A computer-implemented method for managing a life-cycle of at least in parts interdependent cryptographic keys is disclosed. Each of the cryptographic keys is signed and relates to a different one of artifacts. The method comprises creating a key manifest, wherein the key manifest comprises data about determined dependencies of the cryptographic keys at a point in time when one of the artifacts is built encrypting the key manifest with a manifest key, and upon a life-cycle change happening to one out of the group comprising one of the artifacts and one of the interdependent cryptographic keys in the key manifest of the one of the artifacts, the method comprises decrypting the key manifest and invoking an action to a related one out of the group comprising the one of the artifacts and at least one of the interdependent cryptographic keys in accordance with the key manifest.

The disclosed technology teaches delegating authorization to access a resource server contingent upon group membership confirmation by a third-party identity management provider. As part of the technology, a client obtains a Macaroon Access Token with a third-party caveat that requires the client to obtain a one-time Discharge Macaroon Authorization from a third-party authority, and identifies both user group membership that needs to be checked, and a hint how to find the third-party authority. The client provides the Macaroon Access Token to the third-party authority. The client obtains, from the third-party authority, a Discharge Macaroon Access Token that identifies user group membership, and sends the Macaroon Access Token and the Discharge Macaroon Authorization to the resource server as proof of authorization.

In a method of generating a secret key according to an embodiment, a share of each of a user and a plurality of other users for a secret key of the user are generated, the share of each of the plurality of other users is provided to a user terminal of each of the plurality of other users, a share of the user for a secret key of each of the plurality of other users is received from the user terminal of each of the plurality of other users, and a new secret key of the user is generated using the share of the user for the secret key of the user and the shares of the user for the secret key of each of the plurality of other users.

Performing cryptographic operations such as encryption and decryption may be computationally expensive. In some contexts, initialization vectors and keystreams operable to perform encryption operations are generated and stored in a repository, and later retrieved for use in performing encryption operations. Multiple devices in a distributed system can each generate and store a subset of a larger set of keystreams.

A method is provided for remotely and securely accessing a modem is provided that uses an encrypted authentication token with a modem password. The method includes receiving an encrypted authentication token from the modem, the authentication token having a modem password stored in secure memory and being encrypted according to a public key, transmitting the encrypted authentication token to an authentication server. receiving a decrypted authentication token from the authentication server, the decrypted authentication token comprising the modem password, generating an authentication key and a privacy key from the modem password, configuring modem interfaces at least in part using the authentication token, the modem interfaces including a network management protocol interface and communicating with the modem using the network management protocol interface according to at least one of the generated authentication key and the privacy key.

A system and method are provided for generating access tokens on a user device rather than via a remote server computer. An access token can be generated on a second user device by combining and encrypting, with format preservation, a primary access identifier, variable value, and salt. The resulting value can be provided to a first user device that can subsequently can provide the access token to an access device as part of an interaction. The access device can generate an authorization request message that comprises the access token and transmit it to a remote server computer for processing. The remote server computer can process the access token to determine the primary access identifier despite not being involved in the generation of the access token, providing an improvement over conventional tokenization methods.

A process of linking a key to a component is disclosed herein. In various aspects, the key may be a password, hash, key, encryption key, decryption key, seed value, unlock code, or other alphanumeric identifier, and the component includes a computer in networked communication, and may further include a specific user of the computer. The process may include the step of identifying a component using environmental variables associated with the component, and the process step of forming a representation of the key unique to the component. The representation is tested to determine that the identified component is the source of the representation, in various aspects. Accordingly, the process may include the step of testing the representation against previous representations thereby determining the representation is not statistically duplicative of previous representations, and the process may include the step of testing the representation against possible representations from the component where the possible representations are unique to the component.

The disclosed embodiments relate to virtual distributed ledger networks provisioning using distributed ledger technology. In one embodiment, a system is disclosed, comprising a hardware processor and a memory device storing instructions executable by the hardware processor to perform operations. The operations comprise creating one or more virtual machines, and executing a plurality of microservices via the one or more virtual machines. At least two of the plurality of microservices are associated with different distributed ledger technology networks. The plurality of microservices include an event routing manager microservice configured to receive a smart contract microservice request and to route events between microservices, a smart contract execution microservice configured to execute a smart contract associated with the smart contract microservice request, and a transaction resource manager microservice configured to commit an outcome of the smart contract execution microservice to a distributed ledger associated with one of the different distributed ledger technology networks.

Facilitating the generation of ephemeral credentials and verification thereof within a distributed storage system is provided herein. Based on a request for ephemeral credentials from a first account client to a first node of a first storage instance of a distributed system, generating the ephemeral credential comprising a session token and a secret session key for the first account client by a method that derives the secret session key using a first account private key and a first storage instance public key. This session token along with a signature generated using the secret session key of the ephemeral credential is subsequently used to make further requests to a second node of a second storage instance of the distributed system where the secret session key is independently derived using information in the request and the previously shared first account private key to verify the signature in the request.

A method provides a firmware update to an electronic device, to code signing for firmware updates of electronic devices, and a system therefor. In particular, the system and method for updates firmware that is authenticated through a public key infrastructure. The method includes an electronic device receiving a firmware update provided with a signature of a signing key, a signing certificate with a signature of a master key, and a revision number. The device verifies the signature of the master key on the signing certificate of the signing key, checks the revision number on the signing certificate of the signing key against a roll back counter, and verifies the signature of the signing key on the firmware update. The device then rejecting or accepting the received firmware update based on the outcome of the above verifying and checking.