Facilitating the generation of ephemeral credentials and verification thereof within a distributed storage system is provided herein. Based on a request for ephemeral credentials from a first account client to a first node of a first storage instance of a distributed system, generating the ephemeral credential comprising a session token and a secret session key for the first account client by a method that derives the secret session key using a first account private key and a first storage instance public key. This session token along with a signature generated using the secret session key of the ephemeral credential is subsequently used to make further requests to a second node of a second storage instance of the distributed system where the secret session key is independently derived using information in the request and the previously shared first account private key to verify the signature in the request.

A method provides a firmware update to an electronic device, to code signing for firmware updates of electronic devices, and a system therefor. In particular, the system and method for updates firmware that is authenticated through a public key infrastructure. The method includes an electronic device receiving a firmware update provided with a signature of a signing key, a signing certificate with a signature of a master key, and a revision number. The device verifies the signature of the master key on the signing certificate of the signing key, checks the revision number on the signing certificate of the signing key against a roll back counter, and verifies the signature of the signing key on the firmware update. The device then rejecting or accepting the received firmware update based on the outcome of the above verifying and checking.

A method for concurrent training and updating a machine learning (ML) model at an edge node in a peer to peer network using a certifying node is provided. The method includes performing an incremental training of the ML model by a first edge node based on one or more data points associated with a data event. The first edge node ML transfers the incrementally trained ML model to the certifying node. While awaiting a response form the certifying node, the first edge node receives a certified ML model from the certifying node. The certified ML model originates from a second edge node. The first edge node performs an incremental training of the received certified ML model based on one or more data points by re-applying the data points associated with the event data. The first edge node transfers the incrementally trained ML model to the certifying node for certification.

A method for registering and provisioning an electronic device is provided. The method includes a step of inserting a first keypair into a secure element of the electronic device. The first keypair includes a public key and a private key. The method further includes a step of requesting, from a server configured to register and provision connected devices, a provisioning of credentials of the electronic device. The method further includes a step of verifying, by the server, the electronic device credentials. The method further includes a step of registering, by the server, the electronic device. The method further includes a step of transmitting, from the server to the electronic device, a device certificate. The method further includes steps of installing the transmitted device certificate within the secure element of the electronic device, and provisioning the electronic device according to the installed device certificate.

A device management service to facilitate onboarding of a remote IoT device may receive, from a client service, a request for a session certificate for a remote device. The device management service may send the session certificate to the client service, where the session certificate is valid for the remote device to obtain a primary certificate during a session duration. The device management service may receive, from the remote device, a request for the primary certificate for the remote device. The device management service may send, to the remote device, the primary certificate, wherein the primary certificate enables communication between the remote device and the device management service, and wherein the primary certificate has a primary duration that is longer than the session duration. The device management service may establish a communication channel with the remote device according to the primary certificate.

Embodiments of this application disclose a data processing method. The method includes obtaining data that need to be verified from a target trusted computing node; obtaining first ledger data corresponding to the data that need to be verified, the first ledger data being obtained by signing a first message digest by using a private key of the target trusted computing node and being stored in the blockchain network by the target trusted computing node, and the first message digest being obtained by performing message digest calculation on raw data; decrypting the first ledger data by using a public key of the target trusted computing node to obtain the first message digest; performing message digest calculation on the data that need to be verified to obtain a second message digest; and determining a verification result according to the first message digest and the second message digest.

Technology is shown for verifying a leaf certificate in a PM chain of trust involving receiving a leaf certificate signed by an intermediate certificate embedded in the leaf certificate. The intermediate certificate is extracted from the received leaf certificate and its public key used to calculate a signature for the received leaf certificate. The calculated signature is compared to a signature included in the received leaf certificate. The received leaf certificate is verified when the calculated signature matches the signature included in the received leaf certificate. The intermediate certificate can be included as a X.509 property of the leaf certificate.

Systems and methods provide validation of hardware components of an IHS (Information Handling System). An attestation certificate stored to the IHS specifies authenticated instructions for operation of a hardware component of the IHS. This attestation certificate is endorsed by a self-signed root attestation certificate. An identity certificate, also stored to the IHS, specifies an identity of the hardware component and is endorsed using an embedded keypair of the hardware component. The root attestation certificate is validated to ensure it corresponds to the hardware component specified in the identity certificate, where this validation confirms that a public key included in the identity certificate is identical to a public key included in the attestation certificate. Through use of the same public key by both certificates, the attestation certificate can be validated as corresponding to the identity certificate without accessing the embedded keypair of the hardware component used to sign the identity certificate.

This application discloses a method for Internet key exchange protocol (IKE) authentication using a certificate. The method includes: A first device parses a certificate to obtain signature information in the certificate. The first device fills an AUTH payload field in an IKE identity authentication (AUTH) message based on the signature information in the certificate, where signature information indicated by the AUTH payload field matches the signature information in the certificate. The first device sends the IKE AUTH message to a second device. In the method for Internet key exchange protocol IKE authentication using a certificate provided in this application, the first device may automatically parse the signature information in the certificate, and fill the related field of the IKE AUTH message based on the signature information. Therefore, user configuration is simplified and product usability is improved.

A computing device may include a memory and a processor configured to cooperate with the memory to establish a connection with a client device, with the client device having a first credential to connect the client device to a computing service, and the first credential being provided by a proxy. The processor may further receive a request from the client device via the connection to validate the first credential before use of the first credential by the client device, and validate the first credential with use of a second credential for the computing service obtained independent of the proxy.