A key management apparatus receives a key request including a first device identification information and a second device identification information, encrypts a common key using the first device identification information to generate a first encrypted common key, encrypts the common key using the second device identification information to generate a second encrypted common key, and transmits a key response including the first encrypted common key and the second encrypted common key. A first device receives the key response, decrypts the first encrypted common key using the first device identification information to obtain the common key, and transmits the second encrypted common key. A second device receives the second encrypted common key and decrypts the second encrypted common key using the second device identification information to obtain the common key.

The present disclosure describes apparatuses and techniques for secure device authentication. In some aspects, a public ephemeral key of a device is exposed. A message received from a remote device to authenticate includes a hash of the public ephemeral key of the device, a public ephemeral key and an encrypted public key of the remote device, and an encrypted hash value useful to prove ownership of the public key received from the remote device. An encryption key is generated based on the public ephemeral key of the remote device and a private ephemeral key of the device. The device then decrypts, with the encryption key, the encrypted public key of the remote device and the encrypted hash value. The remote device is then authenticated by verifying, based on the decrypted hash value, that the remote device owns the decrypted public key.

The solutions disclosed enable security credentials to be shared between two entities. Embodiments of the present invention can be used to facilitate the transfer security credentials associated with a first level of permission of a first entity to a second entity that does not have the security credentials associated with the first level of permission in response to receiving a request to share security credentials between two entities.

A system and method of allowing a new device to join an existing network are disclosed. A configuration tool is used to communicate relevant information from the new network device to the gateway in the existing network using a secondary network protocol different from that used by the primary network. For example, in one embodiment, messages are exchanged between the configuration tool and the new device and between the configuration tool and the gateway using BLUETOOTH®. Once all of the pertinent information has been exchanged, the new device is able to securely join the primary network, which may be based on the IEEE802.15.4 standard.

Methods, systems, and devices are described herein for delivering protected data to a trusted execution environment (TrEE) associated with a potentially untrusted requestor. In one aspect, a targeting protocol head may receive a request for protected data from a potentially untrusted requestor associated with a TrEE, and an attestation statement of the TrEE. The targeting protocol head may retrieve the protected data, and obtain a targeting key of the TrEE from, for example, the request in the case of clean room provisioning, or the attestation statement. The targeting protocol head may generate targeted protected data by encrypting the protected data with the targeting key, and provide the targeted protected data to the potentially untrusted requestor, where a private targeting key of the TrEE is required to decrypt the targeted protected data.

A method for securing an identifier of a user equipment used when connecting to a network connection in a wireless communication system, according to an embodiment of the present invention, may comprise the steps of: receiving, from the user equipment, a message requesting a first ticket for authenticating a right to access the identifier in a serving network of the user equipment, wherein the message includes information on a second ticket for authenticating a right to access the identifier in a home network of the user equipment; transmitting the information on the second ticket to a mobility management entity (MME) of the home network; receiving, from the MME of the home network, identification information of the user equipment that is determined on the basis of the information on the second ticket; and transmitting, to the terminal, information on the first ticket and a temporary key used to encrypt the identifier in the serving network, on the basis of the identification information.

A method for protecting content, comprising receiving, from a client device, a request for an encryption key for encrypting the content comprising a reference associated with the client device, identifying a set of supported security capabilities corresponding to the reference associated with the client device, identifying a set of required security capabilities corresponding to the content associated with the key request, determining if the set of supported security capabilities satisfy the set of required security capabilities, and in response to determining that the supported security capabilities satisfy the set of required security capabilities, transmitting the encryption key to the client device.

An information processing method, a terminal device, and a network system include encrypting, by a first terminal, an authorization key based on a public key of a second terminal to obtain an authorization key ciphertext corresponding to the second terminal, and sending, by the first terminal, the authorization key ciphertext to the second terminal such that the second terminal decrypts the authorization key ciphertext based on a private key of the second terminal to obtain the authorization key, and then performs file decryption.

A system supports symmetric release of cryptologically-locked asset transactions. A leading exchange party and a reciprocal exchange party establish, at least in part, a peer challenge in a pre-exchange proposal. The reciprocal party uses the peer challenge to lock a cryptologically-locked asset transaction. The solution to the peer challenge corresponds to an exchange key controlled by the leading exchange party. The cryptologically-locked asset transaction call for solution of the peer challenge and signature of the transaction by exchange logic as conditions of release of the cryptologically-locked asset transaction. The exchange logic may execute a symmetric release of the exchange key and/or signature to the reciprocal exchange party and cryptologically-locked asset transaction (such that the asset is transferred to the leading exchange party).

Example embodiments of systems and methods for application verification are provided. An application may generate a cryptographic key, and encrypt the cryptographic key with a predefined public key. A server, in data communication with the application, may include a predefined private key. The application may transmit the cryptographic key to the server. The server may receive, from the application, the cryptographic key; decrypt the cryptographic key using the predefined private key; encrypt an authorization token using the decrypted key; and transmit, to the client application, the authorization token via an out-of-band channel. The application may receive, from the server, the authorization token via the out-of-band channel; and decrypt the authorization token to obtain access to one or more services associated with the server.