approving the at least one request, wherein the group of IDs comprises at least an Integrated Circuit Card Identifier ICCID of a Subscriber Identity Module SIM of the electronic device and a device identifier associated with the electronic device. The device identifier may be an IMEI, Trusted Execution Environment TEE, or MAC address. The method prevents fraudulent activity by the use of Cloned sim cards.

Identification apparatus and method

Hacking prevention system

Cryptographic key server embedded in data transfer system

Method and system for providing continued access to authentication and encryption services

A system and method for providing continued access to authentication and encryption services that includes a secure key store communicably coupled to a virtual smart card server. A virtual smart card driver is also provided and is communicably coupled to a virtual smart card secure hardware server. The virtual smart card driver communicates with an authentication client to authenticate a user, and access the user's private key stored in the secure key store when the user's physical smart card is unavailable. Continued access is provided when the user has been authenticated.

Securely storing and accessing data

Integration of verification tokens with mobile communication devices

Security mechanism for external code

Security mechanism for external code

INTEGRATION OF VERIFICATION TOKENS WITH MOBILE COMMUNICATION DEVICES

INTEGRATION OF VERIFICATION TOKENS WITH MOBILE COMMUNICATION DEVICES

Integration of verification tokens with mobile communication devices

Security mechanism for external code

INTEGRATION OF VERIFICATION TOKENS WITH MOBILE COMMUNICATION DEVICES

INTEGRATION OF VERIFICATION TOKENS WITH MOBILE COMMUNICATION DEVICES

Integration of verification tokens with mobile communication devices

Security mechanism for external code

PROCEDURE AND ARRANGEMENT FOR THE EXECUTION OF A QUALIFIED ELECTRONIC SIGNATURE (QES) WITH THE HELP OF A MOBILE COMMUNICATION TERMINAL

LOCAL ONE AUTHENTIFIZIERUNG IN A COMMUNICATION SYSTEM

PROCEDURE FOR EXAMINING AN AUTHORIZATION

FURNISH A SAFE CONTEXT FOR THE TRANSMISSION OF MESSAGES BETWEEN COMPUTER SYSTEMS

SYSTEM AND PROCEDURE FOR THE WIRELESS ONE ZWEIFAKTORAUTHENTIFIZIERUNG

PROCEDURE AND SYSTEM FOR THE SAFE ONE, AUTHENTIFIZIERTEN PAYING IN A COMPUTER NETWORK

SUBSEQUENT IMPLEMENTING OF A SIM FUKTIONALITÄT IN A SAFETY MODULE

UNIVERSAL SAFE DATA EXCHANGE FOR ENFERNTE SAFETY TOKENS

PROCEDURE AND DEVICE FOR THE SAFE PROTECTION OF THE ORIGINAL USER IDENTITY IN AN INITIAL SIGNAL MESSAGE

ZEITVALIDERUNGSSYSTEM

VERTEILTE DATENSPEICHERUNGSEINRICHTUNG

The invention relates to a distributed data memory unit comprising a plurality of memory units, each having memory means and an access controller, an authentication unit comprising memory means and a validation unit, an execution controller comprising an execution controller module and an access verification unit, the execution controller communicating with the memory units and the authentication unit. At least one unambiguous electronic cipher is stored in the memory means of the authentication unit, the access verification unit has an access controller module and a memory unit. A first unambiguous cipher, which corresponds to a stored cipher of the authentication unit is stored in the memory unit and an assignment table is stored in the memory means of the memory unit. The invention also relates to a method for operating a distributed data memory unit.

PROCEDURE, SYSTEM AND SMART CARD READER FOR THE ADMINISTRATION OF THE ENTRANCE TO A SMART CARD

CODING SYSTEM WITH PUBLIC KEY USING ELLIPTICAL CURVES OVER RINGS.

PROCEDURE FOR AUTHENTICATING THE AUTHENTICITY EXCHANGED BY DATA, BY TWO DEVICES, WHICH REMOVES OERTLICH OR MEANS OF A CHANNEL GROUPS IS.

PROCEDURE FOR THE MUTUAL ONE AUTHENTIKATION

PROCEDURE AND MECHANISM FOR THE SAFE IDENTIFICATION OF A MOBILE PARTICIPANT IN A COMMUNICATIONS NETWORK

PROCEDURE AND ARRANGEMENT FOR THE EXECUTION OF A QUALIFIED ELECTRONIC SIGNATURE (QES) WITH THE HELP OF A MOBILE COMMUNICATION TERMINAL

PROCEDURE AND ARRANGEMENT FOR THE EXECUTION OF A QUALIFIED ELECTRONIC SIGNATURE (QES) WITH THE HELP OF A MOBILE COMMUNICATION TERMINAL

PROCEDURE AND ARRANGEMENT FOR THE EXECUTION OF A QUALIFIED ELECTRONIC SIGNATURE (QES) WITH THE HELP OF A MOBILE COMMUNICATION TERMINAL

PROCEDURE AND ARRANGEMENT FOR THE EXECUTION OF A QUALIFIED ELECTRONIC SIGNATURE (QES) WITH THE HELP OF A MOBILE COMMUNICATION TERMINAL

PROCEDURE AND ARRANGEMENT FOR THE EXECUTION OF A QUALIFIED ELECTRONIC SIGNATURE (QES) WITH THE HELP OF A MOBILE COMMUNICATION TERMINAL

PROCEDURE AND ARRANGEMENT FOR THE EXECUTION OF A QUALIFIED ELECTRONIC SIGNATURE (QES) WITH THE HELP OF A MOBILE COMMUNICATION TERMINAL

PROCEDURE AND ARRANGEMENT FOR THE EXECUTION OF A QUALIFIED ELECTRONIC SIGNATURE (QES) WITH THE HELP OF A MOBILE COMMUNICATION TERMINAL

PROCEDURE AND ARRANGEMENT FOR THE EXECUTION OF A QUALIFIED ELECTRONIC SIGNATURE (QES) WITH THE HELP OF A MOBILE COMMUNICATION TERMINAL

Methods and systems for identity creation, verification and management

A method of providing identity services, the method comprising: receiving, by an identity system, identity data including validated identity data of an identity that an identity provider has generated for an individual; generating, by the identity system, a transaction to store an identifier representing the identity data in a data structure on a ledger of a distributed ledger system; sending, by the identity system, the transaction to at least one node of the distributed ledger system; generating, by the identity system, an identity token incorporating the identifier stored in the data structure on the ledger of the distributed ledger system; and providing, by the identity system to a user system of the individual, the generated identity token. WO 2017/112019 PCT/US2016/055215 Identity 20 Provider System(s) Inrteg rated Identity System Identity Restricted User Access Systems) System(s) Integrated Identity System 2_4 /From Identity Identity Identity Provider Creation/ PrvierInterface 4- ...

Trusted terminal platform

Abstract Point-of-sale (POS) terminal for entering a PIN to enable a financial 5 transaction, comprising: - a card reader for reading information from a credit card; - a processor for running an operating system, with applications; - a touch screen for displaying information and receiving user inputs; 0 - a Security-Box being connected between the touch screen and the processor, to control the user input on the touch screen to the processor, wherein the Security Box is being configured to run in two modes "PIN Entry Mode" and "Clear Text Mode", wherein when running in "PIN Entry Mode" the user input is not forwarded as touch coordinates 5 to the processor and when running in "Clear Text Mode" the touch coordinates arte transmitted to the processors. 11806886_1 (GHMatters) P100934.AU.1 WO 2014/135569 PCT/EP2014/054223 Fig. 1 Touch Sensor - - Tuch ontrller CC Reader Antenna Security Box Tamper Port HF- NFC Controller eDisasembly switch LUSB 7 UART MS Reader lProcessor Terminal ...

Delegated administration of permissions using a contactless card

Delegated administration of permissions using a contactless card. In one example, a permissions module may receive a request from a first account to grant a second account access to a computing resource. The permissions module may receive permissions data of the first account from a contactless card and encrypted data generated by the contactless card. The permissions module may transmit the permissions data and the encrypted data to an authentication server, which may verify the encrypted data based at least in part on the private key, and determine, based on the permissions data, that the first account has permissions to grant access to the computing resource. The permissions module may receive, from the authentication server, an indication of the verification of the encrypted data and a permissions vector associated with the second account, the permissions vector reflecting the grant of access to the computing resource to the second account.

Securing a data connection for communicating between two end-points

Methods and systems for securing a data connection for communicating between two end-points are described herein. One of the end-points may be a server and the other of the end-points may be a client that wants to communicate with the server. The data, connection may be secured based on a previously-established secure connection and/or a self-signed or self-issued certificate. In some variations, by using the previously-established secure connection and/or a self-signed or self-issued certificate, the secure communication between the server and the client may be conducted without using a third-party authentication service and without requiring a third-party CA to issue a certificate for the server.

Offline authentication

A method is disclosed. The method comprises providing, by a remote computer, a first signature key to a communication device; receiving, by the remote computer, transaction information for each transaction conducted by a communication device using the first signature key; receiving, by the remote computer, a replenishment request for a second signature key, the replenishment request including transaction log information derived from transaction data stored in a transaction log on the communication device; verifying, by the remote computer, that the transaction log information in the replenishment request is consistent with the previously received transaction information; and providing, by the remote computer, the second signature key to the communication device in response to verifying the transaction log information in the replenishment request.

HRPD network access authentication method based on CAVE algorithm

Electronic transaction systems and methods therefor

METHOD FOR LOADING AN APPLICATION IN A DEVICE, DEVICE AND SMART CARD THEREFOR

Method of using one device to unlock another device

Abstract A method of unlocking a second device using a first device is disclosed. The method can include: the first device pairing with the second device; establishing a trusted relationship with the second device; authenticating the first device using a device key; receiving a secret key from the second device; receiving a user input from an input/output device; and transmitting the received secret key to the second device to unlock the second device in response to receiving the user input, wherein establishing a trusted relationship with the second device comprises using a key generated from a hardware key associated with the first device to authenticate the device key. BIOMETRIC KEY FING(IiERPRINT MATCH MANAGEMENT SCANNER MODULE MODULE 102 100 104 106 112 )C 105 122 116 130 ) KERNEL KERNEL APPLICATION -- ~~--- -- -- PROCESSOR AP (AP) USERLAND USERLAND PAIR FIRST AND SECOND DEVICES V201 AUTHORIZE REMOTE IJNLOCK 202 UNLOCK SECOND DEVICE 203 USING THE FIRST DEVICE ...

Browser based identity with multiple login

A system provides a graphical user interface element in a browser. The browser provides multiple different identities for the browser, each of the multiple different identities associated with a different user, each of the multiple different identities being associated with a plurality of accounts. Upon receiving a selection of the graphical user interface element from a first user, the system matches the first user with a first identity that is stored by the browser and associated with the first user. Upon receiving a second selection of the graphical user interface element from a second user, the system matches the second user with a second identity that is stored by the browser and associated with the second user.

System and method for encryption

A method and system for generating a signature for a user are described. The system comprises a signature server, an initial transaction device for a user and a validation device for a user. The initial transaction device is configured to display a first message M and send a request to the signature server to create a signature for said first message M. The signature server is configured to generate a validation challenge using a second message M' which is based on said first message M' and a first secret shared between said user and said signature server and send said validation challenge to the validation device. The validation device is configured to regenerate said second message M' using said first shared secret, display said second message M', receive user confirmation that the displayed second message M' corresponds to said first message M, generate a validation code confirming the request to create a signature; and send said validation code to said signature server. Thereafter, ...

Secure authentication of user and mobile device

An authentication method is disclosed. To authenticate a user, a mobile device may request identification and verification from the user. Upon receiving a positive identification and verification response from the user, the mobile device may generate a cryptogram using a user identification (ID) associated with the user, a timestamp, a device ID associated with the mobile device, a service provider application ID associated with the service provider application, and a service provider device ID. The mobile device may transmit the generated cryptogram, the user ID, the timestamp, the device ID, the service provider application ID, and the service provider device ID, to a service provider computer associated with the service provider application. The service provider computer may decrypt the cryptogram and compare the decrypted data elements to the received data elements to validate and authenticate the user.

Unique code for token verification

A method for tokenizing credentials is disclosed. In addition to a token, a verification value can be provided for each interaction. The verification value can be generated based at least in part on a dynamic data element. The dynamic data element may be kept secret, while the verification value can be distributed for use during an interaction. When the verification value is used, it can be validated by re-creating the verification value based at least on the stored dynamic data element.

Authentication server of a cellular telecommunication network and corresponding UICC

The invention proposes an authentication server of a cellular telecommunication network, the authentication server being arranged for generating an authentication token to be transmitted to a telecommunication terminal, the authentication token comprising a message authentication code and a sequence number, wherein the message authentication code is equal to: MACx = KIdx XOR f1 (AMF, SQNx, RAND,K) with KIdx being a key index information in the form of a bias of a MAC equal to: MAC = f1(K,AMF,SQNx, RAND) with f1 being a function, K a key, RAND a random number and SQNx a sequence counter relative to a corresponding key Kx derived from the key K and KIdx, and AMF the content of an authentication management field as defined in 3GPP TS 33.102.

Secure communication of network traffic

Techniques are disclosed relating to securely communicating traffic. In some embodiments, an apparatus includes a secure circuit storing keys usable to encrypt data communications between devices over a network. The secure circuit is configured to store information that defines a set of usage criteria for the keys. The set of usage criteria specifies that a first key is dedicated to encrypting data being communicated from a first device to a second device. The secure circuit is configured to receive a request to encrypt a portion of a message with the first key, the request indicating that the message is being sent from the first device to the second device, and to encrypt the portion of the message with the first key in response to determining that the set of usage criteria permits encryption with the first key for a message being sent from the first device to the second device.

Wireless transaction and information system

Dual network system and method for online authentication or authorization

Apparatus and method for preventing disclosure through user-authentication at a printing node

Method for using fingerprints to distribute information over a network

Method and apparatus for real-time digital certification of electronic files andtransactions using entropy factors

Communication system for managing safely and independently a plurality of applications by each user card and corresponding user card and management method

Enhanced short message and method for synchronising and ensuring security of enhanced short messages exchanged in cellular radio communication system

Data communication transponder and communications system employing it

NETWORK USER AUTHENTICATION SYSTEM AND METHOD

In a network user authentication system, a network user is identified for authentication purposes using the unique identifier for a dedicated physical communication line associated with the building in which the network user is located or a digital certificate which is associated with a secure component or communication line physically attached to a building. An authentication server initially verifies the identification of the dedicated communication line to be associated with a network service subscriber or issues a unique digital certificate to be associated with the dedicated communication line for authentication purposes. The digital certificate may be stored in a building gateway or in an edge site module which is connected to the secure components of a plurality of buildings and stores unique digital certificates for each building.

METHOD AND APPARATUS FOR SECURELY TRANSMITTING AND AUTHENTICATING BIOMETRIC DATA OVER A NETWORK

A method and apparatus for collecting and securely transmitting biometric data over a network contains a sensor, preferably a camera, for collecting biometric data and code generating hardware and software. The camera data is digitized and a unique code which is a function of the digitized camera data, a secret key and a transaction token is attached to the digital file. The code may identify the sensor which acquired the biometric information, a time at which the biometric information was acquired, or a time interval during which the data is considered to be valid, and a unique transaction code. The data and code are transmitted over a network to a server which authenticates that the data has not been altered by recomputing the code using its own knowledge of the secret key and transaction token needed to generate the code. If the data is authentic the server then computes a biometric template using the data. This biometric template is then compared to a previously defined biometric template ...

SECURE COMMUNICATION OF PAYMENT INFORMATION TO MERCHANTS USING A VERIFICATION TOKEN

Disclosed are apparatuses, systems, and methods pertaining to the secure communication of payment information from portable consumer devices, such as credit cards, to online merchants using verification tokens.

DOCUMENT

The invention relates to a document having a document body (102) that is formed by a plurality of document layers (104, 106, 108; 126, 128, 130, 104, 106, 108, 132) that are arranged one above the other. A first (106) of the documents layers contains an evaluation unit (114), a second (104) of the document layers contains a first detection unit (110) for detecting first biometric data, a third (108) of the document layers contains a second detection unit (122) for detecting second biometric data, and the evaluation unit is at least connected to the first and second detection unit in order to receive at least the first and second biometric data from the detection units. The evaluation unit for evaluating the first and second biometric data delivered by the first and second detection unit is designed to activate a function (116) of the document depending on a result of the evaluation.

METHOD, SYSTEM AND SMART CARD READER FOR MANAGEMENT OF ACCESS TO A SMART CARD

The described embodiments relate generally to devices, methods and systems for managing access to a memory card, such as a smart card, by a plurality of accessing devices. Certain embodiments relate to a smart card reader (SCR) for managing concurrent access to a smart card by a plurality of accessing devices. Other embodiments cause an existing session with one accessing device to be terminated to allow establishment of a session with another accessing device.

DELEGATED ADMINISTRATION OF PERMISSIONS USING A CONTACTLESS CARD

Delegated administration of permissions using a contactless card. In one example, a permissions module may receive a request from a first account to grant a second account access to a computing resource. The permissions module may receive permissions data of the first account from a contactless card and encrypted data generated by the contactless card. The permissions module may transmit the permissions data and the encrypted data to an authentication server, which may verify the encrypted data based at least in part on the private key, and determine, based on the permissions data, that the first account has permissions to grant access to the computing resource. The permissions module may receive, from the authentication server, an indication of the verification of the encrypted data and a permissions vector associated with the second account, the permissions vector reflecting the grant of access to the computing resource to the second account.

SYSTEMS AND METHODS FOR SECURING OFFLINE DATA

Described embodiments provide systems and methods for securing offline data for shared accounts of a shared computing device. Cache files can be generated for a plurality of users of an application executable on the device to store user data corresponding to individual users of the application. An encryption key can be generated for one or more of the cache files and the encryption key can be associated with at least one user of the application. The encryption key can be associated with a user identifier so that the encryption key is not accessible by other users of the computing device. The user data can be encrypted in one of the cache files with the encryption key. The encrypted user data can be presented to a user via the shared computing device based on receipt of a user identifier that enables access to the encryption key.

PROCEDE POUR AUTHENTIFIER UNE DONNEE D'HABILITATION EXTERNE PAR UN OBJET PORTATIF TEL QU'UNE CARTE A MEMOIRE

Abrégé déscriptif Procédé pour authentifier une donnée d'habilitation externe par un objet portatif tel qu'une carte à mémoire. La donnée d'habilitation (C1) entrée dans un appareil (2) est chiffrée avec une information (E) prédéterminée pour donner un message (M) qui est transmis à un objet portatif (1). L'objet (1) déchiffre le message (M) en prenant en compte une donnée d'habilitation de référence (C1) pour retrouver une information (E') qui doit être cohérente avec l'information (E). L'invention s'applique notamment à la reconnaissance du code porteur du titulaire d'une carte de crédit. Figure 1 ...

SYSTEM AND METHOD FOR SECURELY ACCESSING, MANIPULATING AND CONTROLLING DOCUMENTS AND DEVICES USING NATURAL LANGUAGE PROCESSING

A system and method for securing transaction between a user and an electronic device or an electronic document, where the device or document is accessible and controllable by a user with a user electronic device. A transaction request is initiated by the user electronic device, the electronic device is connectable to a network and the electronic document is accessible over the network. The system includes a smart box connectable to the network and having a processor and memory storing general purpose and special purpose software. One or more monitoring hots storable in the memory of the smart box are configured to collect data for the transaction request pertaining to at least one of the user,a process or a the transaction.

Semiconductor integrated circuit device

A semiconductor integrated circuit device including a semiconductor substrate having a first surface on which a circuit block is formed, and a second surface opposite to the first surface; a mounting board on which the semiconductor substrate is mounted; an electrically conductive pattern formed over a region of the mounting substrate, which overlaps a portion to be protected of the circuit block; and a detection circuit configured to detect that the electrically conductive pattern has been altered is provided. The semiconductor substrate is mounted on the mounting board such that the second surface of the semiconductor substrate faces the mounting board.

Systems and methods for remotely loading encryption keys in card reader systems

Systems and methods for remotely loading encryption keys in card reader systems are provided. One such method includes storing, at a card reader, a device identification number for identifying the card reader, a first magnetic fingerprint of a data card, and a second magnetic fingerprint of the data card, wherein each of the first and second fingerprints includes an intrinsic magnetic characteristic of the data card, encrypting, using a first encryption key derived from the second fingerprint, information including the device identification number and first fingerprint, sending the encrypted information to an authentication server, receiving, from the authentication server, a score indicative of a degree of correlation between the first fingerprint and second fingerprint, and receiving, when the score is above a preselected threshold, a second encryption key from the authentication server, the second encryption key encrypted using a third encryption key derived from the first fingerprint.

System and method for managing user token in client device on network

A user token management system in a client device on a network comprises an obtaining module, a web controller and a processing module. The obtaining module obtains a user token from a database in response to a retrieving request for retrieving authorization of a web service provider on the network. The web controller transmits an authenticating request for authenticating the user token to the web service provider and receives an authentication result authenticating the user token. The processing module deletes the user token from the database when that user token is not authenticated by the web service provider.

Techniques for mobile device authentication

A user authenticates a mobile device (MD) to a network-based service (NBS) for initial authentication. Policy is pushed from the NBS to the MD and the MD automatically obtains details about devices and attributes that are near or accessible to the MD in accordance with the policy. The details are pushed as a packet from the MD to the NBS and multifactor authentication is performed based on the details and the policy. If the multifactor authentication is successful, access privileges are set for the MD for accessing the NBS and perhaps for accessing local resources of the MD.

Personalized digital media access system (pdmas)

The invention is an apparatus that facilitates access to encrypted digital media to accept verification and authentication from an excelsior enabler using at least one token and at least one electronic identification. The at least one electronic identification could be a device serial number, a networking MAC address, or a membership ID reference from a web service. Access to the product is also managed with a plurality of secondary enablers using the at least one electronic identification reference.

Methods and Systems for Scalable Distribution of Protected Content

A computerized device can implement a content player to access a content stream using a network interface, the content stream comprising encrypted content and an embedded license comprising a content key encrypted according to a global key accessible by the content player. The content player determines whether a token meeting an authorization condition is present and uses the global key to decrypt the content key only if such a token is present. The authorization condition may be evaluated at least in part based on data included in the content stream. The authorization condition can include presence of a token having a content ID matching a corresponding ID in the license; presence of a token with a correct device ID; presence of a token signed according to a digital signature identified in the licenses; and/or presence of a token that is unexpired, with expiration evaluated based on a time-to-live indicator in the token.

Program execution device

A program execution device capable of protecting a program against unauthorized analysis and alteration is provided. The program execution device includes an execution unit, a first protection unit, and a second protection unit. The execution unit executes a first program and a second program, and is connected with an external device that is capable of controlling the execution. The first protection unit disconnects the execution unit from the external device while the execution unit is executing the first program. The second protection unit protects the first program while the execution unit is executing the second program.

System and methods for identity attribute validation

A method of identity attribute validation at a computer server involves the computer server receiving an identity attribute validation request from a communication terminal. The computer server further receives a credential, and is configured with an attribute disclosure profile of attributes authorized for disclosure to the communication terminal. The computer server determines the validity of the credential, and provides the communication terminal with a response to the identity attribute validation request based on an outcome of the credential validity determination. The attribute validation response includes attributes data associated with the credential authorized for disclosure by the attribute disclosure profile but excludes attributes data associated with the credential not authorized for disclosure by the attribute disclosure profile.

User impersonation/delegation in a token-based authentication system

A “trusted service” establishes a trust relationship with an identity provider and interacts with the identity provider over a trusted connection. The trusted service acquires a token from the identity provider for a given user (or set of users) without having to present the user's credentials. The trusted service then uses this token (e.g., directly, by invoking an API, by acquiring another token, or the like) to access and obtain a cloud service on a user's behalf even in the user's absence. This approach enables background services to perform operations within a hosted session (e.g., via OAuth-based APIs) without presenting user credentials or even having the user present.

Method and apparatus to scale authenticated firewall traversal using trusted routing point

A Trusted Routing Point (TROP) generates a signaling message that includes an authorization token used to authorize a firewall to open a pinhole. The signaling message contains a first indicator that indicates whether a data field in the signaling message represents a source address of a media flow. The signaling message also includes a second indicator that indicates whether the firewall should derive the source address of the media flow from the data field. The authorization token is generated using a one-way hash function over information that may be included in the signaling message, including the first indicator and the second indicator.

Multi-Factor Authentication Using A Smartcard

Methods and systems are provided for non-cryptographic capabilities of a token such as a smartcard to be used as an additional authentication factor when multi-factor authentication is required. Smartcards are configured to generate a transaction code each time a transaction is attempted by the smartcard. The transaction code is dynamic, changing with each transaction, and therefore is used as a one-time password. When a user attempts to access a service or application requiring at least two authentication factors, a secure processor is used to read transaction code from the smartcard. The secure processor establishes a secure communication with the remote computer hosting the service or application. The transaction code can then be encrypted prior to transmission over the public Internet, providing an additional layer of security.

Single sign-on between applications

A single sign-on (SSO) system uses simple one-to-one trust relationships between individual applications and an SSO service to extend log in services from one application to another. Each application retains its own login policies and can separately make a decision whether to trust the SSO request or challenge the user for login credentials. By structuring the SSO system to use simple identity mapping, there is no requirement for consolidating user identity records from multiple applications into a single database with its attendant overhead and dependency risks.

Maintaining privacy for transactions performable by a user device having a security module

A method and system for maintaining privacy for transactions performable by a user device having a security module with a privacy certification authority and a verifier are disclosed. The system includes an issuer providing an issuer public key; a user device having a security module for generating a first set of attestation-signature values; a privacy certification authority computer for providing an authority public key and issuing second attestation values; and a verification computer for checking the validity of the first set of attestation signature values with the issuer public key and the validity of a second set of attestation-signature values with the authority public key, the second set of attestation-signature values being derivable by the user device from the second attestation values, where it is verifiable that the two sets of attestation-signature values relate to the user device.

Systems and Methods for Encrypting Mobile Device Communications

Embodiments of the invention can provide systems and methods for encrypting mobile device communications. According to one example embodiment of the invention, a method for encrypting mobile device communications is provided. The method can include generating, by a first application stored on a first memory of a mobile device, a message to be communicated to an intended recipient; providing, by the first application to an authentication application stored on a second memory of the mobile device, the message; encrypting, by the authentication application, the message; providing, by the authentication application to the first application, the encrypted message; and directing, by the first application, communication of the message to the intended recipient.

Systems and Methods for Authenticating Mobile Devices

Embodiments of the invention provide systems and methods for authenticating mobile devices. A registration request and identifying information for a mobile device or a secure element associated with the mobile device may be received. Based upon the received identifying information and a base level key, a rotated key for the mobile device may be determined. The determined rotated key may then be provided to the mobile device, and the rotated key may be utilized for subsequent authentication of the mobile device.

Revocation status using other credentials

Providing revocation status of at least one associated credential includes providing a primary credential that is at least initially independent of the associated credential, binding the at least one associated credential to the primary credential, and deeming the at least one associated credential to be revoked if the primary credential is revoked. Providing revocation status of at least one associated credential may also include deeming the at least one associated credential to be not revoked if the primary credential is not revoked. Binding may be independent of the contents of the credentials and may be independent of whether any of the credentials authenticate any other ones of the credentials. The at least one associated credential may be provided on an integrated circuit card (ICC). The ICC may be part of a mobile phone or a smart card.

Method and apparatus for protecting software of mobile terminal

A method for protecting software of a mobile terminal is provided in the disclosure, wherein an encryption chip is mounted in the mobile terminal. The method includes: when the mobile terminal is turned on, whether or not the encryption chip is invalid is detected; when it is not invalid, the encryption chip authenticates the software of the mobile terminal through interaction with a main chip; when the authentication is not passed, the encryption chip controls a functional module of the mobile terminal through a hardware protection circuit. An apparatus for protecting software of a mobile terminal is also provided in the present disclosure. The solution of the disclosure can prevent the software of the mobile terminal from being cracked and protect the functions of the mobile terminal from illegal usage, thus the security of the mobile terminal is greatly improved and the interests of operators and manufacturers are protected.

Electronic wallet using allocation of funds

A user may instruct a host to transmit an allocation of electronic money to the user's mobile electronic device from a user's payment account managed by the host. The allocation may include credentials, authentication key(s), a signature, a limited amount of funds, and/or other types of payment information. The allocation may be limited to the amount of funds that, when exhausted or expired, prevents further payments using the mobile electronic device. The user may reload the mobile electronic device with electronic money by reconnecting to the host via the secure channel. The user may spend the allocation using the electronic device with use of minimal or no user-based security measures (e.g., passwords, biometrics, etc.), thereby making it quick and easy to make payments with the electronic money.

Multi-server authentication token data exchange

A client is authenticated by a server receiving an initial request from the client at the beginning of a session. The server receiving the initial request generates an authentication token and returns the authentication token to the client in response to the client being authenticated. The user's credentials used to authenticate the client are stored in the authentication token along with other information. After receiving the authentication token from the server that generated the authentication token, the client passes the authentication token with each of the future requests to the pool of servers. Using the client to pass the transferrable authentication token, the servers share the user's identity/credentials in a decentralized manner. Any server from the shared pool of servers that receives a subsequent client request is able to decrypt the token and re-authenticate the user without having to prompt the client for authentication credentials again.

Authentication

The user's SIM 20 is adapted to store a seed for generating an authentication code which is usable to authenticate a transaction. The mobile telecommunications device 1 has a processor including means operable to obtain the seed from the SIM, to calculate the authentication code and to generate a transaction message for enabling the transaction with the entity, the transaction message including the authentication code.

Systems and methods for identifying an individual

The present application relates to systems and methods using biometric data of an individual for identifying the individual and/or verifying the identity of an individual. These systems and methods are useful for, amongst many applications, more secure identification of high-risk individuals attempting to gain access to an entity, transport, information, location, security organization, law enforcement organization, transaction, services, authorized status, and/or funds.

Method for the Cryptographic Protection of an Application

A method is provided for cryptographic protection of an application associated with an application owner and executed in an external data processing center having a security module that stores private cryptographic material of the application owner. A first secure channel between the security module and application owner and a second secure channel between the application owner and the application are used for transmitting a cryptographic key. The cryptographic key is automatically made available to the secure module and the application via the secure channels, without the data processing center service operator being able to access said key. The application can authenticate itself using the key so that the cryptographic material can be transmitted to the application via a channel protected by the cryptographic key. The application data can be encrypted using the cryptographic material such that the application data cannot be accessed by the data processing center service operator.

Captcha (completely automated public test to tell computers and humans apart) data generation methods and related data management systems and computer program products thereof

CAPTCHA (Completely Automated Public Test to tell Computers and Humans Apart) data generation methods for use in an electronic device and related management systems are provided. First, the electronic device determines a first data set according to at least one first data corresponding to an operation to be performed, wherein the first data represents sensitive data corresponding to the operation. Then, the electronic device generates a group of CAPTCHA data corresponding to the first data set according to the first data. The electronic device may be a server or a client. When the electronic device is the client, the client obtains at least one generation module from the server to determine the first data set, and generate the CAPTCHA data. In some embodiments, during a data transmission procedure, the client performs the operation with the server using the CAPTCHA data.

Method of performing a financial transaction via unsecured public telecommunication infrastructure and an apparatus for same

A method of performing a financial transaction via unsecured public telecommunication infrastructure comprising collecting data relating to a specified financial transaction type; building a transaction token including collected data and/or data derived from the collected data; encrypting the transaction token; creating a financial transaction protocol message incorporating the encrypted transaction token as dependent on a selected transport channel through which the message is to be conveyed; and conveying the financial transaction protocol message using the selected transport channel and by way of the unsecured public telecommunication infrastructure to a destination where the financial transaction protocol message will be further processed is disclosed.

System and Method for Implementing a Trusted Dynamic Launch and Trusted Platform Module (TPM) Using Secure Enclaves

An apparatus and method are described for implementing a trusted dynamic launch and trusted platform module (TPM) using a secure enclave. For example, a computer-implemented method according to one embodiment of the invention comprises: initializing a secure enclave in response to a first command, the secure enclave comprising a trusted software execution environment which prevents software executing outside the enclave from having access to software and data inside the enclave; and executing a trusted platform module (TPM) from within the secure enclave, the trusted platform module securely reading data from a set of platform control registers (PCR) in a processor or chipset component into a memory region allocated to the secure enclave. 1. A method implemented on a computing platform comprising:initializing a secure enclave in response to a first command, the secure enclave comprising a trusted software execution environment which prevents software executing outside the enclave from having access to software and data inside the enclave; andexecuting a trusted platform module (TPM) from within the secure enclave, the trusted platform module securely reading data from a set of hardware platform control registers (pPCR) in a processor or chipset component into a memory region allocated to the secure enclave.2. The method as in further comprising:generating a root key to be used to encrypt data for the trusted platform module, the root key generated from different sets of data stored by native hardware components of a computing system.3. The method as in wherein the different sets of data stored by the native hardware components used to generate the root key comprise one or more of a Flags component claim 1 , a platform unique key claim 1 , an owner epoch value claim 1 , and attestation primitives.4. The method as in wherein the attestation primitives include a set of measurement registers (MRs) claim 3 , at least one of the MRs providing a measurement of code and ...

CONTROL WORD PROTECTION

The invention enables a chip set of a receiver of a conditional access system to receive control words securely from a head-end system in the content delivery network. Hereto the chip set comprises means for processing an incoming message to obtain a virtual control word, and using the virtual control word to generate the control word used for descrambling content received from the content delivery network. The authenticity of incoming messages is verified, in the sense that content descrambling fails if an incoming message is not authentic. 1. A method for securely obtaining a control word in a chip set of a receiver , said control word for descrambling scrambled content transmitted from a content delivery network , the method comprising:receiving, at the chip set, a secured version of a virtual control word from a smart card communicably connected to the chip set, wherein the secured version of the virtual control word is a virtual control word provided from a head-end system to the smart card and secured by the smart card to protect its authenticity and confidentiality;obtaining the virtual control word from the secured version of the virtual control word; andproviding the virtual control word and a signature verification key associated with the head-end system as inputs to a cryptographic function in the chip set to produce a given output, the given output including at least one control word, wherein the cryptographic function has the property that it is infeasible to determine a key pair including a signature key, a signature verification key associated with the signature key and another virtual control word, such that the determined signature verification key and the other virtual control word map to the given output of the cryptographic function.2. The method according to claim 1 , wherein the secured version of the virtual control word comprises the virtual control word secured by an encryption of the virtual control word using a public key associated with ...

Dual Device System for Secure Transactions

Methods and systems for operating a Smart Device 102 with a secure communication system. A SPARC Security Device (SSD) 104 is in communication with one or more Smart Devices 102 . SSD 104 receives a request for a transaction from a Smart Device 102 executing an application obtained from an Application Controlling Institution (ACI) 101 , and is asked to verify the validity of the transaction. A one-time identifier (SSD ID, which replaces the user's account number) is generated by the SPARC Security Device 104 . The one-time identifier comprises a unique SSD 104 unit identifier and a one-time transaction number. In a Loyalty Application, an ACIRD 81 stores on behalf of participating entities an accounting of at least one of inducements, rebates, loyalty points, and rewards earned by or attributable to users of the SD's 102 , and communicates with the SD's 102 and with the associated ACI(s) 101 and SSD(s) 104.

Using windows authentication in a workgroup to manage application users

An system for authenticating users of an application program executing at a front-end computer using the security features built into the operating system of a logon computer is provided. Initially, an administrator establishes user accounts for each user with an operating system executing at the logon computer with access to application resources. When the application program starts executing at the front-end computer, the application program prompts the user for credentials. The application program attempts to access resources managed by the logon computer using the received credentials. When access to a resource is successful, the application program knows that the logon computer has authenticated the user and the user is authorized to access the resource. In this manner, the application program can take advantage of the security features built into the operating system executing at the logon computer to authenticate users of the application program and authorize access to application resources.

System and method for preventing unauthorized access to information

An authentication system protects a hardware cryptographic chip from being commanded to decrypt or sign data by someone other than the legitimate owner(s) of the certificate residing on the chip. Openness of present cryptographic hardware systems are limited by imposing a condition that the cryptographic chip will only perform critical cryptographic tasks if the task is accompanied by a signature which only the legitimate owner can provide.

Method for Programming a Mobile End Device Chip

The invention provides a method for programming a chip for a mobile end device, wherein, in a preparatory step, a serial number is programmed into the chip and thereafter, in a programming step, the serial number is verified and a programming of at least one further datum into the chip is only carried out if the serial number has been successfully verified. The serial number is verified here by means of a security module (HSM), while employing a secret information item stored in the security module (HSM) and different from the serial number.

Device authentication using restriced memory

A device includes a first memory area being used to store a first key and unique secret identification information, the first memory area being restricted from being read and written from outside; a second memory area being used to store encrypted secret identification information generated by encrypting the secret identification information, the second memory area being allowed to be read-only from outside; a third memory area being readable and writable from outside; a first data generator configured to generate a second key by using the first key; a second data generator configured to generate a session key by using the second key; and a one-way function processor configured to generate an authentication information by processing the secret identification information with the session key in one-way function operation, wherein the encrypted secret identification information and the authentication information are output to outside.

Device

According to one embodiment, a device includes a cell array including an ordinary area, a hidden area, and an identification information record area in which identification information which defines a condition for accessing the hidden area is recorded. An authentication circuit performs authentication. A sensing circuit recognizes information recorded in the identification information storage area, determines the information recorded in the identification information record area when an access request selects the hidden area, validates an access to the hidden area when determined that the identification information is recorded, and invalidates an access to the hidden area when determined that the identification information is not recorded.

Authentication method

According to one embodiment, a authentication method comprising: generating a second key by the first key, the first key being stored in a memory and being prohibited from being read from outside; generating a session key by the second key; generating first authentication information, the secret identification information stored in a memory and being prohibited from being read from outside; transmitting encrypted secret identification information to an external device and receiving second authentication information from the external device, the encrypted secret identification information stored in a memory and readable, the second authentication information generated based on the encrypted secret identification information; and determining whether the first authentication information and the second authentication information match.

Message originator token verification

A digital signature of a message originator of a message is validated by a processor on message retrieval by a message recipient as a first-tier validation of the message. In response to a successful first-tier validation of the digital signature of the message originator, a transaction token and a message originator identifier are extracted from a message payload of the message. Communication is initiated with a verification service within a secure messaging environment of the message originator as a second-tier validation of the message using the extracted transaction token and the extracted message originator identifier to confirm whether the secure messaging environment of the message originator generated the transaction token and inserted the transaction token into the message payload. Results of the second-tier validation of the message with the verification service within the secure messaging environment of the message originator are determined.

Interactive Authentication

The present disclosure describes methods, systems, and computer program products for interactive authentication can include receiving a valid authentication credential or an invalid authentication credential associated with a digital identity. The credentials can be received from an end user at an input device in association with a login attempt. If a valid authentication credential is received, it is determined whether an identification token is received with the valid authentication credential. If received, the identification token is identified as a token included in a list of valid tokens associated with the digital identity at an authentication system. In response to the determination that the identification token is included in the list of valid tokens, it is determined whether a lockout period associated with the identification token in the list of valid tokens has expired. If expired, the end user associated with the login attempt can be authenticated.

AUTHENTICATION SYSTEM AND METHOD FOR DIGITAL TELEVISIONS

The invention relates to digital television authentication system and method. The system includes a digital television having a digital television master chip; an SIM card module with a built-in SIM card, connected to the digital television master chip, and an authentication server wirelessly connected to the SIM card. The SIM card module includes a symmetric key generation unit used for generating a symmetric encryption key CT according to a Session Key (SEK) received by the SIM card and an identity (ID) of the SIM card; and a CW acquisition unit used for decrypting, according to the symmetric encryption key CT, an ECW sent by the authentication server, to obtain a CW. The authentication server includes an SEK generation unit used for randomly generating a string and taking the string as an SEK; and an SEK sending unit used for sending the SEK to the SIM card module. 2. The digital television authentication system according to claim 1 , wherein the SIM card module further comprises:an authorization certificate decryption unit configured to decrypt, by using a second public key SK, a Personal Distribute Key (PDK) authorization certificate received by the SIM card, to obtain plaintext of the PDK authorization certificate, and to extract a PDK index from the plaintext of the PDK authorization certificate;a PDK acquisition unit configured to acquire an encryption public key UK and a decryption private key UP according to the ID of the SIM card and the PDK index; andan SEK decryption unit configured to decrypt, by using the decryption private key UP, an encrypted SEK received by the SIM card, to obtain a signature, and to perform decryption and verification on the signature by using a first public key CK, to obtain the SEK; andwherein the authentication server further comprises:an authorization certificate generation unit configured to encrypt, by using a second private key SP, a digital certificate stored at the authentication server, and to generate the PDK ...

Key derivation

To facilitate a change in network authentication key (Ki) for use by a smart card (SIM) during authentication on a cellular telecommunications network, there is provided a smart card management scheme that combines key derivation with over the air (OTA) provisioning. This scheme ensures both that the Ki is never transmitted OTA and that the Ki is stored in two locations only: on the SIM and at an authentication centre (AuC).

Format-preserving cryptographic systems

Key requests in a data processing system may include identifiers such as user names, policy names, and application names. The identifiers may also include validity period information indicating when corresponding keys are valid. When fulfilling a key request, a key server may use identifier information from the key request in determining which key access policies to apply and may use the identifier in determining whether an applicable policy has been satisfied. When a key request is authorized, the key server may generate a key by applying a one-way function to a root secret and the identifier. Validity period information for use by a decryption engine may be embedded in data items that include redundant information. Application testing can be facilitated by populating a test database with data that has been encrypted using a format-preserving encryption algorithm. Parts of a data string may be selectively encrypted based on their sensitivity.

TOKEN PROCESSING WITH SELECTIVE DE-TOKENIZATION FOR PROXIMITY BASED ACCESS DEVICE INTERACTIONS

A method includes providing an initial communication, by an access device to a user device. The access device can receive the user identifier and the access token and receive a secret associated with the user. The access device can determine, using the user identifier and/or the access token, if the transaction is authorized by an authorizing entity computer associated with the access device or by an authorizing entity not associated with the access device. If the transaction is authorized by the authorizing entity computer associated with the access device, the access device can transmit an authorization request message comprising the user identifier, the secret, and the access token to the authorizing entity computer. The authorizing entity computer validates the secret, retrieves a real credential of the user using the user identifier, and authorizes the transaction. 1. A method comprising:providing, by an access device to a user device associated with a user in a transaction, an initial communication;responsive to providing the initial communication, receiving, by the access device from the user device, a user identifier and an access token;receiving, by the access device, a secret associated with the user;determining, by the access device, using the user identifier and/or the access token, if the transaction is authorized by an authorizing entity computer associated with the access device or by an authorizing entity not associated with the access device;if the transaction is authorized by the authorizing entity computer associated with the access device, then transmitting an authorization request message comprising the user identifier, the secret, and the access token to the authorizing entity computer, wherein the authorizing entity computer validates the secret, retrieves a real credential of the user using the user identifier, and authorizes the transaction; andif the transaction is not associated with the authorizing entity computer, then transmitting the ...

INFORMATION PROCESSING DEVICE AND INFORMATION PROCESSING METHOD

An information processing device may include a master device and a slave device capable of communicating with each other. The master device may include a state notification part performing a state notification to the slave device corresponding to a state change, and a command transmission part which waits restoration of the state change and, when restored, transmits the command to the slave device for making execute processing corresponding to the state change. The slave device may include a state notification detection part which sets a notification detection flag when the state notification from the master device is detected, and a state processing execution part which waits the command from the master device and, when the command is received, in a case that the notification detection flag has been set, the state processing execution part performs the processing corresponding to the state change. 1. An information processing device comprising:a master device and a slave device structured to communicate with each other;a state notification line connected between the master device and the slave device being structured to perform a state notification of the master device; anda communication line connected between the master device and the slave device structured to transmit and receive a command and data; a state notification part structured to perform the state notification to the slave device through the state notification line corresponding to a state change; and', 'a command transmission part structured to await restoration of the state change and, when the state change is restored, transmit the command to the slave device for making execute processing corresponding to the state change through the communication line; and, 'wherein the master device comprises a state notification detection part structured to set a notification detection flag when the state notification detection part detects the state notification from the master device through the state ...

ENHANCED SECURITY AUTHENTICATION METHODS, SYSTEMS AND MEDIA

A transaction authorization apparatus includes a processor in communication with a communications interface. The processor is configured to receive a request for a transaction requested by a user with whom a plurality of user devices are associated, to obtain respective transaction measurements from at least some available devices from among the plurality of user devices, and to confirm approval of the request for the transaction in response to confirmation that the transaction measurements satisfy a multi-device authorization policy associated with the transaction. 1. A transaction authorization apparatus comprising:a processor in communication with a computer-readable medium and a communications interface, wherein the processor is configured to:(a) receive a request for a transaction requested by a user with whom a plurality of user devices are associated;(b) obtain respective transaction measurements from at least some available devices from among the plurality of user devices; and(c) confirm approval of the request for the transaction in response to confirmation that the transaction measurements satisfy a multi-device authorization policy associated with the transaction.2. The apparatus of wherein the apparatus comprises a relying party system associated with a party relying upon the user's authentication in respect of the transaction claim 1 , wherein the processor comprises a processor of the relying party system claim 1 , and wherein the processor is configured to receive the request for the transaction by receiving claim 1 , at the relying party system claim 1 , a transaction request message from a first user device of the plurality of user devices.3. The apparatus of wherein the processor of the relying party system is configured to generate and transmit a request response to the first user device claim 2 , the request response defining the multi-device authorization policy for the transaction.4. The apparatus of wherein the processor of the relying party ...

Security hierarchy on a digital transaction processing unit (dtpu)

A Digital Transaction Processing Unit (DTPU) operable to host one or more transaction applications for digitally transacting with a Digital Transaction Device (DTD), the DTPU including a security hierarchy for hosting the one or more transaction applications, wherein the security hierarchy is configured to host at least one transaction application for transacting in contact digital transactions.

SYSTEMS AND METHODS FOR PROVIDING ONLINE AND HYBRIDCARD INTERACTIONS

Various embodiments are generally directed to authenticating a user for non-payment purposes utilizing a payment protocol, a computer device and a contactless card. The payment protocol may be consistent with an EMV standard. An application may determine that authorization or verification of a user may be required to access non-payment features of another application associated with the user and the computer device. The application may then receive and/or facilitate transmission of encrypted data from a communications interface of a contactless card associated with an account and utilizing either an offline or online technique to do so. The offline or online technique may involve one or more operations that can verify the identity of the user and/or otherwise authorize the user to have access to various aspects of the other application. 1. A method comprising:initiating, by a mobile device, a wireless communication to verify a contactless card using near field communication (NFC);receiving, at the mobile device and as part of the wireless communication, a plurality of inputs, including an application transaction counter (ATC);generating, with the mobile device, a cryptogram based on the ATC, the remaining plurality of inputs of the wireless communication, and a symmetric key associated with the card;transmitting, by the mobile device, a message comprising the cryptogram to an authentication server, wherein the message conforms to a payment format;receiving, at the mobile device, a response from the authentication server verifying an identity of the contactless card based on the cryptogram, wherein the generation of the cryptogram and the received response from the authentication server is based on a payment protocol, and wherein the wireless communication and the card verification is distinct from completing a payment in relation to the payment protocol, wherein the response conforms to the payment format;updating, by the mobile device, the ATC based on the card ...

SECURE AUTHENTICATION SYSTEM AND METHOD

Methods and systems pertaining secure transaction systems are disclosed. In one implementation, a computer with a verification token associated with a computer can send user authentication data as well as a secure datum to a control server. The verification token may obtain the secure datum from a validation entity. The control server can validate the secure datum and authentication data and can generate a payer authentication response. 1112.-. (canceled)113. A method comprising:receiving, a Purchase Authentication Page by a computer from a control server over a communications network, the Purchase Authentication Page having a user response posting field to receive a response from a user to authenticate the user; andproviding, a returned Purchase Authentication Page by the computer to the control server over the communications network, the returned Purchase Authentication Page having a user response disposed in the user response posting field and a secure datum received from a verification token associated with the computer, wherein the control server thereaftercompares at least a portion of the received user response to a stored user response to make a first determination of whether a match exists,compares the received secure datum to a stored secure datum to make a second determination of whether a match exists, andgenerates a Payer Authentication Response message based on at least the first and second determinations.114. The method of claim 113 , wherein the secure datum was received by the verification token from a validation entity after the validation entity validates information received from the verification token.115. The method of wherein the secure datum is generated based on an identity of a merchant with which the user conducts a transaction claim 113 , and a date or time of the transaction.116. The method of wherein the secure datum is generated based on an identifier associated with the verification token or an IP address of the computer.117. The ...

SANDBOX BASED INTERNET ISOLATION IN A TRUSTED NETWORK

Methods and systems are disclosed for sandbox based internet isolation system in a trusted network. A networked computer system may include a trusted local area network (LAN) and at least one host computer system connected to the trusted LAN. The host computer system may include a host-based firewall, an operating system, a first memory space, and a second memory space. The host-based firewall may be configured to prevent unauthorized communication between the host computer system and one or more other devices on the trusted LAN. The second memory space may be configured to enable storage and/or operation of one or more applications and/or processes associated with a sandboxed computing environment. The host computer system may include a sandbox firewall that enforces a separation of the first and second memory spaces. 1. A networked computer system comprising:a trusted local area network (LAN), and a first memory space that is configured to enable storage and operation of a workspace configured to execute a first set of one or more applications and processes running on an operating system of the host computer system;', 'a second memory space that is configured to enable storage and operation of a second set of one or more applications and processes associated with a sandboxed computing environment configured to run on the operating system, wherein the second set of one or more applications and processes comprise a browser process configured to operate within the sandboxed computing environment, and wherein the sandboxed computing environment is enforced via a sandbox container process that segregates the workspace associated with the first memory space from the sandboxed computing environment associated with the second memory space, wherein the sandbox container process is configured to prevent data from being communicated between the sandboxed computing environment and the workspace without an explicit user input; and', 'a first firewall configured to operate ...

EXECUTING ENCRYPTED BOOT LOADERS

A secure boot mechanism is described. The secure boot mechanism can operate in environments not originally designed to support such a mechanism. Downstream boot components can be executed from an encrypted boot partition. A first stage boot loader (FSBL) can load a second stage boot loader (SSBL) from an encrypted disk partition. The FSBL can decrypt and load the SSBL. The FSBL can intercept all I/O initiated by the SSBL so that the SSBL can transparently operate on an encrypted disk partition as though the encrypted disk were unencrypted. 1. A computing device comprising:at least one processor:a memory connected to the at least one processor; and intercept an I/O request to an unencrypted partition from a boot loader residing on an encrypted partition; and', 'redirect the intercepted I/O request to an encrypted partition., 'the at least one processor configured to2. The computing device of claim 1 , wherein a primary boot loader decrypts a key using a cryptographic security device claim 1 , the key used to decrypt an encrypted partition.3. The computing device of claim 2 , the at least one processor further configured to:inject the decrypted key into a block of cache memory.4. The computing device of claim 2 , the at least one processor further configured to:unseal the key using a TPM chip.5. The computing device of claim 1 , the at least one processor further configured to:decrypt a downstream boot loader residing on an encrypted partition.6. The computing device of claim 2 , wherein the decrypted key is not persisted to non-memory storage.7. The computing device of claim 1 , wherein a new primary boot loader is inserted before existing boot chain software without modifying the existing boot chain software.8. A method of executing a boot chain comprising:loading a first stage boot loader (FSBL) from an unencrypted partition;checking a certificate associated with the FSBL;in response to determining that the certificate is from a trusted source, executing the FSBL; ...

ASSURED COMPUTER ARCHITECTURE -VOLATILE MEMORY DESIGN AND OPERATION

A method and apparatus providing computer system cryptographic protection including a processor, a trusted platform module, trusted bus devices, a first secure memory and a second secure memory, wherein the first and second memory each have a first and second shadow copy, an external bus controller, and a system bus. The system bus contains trusted data and connects with the processor, the trusted platform module, trusted bus devices, the first and second secure memory and the external bus controller. The first and second secure memory separating code and data via physically distinct memory components. The contents of the distinct memory components being replicated into two shadow copies for each component, wherein during a write operation, simultaneously updating the shadow copies with the contents of the distinct components, and during a read operation, sending the two shadow copies and the memory component to a majority function. 1. An apparatus providing computer system cryptographic protection comprising:a processor;a trusted platform module;trusted bus devices;a first secure memory and a second secure memory, wherein the first and second memory each have a first and second shadow copy;an external bus controller; anda system bus.2. The apparatus as recited in wherein the system bus contains trusted data and connects with the processor claim 1 , the trusted platform module claim 1 , trusted bus devices claim 1 , the first and second secure memory and the external bus controller.3. The apparatus as recited in wherein the external bus controller is connected between the system bus and untrusted external devices.4. The apparatus as recited in wherein data is encrypted when not in use.5. The apparatus as recited in further comprising trust boundaries claim 1 , wherein encrypted data can be unencrypted within the trust boundary.6. The apparatus as recited in wherein the trusted platform module includes secure key generation claim 1 , secure key storage and certified ...

SECURE ENABLEMENT OF PLATFORM FEATURES WITHOUT USER INTERVENTION

Systems, apparatuses, and methods for secure enablement of platform features without user intervention are disclosed. In one embodiment, a system includes at least a motherboard and a processor. The motherboard includes at least a socket and an authentication component. The authentication component can be a chipset, expansion I/O device, or other component. The processor is installed in the socket on the motherboard. During a boot sequence, the processor retrieves a key value from the authentication component and then authenticates the key value. Next, the processor determines which one or more features to enable based on the key value. Then, the processor programs one or more feature control registers to enable the one or more features specified by the key value. Accordingly, during normal operation of the system, the one or more features will be enabled. 1. A system comprising:a processor; andan authentication component; retrieve a key from the authentication component during a boot sequence;', 'authenticate the key;', 'determine, from the key, which of one or more features of the processor to enable responsive to determining the key has been authenticated; and', 'write to one or more feature control registers to enable the one or more features., 'wherein the processor is configured to2. The system as recited in claim 1 , wherein a first feature of the one or more features is overclocking the processor.3. The system as recited in claim 1 , wherein the processor is further configured to:determine from the key, which of one or more features of a motherboard to enable responsive to determining the key has been authenticated; andwrite to one or more feature control registers to enable the one or more features for the motherboard.4. The system as recited in claim 1 , wherein the processor is further configured to:enable a first set of features responsive to retrieving a first key value from the authentication component; andenable a second set of features responsive to ...

Secure Authentication Of A Device Through Attestation By Another Device

Methods and systems for secure authentication of a first device through attestation by one or more other devices are described herein. A server may receive, from an untrusted client device, a request for access to one or more services associated with the server. The server may generate a challenge code. The server may send, to the untrusted client device, a request for attestation of the untrusted client device. The server may receive, from a trusted client device, an indication that the trusted client device attests to an identity of the untrusted client device. Based on the indication that the trusted client device attests to the identity of the untrusted client device, the server may grant, to the untrusted client device, access to the one or more services associated with the server. 1. A method comprising:receiving, by a server from an untrusted client device, a request for access to one or more services associated with the server;generating, by the server, a challenge code;sending, by the server to the untrusted client device, a request for attestation of the untrusted client device, wherein the request for attestation comprises the challenge code;receiving, by the server from a trusted client device, an indication that the trusted client device attests to an identity of the untrusted client device, wherein the indication comprises the challenge code; andbased on the indication that the trusted client device attests to the identity of the untrusted client device, granting, by the server and to the untrusted client device, access to the one or more services associated with the server.2. The method of claim 1 , wherein the challenge code comprises a one-time challenge code claim 1 , and wherein the generating the challenge code comprises generating the challenge code using a random number generator associated with the server.3. The method of claim 1 , wherein the request for attestation further comprises an identifier for the server.4. The method of claim 1 , ...

READING OF AN ATTRIBUTE FROM AN ID TOKEN

The disclosure relates to a method for reading at least one attribute stored in an ID token, wherein the ID token is assigned to a user, said method comprising: determining, by a terminal, of whether a contact-based interface of the ID token is present and can be used for data exchange with the terminal. If the ID token does not have the contact-based interface or this cannot be used, implementing a zero-knowledge authentication protocol via a contactless interface of the terminal and ID token; and deriving an ID token identifier by the terminal. If the ID token has the contact-based interface and this can be used, authenticating the user to the ID token via the contact-based interface; accessing to an ID token identifier by the terminal; sending of the ID token identifier from the terminal to an ID provider computer; use of the ID token identifier by the ID provider computer in order to authenticate the ID provider computer to the ID token; and read access of the ID provider computer to the at least one attribute stored in the ID token. 2. The method according to claim 1 , wherein the implementing the zero-knowledge authentication protocol comprises:first implementing a Diffie-Hellman key exchange (DH I) with use of the static secret by the ID token and by the terminal for generation of a first shared temporary base point (B′);second implementing a Diffie-Hellman key exchange (DH II) with use of the first shared temporary base point (B′), wherein the second implementation comprises the generation of the first public cryptographic key (ÖS_IDT2) and a second public cryptographic key (ÖS_T2) with the inclusion of the static secret and the exchange of the first and second public cryptographic keys between terminal and ID token;establishing a secure first data transfer channel (V1) between ID token and terminal with use of the first and second public cryptographic key;deriving an authentication key (AuS) from the first public cryptographic key (ÖS_IDT2) by the terminal; ...

READING OF AN ATTRIBUTE FROM AN ID TOKEN

The disclosure relates to a method for reading at least one attribute stored in an ID token, wherein the ID token is assigned to a user, said method comprising: determining, by a terminal, of whether a contact-based interface of the ID token is present and can be used for data exchange with the terminal. If the ID token does not have the contact-based interface or this cannot be used, implementing a zero-knowledge authentication protocol via a contactless interface of the terminal and ID token; and deriving an ID token identifier by the terminal. If the ID token has the contact-based interface and this can be used, authenticating the user to the ID token via the contact-based interface; accessing to an ID token identifier by the terminal; sending of the ID token identifier from the terminal to an ID provider computer; use of the ID token identifier by the ID provider computer in order to authenticate the ID provider computer to the ID token; and read access of the ID provider computer to the at least one attribute stored in the ID token. 2. The method according to claim 1 , wherein the implementing the zero-knowledge authentication protocol comprises:first implementing a Diffie-Hellman key exchange (DH I) with use of the static secret by the ID token and by the terminal for generation of a first shared temporary base point (B′);second implementing a Diffie-Hellman key exchange (DH II) with use of the first shared temporary base point (B′), wherein the second implementation comprises the generation of the first public cryptographic key (ÖS_IDT2) and a second public cryptographic key (ÖS_T2) with the inclusion of the static secret and the exchange of the first and second public cryptographic keys between terminal and ID token;establishing a secure first data transfer channel (V1) between ID token and terminal with use of the first and second public cryptographic key;deriving an authentication key (AuS) from the first public cryptographic key (ÖS_IDT2) by the terminal; ...

Cryptographic Device that Binds an Additional Authentication Factor to Multiple Identities

Binding a security artifact to a service provider. A method includes generating a pseudonym for a security artifact. The pseudonym is an identifier of the security artifact to the service provider that is unique to the service provider in that the pseudonym is not used to identify the security artifact to other service providers. Further, the pseudonym uniquely identifies the particular security artifact to the service provider even when a user has available a number of different security artifacts to authenticate to the same service provider to access a user account for the user. The method further includes providing the pseudonym for the security artifact to the service provider. The pseudonym for the security artifact is bound with a user account at the service provider for a user associated with the security artifact.

Client-side security key generation

Techniques are provided for client-side security key generation. An initial request is received from an application executing on a client device. The application includes a security component includes security code. In response to the initial request, a key component is generated. The key component includes one or more parameters from which a valid security key can be generated at the client device by executing the security code. The key component is provided to the client device. A security key associated with a request from the client device to an application server is received. The security key is checked for validity. In response to determining that the security key is valid, processing of the request by the application server is caused.

CONTROLLING VERIFICATION OF KEY-VALUE STORES

Deferred verification of the integrity of data operations over a set of data that is hosted at an untrusted module (UM) is controlled. The controlling includes generating a request for a data operation on the set of data. The request includes an authentication portion. The request is sent to the UM. A response to the request is received from the UM. The response includes cryptographic verification information attesting the integrity of the data operation with respect to prior data operations on the set of data. The response includes results from deferred verification at a trusted module (TM). 1. A system for controlling verification of integrity of data operations , the system comprising:at least one hardware device processor; and generating a request for at least one data operation on the set of data, the request including an authentication portion; and', 'sending the request to the UM; and', 'receiving, from the UM, a response to the request, the response including cryptographic verification information attesting the integrity of the at least one data operation with respect to prior data operations on the set of data, the response including results from deferred verification at a trusted module (TM)., 'control deferred verification of the integrity of data operations over a set of data that is hosted at an untrusted module (UM), the controlling including, 'a memory storing a client secure key value, and storing executable instructions that, when executed, cause one or more of the at least one hardware device processor to2. The system of claim 1 , wherein:the data operations include insert, lookup, delete, and update operations.3. The system of claim 1 , wherein:the set of data is included in a key-value store that is hosted at the UM.4. The system of claim 1 , wherein:receiving the response to the request includes receiving, from the UM, the response to the request, the response including a message authentication code (MAC) based attestation of the integrity for a ...

TOKEN AND CRYPTOGRAM USING TRANSACTION SPECIFIC INFORMATION

Systems and methods for token processing are disclosed. An access device can provide access device data to a mobile communication device. The communication device generates a token request including the access device data and communication device data and sends the token request to a server computer. The server computer returns a token and a token cryptogram to the mobile communication device. The token and the cryptogram may be used in a transaction. 1. A method comprising:receiving access device data by a mobile communication device from an access device;generating, by the mobile communication device, a token request including the access device data and communication device data;sending, by the mobile communication device, the token request to a server computer, wherein the server computer thereafter determines a token and generates a cryptogram, the cryptogram generated using the access device data and the communication device data;receiving, by the mobile communication device, the token and the cryptogram; andproviding, by the mobile communication device, the token and the cryptogram to the access device, wherein the access device forwards the cryptogram and the token to the server computer, which verifies the cryptogram and processes the token.2. The method of , wherein the access device data comprises location information of the access device , and wherein the communication device data comprises location information of the communication device. The method of , wherein the cryptogram is generated using token specific information , the token specific information including when the token was requested.4. The method of claim 1 , wherein the access device data was present in a two-dimensional code displayed on the access device.5. The method of claim 1 , wherein the access device data comprises a resource provider ID and a transaction initiate timestamp.6. A communication device comprising;a processor, anda computer readable medium, the computer readable medium ...

USB SECURITY GATEWAY

A USB security gateway device is integrated within a host computer. The USB security gateway device is used for protecting a USB port of a host computer against interaction with unauthorized USB device. The USB security gateway device qualifies any USB peripheral device before it allows it to interact with the host device. Qualification parameters are stored in the USB security gateway device and are reprogrammable. 2. The USB gateway of claim 1 , wherein the controller further comprising a table of qualified peripheral devices.3. The USB gateway device of claim 1 , wherein the USB gateway is in a single enclosure stand-alone device.4. The USB gateway of claim 1 , wherein the USB gateway is integrated into a USB hub.5. The USB gateway of claim 1 , wherein the switch and the reset detector are integrated together in a single component.6. The USB gateway of claim 1 , wherein the USB gateway is in a form of a USB dongle.7. The USB gateway of claim 1 , wherein the USB gateway have a plurality of host USB connectors and the switch is configured to couple the peripheral device USB to any one of a plurality of host computers.8. The USB gateway of claim 1 , wherein the USB gateway is integrated in a peripheral sharing switch that is configured to switch the peripheral device USB signals to any one of the connected hosts computer of the peripheral sharing switch.9. The USB gateway of claim 1 , wherein the USB gateway support a plurality of USB versions including at least one of or any combination of USB 2.0 claim 1 , USB 3.0 claim 1 , and USB 3.110. The USB gateway of claim 2 , wherein said table of qualified peripheral devices contains at least one of:a black list, listing qualifications of peripheral device to be blocked from connecting to each of said USB host connectors; anda white list, listing qualifications of peripheral device to be allowed to connect to each of said USB host connectors.11. The USB gateway of claim 1 , wherein said enumeration data to qualify the ...

SECURE TRANSFER AND USE OF SECRET MATERIAL IN A SHARED ENVIRONMENT

Aspects related to the secure transfer and use of secret material are described. In one embodiment, an encrypted secret key and encrypted revocation data are imported into a trusted execution environment and decrypted with private provider and vendor keys. In this manner, a provider of cryptographic processes is not exposed to the secret key or revocation data of a customer, as the secret key and revocation data are decrypted and stored within the trusted execution environment but not accessed in an unencrypted form. In turn, the provider can receive various instructions to perform cryptographic operations on behalf of the customer. Based on the outcome of a revocation check using the revocation data, the instructions can be performed by the trusted execution environment. 1. A non-transitory computer-readable medium having computer-readable instructions stored thereon that , when executed by at least one of one or more computing devices , directs at least one of the one or more computing devices to:receive double encrypted revocation data from a customer client device;extract vendor encrypted revocation data from the double encrypted revocation data by decrypting the double encrypted revocation data with a private provider key;extract revocation data from the vendor encrypted revocation data by decrypting the vendor encrypted revocation data with a private vendor key;store the revocation data within a trusted execution environment;receive an instruction from the customer client device to perform a cryptographic operation using a secret key; andin response to the instruction, perform a revocation check to determine whether the secret key has been revoked.2. The non-transitory computer-readable medium of claim 1 , wherein at least one of the one or more computing devices is further directed to perform claim 1 , by the trusted execution environment claim 1 , the cryptographic operation using the secret key based in part on an outcome of the revocation check.3. The non- ...

EVENT DRIVEN SECOND FACTOR CREDENTIAL AUTHENTICATION

A reader configured to perform dual-factor authentication is provided. The reader is configured to analyze credential data as well as event-based user inputs. The event-based user inputs are received in response to the reader presenting one or more events to a user and monitoring the user's reaction thereto. Utilization of an event-based user input enables the reader to perform dual-factor authentication without necessarily being provided with a keyboard or other advanced user input device. 1. A method , comprising:detecting, at a reader, user input related to one or more events controlled by the reader;analyzing the event-based user input; andbased on the analysis of the event-based user input, determining whether the user that provided the user input is allowed access to an asset protected by the reader.2. The method of claim 1 , further comprising:receiving, at the reader, credential data from a credential;analyzing the credential data; andupon determining that the credential data and the event-based user input are both valid, permitting the user access to the asset protected by the reader.3. The method of claim 2 , wherein the credential data is split across a plurality of credentials and wherein the credential data is determined to be valid when each of the plurality of credentials are presented in a predetermined order.4. The method of claim 1 , wherein the one or more events controlled by the reader comprise at least one of flashing a light and beeping a buzzer a predetermined number of times.5. The method of claim 1 , wherein the one or more events controlled by the reader comprise sequentially displaying numbers in a random or pseudo random order.6. The method of claim 1 , wherein the event-based user input comprises monitoring and detecting a user action that occurs at a predetermined time during presentation of the one or more events controlled by the reader.7. The method of claim 1 , wherein a valid event-based user input comprises an N-digit PIN and ...

Methods to authorizing secondary user devices for network services and related user devices and back-end systems

Methods are provided to authorize a secondary user device for a network service provided over a network. Responsive to receiving a request from a primary user device, a voucher may be transmitted over the network to the primary user device. A request for an authorization waiver may be received from the secondary user device over the network, wherein the request for the authorization waiver includes the voucher that was transmitted to the primary user device. Responsive to receiving the request from the secondary user device including the voucher, an authorization waiver may be transmitted to the secondary user device. Related methods of operating primary and secondary user devices are also discussed.

ACCESS CONTROL AND SECURITY FOR SYNCHRONOUS INPUT/OUTPUT LINKS

Aspects include providing automatic access control and security for a synchronous input/output (I/O) link. Providing automatic access control and security includes initializing devices of a storage environment over a first link to verify that the devices are available within the storage environment; building a table of identifiers, where each of the identifiers is assigned one of the devices that have been initialized; and verifying a first device attempting to perform synchronous I/O commands across the synchronization I/O link by confirming that an identifier assigned to the first device is within the table of identifiers. 1. A method for providing automatic access control and security for a synchronous input/output (I/O) link , the method comprising:initializing devices of a storage environment over a first link to verify that the devices are available within the storage environment;building a table of identifiers, each of the identifiers is assigned one of the devices that have been initialized; andverifying a first device attempting to perform synchronous I/O commands across the synchronization I/O link by confirming that an identifier assigned to the first device is within the table of identifiers; andplacing, by host firmware, information comprising a channel image and worldwide node name target information into a mailbox based on the synchronous I/O commands.2. The method of claim 1 , further comprising:checking a target worldwide node name to determine that no errors have occurred on the synchronous input/output (I/O) link with respect to the synchronous I/O commands.3. The method of claim 1 , further comprising:passing a link token between a logical partition and when performing synchronous I/O commands.4. The method of claim 1 , wherein the information includes a target storage control unit image claim 1 , a unit address claim 1 , a worldwide unique node name claim 1 , a logical partition identification claim 1 , and a function handle.5. The method of ...

SECOND DYNAMIC AUTHENTICATION OF AN ELECTRONIC SIGNATURE USING A SECURE HARDWARE MODULE

A system for a second dynamic authentication of an electronic signature by a signing user of a document having signature keys located in a key container, using signer enrolment and signature applications connected to the server, wherein the system includes a secure hardware module to be connected to the signature server, including a system for building an activation challenge from a key identifier, and an initialisation password given by the signer, in order to issue the challenge to the signature server, which then requests a computing application to compute a one-time password to be sent to the signer. 1. A system for a second dynamic authentication of an electronic signature by a signing user of a document having signature keys located in a key container , using signer enrolment and signature applications connected to the server , the system comprising a secure hardware module to be connected to the signature server , comprising means for building an activation challenge from a key identifier , and an initialisation password given by the signer , in order to issue said challenge to the signature server which then requests a computing application to compute a one-time password to be sent to the signer.2. A method for implementing a system for a second dynamic authentication according to claim 1 , comprising building an activation challenge from a key identifier and an initialisation password given by the signer.3. The method for implementing according to claim 2 , comprising generating a signature key comprising a step of transmitting by the signature server to the secure hardware module claim 2 , a key identifier claim 2 , a maximum use counter and an initialisation password claim 2 , in order to obtain in return a pair of keys in the form of a user-linked key token and contained in the key container thereof claim 2 , which is produced by the module.4. The method for implementing according to claim 2 , comprising carrying out a request for a signature certificate ...

Accelerator for encrypting or decrypting confidential data with additional authentication data

Disclosed embodiments relate to encrypting or decrypting confidential data with additional authentication data by an accelerator and a processor. In one example, a processor includes processor circuitry to compute a first hash of a first block of data stored in a memory, store the first hash in the memory, and generate an authentication tag based in part on a second hash. The processor further includes accelerator circuitry to obtain the first hash from the memory, decrypt a second block of data using the first hash, and compute the second hash based in part on the first hash and the second block of data.

FEDERATED BLOCKCHAIN IDENTITY MODEL AND SECURE PERSONALLY IDENTIFIABLE INFORMATION DATA TRANSMISSION MODEL FOR RCS

According to one embodiment, providing identity authentication can comprise registering, by an identity server, Proof Of Identity (POI) information in an identity record for a user of a Rich Communications Services (RCS) network in a secure store and a hash of an identity claim token for the user in an identity management blockchain. The identity server can receive a request to authenticate the user and, in response to the request, provide an encrypted identity claim token for the user. The encrypted identity claim token can comprise a attestation of a certifying authority and, when decrypted and hashed can match the hash of identity claim token in the identity management blockchain when the user is authentic. An authentication score indicating a degree to which received biometric data of the user and device data matches a set of baseline biometric and device date can also be provided in response to the request. 1. A method for providing identity authentication , the method comprising:registering, by an identity server, Proof Of Identity (POI) information in an identity record for a user of a Rich Communications Services (RCS) network in a secure store and a hash of an identity claim token for the user in an identity management blockchain;receiving, by the identity server, a request to authenticate the user; andproviding, by the identity server, in response to the request, encrypted identity information for user, the encrypted identity information comprising an identity claim token for the user.2. The method of claim 1 , wherein registering the POI information in an identity record for the user further comprises:receiving, by the identity server from a device of the user, device information uniquely identifying the device of the user;receiving, by the identity server from the device of the user, the POI information for the user;storing, by the identity server, the device information and the PII POI information for the user in the identity record for the user in an ...

DATA TRANSMISSION METHOD, TERMINAL, AND ELECTRONIC SIGNATURE METHOD AND SYSTEM

Provided are a data transmission method, a terminal, and an electronic signature device. The data transmission method includes: establishing an NFC connection with a terminal; sending a Bluetooth address of an electronic signature token to the terminal via the NFC connection; receiving a Bluetooth address of the terminal and first information sent by the terminal via the NFC connection; prompting the first information; performing a processing on the first information to acquire second information after the electronic signature token receives a confirming instruction for indicating that the first information is correct; broadcasting the Bluetooth address of the electronic signature token to be explored by the terminal; establishing a Bluetooth connection with the terminal corresponding to the Bluetooth address of the terminal; and sending the second information to the terminal via the Bluetooth connection. 13-. (canceled)4. A data transmission method , comprising:establishing, by an electronic signature token, an NFC connection with a terminal;sending, by the electronic signature token, a Bluetooth address of the electronic signature token to the terminal via the NFC connection;receiving, by the electronic signature token, a Bluetooth address of the terminal and first information sent by the terminal via the NFC connection;prompting, by the electronic signature token, the first information;performing, by the electronic signature token, a processing on the first information to acquire second information after the electronic signature token receives a confirming instruction for indicating that the first information is correct;broadcasting, by the electronic signature token, the Bluetooth address of the electronic signature token to be explored by the terminal;establishing, by the electronic signature token, a Bluetooth connection with the terminal corresponding to the Bluetooth address of the terminal; andsending, by the electronic signature token, the second ...

INTERNET OF THINGS SECURITY MODULE

An Internet of Things (IoT) security module that easily interfaces with an electronic device and performs security functions includes: at least one of an authentication function; an encryption and decryption function; a random number generation function; and a storage function. An IoT security hardware develops an interface to be easily attached to and detached from a general-purpose open board for building an IoT environment and makes security features easy to use on the general-purpose open board. The IoT security module includes an interface unit which interfaces with the electronic device and receives one of the security functions from the electronic device, where the security functions include authentication function, encryption and decryption function, random number generation function, and storage function; and an authentication unit which determines whether the ID and unique number of the electronic device input through the interface unit match the prestored ID and unique number. 1. An Internet of Things security module comprising:an interface unit interfaced with an electronic device to receive any one of security functions, including an authentication function, an encryption and decryption function, a random number generation function and a storage function, inputted by the electronic device; andan authentication unit for determining whether an ID and a unique number of the electronic device inputted through the interface unit match an ID and a unique number stored in advance.2. The Internet of Things security module according to claim 1 , wherein the authentication unit outputs a match signal to the electronic device if the inputted ID and unique number match an ID and a unique number stored in advance.3. The Internet of Things security module according to claim 1 , further comprising an encryption and decryption unit for encrypting information to be encrypted on the basis of the information to be encrypted claim 1 , an encryption method and a key value ...

DEVICE AND METHOD FOR CONNECTING A PRODUCTION DEVICE TO A NETWORK

An apparatus for connecting a data-processing and/or data-generating production apparatus with a network includes a first network interface to be connected with the network, a second network interface to be connected with the production apparatus, and a program code stored in the memory for execution by the at least one processor. The program code comprises program code upon whose execution data packets received at the second network interface via a second protocol are forwarded to the first network interface, and/or upon whose execution data packets received at the first network interface via a first protocol are forwarded to the second network interface and there are sent via a second protocol to the production apparatus. The program code comprises program code upon whose execution the at least one processor applies a packet filter to the data packets on the way between the network interfaces. 116.-. (canceled)17. An apparatus for connecting a data-processing and/or data-generating production apparatus with a network , preferably with a data processing device , for example a server , via the network , comprisinga memory,at least one processor with the memory, which processor can access the memory in reading and writing manner,a first network interface to be connected with the network,a second network interface to be connected with the production apparatus,a computer program's program code stored in the memory for execution by the at least one processor,wherein the program code comprises program code upon whose execution data packets received at the second network interface via a second protocol are forwarded to the first network interface and there are sent via a first protocol into the network, in particular to the data processing apparatus, for example the server, and/orupon whose execution data packets received at the first network interface via a first protocol are forwarded to the second network interface and there are sent via a second protocol to the ...

Secure request authentication for a threat protection service

The technique herein provides for a client application to manage a resolver configuration and send DNS requests to a threat protection service when a mobile device operating the client application is operating off-network. The client application is configured to detect network conditions and automatically configure an appropriate system-wide DNS resolution setting for various operating. Preferably, DNS requests from the client identify the customer and the device to threat protection (TP) service resolvers without introducing a publicly-visible customer or device identifier to the DNS requests or responses. The TP system then applies the correct policy to DNS requests coming from off-network clients. In particular, the TP resolver recognizes the customer for requests coming for off net clients and apply the customer's policy to such request. The resolver is also configured to log the customer and the device associated with requests from the TP off-net client. Preferably, request logs from the TP resolver are provided to a cloud security intelligence platform for threat intelligence analytics and customer visible reporting.

SYSTEMS AND METHODS FOR CYBER-PHYSICAL VEHICLE MANAGEMENT, DETECTION AND CONTROL

A cyber-physical device management system may allow for highly reliable and authentic identity management of cyber-physical systems, unforgeable legal interception devices, and robust relay nodes. A cyber-physical device management system may also provide for human and object bi-directional authenticity verification. In some cases, a cyber physical management system may enable a cyber physical vehicle (CPV) detection and intervention system which may be capable or detection, identification, capture, seizure, and immobilization of CPVs. In some embodiments the CPV detection and intervention system includes a geocoding laser subsystem for determining a location of a CPV. 1. A system for cyber-physical device management , comprising: receive and store authenticating information from an authentication authority for a plurality of authenticated cyber-physical devices,', 'receive and store authoritative cyber-physical command computing device registration information from an authoritative cyber-physical device command agency,', 'generate a cryptographic authentication token for at least one of the plurality of authenticated cyber-physical devices,', 'issue and send the cryptographic authentication token to the corresponding cyber-physical device, and', 'communicate with any one of the plurality of authenticated cyber-physical devices to verify, prior to and during operation, the authenticity of the data transmitted by the cyber-physical device using the cryptographic authentication token issued and stored on the cyber-physical device; and, 'a cyber-physical device management computing system configured to query the cyber-physical device, intercept the cyber-physical device transmissions,', 'send a challenge to the cyber-physical device,', 'receive a challenge response from the cyber- physical device,', 'authenticate the challenge response received from the cyber-physical device, and', 'determine if the cyber-physical device is authentic and authorized., 'at least one ...

KEY PROTECTION FOR COMPUTING PLATFORM

A security accelerator device stores a first credential that is uniquely associated with the individual security accelerator device and represents a root of trust to a trusted entity. The device establishes a cryptographic trust relationship with a client entity that is based on the root of trust, the cryptographic trust relationship being represented by a second credential. The device receives and store a secret credential of the client entity, which is received via communication secured by the second credential. Further, the device executes a cryptographic computation using the secret client credential on behalf of the client entity to produce a computation result. 1 a first credential that is uniquely associated with the security accelerator device and represents a root of trust to a trusted entity; and', establish a cryptographic trust relationship with a client entity that is based on the root of trust, the cryptographic trust relationship being represented by a second credential;', 'receive and store a secret client credential of the client entity, wherein the secret client credential is received from the client entity via communication secured by the second credential; and', 'execute a cryptographic computation using the secret client credential on behalf of the client entity to produce a computation result., 'instructions that, when executed by the execution hardware, cause the security accelerator device to], 'execution hardware including at least one processor core, and non-volatile data storage hardware, wherein the data storage hardware includes. A security accelerator device, comprising: This application is a continuation of U.S. patent application Ser. No. 15/941,407, filed Mar. 30, 2018, which is incorporated by reference herein in its entirety.Embodiments described herein generally relate to data processing and network communication systems, and in particular, to techniques for establishing and implementing functionality for data processing and ...

ACCESS MANAGEMENT SYSTEM, AUTHENTICATION DEVICE FOR ACCESS MANAGEMENT SYSTEM, MANAGEMENT DEVICE FOR ACCESS MANAGEMENT SYSTEM, PORTABLE TERMINAL FOR ACCESS MANAGEMENT SYSTEM, MOBILE BODY FOR ACCESS MANAGEMENT SYSTEM, DATA STRUCTURE FOR ACCESS MANAGEMENT DATA, ACCESS MANAGEMENT PROGRAM, AND CONSTRUCTION METHOD FOR ACCESS MANAGEMENT SYSTEM

An access management system that reduces possibility of unauthorized access, an authentication device, a management device, a portable terminal, and a mobile body configuring the access management system, a data structure for access management data used in the access management system, an access management program executed in the access management system, and a construction method for the access management system. A plurality of nodes connected by a P2P network share a blockchain. Authentication conditions are recorded in blocks of the blockchain by a management node, which is any one of the plurality of nodes. The authentication conditions include authentication information. The authentication conditions designate an authentication node, which is any one of the plurality of nodes, as a node that performs authentication. The passing body is authenticated by the authentication node. 1. An access management system comprising a plurality of nodes connected by a P2P network , to store a blockchain shared among the plurality of nodes; and', 'to validate validity of a block added to the blockchain, wherein, 'each of the plurality of nodes including processing circuitryin at least any one of the plurality of nodes, the processing circuitry generate a block added to the blockchain,in a management node, which is any one of the plurality of nodes, the processing circuitry record in blocks of the blockchain, authentication conditions including authentication information of an authenticatable passing body, and the processing circuitry read authentication information of the passing body; and', 'authenticate the passing body when the authentication node is designated, in the authentication conditions recorded in the blocks of the blockchain, as a node that performs authentication and the read authentication information is included in the authentication conditions., 'in an authentication node, which is any one of the plurality of nodes and provided in a region where the passing ...

CARD ISSUING WITH RESTRICTED VIRTUAL NUMBERS

Various embodiments are directed to applying, via contactless card authentication, one or more restrictions to a virtual card number and generating the card number for use by a recipient. The one or more restrictions may be specifically personalized to the recipient and may include, for example, a merchant restriction, an amount restriction, a time period restriction, or a location restriction. The generated virtual card number along with the applied one or more restrictions may be consumed in various ways, such as writing the number to a blank card, transmitting the number directly to the recipient's computing device, etc., all via near-field communication. 120-. (canceled)21. An apparatus , comprising:a display device;near field communication (NFC) circuitry configured to communicate data;memory configured to store instructions; detect an indication to generate a virtual card number;', 'cause a prompt to display on the display device, the prompt to prompt a user to provide a contactless card on a surface of the apparatus or within a distance of the apparatus to communicate in accordance with NFC;', 'detect, via the NFC circuitry, the contactless card;', 'receive, via the NFC circuitry, a cryptogram from the contactless card, the cryptogram comprising identifying information to authenticate the user;', 'send the cryptogram to one or more remote devices to authenticate the user;', 'receive a second indication from the one or more remote devices that authentication of the user is successful;', 'determine, in response to authentication of the user, the virtual card number; and', 'send the virtual card number to another contactless card or to a remote device., 'processing circuitry coupled with the memory, the NFC circuitry, and the display device, the processing circuitry configured to process the instructions, that when executed, cause the processing circuitry to22. The apparatus of claim 21 , wherein the processing circuitry further configured to process the ...

MOBILE PEER-TO-PEER AUTHENTICATED TRANSFERS

A peer-to-peer transaction security method includes authentication and identification steps for pushing an encrypted colorgram from a transaction server to a first personal trusted device. Such provides a visual key for user authentication. Persona descriptors may be included for user identification. A decryption of the colorgram is displayed on the first personal trusted device to be optically captured by a second personal trusted device. The image captured from the second personal trusted device is encrypted and uploaded to the transaction server. In some cases, the persona descriptors alone are used to build a composite rendering for identification of the first user by the second user. The second user clicks and returns an acceptance if they recognize the composite drawing as a reasonable persona of the first user. 1. An electronic transaction security method for peer-to-peer authenticated transfers between independent users each equipped with a personal trusted device , comprising the steps of:pushing an encryption of a first video image from a transaction server over a network to a first personal trusted device;displaying a decryption of the encrypted video image reconstituted as the first video image on said first personal trusted device;optically capturing a second video image of that displayed on said first personal trusted device with a second personal trusted device;uploading an encryption of the second video image from the second personal trusted device to the transaction server; andauthenticating an associated transaction between independent users respectively equipped with the first and second personal trusted devices based on a comparison of the first video image that was pushed to the first personal trusted device and the second video image that was uploaded from the second personal trusted device.2. The electronic transaction security method of claim 1 , further comprising:including within the pushing of the encrypted video image at least one coupon, ...

TRUSTED KERNEL STARTING METHOD AND APPARATUS

A trusted kernel starting method and apparatus are provided. The method includes: starting a security boot module boot loader; invoking the boot loader to measure, according to a first security algorithm, whether a platform configuration register (PCR) partition is trusted; if the PCR partition is trusted, invoking the boot loader to read kernel code into a memory, and invoking the boot loader to measure, according to a first complete algorithm and a kernel code standard measurement value prestored in the PCR partition, whether the kernel code is trusted; initializing, if the kernel code is trusted, the kernel code to trigger an initialized kernel to measure, according to a second complete algorithm, whether the boot loader is trusted; and starting the kernel if the boot loader is trusted. Kernel starting security is improved. 1. A trusted kernel starting method , comprising:starting a security boot loader;invoking the boot loader to measure, according to a first security algorithm, whether a platform configuration register (PCR) partition is trusted;invoking, if the PCR partition is trusted, the boot loader to read kernel code into a memory, and invoking the boot loader to measure, according to a first complete algorithm and a kernel code standard measurement value prestored in the PCR partition, whether the kernel code is trusted;initializing, if the kernel code is trusted, the kernel code to trigger an initialized kernel to measure, according to a second complete algorithm, whether the boot loader is trusted; andstarting the kernel if the boot loader is trusted.2. The trusted kernel starting method according to claim 1 , further comprising:acquiring a PCR partition standard measurement value prestored in an environment (ENV) partition; andwherein the invoking the boot loader to measure, according to the first security algorithm, whether the PCR partition is trusted comprises:invoking the boot loader to calculate a PCR partition actual measurement value according ...

VERIFYING INTEGRITY OF BACKUP FILE IN A MULTIPLE OPERATING SYSTEM ENVIRONMENT

Provided is a technique to enhance security of a computer in a multi-OS operating environment. A memory image of a primary OS is in an active state, and a memory image of a secondary OS is in a non-active state. When switching is performed from the primary OS to the secondary OS, a runtime image is created, and a digest P is calculated and encrypted (C). When switching is performed from the secondary OS to the primary OS, a digest of the stopped runtime image is calculated. Only when comparison between the decrypted digest P and the calculated digest shows agreement, is switching of the primary OS allowed. 1. A method comprising:in response to switching operation of a computer from a first operating environment to a second operating environment, encrypting a representative file enabling verification of identity of at least a portion of a first memory image, the first memory image corresponding to the first operating environment;saving the first memory image at a selected location;decrypting the encrypted representative file in response to switching operation from the second operating environment to the first operating environment; andcomparing a file representative of the saved first memory image with the decrypted representative file.2. The method of claim 1 , wherein the representative file is a digest that is created by hashing at least a portion of the first memory image3. The method of claim 1 , wherein a system firmware causes the computer to execute the encrypting claim 1 , the saving claim 1 , the decrypting and the comparing.4. The method of claim 3 , wherein the encrypting includes using an encryption key that is stored at a SMRAM area.5. The method of claim 3 , wherein the encrypting includes:creating a public key and an encrypted private key; andstoring a decrypted private key at a SMRAM area.6. The method of claim 5 , wherein encryption and decryption of the private key is performed by a security chip.7. The method of claim 3 , wherein the encrypting ...

System and method for controlling state tokens

The system and method for controlling state tokens described herein may secure sensitive application state tokens, link one application state token to other state tokens that represent certain identities or communication sessions, and maintain application state tokens to integrate various different systems or applications. In particular, the system and method described herein may provide a mechanism to override scheme that applications use to manage state information and thereby enforce policies that provide fine-grained control over any semantics the applications otherwise use to manage state information. Furthermore, a first application state token may be linked to another state token representing a session or identity to validate whether the session or identity represented therein created the first application state token, and state tokens that represent active communication sessions may be copied from browser processes to various external clients to integrate or otherwise share state information across the various external clients.

IMBALANCED MONTGOMERY LADDER

The invention relates to a method for securing an electronic device (SC) against attacks via covert channels when the electronic device (SC) implements a Montgomery ladder for calculating the element AA. . . A where A appears k times. A designates an element of an Abelian group with a law , and k is a natural number. The method comprises a modified implementation of the Montgomery ladder. The invention also relates to a device (SC), a computer program and a storage medium arranged so as to implement such a method. 1. A method for securing an electronic device (SC) against side-channel attacks when the electronic device (SC) implements a Montgomery ladder to calculate element AA . . . A where A appears k times , A being an element of an Abelian group with a law and k being a positive integer , the method comprising a modified implementation of the Montgomery ladder comprising:{'b': 1', '1, 'determining (DET_r), by a determination circuit of the electronic device (SC), a first positive integer r;'}{'b': 1', '1', '1, 'sup': ⊥', '⊥', '⊥, 'calculating (CALC_R), by a calculation circuit of the electronic device (SC), a first parameter R=AA . . . A where A appears r times;'}{'b': 2', '2, 'determining (DET_r), by a determination circuit of the electronic device (SC), a second positive integer r;'}{'b': 2', '2', '2, 'sup': ⊥', '⊥', '⊥, 'calculating (CALC_R), by a calculation circuit of the electronic device (SC), a second parameter R=AA . . . A where A appears r times;'}{'b': 1', '2, 'calculating (CALC_k), by a calculation circuit of the electronic device (SC), a positive integer k′ from the positive integer k, from the first positive integer r, and from the second positive integer r;'}{'b': 1', '1', '1', '2', '2', '2, 'sup': ⊥', '⊥', '⊥', '⊥', '⊥', '⊥, 'implementing (M_ML), by a calculation circuit of the electronic device (SC), the Montgomery ladder modified to use positive integer k′ in place of positive integer k, first parameter R=AA . . . A where A appears r times in ...

METHOD AND SYSTEM FOR IMPROVING THE DATA SECURITY DURING A COMMUNICATION PROCESS

A system for improving the data security during a communication process, including at least one processor and a hardware security module. The communication data is authenticated prior to a transmission process, and the authenticity of the communication data is checked upon being received. The authentication is carried out by the processor, and the authentication check is carried out by the hardware security module, wherein the communication data is car-to-X messages. The processor and the hardware security module are linked via a common secret element such that at least the hardware security module cannot be coupled to another processor. 1. A method for improving data security in a communication process , comprising:encrypting and/or authenticating communication data before sending; anddecrypting and/or checking the authenticity thereof when received, whereina processor performs the encryption and/or the authentication, and a hardware security module performs the decryption and/or the authenticity check.2. The method as claimed in claim 1 , wherein the communication data are vehicle-to-X messages.3. The method as claimed in claim 1 , wherein the processor and the hardware security module each comprise a TRNG or a key generator module.4. The method as claimed in claim 1 , wherein the processor and the hardware security module are linked via a shared secret such that at least the hardware security module cannot be linked to any other processor.5. The method as claimed in claim 1 , wherein the processor executes software that performs a secure boot procedure.6. The method as claimed in claim 1 , wherein the processor executes software that opens debugging interfaces only after successful authentication of the communication partners.7. The method as claimed in claim 1 , wherein the processor comprises a special secure RAM claim 1 , which can be used solely by a security module assigned to the processor.8. The method as claimed in claim 1 , wherein an AES module of the ...

SECURE CIRCUIT FOR ENCRYPTION KEY GENERATION

Techniques are disclosed relating to relating to a public key infrastructure (PKI). In one embodiment, an integrated circuit is disclosed that includes at least one processor and a secure circuit isolated from access by the processor except through a mailbox mechanism. The secure circuit is configured to generate a key pair having a public key and a private key, and to issue, to a certificate authority (CA), a certificate signing request (CSR) for a certificate corresponding to the key pair. In some embodiments, the secure circuit may be configured to receive, via the mailbox mechanism, a first request from an application executing on the processor to issue a certificate to the application. The secure circuit may also be configured to perform, in response to a second request, a cryptographic operation using a public key circuit included in the secure circuit. 1. An integrated circuit , comprising:at least one processor; and receive, via the mailbox mechanism, a first request from an application executing on the processor, wherein the first request is a request to issue a certificate to the application;', generate a key pair having a public key and a private key; and', 'issue, to a certificate authority (CA), a certificate signing request (CSR) for a certificate corresponding to the key pair., 'in response to the first request], 'a secure circuit isolated from access by the processor except through a mailbox mechanism, wherein the secure circuit is configured to2. (canceled)3. The integrated circuit of claim 1 , wherein the secure circuit is configured to:receive, from the application via the mailbox mechanism, a second request to perform a cryptographic operation with the private key on a set of data from the application; andin response to the second request, perform the cryptographic operation using a public key included in the secure circuit.4. The integrated circuit of claim 3 , wherein the cryptographic operation is generating a signature from the set of data ...

METHOD AND SYSTEM FOR RESPONDING TO AN UNAUTHORIZED ACTION ON A MOBILE COMMUNICATIONS DEVICE

In a method and system for responding to an unauthorized action on a mobile communications device, a cryptographic key is destroyed. The destruction of the cryptographic key is followed by initiating a boot sequence at the mobile communications device where the device is booted into a kernel that restricts operation of the mobile communications device to communications with a server. 1. A method comprising:determining, by an autonomous security component of a mobile communications device, that the mobile communications device is in a first state, the first state being an indication that an unauthorized action has been attempted on the mobile communications device, wherein the autonomous security component is preloaded on a system partition of an internal memory of a mobile communications device where an operating system is stored, wherein the autonomous security component is configured to persist after a factory reset of the mobile communications device, and wherein the autonomous security component is separate from the operating system;in response to the determination that the mobile communications device is in the first state, initiating and causing, by the autonomous security component, a destruction of a cryptographic key of a bootloader from a key store on the mobile communications device;upon initiating and causing the destruction of the cryptographic key of the bootloader, initiating, by the autonomous security component, a boot sequence at the mobile communications device; andduring the boot sequence at the mobile communications device after the destruction of the cryptographic key, booting the mobile communications device into a kernel that restricts operation of the mobile communications device so that the mobile communications device can only communicate with a single server:(i) to report at least one selected from the group of: a mobile communications device location, and mobile communications device contextual information; and(ii) to receive a re- ...

System and Method for Gaining Access of Devices Based on User's Identity

A system and a method for gaining access of devices based on a user's identity are disclosed. The method comprises a target device detecting a user worn accessory present in vicinity of a target device. Upon detection, the target device receives a user identity (UID) from the user worn accessory. The user worn accessory sends the UID based on verification of user's body data. Upon receiving the UID, the target device matches the UID with a list of known UID's to identify access rights assigned to the target device. Based on the identified access rights, the target device provides access to the user. Thus, the user may automatically get an access without handling the target device.

PREVENTING AN INCORRECT TRANSMISSION OF A COPY OF A RECORD OF DATA TO A DISTRIBUTED LEDGER SYSTEM

An incorrect transmission, of a record of data to a distributed ledger system, can be prevented. A first signal can be received. The first signal can include a first instruction to cause the record to be transmitted to the system. One or more items of information in the record can be determined. A delay of time to be elapsed, before a transmission of the record to the system, can be set in response to a receipt of the first signal and a determination of the one or more items. The transmission of the record to the system can be caused to occur after the delay has elapsed. The transmission of the record to the system can be prevented in response to a receipt of a second signal before the delay has elapsed. The second signal can include a second instruction that supersedes the first instruction. 1. A method for preventing an incorrect transmission of a copy of a record of data to a distributed ledger system , the method comprising:receiving, by a processor, a first signal, wherein the first signal includes a first instruction to cause the copy of the record of data to be transmitted to the distributed ledger system;determining, by the processor, at least one item of information in the record of data;setting, by the processor and in response to a receipt of the first signal and a determination of the at least one item of information, a delay of time to be elapsed before a transmission of the copy of the record of data to the distributed ledger system;causing, by the processor and after the delay of time has elapsed, the transmission of the copy of the record of data to the distributed ledger system; andpreventing, by the processor and in response to a receipt of a second signal before the delay of time has elapsed, the transmission of the copy of the record of data to the distributed ledger system, wherein the second signal includes a second instruction that supersedes the first instruction.2. The method of claim 1 , wherein the record of data is to be included claim 1 ...

WEARABLE DEVICE-BASED IDENTITY AUTHENTICATION METHOD AND SYSTEM

A wearable device-based identity authentication method and system, comprising: a user terminal initiates an authentication request to a target server and provides device information of the user terminal, the target server generates a temporary session, and sends a temporary session ID and the device information to a quantum key distribution network; the quantum key distribution network generates identification information, searches a wearable device bound to the user terminal, and sends the identification information to the wearable device; the wearable device receives and provides the identification information to the user terminal, the user terminal acquires the identification information, and sends verification information to the wearable device and then to the quantum key distribution network; the quantum key distribution network generates an authentication result and sends to the target server; and the target server generates an identification authentication result and sends to the user terminal. 1. An identity authentication method based on a wearable device , comprising the steps of:{'b': '1', 'S: initiating an authentication request and providing device information of a user terminal, by the user terminal, to a target server; and receiving, by the target server, the authentication request to generate a temporary session, and transmitting, by the target server, a temporary session ID and the device information to a quantum key distribution network;'}{'b': '2', 'S: receiving, by the quantum key distribution network, the temporary session ID and the device information to generate identification information, searching for, by the quantum key distribution network, a wearable device bound to the user terminal, and transmitting, by the quantum key distribution network, the identification information to the wearable device;'}{'b': '3', 'S: receiving, by the wearable device, the identification information, and providing, by the wearable device, the identification ...

SYSTEM AND METHOD FOR STORING AND DISTRIBUTING CONSUMER INFORMATION

A computer implemented system for controlling access to data associated with an entity includes a data storage device having a protected memory region, and one or more processors, at least one of which is operable in the protected memory region. The one or more processors are configured for: storing a secret key associated with the entity in a portion of the protected memory region associated with the entity; upon receiving entity data, storing the entity data in the portion of the protected memory region associated with the entity; and upon receiving an access grant signal, generating a smart contract, the smart contract defining the entity data to be accessed and a recipient of the entity data to be accessed. 1. A computer implemented system for controlling access to data associated with an entity , the system comprising:a data storage device having a protected memory region; storing a secret key associated with the entity in a portion of the protected memory region associated with the entity;', 'upon receiving entity data associated with the entity, storing the entity data in the portion of the protected memory region associated with the entity; and', 'upon receiving an access grant signal, generating a smart contract, the smart contract defining the entity data to be accessed and a recipient of the entity data to be accessed, the smart contract configured to trigger a message for communicating information associated with the entity data to a recipient device upon satisfaction of at least one verification condition., 'one or more processors, at least one of which is operable in the protected memory region and configured for2. The system of claim 1 , wherein the system comprises a trusted execution environment including the protected memory region claim 1 , the protected memory region inaccessible to the one or more processors when operating outside the trusted execution environment; wherein at least one processor configured to operating inside the trusted ...

SYSTEMS AND METHODS FOR SECURELY PAIRING A TRANSMITING DEVICE WITH A RECEIVING DEVICE

Systems and methods for securely pairing a transmitting device with a receiving device are described. The systems and methods may communicate with a first device via a first communication method over a wireless communication network. The systems and methods may transmit, to the first device via a second communication method, a first sensory pattern representing a first key. In addition, the system and methods may communicate with the first device via the first communication method using the first key. 120-. (canceled)21. A system for secure communication between a transmitting device and a receiving device comprising:one or more memory devices storing instructions; and determining that a pairing configuration has changed;', 'in response to the determination, transmitting, from the transmitting device to the receiving device via a second communication method, a sensory pattern representing a first key, wherein the first key is encoded based on a ciphering scheme specified by the pairing configuration;', 'receiving messages from the receiving device via a first communication method different from the second communication method; and', 'decrypting messages received from the receiving device using the first key or a second key corresponding to the first key., 'one or more processors configured to execute the instructions to perform operations comprising22. The system of claim 21 , wherein the determination is based on a change in one or more parameters of the pairing configuration.23. The system of claim 22 , where the one or more parameters comprises at least one of the first communication method claim 22 , the second communication method claim 22 , the ciphering claim 22 , and the first key.24. The system of claim 21 , the operations further comprise acquiring claim 21 , from the pairing configuration claim 21 , at least one of the first communication method claim 21 , or the second communication method.25. The system of claim 21 , wherein the first communication ...

Credential authentication methods and systems

Methods and systems are provided for performing and verifying transactions involving authentication with a secure credential, such as a smart card, in an untrusted or semi-trusted environment. An application module, operating in an untrusted or semi-trusted environment can be denied access to sensitive data. The application module can determine a preliminary command to be sent to the credential and transmit the preliminary command to a broker module. The broker module, operating in a trusted environment, can supply sensitive data and transmit the command to the credential. Subsequently, the broker module can extract sensitive data from a response before it is transmitted to the application module. A verification server can audit the transaction to verify that it was carried out properly.

Secure Electronic Identification Device

In accordance with one embodiment of the present invention a secure electronic identification device (SEID) is presented. The SEOD includes a display mode for displaying government furnished information, a display mode for displaying user furnished information, and a public display mode for displaying public information. The SEID also includes a banking module with logic and resources for initiating financial transactions between the SEID and a payment gateway. The SEID includes a removable card having a magnetic strip and an EMV chip encodable by the SEID.

Method and system for automatically selecting an authentication domain

An image processing apparatus and method is provided. The image processing apparatus has one or more processors and a memory that stores instructions for execution by the one or more processors. Upon execution of the instructions, the image processing apparatus is configured receive, from a credential source, a credential having a domain identifier identifying an authentication domain and authentication data used to authenticate with authentication domain and parse at least a portion of the domain identifier to obtain information identifying the authentication domain with which to authenticate the credential. The image processing apparatus is automatically reconfigured to authenticate with the identified authentication domain when it is determined, based on the information identifying the authentication domain, that a currently configured authentication domain is different from the identified authentication domain and the authentication data of the received credential is transmitted to the reconfigured domain for domain authentication processing.

SYSTEMS AND METHODS FOR INITIALIZATION AND ACTIVATION OF SECURE ELEMENTS

Disclosed herein are secure transaction systems having secure elements that are initialized and activated independent from each other. The secure element is first initialized to make the secure element turn to a state in which the secure element can be packaged, sold within retail stores, and then injected with encryption keys. The initialization process of the secure element formulates the secure element to ensure trust between the secure elements and secure element activation servers. The process of independently initializing and activating the secure elements while still addressing the security protocols allows the secure element to be packaged and sold within retail stores after initialization, and then activating the secure element at a later date and time when the secure element is ready to be used by a merchant. 1. A method for initialization and activation of a secure element for use in a terminal device , the method comprising:generating, by at least one service provider server, a set of encryption keys associated with the secure element;transmitting, by the at least one service provider server, the set of encryption keys associated with the secure element to a key injection facility server;receiving, by the at least one service provider server, a service provider certificate generated by a certification authority server;transmitting, by the at least one service provider server, the service provider certificate to the key injection facility server, whereby the key injection facility server stores the set of encryption keys, one or more attributes associated with the secure element, and the service provider certificate into a memory of the secure element;authenticating, by the at least one service provider server, an identity of the secure element based on one or more parameters of the service provider certificate;generating, by the at least one service provider server, a session with the secure element based on mutual authentication with the secure element ...

SECURING USER CREDENTIALS

A password is secured using a first key. At least one of a password record, a username record, and as domain name record is created. The at least one password record, username record, and domain name record are associated. The associated records are encrypted using a second key, where the second key is different from the first key. A credentials record is created based on the encrypted associated records.

TRUSTED TERMINAL PLATFORM

A point-of-sale (POS) terminal is provided for entering a PIN to enable a financial transaction. The point-of-sale terminal has a card reader for reading information from a credit card, a processor for running an operating system, with applications, a touch screen for displaying information and receiving user inputs, and a Security-Box connected between the touch screen and the processor to control the user input on the touch screen to the processor. The Security Box is configured to run in a “PIN Entry Mode” and a “Clear Text Mode.” When running in “PIN Entry Mode” the user input is not forwarded as touch coordinates to the processor and when running in “Clear Text Mode” the touch coordinates are transmitted to the processors. 1. A User-terminal for entering secure user information , comprising:a processor configured for running an operating system with applications;a touch screen configured for displaying information and receiving user inputs and to receive the secure user information from the user;a Security-Box being connected between the touch screen and the processor and configured to control the user input on the touch screen to the processor, the Security-Box being configured to run in a “Secure Mode” and a “Clear Text Mode”, wherein when running in “Secure Mode” the user input is not forwarded as touch coordinates to the processor and when running in “Clear Text Mode” the touch coordinates are transmitted to the processors;wherein the user-terminal is configured to run at least first and second applications displaying information on the touch screen and allowing an interaction with the user, the first application interacting with the Security-Box to perform security relevant financial transactions;and the second application interacting in “Clear Text Mode” with the touch screen, andwherein the first application interacting with the Security-Box is configured for switching the Security-Box into “Secure Mode” and needs to be authenticated with the Security ...

CONFIGURABLE UICC INTEGRATED IN NB-IOT DEVICE

A method to configure a virtual integrated universal integrated circuit card (UICC) that is integrated in a narrowband Internet-of-Things (NB-IoT) host device of a telecommunications network. One or more network nodes can configure one or more authentication and encryption functions for the UICC based on a capability of the NB-IoT device and a condition of the 5G network. The network node(s) can detect a change in a condition of the network or the capability of the NB-IoT device and, in response, reconfigure the UICC for one or more second authentication and encryption functions. 1. A method performed by one or more network nodes to configure a virtual integrated universal integrated circuit card (UICC) integrated in a narrowband Internet-of-Things (NB-IoT) device of a 5G network , the method comprising:maintaining a device profile that indicates a capability and a communications service of the NB-IoT device; 'wherein the first authentication and encryption functions support the communications service based on the capability of the NB-IoT device and a condition of the 5G network;', 'determining one or more first authentication and encryption functions for the UICC,'}configuring the UICC to allocate the first authentication and encryption functions for the NB-IoT device;detecting a change in the condition of the 5G network, the capability of the NB-IoT device, or the communications service; 'wherein the second authentication and encryption functions are determined to support the communications service based on the changed condition of the 5G network, the changed capability of the NB-IoT device, or the changed communications service of the NB-IoT device; and', 'in response to the detected change, determining one or more second authentication and encryption functions for the UICC,'}causing dynamic reconfiguration of the UICC to support the second authentication and encryption functions for the NB-IoT device.2. The method of further comprising claim 1 , prior to ...

PROTECTION DEVICE AND DONGLE AND METHOD FOR USING THE SAME

Methods and systems for suspending a physical protection of an object by a protection device. A host device receives a first and second public key, a third public key and a signed combined identifier incorporating the first and second public keys. The host device authenticates the first and second public keys using a signature of the signed identifier and authenticates the protection device. The host device sends an unlock request to the dongle. 1. A system for physically protecting an object comprising:a protection device having a controllable actuator for engaging and releasing physical protection of an object, anda dongle associated with the protection device,the protection device comprises an internal memory and a first data connection interface, and the internal memory of the protection device stores at least a first private key,the dongle comprises an internal memory, a second data connection interface compatible with the first data connection interface of the protection device, and a third data connection interface, and the internal memory of the dongle stores at least a second private key, a third public key, and a signed combined identifier,wherein the signed combined identifier incorporates at least a first public key, which is cryptographically associated with the first private key, and a second public key, which is cryptographically associated with the second private key, andwherein the signed combined identifier comprises a signature from a third private key, which third private key is cryptographically associated with the third public key.2. The system according to claim 1 , wherein the internal memory of the dongle further stores a contract script.3. The system according to claim 2 , wherein the internal memory of the protection device further stores a signature of a contract script signed with the second private key.4. The system according to claim 2 , wherein the internal memory of the dongle further stores a signature of the contract script signed ...

SYSTEM AND METHOD FOR HIGH PERFORMANCE SECURE ACCESS TO A TRUSTED PLATFORM MODULE ON A HARDWARE VIRTUALIZATION PLATFORM

A system and method for high performance secure access to a trusted platform module on a hardware virtualization platform. The virtualization platform including Virtual Machine Monitor (VMM) managed components coupled to the VMM. One of the VMM managed components is a TPM (Trusted Platform Module). The virtualization platform also includes a plurality of Virtual Machines (VMs). Each of the virtual machines includes a guest Operating System (OS), a TPM device driver (TDD), and at least one security application. The VMM creates an intra-partition in memory for each TDD such that other code and information at a same or higher privilege level in the VM cannot access the memory contents of the TDD. The VMM also maps access only from the TDD to a TPM register space specifically designated for the VM requesting access. Contents of the TPM requested by the TDD are stored in an exclusively VMM-managed protected page table that provides hardware-based memory isolation for the TDD. 1Virtual Machine Monitor (VMM) managed components coupled to a VMM, wherein one of the VMM managed components comprises a Trusted Platform Module (TPM); anda plurality of Virtual Machines (VMs), each of the virtual machines including a guest operating system (OS), a TPM device driver (TDD), and at least one security application,wherein the VMM to create an intra-partition in memory for the TDD such that other code and information at a same or higher privilege level within the VM cannot access the memory contents of the TDD and to map accesses from only the TDD to a TPM register space specifically designated for the VM requesting access.. A virtual platform comprising: This application is a continuation of U.S. application Ser. No. 14/510,534, entitled “System and Method for High Performance Secure Access to a Trusted Platform Module on a Hardware Virtualization Platform,” which was filed on Oct. 9, 2014, and which is a divisional application of U.S. application Ser. No. 13/305,902, entitled “System ...

Distributed management system for security of remote assets

A Distributed management system for security of remote assets which provides security for widely distributed assets while at the same time providing great flexibility for a multiplicity of authorized persons without passcodes or personal keys to access multiple assets. The system has great flexibility by separating the lock and Key function and provides complete history of Key-Lock operations of the asset in real time scenario. The system gives a comprehensive solution to the static or mobile asset located at remote location to the owner.

CLOCK SYNCHRONIZATION

In an example embodiment disclosed herein, a first clock is allowed to synchronize with a second clock as long as the time difference between the first and second clocks is less than a predefined limit. If the time difference between the clocks is not less than the predefined limit, the first clock does not synchronize with the second clock until a predefined activity has occurred. 1. A method , comprising:determining a time difference between the first clock and the second clock; andpreventing the first clock from synchronizing with the second clock responsive to the time difference between the first clock and the second clock is greater than a predetermined limit until a predefined event has been detected; receiving a user authentication from a predetermined user via a first user interface,', 'providing access to a second interface that is inside a housing responsive to the predefined user authenticating via the first user interface,', 'receiving an input via the second user interface to enter a predefined mode that allows synchronizing of the first clock with the second clock, and', 'synchronizing the first clock with the second clock responsive to entering the predefined mode., 'wherein the predefined event comprises2. The method set forth in claim 1 , wherein receiving the user authentication comprises receiving user authentication data via a token.3. The method set forth in claim 1 ,wherein the user interface comprises a keypad; andwherein receiving the user authentication comprises receiving a predefined code via the keypad.4. The method set forth in claim 1 ,wherein the user interface comprises a touch screen; andwherein receiving the user authentication comprises receiving a predefined code via the touch screen.5. The method set forth in claim 1 , further comprising:determining a second time difference between a first clock and a second clock at a second time;synchronizing the first clock with the second clock responsive to determining the second time ...

Method for Using Cryptography and Authentication Methods and Systems for Carrying Out Said Method

The invention relates to a method to initiate the use of cryptography and authentication methods and to perform these methods. The method comprises the steps of: generating a URI (), calling () a communication component () using the generated URI and a proprietory URI scheme; performing () the cryptography and authentication method by the local communication component (); generating () at least one result () by the communication component (). 1. A method of using cryptography and authentication methods comprising:generating a URI;calling a communication component using the generated URI and a proprietory URI scheme;performing one of the cryptography or the authentication method by the communications component; andgenerating at least one result by the communication component.2. The method according to claim 1 , further comprising:registering the proprietory URI scheme for calling the communication component.3. The method according to claim 1 , further comprising:access to a security device by the communication component.4. The method according to claim 1 , further comprising:polling an identifier by the communication component prior to performing the cryptography and authentication method.5. The method according to claim 1 , further comprising:generating the URI on the external computer and transferring the URI from the external computer to the local application prior to calling the communications component.6. The method according to claim 1 , further comprising:forwarding the generated result to the local application or to an external computer.7. The method according to claim 1 , further comprising:processing the generated result by the management application on the external computer.8. The method according claim 1 , wherein the result of the communication component is a signature over data or is encrypted or decrypted data.9. A local unit comprising:a processor having a local application and a local communication component which registers a URI scheme;a network ...

VEHICLE ACCESS SYSTEMS AND METHODS

Systems, devices, and methods for controlling access to vehicles in rental, loaner, shared-use, and other vehicle fleets. Some of the present systems, devices, and methods use encrypted virtual keys that can be relayed to a vehicle computing device via a user's mobile device. Such virtual keys can be command-specific such that successful use of a virtual key results execution of a predetermined command or group of commands, and further commands require one or more additional virtual keys with the additional commands. Others of the present systems, devices, and methods provide tools: for provisioning or initial pairing of vehicle computing devices with corresponding vehicles, identifying and permitting a user to select locally available vehicles, prompting vehicle computing devices to retrieve pending commands from a server, and/or various other functions described in this disclosure. 124-. (canceled)25. A system comprising: a memory storing one or more instructions; and', responsive to a request received from a mobile computing device, access an encryption key for a first vehicle;', 'generate an encrypted portion of a virtual key based on the accessed encryption key, the encrypted portion of the virtual key comprising a command for an action to be initiated by a device corresponding to the first vehicle; and', 'initiate transmission of the virtual key to the mobile computing device., 'a processor coupled to the memory and configured to execute the one or more instructions to cause the processor to], 'a server comprising This application is a continuation of U.S. application Ser. No. 15/083,369, filed Mar. 29, 2016, which claims priority to U.S. Provisional Patent Application No. 62/252,778 filed Nov. 9, 2015, the contents of each of which are incorporated herein by reference in their entirety.The present invention relates generally to vehicle rental and vehicle sharing and more particularly, but not by way of limitation, to systems and methods for controlling access ...

VEHICLE ACCESS SYSTEMS AND METHODS

Systems, devices, and methods for controlling access to vehicles in rental, loaner, shared-use, and other vehicle fleets. Some of the present systems, devices, and methods use encrypted virtual keys that can be relayed to a vehicle computing device via a user's mobile device. Such virtual keys can be command-specific such that successful use of a virtual key results execution of a predetermined command or group of commands, and further commands require one or more additional virtual keys with the additional commands. Others of the present systems, devices, and methods provide tools: for provisioning or initial pairing of vehicle computing devices with corresponding vehicles, identifying and permitting a user to select locally available vehicles, prompting vehicle computing devices to retrieve pending commands from a server, and/or various other functions described in this disclosure. 123-. (canceled)24. A system comprising: a memory storing one or more instructions; and', receive, from each transportation device of one or more transportation devices, state information of the corresponding transportation device;', 'receive a selection input indicating a first transportation device of the one or more transportation devices; and', 'initiate an indication of the selection input to a server associated with a management system corresponding to the one or more transportation vehicles., 'a processor coupled to the memory and configured to execute the one or more instructions to cause the processor to], 'a mobile computing device comprising This application is a continuation of U.S. application Ser. No. 15/083,377, filed Mar. 29, 2016, which claims priority to U.S. Provisional Patent Application No. 62/252,778 filed Nov. 9, 2015, the contents of each of which are incorporated herein by reference in their entirety.The present invention relates generally to vehicle rental and vehicle sharing and more particularly, but not by way of limitation, to systems and methods for ...

Vehicle access systems and methods

Systems, devices, and methods for controlling access to vehicles in rental, loaner, shared-use, and other vehicle fleets. Some of the present systems, devices, and methods use encrypted virtual keys that can be relayed to a vehicle computing device via a user's mobile device. Such virtual keys can be command-specific such that successful use of a virtual key results execution of a predetermined command or group of commands, and further commands require one or more additional virtual keys with the additional commands. Others of the present systems, devices, and methods provide tools: for provisioning or initial pairing of vehicle computing devices with corresponding vehicles, identifying and permitting a user to select locally available vehicles, prompting vehicle computing devices to retrieve pending commands from a server, and/or various other functions described in this disclosure.

CENTRALIZED VOLUME ENCRYPTION KEY MANAGEMENT FOR EDGE DEVICES WITH TRUSTED PLATFORM MODULES

The present disclosure relates to centralized volume encryption key management for edge devices with trusted platform modules (TPM)s. In some aspects a volume encryption key is generated for a gateway device. A sealing authorization policy is also generated for the gateway device. The sealing authorization policy is generated based on a predetermined platform configuration register (PCR) mask and expected PCR values. The volume encryption key and the sealing authorization policy are transmitted from the management service to the gateway device to provision the gateway device with the volume encryption key. 1. A system , comprising:at least one computing device; and generate, by a management service, a volume encryption key for a gateway device;', 'generate, by the management service, a sealing authorization policy based on a predetermined platform configuration register (PCR) mask and expected PCR values; and', 'transmit, from the management service to the gateway device, a command to seal the volume encryption key in a non-volatile memory of a trusted platform module (TPM) of the gateway device based on the predetermined PCR mask and the expected PCR values., 'at least one data store comprising instructions executable in the at least one computing device, wherein the instructions, when executed by at least one processor, cause the at least one computing device to at least2. The system of claim 1 , wherein the instructions claim 1 , when executed by the at least one processor claim 1 , cause the at least one computing device to at least:unseal, by extractor code of the gateway device, the volume encryption key, the volume encryption key being unsealed based on the predetermined PCR mask and measured PCR values that are measured during a boot process of the gateway device.3. The system of claim 2 , wherein the instructions claim 2 , when executed by the at least one processor claim 2 , cause the at least one computing device to at least:load, by the extractor code of ...