Abstract: A method for recovering a digital file from a locked device is provided. An identity token is received at a recovery app on the locked device. The recovery app retrieves a digital file from the locked device and sends the digital file and the identity token to a service external to the device.

Abstract: A method and secret origination service are provided for calculating and distributing a shared secret. The secret origination service receives a first shared secret request from a first device. The first shared secret request includes a first identity token associated with a first user of the first device and a second participant identifier associated with a second user. The secret origination service verifies the first identity token to produce a first verified requestor identity and calculates a first shared secret based on the first verified requestor identity and the second user. The secret origination service sends the first shared secret to the first device. The secret origination service also receives a second shared secret request from the second device, which includes a second identity token associated with the second user of the second device and a first participant identifier associated with the first user.

Abstract: An electronic device includes a memory configured to store a lab certificate, a code authentication certificate and the executable code. The electronic device also includes a processor associated with a unique device identifier. For a first operational condition of the plurality of operational conditions, the processor is configured to: retrieve the code authentication certificate associated with the executable code; determine that a valid lab certificate is present in the memory; authenticate the code authentication certificate by determining that the code authentication certificate is signed with a private developer key and that the signature is valid; and execute the executable code on the electronic device responsive to determining that the lab certificate is valid and authenticating the code authentication certificate.

Abstract: In a method, a secured link is established between a primary device and a secondary device, both of which are assigned to a user. The secondary device receives, on the secured link, a request for a derived certificate for the primary device and a public key generated by the primary device. The secondary device generates the derived certificate for the primary device based on an original certificate issued to the secondary device and transmits, on the secured link, the derived certificate to the primary device.

Abstract: A device executes debugging instructions received from a debugging computer. The device receives a debugging establishment request from the debugging computer. The device transmits a unique identifier associated with the device and a secured expiration value to the debugging computer. The device receives a transport layer security (TLS) certificate from the debugging computer and establishes a secured and authenticated link with the debugging computer using the TLS certificate. The device enables a debugging mode, responsive to determining that an identifier in the TLS certificate matches the unique identifier and that a secured expiration value in the TLS certificate is valid and within a predefined validity range, and executes, in the debugging mode, debugging instructions received from the debugging computer.

Abstract: In a method, a secured link is established between a primary device and a secondary device, both of which are assigned to a user. The secondary device receives, on the secured link, a request for a derived certificate for the primary device and a public key generated by the primary device. The secondary device generates the derived certificate for the primary device based on an original certificate issued to the secondary device and transmits, on the secured link, the derived certificate to the primary device.

Abstract: An electronic device includes a memory configured to store a lab certificate, a code authentication certificate and the executable code. The electronic device also includes a processor associated with a unique device identifier. For a first operational condition of the plurality of operational conditions, the processor is configured to: retrieve the code authentication certificate associated with the executable code; determine that a valid lab certificate is present in the memory; authenticate the code authentication certificate by determining that the code authentication certificate is signed with a private developer key and that the signature is valid; and execute the executable code on the electronic device responsive to determining that the lab certificate is valid and authenticating the code authentication certificate.

Abstract: A device executes debugging instructions received from a debugging computer. The device receives a debugging establishment request from the debugging computer. The device transmits a unique identifier associated with the device and a secured expiration value to the debugging computer. The device receives a transport layer security (TLS) certificate from the debugging computer and establishes a secured and authenticated link with the debugging computer using the TLS certificate. The device enables a debugging mode, responsive to determining that an identifier in the TLS certificate matches the unique identifier and that a secured expiration value in the TLS certificate is valid and within a predefined validity range, and executes, in the debugging mode, debugging instructions received from the debugging computer.

Abstract: A method and apparatus for modifying the Multimedia Internet KEYing (MIKEY) protocol to support an extended key-management message (KMM), wherein the apparatus programs a computer to perform the method, which includes: determining that a KMM is directed to a target device; determining that the KMM is an extended KMM related to a key-management operation that is not supported by the standard MIKEY protocol; signaling the extended KMM in at least one field of a MIKEY message; and sending the MIKEY message to the target device.

Abstract: A system and method for secure communications in a communication system, wherein the system programs a computer to perform the method, which includes: receiving at least one authentication key, without an encryption key, from a key-management server; receiving a packet, which is encrypted, from a source device; authenticating the packet, using the at least one authentication key, without cryptographically altering the packet; and forwarding the authenticated packet to a destination device of the packet.

Abstract: A key message can include a key-encryption-key (KEK) associated with a KeyDomainID and a KeyGroupID. A session description message can describe streaming media initialization parameters containing media stream information for one or more media streams. For each media stream, the media stream information can include an IP address and a data port. The session description message can further contain a linkage for binding the KEK to a corresponding one of the media streams. The linkage can include the KeyDomainID and KeyGroupID or can include an abstract representation of the KeyDomainID and KeyGroupID. During session initialization, the key-encryption-key (KEK) can be bound to the media streams using the linkage of the session description message. Each of the media streams can be secured using a traffic key conveyed to user equipment (UE) under protection of the key-encryption-key (KEK).

Abstract: Methods, systems and apparatus are provided for source authentication. In accordance with the disclosed embodiments, a key-management server generates a key-delivery message that includes a key data transport payload secured with a group key, and a source authentication payload. Upon receiving the key-delivery message at a communication device, the communication device may verify whether the source authentication payload of the key-delivery message is valid. When the source authentication payload is determined to be valid, the communication device thereby authenticates that the key-delivery message was transmitted by the key-management server.

Abstract: A means for determining a channel for communication in a wireless communication system is provided. A method includes receiving one or more sub-frames of a beacon signal on a beaconing channel until a legitimacy condition of the beacon signal is met. The beacon signal is transmitted by a beaconing device. The method further includes determining a suitability of the channel for communication in the wireless communication system based on the legitimacy condition.

Abstract: A system and method for secure communications in a communication system, wherein the system programs a computer to perform the method, which includes: receiving at least one authentication key, without an encryption key, from a key-management server; receiving a packet, which is encrypted, from a source device; authenticating the packet, using the at least one authentication key, without cryptographically altering the packet; and forwarding the authenticated packet to a destination device of the packet.

Abstract: A key message can include a key-encryption-key (KEK) associated with a KeyDomainID and a KeyGroupID. A session description message can describe streaming media initialization parameters containing media stream information for one or more media streams. For each media stream, the media stream information can include an IP address and a data port. The session description message can further contain a linkage for binding the KEK to a corresponding one of the media streams. The linkage can include the KeyDomainID and KeyGroupID or can include an abstract representation of the KeyDomainID and KeyGroupID. During session initialization, the key-encryption-key (KEK) can be bound to the media streams using the linkage of the session description message. Each of the media streams can be secured using a traffic key conveyed to user equipment (UE) under protection of the key-encryption-key (KEK).

Abstract: A method and apparatus for modifying the Multimedia Internet KEYing (MIKEY) protocol to support an extended key-management message (KMM), wherein the apparatus programs a computer to perform the method, which includes: determining that a KMM is directed to a target device; determining that the KMM is an extended KMM related to a key-management operation that is not supported by the standard MIKEY protocol; signaling the extended KMM in at least one field of a MIKEY message; and sending the MIKEY message to the target device.

Abstract: A mobile device as disclosed herein can support a plurality of electronic payment applications such as credit and/or debit applications. During a payment transaction, the mobile device communicates a priority list of the electronic payment applications to a point of sale terminal, which then selects one of the applications for completion of the payment transaction, where the selection is governed by the priority list. The data structure corresponding to the priority list is configured such that the end user of the mobile device has management access rights to at least some of the electronic payment applications. Such end user management access rights can be used to modify the relative priority of the electronic payment applications.

Abstract: Disclosed are a system and method for aggregating micropayment hash chains. An end user (the “payer”) cryptographically signs “commitments” and transmits then to a vendor. The commitments include an “accumulated count” field which tracks the total number of micropayments made thus far in the payment transaction between the payer and the vendor. The payer can also transmit payment tokens to the vendor. These payment tokens include micropayments verified by a hash chain. When the vendor seeks reimbursement from a broker, the vendor tells the broker the total number of micropayments in the payment transaction and sends verification information to the broker. The broker checks this information against a verification system established with the payer. If the information is verified to be correct, then the broker reimburses the vendor for the services provided and charges the payer. The verification information ensures that the payer and vendor cannot cheat each other.

Abstract: A device (110) performs a method 200 for authentication and Ad Hoc network setup. The device (110) receives (210) a first security configuration; receives (220) a second security configuration based on location; authenticates (230) at least a second node (110) having the first security configuration and the second security configuration; and forms (240) a network with the at least a second node (110).

Abstract: A communications device (300) enabled to support both external voice communications functionality (301) (or other external communications of interest and choice) and other functionality (302) has at least a first and second mode of operation (304 and 305). The first mode of operation permits essentially all functionality while the second mode of operation precludes at least much of the other functionality in favor of preserving the viability of at least some of the external communications functionality. A selector (306) can select a given mode of operation based, at least in part, on a trigger 307 comprising, for example, a user input and/or detection of a condition of concern.