The techniques herein are directed generally to a “zero-knowledge” data management network. Users are able to share verifiable proof of data and/or identity information, and businesses are able to request, consume, and act on the data—all without a data storage server or those businesses ever seeing or having access to the raw sensitive information (where server-stored data is viewable only by the intended recipients, which may even be selected after storage). In one embodiment, source data is encrypted with a source encryption key (e.g., source public key), with a rekeying key being an encrypting combination of a source decryption key (e.g., source private key) and a recipient's public key. Without being able to decrypt the data, the storage server can use the rekeying key to re-encrypt the source data with the recipient's public key, to then be decrypted only by the corresponding recipient using its private key, accordingly.

One example method includes contacting, by a client, a service, receiving a credential from the service, obtaining trust information from a trust broker, comparing the credential with the trust information, and either connecting to the service if the credential and trust information match, or declining to connect to the service if the credential and the trust information do not match. Other than by way of the trust information obtained from the trust broker, the client may have no way to verify whether or not the service can be trusted.

The techniques herein are directed generally to a “zero-knowledge” data management network. Users are able to share verifiable proof of data and/or identity information, and businesses are able to request, consume, and act on the data—all without a data storage server or those businesses ever seeing or having access to the raw sensitive information (where server-stored data is viewable only by the intended recipients, which may even be selected after storage). In one embodiment, source data is encrypted with a source encryption key (e.g., source public key), with a rekeying key being an encrypting combination of a source decryption key (e.g., source private key) and a recipient's public key. Without being able to decrypt the data, the storage server can use the rekeying key to re-encrypt the source data with the recipient's public key, to then be decrypted only by the corresponding recipient using its private key, accordingly.

An apparatus including a processor and a memory, where the processor and the memory are configured to provide a secure execution environment and the memory stores a hardware unique key and a class key. The processor is configured to recover, in the secure execution environment, a certificate signing key based on the class key, where the certificate signing key is associated with a certificate authority. The processor is further configured to derive a device key pair based on the hardware unique key, where the device key pair includes a device public key and a device private key, and generate a device certificate based on the device public key and the certificate signing key. The generated device certificate is configured to be validated based on a public key associated with the certificate authority.

Certain aspects and features provide an automated process for a server switching from a self-signed digital certificate to a digital certificate signed by a trusted certificate authority (CA). During initiation of an encrypted communication session, for example, during a transport layer security (TLS) handshake, upon receiving a client hello message, the server determines if it is using a self-signed digital certificate. If so, the server automatically creates and sends a certificate signing request, receives a CA-signed digital certificate, and replaces the self-signed digital certificate in its key store with the CA-signed digital certificate. The server then includes the new, CA-signed digital certificate in the server hello message sent back to the client to establish the encrypted communication session.

Visually enrolling a camera using an optical code and a picture file, including: receiving the picture file and the optical code from the camera, wherein the optical code includes a public key of the camera; generating a visual challenge using a nonce created by a random number generator; transmitting the visual challenge to a user of the camera to capture the visual challenge; receiving the captured visual challenge from the camera; extracting a response from the captured visual challenge; comparing the response to the nonce to verify a signature of the captured visual challenge using the public key of the camera and to convert the optical code received from the camera into a valid certificate; and enrolling the camera and adding the valid certificate to a key store.

A blockchain integrated station initiates a certificate authority service to generate a root certificate. The blockchain integrated station broadcasts the root certificate in a network that includes the blockchain integrated station. The blockchain integrated station receives an authentication application initiated by a node in the network. In response to a determination that the authentication application passes verification, a certificate is issued to the node based on the certificate authority service.

Methods and apparatus to facilitate certificate and trust management across a distributed environment are disclosed. An example apparatus includes a first virtual appliance including a first management endpoint and a first authentication provider including a first certificate validator, the first certificate validator to validate that a first certificate received by the first authentication provider is authentic, virtual appliance to communicate the first certificate via the first management endpoint; and a first component server including a first management agent and a first certificate evaluator, the first management agent to communicate with the first virtual appliance via the first management endpoint, the first management agent to receive the first certificate via the first management endpoint, the first certificate evaluator to evaluate the first certificate to determine a signing authority, the first management agent to restart the first component server and notify the first virtual appliance of acceptance of the first certificate.

The techniques herein are directed generally to a “zero-knowledge” data management network. Users are able to share verifiable proof of data and/or identity information, and businesses are able to request, consume, and act on the data—all without a data storage server or those businesses ever seeing or having access to the raw sensitive information (where server-stored data is viewable only by the intended recipients, which may even be selected after storage). In one embodiment, source data is encrypted with a source encryption key (e.g., source public key), with a rekeying key being an encrypting combination of a source decryption key (e.g., source private key) and a recipient's public key. Without being able to decrypt the data, the storage server can use the rekeying key to re-encrypt the source data with the recipient's public key, to then be decrypted only by the corresponding recipient using its private key, accordingly.

The techniques herein are directed generally to a “zero-knowledge” data management network. Users are able to share verifiable proof of data and/or identity information, and businesses are able to request, consume, and act on the data—all without a data storage server or those businesses ever seeing or having access to the raw sensitive information (where server-stored data is viewable only by the intended recipients, which may even be selected after storage). In one embodiment, source data is encrypted with a source encryption key (e.g., source public key), with a rekeying key being an encrypting combination of a source decryption key (e.g., source private key) and a recipient's public key. Without being able to decrypt the data, the storage server can use the rekeying key to re-encrypt the source data with the recipient's public key, to then be decrypted only by the corresponding recipient using its private key, accordingly.