A device can (i) operate a primary platform (PP) within a tamper resistant element (TRE) and (ii) receive encrypted firmware images for operating within the primary platform. The TRE can store in nonvolatile memory of the TRE (i) a PP static private key (SK-static.PP), (ii) a server public key (PK.IDS1), and (iii) a set of cryptographic parameters. The TRE can generate a one-time PKI key pair of SK-OT1.PP and PK-OT1.PP and send the public key PK-OT1.PP to a server. The TRE can receive a one-time public key from the server comprising PK-OT1.IDS1. The TRE can derive a ciphering key using an elliptic curve Diffie Hellman key exchange and the SK-static.PP, SK-OT1.PP, PK.IDS1, and PK-OT1.IDS1 keys. The TRE can decrypt the encrypted firmware using the derived ciphering key. The primary platform can comprise a smart secure platform (SSP) and the decrypted firmware can comprise a virtualized image for the primary platform.

The invention relates to a method for managing exchanges of data between: —a probe (1) comprising a memory containing a probe digital certificate including a probe public key, —a terminal (2) comprising a memory containing a terminal digital certificate including a terminal public key, —a remote platform (3) configured to: .sup.∘deliver the probe digital certificate to the probe and .sup.∘deliver the terminal digital certificate to the terminal, characterised in that the method comprises the implementation of an authentication procedure consisting of the following steps:—a first step in which the probe verifies the identity of the terminal from the terminal digital certificate; —a second step in which the terminal verifies the identity of the probe from the probe digital certificate, and—a third step in which the probe, the terminal and the platform each generate an identical session key from the probe and terminal public keys.

A system can include a certificate application programming interface (API) device that is operable to receive, via an application programming interface (API), an enrollment request for the at least one computerized device. The certificate API device can also generate, via the API, an enrollment package and an end entity certificate package for the at least one computerized device by obtaining the enrollment package and the end entity certificate package from a certificate management service (CMS). The certificate API device can also transmit, via the API, the enrollment package and the end entity certificate package to the at least one computerized device. The system can also include the CMS that is operable to provide the enrollment package and the end entity certificate package to the certificate API device.

A server establishes a secure session with a client device where a private key used in the handshake is stored in a different server. An encrypted connection is established between the first server and the second server. A message is received from the client device that initiates a procedure to establish the secure session between the client device and the first server. As part of this procedure, the first server transmits over the encrypted connection a request to the second server to use the private key. The first server receives, over the encrypted connection, a response to the request that includes a result of the use of the private key. The first server uses the result during the procedure to establish the secure session.

Systems and methods are described for accessing resources of a Unified Endpoint Management (“UEM”) system through an enrolled device. In an example, an unenrolled device can be paired with an enrolled device. The unenrolled device can connect to the enrolled device on a local network. The enrolled device can verify the unenrolled device using a key provided during pairing. The unenrolled device can send requests for UEM resources to the enrolled device, which the enrolled device can send to a UEM server. The UEM server can send the requested UEM resources to the enrolled device, and the enrolled device can send the UEM resources to the enrolled device over the local network.

A network element and a method for execution by such network element. The method comprises processing a plurality of information streams transiting the network element to identify a particular data stream as a suspected bearer of encrypted media, the particular data stream established between a first node and a second node. The method also comprises establishing a first control stream with the first node and a second control stream with the second node, wherein the first control stream is established using credentials associated with the second node. The method further comprises obtaining a cryptographic key sent by the first node over the first control stream and destined for the second node, sending the cryptographic key to the second node over the second control stream, obtaining encrypted media sent by the second node and destined for the first node and decrypting the encrypted media based on the cryptographic key.

Systems and methods for federated privacy management are disclosed. In one embodiment, a method for federated privacy management may include: (1) receiving, at a user management node, and from a client application executing on an electronic device, a device identifier; (2) receiving, by the user management node, and from a second layer node in a multi-layer federated privacy management network, data comprising at least one of browsing data and application data from a web host or a server, wherein the data is in response to an internet protocol request from the client application via a first layer node and the second layer node to the web host or the server, and the data is associated with the device identifier; (3) receiving, at the user management node, a request for the data from the client application using the device identifier; and (4) communicating the data to the client application.

Techniques for connecting known entities to a protected network are described. A user device with a certified application installed is authenticated with an identification repository. The authentication is accomplished using credentials associated with the certified application. The user device is also enrolled with an authentication server and the authenticated user device is connected to the protected network.

Systems and applications are described that use group signature technology to allow for anonymous and/or semi-anonymous feedback while allowing for the application of rules and parameters. The use of group signature technology may serve to potentially mitigate or prevent malicious identification of individuals or entities providing a communication such as feedback. Feedback may range from constructive feedback all the way to the ‘whistleblower’ variety. It may be desirable to identify the individuals as belonging to a particular group or having a particular status or position while maintaining the anonymity of the individuals within the particular group.

The embodiments relate to improved security in computing devices. In some aspects, the techniques described herein relate to a device including: a secure storage area, the secure storage area including a first public key written during manufacturing of the device; a controller configured to: receive data, the data including a payload, digital certificate, and digital signature, validate the digital certificate using the first public key, extract a second public key from the digital certificate; validate the digital signature using the second public key; and process the payload.