404results about "Public key infrastructure trust models" patented technology

Procedures, methods, architectures, apparatuses, systems, devices, and computer program products for decentralized data control and access management. For example, a data owner may perform a subscription procedure to obtain verification credentials and an index (e.g., address, identifier) to public data control and access information. The data owner may perform a registration procedure to register ownership of data using the public data control and access information. The public data control and access information may include a public key. The public key is paired with a private trapdoor key to form a key pair. The data owner and a data consumer may perform an access procedure to grant access to registered data. For example, the registration procedure may verify collisions between a token hash, a data hash, and a data owner hash based on use of the key pair.

A method of authorizing a computer mouse to perform a particular action may include receiving, by a network device, a request associated with a particular action to be performed by a computer mouse. The request may be digitally signed using a private device key of the computer mouse. The method may include validating, by the network device, the digitally signed request using a public device key previously provided by the computer mouse. The method may include generating a response to the request. The response may indicate whether the computer mouse is authorized to perform the particular action associated with the trusted request. The method may include sending the response to a client device associated with the computer mouse.

A system and method (400, 600, 700, 900, 1100, 1200) of verifying an originator of an object using a biometric operation can include the steps of requesting (400, A) a biometric certificate from an enrollment service, capturing and receiving (400, C, D) a biometric reading associated with a user, transforming (400, E, F, G) the biometric reading into a format that can be made public, and creating (400, I, J) a user's certificate containing the public biometric data.

A server can receive a device public key and forward the device public key to a key server. The key server can perform a first elliptic curve Diffie-Hellman (ECDH) key exchange using the device public key and a network private key to derive a secret X1. The key server can send the secret X1 to the server. The server can derive an ECC PKI key pair and send to the device the server public key. The server can conduct a second ECDH key exchange using the derived server secret key and the device public key to derive a secret X2. The server can perform an ECC point addition using the secret X1 and secret X2 to derive a secret X3. The device can derive the secret X3 using (i) the server public key, a network public key, and the device private key and (ii) a third ECDH key exchange.

Systems and methods include, responsive to determining a user can access an application via a cloud-based system, wherein the application is in one of a public cloud, a private cloud, and an enterprise network, and wherein the user is remote over the Internet, obtaining a predetermined inspection profile for the user with the inspection profile including a plurality of rules evaluated in an order; performing inspection of the access using the plurality of rules in the order; and responsive to results of any of the plurality of rules, one or more of monitoring, allowing, blocking, and redirecting the access, via the cloud-based system.

Systems and methods for implementing a service identity platform with cloud-based Public Key Infrastructure (PKI) include providing security as a service via a cloud-based system for a plurality of tenants, wherein the cloud-based system includes a plurality of components communicatively coupled and adapted to communicate with one another based on mutual Transport Layer Security (mTLS) authentication; responsive to a new component requiring deployment within the cloud-based system, performing an enrollment process for the new component; and subsequent to the enrollment process, utilizing the new component within the cloud-based system for providing security as a service.

Systems, methods, computer products for associating a blockchain address with a network identifier enable operations that may include: receiving, over a computer network and by a network identifier infrastructure operator, a request for a registration status of the network identifier; retrieving, by the network identifier infrastructure operator, an association of the network identifier with the blockchain address; signing, by a private key of a key pair of the network identifier infrastructure operator, the association of the network identifier with the blockchain address, which produces a signed association of the network identifier with the blockchain address; and providing, over the computer network and by the network identifier infrastructure operator, the signed association of the network identifier with the blockchain address.

A method, system, and apparatus for managing digital certificates, managing a certificate authority (CA), and cross-referencing CA hierarchies. The method includes receiving, by a processor of a CA computing system, at least one of a digital certificate generation request and a digital certificate revocation from a user via a user computing device, the digital certificate generation request including a user public key and a user identity. The method further includes generating a digital certificate for the user and signing the digital certificate with a CA private key, wherein the CA private key is associated with a known CA public key. The method further includes publishing the digital certificate signed with the CA private key to a digital certificate blockchain, determining a certificate status of the digital certificate, and publishing an update to the digital certificate blockchain to reflect the certificate status of the digital certificate.

An OTA security update method and system for intelligent connected vehicles are provided. The method includes: the downloaded software update packet from a CDN to UC-master is decrypted, and verified for the first time through signature verification; for the secondary verification, decomposing a current software update packet into a plurality of sub-packets; calculating HASH values of the sub-packets in sequence; thereafter, constructing a Merkle tree according to these HASH values; calculating a root HASH value of the Merkle tree; after the sub-packets are transferred from a UC-master to ECU-UAs through a gateway or a domain controller, recalculating the HASH values of the sub-packets; reconstructing the Merkle tree according to these HASH values; recalculating the root HASH value of the Merkle tree; comparing the two HASH values; if they are equal, starting a normal update procedure; otherwise, terminating this OTA update by the UC-master immediately.

Techniques to enable implementation within a network infrastructure of a network operator (550, 560) comprising the following steps: • providing and / or creating a Decentralised Identifier "DID", a private key, a public key and verifiable credentials "VC" for the network element (200, 425, 530, 810); • binding the VC to the DID resulting in a DID-bound VC (205) and add a digital signature of an issuer to the DID-bound VC (205); • providing the DID-bound VC and the private key to the network element (200, 425, 530, 810).

A method in a secure element, SE, for generating at least one symmetric key and / or one SE-specific cryptographic key pair for creating and transmitting a response to an identity query, including a GET IDENTITY command, transmitted by a network. The invention additionally relates to an SE, a computer program product and a system comprising an SE and a network.

According to one embodiment, a system receives, at a host system from a data processing (DP) accelerator, an accelerator identifier (ID) that uniquely identifies the DP accelerator), wherein the host system is coupled to the DP accelerator over a bus. The system transmits the accelerator ID to a predetermined trusted server over a network. The system receives a certificate from the predetermined trusted server over the network, the certificate certifying the DP accelerator. The system extracts a public root key (PK_RK) from the certificate for verification, the PK_RK corresponding to a private root key (SK_RK) associated with the DP accelerator. The system establishes a secure channel with the DP accelerator using the PK_RK based on the verification to exchange data securely between the host system and the DP accelerator.

A network can operate a WiFi access point with credentials. An unconfigured device can (i) support a Device Provisioning Protocol (DPP), (ii) record responder bootstrap public and private keys, and (iii) be marked with a tag. The network can record initiator bootstrap public and private keys, as well as derived initiator ephemeral public and private keys. An initiator can (i) operate a DPP application, (ii) read the tag, (iii) establish a secure and mutually authenticated connection with the network, and (iv) send the network data within the tag. The network can record the responder bootstrap public key and derive an encryption key with the (i) recorded responder bootstrap public key and (ii) derived initiator ephemeral private key. The network can encrypt credentials using the derived encryption key and send the encrypted credentials to the initiator, which can forward the encrypted credentials to the device, thereby supporting a device configuration.

A network can operate a WiFi access point with credentials. An unconfigured device can (i) support a Device Provisioning Protocol (DPP), (ii) record responder bootstrap public and private keys, and (iii) be marked with a tag. The network can record initiator bootstrap public and private keys, as well as derived initiator ephemeral public and private keys. An initiator can (i) operate a DPP application, (ii) read the tag, (iii) establish a secure and mutually authenticated connection with the network, and (iv) send the network data within the tag. The network can record the responder bootstrap public key and derive an encryption key with the (i) recorded responder bootstrap public key and (ii) derived initiator ephemeral private key. The network can encrypt credentials using the derived encryption key and send the encrypted credentials to the initiator, which can forward the encrypted credentials to the device, thereby supporting a device configuration.

A system, for controlling well site operations, comprising a machine learning engine, a predictive engine, a node system stack, and a blockchain. The learning engine includes a machine learning algorithm, an algorithmically generated earth model, and control variables. The learning algorithm generates a trained data model using the algorithmically generated earth model. The predictive engine includes an Artificial Intelligence (AI) algorithm. The AI algorithm generates a trained AI algorithm using the trained data model and earth model variables using the trained AI algorithm. The system stack is communicable coupled to the predictive engine, the learning engine, the blockchain, sensors, and a machine controller. The blockchain having a genesis block and a plurality of subsequent blocks. Each subsequent block comprising a well site entry and a hash of a previous entry. The well site entry comprises transacted operation control variables. The transacted variables are based on the generated earth model variables.

A module with an embedded universal integrated circuit card (eUICC) can include a received eUICC profile and a set of cryptographic algorithms. The received eUICC profile can include an initial shared secret key for authentication with a wireless network. The module can receive a key K network token and send a key K module token to the wireless network. The module can use the key K network token, a derived module private key, and a key derivation function to derive a secret shared network key K that supports communication with the wireless network. The wireless network can use the received key K module token, a network private key, and the key derivation function in order to derive the same secret shared network key K derived by the module. The module and the wireless network can subsequently use the mutually derived key K to communicate using traditional wireless network standards.

Techniques for signing internet data are disclosed. The techniques include accessing a plurality of internet data records. The techniques also include generating, using at least one electronic processor, leaf nodes from the plurality of internet data records, and constructing a recursive hash tree from the plurality of leaf nodes. The techniques also include deriving information sufficient to validate the root node, and publishing, in an internet public key infrastructure (PKI) as a synthesized public key, the information sufficient to validate the root node. The techniques also include providing, through the internet and as a signature on at least one of the plurality of internet data records, validation data including sibling path data from the recursive hash tree, such that an internet client validates the at least one of the internet data records using at least the validation data and the synthesized public key.

A system and method provide a hybrid communication scheme that achieves high communication rates with post-quantum computational security guarantees. Messages to be securely communicated are first mixed using an individually secure encoding, such as a linear network code, and some of the encoded messages are further encrypted. The encrypted and unencrypted messages are sent via different communications channels. Each unencrypted message becomes almost as secure as the encrypted messages because of the pre-mixing, since decoding any one of the messages requires all of the messages, including the encrypted messages. Thus, a very few encrypted messages may be used, allowing the rate of communication to approach one as the number of channels increases. This is particularly beneficial when a classical public-key cryptosystem can only be used in part of the data transmitted or stored, in the presence of noisy channels, in distributed data storage, and other applications.

An issuing authority (IA) may validate the identity of a user and issue a digital license to the user. IA may generate IA public-private key pair, and provide IA public key to the certification authority (CA). IA may sign the digital license with IA private key, and provision the signed digital license on the user device. IA may request CA to certify the digital license. CA may use IA public key to validate the digital license, and sign IA public key with CA private key, thereby generating a digital certificate associated with the issuing authority that is linked to the digital license. A relying party may use CA public key to validate the digital license. The relying party can retrieve the information from the digital license and trust that the retrieved information is legitimate.

The present application relates to messaging between instances of a microservice in a decentralized architecture. A computer device hosting an instance may include a memory storing instructions to operate a microservice and a processor. The instance receives a message for the microservice from another instance of the microservice, the message including a branch of a hash tree with at least a block for a root hash of a central node, one or more blocks for intermediate nodes, and a leaf block including message content. The instance places at least the leaf block into a local hash tree based on the branch of the hash tree. The instance verifies an integrity and an order of the message based on the root hash and the location of the leaf block in the local hash tree. The instance acts on the message content in response to verifying the integrity and the order.

A homomorphic encryption operation key management system receives a public key and a hierarchical Galois key from a client device, verifies validity of a token in response to receiving the token and a request for a homomorphic encryption operation key for the client device from a server, and generates the homomorphic encryption operation key using the public key and the hierarchical Galois key and transmits the homomorphic encryption operation key to the server when the token is valid.

The invention discloses a routing source verification deployment recommendation method and system based on routing betweenness, and the method comprises the steps: S1, constructing an Internet routing system knowledge graph model through employing a routing data set disclosed in a network; s2, selecting an analyzed route prefix, obtaining a route propagation range based on the model, and constructing a network service sub-graph; s3, based on the network service sub-graph, simulating various prefix hijacking scenes in combination with routing information provided by the knowledge graph; and S4, giving a whole network routing source verification deployment recommendation scheme for protecting the network service subgraph by using a recommendation algorithm based on routing betweenness. The system is used for executing the method. The method has the advantages of simple principle, wide application range, good effect and the like.

A secure transfer system where a wallet is generated utilising a public and private key pair; whereby the private key of the key pair is encrypted; whereby the public key of the key pair and the encryption key for the private key are given to a party to a transaction; and the other party receives the encrypted private key and the public key of the transfer wallet; where a copy of the encrypted private key, the public key and the encryption key used to encrypt the private key are placed in storage. Also described is a multi sig implementation.

In a client-server model for generating a rotation operation key in fully homomorphic encryption, a client transmits a public key and a hierarchical Galois key generated using a secret key to a server, and the server performs a rotation operation on the public key using the hierarchical Galois key to directly generate one or more rotation operation keys, so that the server may generate a rotation operation key if necessary while computational burden and communication cost of the client are reduced.

A method for issuing one or more certificates to a substrate instance of a cloud environment is disclosed. The method includes performing a first fetch to obtain one or more of: (i) an identifier of a compartment that includes the substrate instance, or (ii) an identifier of the substrate instance. The method further includes performing a second fetch to obtain an identifier of a tenancy that includes the substrate instance, based at least in part on one or more of: (i) the identifier of the compartment identified from the first fetch, or (ii) the identifier of the substrate instance identified from the first fetch. The method further includes issuing a principal certificate to the substrate instance, the principal certificate including the identifier of the tenancy that includes the substrate instance.

The invention relates to a vehicle gauge chip PKI verification system and verification method based on UVM and python, because a PKI module supports large number operation, systemverilog cannot directly realize large number complex operation, and the large number can only be divided into decimal numbers for operation through a specific algorithm, after research in the scheme, a UVM verification platform and a python platform are determined to be combined, so that the verification efficiency of the vehicle gauge chip PKI verification system is improved, and the verification efficiency of the vehicle gauge chip PKI verification system is improved. Therefore, a special python reference model is compiled by ingeniously utilizing the characteristic that a python platform can directly perform large number operation, the configuration data in the UVM simulation log file is continuously monitored through the monitoring thread script, the configuration data does not need to be written into an intermediate file in a UVM verification environment, then the intermediate file is read by the python reference model for handshake, and the operation efficiency is improved. Therefore, the verification efficiency is effectively improved, and complete verification of the PKI (algorithm) module is efficiently realized.

Systems and methods include, connecting to a first service edge node in a cloud-based system and obtaining one or more addresses each for one or more service edge nodes in the cloud-based system, wherein the one or more service edge nodes include public service edge nodes and private service edge nodes; connecting to a second service edge node of the one or more service edge nodes using the corresponding address; providing a request for an application to the second service edge node; and responsive to policy and accessibility determined via the cloud-based system, receiving access to the application via a connector adjacent to the application.

Examples described herein provide a computer-implemented method that includes receiving, at a token generation service, a contract token request from a data non-owner, the contract token request indicating a condition of an agreement between the data non-owner and a data owner that owns data stored in a data storage system. The method further includes generating, by the token generation service, a contract token based on the contract token request, the contract token including an attribute that defines the condition of the agreement between the data non-owner and the data owner. The data storage system enables the data owner to execute an operation on the data based at least in part on the contract token.

A system for managing well site operations comprising a well site operations module, a chain of blocks of a distributed network, and a sensor bank and control module. The operations module generates earth model variables using a physics model, well log variables or seismic variables, or both, and a trained AI / ML algorithmic model. The chain of blocks comprises a plurality of subsequent blocks. Each subsequent block comprises a well site entry and a hash value of a previous well site entry. A well site entry comprises transacted operation control variables. The well site operations module generates production operation control variables or development operation control variables from earth model variables. The well site entry can also include transacted earth model variables and sensor variables. The sensor bank and control module provides well log variables and the operations module couples control variables to the control module to control well site equipment.