Abstract: Disclosed are techniques that use devices with corresponding identity wallet applications that execute on an electronic processor device of the devices, and which identity wallets store identity information and encrypt the stored identity information. A distributed ledger system, and a broker system that interfaces to the wallet and the distributed ledger are used for various information exchange cases pertaining to access to facilities.

Abstract: The disclosed embodiments include encrypted data retrieval systems and methods to provide access to encrypted data. In one of such embodiments, the method includes receiving a request to access encrypted data. The method also includes analyzing the request to determine a credential of a source electronic device seeking to access the encrypted data. The method further includes determining, based on the credential of the source electronic device, a category of the request. In response to determining the category of the request, the method further includes selecting additional credentials with which to authenticate the request. The method further includes providing an indication of the credentials to at least one operator, wherein the at least one operator is authorized to enter the additional credentials to release the encrypted data. In response to receiving the additional credentials, the method further includes transmitting the encrypted data to the source electronic device.

Abstract: The disclosed computer-implemented method for enforcing access-control policies in an arbitrary physical space may include (i) identifying a collection of devices that are located within a predetermined physical space, (ii) determining the physical location of each device in the collection of devices, (iii) establishing, based on the collection of devices, (a) a list of controlled devices that are subject to an access-control policy and (b) a list of monitoring devices that are capable of monitoring user activity within a physical proximity, (iv) matching each controlled device with at least one monitoring device that is capable of monitoring user activity within physical proximity to the controlled device, and (v) monitoring, for each controlled device and by each monitoring device matched to the controlled device, user activity within proximity to the controlled device. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A client maintains a pinned collection of trusted digital certificates. An original digital certificate in the collection may be updated by sending a request to the certificate authority that issued the original digital certificate. The certificate authority generates an updated certificate, signs the updated certificate with a private key of the updated certificate, and also signs the updated certificate with the private key of the original digital certificate. The server provides the updated certificate to the client. The client can validate the signature created with the updated private key using the updated public key of the certificate authority, and the signature created with the original private key can be validated using the original public key of the certificate authority. If both signatures are valid, a continuity of trust may be established, and the updated certificate added to the collection of trusted digital certificates.

Abstract: Techniques are disclosed for provisioning device-specific credentials to an Internet of Things device that accesses a cloud-based IoT service. The IoT service receives, from the IoT device, a request for device-specific credentials. The request comprises a provisioning certificate including information identifying a group of devices associated with the IoT device. The provisioning certificate is authenticated by evaluating the information with expected information. The device-specific credentials are generated based, at least in part, on the information provided in the provisioning certificate. The device-specific credentials are sent to the IoT device, and the IoT device installs and activates the device-specific credentials. The device-specific credentials are associated with the IoT device in a registry of the IoT service.

Abstract: Blockchain blocks are provided with either or both of two element types that enable later verification of block validity. One element type is identifiers, such as signatures, of trusted validators that approve entry of the block into the blockchain. Another element is a history hash tree that encodes data from not only the current block, but also at least one previous block.

Abstract: Methods for distributed storage in accordance with embodiments of the invention enable secret sharing. One embodiment includes encoding source data using an encoding system to produce a plurality of sets of encoded data, where: the source data can be recovered from at least a portion of less than all of the plurality of sets of encoded data; and the source data cannot be recovered using less than a threshold number of the plurality of sets of encoded data; storing each of the plurality of sets of encoded data on a storage device from a set of storage devices on which encoded data is stored; determining a set of storage devices that are available using a decoding system, where the set of storage devices that are available does not include all of the storage devices in the set of storage devices on which encoded data is stored.

Abstract: A method is provided for generating a public/private key pair on an IC and to provision an IoT device having the IC. In the method, a first entity manufacturers an integrated circuit (IC) for use in a device. The IC, or chip, has a root secret embedded therein. A public key is generated on the IC using a unique identifier (ID) and the root secret. The IC is provided to a second entity for manufacturing the device using the IC. A reference IC is provided to a third entity. The reference IC has the same embedded root secret as the IC. The reference IC is configured to use the unique ID of the IC and the embedded root secret to generate a derived public key. The third entity is enabled to verify that the public key of the IC is associated with the unique ID by using the derived public key of the reference IC. The method allows the IoT device to be provisioned without using a public key infrastructure.

Abstract: Embodiments of the invention are directed to systems, methods and computer program products for enhanced detection of polymorphic malicious content within an entity. In this regard, the present invention receives information associated with an incidence of an electronic file; receives an first hash value of the electronic file from a first network device and a second hash value of the electronic file from a second network device; compares the first hash value with the second hash value; determines that the electronic file is polymorphic based on at least the match; initiates an execution of a quantum optimization algorithm using a quantum optimizer to determine one or more hash value states associated with the electronic file for a third network device; and initiates a control signal configured to store the one or more hash value states in a database associated with the third network device.

Abstract: Methods, systems, and computer programs are presented for creating a secure network fabric and for adding trusted devices to an existing secure network fabric. One method includes an operation for setting a switch into a provisioning mode where the switch does not enforce secure communications. While the switch is in provisioning mode, the method performs operations including establishing a connection from the switch to a provisioning controller, sending a certificate signing request (CSR) from the switch to the provisioning controller, and receiving, from the provisioning controller, a security certificate generated by a certificate authority. The method further includes an operation for entering a lockdown mode by the switch after receiving the security certificate, where the switch, while in lockdown mode, secures communications utilizing the security certificate.

Abstract: Provided are a computer program product, system, and method for using public keys provided by an authentication server to verify digital signatures. A plurality of public keys from a plurality of public-private key pairs and stored in a local key store. A request is received to access computational resources in the system. A challenge is returned in response to the request. A response to the challenge is received comprising a purported digitally signed challenge. A determination is made as to whether the purported digitally signed challenge is verified using a first public key of the public keys in the local key store. A determination is made as to whether the purported digitally signed challenge is verified using a second public key of the public keys in the local key store in response to determining that the first public key did not verify the purported digitally signed challenge.

Abstract: A technology is provided for certificate authentication for registering a certificate in computing service environment. A request may be received to register a certificate authority (CA) certificate. A registration token associated with a customer account in a service provider environment may be generated to enable association of the customer account with the CA certificate and to authenticate a registration of the CA certificate. The registration token may be sent to a requester desiring to register the CA certificate. A verification certificate that contains the registration token and that is signed by a certificate authority (CA) of the CA certificate and the CA certificate that is signed by the CA may be received to register the CA certificate with the customer account within a service provider environment The CA certificate is persisted with the service provider environment after verifying the registration token is associated with the customer account and the CA certificate is signed by the CA.

Abstract: An apparatus and method for operating a relational database (DB) are provided. The method includes determining a sensitivity classification for a column of a table in the DB, performing encryption, using a data encryption key (DEK), of sensitive data when writing the sensitive data to the column determined to be sensitive, performing decryption, using the DEK, of the encrypted sensitive data when reading the sensitive data from the column determined to be sensitive, and performing writing to the column and reading from the column of unencrypted non-sensitive data when the column is determined to be non-sensitive.

Abstract: This invention discloses a novel system and method for distributing electronic ticketing to mobile devices such that the ticket stored on the device is checked for its integrity from tampering and the device periodically reports on ticket usage with a central server.

Abstract: A digital certificate of a user is collected. A digest computation of a collecting result of the digital certificate is performed to generate a digital certificate digest of the user. The digital certificate digest is cached. In response to an operation of the user, a service request containing the cached digital certificate digest is transmitted to a service server such that when a service corresponding to the service request is a service for which the digital certificate needs to be verified, the service server executes the service when the verification passes through verification of the digital certificate digest. The techniques of the present disclosure execute the verification operation of the digital certificate along with specific service operations, which reduce the number of certificate verifications and the number of requests for executing the specific service.

Abstract: A mobile device may include at least one memory and a processor-cooperating with the at least one memory to enroll with an enterprise mobility management (EMM) server and store a plurality of different managed enterprise applications in the at least one memory, and receive and store a digital certificate associated with a given one of the managed enterprise applications in a secure shared location within the at least one memory. The processor may further run the plurality of managed enterprise applications to share access to the digital certificate from the secure shared location and generate and send encrypted data to another mobile device via the EMM server with all of the managed enterprise applications using the same digital certificate associated with the given managed enterprise application for encryption so that the EMM server is unable to decrypt the encrypted data.

Abstract: Examples of techniques for identifying external devices using a wireless network associated with a vehicle are disclosed. In one example implementation, a method includes initializing, by a processing system, an unsecure wireless network identified by a service set identifier (SSID). The method further includes receiving, by the processing system, a safety message from an external device external to a vehicle. The method further includes processing, by the processing system, the safety message to determine a location and a movement vector of the external device without performing a dynamic internet protocol address allocation to the external device. The method further includes alerting, by the processing system, an operator of the vehicle of the location and the movement vector of the external device.

Abstract: Disclosed are various embodiments for validating the identity of network sites. A communication session is established with a network site using a credential for the network site. A validation of the communication session is generated based at least in part upon a profile for the network site. The profile is derived from at least one previous communication session with the network site. An action is initiated in response to the validation when the validation indicates a discrepancy exists between the profile for the network site and the communication session with the network site.

Abstract: Embodiments are directed to sharing secure communication secrets with a network monitoring device (NMD). The NMD may passively monitor network packets communicated between client computers and server computers. If a secure communication session is established between a client computer and a server computer, a key provider may provide the NMD a session key that corresponds to the secure communication session. The NMD may buffer each network packet associated with the secure communication session until the NMD is provided a session key for the secure communication session. The NMD may use the session key to decrypt network packets communicated between the client computer and the server computer. The NMD may then proceed to analyze the secure communication session based on the contents of the decrypted network packets.

Abstract: Technology for communicating secure data from a sensor is disclosed. A data transfer device may comprise at least one sensor to generate sensor data and a security engine to generate a key. The data transfer device may also comprise a hardware interface to couple with the at least one sensor and receive the sensor data, and to generate a security signature using the key with the sensor data, and configured to send the sensor data combined with the security signature to a communication interface of a host device. The data transfer device may also comprise a security enclave configured to receive the key from the security engine and to send the key to an application layer of the host device.

Abstract: A method for importing and exporting configurations includes: generating a public key and a private key of a manufacturer; generating a certificate of the manufacturer; storing the certificate of the manufacturer in each of products; and signing a public key by using the private key of the manufacturer to generate a signature of the manufacturer; wherein the products receive the certificate of the manufacturer, at least one configuration and a signature of a customer which is generated by signing the at least one configuration by using a private key of the customer, as well as each products verifies the signature of the manufacturer in accordance with the stored certificate of the manufacturer, verifies the signature of the customer in accordance with the certificate of the manufacturer, and applies the at least one configuration when authenticated. A system for importing and exporting configurations is also provided.

Abstract: A system and method for identifying a phishing website is disclosed. Content associated with a website that a user is attempting to access is retrieved and translated into a format that a classifier can process. The classifier is trained to identify phishing attempts for a particular website or family of websites. The classifier processes the website to determine if the website is a phishing website. A scorer can determine the likelihood that the classifier classified the website correctly. If the website is determined to be a phishing website a protection component can deny access to the website. Otherwise the user can be permitted to access the website.

Abstract: Systems and methods described herein generally relate to storing and verifying data. In some embodiments, reference levels are generated according to time intervals, where the first reference level comprises a predetermined number of the time intervals, and where each of the time intervals of the remaining reference levels is comprised of a predetermined number of the time intervals of a previous reference level. Hashes of data can be created at the first reference level by performing a hashing function on the data in a time-sequenced manner. First reference level time interval hashes may be generated by performing the hashing function on the hashes of the data at each of the time intervals of the first reference level. Hashes for remaining reference level time intervals can be generated by performing the hashing function on the hashes of each of the time intervals of the previous reference level.

Abstract: A first digital identification document is transmitted from an identification authority to a mobile device of an identified individual. This first digital identification document is digitally signed and includes a set of attributes about the identified individual. In the same manner, a second digital identification document is also transmitted to the identified individual's mobile device. The second digital identification document is also digitally signed but includes a different set of attributes about the identified individual. The identified individual is then confronted by a series of challengers, wherein each challenger requires a different amount of information about the identified individual. Based on the identity of each challenger, the identified individual selects an appropriate identification document and transmits it to the applicable challenger's device.

Abstract: A method, system or computer usable program product for managing exchanges of sensitive data including utilizing a processor to request a service across a network from an application, the service requiring a disclosure of a first set of sensitive data by the application; providing a set of certified policy commitments regarding the first set of sensitive data to the application for a determination of acceptability; and upon a positive determination, receiving the service including the disclosure of the first set of sensitive data.

Abstract: A security chip and an application processor may be included in a device configured to engage in encrypted communications with an external client, including public key infrastructure communications, in an environment where a certificate authority is absent. The security chip may provide the application processor with a device public key from among a pair of device keys related to public key infrastructure communications, receive a request from the application processor to generate a digital signature on a certificate form including the device public key, provide the application processor with a digital signature generated based on an encryption operation using a certificate authority private key, and receive and store a certificate including the digital signature from the application processor.

Abstract: Examples for acceleration of online certificate status checking with an Internet hinting service are disclosed. For example, one method includes receiving, by a computing device from a hinting server, hint information comprising certificate information; receiving, from a remote computing device, a certificate in response to a request to establish secure communications with the remote computing device; and determining a validity of the certificate based on the certificate information.

Abstract: Systems and methods prevent fraudulent registration of devices associated with remuneration vehicles by bootstrapping the device to be registered with a bootstrap URL. The bootstrap URL may provide access to a registration server hosted by the vehicle provider. The vehicle provider may verify a single use of the bootstrap URL. Moreover, if access to the bootstrap URL is provided to the device, the vehicle provider may provide a server access communication to the device allowing the device and vehicle provider to set up a secure communication (even if communicating via an unsecure communication path). The secure communication may be used by the vehicle provider and the device to negotiate a symmetric communication key. At least the secure access communication and the symmetric communication key may operate based on one or more of an Elliptic Curve-, Diffie Hellman-, or Elliptic Curve Diffie Hellman (ECDH)-based secure connection scheme.

Abstract: A disclosed method includes operations of a control computer and interceptor computer. The control computer creates a certificate request and sends it to a certificate issuer, the certificate request created with an encrypted blob including a service private key S-PrK encrypted with an escrow server public key E-PuK. The control computer receives the certificate from the certificate issuer and provisions it to the service server along with S-PRK for use in secured communications with clients. The interceptor computer monitors session-establishment communications, e.g. a TLS handshake, between the service server and client to obtain the digital certificate, and retrieves the encrypted blob from the certificate and sends it to the escrow server. The escrow computer retrieves S-PrK by decrypting the encrypted blob using the escrow private key E-PrK, and returns S-PrK to the interceptor, where it is used to decrypt secure-session communications between the client and service server.

Abstract: In one aspect, a vehicle includes an engine, a drive train and chassis, a battery, a wireless transceiver, and a vehicle computing system that controls the engine, drive train, chassis, battery, and wireless transceiver. The vehicle computing system includes a cryptographic processor that has program instructions to communicate with a device separate from the vehicle to provide authentication information to the device via the wireless transceiver.

Abstract: A method executed by an Intermediary Node arranged between a Client and a Server for participating in the setting up of a connection between the Client and a Server is described. In response to intercepting a first message, the method transmits from the Client and destined for the Server, and requests for a connection to be set-up between the Client and the Server. The method recognizes, based on content of the received first message, that it is desirable for the Intermediary Node to perform at least one function on the requested connection, the Intermediary Node is transmitting a second message to the Client, comprising an identity of the Intermediary Node. This enables the Client to accept or reject the Intermediary Node as a node participating in the requested connection set-up.

Abstract: Techniques are disclosed for improving user experience of multimedia streaming over computer networks. More specifically, techniques presented herein reduce (or eliminate) latency in playback start time for streaming digital media content resulting from digital rights management (DRM) authorizations. A streaming media client (e.g., a browser, set-top box, mobile telephone or tablet “app”) may request a “fast-expiring” license for titles the streaming media client predicts a user is likely to begin streaming. A fast-expiring license is a DRM license (and associated decryption key) which is valid for only a very limited time after being used for playback. During the validity period of such a license, the client device requests a “normal” or “regular” license to continue accessing the title after the fast-expiring license expires.

Abstract: A system of testing updated software may include a cloud-based production environment. The system may also include a cloud-based testing environment. The system may also include a cloud-based production processing unit configured to receive in response to document, execute an initial software by inputting the document, and determine an initial software result and an initial software process based the document. The system may also include a cloud-based testing processing unit configured to receive the document, execute an updated software by inputting the document, and determine an updated software result and an updated software process based on the document. The system may also include a testing comparison unit configured to compare the initial software result and the updated software result, and compare the initial software process and the updated software process.

Abstract: The present disclosure provides a computer-readable medium, method and system for determining security vulnerabilities for a plurality of application programs used to provide television services to a customer device over a communications network. The method includes running a first scanning program against a first application program relating to a control panel for the customer device; running a second scanning program against a second application program that provides Internet content to the customer device; running a third scanning program against a third application program that relates to a component management system of customer premises equipment; and correlating security vulnerabilities identified utilizing the first, second, and third scanning programs.

Abstract: In a distributed system, data is shared between three or more electronic devices. The first device generates and signs an object that includes the data. A second device receives the signed object and determines whether the signed object is valid. If valid, the second device will generate a validated signed object and send it to a third device. The third device will validate the object by determining whether the object includes valid signatures of both the first and second devices.

Abstract: A mobile device may include at least one memory and a processor cooperating with the at least one memory to store a plurality of managed enterprise applications in the at least one memory, and receive and store a digital certificate in a secure shared location within the at least one memory. The processor may further cooperate with the at least one memory to run the plurality of managed enterprise applications to access the digital certificate from the secure shared location and generate and send encrypted data to another mobile device based upon the digital certificate.

Abstract: A method manages a care service by a terminal apparatus of a caregiver. The method includes recognizing a smart card of a patient, receiving encrypted data including encrypted time information from the smart card, the encrypted time information being generated at the smart card by encrypting time information corresponding to a point in time when the terminal apparatus recognizes the smart card, and transmitting the encrypted data to a management server. The encrypted data is generated by the smart card using an encryption key and decrypted by the management server using a decryption key corresponding to the encryption key. A time corresponding to time information acquired from the decrypted data is stored in the management server as a care service providing time.

Abstract: A method for dynamically managing spectrum access and supporting multiple tiers of users is provided. A spectrum access server receives a request from a device to access a segment of spectrum, and determines which tier of the multiple tiers is associated with the request. If the request is from a second tier user and the request does not interfere with first tier users, the request is granted. If the request is from a third tier user and the request does not interfere with first tier users and authorized second tier users, the request is granted.

Abstract: Virtual smart card system includes a virtual smart card server (VSS) which controls access to content respectively associated with a plurality of virtual smart cards. A remote client computer system includes a system level agent which establishes the client computer machine to the VSS as a trusted computer system. A user level agent at the client computer system responds to a request for a virtual smart card operation by causing the client computer system to obtain user authentication information, negotiate with the system level agent to obtain a cookie, and initiate a request to the VSS for the virtual smart card operation. The VSS will perform the virtual smart card operation provided that a security policy is satisfied and will communicate the results to the user level agent.

Abstract: A first digital identification document is transmitted from an identification authority to a mobile device of an identified individual. This first digital identification document is digitally signed and includes a set of attributes about the identified individual. In the same manner, a second digital identification document is also transmitted to the identified individual's mobile device. The second digital identification document is also digitally signed but includes a different set of attributes about the identified individual. The identified individual is then confronted by a series of challengers, wherein each challenger requires a different amount of information about the identified individual. Based on the identity of each challenger, the identified individual selects an appropriate identification document and transmits it to the applicable challenger's device.

Abstract: There is described a method of controlling application access to predetermined functions of a mobile device. The described method comprises (a) providing a set of keys, each key corresponding to one of the predetermined functions, (b) receiving an application from an application provider together with information identifying a set of needed functions, and (c) generating a signed application by signing the received application with each of the keys that correspond to one of the needed functions identified by the received information. There is also described a device for controlling application access and a system for controlling and authenticating application access. Furthermore, there is described a computer program and a computer program product.

Abstract: A method, system or computer usable program product for managing exchanges of sensitive data including utilizing a processor to request a service across a network from an application, the service requiring a disclosure of a first set of sensitive data by the application; providing a set of certified policy commitments regarding the first set of sensitive data to the application for a determination of acceptability; and upon a positive determination, receiving the service including the disclosure of the first set of sensitive data.

Abstract: Effecting reissue in a data processing system of a cryptographic credential certifying a set of attributes, the credential being initially bound to a first secret key stored in a first processing device. A backup token is produced using the first device and comprises a commitment to said set of attributes and proof data permitting verification that the set of attributes in said commitment corresponds to the set of attributes certified by said credential. At a second processing device, a second secret key is stored and blinded to produce a blinded key. A credential template token produced from the backup token and the blinded key is sent to a credential issuer where said verification is performed using the proof data and the credential template token is used to provide a reissued credential, certifying said set of attributes, to the second device, the reissued credential being bound to the second secret key.

Abstract: In one embodiment, a method includes receiving a request for the client device to access a communication network. The request includes data identifying the client device based on an intermediate device certificate signed by one or more of the computing devices. The method also includes associating the request with a user profile of a social-networking system; and granting the client device access to the communication network based at least in part on the association of the request to the user profile.

Abstract: Inherent terminal identification information and a terminal unique key are stored in an on-board terminal, and server-side terminal identification information and a server-side terminal unique key, which are same information as the above terminal identification information and terminal unique key are stored in a server. And, the on-board terminal transmits the terminal identification information to the server via a communication terminal, and the server performs terminal authentication according to the server-side terminal identification information, and if the authentication is success, transmits encrypted software for the on-board terminal of which authentication was success to the communication terminal.

Abstract: Disclosed are various embodiments for controlling access to resources in a network environment. Methods may include installing a profile on the device and installing a certificate included in or otherwise associated with the profile on the device. A request to execute an application, and/or access a resource using a particular application, is received and determination is made as to whether the certificate is installed on the device based on an identification of the certificate by the application. If the certificate is installed on the device, then execution of the application and/or access to the resource is allowed. If the certificate is not installed on the device, then the request for execution and/or access is refused.

Abstract: Disclosed is a method for providing a public key for authenticating an integrated circuit. In the method, the integrated circuit obtains a hardware key and an integrated circuit identifier. The integrated circuit generates a derived key based on the hardware key using a key derivation function (KDF) shared with a manufacturing machine. The integrated circuit generates a private key and a corresponding public key using the derived key as an input to a deterministic function. The integrated circuit then provides the public key and the integrated circuit identifier to a partner service for authentication of the integrated circuit using an anonymized credential database to be provided to the partner service by a manufacturer.

Abstract: Methods and apparatus are provided for performing an asymmetric key exchange between a vehicle and a first remote device. The method comprises storing predetermined cryptographic information on the vehicle, generating a first public key and a first private key that correspond to the vehicle, storing the first private key on the vehicle, and providing the first public key and descriptive data associated with the vehicle to a trusted entity, wherein the trusted entity is configured to store the first public key and the descriptive data in a location that is accessible to the first remote device.

Abstract: A device fingerprinting system provides an additional factor of authentication. A user device may be redirected, along with user ID parameters, to authentication system. The user device may be sent instructions to execute that collect and send back device characteristic information to the authentication system. The authentication can create a unique fingerprint of the device, and determine if the fingerprint has been seen before. If seen before, the authentication system may send back an authentication token indicating the additional factor of authentication was a success. If the fingerprint has not been seen previously, the authentication system may conduct a one-time password authentication as the additional factor. If successful, the fingerprint may be stored in association with the user device for future authentication as an additional factor.

Abstract: A secure boot method includes: obtaining a certificate digest at a digest processor from a write-once, always-on memory; calculating a flash digest using the digest processor by cryptographically processing a sensitive information image; and comparing, using the digest processor, the flash digest with the certificate digest.