A computer-implemented method according to one aspect includes creating an initialization vector, utilizing an instance of plaintext and a secret key; encrypting the instance of plaintext, utilizing the initialization vector, the secret key, and the instance of plaintext; combining the initialization vector and the encrypted instance of plaintext to create a ciphertext string; and sending the ciphertext string to a storage device performing deduplication.

Methods, system and devices are provided that generate a sequence of sub-keys for cryptographic operations from a main key. The main key is operated on only once to generate the sub-keys of the sequence, with a transformation comprising one or more one-way functions. The respective bit values of the sub-keys of the sequence are set using respective bit values of the one or more one-way functions. Advantageously, deriving sub-key bits from respective output bits of one or more one-way functions removes or at least reduces correlations between the main key and the sub-keys, as well as between sub-keys, making it harder or even impossible to recover the main key or other sub-keys from a single sub-key, for example as found using a side-channel attack. At the same time, by using the main key only once (rather than using the main key each time a sub-key is generated), the vulnerability of the main key to a side-channel attack is reduced, because the opportunities for recovering physical information that could lead to the discovery of the main key are reduced. Specific embodiments use parallel or chained execution of sub-functions to generate respective sub-keys. Other specific embodiments generate all sub-keys from a single one-way function in one go.

The described technology is generally directed towards generating shared authentication keys using network connection characteristics. According to an embodiment, a system can comprise a processor and a memory that can store executable instructions that, when executed by the processor, facilitate performance of operations. The operations can comprise generating a first authenticator based on a first authentication key generated based on a first connection characteristic of the first device and a second connection characteristic of a second device. The operations can further comprise incorporating the first authenticator into first content for authentication by the second device employing a second authentication key, generated by the second device based on the first connection characteristic and the second connection characteristic. The operations can further comprise establishing, based on the first content, a connection with the second device.

A system includes a processor configured to wirelessly broadcast a message obtained from a first originating vehicle BUS or controller, following a determination that the message was on a pre-approved list for broadcast and having encrypted the message utilizing a temporary random key generated for a message session. The system may include vehicle controllers, a gateway module, and vehicle BUSSES connecting the system controllers to the gateway module. The gateway module may include a memory storing a list of pre-approved message types and corresponding source types, and a processor configured to receive a message from one of the vehicle controllers over one of the vehicle BUSSES to determine if a message type and source type of the received message matches an element of the list.

A path for a node of a computing environment is secured. The securing includes obtaining, by the node, a message that includes an identifier of a shared key and an encrypted message. The node obtains the shared key from a key server and uses it to decrypt the encrypted message to obtain an encryption key and one or more parameters. A security parameters index to be associated with the encryption key and the one or more parameters is obtained. The node sends a response message to another node, the response message including the security parameters index.

Aspects of the present disclosure relate to systems and methods for providing strong resource identification. When a resource is created, saved, or re-based, a cryptographic key pair may be generated and associated with the resource. A public key of the cryptographic key pair may be used as a unique identifier. Information about the resource, such as the name of the resource and its actual location may be stored in an index based upon the resource's public key. Sharing the resource with other devices may comprise sending the resource's key, as opposed to information about the resource's actual location, to one or more recipient device.

Providing authorization and authentication in a cloud for a user of a storage array includes: receiving, by a storage array access module from a client-side array services module, a token representing authentication of user credentials and authorized access privileges defining one or more storage array services accessible by the user, where the token is generated by a cloud-based security module upon authentication of the user credentials and identification of authorized access privileges for the user; receiving, by the storage array access module from the user, a user access request to one or more storage array services; and determining, by the storage array access module, whether to grant the user access request in dependence upon the authorized access privileges represented by the token.

A method is provided for managing key rotation (use of series of keys) and secure key distribution in over-the-top content delivery. The method provided supports supplying a first content encryption key to a content packaging engine for encryption of a first portion of a video stream. Once the first content encryption key has expired, a second content encryption key is provided to the content packaging engine for encryption of a second portion of a video stream. The method further provides for notification of client devices of imminent key changes, as well as support for secure retrieval of new keys by client devices. A system is also specified for implementing a client and server infrastructure in accordance with the provisions of the method.

A solution for security negotiation during handover of a user equipment (UE) between different radio access technologies is provided. In the solution, the UE receives non-access stratum (NAS) security information and access stratum (AS) security information which are selected by the target system and then performs security negotiation with the target system according to the received NAS security information and AS security information. As such, the UE may obtain the key parameter information of the NAS and AS selected by a Long Term Evolution (LTE) system and perform security negotiation with the LTE system when the UE hands over from a different system, such as a Universal Terrestrial Radio Access Network (UTRAN), to the LTE system.

A homomorphic encryption processing device includes the processing circuitry is configured to generate ciphertext operation level information based on field information. The field information represents a technology field to which homomorphic encryption processing is applied. The ciphertext operation level information represents a maximum number of multiplication operations between homomorphic ciphertexts without a bootstrapping process. The processing circuitry is further configured to select and output a homomorphic encryption parameter based on the ciphertext operation level information. The processing circuitry is further configured to perform one of a homomorphic encryption, a homomorphic decryption and a homomorphic operation, based on the homomorphic encryption parameter. The homomorphic encryption processing device may adaptively generate a homomorphic encryption parameter according to a ciphertext operation level information determined based on a field information, and may perform a homomorphic encryption, a homomorphic decryption and a homomorphic operation based on the homomorphic encryption parameter.