A device management service of a provider network maintain a device repository that is accessible to a remote managed network. The device management service assigns different service credentials for different edge devices indicated by the device repository. For a particular edge device, the device management service provides, based on the service credentials assigned for the edge device, secure transmission of a message between the device management service and a network manager of the managed network. The network manager of the managed network provides secure transmission of the message between the network manager and the edge device based on local credentials assigned for the edge device.

A pseudonym credential configuration method and apparatus are provided. The method includes: receiving an identifier of a terminal device and information about N to-be-requested pseudonym credentials from the terminal device, sending N second request messages to a pseudonym credential generation server, and storing a tag of each second request message in association with the identifier of the terminal device in the registration server, so that the registration server can obtain, based on the tag, the identifier that is of the terminal device and that is associated with the tag; and generating N pseudonym credentials. The pseudonym credential generated in this application may enable a behavior investigation server to learn of a real identity of the terminal device.

A system and method generate private keys for devices participating in a self-certified identity based encryption scheme. A private key is used by the devices to establish a common session key for encoding digital communications between devices.

A computer-implemented method for generating an identity-based cryptographic key, the method comprising: obtaining a set of private key shares and a set of corresponding public key shares, wherein each private key share is generated based on the personal identifier, and wherein at least one of the set of private key shares is generated by a respective one of a set of key-generating parties; generating an identity-based private key based on each of the one or more private key shares; and generating a partial identity-based public key, wherein the partial identity-based public key is generated based on each of the set of corresponding public key shares; transmitting the partial identity-based public key to at least one of the set of key-generating parties for generating the identity-based public key; and/or generating the identity-based public key, wherein the identity-based public key comprises the personal identifier and the partial identity-based public key.

The disclosure relates to, among other things, systems and methods for facilitating the secure recording of assertions made by entities tied to identities. Embodiments of the disclosed systems and methods may allow users to make non-revocable, difficult to forge, cryptographic assertions tied to their identities through the posting of entries in an immutable ledger. In certain embodiments, a user's cryptographic assertions may be preceded by ledger entries which feature certificates from trusted authorities that tie the keys used for making assertions to the user's identity. Further embodiments provide for a mechanism for disabling further entries posted under a user's key, either automatically or at the user's initiation.

A blockchain network control system and method is disclosed. The system includes a processor coupled to a storage comprising a plurality of network entity definitions each defining a different network entity that make up a target network architecture for a permissioned blockchain network. The system also includes a control object communicatively coupled to an ordering service and a plurality of organizations. The plurality of organizations was established by the blockchain network control system by instantiating the organizational membership service provider, registering and enrolling each peer node within each organization, storing the cryptographic identity generated for the peer node, and then instantiating the plurality of peer nodes. The ordering service was established by the blockchain network control system by instantiating the ordering membership service provider, registering and enrolling each orderer node belonging to the ordering service, storing the cryptographic identity generated for the orderer node, and then instantiating the orderer nodes.

This application describes methods, mediums, and systems for verifying a device for use in a messaging system. Using the device verification procedures described, a messaging system can securely authorize new devices to send and receive encrypted messages on behalf of a user, preferably without the need to share a private encryption key between the users' different devices. The application describes several techniques that can be used to provide such a system, including distributing a computer-perceptible code that encodes encryption information between a secondary device and a primary device. This allows the information to be distributed without intervention by a server. Other techniques provide unique ways to build and reverify authorized device lists, distribute encryption keys in chat channels, ensure that lists of authorized devices are distributed in the correct order and remain valid for an appropriate amount of time, add new devices to an ongoing or new conversation, and more.

Certain embodiments disclosed herein provide attestation for a transient version of an application while reusing the attestation and the cryptographic key on which the attestation is based for the full version of the application should the user obtain the full version of the application prior to the transient version being deleted. As an example, a computing device can detect an upgrade event corresponding to replacing an application clip with the full version of the application, and associate the cryptographic key already stored in a key database with the full version of the application. Associating the existing key with the full version of the application enables the full application to automatically take over the attestation previously provided for the application clip, saving time and resources that would otherwise be used for establishing a new attestation for the full version of the application.

The system has a unique identifier (2) stored in client's hardware (1). Via a transfer environment (3) using a higher layer protocol (4), the unique identifier (2) is coupled to a server (5), where, in an evaluation module (6), it is connected to a substitution and calculation module (7). A w polynomial system (8) stored in the persistent memory (9) of the server (5) is also connected to the substitution and calculation module (7), the output of which is a calculated key (10). At the same time, the client's hardware (1) stores a local key (11) which is via the transfer environment (3) using the higher layer protocol (4) connected to a key comparison module (12) to which the calculated key (10) is also connected. The key comparison module (12) is through its positive output (13) and negative output (14) connected via the transfer environment (3) using the higher layer protocol (4) to a response processing module (15) which is stored in the client's hardware (1). The system, at high security levels, provides the required response speed even for a large number of users and/or licenses without significantly increasing the space/memory requirements of computing resources.

A facility operating in a first mobile communication device (MCD) is described. The facility generates a key pair made up of a private key and a public key for use by the first MCD in communicating with other MCDs. The public key has information content. The facility constructs a first public key component and a second public key component, that each encode an incomplete portion of the information content of the public key; and that collectively encode the complete information content of the public key. The facility transmits a wireless message for receipt by other MCDs; it has (1) first contents that identify the wireless message as a notification signal, and (2) as second contents, the first public key component. The second contents are located at a position in the first wireless message that identifies the second contents as the node ID of the first MCD.