Embodiments of the disclosure implement techniques to create secure Original Equipment Manufacturer (OEM) identifiers. In one embodiment, a processing system is disclosed. The processing system includes a memory to store an Original Equipment Manufacturer (OEM) key and a processing device, operatively coupled to the memory. The processing device is to receive the OEM key for an OEM system as input to a cryptographic hash function. A device key is produced by applying the cryptographic hash function to the OEM key and a global key associated with a vendor of the OEM system. The device key is provided to a security firmware device to authenticate the OEM system.

Various configurations and methods for providing a secure transfer of data from computing device sensors to a Trusted Execution Environment (TEE) are disclosed. As disclosed, various data flows, data sequences, and configurations are provided to allow sensor data to maintain integrity and confidentiality while being accessed by trusted agents of a TEE. In an example, a microcontroller-based TEE is operated to communicate with a sensor hub via a secure hardware channel. The microcontroller-based TEE is configured to receive the sensor data via the secure hardware channel, and communicate the sensor data to other trusted agents in the computing system via secure communications. Other variations of secure communications among multiple sensors, trusted agents, TEEs, and third party services are also disclosed.

In a method and system for responding to an unauthorized action on a mobile communications device, a cryptographic key is destroyed. The destruction of the cryptographic key is followed by initiating a boot sequence at the mobile communications device where the device is booted into a kernel that restricts operation of the mobile communications device to communications with a server.

Techniques are described herein that are capable of provisioning a trusted execution environment (TEE) based on (e.g., based at least in part on) a chain of trust that includes a platform on which the TEE executes. Any suitable number of TEEs may be provisioned. For instance, a chain of trust may be established from each TEE to the platform on which an operating system that launched the TEE runs. Any two or more TEEs may be launched by operating system(s) running on the same platform or by different operating systems running on respective platforms. Once the chain of trust is established for a TEE, the TEE can be provisioned with information, including but not limited to policies, secret keys, secret data, and/or secret code. Accordingly, the TEE can be customized with the information without other parties, such as a cloud provider, being able to know or manipulate the information.

An authentication system facilitates a transfer of enrollment in authentication services between client devices. The authentication system enrolls a client device in authentication services to enable the client device to be used for authenticating requests to access one or more services. As part of enrolling the client device, the authentication system receives authentication enrollment information for the client device that is associated with one or more authentication credentials securely stored on the client device (e.g., a multi-factor authentication (MFA) certificate). The authentication system facilitates one or more processes for transferring the enrollment from an enrolled client device to a non-enrolled client device that limit the number and complexity of actions performed by the user. In particular, the authentication system facilitates transfer of enrollment based on receiving enrollment transfer requests authorized by the enrolled client device using one or more authentication credentials associated with the enrollment of the enrolled client device.

A method including receiving, by an infrastructure device from a first user device, a request to provide a list of available user devices that are available for authenticating the first user device with a service provider; receiving, by the infrastructure device from the first user device, a selection message indicating a selection of a second user device for authenticating the first user device; transmitting, by the infrastructure device to the second user device based on receiving the selection message, an authentication message indicating that the second user device is to authenticate the first user device; receiving, by the infrastructure device from the second user device, one or more encrypted authentication factors associated with authenticating the first user device; and transmitting, by the infrastructure device to the first user device, the one or more encrypted factors associated with authenticating the first user device with the service provider is disclosed.

According to certain general aspects, the present embodiments relate generally to securing communication between ECUs. Example implementations can include a method of securely transmitting Controller Area Network (CAN) protocol frames via a CAN controller.

Techniques are disclosed for enabling attested end-to-end encryption for transporting data between devices. In one example, a destination device receives a policy profile that includes an origination key and a destination key, and the origination key corresponds to a public transfer key of a source device. The destination device verifies the policy profile based on the destination key corresponding to a public transfer key of the source device. The destination device receives a signed encrypted data encryption key from the source device. The destination device receives encrypted data from the source device. The destination device verifies the signed encrypted data encryption key originated from the source device based on the signed encrypted data key being signed with a private attestation identity key that corresponds to a public attestation identity key of the source device. The destination device decrypts encrypted data using a private transfer key of the destination device.

In one general embodiment, a computer-implemented method includes performing a firmware update on a hardware component of a computer system. A hash value associated with the update of the firmware is collected, and added to Platform Control Registers (PCRs) of multiple Trusted Platform Module (TPMs) of the computer system. The hash value is logged in a log file. At a predetermined time, PCR values are received from the TPMs. The PCR values are compared to determine whether all PCR values match. In response to one of the PCR values not matching, a warning is issued.

This disclosure is directed to automated processes for attesting to trustworthiness of a host considered for connection to a data center network. The attestation process is performed in two attestation phases. In the first phase, attestation is performed on a smart network interface controller (SNIC) connected to an internal bus of the host using a first trusted platform module (TPM) of the SNIC. In the second phase, attestation is performed on the host by the SNIC using a second TPM connected to the internal bus of the host in response to a determination that the SNIC is trustworthy. The host is connected to the data center network in response to a determination by the SNIC that the host is trustworthy.