Described herein is a system and method for validating media integrity using asymmetric key cryptography utilizing a public/private cryptographic key pair. The private key is kept secret and is known to an originator and/or publisher of a media file. The public key is added to the media file and is used to validate integrity of the media file, that is, that content of the media file (e.g., portion(s), frame(s)) has not been altered since publication of the media file. By validating integrity of the media file, strong proof that the media file came from an owner of the keypair (e.g., had possession of the private key) can be obtained, for example, resolving issues of trust and/or authenticity common in altered content. In some embodiments, information regarding an origin of the content can further be determined.

A data management and storage (DMS) cluster of peer DMS nodes manages data of a tenant of a multi-tenant compute infrastructure. The compute infrastructure includes an envoy connecting the DMS cluster to virtual machines of the tenant executing on the compute infrastructure. The envoy provides the DMS cluster with access to the virtual tenant network and the virtual machines of the tenant connected via the virtual tenant network for DMS services such as data fetch jobs to generate snapshots of the virtual machines. The envoy sends the snapshot from the virtual machine to a peer DMS node via the connection for storage within the DMS cluster. The envoy provides the DMS cluster with secure access to authorized tenants of the compute infrastructure while maintaining data isolation of tenants within the compute infrastructure.

Methods and systems are disclosed for a digital signature system using scalable and reliable servers. The system includes multiple frontend servers that are each in communication with multiple backend servers. A remote application server sends a signature request to one of the front end servers. The signature request includes at least two public keys that each have a different server identifier embedded in them. The backend server extracts one of the server identifiers and tries the signature generating process with the corresponding back end server. If that that backend server does not respond, then the frontend server extracts the server identifier from another public key and initiates the signature generation process with that backend server. In some systems, the remote application server has a predefined relationship with multiple frontend servers so that if one frontend server is down, the application server can communicate with a backup frontend server.

Systems and methods are disclosed herein for real-time digital authentication. According to some embodiments, a certification authentication method includes receiving a list of third party root certificates from a remote server, the list of third party root certificates including at least one association between a program configured to run on the computing apparatus and a public key for authenticating communication between the program and an associated server of the program. The method may also include authenticating the list of third party root certificates. The method may also include initiating a communication between the computing apparatus and the associated server and authenticating the communication with the associated server using the public key. Furthermore, the method may also include loading the program onto the one or more memories during a bootstrapping process in response to determining that the communication with the associated server is authentic.

Implementations generally relate to providence certificates. In some implementations, a method includes generating a first providence certificate digitally signed with a first private encryption key, where the first providence certificate is associated with a first component of a product, and where the first providence certificate provides a first predetermined assurance. The method further includes generating a second providence certificate digitally signed with a second private encryption key, where the second providence certificate is associated with the product, and where the second providence certificate provides the first providence certificate and a second predetermined assurance.

Methods, apparatus, systems and articles of manufacture (e.g., physical storage media) for software defined silicon security are disclosed. Example apparatus include a trusted agent determiner to (i) determine respective reputation scores associated with a plurality of agents in a mesh network, the plurality of agents associated with a plurality of semiconductor devices, respective ones of the semiconductor devices including circuitry configurable to provide one or more features, and (ii) select, based on the respective reputation scores, a first agent from the plurality of the agents to transmit a request to activate or deactivate at least one of the one or more features. Example apparatus also include an agent interface to, in response to the request, broadcast an activation or deactivation of the least one of the one or more features to the mesh network to cause the trusted agent determiner to update the reputation score of the first agent.

A method for enabling a secure communication with a target device over a network includes: opening an unsecured OPC UA Endpoint by an OPC UA Server that runs on the target device; connecting to the OPC UA Server over the network by an OPC UA Client running on a first device, and requesting the initial device certificate; receiving the initial device certificate by unsecured communication over the network; validating, by the first device, the initial device certificate; establishing, by the first device, a device certificate; encrypting, by the first device, at least the device certificate; sending the encrypted data over the network; decrypting, by the target device, the encrypted data using an initial device private key associated with the initial device certificate to obtain at least the device certificate; storing the device certificate on the target device; and opening a secured OPC UA Endpoint by the OPC UA Server.

A method for authorizing I/O (input/output) commands in a storage cluster is provided. The method includes generating a token responsive to an authority initiating an I/O command, wherein the token is specific to assignment of the authority and a storage node of the storage cluster. The method includes verifying the I/O command using the token, wherein the token includes a signature confirming validity of the token and wherein the token is revocable.

This disclosure relates to a data storage device. A data port transmits data between a host computer system and the data storage device over a data channel. The device repeatedly broadcasts advertising packets over a wireless communication channel different from the data channel. Each advertising packet comprises a random value and a message authentication code calculated based on the random value and an identity key. The identity key is readable by a device to be connected and in proximity of the data storage device out of band of the data channel and the communication channel. The identity key enables the device to be connected to verify the message authentication code based on the random value and the identity key to thereby authenticate the data storage device.

A blockchain value transfer method including receiving a transfer request, executing a first smart contract function to perform data analytics on the transfer request and a second smart contract function to implement a security response responsive to compliance with a security criterion, and recording a result of execution of the second smart contract function to at least one of a relational database, a non-relational database, and an analytics service.