A method for key rotation includes initiating key rotation for a user account of a multi-factor authentication platform enabling one-time password authentication using a first symmetric cryptographic key; generating, at an authenticating device, a second symmetric cryptographic key; transmitting, at the authenticating device, the second symmetric cryptographic key to the multi-factor authentication platform; configuring the multi-factor authentication platform and the authenticating device to disable authentication that uses the first symmetric cryptographic key; and configuring the multi-factor authentication platform and the authenticating device to enable authentication that uses the second symmetric cryptographic key.

The present disclosure relates to the field of computer technologies and it discloses a method for encrypting a picture performed at a sending device, the method including: obtaining, by a sending device raw data of a to-be-encrypted picture, a first key, a second key, and location information that is used for adding disturbance data to the raw data; generating the disturbance data, and adding the disturbance data to the raw data according to the location information, to obtain first data; encrypting the first data by using the first key, to obtain the second data, and encrypting the first key and the length of the disturbance data by using the second key, to obtain first encrypted data; and sending the second data, the first encrypted data, and the second key to a receiving device.

The present disclosure relates to the field of computer technologies and it discloses a method for encrypting a picture performed at a sending device, the method including: obtaining, by a sending device raw data of a to-be-encrypted picture, a first key, a second key, and location information that is used for adding disturbance data to the raw data; generating the disturbance data, and adding the disturbance data to the raw data according to the location information, to obtain first data; encrypting the first data by using the first key, to obtain the second data, and encrypting the first key and the length of the disturbance data by using the second key, to obtain first encrypted data; and sending the second data, the first encrypted data, and the second key to a receiving device.

At a transmitter node, a commitment value C is obtained as a function of a message m. The commitment value C and transmitter terms of use T.sup.A for the message m are then sent to a receiver node without disclosing the message m. A cryptographic receiver signature S.sub.B over the commitment value C and the transmitter terms of use T.sup.A is received from the receiver node, where the cryptographic receiver signature S.sub.B is signed with a private key kprv-B associated with the receiver node. The receiver signature S.sub.B may be authenticated using a public key kpuh-B for the receiver node. If the receiver signature S.sub.B is successfully authenticated, the message m and the receiver signature S.sub.B are signed using a private key kprv-A for the transmitter node to obtain a transmitter signature S.sub.A. The message m and the transmitter signature S.sub.A may then be sent to the receiver node.

At a transmitter node, a commitment value C is obtained as a function of a message m. The commitment value C and transmitter terms of use T.sup.A for the message m are then sent to a receiver node without disclosing the message m. A cryptographic receiver signature S.sub.B over the commitment value C and the transmitter terms of use T.sup.A is received from the receiver node, where the cryptographic receiver signature S.sub.B is signed with a private key kprv-B associated with the receiver node. The receiver signature S.sub.B may be authenticated using a public key kpuh-B for the receiver node. If the receiver signature S.sub.B is successfully authenticated, the message m and the receiver signature S.sub.B are signed using a private key kprv-A for the transmitter node to obtain a transmitter signature S.sub.A. The message m and the transmitter signature S.sub.A may then be sent to the receiver node.

A multi-phase boot operation of a virtualization manager at a virtualization host is initiated at an offload card. In a first phase of the boot, a security key stored in a tamper-resistant location of the offload card is used. In a second phase, firmware programs are measured using a security module, and a first version of a virtualization coordinator is instantiated at the offload card. The first version of the virtualization coordinator obtains a different version of the virtualization coordinator and launches the different version at the offload card. Other components of the virtualization manager (such as various hypervisor components that do not run at the offload card) are launched by the different version of the virtualization controller.

A multi-phase boot operation of a virtualization manager at a virtualization host is initiated at an offload card. In a first phase of the boot, a security key stored in a tamper-resistant location of the offload card is used. In a second phase, firmware programs are measured using a security module, and a first version of a virtualization coordinator is instantiated at the offload card. The first version of the virtualization coordinator obtains a different version of the virtualization coordinator and launches the different version at the offload card. Other components of the virtualization manager (such as various hypervisor components that do not run at the offload card) are launched by the different version of the virtualization controller.

As disclosed herein a computer system for secure database backup and recovery in a secure database network has N distributed data nodes. The computer system includes program instructions that include instructions to receive a database backup file, fragment the file using a fragment engine, and associate each fragment with one node, where the fragment is not stored on the associated node. The program instructions further include instructions to encrypt each fragment using a first encryption key, and store, randomly, encrypted fragments on the distributed data nodes. The program instructions further include instructions to retrieve the encrypted fragments, decrypt the encrypted fragments using the first encryption key, re-encrypt the decrypted fragments using a different encryption key, and store, randomly, the re-encrypted fragments on the distributed data nodes. A computer program product and method corresponding to the above computer system are also disclosed herein.

Methods, systems, storage media for authentication are described. On the methods includes receiving, at a smart contract on a distributed ledger, a signed authentication challenge. The method includes verifying the identity of the user who signed authentication challenge. The method includes raising an event that indicates that the user has been authenticated; wherein a server listens for events from the smart contract, and associates a session between the browser and the server with the user based on the event.

Methods, systems, storage media for authentication are described. On the methods includes receiving, at a smart contract on a distributed ledger, a signed authentication challenge. The method includes verifying the identity of the user who signed authentication challenge. The method includes raising an event that indicates that the user has been authenticated; wherein a server listens for events from the smart contract, and associates a session between the browser and the server with the user based on the event.