Abstract: The disclosure is generally directed to a method and apparatus for encrypting and decrypting data on an integrated circuit. In various implementations, the apparatus includes an on-chip high performance bus bridge that transparently encrypts and decrypts data between the embedded microprocessor(s) and off-chip system memory. In some implementations, the apparatus is optimized to the transactions generated by the processor's cache controller (e.g., optimized for cache line size) and optimized to the bus protocol being used. This provides code protection with minimal effect on system performance latency and throughput. The implementation of multiple cryptographic engines allows for encryption of a complete cache line while incurring only a single latency for the first cipher rounds to be completed.

Abstract: A toggle electrode disposed on the bottom end of a battery assembly. The toggle electrode includes a rotating shaft and a toggle. The battery assembly includes a negative terminal of an input end soldered on the rotating shaft and a battery. The rotating shaft is connected to the toggle. The toggle is rotatable around the battery to contact or not contact the negative terminal of the battery. When the toggle is not in contact with the negative terminal of the battery, the battery is removable for replacement. The toggle is in contact with the negative terminal of the battery for electric conduction.

Abstract: A device in a multicast group includes an encryptor/decryptor, a key storage, a security interface and a data processing requestor. The security interface performs receiving and storing a group key and a publisher key from and in the key storage when the device is registered as a publisher, and receiving and storing the group key from and in the key issuing when the device is registered as a subscriber; receiving a request for encrypting first data from the data processing requestor; determining whether the device is an authorized publisher; and transmitting the first data and the read group key to the encryptor/decryptor when the result of the determining indicates the device is the authorized publisher; receiving a first encrypted data generated by encrypting the first data using the group key; and transmitting the first encrypted data to the data processing requestor.

Abstract: Aspects of the disclosure relate to validation of a request for an asset based on information in the request. Validation of the request can be processed by a network node in a network repository that contains the asset. In one aspect, validation of the request can comprise determining if the request is legitimate based at least on processing at least a portion of the information in the request. In response to a legitimate request, the network node can process the request and, as a result, a data object associated with the asset can be supplied to a device originating the request. In the alternative, the network node can yield an exception.

Abstract: A communication system includes: a plurality of devices that are provided inside a firewall; at least one gateway that is provided inside the firewall, and relays communication between the plurality of devices and at least one cloud server provided outside the firewall; and a platform server that is provided outside the firewall, receives at least one access request with respect to at least one communication target device in the plurality of devices, and transmits a message to a gateway corresponding to the at least one communication target device designated in the at least one access request, through a communication route for message transmission selected from a plurality of types of communication routes, wherein each of the plurality of types of communication routes is a route passing through the firewall, and the platform server selects the communication route for message transmission relevant to the at least one communication target device.

Abstract: A packet network includes packet engines that perform packet handling. Cipher engines are provided separately from the packet engines for encryption and/or authentication operations. To preserve relative timing and ordering of data packets, a packet engine performs pre-shaping of data traffic, wherein the packet engine inserts dummy packets into a data flow. The packet engine provides the pre-shaped data traffic to a cipher engine.

Abstract: A path for a node of a computing environment is secured. The securing includes obtaining, by the node, a message that includes an identifier of a shared key and an encrypted message, the encrypted message including a first encryption key, a second encryption key, one or more first parameters and one or more second parameters. The node obtains the shared key from a key server and uses it to decrypt the encrypted message to obtain the first encryption key, the second encryption key, the one or more first parameters and the one or more second parameters. A second security parameters index, to be associated with the second encryption key and the one or more second parameters, is obtained. The node sends a response message to another node, the response message including the second security parameters index.

Abstract: A network processor provides for in-line encryption and decryption of received and transmitted packets. For packet transmittal, a processor core generates packet data for encryption and forwards an encryption instruction to a cryptographic unit. The cryptographic unit generates an encrypted packet, and enqueues a send descriptor to a network interface controller, which, in turn, constructs and transmits an outgoing packet. For received encrypted packets, the network interface controller communicates with the cryptographic unit to decrypt the packet prior to enqueuing work to the processor core, thereby providing the processor core with a decrypted packet.

Abstract: Parties communicate input values to a central entity by first decomposing them according to a chosen operation into share values, which are sent either directly or, in a transformed form such as being hashed and/or encrypted, via a bulletin board data structure, to respective nodes, such that no node receives the input value itself. The nodes then combine the share values using the operation and pass these respective node values to the central entity for computation of a global value. The operation of the parties and of the nodes may be made verifiable by aggregating the share values within a party or the received share values within a node using a data and computational structure such as a hash tree or skip list. Digital signing and timestamping may also be applied.

Abstract: This disclosure relates to blockchain-based transaction verification. Some aspects include receiving, by a blockchain system, transaction data to be verified. The transaction data includes plaintext transaction information and at least one piece of verifier signature data. The plaintext transaction information includes a designated-verifier information set that identifies verifiers that have been designated to verify the plaintext transaction information and that includes, for each of one or more verifiers, a piece of designated-verifier information. Each piece of signature data includes a digital signature generated by one of the verifiers. The blockchain system obtains an authenticated information set by verifying each digital signature. The authenticated information set includes the piece of designated-verifier information for each verifier for which the digital signature is successfully verified.

Abstract: The present invention relates to a method for electronic signing of a document with a predetermined secret key (x), the method being characterized in that it comprises the implementation of steps of: (a) Drawing a pair formed by a first internal state (s1i) and a white-box implementation (WBi) of a modular arithmetic operation, from among a set of predetermined pairs ({(s1i,WBi)}i?[0,n-1]) each for one nonce (ki), said first internal state (s1i) being a function of the nonce (ki) and said modular arithmetic operation being a function of the first internal state (s1i), of the nonce (ki) and of the secret key (x); (b) Determining a second internal state (s2i) by application of said drawn white-box implementation (WBi) to a condensate of the document obtained via a given hash function; (c) Generating an electronic signature of the document from the first internal state (s1i) of the drawn pair and from the second determined internal state (s2i), and deleting the drawn pair of said set of pairs ({(s1i,WBi)}i?[0

Abstract: Techniques for securely sealing and unsealing enclave data across platforms are presented. Enclave data from a source enclave hosted on a first computer may be securely sealed to a sealing enclave on a second computer, and may further be securely unsealed for a destination enclave on a third computer. Securely transferring an enclave workload from one computer to another is disclosed.

Abstract: This application relates to techniques for anonymously establishing a secure communication session with a wireless client. A described method, performed by an anonymous wireless host, includes advertising a service implemented by the anonymous wireless host as available over a wireless network, receiving an invitation to establish the secure communication session with the wireless client, transmitting an acceptance of the invitation to the wireless client, and establishing the secure communication session over a communication channel. The invitation is received from the wireless client and the acceptance is transmitted to the wireless client via a broadcast address or a multicast address associated with the wireless network. The secure communication session is used to exchange encrypted data between the service and the wireless client.

Abstract: Many-to-many cryptographic systems and methods are disclosed, including numerous industry applications. Embodiments of the present invention can generate and regenerate the same symmetric key from a random token. The many-to-many cryptographic systems and methods include two or more cryptographic modules being in communication with each other and may be located at different physical locations. The cryptographic modules are configured to encrypt and/or decrypt data received from other cryptographic modules and to provide encrypted and/or decrypted data to other cryptographic modules. Each cryptographic module includes a key generator configured to use two or more inputs to reproducibly generate the symmetric key and a cryptographic engine configured to use the symmetric key for encrypting and decrypting data. Corresponding methods are also provided.

Abstract: A system and method is provided for encrypting data for secure storage or transport. The method includes generating object-based wave screen(s) and optionally stumbling block(s) and/or XOR block(s) associated with a block map layout. For each data segment to be encrypted, the method includes positioning the bits of the data segment within the block map layout to generate a data map, and encrypting the data map by applying the object-based wave screen(s) and optionally the stumbling block(s) and/or XOR block(s) to remap the positions of the bits within the block map layout. The encrypted data map is then stored or transported as a representation of the data segment.

Abstract: Systems and methods for controlling a barrier are disclosed in which a barrier control component running on a server receives a first key and a request from a user device to provide a second key and a set of abilities to a second user device. The barrier control component retrieves information associated with first key, with the information indicating whether or not the first key is authorized to provide the second key and the set of abilities to the second device. When a review of the information regarding the first key indicates that the first key is appropriately authorized, the barrier control component provides the second key to the second device, and stores the set of abilities associated with the second key.

Abstract: Some embodiments provide, for a particular device in a set of related devices, a method for backing up data synchronized between the set of related devices. The method stores the backup data encrypted with a set of data encryption keys. The method also stores the set of data encryption keys encrypted with a master recovery key. The method also stores several copies of master recovery key data, each copy of the master recovery key data encrypted with a public key of a different one of the related devices. The backup data is only recoverable by accessing a private key of any one of the related devices.

Abstract: A decoding method for low-density parity-check (LDPC) code is provided and is configured to decode a communication protocol, which is pending to be tested. The communication protocol includes a code word, and the code word includes a code rate. The decoding method includes: receiving the code word of the communication protocol, which is pending to be tested; determining a parity-check matrix according to the code rate of the code word and saving the parity-check matrix in a dynamic memory; moving the parity-check matrix from the dynamic memory to a first memory and saving the code word in a second memory; sequentially transmitting the code word from the second memory to a plurality of check node units to calculate according to the parity-check matrix in the first memory; transmitting the code word verified by the check node units back to the second memory.

Abstract: Grouping virtualized computing instances in cloud environments can be achieved utilizing groups of network endpoints, such as hardware devices, virtualized computing instances, etc. The network endpoint group (NEG) provides a logical grouping for providers of backend services that may be arranged on the network endpoints, and may be organized based on the backend service to be provided by the computing environments that operate as network endpoints. For example, the NEGs may be implemented for load balancing applications. The network endpoint groups, and the network endpoints included therein, may be managed using a framework of tools, libraries and application programming interfaces.

Abstract: A processor device has an executable implementation of a cryptographic algorithm implemented thereon, which algorithm is adapted to produce an output text from an input text employing a secret key K. The implementation of the algorithm comprises a key-dependent computing step S which comprises a key combination of input values x derived directly or indirectly from the input text with key values SubK derived directly or indirectly from the key; the key-dependent computing step S is represented by a table which is masked with input masking and/or output masking to form a masked table TabSSubK; and a new masked table TabSKneu is generated in the processor device.

Abstract: Many-to-many cryptographic systems and methods are disclosed, including numerous industry applications. Embodiments of the present invention can generate and regenerate the same symmetric key from a random token. The many-to-many cryptographic systems and methods include two or more cryptographic modules being in communication with each other and may be located at different physical locations. The cryptographic modules are configured to encrypt and/or decrypt data received from other cryptographic modules and to provide encrypted and/or decrypted data to other cryptographic modules. Each cryptographic module includes a key generator configured to use two or more inputs to reproducibly generate the symmetric key and a cryptographic engine configured to use the symmetric key for encrypting and decrypting data. Corresponding methods are also provided.

Abstract: A transmitter encodes information with randomly flipped bits. A cipher key that includes for each letter of an alphabet a unique string of binary bits of length N and a total amount of bits M to be randomly flipped where M<N are stored using a secure memory. An information message that includes a series of one or more letters is received using a transmitter. The cipher key is read from the secure memory and at least one letter of the series is converted to a corresponding unique string of binary bits of length N. The total amount of bits M to flip are read from the secure memory, the M bits of the unique string are randomly selected, and the M bits are flipped to the opposite binary value. The string with M flipped bits is transmitted through a communications channel.

Abstract: A storage integration object is created in a database of a data warehouse system. The storage integration object identifies a storage location in a storage platform of a cloud storage provider system and a cloud identity object maintained by a network-based data warehouse system. The cloud identity object is associated, at the storage platform of the cloud storage provider, with a proxy identity object granted permission to access the storage location. An external stage object is created based on the storage integration object. The external stage object identifies the storage location and includes an association with the storage integration object. A command to load or unload data at the storage location is received. In response to the command, the data is loaded or unloaded, via the proxy identity object, at the storage location using the external stage object.

Abstract: One-to-many cryptographic systems and methods are disclosed, including numerous industry applications. Embodiments of the present invention can generate and regenerate the same symmetric key from a random token. The one-to-many cryptographic systems and methods include a cryptographic module being in communication with one or more remote locations. The cryptographic module is configured to encrypt data received from the remote locations and to decrypt data for receipt by the remote locations. The cryptographic module includes a key generator configured to use two or more inputs to reproducibly generate the symmetric key and a cryptographic engine configured to use the symmetric key for encrypting and decrypting data. Corresponding methods are also provided.

Abstract: A circuit arrangement includes an encryption circuit and a decryption circuit. A cryptographic shell circuit has a transmit channel and a receive channel in parallel with the transmit channel. The transmit channel includes an encryption interface circuit coupled to the encryption circuit. The encryption interface circuit determines first cryptographic parameters based on data in a plaintext input packet and inputs the first cryptographic parameters and plaintext input packet to the encryption circuit. The receive channel includes a decryption interface circuit coupled to the decryption circuit. The decryption interface circuit determines second cryptographic parameters based on data in a ciphertext input packet and inputs the second cryptographic parameters and ciphertext input packet to the decryption circuit.

Abstract: Embodiments of the present application disclose an operation method. The method includes: obtaining, by the input/output interface, an input ciphertext; performing, by the decryption circuit, a modular exponentiation operation according to the ciphertext and a preset operation parameter; and using, by the microprocessor, an operation result obtained after the modular exponentiation operation as a plaintext obtained after decryption.

Abstract: Methods of securing a cryptographic device against implementation attacks are described. A disclosed method comprises the steps of: generating secret values (324) using a pseudorandom generator (510); providing a key (330), an input (324) having a number of chunks and the secret values to an encryption module (340); indexing the chunks and the secret values (324); processing the input chunk wise by encrypting the secret values (324) indexed by the chunks using the key (330) and the encryption module (340); generating for each chunk a pseudorandom output (330?) of the encryption module (340), providing the pseudorandom output as the key (330?) when processing the next chunk; and performing a final transformation on the last pseudorandom output (330?) from the previous step by using it as a key to encrypt a fixed plaintext.

Abstract: The present disclosure relates to a 5G or pre-5G communication system for supporting a higher data transfer rate beyond a 4G communication system such as LTD. A method of a terminal connected to another base station (BS) for a second communication system in a wireless environment, the method comprising receiving, via the another BS from a BS for the first communication system, a radio resource control (RRC) connection reconfiguration message comprising information regarding a first key, generating a secure key for a security of the first communication system based on the first key, an identifier (ID) for indicating an algorithm for applying to the first key, a distinguisher for indicating a function of the algorithm indicated by the ID, and transmitting, to the BS, a signal based on the generated secure key.

Abstract: Techniques for securely sealing and unsealing enclave data across platforms are presented. Enclave data from a source enclave hosted on a first computer may be securely sealed to a sealing enclave on a second computer, and may further be securely unsealed for a destination enclave on a third computer. Securely transferring an enclave workload from one computer to another is disclosed.

Abstract: The invention relates to a secured comparative processing method of the type in which a processor of an electronic component compares a set of proof data received by the processor as an input with main secret data stored in said electronic component, characterised in that the processor executes, in parallel with the comparison with the secret data, a series of complementary operations on the set of proof data which generate on the electronic component a variation in behaviour which is a function of the proof data which the component receives as an input and which is added to the variation in behaviour linked to the comparison with the main secret data, the series of complementary operations including a series of base operations repeated K times, and the execution of said series being preceded by an adjustment of execution parameters of said series, the parameters including: the identifier of the series of base operations to be executed, the series of base operations being comprised within a set of predefined

Abstract: An example method of cryptographically modifying an input data segment includes performing, in a first stage, a first bit substitution operation based on a first stage input segment and a first cryptographic key sequence. The method also includes performing, in a subsequent second stage, a bit dispersal based on a second stage input segment and a second cryptographic key sequence. The method also includes performing, in a subsequent third stage, a second bit substitution operation based on a third stage input segment and a third cryptographic key sequence. The first, second, and third stage input segments are all derived from the input data segment.

Abstract: A network protocol is provided to identify and authenticate devices from different vendors that are deployed in a network. Each vendor is provided a vendor key unique to the vendor by a network management server. A vendor server associated with the vendor provisions a device with a first hash value generated using the vendor key among other device attributes. When the device is deployed in the network, the network management server queries the device. The device generates a second hash value using the first hash value and sends it in a response to the network management server. The network management server computes a local hash value using the vendor key and the attributes received from the response. The network management server authenticates the device if the local hash value matches with the second hash value.

Abstract: A system and method are provided for certificate selection in infrastructures such as those planned to be used for V2V messaging, wherein the vehicle (or other moving object)'s location is used to aid in the selection of certificates. In one aspect, there is provided a method of selecting certificates for vehicle-to-vehicle messaging, the method comprising: determining a location for a vehicle; and adapting reuse of certificates in a certificate pool for the vehicle according to the location. In another aspect, there is provided a method of selecting certificates for vehicle-to-vehicle messaging, the method comprising: determining an amount of messaging activity; and adapting reuse of certificates in a certificate pool for the vehicle according to the amount of messaging activity.

Abstract: An image processing apparatus is provided. The image processing apparatus includes a storage configured to store an operating system (OS) of the image processing apparatus, a script file including a program code and a first electronic signature, and an interpreter program provided to execute the program code on the OS; and at least one processor configured to perform an authentication of the first electronic signature with the OS in response to the interpreter program executing the program code on the OS, and selectively permit or block the execution of the program code according to whether the first electronic signature passes or fails to pass the authentication.

Abstract: Systems and methods for generating and deploying integrated circuit (IC) applications are provided. Partial reconfiguration functionality of an IC may be used to build reconfigurable application platforms that enable application execution on the IC. These apps may include partial reconfiguration bitstreams that allow ease of access to programming without cumbersome compilation via a set of complex tools. The apps may be acquired via a purchasing website or other mechanism, where the bitstreams may be downloaded to the IC, thus increasing usability of the IC as well providing addition revenue streams.

Abstract: A mobile communication device causes a communication session to be established with a host server of a communication network. The mobile device performs communication operations in the communication session for activating a communication service, such as a data synchronization service, with the host server. In the communication session, the mobile device also receives configuration information which includes information for use in constructing a request message for obtaining a digital certificate from a certificate authority (CA). After receipt of the configuration information, the mobile device constructs the request message for the digital certificate and causes it to be sent to the host server. In response, the host server requests and obtains the digital certificate from the CA on behalf of the mobile device, and thereafter “pushes” the received digital certificate to the mobile device. The mobile device receives the digital certificate and stores it for use in subsequent communications.

Abstract: Techniques are described for runtime checking of function metadata prior to execution of a function in an environment. An application may include any appropriate number of components at one or more levels in a hierarchical arrangement, and each component may be packaged with metadata that describes the component. A function, or any component, may be packaged with metadata that includes term(s) governing the usage of the function. The term(s) may be checked, at runtime, during execution of the application to determine whether the function is to be executed. A function may also be hashed at runtime for verification of function version. Function(s) may be individually and independently executed as containerized nano functions within the environment.

Abstract: Embodiments of the present disclosure include systems and methods for providing query service of secured contents. A data collection service collects data and security context associated with the data from a data source and stores the data with the security attributes in a datastore, where the security attributes are derived from the security context and used to determine access to the data so that access to the data is consistent with the security context. Upon receiving a query and a user context of a requester making the query of the datastore, a set of query results is obtained. Based on the user context and security attributes, it is determined whether the requestor has a proper right to access the query results. If the requestor has a proper right to access the query results, access to the query results is granted.

Abstract: A method and apparatus for issuing an incident-issued credential for an incident area network. One embodiment provides an identity server including an electronic processor configured to receive an agency-issued credential and retrieve a first set of attributes from the agency-issued credential. The electronic processor is also configured to map the first set of attributes to a scope of a service available through an incident area network. The electronic processor is further configured to generate the incident-issued credential for the incident area network including the scope and issue the incident-issued credential to a user device.

Abstract: In a client, an encryption key is created using plain text data, a first tag is created using the encryption key, and the plain text data are encrypted under the encryption key to create encrypted data. The first tag is transmitted to the server to confirm whether the encrypted data is duplicated and after transmitting the first tag, the encrypted data is transmitted to the server in accordance with the request of the encrypted data from the server.

Abstract: Network and device configuration systems and methods are described. In an embodiment, a first user interface configured to receive from a user configuration information regarding a first network provided. Program code stored in computer accessible memory is configured to generate a barcode that includes information related to the first network configuration information, wherein the barcode can be scanned by a device having a barcode scanner and a network interface to configure the network interface to access the first network.

Abstract: The disclosed computer-implemented method for handling fraudulent uses of brands may include (1) enabling a subscriber of a brand-protection service to select an action to perform when a fraudulent use of a brand is detected in Internet traffic that is transmitted via any of a plurality of Internet-traffic chokepoints that are managed by the brand-protection service, (2) monitoring, at each of the plurality of Internet-traffic chokepoints, Internet traffic for fraudulent uses of brands, (3) detecting, while monitoring the Internet traffic, the fraudulent use of the brand, and (4) performing the action in response to detecting the fraudulent use of the brand. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method for protecting application servers from network-based attacks and verifying the security posture of end client systems is disclosed. A trust broker system receives a request from a user agent associated with a client system remote from the trust broker to connect to applications and resources associated with the trust broker. The trust broker system verifies the integrity of the client system and verifies the identity of a user of the client system. The trust broker system then determines the access level permitted to the identified user and based on the access level. The trust broker system establishes a connection with the user agent and transmits session information to the server system. The trust broker system sends the user agent connection information, wherein the connection information enables the requesting user agent to connect to the requested server system.

Abstract: A computer-implemented method, the method includes identifying a piece of data to be served from a server system to a client device that is remote from the server system; creating a plurality of expressions that, when executed, provide a result that corresponds to the piece of data; and providing the plurality of expressions to the client device with code for executing the plurality of expressions.

Abstract: A data synchronization method, in a network element operating in a network, includes generating an event at the network element that needs to be synchronized with other devices in the network; based on assigned tokens for the network element, generating a row key for the event; and providing the row key to a Highly-Available (HA) key-value storage system for synchronization therewith, wherein the HA key-value storage system includes a plurality of nodes including the network element and the other devices.

Abstract: A system of replicating data stored on a source node. Replication can be configured between two controllers, the source node on the one hand, and a target node on the other. A synchronization relationship between the source node and the target node is established and maintained. The synchronization relationship can be quickly and easily created for disaster recovery, real-time backup and failover, thereby ensuring that data on the source node is fully-protected at an off-site location or on another server or VM, for example, at another data center, a different building or elsewhere in the cloud. Processes described herein streamline the entire replication setup process, thereby significantly reducing error rates in conventional systems and making the replication process more user friendly than in conventional systems.

Abstract: A computer-implemented method, the method includes identifying a piece of data to be served from a server system to a client device that is remote from the server system; creating a plurality of expressions that, when executed, provide a result that corresponds to the piece of data; and providing the plurality of expressions to the client device with code for executing the plurality of expressions.

Abstract: Technologies for one-touch device personalization include at least two mobile computing devices configured to communicate with a personalization server. The first mobile computing device tracks changes to device personalization data and backs up the personalization data to the personalization server. The personalization server associates the personalization data to authenticated user credentials. The personalization server may store the personalization data in an operating-system-independent format. Later, a second mobile computing device sends a request for personalization including those user credentials. After authenticating the user credentials, the personalization server sends the personalization data to the second mobile computing device, which installs the personalization data. Installing the personalization data establishes a configuration of the second mobile computing device corresponding to a previous configuration of the first mobile computing device.

Abstract: Techniques for handling ciphering keys in a mobile station comprising a mobile equipment (ME) and a Universal Subscriber Identity Module (USIM) are disclosed. An example method includes obtaining a UMTS cipher key (CK), integrity key (IK), and ciphering key sequence number (CKSN) from the USIM, deriving a 128-bit ciphering key (Kc-128) from the CK and the IK, and storing the Kc-128 and the CKSN on the mobile equipment, separate from the USIM. The stored CKSN is associated with the stored Kc-128, so that the Kc-128's correspondence to the most current UMTS security context can be tracked. This example method applies to the generation and storage of a 128-bit ciphering key for either the packet-switched or circuit-switched domains. A corresponding user equipment apparatus is also disclosed.

Abstract: An ASIC for implementing digital rights management includes a processor for requesting encrypted digital data from a server and decrypting the data, and a player for transforming the decrypted data to analog signals. Preferably, the ASIC is tamper-resistant. Preferably, all the management code of the ASIC is stored on a ROM in the ASIC. A device for receiving, decrypting and displaying encrypted digital data includes the ASIC, and also a transceiver for communicating with the server, a display mechanism for displaying the analog signals, and a nonvolatile memory for storing the encrypted data. A system for storing and displaying digital data includes both the server and the device. Preferably, the server is configured to send to the device only the encrypted digital data and associated decryption keys.