569results about "Public key infrastructure trust models" patented technology

Techniques for updating certificate bundles may include receiving, at an entity associated with a virtual cloud network, a certificate bundle that includes an updated set of certificate authority (CA) certificates. The techniques may include applying a validation process to an entity certificate based on the certificate bundle, with the entity certificate having been issued to the entity prior to the entity receiving the certificate bundle. The validation process may include validating, by the entity, a certificate chain that includes the entity certificate and a CA certificate included in the updated set of CA certificates. The techniques may include, responsive to validating the certificate chain, installing the certificate bundle in a storage medium associated with the entity, and utilizing, by the entity, the certificate bundle to authenticate at least one additional entity associated with the virtual cloud network.

Procedures, methods, architectures, apparatuses, systems, devices, and computer program products for decentralized data control and access management. For example, a data owner may perform a subscription procedure to obtain verification credentials and an index (e.g., address, identifier) to public data control and access information. The data owner may perform a registration procedure to register ownership of data using the public data control and access information. The public data control and access information may include a public key. The public key is paired with a private trapdoor key to form a key pair. The data owner and a data consumer may perform an access procedure to grant access to registered data. For example, the registration procedure may verify collisions between a token hash, a data hash, and a data owner hash based on use of the key pair.

A method, system, and computer program product is provided for third-party authorization. The method includes generating an authorization code, encrypting the authorization code with a public key associated with a first system, resulting in an encrypted authorization code, transmitting the encrypted authorization code to the first system, receiving, from the first system, a digitally signed authorization code generated by the first system based on the authorization code and a private key corresponding to the public key associated with the first system, verifying the digitally signed authorization code based on the public key and the authorization code, and in response to verifying the digitally signed authorization code, transmitting an access token to the first system, wherein the access token is configured to authorize a user with the first system.

A method of authorizing a computer mouse to perform a particular action may include receiving, by a network device, a request associated with a particular action to be performed by a computer mouse. The request may be digitally signed using a private device key of the computer mouse. The method may include validating, by the network device, the digitally signed request using a public device key previously provided by the computer mouse. The method may include generating a response to the request. The response may indicate whether the computer mouse is authorized to perform the particular action associated with the trusted request. The method may include sending the response to a client device associated with the computer mouse.

A system and method (400, 600, 700, 900, 1100, 1200) of verifying an originator of an object using a biometric operation can include the steps of requesting (400, A) a biometric certificate from an enrollment service, capturing and receiving (400, C, D) a biometric reading associated with a user, transforming (400, E, F, G) the biometric reading into a format that can be made public, and creating (400, I, J) a user's certificate containing the public biometric data.

A server can receive a device public key and forward the device public key to a key server. The key server can perform a first elliptic curve Diffie-Hellman (ECDH) key exchange using the device public key and a network private key to derive a secret X1. The key server can send the secret X1 to the server. The server can derive an ECC PKI key pair and send to the device the server public key. The server can conduct a second ECDH key exchange using the derived server secret key and the device public key to derive a secret X2. The server can perform an ECC point addition using the secret X1 and secret X2 to derive a secret X3. The device can derive the secret X3 using (i) the server public key, a network public key, and the device private key and (ii) a third ECDH key exchange.

Systems and methods include, responsive to determining a user can access an application via a cloud-based system, wherein the application is in one of a public cloud, a private cloud, and an enterprise network, and wherein the user is remote over the Internet, obtaining a predetermined inspection profile for the user with the inspection profile including a plurality of rules evaluated in an order; performing inspection of the access using the plurality of rules in the order; and responsive to results of any of the plurality of rules, one or more of monitoring, allowing, blocking, and redirecting the access, via the cloud-based system.

Systems and methods for implementing a service identity platform with cloud-based Public Key Infrastructure (PKI) include providing security as a service via a cloud-based system for a plurality of tenants, wherein the cloud-based system includes a plurality of components communicatively coupled and adapted to communicate with one another based on mutual Transport Layer Security (mTLS) authentication; responsive to a new component requiring deployment within the cloud-based system, performing an enrollment process for the new component; and subsequent to the enrollment process, utilizing the new component within the cloud-based system for providing security as a service.

A central server configured with an Attribute Authority (“AA”) acting as a Trusted Third Party mediating service provider and using X.509-compatible PKI and PMI, VPN technology, device-side thin client applications, security hardware (HSM, Network), cloud hosting, authentication, Active Directory and other solutions. This ecosystem results in real time management of credentials, identity profiles, communication lines, and keys. It is not centrally managed, rather distributes rights to users. Using its Inviter-Invitee protocol suite, Inviters vouch for the identity of Invitees who successfully complete the protocol establishing communication lines. Users establish and respond to authorization requests and other real-time verifications pertaining to accessing each communication line (not end point) and sharing encrypted digital files. These are auditable, brokered, trusted-relationships where such relationships / digital agreements can each stand-alone (for privacy) or can leverage build-up of identity confidence levels across relationships. The service is agnostic to how encrypted user content is transported or stored.

Systems, methods, computer products for associating a blockchain address with a network identifier enable operations that may include: receiving, over a computer network and by a network identifier infrastructure operator, a request for a registration status of the network identifier; retrieving, by the network identifier infrastructure operator, an association of the network identifier with the blockchain address; signing, by a private key of a key pair of the network identifier infrastructure operator, the association of the network identifier with the blockchain address, which produces a signed association of the network identifier with the blockchain address; and providing, over the computer network and by the network identifier infrastructure operator, the signed association of the network identifier with the blockchain address.

A method, system, and apparatus for managing digital certificates, managing a certificate authority (CA), and cross-referencing CA hierarchies. The method includes receiving, by a processor of a CA computing system, at least one of a digital certificate generation request and a digital certificate revocation from a user via a user computing device, the digital certificate generation request including a user public key and a user identity. The method further includes generating a digital certificate for the user and signing the digital certificate with a CA private key, wherein the CA private key is associated with a known CA public key. The method further includes publishing the digital certificate signed with the CA private key to a digital certificate blockchain, determining a certificate status of the digital certificate, and publishing an update to the digital certificate blockchain to reflect the certificate status of the digital certificate.

This document describes systems and techniques for using secure MPC to select digital components in ways that preserve user privacy and protects the security of data of each party that is involved in the selection process. In one aspect, a method includes obtaining, by a first computer of a secure multi-party computation (MPC) system, at least a first share of a set of contextual properties of an environment in which a selected digital component will be displayed at a client device. For each digital component in a set of digital components, at least a first share of an eligibility expression that defines a relationship between a set of eligibility criteria for the digital component is obtained. A determination is made, based on the at least first share of the set of contextual properties and the at least first share of the eligibility expression, a first share of an eligibility parameter.

An OTA security update method and system for intelligent connected vehicles are provided. The method includes: the downloaded software update packet from a CDN to UC-master is decrypted, and verified for the first time through signature verification; for the secondary verification, decomposing a current software update packet into a plurality of sub-packets; calculating HASH values of the sub-packets in sequence; thereafter, constructing a Merkle tree according to these HASH values; calculating a root HASH value of the Merkle tree; after the sub-packets are transferred from a UC-master to ECU-UAs through a gateway or a domain controller, recalculating the HASH values of the sub-packets; reconstructing the Merkle tree according to these HASH values; recalculating the root HASH value of the Merkle tree; comparing the two HASH values; if they are equal, starting a normal update procedure; otherwise, terminating this OTA update by the UC-master immediately.

Techniques to enable implementation within a network infrastructure of a network operator (550, 560) comprising the following steps: • providing and / or creating a Decentralised Identifier "DID", a private key, a public key and verifiable credentials "VC" for the network element (200, 425, 530, 810); • binding the VC to the DID resulting in a DID-bound VC (205) and add a digital signature of an issuer to the DID-bound VC (205); • providing the DID-bound VC and the private key to the network element (200, 425, 530, 810).

A module with an embedded universal integrated circuit card (eUICC) can include a received eUICC profile and a set of cryptographic algorithms. The received eUICC profile can include an initial shared secret key for authentication with a wireless network. The module can receive a key K network token and send a key K module token to the wireless network. The module can use the key K network token, a derived module private key, and a key derivation function to derive a secret shared network key K that supports communication with the wireless network. The wireless network can use the received key K module token, a network private key, and the key derivation function in order to derive the same secret shared network key K derived by the module. The module and the wireless network can subsequently use the mutually derived key K to communicate using traditional wireless network standards.

A method in a secure element, SE, for generating at least one symmetric key and / or one SE-specific cryptographic key pair for creating and transmitting a response to an identity query, including a GET IDENTITY command, transmitted by a network. The invention additionally relates to an SE, a computer program product and a system comprising an SE and a network.

According to one embodiment, a system receives, at a host system from a data processing (DP) accelerator, an accelerator identifier (ID) that uniquely identifies the DP accelerator), wherein the host system is coupled to the DP accelerator over a bus. The system transmits the accelerator ID to a predetermined trusted server over a network. The system receives a certificate from the predetermined trusted server over the network, the certificate certifying the DP accelerator. The system extracts a public root key (PK_RK) from the certificate for verification, the PK_RK corresponding to a private root key (SK_RK) associated with the DP accelerator. The system establishes a secure channel with the DP accelerator using the PK_RK based on the verification to exchange data securely between the host system and the DP accelerator.

A network is described. The network is a peer-to-peer network of nodes. The nodes maintain a distributed ledger. The distributed ledger includes a list of transactions. The list of transactions includes various transactions for maintaining a decentralized root store between the nodes. The decentralized root store includes a list of certificate authorities which are trusted by the nodes in the network. The root certificates may be retrieved from the distributed ledger, validated, and then used to access the certificate authorities.

The invention discloses an end-cloud cooperation privacy protection method based on homomorphic encryption and additive secret sharing, which comprises the following steps: a terminal device receives an image sent by a user, extracts image features locally, splits the image features into two parts by using additive secret sharing, stores one part locally, and sends the other part to a weight having a model; and a biased cloud server. And the terminal equipment and the cloud server execute a hierarchical encryption protocol, the number of layers of the model is divided, the previous layer is calculated on the terminal equipment by using a parameter encryption method, and the remaining layer is calculated by the cloud server by using a data encryption method. And the terminal equipment receives a calculation result after the cloud server data encryption method, and combines the calculation results of terminal equipment parameter encryption to obtain a reasoning result. According to the method, the data privacy leakage risk can be efficiently reduced, the inference efficiency is improved, and the communication overhead is reduced.

A network can operate a WiFi access point with credentials. An unconfigured device can (i) support a Device Provisioning Protocol (DPP), (ii) record responder bootstrap public and private keys, and (iii) be marked with a tag. The network can record initiator bootstrap public and private keys, as well as derived initiator ephemeral public and private keys. An initiator can (i) operate a DPP application, (ii) read the tag, (iii) establish a secure and mutually authenticated connection with the network, and (iv) send the network data within the tag. The network can record the responder bootstrap public key and derive an encryption key with the (i) recorded responder bootstrap public key and (ii) derived initiator ephemeral private key. The network can encrypt credentials using the derived encryption key and send the encrypted credentials to the initiator, which can forward the encrypted credentials to the device, thereby supporting a device configuration.

A system for processing digital signatures includes a sender device and a receiver device. The sender device encrypts a plaintext message and transmits an encrypted ciphertext message to the receiver device. The receiver device receives and decrypts the encrypted ciphertext message into a coded plaintext message, which is then decoded to output a readable plaintext message to the receiver device substantially corresponding to the plaintext message at the sender device. The sender and receiver devices are in communication with a certificate authority of a public key infrastructure configured to generate a keypair including a public key and a private key. The sender encrypts the plaintext message, and the receiver device decrypts the encrypted ciphertext message, using a common coding scheme that is configured for a document containing the public key.

A network can operate a WiFi access point with credentials. An unconfigured device can (i) support a Device Provisioning Protocol (DPP), (ii) record responder bootstrap public and private keys, and (iii) be marked with a tag. The network can record initiator bootstrap public and private keys, as well as derived initiator ephemeral public and private keys. An initiator can (i) operate a DPP application, (ii) read the tag, (iii) establish a secure and mutually authenticated connection with the network, and (iv) send the network data within the tag. The network can record the responder bootstrap public key and derive an encryption key with the (i) recorded responder bootstrap public key and (ii) derived initiator ephemeral private key. The network can encrypt credentials using the derived encryption key and send the encrypted credentials to the initiator, which can forward the encrypted credentials to the device, thereby supporting a device configuration.

A system, for controlling well site operations, comprising a machine learning engine, a predictive engine, a node system stack, and a blockchain. The learning engine includes a machine learning algorithm, an algorithmically generated earth model, and control variables. The learning algorithm generates a trained data model using the algorithmically generated earth model. The predictive engine includes an Artificial Intelligence (AI) algorithm. The AI algorithm generates a trained AI algorithm using the trained data model and earth model variables using the trained AI algorithm. The system stack is communicable coupled to the predictive engine, the learning engine, the blockchain, sensors, and a machine controller. The blockchain having a genesis block and a plurality of subsequent blocks. Each subsequent block comprising a well site entry and a hash of a previous entry. The well site entry comprises transacted operation control variables. The transacted variables are based on the generated earth model variables.

A module with an embedded universal integrated circuit card (eUICC) can include a received eUICC profile and a set of cryptographic algorithms. The received eUICC profile can include an initial shared secret key for authentication with a wireless network. The module can receive a key K network token and send a key K module token to the wireless network. The module can use the key K network token, a derived module private key, and a key derivation function to derive a secret shared network key K that supports communication with the wireless network. The wireless network can use the received key K module token, a network private key, and the key derivation function in order to derive the same secret shared network key K derived by the module. The module and the wireless network can subsequently use the mutually derived key K to communicate using traditional wireless network standards.

Techniques for signing internet data are disclosed. The techniques include accessing a plurality of internet data records. The techniques also include generating, using at least one electronic processor, leaf nodes from the plurality of internet data records, and constructing a recursive hash tree from the plurality of leaf nodes. The techniques also include deriving information sufficient to validate the root node, and publishing, in an internet public key infrastructure (PKI) as a synthesized public key, the information sufficient to validate the root node. The techniques also include providing, through the internet and as a signature on at least one of the plurality of internet data records, validation data including sibling path data from the recursive hash tree, such that an internet client validates the at least one of the internet data records using at least the validation data and the synthesized public key.

A system and method provide a hybrid communication scheme that achieves high communication rates with post-quantum computational security guarantees. Messages to be securely communicated are first mixed using an individually secure encoding, such as a linear network code, and some of the encoded messages are further encrypted. The encrypted and unencrypted messages are sent via different communications channels. Each unencrypted message becomes almost as secure as the encrypted messages because of the pre-mixing, since decoding any one of the messages requires all of the messages, including the encrypted messages. Thus, a very few encrypted messages may be used, allowing the rate of communication to approach one as the number of channels increases. This is particularly beneficial when a classical public-key cryptosystem can only be used in part of the data transmitted or stored, in the presence of noisy channels, in distributed data storage, and other applications.

An issuing authority (IA) may validate the identity of a user and issue a digital license to the user. IA may generate IA public-private key pair, and provide IA public key to the certification authority (CA). IA may sign the digital license with IA private key, and provision the signed digital license on the user device. IA may request CA to certify the digital license. CA may use IA public key to validate the digital license, and sign IA public key with CA private key, thereby generating a digital certificate associated with the issuing authority that is linked to the digital license. A relying party may use CA public key to validate the digital license. The relying party can retrieve the information from the digital license and trust that the retrieved information is legitimate.

The present application relates to messaging between instances of a microservice in a decentralized architecture. A computer device hosting an instance may include a memory storing instructions to operate a microservice and a processor. The instance receives a message for the microservice from another instance of the microservice, the message including a branch of a hash tree with at least a block for a root hash of a central node, one or more blocks for intermediate nodes, and a leaf block including message content. The instance places at least the leaf block into a local hash tree based on the branch of the hash tree. The instance verifies an integrity and an order of the message based on the root hash and the location of the leaf block in the local hash tree. The instance acts on the message content in response to verifying the integrity and the order.

A homomorphic encryption operation key management system receives a public key and a hierarchical Galois key from a client device, verifies validity of a token in response to receiving the token and a request for a homomorphic encryption operation key for the client device from a server, and generates the homomorphic encryption operation key using the public key and the hierarchical Galois key and transmits the homomorphic encryption operation key to the server when the token is valid.