Arris Enterprises LLC

General Instrument Corporation

Google Inc.

Motorola Mobility LLC

Arris Technology, Inc.

Commscope Technologies LLC

Combined Conditional Access Development and Support, LLC

Motorala Mobility LLC

Google Technology Holdings LLC

Alexander Medvinsky

Tat Keung Chan

Xin Qiu

Eric J Sprunk

Ting Yao

Jason A Pasion

Petr Peterka

Paul Moroney

Rafie Shamsaasef

Jinsong Zheng

Jiang Zhang

Lex Aaron Anderson

Madjid F Nakhjiri

Douglas M Petty

Oscar L Jiang

Stuart Moskovics

Ali Negahdar

John I Okimoto

Brian Daniel Mullen

Fan Wang

Shanthakumar Ramakrishnan

Steven E Anderson

Jonathan A Fellows

Nicol C P So

Daniel Torbet

Eric Eugene Berry

Peter Chen

Daniel E Kline

Michael Ryan Pilquist

Jeffrey Dement

William Paul Alberth, Jr

Jay William Strater

Wayne W Ballantyne

Lawrence D Vince

Christopher John Bennett

Christopher Poli

Steven D Upp

Mark G DePietro

Poornima Assudo Lalwaney

Sean Joseph Higgins

Paul Richard Osborne

Kenneth P Miller

Ananth Seetharam

Cheng Li

Liqiang Chen

Kun-Pei P Chen

Devaraj Sambandan

Bill Franks

Jeffrey Scott Markwell

Prashanth Venkatesh

Chia Ling Tsai

Madjid F Nakhijiri

Eric Brunnett-Lazarte

Reshma Shahabuddin

David B Prickett

Katrin Hoeper

Kyle W Stewart

Sven Tomas Hassler

Jiang (Jason) Zhang

Geetha Manglore

Alexey Shevchenko

Fariba Barez

James J Ni

Tat Keung Chen

Stuart P Moskovics

Manglore Geetha

Paul Adrian Nugent

A system and method for receiving secure data in a client device. In one embodiment, the method comprises (a) receiving a token having a token ID and a digital certificate generated by a certificate authority (CA) having client device fingerprint data generated from client device parameters, (b) accepting a request in the client device to provide secure data to the client device, (c) regenerating the client device fingerprint data from the client device parameters, (d) determining, in the client device, differences between the client device fingerprint data of the digital certificate from the regenerated client device fingerprint data, and (e) transmitting a request to a secure data service to provide secure data based upon the determination.

Token node locking with fingerprints authenticated by digital certificates

A method and apparatus, and system for providing device credentials to a plurality of devices is disclosed. The system comprises a credential builder, for generating the credentials or procuring the credentials from a source external to the credential distribution system; a credential loader; a credential server, for accepting credential requests from the devices and for receiving the requested credentials from the credential loader; a first secured interface, communicatively coupling the credential loader and the credential server; a second secured interface, communicatively coupling the credential server and the device; a central credential database, communicatively coupled to the credential loader, for storing each the credentials and a provisioning history of each of the credentials; a credential server database, communicatively coupled to the credential server, for storing the credentials local to the credential server; and a cloning detection system, communicatively coupled to the central credential database and the credential server database, the cloning detection system for detecting duplicate credentials using the credentials stored in the central credential database and the credential server database.

Anti-cloning architecture for device identity provisioning

A system and method for providing a providing security credential is disclosed. In one embodiment, the method comprises accepting a request to generate at least one key in an online data signing system; generating, in a hardware security module communicatively coupled to the online data signing system, a first key Kas a temporary object; encrypting, by the hardware security module, the first key Kaccording to a wrapping key Kw to produce an encrypted first key E[K]; storing the encrypted first key; and providing a second key Kassociated with the first key Kto a user device communicatively coupled to the online data signing system.

Optimized key management for data signing systems

A system and method for signing data is presented. In one embodiment, the method comprises: generating a data signing key; transforming the data signing key into a first subkey and a second subkey; encrypting the first subkey according to a secret key of an ODSS; generating a signature verification public key; providing the signature verification public key, the encrypted first subkey, and the second subkey for storage in a client device; accepting a request to sign the data, the request having a representation of the data and the encrypted first subkey; generating a partially computed signature of the data according to the representation of the data and the encrypted first subkey; and providing the partially computed signature of the data to the client device.

Method and apparatus for two-step data signing

Anti-cloning of device cryptographic keys for counterfeit prevention

A secure cloud-based node-locking service with built-in attack detection to eliminate fuzzing, cloning and other attacks is disclosed. White-box base files are securely stored on the cloud service and are not vulnerable to accidental leakage. A secure cloud-based dynamic secret encoding service reduces the risk of exposure of unprotected secrets and other sensitive data.

Cloud-based whitebox node locking

A system and method for provisioning confidential data such as unique credentials is described. The technique initializes a whitebox cryptographic software module to a particular PKI client to soft-lock whitebox cryptographic operations to the particular PKI client and uniquely encrypting the credentials with a node-locking key (NLK) derivable from a digital certificate.

Method and apparatus for provisioning node-locking confidential data

A system and method for authenticating an application that employs cryptographic keys and functions is provided with white box cryptography employed to secure the application, and to secure communications with the application. The white box includes a transformation of the application and the keys. A secure channel between the white box and a crypto token is used for communications. In some cases, the transformed keys can be employed in authenticating the white box to the crypto token. The presence of a valid crypto token can be periodically determined. In the presence of a valid crypto token, the white box can provide a verifiable message to a remote server. The remote server can verify the message and initiate a service.

Advanced crypto token authentication

A system is provided for configurably signing a secure data image that includes software code that interprets cryptographic atomic code. In the system, a code signing engine includes an interpreter that interprets atomic code signing operations presented in a recipe defined by a system administrator according to configuration parameter values supplied with the input image.

Configurable code signing system and method

A method is provided that permits user to submit a password to the private key that is to be used to decrypt files either at the time of user account setup or at the time of submitting the files. The password is stored securely in the system, permanently or temporarily, and is used later to decrypt the files right before the system is ready to process the files.

Secure deferred file decryption

In one embodiment, a method for secure virtualized wireless base station orchestration comprises: obtaining a node certificate and private key from a global CA defining a PKI signing certificate/private key; obtaining a sub CA certificate/private key from either an edge cloud node cluster or the global CA, using a PKI request signed using the PKI signing certificate/private key; establishing an orchestration access IPsec tunnel to a cloud comprising edge cloud orchestration functions; utilizing the orchestration functions to deploy on the node virtualized entities comprising VNFs of a wireless base station; obtaining at least one VNF certificate and private key for the VNFs from the global CA using a PKI request signed using the global certificate/private key; utilizing the VNF certificate/private key, establishing IPsec tunnels between the VNFs and a wireless network services operator network and/or to an OAM secure gateway for a DMS.

Systems and methods for secure virtualized base station orchestration

A method is provided for securely providing data for use in a consumer electronics device having a processor performing instructions defined in a software image. The method includes receiving the data encrypted according to a global key, further encrypting the data according to a device-unique hardware key, storing the further encrypted data in a secure memory of the consumer electronics device, providing the global key to a whitebox encoder for encoding according to a base key to generate a whitebox encoded global key, and transmitting the software image to the consumer electronics device for storage in an operating memory of the consumer electronics device, the software image having a whitebox decoder utility corresponding to the whitebox encoder and the whitebox encoded global key.

Method and apparatus for protecting confidential data in an open software stack

Growing community of inventors

San Diego, CA, United States of America

Alexander Medvinsky