This application discloses a method of provisioning an electronic device. The electronic device establishes a communication link with a client device that can obtain network credentials for accessing a secure wireless network. The network credentials is configured to enable the electronic device to independently access the secure wireless network. The client device encrypts at least a portion of the network credentials using a password key provided by a remote server. The password key is based on a secret not known to the client device, and the secret is associated with the electronic device at the remote server. The client device sends the encrypted network credentials to the electronic device over the established communication link, thereby allowing the electronic device to recover the network credentials based on the secret and access the secure wireless network using the network credentials.

Generally described, one or more aspects of the present application correspond to techniques for creating encrypted block store volumes of data from unencrypted object storage snapshots of the volumes. These encryption techniques use a special pool of servers for performing the encryption. These encryption servers are not accessible to users, and they perform encryption and pass encrypted volumes to other block store servers for user access. The encryption context for the volumes can be persisted on the encryption severs for as long as needed for encryption and not shared with the user-facing servers in order to prevent user access to encryption context.

A method for a data owner to enforce attribute-based and discretionary access control over a cloud-based data store by specifying an access policy, creating a plurality of users with attributes that satisfy the access policy, and revoking one or more of the plurality of users by embedding their respective identities as revoked into a ciphertext, whereby only those of the plurality of users whose attributes satisfy the access policy and that are not revoked can decrypt the ciphertext.

A sending device may send data intended for a target device. An intermediate device may intercept the data sent from the sending device and forward the communications to the target device. Security data (e.g., a security certificate for authentication) along with an encrypted version of the security data may be sent at the application layer such that it passes from the sending device, through the intermediate device, and to the target device without being analyzed or modified by the intermediate device. The target device may use the encrypted security data and the security data to verify the identity of the sending device

Disclosed is a method of facilitating authentication of a user. The method may include performing at least one of generating and receiving, using a processor, a primary cryptographic identifier consisted of a primary public key and a primary private key. Further, the method may include generating, using the processor, a global static user identifier corresponding to the user based on the primary public key. Further, the method may include generating, using the processor, a digital signature corresponding to a service based on a unique identifier associated with the service and the primary cryptographic identifier. Further, the method may include generating, using the processor, a key generation seed based on the digital signature and the global static user identifier. Further, the method may include generating, using the processor, a secondary cryptographic identifier including a secondary public key based on the key generation seed.

In one implementation, a media stream is recorded using one or more keys. The one or more keys are also encrypted. The one or more encrypted keys may be stored with the encrypted media session at a cloud storage service. A network device receives a request to record a media stream and accesses at least one stream key for the media stream. The stream key is for encrypting the media stream. The network device encrypts the stream key with a master key. The encrypted stream key is stored in association with the encrypted media stream.

The disclosure provides a key generation method and apparatus. The key generation method comprises: encrypting a first key factor generated by a first device with an initial key, and sending the encrypted first key factor to a second device through a first secure channel, wherein the initial key is a key preset for the first device and the second device; receiving, through the first secure channel, a second key factor encrypted with the initial key, wherein the second key factor is generated by the second device; decrypting the second key factor encrypted with the initial key and received through the first secure channel, so as to obtain the second key factor; and generating a shared key between the first device and the second device according to the first key factor and the second key factor. According to the disclosed embodiments, a gateway device is unable to acquire a shared key negotiated between a first device and a second device, ensuring the security of data transmitted there between, and further reducing the risk of data being illegally captured during transmission.

Systems, apparatuses, and methods are described for adjusting capacity in a networking environment. A networking system comprising clients, servers, load balancers, and/or other devices may expand and contract network capacity as needed. When expanding network capacity, load balancers may instruct client devices to connect to servers that are part of the expanded network. When network capacity is reduced, a server and/or a load balancer my instruct client devices to close a connection with a first server and establish a connection with a second server. Client devices may seamlessly begin using the connection with a second server without having to wait for a connection timeout with the first server.

A portable encryption format wraps encrypted files in a self-executing container that facilitates transparent, identity-based decryption for properly authenticated users while also providing local password access to wrapped files when identity-based decryption is not available.

A secure communication platform includes a user database that allows users from different secure communication networks to perform directory look-ups to access keys, and other information, for recipients outside of their network. Users from different secure communication networks may request, from the database, user information of users outside their secure communication. The user information may allow the users of different secure communication networks to exchange secure communications. The secure communication platform provides a high degree of trust regarding the sender's identity, allowing the receiving network to trust the sender, and allowing the secure communications to flow across different secure communication networks.