Abstract: Various embodiments provide a method and an apparatus for determining a trust status of a TPM, and a storage medium, and pertains to the field of data security technologies. In those embodiments, a verifier send an unsealing request to a host, so that the host unseals current PCR values in the TPM based on a seal key handle carried in the unsealing request, and sends verification information to the verifier based on the unseal verification key obtained after the unsealing. Therefore, any verifier that establishes an encrypted channel with the host can determine the trust status of the TPM in the host based on a second verification key transmitted on the encrypted channel, and there is no need to pre-deploy a remote attestation server to determine the trust status of the TPM.

Abstract: There is disclosed in one example a home router, including: a hardware platform including a processor and a memory; a local area network (LAN) interface; a data store including rules for domain name-based services; and instructions encoded within the memory to instruct the processor to: provision a certificate and key pair to provide domain name system (DNS) over hypertext transfer protocol secure (DoH) or DNS over transport layer security (DoT) services; receive on the LAN interface an encrypted DNS request; decrypt the DNS request; query the data store according to the DNS request; receive a rule for the DNS request; and execute the rule.

Abstract: A system/method for secure communication between client devices includes receiving a request, at a secure communication platform, from a from a first client device to communicate with a second client device; determining, by the secure communication platform, whether the first client device is permitted to communicate with the second client device; if communication is permitted: generating, by the secure communication platform, a one-time use ephemeral key; transmitting, by the secure communication platform, the generated one-time use ephemeral key to the first and second client devices; establishing, by the secure communication platform, a secure communication session directly between the first and second client devices, wherein communications between the first and second client devices are encrypted and decrypted using the one-time use ephemeral key; and destroying, by the secure communication platform, the one-time use ephemeral key upon termination of the secure communication session between the first and

Abstract: Systems and methods for encrypted storage device telemetry data are described. Storage device telemetry data may be collected for a telemetry message, such as a non-volatile memory express (NVMe) telemetry command, and encrypted using a first encryption key. The first encryption key may be encrypted using one or multiple second encryption keys and the encrypted first encryption key may be added to the telemetry message. A client system may receive the telemetry message, decrypt the encrypted first encryption key, and use the first encryption key to decrypt the encrypted storage device telemetry data.

Abstract: A method, apparatus and computer program product are provided for encrypting and decrypting data using multiple authority keys including receiving, from a first computing device, a data decrypt request to decrypt encrypted data, the data decrypt request comprising a user key, determining that the user key is associated with a key hierarchy that comprises a server key, decrypting the server key using the user key, decrypting the encrypted data using the decrypted server key and permitting access to the decrypted data by the first computing device.

Abstract: A method for integrating third-party encryption managers with cloud services includes receiving, at data processing hardware, an operation request requesting a cryptographic operation on data comprising an encryption operation or a decryption operation. When the operation is an encryption operation, the method includes transmitting a data encryption key associated with the data to a remote entity. The remote entity encrypts the data encryption key with a key encryption key and transmits the encrypted data encryption key to the data processing hardware. When the operation is a decryption operation, the method includes transmitting the encrypted data encryption key to the remote entity which causes the remote entity to decrypt the encrypted data encryption key with the key encryption key and transmit the decrypted data encryption key and transmit to the data processing hardware.

Abstract: In embodiments of the present disclosure, there is provided an approach for connecting an access point (AP) to a mesh network. According to embodiments of the present disclosure, an AP in a recovery mode transmits its identity information to a mesh portal (MPP) in the mesh network via an unsecured connection between the AP and the MPP. Upon a successful verification by the MP, the AP establishes a secured connection with a trusted server to obtain configuration information. The configuration information is used by the AP to establish a mesh link with an MPP or MP in the mesh network automatically. Accordingly, the AP switches from the recovery mode to a normal mode. Embodiments of the present disclosure provide an effective way for deploying and/or recovering an AP in a mesh network, which is more secure and requires no manual operation.

Abstract: A unique transaction key (Tk) is established amongst multiple entities using a common hardware security module (HSM) with a common HMAC key (HK) and transaction scheme name (T). The transaction key (Tk) can be used for various cryptographic functions (e.g. encryption, MAC, HMAC, key management) with one or more messages at the transaction or session level.

Abstract: A vehicle includes: at least one memory configured to store at least one default Instruction Structure Key (ISK), a generated ISK, and a pin code of the vehicle; and at least one processor. The at least one default ISK may include a first default ISK and a second default ISK. The processor may generate a random number using the first default ISK, receive the second default ISK encrypted with the generated ISK generated based on the pin code, and determine the generated ISK as an encryption key for encryption communication of the vehicle when the generated random number and the random number corresponding to the second default ISK are the same.

Abstract: This technology uses a bootstrap key (“BSK”) to securely onboard a computing device to a network. A unique BSK associated with an onboarding computing device is used to verify for various deployment models (1) that the computing device has proof the computing device is connecting to the correct wired or wireless network and (2) that the network has proof the computing device is trusted. The BSK may be an associated BSK or an embedded BSK. A computing device receives a signed voucher from the manufacturer authorized signing authority (“MASA”) before the computing device may onboard to a network. The MASA will issue a voucher to a Bootstrapping Remote Secure Key Infrastructure (“BRSKI”) registrar if the registrar proves knowledge of the computing device's BSK to the MASA or the registrar has an established trust relationship with the MASA.

Abstract: A method for hosted payload operations comprises transmitting, by a hosted payload (HoP) operation center (HOC), encrypted hosted commands to a host spacecraft operations center (SOC). The method further comprises transmitting, by the host SOC, encrypted host commands and the encrypted hosted commands to a vehicle. Also, the method comprises reconfiguring a host payload according to unencrypted host commands, and reconfiguring a hosted payload according to unencrypted hosted commands. Additionally, the method comprises transmitting host payload data to a host receiving antenna. Also, the method comprises transmitting hosted payload data to a hosted receiving antenna and/or the host receiving antenna. Additionally, the method comprises transmitting, by a host telemetry transmitter, encrypted host telemetry to the host SOC; and transmitting, by a hosted telemetry transmitter, encrypted hosted telemetry to the host SOC.

Abstract: A method includes establishing a multi-link security association between a transmitter upper Media Access Control (MAC) logic entity of a transmitter and a receiver upper MAC logic entity of a receiver. The transmitter includes one or more transmitter links. The receiver includes one or more receiver links.

Abstract: A method for secure key exchange. The method comprises receiving a request to certify a key from a communication partner at an interface between an access and tamper resistant circuit block and exposed circuitry. Within the access and tamper resistant circuit block, a first random private key is generated. A corresponding public key of the first random private key is derived, and a cryptographic digest of the public key and attributes associated with the first random private key is generated. The generated cryptographic digest is signed using a second random private key that has been designated for signing by one or more associated attributes. The public key and the signature are then sent to the communication partner via the interface.

Abstract: At least a static analysis and a dynamic analysis to perform for a first software application are determined based, at least in part, on a profile of the first software application. The first software application is analyzed with the static analysis to generate static analysis results. The first software application is analyzed with dynamic analysis to generate dynamic analysis results. An assessment report is generated based on the static analysis results and the dynamic analysis results, wherein the assessment report indicates a security score of the first software application that is based, at least in part, on the static analysis results and the dynamic analysis results.

Abstract: Embodiments of the invention introduce efficient methods for securely generating a cryptogram by a user device, and validating the cryptogram by a server computer. A secure communication can be conducted whereby a user device provides a cryptogram without requiring the user device to persistently store an encryption key or other sensitive data used to generate the cryptogram. The user device and server computer can mutually authenticate and establish a shared secret. Using the shared secret, the server computer can derive a session key and transmit key derivation parameters encrypted using the session key to the user device. The user device can derive the session key using the shared secret, decrypt the encrypted key derivation parameters, and store the key derivation parameters. Key derivation parameters and the shared secret can be used to generate a single use cryptogram key, which can be used to generate a cryptogram for conducting secure communications.

Abstract: A computer-implemented system and method for secure authentication of IoT devices are disclosed. The method for secure authentication of IoT devices comprises establishing a network connection with a network operator server via a control channel, establishing identity of the network operator server using a pre-shared server key from one or more of pre-shared server keys, establishing identity of the IoT device using a pre-shared client key from one or more of pre-shared client keys and cryptographically generating a session key for a network session to allow secure data exchange between the network operator server and the IoT device. The cryptographically generated session key is used for securely authenticating application running on the authenticated IoT device.

Abstract: A communication apparatus can act as a proxy to perform communication with a plurality of other communication apparatuses by receiving a request from a client apparatus in a network in compliance with the Neighbor Awareness Networking standard, and includes a first reception unit configured to receive, from a first other communication apparatus, a first signal for service provision notification, a second reception unit configured to receive, from the first other communication apparatus, a second signal for service provision notification, and a third reception unit configured to receive, from a second other communication apparatus, a third signal for service provision notification. In addition, a notification unit notifies the client apparatus of information related to the first other communication apparatus and information related to the second other communication apparatus together in a case where the first signal, the second signal, and third signal are received.

Abstract: One disclosure in the present specification provides a session management method performed by a session management function (SMF) node. The session management method may comprise: a step of transmitting, to a user plane function (UPF) node, a request message for discarding traffic buffering, when a notification of the detection of particular traffic associated with a wireless device has been received, and if additional authentication is required for the particular traffic; and a step of transmitting a message for triggering the wireless device to establish a new packet data unit (PDU) session, to an access and mobility management function (AMF) node.

Abstract: A system and method are provided for generating access tokens on a user device rather than via a remote server computer. An access token can be generated on a second user device by combining and encrypting, with format preservation, a primary access identifier, variable value, and salt. The resulting value can be provided to a first user device that can subsequently can provide the access token to an access device as part of an interaction. The access device can generate an authorization request message that comprises the access token and transmit it to a remote server computer for processing. The remote server computer can process the access token to determine the primary access identifier despite not being involved in the generation of the access token, providing an improvement over conventional tokenization methods.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for establishing a proof of storage over a specified period of time.

Abstract: Disclosed herein are embodiments of systems, methods, and products comprise a computing device, which allows in-network and network-border protection for Internet of things (IoT) devices by securely partitioning network space and defining service-based access to IoT devices. The disclosed segmented attack prevention system for IoT networks (SAPSIN) segments the IoT network into two virtual networks: a service network and a control network; and define access control rules for each virtual network. In the service network, SAPSIN utilizes a service-based approach to control device access, allowing only configured protocol, applications, network ports, or address groups to enter or exit the network. In control network, the SAPSIN provides the access control rules by defining a threshold for the number of configuration requests within a predetermined time. As a result, SAPSIN protects IoT devices against intrusion and misuse, without the need for device-specific software or device-specific security hardening.

Abstract: A method for seamlessly and automatically granting tailored permission for use and transference of internet data between databases with comprehensive consent is described. The method employs a graph language such as JSON-LD to integrate and employ cryptographically signed Information Sharing Agreements (ISA) between parties. Data is serialized to be easily transferred between databases when appropriate permission is obtained. Granular data exchange under usage control contacts can be automated among any number of parties on the internet. As such, the method provides a means by which users may control not only what may be done with their data, but to what entity or entities the data may be transferred. Advertisements may then be served to the user according to his or her preferences as defined within a web or desktop app, which is then applied to all related ad publishers publishing to the domains visited by the user.

Abstract: A method that includes obtaining threat model data associating at least one actor with an application. The at least one actor being capable of taking advantage of at least one potential vulnerability associated with the application. The method includes associating at least one technology with the at least one potential vulnerability based at least in part on the at least one actor, formulating a test based at least in part on the at least one technology, instructing a processor to perform the test on the application, and receiving results from the processor after performance of the test.

Abstract: Disclosed are an electronic device and a method for controlling same. A method for controlling an electronic device according to the present disclosure comprises: a step of obtaining a program which shares data about an advertisement with another electronic device so as to verify the shared data; a step of, when an event for the advertisement occurs, generating first data including information about the event for the advertisement; a step of transmitting the generated first data to the other electronic device; a step of receiving second data including information about an event from the advertisement generated from the other electronic device; and a step of verifying the second data using the program.

Abstract: An encrypted sequence that includes an authentication key may be received. A base key stored at a device may be identified and the encrypted sequence may be decrypted with the base key to obtain the authentication key. A challenge value may be received and the authentication key may be combined with the challenge value to generate a device ephemeral key. An authentication result may be generated for the device based on a combination of the device ephemeral key and the challenge value. Furthermore, the authentication result may be transmitted to a mobile network to authenticate the device.

Abstract: An authentication unit of an information processing apparatus authenticates an update control device that controls update of a control program by using a random number generated by a random number generation unit. In the random number generation unit, a first extraction unit extracts a bit value from a count value of a first clock signal, a calculation unit performs logical operation on the bit value extracted by the first extraction unit and a target bit value at a bit position included in an entropy as an update position that is designated, a replacement unit replaces the bit value at the update position with a result of the logical operation a position designation unit designates a new update position after the bit value is replaced, and an output unit generates the random number from the entropy.

Abstract: A method and apparatus for providing user key material from a server to a client is disclosed. The method comprises receiving a first message from the client in a server, the first message having a user key material request, an access token and an identifier of a transport key (TrK-ID), validating the user key material request according to the access token, generating a response having user key material responsive to the user key material request, encrypting the response according to the transport key (TrK), and transmitting a second message comprising the response from the server to the client. The client decrypts the second message according to the transport key (TrK) and validates the second message using the identifier of the transport key (TrK-ID).

Abstract: A communication terminal (10) includes control means for generating a subscription concealed identifier (SUCI) including a subscription permanent identifier (SUPI) concealed using a predetermined protection scheme, and a protection scheme identifier identifying the protection scheme, and transmission means for sending the SUCI to a first network apparatus during a registration procedure, the SUCI being sent for a second network apparatus to de-conceal the SUPI from the SUCI based on the protection scheme used to generate the SUCI.

Abstract: The embodiments herein relate to reducing signaling for DoNAS (Data over Non-Access Stratum) via SGi. In one embodiment, there proposes a method (400) in a mobility management node (203), comprising: establishing (S401) an S11-U connection between the mobility management node (203) and a gateway node (204); monitoring (S402) the frequency of data transferring request for a wireless device (201); and deciding (S404) whether or not to release the S11-U connection based on the frequency of data transferring request. With the embodiments herein, the signaling between the mobility management node and the gateway node can be significantly reduced, without introducing extra signaling or message to the existing network.

Abstract: A network entity may determine whether a network context of a device is stored in the device or in the network based, at least in part, on a preference or capability of the device, as reported by the device during attachment to the network entity. The context may be stored in, and retrieved from, a dedicated context storage function that is independent of the network entity. A context storage function may be partitioned, or separate storage functions used, to automatically group and track access network contexts, core network contexts, or network slice contexts. The context storage function may provide to the device an index, such as a link or other identifier to be used in retrieving the stored context information. The context storage function may further provide a token to secure re-attachment communications among the device, the network entity, and the context storage function.

Abstract: The present disclosure is directed to secure processing and display of protected content. The use of a trusted execution environment (TEE) to handle authentication and session key negotiation in accordance with a selected content protection protocol may reduce any trusted computing base (TCB) needed for such operations, and thereby present a smaller target for potential attackers. Techniques are presented in which a session key negotiated via such a TEE is securely provided to output circuitry such as a display controller, which may encrypt protected content that has been requested for viewing on a protocol-compliant display device communicatively coupled to a device comprising the TEE and/or the output circuitry. The output circuitry may then provide the encrypted protected content to the protocol-compliant display device, such as for compliant display of the protected content.

Abstract: A system that provides recommendations of documents to a user, the system including a server arrangement, and a database arrangement that stores documents, wherein the server arrangement: receives identification details of the user, obtains prior work associated with the user, determines a user classification of the user based on: the identification details of the user, the prior work associated with the user, and an activity data of the user, determines a document classification for the documents based on a metainformation pertaining to the documents, determines a relevance factor for the documents with respect to the user based on the document classification of the documents, the user classification of the user, and activity data relating to the documents of a plurality of users with similar user classification as the user, and provides recommendations of documents to the user based on relevance factors of the documents.

Abstract: Embodiments described herein relate to credential wrapping for secure transfer of electronic SIMs (eSIMs) between wireless devices. Transfer of an eSIM from a source device to a target device includes re-encryption of sensitive eSIM data, e.g., eSIM encryption keys, financial transaction credentials, transit authority credentials, and the like, using new encryption keys that include ephemeral elements applicable to a single, particular transfer session between the source device and the target device. The sensitive eSIM data encrypted with a symmetric key (Ks) is re-wrapped with a new header that includes a version of Ks encrypted with a new key encryption key (KEK) and information to derive KEK by the target device. The re-encrypted sensitive SIM data is formatted with additional eSIM data into a new bound profile package (BPP) to transfer the eSIM from the source device to the target device.

Abstract: A secure element device for use in a connected device includes a first interface configured to enable communication with a communication module and a second interface configured to enable communication with an action module of the connected device. A processor coupled to the first interface and the second interface, executes a first set of computer-readable instructions, stored in a memory of the secure element device, to authenticate, via the first interface, the connected device on the communication network. The processor also executes a second set of computer-readable instructions, stored in the memory, to perform one or both of (i) obtaining, via the second interface, data from the action module, the data to be transmitted over the communication network and (ii) controlling, via the second interface, the action module to cause the action module to perform one or more operations based on an instruction received over the communication network.

Abstract: A system and method of determining an attestation or identity score of a user of a communication device employs metadata stored in a plurality of client devices, such as IoT devices. A request for attestation, comprises a unique identifier associated with the communication device and an input or shared value. The unique identifier is used to identify, in a distributed ledger (blockchain), client devices that are paired with the communication device. Metadata stored in association with each of the client devices is retrieved and compared to the input or shared value, and a sub-identity score is determined based on the extent to which there is a match and the reliability of the client device. The sub-identity scores are combined to obtain an identity score reflecting a confidence level in the user and/or communication device.

Abstract: A client can allocate and reassociate unique identifiers to local content items associated with an account at a content management system, and use the unique identifiers to commit operations for the content items on the content management system. For example, a client can create a content item and determine the content item does not have an identifier from the content management system. The client obtains an identifier for the content item and asks the content management system to verify a uniqueness of the identifier. When the identifier is unique, the client adds a node corresponding to the content item to a local tree representing a state at the client of content items associated with the account, and uploads the content item with the identifier to the content management system. When the identifier is not unique, the client obtains a new identifier for the content item.

Abstract: A method for sharing information has an assertion associated therewith such that the receiving communication device is able to verify the assertion without the sender revealing underlying data demonstrating the validity of the assertion. The assertion is derived from underlying data input to a pre-provisioned first algorithm. The assertion is encapsulated in a first data object by a PGE that controls an environment in which the first algorithm is executed. A first proof is generated that is configured to verify that the first algorithm used the underlying data to produce the assertion when provided to a PVE along with the first data object. The underlying data is excluded from the first proof and the first data object such that privacy of the underlying data is maintained. The information, the first proof and the first data object are sent to the receiving communication device from the sending communication device.

Abstract: A server includes a processor, memory, and a communications interface. During a registration process the communications interface receives a phone number associated with a client mobile device, from a client computer system. In response to receiving the phone number, the processor generates a password and associates it with the client computer system. The password is transmitted to the client mobile device using the received phone number, and a password interface is transmitted to the client computer system. The processor waits up to a predetermined amount of time for the password transmitted to the client mobile device to be returned to the server device via the password interface transmitted to the client computer system. In response to the predetermined amount of time expiring without receiving the password, a message allowing the registration process to be completed using the client mobile device is transmitted to the client mobile device.

Abstract: A communication control apparatus includes a collection control unit, an analysis unit, and a coordination unit. The collection control unit collects communication performed with a device connected to a subordinate network, and controls communication performed by the device based on a first control condition; The analysis unit analyzes the communication collected by the collection control unit to extract device identification information indicating characteristics of the communication performed by the device. The analysis unit specifies a device name of the device and the first control condition corresponding to a normal communication range extracted from the device identification information, based on the device identification information.

Abstract: Methods, systems, and apparatuses are provided for inferring security incidents from observational data. For example, alerts generated with respect to a set of entities by a first alert generator are received, association scores are calculated for pairs of alerts, the alerts are formed into clusters based on the association scores, and a security incident model is formed based on the clusters. The security incident model may define sequences of alerts corresponding to security incidents. Furthermore, the security incident model may be used to determine a match between additional alerts and a sequence of alerts in the security incident model and identify the additional alerts as a security incident corresponding to the sequence of alerts in the security incident model.

Abstract: A key exchange device is provided that includes: a shared secret key storage in which shared secret information mkik which is information different from a secret key of the key exchange device is stored; an authentication information addition unit that generates authentication information ?i, by which authentication is performed and falsification is detected, for key exchange information ei, which is output to the outside, by using the shared secret information mkik; and an authentication information verification unit that receives key exchange information es and authentication information ?s corresponding to the key exchange information es from the outside, verifies the authentication information ?s using the shared secret information mkik, and, if the authentication information ?s is not successfully verified, stops a key exchange, and the shared secret information mkik is a value that is used in a generation process in a key exchange.

Abstract: A method comprises receiving, at a server from a communications-enabled device that includes processing circuitry, a request for providing a user session correlated with a user identifier (ID) and a target appliance. The method further includes in response to the request for the requested user session: retrieving a user attribute from a user-ID database that stores user ID information for a plurality of user accounts, and retrieving an appliance attribute from an appliance-ID database that stores appliance ID information; and correlating the retrieved user attribute and appliance attribute with the requested user session for a user account from among the plurality of user accounts. The method further includes transferring the requested user session to the target appliance as a new user session that is spatial-temporal limited and that is without the target appliance using user login information.

Abstract: A method of securely transmitting a message from a sending entity to a receiving entity via a network. A Processing String Engine is communicatively coupled to the sending and receiving entities. The sending entity requests the Processing String Engine to provide a network routing path for message transmission from the sending entity to the receiving entity and to provide a processing string for the message transmission. The Processing String Engine identifies a network path and generates a processing string. The sending entity appends the processing string to the message and sends the message to the receiving entity. The message is unreadable while the processing string is appended thereto. Upon receipt of the message with the appended processing string, the receiving entity requests removal the processing string. Upon successful verification of the receiving entity, the processing string is removed, and the message is returned to the receiving entity.

Abstract: Techniques for inspecting network traffic are disclosed. An application executing as an operating system extension that uses a virtual private network (VPN) stack of the operating system intercepts an Internet protocol (IP) packet for delivery to a remote computer system. A determination is made of an alteration action to take in response to intercepting the packet. The determined action is taken.

Abstract: A method of delivering audio to one or more client computing devices includes receiving, by an audio server computing device, a live audio signal starting at a first time; processing, by the audio server computing device, the live audio signal, thereby creating a data representation of the live audio signal; transmitting, by the audio server computing device, via a wireless network in electronic communication with the audio server computing device, the data representation of the live audio signal to the one or more client computing devices; interpreting, by the one or more client computing devices, the data representation of the live audio signal, thereby producing an interpreted audio signal; and providing, by the one or more client computing devices, the interpreted audio signal to a user listening device starting at a second time. A latency between the first time and the second time is less than 100 milliseconds.

Abstract: A method and apparatus are disclosed from the perspective of a first UE (User Equipment) to support multiple services on a one-to-one sidelink communication link between the first UE and a second UE. In one embodiment, the first UE initiates a first service. The first UE also establishes the one-to-one sidelink communication link for the first service. Furthermore, the first UE negotiates a security configuration with the second UE for encrypting or decrypting data from the first service. In addition, the first UE initiates a second service. The first UE also encrypts or decrypts data from the second service with the security configuration used by the first service.

Abstract: Service layer and application triggering may be used in a machine-to-machine environment. In an embodiment, an existing service layer procedure, such as registration, may allow a device or gateway service layer or application to indicate to a machine-to-machine server what port is listened to for triggers. In another embodiment, triggering may be used to provide bootstrapping instructions, including temporary bootstrapping identifiers, in trigger requests. In another embodiment, triggering may be used to assist with event notification. Service layer or application instructions may be embedded inside of trigger payloads. A trigger payload format is defined.

Abstract: A method for use in a hybrid network ecosystem comprising an enterprise network and a reconciliation network is presented. The method comprises generating, by at least one first computing node in the enterprise network or the reconciliation network, a first digital facilitator, wherein the first digital facilitator provides one or more parameters for accessing or distributing data on a distributed ledger in the enterprise network, and wherein a private key is used for performing a computing operation, based on the data, in the enterprise network. The method also comprises generating, by the at least one first computing node in the enterprise network or the reconciliation network or at least one second computing node in the enterprise network or the reconciliation network, a second digital facilitator, wherein the second digital facilitator provides the one or more parameters for accessing or distributing the data in the reconciliation network.

Abstract: Techniques are described herein that are capable of registering a user device with a cloud-based management service using an intermediate cloud storage. For instance, the intermediate cloud storage may store an encrypted data blob including information that identifies the user device. The intermediate cloud storage or a registration system may decrypt the encrypted data blob so that the registration system may use the decrypted data blob to register the user device with the cloud-based management service. For instance, the registration system may retrieve the encrypted or decrypted data blob from the intermediate cloud storage by providing a requisite secret to the intermediate cloud storage. The requisite secret may be provided to the registration system by the user device (e.g., via a matrix barcode, such as a QR code).

Abstract: A method and apparatus for establishing a trust relationship between users is disclosed. The apparatus includes at least two user devices containing the Application, a service provider server (SPS) comprising an application programming interface (API), a network communicably coupling the sender device, the receiver device and the SPS, and an out-of-band (OOB) channel, separate from the network, communicably coupling the sender device and the receiver device. The method includes obtaining a receiver's Public Key provided by an Application Programming Interface (API) on an service provider server, encrypting a verification message with the Receiver's Public key and the Sender's Private Key, sending the encrypted verification message from the Sender's device to the Receiver's device through the out-of-band channel, decrypting the encrypted verification message using Receiver's Private Key and Sender's Public Key, and communicating decrypted verification message via out-of-band channel.