Abstract: A service provider receives a set of credentials from a customer and a request to access one or more services provided by the service provider. An authentication service of the service provider receives the set of credentials and, based at least in part on the received set of credentials, one or more activities performed by the customer, the customer's user profile, and the system configuration of the customer's computing device, calculates a risk score. The authentication service subsequently utilizes the calculated risk score to determine a credential rotation schedule for the set of credentials. The authentication service updates one or more servers to enforce the new credential rotation schedule and enables the customer to utilize the set of credentials to access the one or more services.

Abstract: A method includes encrypting a first message that contains a first public key of a first peer, by using a second public key of a second peer; and decrypting a second message sent from the second peer by using a first private key paired with the first public key. The second message includes a write command and is encrypted at the second peer by using the first public key, and contains an encrypted data encrypted by the second peer using the second public key and hashed by using a secret key of the first peer. The first public key, the second public key, the first private key and the secret key are physically unclonable function (PUF)-based keys.

Abstract: A system and method includes mobile device, a SIM associated with mobile device, an MNO computer, a computer associated with an owner of the mobile device, a first set of keys stored in the SIM for securely communicating with the MNO computer, and a second set of keys for securely communicating with the computer associated with the owner of the mobile device, to exchange application information. The SIM can be configured to determine when updated information related to the second set of keys is required, securely send a request to the MNO computer for updated information related to the second set of keys using the first set of keys, and responsively receive the updated information related to the second set of keys from the MNO computer, the updated information being provisioned by the computer associated with the owner of the mobile device.

Abstract: One embodiment of the present application sets forth a computer-implemented method for establishing trust for handles used to identify digital objects in a digital object architecture (DOA) by associating a first attester identifier with a first attester from a trusted public key infrastructure (PKI), identifying a first digital object public key for a first digital object, generating, by the first attester, a first digital object identity attestation that associates the first digital object public key with a handle identifier for the first digital object, wherein the handle identifier is external to the trusted PKI, and generating a first attester identity attestation attesting that the first attester is authentic, where the first attester identity attestation includes the first attester identifier.

Abstract: A system for generating unique digital certificates is provided that generates computed hashes public keys and compares them. The system method computes a hash of a public key, compares the computed hash of the public key with hashes of public keys previously generated, generates the digital certificate having the public key and a device identifier only if the computed hash of the public key does not match any of the hashes of public keys previously generated, and provides the digital certificate.

Abstract: Systems and method for generating and managing certificate authorities. For instance, a certificate service may provide one or more user interfaces for creating certificate authorities, such as a root certificate authority, a subordinate certificate authority, and/or an intermediate certificate authority. For example, a user may use a user device to create a certificate hierarchy. The certificate service may also provide one or more user interfaces for issuing certificates using the certificate authorities. One or more computing resources may then use the end-entity certificates issued from the certificate authority hierarchy for authentication and/or encryption. For security purposes, the certificate authority may also allow the user to set policies representing users that are able to access and/or utilize the certificate authorities to perform actions, such as issuing certificates.

Abstract: In some aspects, methods and systems for a digital trust architecture are provided. In some aspects, the architecture includes a user account provisioning process. The provisioning process may make use of in person verifications of some personal information to ensure authenticity of the user information. Once the authenticity of user information is established, an account may be created. The user account may include a user email account, with integrated access to digital certificates linked to the user account. Account creation may also automatically publish the new user's public key in a publicly accessible directory, enabling encrypted email information to be easily sent to the new user.

Abstract: A method including determining, by a first user device, a sharing encryption key based at least in part on a folder access private key associated with a folder and an assigned public key associated with a second user device; encrypting the folder access private key associated with the folder utilizing the sharing encryption key; and transmitting the encrypted folder access private key to enable the second user device to access the folder. Various other aspects are contemplated.

Abstract: Dynamic directory service object creation and certificate management can be performed. In response to discovering a device connected to a network, a corresponding directory service object can be automatically created, and a digital certificate can be automatically acquired and deployed on the device to facilitate authentication. Further, actions can be logged, and notifications generated based on logged actions. Time involved in deploying and configuring directory services is reduced, efficiency is improved, and there is less of a chance for errors associated with manual configuration.

Abstract: A system and method for signing and authenticating electronic documents using public key cryptography applied by one or more server computer clusters operated in a trustworthy manner, which may act in cooperation with trusted components controlled and operated by the signer. The system employs a presentation authority for presenting an unsigned copy of an electronic document to a signing party and a signature authority for controlling a process for affixing an electronic signature to the unsigned document to create a signed electronic document. The system provides an applet for a signing party's computer that communicates with the signature authority.

Abstract: A system, method, and computer-readable medium are disclosed for implementing a cybersecurity system having a digital certificate reputation system. At least one embodiment is directed to a computer-implemented method executing operations including receiving a communication having an internet protocol (IP) address and a digital certificate at a device within the secured network; determining whether the IP address is identified as having a high-security risk level; if the IP address has a high-security risk level, assigning a security risk level to the digital certificate based on the security risk level of the IP address; and using the security risk level for the digital certificate in executing the one or more security policies. Other embodiments include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices.

Abstract: A proxy revocation service provides a reliable service for performing revocation checks. The proxy revocation service queries public certificate authorities for the revocation status of a set of digital certificates and maintains a database of the revocation statuses. The proxy revocation service provides a singular endpoint that is Application Protocol Interface (API) accessible to web clients. Web clients communicate with the proxy revocation service through use of API message to perform revocation checks, rather than communicating with the public certificate authorities using an online certificate status protocol (OCSP). Use of the proxy revocation service provides both a reliable service for performing revocation checks as well as shifts the complexity away from the web clients.

Abstract: Introduced are systems and methods that enable modification of logs in multiple off-line databases. Multiple off-line devices can mistakenly associate different respondents with the same identification (ID) unique to the system. When the multiple off-line devices synchronize with each other, or synchronize with a server hosting the central database, the software running on the off-line devices, or on the server detects that the modified logs come from different respondents, and the software assigns two different IDs unique to system to the logs. In another embodiment, multiple off-line devices can mistakenly associate the same respondent with two different IDs unique to the system. When the multiple off-line devices synchronize with each other or with the server, the software running on the off-line devices, or the server detects that the modified logs come from the same respondent, and the software assigns the logs to the same ID unique to system.

Abstract: Systems and methods for container orchestration security employ one or more processors that separate a lifecycle of one or more containers into a plurality of predefined container image lifecycle phases; segregates control of the plurality of predefined container image lifecycle phases into a plurality of control environments separately controlled by different enterprise control components isolated from one another. In addition, one or more external processors may generate one or more certificates that are based on the platform, state attributes and meta data for interaction of the container with one or more external nodes. The one or more processors may also control the promotion, update and deletion of container images between the plurality of lifecycle phases and registries in different control environments as well as between the enterprise registries and the plurality of other registries that are part of multiple external clouds.

Abstract: A device, method, or computer program product for conducting a cryptographic operation in a vehicle is disclosed herein. The device is arranged to receive key data and input data, and to conduct a cryptographic computation of the input data to output data using the key data. The cryptographic computation is conducted with or without side channel attack counter measures, which are toggled based on the key data or based on a control input.

Abstract: In an approach for an API key access authorization, a processor receives a transaction identity, a part of a token, and an API key identity attribute from a server. The transaction identity is generated in the server associated with generating the token. A processor receives a request from a client with the transaction identity for the part of the token. A processor looks up a transaction table via the transaction identity as an index. The transaction identity is associated with the part of the token and the API key identity attribute. A processor retrieves a client identity attribute through a second server via an IP address of the client. The second server registers the client. A processor matches a policy via the API key identity attribute and the client identity attribute. A processor sends the part of the token to the client.

Abstract: A certificate transfer system includes a first certificate management host and a certificate transfer management host. The first certificate management host is configured to generate a first certificate, sign an electronic device with the first certificate, and transmit a first Internet address to the electronic device to complete a certificate-issuance operation. The certificate transfer management host is configured to store a transfer device list and a second Internet address. When the first certificate management host receives the first certificate issued by the electronic device, the first certificate management host verifies that the first certificate is correct and determines that if the first certificate matches one of the certificates in the transfer device list, the first certificate management host returns the certificate transfer management host address to the electronic device.

Abstract: An information handling system includes a baseboard management controller and a media controller. The baseboard management controller includes a memory, and an immutable attribute of the baseboard management controller is fused in the memory during a factory process of the information handling system. The baseboard management controller generates a first seed value based on the immutable attribute, generates a first key value based on the first seed value, and provides the first key value. The media controller includes a secure memory and a processor. The processor receives the first key value from the baseboard management controller, and stores, during the factory process, the first key value in the secure memory. The first key value cryptographically links the secure memory to the baseboard management controller.

Abstract: A pseudonym certificate management method, performed by a pseudonym certificate management apparatus interworking with an external server, may comprise: receiving, from the external server, a pseudonym certificate in a state locked based on a root value identifiable only by the external server; periodically receiving an unlocking key for the pseudonym certificate from the external server; activating the pseudonym certificate with the unlocking key; and when the activated pseudonym certificate is abnormal, deactivating the pseudonym certificate.

Abstract: Provided are embodiments of electronic document processing that include a workflow engine executing a workflow that includes verifying material data of an electronic document, providing a verified copy of the electronic document to a reviewer for review and, in response to receiving approval of the electronic document from the reviewer, obtaining a digital signature of material data of the electronic document from the reviewer. The workflow may include a similar process for multiple reviewers, and providing the electronic document to a processor for processing.

Abstract: A sending device may send data intended for a target device. An intermediate device may intercept the data sent from the sending device and forward the communications to the target device. Security data (e.g., a security certificate for authentication) along with an encrypted version of the security data may be sent at the application layer such that it passes from the sending device, through the intermediate device, and to the target device without being analyzed or modified by the intermediate device. The target device may use the encrypted security data and the security data to verify the identity of the sending device.

Abstract: A method and apparatus is provided for updating certificates in a trust chain and managing versions of the trust chain. A first electronic processor determines that a first certificate in a first level of the trust chain is to be updated, updating the first certificate and each certificate in a lower level in the trust chain that is lower than the first level, creates a second version of the trust chain including an updated first certificate and an updated certificate at each lower level in the trust chain, and transmits the second version of the trust chain to one or more entities.

Abstract: An anonymous credential authentication system receives an anonymous credential signature value indicating that setting proposition information using a credential is satisfied from a user device that has been issued the credential combined with multiple pieces of attribute information constituting personal information, generates signer authentication information that confirms a signer of the anonymous credential signature value using an opening key, and outputs the signer authentication information.

Abstract: Systems and methods are provided to allow a smart phone or any terminal to activate a lock using a web site or server computer system. An access control system is provided that includes a server and an access device. The access device includes a processor and a communication module. The process has control of a lock and is able to receive a reservation certificate presented by a portable terminal through the communication module. The processor activates the lock when a current reservation certificate has been presented.

Abstract: A consumer of a software module issues a module certificate that enables a testing entity to automatically validate a software module from a producer of the software module. The consumer receives a request for a module certificate from the producer of the software module. The request indicates attributes of the software module. The consumer determines whether the attributes of the software module are within predetermined limits, and if the attributes are within predetermined limits, the consumer generates and signs the module certificate including the attributes of the software module. The consumer issues the module certificate to the producer of the software module. Once the consumer obtains a software package including the software module and the module certificate from the producer, the consumer directs a testing entity to validate the software module with the module certificate.

Abstract: A computer-implemented method, a system, and a computer program product for renewing a digital certificate. According to an embodiment of the present invention, the computer-implemented method comprises copying a digital certificate, from a first computer, onto a second computer, and requesting, from the second computer, renewal of the digital certificate by a certificate authority. The method further comprises loading a renewed digital certificate from the certificate authority, and saving the renewed digital certificate on the second computer. The renewed digital certificate is checked, on the second computer, for specified conditions, and the renewed digital certificate is copied from the second computer onto the first computer.

Abstract: During provisioning of a biometric device, a hardware root of trust is established between the biometric device and a server. The biometric device includes a cryptographic processor with a first encryption key stored in secure storage. The first encryption key is used to establish a mutually authenticated communication channel with the server. A set of additional encryption keys between the device and the server are established via the communication channel. Biometric data generated by the biometric device is encrypted using the additional keys and digitally signed. The server receives the encrypted and signed data via the communication channel and verifies the signature. Once the signature is verified, the biometric data is then decrypted. The server then processes the decrypted biometric data. Data that does not arrive via the communication channel, that fails the verification, or that fails decryption is deleted or disregarded.

Abstract: Described herein is a system and method for validating media integrity using asymmetric key cryptography utilizing a public/private cryptographic key pair. The private key is kept secret and is known to an originator and/or publisher of a media file. The public key is added to the media file and is used to validate integrity of the media file, that is, that content of the media file (e.g., portion(s), frame(s)) has not been altered since publication of the media file. By validating integrity of the media file, strong proof that the media file came from an owner of the keypair (e.g., had possession of the private key) can be obtained, for example, resolving issues of trust and/or authenticity common in altered content. In some embodiments, information regarding an origin of the content can further be determined.

Abstract: An information processing apparatus is provided. The apparatus performs operations comprising searching for devices connected to a network; displaying a screen for selecting a device to be used from among devices discovered through the search; when the device selected through the screen is a device which can perform encrypted communication and for which a result of processing for verifying a certificate received from the device is a failure, inquiring with a user as to whether to allow or reject communication with that device; and obtaining information of the selected device by communicating with the device when a user operation for allowing the communication has been made in response to the inquiring, and performing control for not establishing encrypted communication with the selected device when a user operation for rejecting the communication has been made.

Abstract: Embodiments of the present application relate to a method, apparatus, and system for verifying an identity of a user. The method includes receiving a preset key that is associated with a key carrier that is a physical object, storing the preset key in a database storing mappings between a plurality of preset keys and a plurality of users, receiving a verification key in connection with an identity verification of a user, retrieving the preset key associated with the user from the database, determining whether the verification key matches the preset key associated with the user, and causing a determination of whether the key carrier is authentic.

Abstract: A public key infrastructure (PKI) ecosystem includes a first organization computer system having a first processor, a first memory, and a first organization process including instructions that are (i) encoded in the first memory, and (ii) executable by the first processor. The ecosystem further includes a second organization computer system having a second processor and a second memory, a digital ledger, and domain name system security extensions (DNSSEC). When executed, the first instructions cause the first processor to create at least one public/private PKI keypair for a first domain name, in the DNSSEC, register the first domain name and create a certificate authority (CA), register the CA in the blockchain, using the CA, create a certificate for a first entity, register the certificate in the blockchain and/or the DNSSEC, and assert, to the second organization computer system, trust in the first entity based on the registered certificate.

Abstract: A method, a system, and a computer program product for validating a transaction. A received request to validate a transaction in accordance with one or more validation rules in a plurality of validation rules is executed. Based on the executed validation request, a validation certificate associated with the transaction is generated. Validity of the validation certificate is determined. The transaction is stored on a blockchain network upon determining that the validation certificate is valid. Storage of the transaction on the blockchain network is prevented upon determination that the validation certificate is invalid.

Abstract: Embodiments of the present invention provide a method, program, and apparatus that may identify a device by using a virtual code generated based on a unique value of a chip inside a device without a separate procedure for identifying the device. Furthermore, embodiments of the present invention provide a method, program, and apparatus that may generate a virtual code, which is not matched with any other code, whenever a code for identifying a device is requested. Moreover, embodiments of the present invention provide a method, program, and apparatus for identifying a device that may add and use only an algorithm without changing a conventional process.

Abstract: Systems and methods are provided to allow a smart phone or any terminal to activate a door lock using a web site or server computer system. An access control system is provided that includes a server and an access device. The access device includes a processor and a communication module. The process has control of a door lock and is able to receive a reservation certificate presented by a portable terminal through the communication module. The processor activates the door lock when a current reservation certificate has been presented.

Abstract: This is a system and method for homomorphic encryption comprising: a key generation module configured to generate a secret key, a public key and a bootstrapping key; a private-key encryption module configured to generate a first ciphertext using the secret key; a public-key encryption module configured to generate a second cyphertext using the public key; a private-key decoding module configured to decode a first ciphertext, a second ciphertext and an encrypted analytic result; a homomorphic computational module configured to perform an analytical operation, according to an analytical operation request on the first ciphertext and the second ciphertext without decrypting the first ciphertext and the second ciphertext using the bootstrapping key; and, wherein the encrypted analytical result is provided by the homomorphic computational module and are encrypted with the secret key.

Abstract: A system for implementing mixed protocol certificates, the system includes a subject device designed and configured to receive, from an issuing device, a first digital certificate, wherein the first digital certificate further comprises a first digital signature public and private key pair according to a first digital signature protocol and a second digital signature public key according to a second digital signature protocol, wherein the second digital signature protocol is distinct from the first digital signature protocol, to generate a second digital certificate, wherein generating the second digital certificate comprises generating a subject digital signature signing the certificate, the subject digital signature generated as a function of the second digital signature protocol and to provide the first digital certificate and the second digital certificate to a verifying device.

Abstract: The aim of the invention is to strengthen the security of secure voice and/or video communications established through a network of Internet type. The security of these communications, which are based on the use of the SRTP protocol, is strengthened by the invention which makes it possible, without significantly modifying the protocols, to use better quality session keys produced by a security server of HSM type. These keys are configured by an intermediate server of SIP proxy type when establishing the communication.

Abstract: Systems and methods for provisioning and operating a primary security device in a verifiable end-to-end election system are presented herein. The security device serves as a root of trust for chains of certificates that are deployed and utilized throughout the election process. These chains of certificates, originating with the device, which acts as an intermediate certification authority, are used to create a verifiable trust chain throughout the different parts of the election process, the trust chain being traceable back to the device and to the original root of trust certificate. In various embodiments the security device includes a compute module, a security chip, a connection to a human interface display device, at least one lockable transfer device port, and an air-gapped main board to house the compute module, the security chip, and the lockable transfer device port.

Abstract: A home energy management system (HEMS) controller certifies a plurality of devices participating in an HEMS network. When a request for re-certification is issued to a given device among the plurality of devices and when a response is not available from the device, the HEMS controller suspends a re-certification process for the device and performs a re-certification process for another device first.

Abstract: A file verification method, a file verification system and a file verification server are provided. The file verification method includes the following steps. A tree data structure is established according to a plurality of first hash values of a plurality of first electronic files. A first root hash value of the tree data structure is stored into a block of a blockchain. A verification data including block information of the block, one of the first hash values and at least one non-terminal hash value of the tree data structure is generated for one of the first electronic files. A second electronic file is verified according to the verification data.

Abstract: Embodiments of the present disclosure generally relate to systems, devices, and methods wherein dynamically generated symmetric keys are used for encryption and decryption of software updates for vehicles. The symmetric keys are dynamically generated using a combination of information that ties a given symmetric key to a specific combination of a vehicle and the devices installed therein. The dynamic generation of the symmetric keys also uses a piece of random data generated by an intermediary server, which allows the intermediary server to validate devices before providing the piece of random data and thereby control access to the software updates. Use of the techniques disclosed herein provide heightened security, control, safety, and reliability for over-the-air software updates for vehicles.

Abstract: Automated registration of one or more IoT devices seeking connection to one or more IoT platforms using a secure provisioning service. The secured provisioning service verifies and administers connection credentials to each IoT device, ensuring legitimate devices cannot be impersonated or controlled by unauthorized personnel. The provisioning service matches the IoT devices and metadata of each IoT device to the provisioning rules. Connection credentials and/or rules defining each IoT device's access to IoT platforms are based on the provisioning rules of the rules registry. Matching each IoT device to one or more provisioning rules offers flexibility to dynamically add, delete or amend one or more rules in a complex rules-based system, allowing for automatic updates to the connection credentials of each IoT device, wherein each IoT device can be provisioned or re-provisioned using the most up to date set of new or amended rules.

Abstract: Embodiments described herein provide systems and methods to prevent, or provide a countermeasure, to a co-existence attack, for example, that may occur in a Security Credential Management System (SCMS) where both regular butterfly key (RBK) protocol and unified butterfly key (UBK) protocol are supported. Embodiments described herein provide, support, employ, or implement hardware acceleration for a Hardware Security Module (HSM), for example, for cryptographic operations (e.g., block ciphers, digital signature schemes, and key exchange protocols).

Abstract: Techniques and systems are disclosed to enable location verification and tracking, for use or access of a geographic-specific phone number or similar location feature of a communications service by a mobile computing device at (or within) a geographic location or defined area. In an example, verification of a use of the device at the location or area is enabled by the receipt and collection of location verification data for a token having location verification and time data, with such location verification data being communicated via a short-range wireless network. The verification is enabled by communication of the token to a communications service for device identification and location registration, and assess to a resource based on registered use of the communications device at the geographic location. In further examples, capabilities for security, verification, and auditing of location information is enabled with use of the token and location information.

Abstract: A device, method, and computer readable storage medium generate a biometric public key for an individual based on both the individual's biometric data and a secret, in a manner that verifiably characterizes both while tending to prevent recovery of either by anyone other than the individual. The biometric public key may be later used to authenticate a subject purporting to be the individual, using a computing facility that need not rely on a hardware root of trust. Such biometric public keys may be distributed without compromising the individual's biometric data, and may be used to provide authentication in addition to, or in lieu of, passwords or cryptographic tokens. Various use cases are disclosed, including: enrollment, authentication, establishing and using a secure communications channel, and cryptographically signing a message.

Abstract: In an aspect of the disclosure, a method, a computer-readable medium, and an apparatus are provided. In certain configurations, the apparatus may connect to a mesh network that includes at least the first device and a second device. The apparatus may communicate with the second device without obtaining one or more access credentials from the second device.

Abstract: A method, in a provisioning server, of provisioning a printer, includes: receiving a provisioning request from the printer, the provisioning request containing (i) a printer identifier, and (ii) an account identifier associated with the printer; obtaining, from a digital certificate issuer, a unique string; sending the unique string to the printer; receiving from the printer, in response to sending the unique string, a certificate signing request containing (i) the printer identifier, (ii) the account identifier, and (iii) an authentication token including the unique string signed with a private key of the printer; validating the certificate signing request; passing the validated certificate signing request to the digital certificate issuer; receiving, from the digital certificate issuer, a digital certificate encoding the printer identifier and the account identifier; and providing the digital certificate to the printer for storage.

Abstract: A system (100) for providing a user device (102) access to a resource or data is disclosed. The system (100) comprises: the user device (102) comprising: a light detector (104) configured to detect light (130) emitted by a light source (122), which light (130) comprises an embedded code comprising a light source identifier of the light source (122), a communication unit (108) configured to communicate with a network device (112), a processor (106) configured to retrieve the light source identifier from the light (130), and to communicate the light source identifier to the network device (112).

Abstract: Server Name Indication (SNI) hostname extraction to populate a reverse Domain Name System (DNS) listing to protect against potentially malicious domains. In some embodiments, a method may include detecting a Transport Layer Security (TLS) handshake between a first client application and a first server application, extracting an SNI hostname and an Internet Protocol (IP) address from the TLS handshake, populating the reverse DNS listing with the SNI hostname as a domain paired with the IP address, detecting communication between a second client application and the IP address, accessing the reverse DNS listing to determine the domain paired with the IP address, determining that the domain is a potentially malicious domain, and in response to determining that the domain is a potentially malicious domain, performing a remedial action to protect against the potentially malicious domain.

Abstract: The present disclosure provides systems and methods for improving provision of secret data on programmable devices. An appliance receives physical unclonable function (PUF) data pertaining to an integrated circuit. Secret data is provided to the appliance from a secret vault. Public and private PUF keys are derived based upon the PUF data. Further, ephemeral public and private keys are derived by the appliance. The public and private PUF keys, along with the ephemeral public and private keys are used to establish a secure channel for programming the secret data on the programmable device.