Blackberry Corporation

Digital 14 LLC

Research in Motion Corporation

Dark Matter Gmbh

Certicom Corporation

Alexander Sherkin

Ravi Singh

Neil Patrick Adams

Nikhil Vats

Michael Matovsky

Alexander Truskovsky

Serguei Velikevitch

Eugene Chin

Will D Franco

Michael S Brown

Kamen B Vitanov

Laura Doktorova

Michael Anthony Carrara

Milap Sheth

Herbert Anthony Little

Michael Shenfield

Surender Kumar

Viera Bibr

Bryan R Goring

Christopher Lyle Bender

Nedim Fresko

Brindusa L Fritsch

Gregory Marc Zaverucha

Christopher Smith

Laura Brindusa Fritsch

Michael Hung

Srimantee Karmakar

Marcel Florin Leica

Osman Zohaib Arfeen

Yevgeny Bondar

Peter Gordon Beshai

Viere Bibr

Brindusa Laura Fritsch

Marcel F Leica

Kamen Vitanov

A system, method, and computer program product are provided for implementing hardware backed symmetric operations for password based authentication. In operation, a system receives a request to access software utilizing password-based authentication. Further, the system receives a password for the password-based authentication. The system computes a hash utilizing the password and a hardware-based authenticator associated with hardware of the system utilizing hardware backed symmetric encryption. Moreover, the system verifies that the hash computed utilizing the password and the hardware-based authenticator is correct for accessing the software.

System, method, and computer program product for performing hardware backed symmetric operations for password based authentication

A system, method, and computer program product are provided for sending and receiving messages using a noisy cryptographic system. To send a message, N secret keys are negotiated using a noisy cryptographic system, where K secret keys are expected to be noiseless. A secret polynomial that includes the N secret keys is generated, and K points on the secret polynomial are derived. For each of the N secret keys, a secret key MAC key is derived and a secret key MAC is calculated using the derived secret key MAC key. A secret key MAC header is generated that includes an array of each of the secret key MACs and possibly a corresponding public key. Message integrity plaintext is generated that includes an encrypted message, the secret key MAC header, and an array of the K points on the secret polynomial. A final message that includes the message integrity plaintext is generated for being sent.

Error-correcting key agreement for noisy cryptographic systems

Zero round trip secure communications are implemented based on noisy secrets with a polynomial secret sharing scheme. A sender identifies two negotiated noisy secrets associated with an encrypted message to send to a receiver system. The sender utilizes a first negotiated noisy secret for sub-key selection, and generates a secret polynomial using Shamir's polynomial-based secret sharing scheme with N positive integer points and a message key as a secret. The sender divides the first negotiated noisy secret into a plurality of sub-keys, and divides a second negotiated noisy secret into test blocks of a length equivalent to a length of a sub-key. The sender utilizes each of the plurality sub-keys for encrypting a corresponding test block along with one unique point of the secret polynomial. Moreover, the sender sends all encrypted test blocks and corresponding encrypted points of the secret polynomial to the receiver with the encrypted message.

System, method, and computer program product for implementing zero round trip secure communications based on noisy secrets with a polynomial secret sharing scheme

A system, method, and computer program product are provided for performing hardware-backed password-based authentication. In operation, a system receives a request to access software utilizing password-based authentication. Further, the system receives a password for the password-based authentication. The system computes a hash utilizing the password and a hardware-based authenticator associated with hardware of the system. Moreover, the system verifies that the hash computed utilizing the password and the hardware-based authenticator is correct for accessing the software.

System, method, and computer program product for performing hardware-backed password-based authentication

A system, method, and computer program product are provided for sensitive data recovery in high security systems. In operation, a client device receives a request by a user to initiate a data recovery process to recover data that is encrypted. The client device generates a new data recovery request key pair. The client device creates a data recovery request that includes a data recovery request public key. The client device signs the data recovery request using an identity private key that is associated with a certificate issued by a certification authority (CA). The client device sends the data recovery request to a server system storing the data. The server system accesses an offline data recovery subsystem (ODRS) storing a data recovery key pair to authenticate the user. The ODRS generates and stores a secret data recovery code. The client device receives the secret data recovery code that was communicated to the user. The client device sends the secret data recovery code along with the data recovery request to the server system. The server system verifies the received secret data recovery code against the stored secret data recovery code. The server system verifies a public key associated with the received data recovery request against a public key associated with a stored recovery request. The server system identifies the data recovery request as authenticated. The ODRS verifies a request signature associated with the data recovery request. The ODRS verifies the encrypted signature against encrypted and signed recovery data. The ODRS verifies that a user ID in a password reset request matches a user ID in a message encryption key signature. The ODRS decrypts the data recovery key pair and re-encrypts the data recovery key pair to the data recovery request public key. The ODRS stores the re-encrypted data recovery key pair associated with the data recovery request. The client device queries the server system to obtain the data. The server system returns the data to the client device. The client device decrypts the data using a data recovery private key.

System, method, and computer program product for sensitive data recovery in high security systems

A system, method, and computer program product are provided for implementing zero round trip secure communications based on a noisy secret. In operation, a sender system utilizes a randomly generated message key for encrypting a message to send to a receiver system. The sender system selects a plurality of different sub-keys from a negotiated noisy secret to encrypt the randomly generated message key. The sender system encrypts the message utilizing the randomly generated message key. The sender system sends the encrypted message, all encrypted message keys, and a message MAC that is calculated and added for every sub-key, to the receiver system such that the receiver system is able to perform a MAC-based verification to test sub-key validity of the plurality of different sub-keys.

System, method, and computer program product for zero round trip secure communications based on noisy secrets

Zero round trip secure communications is implemented based on noisy secrets with a polynomial secret sharing scheme. A sender identifies two negotiated noisy secrets associated with an encrypted message to send to a receiver system. The sender utilizes a first negotiated noisy secret for sub-key selection, and generates a secret polynomial using Shamir's polynomial-based secret sharing scheme with N positive integer points and a message key as a secret. The sender divides the first negotiated noisy secret into a plurality of sub-keys, and divides a second negotiated noisy secret into test blocks of a length equivalent to a length of a sub-key. The sender utilizes each of the plurality sub-keys for encrypting a corresponding test block along with one unique point of the secret polynomial. Moreover, the sender sends all encrypted test blocks and corresponding encrypted points of the secret polynomial to the receiver with the encrypted message.

Zero round trip secure communications is implemented based on two noisy secrets. A sender system: calculates a required number of sub-keys to have at least one noiseless sub-key; for each first negotiated secret sub-key, uses the sub-key to encrypt a first half of a message key and test bytes, and adds the encrypted first half of the message key and the encrypted test bytes to the encrypted message; for each second negotiated secret sub-key, uses the sub-key to encrypt a second half of the message key and the test bytes, and adds the encrypted second half of the message key and the encrypted test bytes to the encrypted message; and sends the encrypted message, message MAC information, encrypted first halves of the message key with associated encrypted test bytes, and encrypted second halves of the message key with associated encrypted test bytes to a receiver.

System, method, and computer program product for zero round trip secure communications based on two noisy secrets

A system, method, and computer program product are provided for implementing zero round trip secure communications based on a noisy secret with a reduced message size. A receiver system receives from a sender system an encrypted message including encrypted message keys and a message MAC that is calculated and added for every sub-key. The receiver system determines if any one of the sub-keys is noiseless based on its corresponding message MAC. If none of the sub-keys are noiseless, the receiver system adjusts bits of the sub-keys until a sub-key with one noisy bit is found and corrected to form a noiseless sub-key. The noiseless sub-key is then processed to obtain a message key to decrypt the encrypted message.

System, method, and computer program product for zero round trip secure communications based on a noisy secret with a reduced message size

A system, method, and computer program product are provided for end-to-end security of centrally accessible group membership information. In use, membership information defining a user group in a messaging system is accessed from a central server, where the membership information includes (1) at least one change to members of the user group, and (2) for each change of the at least one change, a digital signature of a user that made the change. Additionally, a verification process on the membership information is performed, including: for each change of the at least one change, verifying the digital signature of the user that made the change. Further, members of the user group are determined, as a result of the verification process, and at least one action is performed in association with the members of the user group.

System, method, and computer program product providing end-to-end security of centrally accessible group membership information

An apparatus, computer program, and method are afforded for providing a peer-to-peer security protocol. In operation, a message is identified that is directed from a first peer device to a second peer device. Further, the message is copied, so that a copy of the message is caused to be sent to an auditing server.

Peer-to-peer security protocol apparatus, computer program, and method

A system, method, and computer program product are provided for peer-to-peer event ordering using a two part event identifier. In use, a peer-to-peer communication channel is established by a first peer device with a second peer device. A current event identifier is initialized at the first peer device, and the second peer device initializes a different current event identifier at the second peer device. A plurality of events are communicated between the first peer device and the second peer device, where the events are each configured to include an event identifier that is the current event identifier of a sender of the event, and where the current event identifier includes two portions that are updated differently when sending and receiving events. Further, the events are ordered by the first peer device, using the event identifier included with each of the events.

System, method, and computer program product for peer-to-peer event ordering using a two part event identifier

A system, method, and computer program product are provided for multi-layer encryption of an efficient broadcast message. In use, a message is identified that includes data to be broadcasted to a plurality of recipients as well as identifiers of the plurality of recipients. The message is encrypted using a first encryption process to form a first header portion and a first data portion. Additionally, the message with the first data portion is encrypted using a second encryption process to form a second header portion and a second data portion. Further, the first header portion is encrypted using a third encryption process to form a third header portion. A multi-layer efficient broadcast message is then formed for broadcasting the data to the plurality of recipients, the multi-layer efficient broadcast message including the second header portion, the third header portion, and the second data portion.

System, method, and computer program product for multi-layer encryption of an efficient broadcast message

Growing community of inventors

Woodbridge, Canada

Alexander Sherkin