The disclosure provides a method and an apparatus for acquiring an electronic file. The method for acquiring an electronic file includes: generating a first encryption key according to login information of a user of a terminal device at the time of logging in to a platform server and a first identifier corresponding to an information providing server that provides the electronic file; sending a first request message for acquiring the electronic file to the platform server; receiving the electronic file encrypted using a second encryption key and returned by the platform server according to the login information and the first request message; and generating a first decryption key according to the first encryption key, and decrypting, using the first decryption key, the electronic file encrypted using the second encryption key, so as to obtain the decrypted electronic file. By means of the disclosed embodiments, private information concerning a user in an electronic file is not leaked by a platform server. Since a terminal device can obtain a decryption key without the need to perform key exchange with an information providing server, use by the user of the terminal device is facilitated.

Presented herein are techniques for synchronizing a cloud service and a key management service via a single indirect synchronous message sent by a client device. In particular, a cloud service receives a service request message sent by a client device. Embedded into the service request message is an encrypted key management message. The cloud service is configured to extract the encrypted key management message from the service request message and then send the encrypted key management message to the key management service.

A password management service provides automated password management. In one embodiment, a method for automating password changes begins in response to a determination that automated password changes are authorized. In response, a data mining session is initiated. Within the data mining session, a set of third party applications or sites are identified. Then, and responsive to receipt of a password reset flow authorization, a password reset flow to one or more of the third party applications or sites is initiated by the service. Thereafter, and still within the data mining session, and for each of the one or more third party applications or sites, a determination is made whether a password reset confirmation link has been received by the service. In response to a determination that a password reset confirmation link has been received for a given third party application or site, the service uses the password reset confirmation link to perform an automated password reset and thereby obtain a new user password for the application or site.

Methods, systems, and computer readable mediums for securely establishing credential data for a computing device are disclosed. According to one example, a method includes assigning, by a credential manager, credential set data to a computing device and mapping the credential set data to a device identifier key associated with the computing device in a credential data store accessible by the credential manager. The method further includes receiving, from a provisioning service client, a credential set request message including the device identifier key by the credential manager in response to an activation of the computing device at a customer location site and sending, by the credential manager to the provisioning service client, the credential set data for authenticating the computing device at the customer location site.

Disclosed is a zero-knowledge distributed application configured to securely share information among groups of users having various roles, such as doctors and patients. Confidential information may be encrypted client-side, with private keys that reside solely client side. Encrypted collections of data may be uploaded to, and hosted by, a server that does not have access to keys suitable to decrypt the data. Other users may retrieve encrypted data from the server and decrypt some or all of the data with keys suitable to gain access to at least part of the encrypted data. The system includes a key hierarchy with multiple entry points to a top layer by which access is selectively granted to various users and keys may be recovered.

Embodiments of the invention are directed to a method. The method may include transmitting, by a first device, an encrypted first biometric template generated from a first biometric sample of a user of the first device to a second device, wherein the second device inputs the encrypted first biometric template and a second biometric template generated from a second biometric sample of the user into a function to generate an encoded output. The first device may receive the encoded output from the second device, and may decode the encoded output to recover the encrypted first biometric template and the second biometric template of the user. Upon determining a match result between first and second biometric templates, the first device may transmit unique data to the second device.

Systems and methods for device registration and authentication are disclosed. In one embodiment, a method for authentication of a device may include (1)receiving, at a mobile device, a first credential; (2) transmitting, over a network, the first credential to a server; (3) receiving, from the server, a first key and a first value, the first value comprising a receipt for the first credential; (4) receiving, at the mobile device, a data entry for a second credential; (5) generating, by a processor, a second key from the data entry; (6) retrieving, by the mobile device, a third credential using the first key and the second key; (7) signing, by the mobile device, the first value with the third credential; and (8) transmitting, over the network, the signed third value to the server.

A method, computer system, and a computer program product for secure transport of data is provided. The present invention may include defining a trust relationship based on a secret. The present invention may also include associating a trusted transport key identity (TTKI) based on the defined trust relationship. The present invention may then include receiving a trusted transport key (TTK), wherein the TTK is digitally signed and encrypted with the TTKI. The present invention may further include verifying the digitally signed TTK. The present invention may also include enveloping the secret with the TTK.

The present disclosure relates to a communication server and a method for secured transmission of messages from an enterprise server to a telecom server for delivering to end users. The enterprise server comprises a first gateway hosted therein to encrypt and transmit the encrypted messages to the communication server. The communication server comprises a routing unit for routing the encrypted messages from the enterprise server to the user devices via the telecom server. The telecom server comprises a second gateway hosted therein to retrieve the encrypted messages. The user device comprises a third gateway hosted therein to retrieve the encrypted messages from the telecom server in case the decryption is taking place at user device.

A first service submits a request to a second service on behalf of a customer of a service provider. The request may have been triggered by a request of the customer to the first service. To process the request, the second service evaluates one or more policies to determine whether fulfillment of the request is allowed by policy associated with the customer. The one or more policies may state one or more conditions on one or more services that played a role in submission of the request. If determined that the policy allows fulfillment of the request, the second service fulfills the request.