A distributed key management system includes a first SCP subsystem coupled to second SCP subsystems via a network. The first SCP subsystem establishes secure communication channels with the second SCP subsystems, and a first key management subsystem in the first SCP subsystem retrieves enabling key(s) for communicating via the secure communication channels from a second key management subsystem in one of the second SCP subsystems, and stores the enabling key(s). The first key management subsystem then receives a first enabling key request from the first SCP subsystem and determines whether the first SCP subsystem is trusted. If the first SCP subsystem is trusted, the first key management subsystem provides the first SCP subsystem access to the at least one enabling key. If the first SCP subsystem is not trusted, the first key management subsystem prevents the first SCP subsystem from accessing the at least one enabling key stored.

A method for resuming a Transport Layer Security (TLS) session in a Service Function Chain comprising a plurality of Service Function nodes coupled to a Service Function Forwarder. A request is received at a first Service Function node to establish a TLS session, and a Pre-Shared Key (PSK) and a PSK identifier that uniquely correspond to the first Service Function node and the TLS session are generated. The PSK identifier is forwarded to one or more of the Service Function Forwarder and the plurality of Service Function nodes. A request to resume the TLS session is received from a client device that previously disconnected. It is determined that the connection request contains the PSK identifier, a second Service Function node is selected, and the TLS session is re-established between the client device and the second Service Function node using the same PSK as the prior TLS session.

Distributed security key management for protecting roaming data via a trusted platform module is performed by systems that include first and second processors, and first and second respective hardware security modules. The first security module encrypts a security key using a public key from the second security module, and the encrypted security key is provided to the second security module. A virtual machine (VM) executed by the first processor has a first virtual security module instance having state data that includes a storage key encrypting VM virtual disk data and that is encrypted with the security key. When a transfer condition is determined, the VM is transferred and executed by the second processor, using a second virtual security module instance, based on decrypting the security key by the second security module using a private key and decrypting the state data for the second virtual security module using the security key.

Receiving a first request message from a first apparatus through a first secure channel, where the first request message includes an identifier of an electronic control unit of a vehicle; obtaining a first key based on the identifier and security information of the first secure channel; and establishing a second secure channel with the electronic control unit based on the first key, where the second secure channel is used for communication between a cloud server and the electronic control unit.

Examples disclosed herein include accessing, by a host device, device information corresponding to an intermediate communication device communicatively coupled to the host device. Identifying, by the host device, a unique identifier corresponding to the intermediate communication device from the accessed device information. Query, by the host device, a public key from a remote resource, based on the identified unique identifier. Receiving, by the host device, the public key from the remote resource. Authenticating, by the host device, the intermediate communication device based on the received public key and a private key stored in the intermediate communication device.

A client system includes a client-side host device, and a client-side storage device including a storage controller and a storage memory. The storage controller includes a host interface, a processor configured to control a read operation and a write operation for the storage memory, and a homomorphic encryption and decryption accelerator configured to, based on receiving a read request from the client-side host device, perform homomorphic encryption on first plaintext data that is read from the storage memory, to generate first homomorphic ciphertext data, and provide the first homomorphic ciphertext data to the client-side host device through the host interface, and based on receiving a write request from the client-side host device, perform homomorphic decryption on second homomorphic ciphertext data that is received through the host interface, to generate second plaintext data, and write the second plaintext data in the storage memory.

A system and method enabling an entity to prove its identity and provide authentic documents/data/information therein at any time required based upon data retrieved from an independent cryptographically verifiable source (ICVS) through a secured channel is disclosed. The system enables a virtual and secure browser on a user computing device allowing a user to login and retrieve authentic information pertaining to the user from the ICVS in a verifiable and untamperable manner. The retrieved information is bounded with origination information of the ICVS and the bounded information is provided to relying entities as authentic information for verification. Also, cryptographic value of the authentic information can be stored in an immutable storage such as blockchain, so that the cryptographic value is used by the relying-party to validate integrity of the authentic information.

Techniques are disclosed for securely distributing entropy in a distributed environment. The entropy that is distributed may be quantum entropy that is generated by a quantum entropy generator or source. The true random entropy generated by a trusted entropy generator can be communicated securely among computer systems or hosts using secure communication channels that are set up using a portion of the entropy. The distribution techniques enable computer systems and hosts, which would otherwise not have access to such entropy generated by the trusted entropy source, to have access to the entropy.

An integrated circuit comprises an interface controller to receive a message, wherein at least a portion of the message is encrypted, a primary processor coupled to the interface controller and configured to process the received message, and a secondary secure processor coupled to the primary processor and to the interface controller. The secondary secure processor is configured to decrypt the portion of the message that is encrypted on behalf of the primary processor, analyze the decrypted portion of the message to determine whether the decrypted portion comprises information pertaining to sensitive data, and responsive to determining that the decrypted portion comprises information pertaining to sensitive data, process the information pertaining to the sensitive data and provide the sensitive data to the interface controller via a secure private bus not accessible by the primary processor.

A technique to cache content securely within edge network environments, even within portions of that network that might be considered less secure than what a customer desires, while still providing the acceleration and off-loading benefits of the edge network. The approach ensures that customer confidential data (whether content, keys, etc.) are not exposed either in transit or at rest. In this approach, only encrypted copies of the customer's content objects are maintained within the portion of the edge network, but without any need to manage the encryption keys. To take full advantage of the secure content caching technique, preferably the encrypted content (or portions thereof) are pre-positioned within the edge network portion to improve performance of secure content delivery from the environment.