Methods and systems are disclosed for a digital signature system using scalable and reliable servers. The system includes multiple frontend servers that are each in communication with multiple backend servers. A remote application server sends a signature request to one of the front end servers. The signature request includes at least two public keys that each have a different server identifier embedded in them. The backend server extracts one of the server identifiers and tries the signature generating process with the corresponding back end server. If that that backend server does not respond, then the frontend server extracts the server identifier from another public key and initiates the signature generation process with that backend server. In some systems, the remote application server has a predefined relationship with multiple frontend servers so that if one frontend server is down, the application server can communicate with a backup frontend server.

Embodiments of the present invention provide a system for facilitating a secure way to allow primary users and secondary users to perform interactions remotely via an automated machine and one or more auxiliary devices on the same local network. In particular, the system may assign exclusive control over an automated device and one or more auxiliary devices to a primary user via a computing device connected to the same local network or virtual private network as the automated machine, and may allow the primary user to communicate via the automated machine with a secondary user who wishes to complete one or more resource interactions.

An authority transfer system comprising a client, a resource server, a server that receives, from the client, an authorization request requesting permission to access to a resource managed by the resource server, and a user terminal possessed by an owner of the resource is provided. The server registers a first user terminal in accordance with a registration request of the first user terminal being received from the first user terminal, and determines whether or not a registered second user terminal can be deregistered in accordance with a registration cancellation request being received from the first user terminal, and if it is determined that the second user terminal can be deregistered, authenticates the first user terminal or the second user terminal, and deregisters the second user terminal in accordance with the authentication.

Some embodiments of the invention provide a method for a trusted (or originator) device to modify the security state of a target device (e.g., unlocking the device) based on a securing ranging operation (e.g., determining a distance, proximity, etc.). The method of some embodiments exchanges messages as a part of a ranging operation in order to determine whether the trusted and target devices are within a specified range of each other before allowing the trusted device to modify the security state of the target device. In some embodiments, the messages are derived by both devices based on a shared secret and are used to verify the source of ranging signals used for the ranging operation. In some embodiments, the method is performed using multiple different frequency bands.

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Additionally or alternatively, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls to the tenant's virtual network.

Various embodiments include computing devices and methods for management of access credentials. A processor of a computing device may receive an authentication request from a client application support service to authenticate a client application. The processor may send a response comprising an authentication token to the client application support service. The processor may receive from the client application support service a request for an access token to access a target system. The processor may send a response comprising the access token to the client application support service to enable the client application support service to access the target system using the access token on behalf of the client application.

A tunnel connection is enabled between a user terminal and a service provider using a simpler network configuration. A communication system 10 includes a user terminal 20, a service provider 30, a carrier network 40 that connects the user terminal 20 and the service provider 30 to each other, and a network control device 50 that controls the carrier network 40. The network control device 50 sets respective virtual tunnel end points (VTEPs) for a POI terminal 46 that is on the carrier network 40 and that is connected to the service provider 30 and for the user terminal 20, and sets a virtual tunnel between the virtual tunnel end points. The user terminal 20 communicates with the service provider 30 via the virtual tunnel.

Aspects of the disclosure relate to an automated monitoring of proximate devices. A computing platform may cause a reporting device to detect a target device in a local network, retrieve network data associated with the target device, and send, to an intermediate server, the network data. The computing platform may send, to the intermediate server, a query. The intermediate server may send the network data in response to the query. Based on the network data, the computing platform may determine an amount of time that has elapsed since network activity was previously detected for the target device, and based on a determination that the amount of time exceeds a predetermined time threshold, the computing platform may generate an alert notification indicating that the target device may need to be traced. Subsequently, the alert notification may be sent to the reporting device.

A method and processing system for managing user access to one or more resources is disclosed. A central service may receive an access change request message regarding a user. The access change request message may include a user identifier, a user role, and an access action for the user. Example access actions may include adding or removing user access with respect to a resource. The central service may determine which resources are associated with the user role and transmit one or more event messages to the resources to implement the access actions. The resources may send acknowledgement messages to the central service to confirm that the access actions have been completed.

A messaging system for exchanging messages between nodes in a network via a broker that uses a publish-subscribe message protocol, which nodes have object identifications (IDs). Messages between the nodes are routed using the object IDs of the nodes. Secure communication is provided using authentication according to digital certificates being used as first and second tiers by a commissioning broker and a data broker, respectively, in which the second tier certificate used by the data broker has a shorter lived expiration time.