A method includes receiving and temporarily storing data streams from Internet of Things (IoT) sensors. The method continues with determining whether some of the data streams have been requested by a subscribing computing entity. When some of the data streams are requested and the request is valid, the method continues with sending the requested data streams to the subscribing computing entity. The method continues with receiving additional data streams from the IoT sensors and overwriting the temporary storage of the data streams with the additional data streams.

A method operable by a computing device for configuring access for a limited user interface (UI) device to a network service via a local network access point is disclosed. The method comprises the steps of: obtaining from the limited UI device a device identifier via a first out-of-band channel. The device identifier is provided to the network service via a secure network link. A zero knowledge proof (ZKP) challenge is received from the network service. Configuration information is provided to the limited-UI device via a second out-of-band channel, the configuration information including information sufficient to enable the limited-UI device to connect to the local network access point. The ZKP challenge is provided to the limited-UI device via the second out-of-band channel. A secure channel key is received from the network service indicating a successful response from the limited-UI device to the ZKP challenge; and provided to the limited-UI device enabling the limited-UI device to access the network service.

A method executed by a dynamic session key acquisition (DSKA) engine residing in a virtual environment includes receiving session decryption information extraction instructions that configure the DSKA engine to obtain session decryption information for at least one communication session involving a virtual machine and obtaining the session decryption information from the virtual machine in accordance with the session decryption information extraction instructions. The session decryption information includes cryptographic keys utilized by an application server instance in the virtual machine to establish the at least one communication session. The session decryption information obtained from the virtual machine is stored and provided to a network traffic monitoring (NTM) agent. The NTM agent utilizes the session decryption information to decrypt copies of encrypted network traffic flows belonging to the at least one communication session involving the virtual machine.

A responder device receives, from an initiator device, a request to initiate a cryptographic tunnel between the initiator device and the responder device. The responder device does not include a static private key to be used in an asymmetric cryptography algorithm when establishing the tunnel. The responder device transmits a request to a key server that has access to the static private key and receives a response that is based on at least a result of at least one cryptographic operation using the static private key. The responder device receives from the key server, or generates, a transport key(s) for the responder device to use for sending and receiving data on the cryptographic tunnel. The responder device transmits a response to the initiator device that includes information for the initiator device to generate a transport key(s) that it is to use for sending and receiving data on the cryptographic tunnel.

Data security is provided in the form of a method for digitally signing a data message. A client device issues a issuing a signature request to a server and generates a first signature part as functions of selected ones of first signature parameters. It then receives from the server a second signature part, said second signature part having been computed by the server as functions of second signature parameters and at least one of the first signature parameters. The client device then attempts to verify components of the second signature part and generates a final digital signature of the message only if the components of the second signature part are valid. Part of the computational effort of creating the signature is thus offloaded to the server, even though the server may not be fully trusted.

A proxy computer system provides a proxy service for a client to utilize a third-party network service by parsing content retrieved from a third-party network service to identify a link specifying a hostname with multiple subdomains of the third-party network service and substituting the hostname of the link with a mapped hostname that is mapped internally within the proxy service to the hostname of the link and is compatible with a wildcard proxy service certificate to enable the client to securely access a resource associated with the link without a compatible certificate for the hostname with multiple subdomains of the third-party network service.

According to an example aspect of the invention, there is provided an apparatus comprising at least one processing core and at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processing core, cause the apparatus at least to receive, from a first user, a ciphertext, a first hash value and a first ciphered encryption key, receive, from a second user, a second hash value, responsive to a determination the first hash value is the same as the second hash value, obtain a re-encryption key, and apply the re-encryption key to the first ciphered encryption key to obtain a re-encrypted encryption key, the re-encrypted encryption key being decryptable with a secret key of the second user.

An ingress network element obtains data from a source endpoint associated with the ingress network element. The data identifies a destination endpoint remote from the ingress network element. The ingress network element provides a map request identifying the destination endpoint to a mapping server. The ingress network element obtains a map reply including a network address of an egress network element associated with the destination endpoint and a security association. The ingress network element encrypts the data for the destination endpoint with the security association according to a cryptographic policy based on the source endpoint, the destination endpoint, and the availability of cryptographic resources on the network. The ingress network element provides the encrypted data to the egress network element.

An infrastructure delivery platform provides a proxy service as an enhancement to the TLS/SSL protocol to off-load to an external server the generation of a digital signature, the digital signature being generated using a private key that would otherwise have to be maintained on a terminating server. Using this service, instead of digitally signing (using the private key) locally, the terminating server proxies given public portions of ephemeral key exchange material to the external server and receives, in response, a signature validating the terminating server is authorized to continue with the key exchange. In this manner, a private key used to generate the digital signature (or, more generally, to facilitate the key exchange) does not need to be stored in association with the terminating server. Rather, that private key is stored only at the external server, and there is no requirement for the pre-master secret to travel (on the wire).

A registration device (200) generates an encryption keyword by encrypting a keyword with a registration key, generates an index including the encryption keyword and identification information which identifies a corresponding ciphertext, generates a conversion key from the registration key and a search key, and registers a plurality of ciphertexts, the index, and the conversion key in a server device (400). A search device (300) generates a search query by encrypting a keyword, and transmits the search query to the server device (400). The server device (400) generates a re-encryption keyword by re-encrypting the search query with the registered conversion key, searches the registered index with the re-encryption keyword, acquires, from the index, the identification information if the encryption keyword is obtained as a search result, extracts a ciphertext identified by the identification information from the registered plurality of ciphertexts, and transmits the extracted ciphertext to the search device (300).