This disclosure is directed to cryptographic protection for trusted operating systems. In general, a device may comprise for example, at least processing circuitry and memory circuitry. The device may be virtualized in that the processing circuitry may load virtual machines (VMs) and a virtual machine manager (VMM) into the memory circuitry during operation. At least one of the VMs may operate as a trusted execution environment (TEE) including a trusted operating system (TOS). The processing circuitry may comprise encryption circuitry to cryptographically protect the TOS. For example, the VMM may determine a first memory range in which the TOS will be loaded and store data regarding the first memory range in a register within the encryption circuitry. The register configures the encryption circuitry to cryptographically protect the TOS.

Technologies for securely exchanging sensor information include an in-vehicle computing system of a vehicle to establish a trusted execution environment and a secure communication channel between the trusted execution environment and a corresponding trusted execution environment of a coordination server. A private key is bound to the trusted execution environment of the in-vehicle computing system. The in-vehicle computing system confirms the authenticity of the coordination server, receives sensor data generated by a sensor of the vehicle, and generates an attestation quote based on the trusted execution environment of the in-vehicle computing system. The in-vehicle computing system further transmits, to the coordination server over the secure communication channel, the sensor data, the attestation quote, and a cryptographically-signed communication signed with the private key.

Methods, media, and systems for secure provisioning of servers within a cloud computing environment are provided for herein. In some embodiments, a management service can delegate provisioning of a server of the cloud computing environment to an imaging service. In response, the imaging service can generate an operating system image for the server and can utilize disk encryption to protect to operating system image. In embodiments, a volume encryption key of the disk encryption can be encrypted utilizing a public key of a trusted platform manager of the server, to produce an encrypted volume encryption key that is protected by the trusted platform module of the server. The encrypted operating system image and the encrypted volume encryption key can then be transmitted to the server to cause the server to be provisioned with the operating system image. Other embodiments may be described and/or claimed herein.

The present invention relates to a method of transmitting a message comprising an integrity check and a header, between two processing units via a shared memory, comprising steps of: —generation (501), by a first processing unit, of a first pseudorandom binary string; —encryption (502) of the message to be transmitted by applying an involutive transformation dependent on the first pseudorandom binary string generated; —transmission and storage (503) of the encrypted message in the shared memory; —generation (504), by the second processing unit, of a second pseudorandom binary string; —decryption of the message stored by applying an involutive transformation dependent on the second pseudorandom binary string, and by decrypting the header (505) of said message, by verifying the decrypted header (505), and as a function of the result of the verification, by decrypting the complete message (506); —verification (507) of the integrity of the decrypted message on the basis of its integrity check.

A mobile communications device is provided with a tagging module that tags outgoing communications. Upon receiving the tagged communication, a communications provider requests from a registered owner service identified in the tag whether the mobile communications device identified in the tag is registered with the registered owner service. Upon receiving confirmation from the registered owner service that the mobile communications device is registered with the service, the communications provider provides information regarding the location of the mobile communications device to the registered owner service.

A secure microcontroller system comprising an integrated cache sub-system, crypto-engine, buffer sub-system and external memory is described according to various embodiments of the invention. The secure microcontroller incorporates block encryption methods to ensure that content communicated between the integrated microcontroller and external memory is protected and real-time performance of the system is maintained. Additionally, the microcontroller system provides a user-configurable memory write policy in which memory write protocols may be selected to balance data coherency and system performance.

A security code module is provided that a developer may include in an application. The application, when downloaded onto a mobile communications device, includes the security code module. The security code module then initiates a request to a server to determine the status of the mobile communications device. When the status indicates that the mobile communications device is not in the possession of the registered owner, a security component on the server performs an action in response.

There is provided mechanisms for verifying setup of encryption of a block of data. The method is performed by a client node. A method comprises obtaining an indication to encrypt the block of data. The method comprises providing a first message to a compute node indicating a setup request of a block storage volume, V, to be encrypted, wherein the first message comprises a nonce, N. The method comprises obtaining a second message from the compute node, wherein the second message comprises the nonce, N, and provides validation that a key management node has taken part in setup of the encryption of the block of data and a cryptographic measurement of the compute node, including evidence that the compute node is in a trusted state according to the key management node. There is also provide such a client node. There is further provided a compute node and a method performed by the compute node. There is further provided a key management node and a method performed by the key management node.

A private overlay is provided for information networking that puts the user in charge of the user's personal information. User identity is separated from a numeric tag that points to the cell in which the user equipment can be paged. The private overlay is created by addition of a registration and certification authority such as Public Key Infrastructure and Certification Authority (PKI). The registration and certification authority provides the network and all subscribers with public encryption keys for the network and the users. Private decryption key are generated and stored locally in a suitable manner. With this addition, a private overlay to the existing cellular, wireless or utility distribution infrastructure can be established for a device that has registered with, e.g., a cellular or wireless network or with a utility distribution system.

A blockchain-based trusted platform enhances trustworthiness of data generated by application programs that provide services, such as legal services. Included is an application layer having at least one blockchain-based application program configured to perform steps to provide a service, and a trusted service layer having a trusted timing module, a trusted identity module, and a trusted computing module. For each step of at least some of a plurality of steps, the application program is configured to obtain a verified time stamp from the trusted timing module and a verified identity from the trusted identity module, and/or obtain a computation result based on a processing of blockchain data using the trusted computing module. The trusted computing module records information about a corresponding step that is performed by the application program and the verified time stamp, the verified identity, and/or the computation result in a blockchain.