Methods and systems are provided for efficient and secure Machine-to-Machine (M2M) between modules and servers. A module can communicate with a server by accessing the Internet, and the module can include a sensor and/or actuator. The module and server can utilize public key infrastructure (PKI) such as public keys to encrypt messages. The module and server can use private keys to generate digital signatures for datagrams sent and decrypt messages received. The module can internally derive pairs of private/public keys using cryptographic algorithms and a set of parameters. A server can use a shared secret key to authenticate the submission of derived public keys with an associated module identity. For the very first submission of a public key derived the module, the shared secret key can comprise a pre-shared secret key which can be loaded into the module using a pre-shared secret key code.

A virtual secure mode is enabled for a virtual machine operating in a computing environment that is associated with a plurality of different trust levels. First, a virtual secure mode image is loaded into one or more memory pages of a virtual memory space of the virtual machine. Then, the one or more memory pages of the virtual memory space are made inaccessible to one or more trust levels having a relatively lower trust level than a launching trust level that is used by a virtual secure mode loader to load the virtual secure mode image. A target virtual trust level is also enabled on a launching virtual processor for the virtual machine that is higher than the launching trust level.

A method of configuring or changing a configuration of a POS terminal by at least one operator, in which an authorization of the operator by the POS terminal is established, in which after successful authorization of the at least one operator, the at least one operator carries out the configuration or change of the configuration, in which an identification feature for identification of the at least one operator is introduced into the POS terminal, in which this identification feature is used for authorizing the at least one operator. A method of associating a POS terminal with an operator, in which the POS terminal checks the integrity of the identification feature of the operator for identification of the operator, with which the POS terminal is associated.

It is disclosed a method and a constrained resource device (502, 70, 90) for establishing a secret first key between a client device (506) and the constrained resource device. The invention also relates to a method and an authorization server (504, 60, 80) for enabling establishing a secret first key between a client device (506) and the constrained resource device. Based on a secret second key shared (508) between the constrained RD and the AS, the secret first key shared between the constrained resource device and the client device can be established. Devices having constrained resources cannot use protocols with which additional messages are required to share a secure identity. Embodiments of the present invention have the advantage that a secret identity can be established within an authentication protocol and that no additional messages are required to establish the secret identity.

High-precision local search is performed on the Internet. A map image-rendering software provider embeds spatial keys into maps, which are then provided to producers of Internet content such as map providers. For example, a homeowner may post a message on a web bulletin board advertising his house for sale, and including a map showing the location of the house. When a search engine's web crawler encounters a page having a spatial key embedded in an image, the spatial key is indexed with the other content on the page. Because the spatial key identifies a small geographic area, indexing the content with the spatial key allows search queries to be limited by area and still provide useful results. Thus, a user of a search engine searching for house for sale in a specific area will be directed to web pages that meet the geographic and content search terms.

Methods and systems are provided for supporting efficient and secure Machine-to-Machine (M2M) communications using a module, a server, and an application. A module can communicate with the server by accessing the Internet, and the module can include a sensor and/or an actuator. The module, server, and application can utilize public key infrastructure (PKI) such as public keys and private keys. The module can internally derive pairs of private/public keys using cryptographic algorithms and a first set of parameters. A server can authenticate the submission of derived public keys and an associated module identity. The server can use a first server private key and a second set of parameters to (i) send module data to the application and (ii) receive module instructions from the application. The server can use a second server private key and the first set of parameters to communicate with the module.

In one embodiment, a method, comprising obtaining a first uniform resource identifier for a segment of a content item, obtaining encryption metadata indicative of encryption information to be used for encrypting the segment when the segment is requested by a client device or a content delivery network, generating a data combination based on the first uniform resource identifier and the encryption metadata, generating an authentication code or a signature by applying a secret to the data combination, the secret being unknown to the client device or the content delivery network, generating a second uniform resource identifier for the segment based on the authentication code or the signature, the encryption metadata and the first uniform resource identifier, inserting the second uniform resource identifier in an adaptive bitrate media playlist for the content item, and sending the adaptive bitrate media playlist to the client device or the content delivery network.

Several embodiments of memory devices and systems with command and control access are described herein. In one embodiment, a memory device includes a controller having a processor and a memory component operably coupled to the processor. The controller is configured to receive at least one command and control (C.sup.2) packet from a remote computer associated with a device vendor. The C.sup.2 packet includes a request for the controller to perform a restricted command, and a vendor signature. The memory component stores instructions executable by the processor to determine if the vendor signature is valid and to direct the controller to perform the restricted command if the vendor signature is determined to be valid.

A host machine operated for a specific purpose can have restricted access to other components in a multi-tenant environment in order to provide for the security of the host machine. The access restriction can prevent the host machine from obtaining updates to critical system-level configurations, but such information can be obtained through a signed command received to an API for the host machine. The command can be signed by a quorum of operators, and the host machine can be configured to verify the signatures and the quorum before processing the command. The host machine can store the updates to ephemeral storage as well as persistent storage, such that upon a reboot or power cycle the host machine can operate with current configuration data.

Cryptographic keys can include logging properties that enable those keys to be used only if the properties can be enforced by the cryptographic system requested to perform one or more actions using the keys. The logging property can specify how to log use of a respective key. A key can also include a mutability property for specifying whether the logging property can be changed, and if so under what circumstances or in which way(s). The ability to specify and automatically enforce logging can be important for environments where audit logs are essential. These can include, for example, public certificate authorities that must provide accurate and complete audit trails. In cases where the data is not to be provided outside a determined secure environment, the key can be generated with a property indicating not to log any of the usage.