Devices and methods of data communication between a first electronic device and a second electronic device arc disclosed. The disclosed methods optionally comprises obtaining, at the first electronic device a base key having a length of N bits: determining, at the first electronic device, a first updated key based on the base key. vv herein t lie first updated key lias a length of at least N i M bits, is larger than 4. and wherein determining tlic first updated key comprises performing a cryptographic operation, such as a hash function, at least 2M times; and encrypting, at the first electronic dev ice. data with the first updated key for prov ision of cipher data.

Improved pseudonym certificate management is provided for connected vehicle authentication and other applications. Temporary revocation of a certificate is enabled. With respect to Security Credential Management Systems (SCMS), pre-linkage values can be employed. The pre-linkage values can be encrypted using homomorphic encryption. Other embodiments are also provided.

A key management method serves as an electronic control unit (ECU) in an onboard network system having a plurality of ECUs that perform communication by frames via a network. The method includes storing, in a first-type ECU, a shared key to be mutually shared with second-type ECUs, and executing encryption processing regarding a framed transmitted or received via the network, based on the shared key. The method further includes executing, by the first-type ECU, inspection of a security state of the shared key stored by the second type ECUs in a case where a vehicle is in at least one of the following particular states, including immediately after the vehicle is not driving and is entering the accessory-on state, immediately after the vehicle is not driving and the vehicle is entering the accessory-off state, and immediately after the vehicle engine is started.

A method of protecting confidentiality of air-gapped logs comprises: generating, during a first log processing cycle, a data processor key and a drive encryption key, wherein the data processor key and the drive encryption key are unique to a log drive mounted to at least one computer processor; wrapping the drive encryption key with the computer processor key; storing the drive encryption key wrapped by the computer processor key in a database, where the database is mapped to data uniquely identifying the log drive; wrapping the drive encryption key with a default key that is known to at least one originator device; wiping the log drive; and writing the drive encryption key wrapped by the default key to the log drive. Some methods described also include a method of processing logs by an originator. Systems and computer program products are also provided.

A security system is disclosed in which a secure communication session is established between an external security processor and an interface device. After insertion of the external security processor into the interface device, an authorization server provides authorization to the external security processor and the interface device based on, for example, identification information for each device. A derived key may be generated using a common device security key, and a seed value stored at the interface device. The derived key may then be used for multiple communication sessions between the interface device and the external security processor.

An access management and reporting system includes a keysafe that is located outside of a building and a communication system that is located within the building. The communication system is configured to perform, over a short-range wireless communication protocol, two-way communication with a communication module of the keysafe. The system also includes a server that is located remote from the building and the keysafe. The server is configured to perform, over a long-range communication protocol, two-way communication with the communication system located within the building, is configured to manage access to the keysafe, and is configured to handle reporting related to access of the keysafe.

A device receives, from an application, a request to access an attestation key stored in a secure element of the device. The device obtains an attestation policy, by which to verify an identity of the application. The device examines an application file associated with the application, to determine whether the application file satisfies the attestation policy. The device selectively generates a temporary key based on a result of examining the application file. The temporary key may be used to access the attestation key. The temporary key may be generated based on the application file satisfying the attestation policy, and may not be generated based on the application file not satisfying the attestation policy.

Examples described herein provide network enabled control of a security device. Examples include determining that a client device is connected to a network, receiving a request from the client device to instruct a security device to perform an action, wherein the request comprises a key, authenticating the key received from the request, and based on the determination that the client device is authorized to connect to the network, and based on the authentication of the key, sending, by a network device, a signal to instruct the security device to perform the action.

A workflow management system can be used to determine whether a set of transaction events have been properly processed according to a business process rule. A business process rule includes a set of transaction events setup in accordance with a government regulation or an internal company process. An event data may include information associated with a transaction event. A workflow management system includes a workflow management server that receives cryptographically signed transaction event data from one or more additional servers so that the workflow management server can determine whether the received transaction event data comprises a complete or an incomplete transaction.

A network can operate a WiFi access point with credentials. An unconfigured device can (i) support a Device Provisioning Protocol (DPP), (ii) record responder bootstrap public and private keys, and (iii) be marked with a tag. The network can record initiator bootstrap public and private keys, as well as derived initiator ephemeral public and private keys. An initiator can (i) operate a DPP application, (ii) read the tag, (iii) establish a secure and mutually authenticated connection with the network, and (iv) send the network data within the tag. The network can record the responder bootstrap public key and derive an encryption key with the (i) recorded responder bootstrap public key and (ii) derived initiator ephemeral private key. The network can encrypt credentials using the derived encryption key and send the encrypted credentials to the initiator, which can forward the encrypted credentials to the device, thereby supporting a device configuration.