Entrust Corporation

Serge Jean Maurice Mister

Michael Ounsworth

John Robert Gray

Murray McCulligh

Roland Thomas Lockhart

Thomas P Chmara

Andrew Assaly

Greg Wetmore

Xavier Guarch

Christopher D Wood

Michael Holtstrom

Chad Autry

A configuration information management system is provided for secure update of dynamic configuration data in a containerized execution environment. A configuration container may be maintained within the environment separately from an application container hosting a secure enterprise application. The secure enterprise application may require secure configuration information for interaction via a secured connection with one or more remote endpoints from within the application container. The configuration container hosts a service that is configured to maintain the secure configuration information on behalf of the secure enterprise application, allowing the secure enterprise application to not persist secure configuration information within the application container.

Secure update of dynamic configuration in containerized execution environment

Methods and systems for cross-certification to bind together two cryptographic systems are disclosed. One method includes receiving, from a first certificate authority at a second certificate authority, a cross certificate request, the cross certificate request including an attribute unique to the first certificate authority. The method includes generating a cross certificate and embedding the hash value as a certificate extension within the cross certificate.

Cross-certification for secure binding of cryptographic systems

Methods and systems for cross-certification to bind together two cryptographic systems are disclosed. One method includes receiving, from a first certificate authority at a second certificate authority, a cross certificate request, the cross certificate request including an attribute unique to the first certificate authority. The method also includes calculating a signature at the second certificate authority based at least in part on the attribute, and calculating a hash value based on a combination of the signature calculated at the second certificate authority and a key associated with the second certificate authority. The method includes generating a cross certificate and embedding the hash value as a certificate extension within the cross certificate.

Root certificates generated by root certificate authorities may be bound at the time of generation. In an example, a first root certificate can include an identity of a first root certificate authority, a first key identifier associated with a first key of the first root certificate authority and an identity of a first digital signature algorithm used by the first root certificate authority. The first root certificate can also include at least one extension including a second key identifier of a second key associated with the second root certificate authority and an identity of a second digital signature algorithm used by the second root certificate authority, the second digital signature algorithm being different from the first digital signature algorithm.

Binding of multiple heterogeneous root certificate authorities

Content, such as an encryption key, may be transmitted between computing systems that both use more than one encryption algorithm. Secrets may be used to encode the content. The different encryption algorithms may be used to separately encrypt the encoded content and the secrets prior to communicating the encrypted, encoded content and encrypted secrets between computing systems.

Composite encryption across cryptographic algorithms

In one example, a proxy server acts as a gateway to a website and modifies the traffic between a web browser on a user device and the website server, as necessary to request protection by providing step-up authentication and/or transaction verification. The proxy server blocks transactions when protection is required but has not occurred (either because the authentication was not proper or due to the detection of another problem). Associated methods and systems are also provided.

Online secure transaction verification system proxy server and method

A method and apparatus for protecting communication of information through a graphical user interface displays a graphical user interface that includes a trusted interaction window. In one example, the method includes continuously determining whether information has been overlayed on top of at least a portion of the displayed trusted interaction window and then disabling an operation being requested when an overlay condition has been determined. In one example, the trusted interaction window is maintained to be the top most window when it is called by an application, for example, during an online transaction, or any other suitable action. The trusted interaction window may be generated via a browser, or operating system, or any other suitable application. As such, the trusted interaction window detects when another window is overlayed on top of it, such as a chromeless window, thereby preventing an unscrupulous party from tricking the user or obtaining sensitive information.

Method and apparatus for protecting communication of information through a graphical user interface

A method and apparatus facilitates the prevention of interception of incoming data, such as keystroke data in the form of a message to an application, by inserting application generated random insertion data into a message stream. The random insertion data is related to actual data that is being generated for a software application so that it is difficult for an attacker to distinguish between actual message data and inserted message data. The system and method then reads incoming data typically in the form of messages, and filters out the messages that it determines were knowingly inserted. The remaining received messages are determined to be actual data from the data source, such as a keyboard, voice input or other suitable data source. In one embodiment, the system effectively hides actual input data such as actual keystrokes in a stream of randomly generated fake keystrokes.

Growing community of inventors

Ottawa, Canada

Serge Jean Maurice Mister