In some embodiments, a system is a reverse-proxying HTTP cache server that handles user session management and dynamically forwards requests to origin/backend servers based on the content being requested. It caches data from origin servers in order to reduce the stress placed on each origin server. It uses encrypted authorization tokens to handle session management and is able to modify origin data on-the-fly in order to inject per-client authorization information into the data stream. It can enforce maximum concurrent session limits, user bans, limit exemptions, and time-limited live content previews.

Disclosed are systems and methods for registering and localizing a building server. A system comprises a building server communicatively coupled with a computing cloud, and configured to initiate a registration process that comprises transmitting data identifying the building server. The computing cloud comprises at least a device registration module that receives the data transmitted from the building server, authenticates the building server, and generates and transmits data such as a building server password and a digital certificate. The computing cloud also comprises an identity management module that receives a request to create a unique ID associated with the building server, and updates a memory to indicate an association between the building server and the computing cloud.

A communication method includes generating a first connection request including verification information of a mobile platform, and sending the verification information of the mobile platform to a first control terminal communicatively connected to the mobile platform, so that a second control terminal receives the verification information of the mobile platform obtained by the first control terminal and generates a second connection request. The method further includes establishing a mobile network communication link with the second control terminal after verification of the verification information in the first connection request and verification information in the second connection request is passed.

Embodiments relate to a method for secure domain name system, DNS, queries. The method is performed in a DNS client, and the method includes obtaining an encryption key and internet protocol, IP, address for a final DNS resolver, creating a session key, encrypting a DNS query and the created session key with the obtained encryption key, and sending a DNS message containing the encrypted DNS query and the created session key to an intermediate DNS resolver, different from the final DNS resolver, together with the obtained IP address for the final DNS resolver. Methods, nodes, computer programs, and a computer program product for secure DNS queries are also presented.

Techniques are disclosed relating to multiway communications. In some embodiments, a first electronic device initiates a multiway call between a plurality of electronic devices and exchanges a first secret with a first set of electronic devices participating during a first portion of the multiway call, the first secret being used to encrypt traffic between the first set of electronic devices. The first electronic device receives an indication that first set of participating electronic devices has changed and, in response to the indication, exchanges a second secret with a second set of electronic devices participating during a second portion of the multiway call, the second secret being used to encrypt traffic between the second set of participating electronic devices. In some embodiments, the indication identifies a second electronic device as leaving the multiway call, and the second secret is not exchanged with the second electronic device.

Techniques are provided for secure message passing. A sender process has a clear (non-encrypted) text message to pass to a recipient process as an encrypted message. The sender generates a message encryption key (MEK) for encrypting the message and sends the MEK to a first intermediary process, which encrypts the MEK. The sender uses the MEK to encrypt the message and passes both the encrypted message and the encrypted MEK to a second intermediary process. The second intermediary verifies that the sender is authorized to send messages and retains the encrypted message and the encrypted MEK. The second intermediary passes the encrypted message and the encrypted MEK to the recipient, which requests decryption of the encrypted MEK from the first intermediary. The first intermediary then decrypts the MEK and returns it to the recipient. Finally, the recipient decrypts the message using the MEK.

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, that protect analytics for resources of a publisher from traffic directed to such resources by malicious entities. An analytics server receives a first message that includes an encrypted token and analytics data for a publisher-provided resource. The token includes a portion of the analytics data and a trust score indicating a likelihood that activity on the resource is attributed to a human (rather than an automated process). The analytics server decrypts the token. The analytics server determines a trustworthiness measure for the analytics data included in the first message based on the trust score (in the decrypted token) and a comparison of the analytics data in the first message and the portion of the analytics data (in the decrypted token). Based on the measure of trustworthiness, the analytics server performs analytics operations using the analytics data.

An encryption box device has a memory and a processor coupled to the memory. A first clipboard runs on the processor and downloads a plaintext stream. An encryption engine runs on the processor and receives the plaintext stream and encrypts the plaintext stream to produce an encrypted stream. A digitizer runs on the processor and digitizes the encrypted stream to produce a digitized encrypted stream. A second clipboard runs on the processor and uploads the digitized encrypted stream. The encryption engine may also decrypt the encrypted stream to produce the plaintext stream and upload the plaintext stream to the first clipboard.

Sensitive information can be managed using a trusted platform module. For example, a system can encrypt target information using a cryptographic key to generate encrypted data. The system can also receive an encrypted key from a trusted platform module, where the encrypted key is a version of the cryptographic key that is encrypted using a public key stored in the trusted platform module. The system can then transmit the encrypted data and the encrypted key to a remote computing system, for example to store the encrypted data and the encrypted key on the remote computing system. Using these techniques, the target information may be secured and stored in remote locations.

A key management system includes a managed system coupled to a management system through a network. The managed system includes managed device locking subsystem(s) coupled to a managed device and a key storage. The managed device locking subsystem(s) retrieve, through the network from the management system, a managed device locking key that is configured to unlock the managed device. The managed device locking subsystem(s) then encrypt the managed device locking key to provide an encrypted managed device locking key, and store the encrypted managed device locking key in the key storage. Subsequent to storing the encrypted managed device locking key, the managed device locking subsystem(s) retrieve the encrypted managed device locking key from the key storage, and decrypt the encrypted managed device locking key to provide a decrypted managed device locking key. The managed device locking subsystem(s) then use the decrypted managed device locking key to unlock the managed device.