A method for storing data at a cloud storage, wherein data of a user is stored at the cloud storage upon a user request, includes encrypting the data of the user; directing the user request to a data manager; and before an uploading of the encrypted data to the cloud storage, performing, by the data manager, a deduplication on the encrypted data, so that uploading of the data is only performed, if the data is not yet stored within the cloud storage.

Techniques for deriving a WLAN security context from an existing WWAN security context are provided. According to certain aspects, a user equipment (UE) establishes a secure connection with a wireless wide area network (WWAN). The UE may receive from the WWAN an indication of a wireless local area network (WLAN) for which to derive a security context. The UE then derives the security context for the WLAN, based on a security context for the WWAN obtained while establishing the secure connection with the WWAN and establishes a secure connection with the WLAN using the derived security context for the WLAN. This permits the UE to establish a Robust Security Network Association (RSNA) with the WLAN while avoiding lengthy authentication procedures with an AAA server, thus speeding up the association process.

A method for generating an identifier of a key includes that: when a user equipment (UE) transfers from an evolved UMTS terrestrial radio access network (EUTRAN) to a universal terrestrial radio access network (UTRAN) or a global system for mobile communications (GSM), or an enhanced data rate for GSM evolved radio access network (GERAN), an identifier of a system key after transfer is generated by mapping an identifier KSI.sub.ASME for an access security management entity, and a mobile management entity generates an identifier of a ciphering key (CK) and an integrity key (IK) by mapping the KSI.sub.ASME, and then sends the generated identifier to a serving GPRS support node (SGSN), when the UE transfers from the EUTRAN to the UTRAN, the SGSN stores the ciphering key, the integrity key and the identifier thereof, and when the UE transfers from the EUTRAN to the GERAN, the SGSN assigns the value of the identifier of the ciphering key and the integrity key to an identifier of a ciphering key of the GERAN.

Systems and methods are disclosed for implementing an educational mode on a portable computing device, such as a tablet computer, that is a single-user system, used serially by multiple users. Each user can have a separate user storage that may be encrypted. The computing device boots as a system user to a login screen. A first student user enters user credentials into the login screen. The computing device can reboot the user-space processes, while leaving the kernel running, rebooting the computing device as the first student user. When the first student user logs out, data to be synchronized to, e.g., the cloud, can be synchronized for the first student user while a second student user is logged into the device.

A system and a method of counter management and security key update for device-to-device (D2D) communication are provided. The method includes creating by a user equipment, a new packet data convergence protocol (PDCP) entity for a service group wherein a service group is identified by a destination identifier (ID), determining if any PDCP entity of the service group exists or not, generating a new proximity service (ProSe)traffic key (PTK) from a ProSe group key (PGK) corresponding to the service group associated with the new PDCP entity, initializing a new packet counter associated with the service group to zero if the new PDCP entity is a first PDCP entity associated with the service group, generating a ProSe encryption key (PEK) from the PTK and encrypting data packets mapped to the new PDCP entity using the PEK and a packet counter associated with the service group.

Provided is a communication apparatus (121) that securely manages passwords for utilizing a server apparatus. A generator (203) generates a random table having the same number of rows and the same number of columns as a password table associated with a server name specified in an authentication request received by a receiver (202). An acceptor (205) accepts a key from a user to whom the random table is presented by a presenter (204). An identification unit (206) identifies, from the key and the random table, the user's of selection order of elements in the table. An acquirer (207) selects and arranges elements in the password table in the identified selection order, thereby acquiring a password. An output unit (208) displays the acquired password on a display or transmits the acquired password to the server apparatus, thereby allowing the user to utilize the server apparatus.

Mobile device data encryption is disclosed. A file is divided into a plurality of data blocks. The data blocks are encrypted. An authentication value is generated for each encrypted data block. The encrypted data blocks are stored in a tree data structure including the encrypted data blocks and a header block. The header block includes a set of authentication values and an aggregate authentication value. Each authentication value in the set of authentication values is derived from one or more of the encrypted data blocks. The aggregate authentication value is generated based at least in part on the set of authentication values. In various embodiments, the tree data structure may include one or more levels of internal nodes including authentication blocks.

Binding a security token to a client token binder, such as a trusted platform module, is provided. A bound security token can only be used on the client on which it was obtained. A secret binding key (k.sub.bind) is established between the client and an STS. The client derives a key (k.sub.mac) from k.sub.bind, signs a security token request with k.sub.mac, and instructs the STS to bind the requested security token to k.sub.bind. The STS validates the request by deriving k.sub.mac using a client-provided nonce and k.sub.bind to MAC the message and compare the MAC values. If the request is validated, the STS generates a response comprising the requested security token, derives two keys from k.sub.bind: one to sign the response and one to encrypt the response, and sends the response to the client. Only a device comprising k.sub.bind is enabled to use the bound security token, providing increased security.

A computing device includes a secure storage hardware to store a secret value and processing hardware comprising at least one of a cache or a memory. During a secure boot process the processing hardware loads untrusted data into at least one of the cache or the memory of the processing hardware, the untrusted data comprising an encrypted data segment and a validator, retrieves the secret value from the secure storage hardware, derives an initial key based at least in part on an identifier associated with the encrypted data segment and the secret value, verifies, using the validator, whether the encrypted data segment has been modified, and decrypts the encrypted data segment using a first decryption key derived from the initial key to produce a decrypted data segment responsive to verifying that the encrypted data segment has not been modified.

A hierarchical key generation and distribution mechanism for a computer system in which devices are organized into secure enclaves. The mechanism enables network access to be tailored to approximate minimum needed privileges for each device. At the lowest level of the hierarchy, keys are used to form security associations between devices. Keys at each level of the hierarchy are generated from keys at a higher level of the hierarchy and key derivation information. Key derivation information is readily ascertainable, either from identifiers for devices or from within messages, supporting hardware offload of cryptographic functions. Because keys may be generated based on the enclaves in which the hosts participating in a security association are located, the system includes a mechanism by which devices can discover the enclave in which they are located.