Described herein are systems, devices, and methods for content delivery on the Internet. In certain non-limiting embodiments, a caching model is provided that can support caching for indefinite time periods, potentially with infinite or relatively long time-to-live values, yet provide prompt updates when the underlying origin content changes. In one approach, an origin server can annotate its responses to content requests with tokens, e.g., placing them in an appended HTTP header or otherwise. The tokens can drive the process of caching, and can be used as handles for later invalidating the responses within caching proxy servers delivering the content. Tokens may be used to represent a variety of kinds of dependencies expressed in the response, including without limitation data, data ranges, or logic that was a basis for the construction of the response.

A method is provided for redirecting signed code images. The method includes the steps of receiving a code image from an origin device at a proxy machine, invoking a code signing client at the proxy machine, receiving signing request information indicating a requested cryptographic operation, sending a code signing request to a code signing server, receiving a signed code image at the code signing client from the code signing server, storing the signed code image in a restricted memory, invoking a software repository client at the proxy machine, and sending the signed code image from the restricted memory location to a software repository.

One feature provides a method for a client node to establish a session key with a group node by obtaining an epoch identity value associated with a current epoch, wherein obtaining the epoch identity value includes one of computing the epoch identity value based on a node real time or negotiating the epoch identity value with the group node, computing a restricted key using a shared secret key, the epoch identity value, and a group node identity associated with the group node, and executing a session key establishment protocol with the group node to derive the session key using the restricted key as a master key in the session key establishment protocol. The session key may be established between the group node and the client node even though communications between the group node and the central node is only intermittently available during the current epoch.

A gateway device between a first and second communication network outside the gateway device handles communication between a first device in the first network and a second device in the second network. When the gateway receives a communication request from the first device, directed to the second device, for performing a first cryptographic data communication protocol, the gateway determines whether the first cryptographic data communication protocol is registered as unsafe in the gateway device, and/or registered as safe, in particular whether it is safe against key reconstruction by a quantum computer. When the first cryptographic data communication protocol is not registered as unsafe in the gateway device, and/or registered as safe, the gateway device forwards messages exchanged as part of execution of the first cryptographic data communication protocol between the first and second device. When the gateway determines that the first cryptographic data communication protocol is registered as unsafe in the gateway device, and/or not registered as safe, the gateway device executes the first cryptographic data communication protocol between the first device and the gateway device, and executes a second cryptographic data communication protocol, which is not recorded as unsafe in the gateway device, and/or registered as safe, between the gateway and the second device, whereby the first and second cryptographic data communication protocol are executed sequentially to communicate data between the first and second device via the gateway device.

There is provided a method of a server for deriving a time stamp for a piece of data. The method comprises receiving a signing request from a client comprising a hash value of the piece of data, wherein the hash value is formed using a time-forwarded one-time signing key, OTSK, wherein the time-forwarded OTSK comprises a time-forwarded index, queuing the signing request, pushing the hash value to a signature infrastructure entity at the time-forwarded time, and receiving a time stamp from the signature infrastructure entity. There is also provided a method of a client for signing a stream of pieces of data by obtaining a time stamp for each piece of data. The method comprises collecting the pieces of data and deriving one-time signing keys of a one-time signing key hash chain, forming a stream of signing requests for the pieces of data by applying the one-time signing keys with time-forwarded indices for the respective piece of data to calculate hash values of the respective pieces of data, and transmitting the stream of signing requests comprising the hash values to a server for deriving time stamps for the pieces of data, respectively. A server, an electronic device and computer programs are also disclosed.

A providing device according to the present application includes a detecting unit and a providing unit. The detecting unit detects a function, from among functions used for communication with an authentication server that authenticates the identity of a user by verifying a signature of authentication result information that is information created by adding the signature using a predetermined key to an authentication result obtained by an authentication device that performs personal authentication on the user and that is information processed by a specific authentication procedure, that is not held by a terminal device that is used by the user. The providing unit provides the function detected by the detecting unit to the terminal device that is used by the user.

Disclosed is a digital signature service system and method based on a hash function in which a main agent, who requires the generation of a digital signature, does not personally generate the digital signature, and wherein digital signatures may be simultaneously and stably generated for large-scale data such as multiple electronic documents and digital data using a hash function and a hash tree, which are known as a simple and secure method, to guarantee the integrity of the data in a digital signature-based structure based on a server.

A distributed computing environment utilizes a cryptography service. The cryptography service manages keys securely on behalf of one or more entities. The cryptography service is configured to receive and respond to requests to perform cryptographic operations, such as encryption and decryption. The requests may originate from entities using the distributed computing environment and/or subsystems of the distributed computing environment.

A network computer system implements a service interface to provide encryption as a service, performs cryptographic operations on a plurality of data elements communicated between client computers of an enterprise and a third-party network service, and stores decryption logic in association with the plurality of data elements. The network computer system receives a decryption request via the service interface from a programmatic entity implemented by the third-party network service, the decryption request specifying an encrypted form of a data element. The network computer system decrypts the encrypted form of the data element to generate a decrypted form of the data element using a decryption key, of the one or more decryption keys that is associated with the data element. The network computer system provides a response to the decryption request to the programmatic entity, the response including the decrypted form of the data element.

A method, system, and computer program product generate, with a payment network, a first value (a) and a second value (g.sup.a), the second value (g.sup.a) based on the first value (a) and a generator value (g); generate, with the payment network, a plurality of random merchant numbers (m.sub.i) for a respective plurality of merchant banks; determine, with the payment network, a merchant product (M) based on a product of the plurality of random merchant numbers (m.sub.i); generate, with the payment network, a public key (pk.sub.i) based on the second value (g.sup.a), the merchant product (M), and the random merchant number (m.sub.i) and a random key (rk.sub.i) based on the merchant product (M) and the random merchant number (m.sub.i) for each respective merchant bank; and communicate, with the payment network, the public key (pk.sub.i) and the random key (rk.sub.i) to at least one respective merchant bank.