A system for security key rotation in a cloud computing environment is disclosed. The system performs steps to at least initiate, at a predetermined interval, a call to determine whether to initiate generation of a public-private key pair for a client application. The system determines whether to initiate generation of the public-private key pair for the client application and based on determining to initiate generation of the public-private key pair for the client application, transmits a control signal requesting generation of the public-private key pair The system generates the public-private key pair and transmits a private key associated with the public-private key pair to a secure storage location for later retrieval by the client application and transmits a public key associated with the public-private key pair to a public key service for later retrieval by a client associated with the client application.

A server can record (i) a first digital signature algorithm with a first certificate, and a corresponding first private key, and (ii) a second digital signature algorithm with a second certificate, and a corresponding second private key. The server can select first data to sign for the first algorithm and the first private key in order to generate a first digital signature. The server can select second data to sign, wherein the second data to sign includes at least the first digital signature. The server can generate a second digital signature for the second data to sign using the second algorithm and the second private key. The server can transmit a message comprising (i) the first and second certificates, and (ii) the first and second digital signatures to a client device. Systems and methods can concurrently support the use of both post-quantum and classical cryptography to enhance security.

There is provided a cryptographic key determination device for determining one or more cryptographic keys in a cryptographic device, the cryptographic device being configured to execute one or more test programs, the cryptographic device comprising one or more components (11-i), each component (11-i) being configured to generate static and dynamic data, the dynamic data being generated in response to the execution of the one or more test programs, wherein the cryptographic key determination device comprises: a data extraction unit configured to extract at least one part of the static data and at least one part of the dynamic data generated by the one or more components (11-i), and a key generator configured to combine the at least one part of static data and the at least one part of dynamic data, and to determine the one or more cryptographic keys by applying a cryptographic function to the combined data.

A multi-phase boot operation of a virtualization manager at a virtualization host is initiated at an offload card. In a first phase of the boot, a security key stored in a tamper-resistant location of the offload card is used. In a second phase, firmware programs are measured using a security module, and a first version of a virtualization coordinator is instantiated at the offload card. The first version of the virtualization coordinator obtains a different version of the virtualization coordinator and launches the different version at the offload card. Other components of the virtualization manager (such as various hypervisor components that do not run at the offload card) are launched by the different version of the virtualization controller.

Methods, systems, storage media for authentication are described. On the methods includes receiving, at a smart contract on a distributed ledger, a signed authentication challenge. The method includes verifying the identity of the user who signed authentication challenge. The method includes raising an event that indicates that the user has been authenticated; wherein a server listens for events from the smart contract, and associates a session between the browser and the server with the user based on the event.

Systems, methods, and other embodiments for decentralized identity with user biometrics are presented herein. In one embodiment, a method includes, in response to a request to access resources of a cloud service provider by a computing device, transmitting a request for a biometric private key to a mobile device associated with a user; in response to receiving the biometric private key, submitting the biometric private key for validation against a blockchain associated with the user and the mobile device; adding a record of the results of the validation to the blockchain; and controlling access to the resources of the cloud service provider based on the record in the blockchain by (i) denying access where the record indicates that validation has failed (ii) granting access where the record indicates that validation has succeeded.

According to certain embodiments, an electronic device comprises: a secure element storing at least one content application and backup data associated with the at least one content application; a memory storing instructions; and a processor electrically connected to the secure element and the memory and configured to executed the instructions, wherein execution of the instructions by the processor causes the processor to perform a plurality of operations comprising: when receiving a message requesting a backup operation from an external electronic device, loading encrypted backup data from the secure element, transmitting the backup data to the external electronic device, and when receiving a message about backup completion from the external electronic device, setting the backup data to an unavailable state.

Methods, systems, and devices for double wrapping for verification are described. In some cases, a memory subsystem can receive a firmware image for the memory subsystem where the firmware image is signed with a first signature according to a first signing procedure. The memory subsystem can then verify an integrity of the firmware image based on the first signing procedure. After verifying the integrity of the firmware image, the memory subsystem can then generate a second signature for the firmware image based on a second signing procedure different from the first signing procedure. The memory subsystem can then write the second signature to the firmware image. The memory subsystem can then perform a verification process to verify the integrity of the firmware image based on one or both of the first signing procedure or the second signing procedure. In this case, a first verification time is associated with the first signing procedure and is greater than a second verification time associated with the second signing procedure.

Provided is a method and/or system that facilitates offline sharing and verifying digital identity claims among NFC enabled portable smart devices that are enabled by enabling applications. The enabled portable smart-devices store, verify and share identity, peer to peer and offline. Each identity claim is digitally signed by an identity issuing authority, and the claim can be verified to reliably detect tampering of the claim and thus brings trust in the process of claim sharing and verifying the identity/credentials embodied in the claim. Either Blockchain or non-blockchain, as the backend system of the method/system, can be used, via an inter-operable middleware layer, for onboarding claim holders, claim verifiers, and claim issuers, and for creating/issuing, for managing digital identity claims. NFC, as the communication protocol, facilitates secure data sharing among the NFC-enabled devices.

Methods, systems, and computer media provide attestation tokens that protect the integrity of communications transmitted from client devices, while at the same time avoiding the use of stable device identifiers that could be used to track client devices or their users. In one approach, client devices can receive batches of N device integrity elements from a device integrity computing system, each corresponding to a different public key. The N device elements can be signed by a device integrity computing system. The signing by the device integrity computing system can be signing with a blind signature scheme. Client devices can include throttlers imposing limits on the quantity of attestation tokens created by the client device.