Intel Corporation

Matthew D Wood

Ernie F Brickell

Marion H Shimoda

Wesley Deklotz

Michael R Premi

Jeff U Glover

Ned M Smith

Vincent J Zimmer

Michael A Rothman

David W Grawrock

Mark D Yarvis

Bradford H Needham

Simon R Hunt

Gary L Graunke

Willard M Wiseman

Nathan Heldt-Sheller

Ylian Saint-Hilaire

German Lancioni

Joseph Frank Cihula

Richard T Beckwith

David A Sandage

David A Cobbley

Pablo A Michelis

In one embodiment, an apparatus comprising a memory to store a first value of a cryptographic key state; and a processor to generate a request to commit the first value of the cryptographic key state into a block of a blockchain, the blockchain to synchronize the cryptographic key state for a plurality of security modules; and generate a one-time cryptographic key based on the first value of the cryptographic key state responsive to a determination that the first value of the cryptographic key state has been committed to the blockchain.

System for synchronizing a cryptographic key state through a blockchain

Techniques for allowing devices to obtain software updates are described. In one scenario, a device broadcasts request for updates to nearby devices of the same type, at least one of which responds indicating an available update. The device requesting the update broadcasts a request for the available update to nearby devices, at least one of which provides at least a portion of the update. In another scenario, a device broadcasts requests for update to nearby devices manufactured by the same manufacturer. At least one device may provide the update, responsive to a determination that the update is available. Alternately, responsive to a determination that the update is not available, the device receiving the broadcast may respond saying the update is not available, then attempt to update the update from an update server. Upon receiving a later broadcast, the device having the update may provide the update to the requesting device.

Method and system to accelerate IoT patch propagation and reduce security vulnerabilities exposure time

The present disclosure is directed to content protection for Data as a Service (DaaS). A device may receive encrypted data from a content provider via DaaS, the encrypted data comprising at least content for presentation on the device. For example, the content provider may utilize a secure multiplex transform (SMT) module in a trusted execution environment (TEE) module to generate encoded data from the content and digital rights management (DRM) data and to generate the encrypted data from the encoded data. The device may also comprise a TEE module including a secure demultiplex transform (SDT) module to decrypt the encoded data from the encrypted data and to decode the content and DRM data from the encoded data. The SMT and SDT modules may interact via a secure communication session to validate security, distribute decryption key(s), etc. In one embodiment, a trust broker may perform TEE module validation and key distribution.

Content protection for data as a service (DaaS)

An embodiment of the present invention provides a method of offering anonymous incentive based context to service providers, comprising delivering context information of a user to the service provider, wherein prior to delivery of the context information to the service provider, the context is anonymized by removing identifying information and aggregating it with context from additional users.

Techniques for monetizing anonymized context

Methods and apparatus to provide secure application attestation using dynamic measurement kernels are described. In some embodiments, secure application attestation is provided by using dynamic measurement kernels. In various embodiments, P-MAPS (Processor-Measured Application Protection Service), Secure Enclaves (SE), and/or combinations thereof may be used to provide dynamic measurement kernels to support secure application attestation. Other embodiments are also described.

Secure application attestation using dynamic measurement kernels

A manufacturing entity provides a blinded signature to a secure device and associates a time with the blinded signature. If a signing key is compromised, the manufacturing entity provides a time of the compromise and the time associated with the blinded signature to the replacement authority.

Replacing blinded authentication authority

An embodiment of the invention includes (a) acquiring a tour start location, a tour constraint, and a first user travel preference for a first user; and (b) determining a tour route, including first and second tour segments, based on the tour start location and the tour constraint. The first tour segment is determined based on the first user travel preference. The tour constraint includes a time constraint that is defined by the first user and includes a maximum allowable time for the tour route. Other embodiments are described herein.

Customized travel route system

A system, apparatus, and method are provided for enhancing entropy in a pseudo-random number generator (PRNG) using remote sources. According to one embodiment of the present invention, first, the PRNG's internal state is initialized. Local seeding information is then obtained from a local host. For added security, additional seeding information is obtained from one or more remote entropy servers operating independently to each maintain a constantly updated state pool. Finally, the PRNG is stirred based upon the local seeding information, and the additional seeding information.

Encrypting message for secure transmission

Receiving a request for an attestation of platform configuration from an attestation requestor, receiving an acceptable configuration, and if the platform matches the acceptable configuration, sending an attestation of platform configuration including a signed response indicating that the platform configuration matches an acceptable configuration to the attestation requester.

Attesting to platform configuration

According to an embodiment of the invention, a method and apparatus for session key exchange are described. An embodiment of a method comprises requesting a service for a platform; certifying the use of the service for one or more acceptable configurations of the platform; and receiving a session key for a session of the service, the service being limited to the one or more acceptable configurations of the platform.

Session key exchange

The system includes receiving, from a delegator, a designation of a role and a delegate to assume the role, receiving, from a credential service provider, an indication that the designation is valid, issuing a delegation credential in response to receiving the indication, and issuing a confirmation to the delegator, which indicates that the delegation credential was issued.

Delegating digital credentials

An arrangement is provided for controlled access to identification and status information or delegated credentials. A delegation, formed between a delegator and a delegate, is registered with a delegate credential service provider. The delegate requests a service from a relying party that then requests, based on the requested service and the delegation, delegated credential from the delegate credential service provider. The delegate credential service provider sends the delegated credential to the relying party. According to the received delegated credential, the relying party generates a service response and sends the response to the delegate.

Controlled access to credential information of delegators in delegation relationships

To protect a private cryptographic key, two values are derived. The two values together can reconstruct the key. One value is sent to a server and deleted from the local machine. The other value is held by the local machine. To use the key, the user will enter a password, which will be used to authenticate the user to the server, and retrieve the value from the server. The password is also used to unlock the value held by the local machine. The private cryptographic key is thus protected against brute force password attacks without changing the behavior of the user.

Growing community of inventors

Hillsboro, OR, United States of America

Matthew D Wood