Symantec Corporation

Fortanix, Inc.

Anand Kashyap

Kevin Alejandro Roundy

Ambuj Kumar

Leylya Yumer

Qiyan Wang

Sandeep B Bhatkar

Christopher Gates

Aleatha Parker-Wood

Yin Liu

Jethro Gideon Beekman

Nehal Bandi

Jeffrey Seyfried

Faisal Faruqui

Andrew John Leiserson

Sanjay Sawhney

Yongjie Cai

Petros Efstathopoulos

Hemant Puri

Olivier Thonnard

Jason Franklin

Eun Kyu Lee

Sudhanshu Shekhar

Karthik Ragunath Balasundaram

A system disclosed herein may receive, from an application associated with a client identification, a request to perform a cryptographic operation with a specified application key, identify a gateway associated with the client identification, identify a respective characteristic of each self-encrypting key management service of a plurality of self-encrypting key management services that correspond to the gateway, identify a self-encrypting key management service with a characteristic satisfying a threshold criterion, and send the request to the identified self-encrypting key management service.

Self-encrypting key management system

A request to execute an application at a secure cryptographic environment of a server may be received. A tag that has been assigned to the application may be received. An attribute of the server may be identified. A determination may be made as to whether the attribute of the server satisfies the tag that has been assigned to the application. In response to determining that the attribute of the server satisfies the tag that has been assigned to the application, an indication may be provided to execute the application at the secure cryptographic environment of the server.

Geo-fencing of an application for a secure cryptographic environment

Encrypted first data and encrypted second data may be received, where each data is from different client servers. A request to perform an operation with the first data and the second data may be received. Whether the operation is authorized to be performed with the first data and the second data at an enclave may be verified. In response to verifying that the operation is authorized to be performed with the first data and the second data at the enclave, the encrypted first data and the encrypted second data may be decrypted to the first data and the second data, respectively. Furthermore, the operation may be performed with the first data and the second data at the enclave.

Secure computation of multiparty data

An encrypted search query may be received from a requesting client system at a secure enclave of a processing device. The encrypted search query may be decrypted to form a decrypted search query. One or more index entries of a metadata index that correspond to the decrypted search query may be identified, such that each identified index entry is associated with a content reference that identifies a content item located outside the secure enclave. The index entries that correspond to the decrypted search query may include one or more index entries having one or more associated index metadata items that correspond to the decrypted search query. One or more secure search results may be generated, such that each secure search result corresponds to one of the index entries and comprises the content reference associated with the corresponding index entry. The secure search results may be sent to the requesting client system.

Secure search service

A request to perform an operation associated with a service instance may be received by a processing device. The service instance may have an associated service instance identifier. A proxy instance associated with the service instance may be identified. The proxy instance may perform operations within a secure enclave associated with the processing device. The proxy instance within the secure enclave associated with the processing device may be used to verify that the secure enclave associated with the processing device contains the service instance associated with the service instance identifier. When the verification is successful, the proxy instance within the secure enclave associated with the processing device may be used to send a request to the service instance to perform the operation.

Secure service mesh

A request may be received from an application for a performance of an operation associated with a cryptographic key that is stored at a secure enclave. A plugin of the secure enclave may be identified from the request for performance of the operation. The operation associated with the cryptographic key may be performed by using the plugin of the secure enclave to generate an output within the secure enclave. The output generated within the secure enclave and based on the plugin may be provided to the application.

Runtime encryption plugin for a key management system

A request to perform an operation with a cryptographic item may be received. A request for approval to perform the requested operation with the cryptographic item may be transmitted to a set of entities based on a policy associated with the cryptographic item. Indications of approval to perform the requested operation may be received from corresponding entities of the set of entities. A determination as to whether a number of the received indications of approval to perform the requested operation with the cryptographic item satisfies a threshold number may be made. In response to determining that the number of the received indications of approval from the corresponding entities of the set of entities satisfies the threshold number, the requested operation may be performed with the cryptographic item.

Obtaining quorum approval to perform an operation with a cryptographic item of a key management system

Authentication information at a first portion of encrypted data may be identified. A cryptographic key may be derived based on a combination of an identification of the first portion of the received encrypted data and a master key. Additional authentication information may be generated based on a combination of the derived cryptographic key and another portion of the received encrypted data. The encrypted data may be verified by comparing the authentication information at the first portion of the received encrypted data with the generated additional authentication information. In response to verifying the received encrypted data, a second cryptographic key may be derived based on a combination of an identification of the another portion of the encrypted data and the master key. The other portion of the received encrypted data may be decrypted by using the second cryptographic key.

Management of and persistent storage for nodes in a secure cluster

A first connection between a first network server and a second network server may be established where the first connection is based on a connection key stored at a secure location of the first network server. A request for one or more cryptographic keys may be transmitted from the first network server to the second network server. The first network server may receive the one or more cryptographic keys from the second network server over the first connection. The one or more cryptographic keys from the second server may be stored at the secure location of the first network server that is storing the connection key used to establish the first connection.

Secure key caching client

A cryptographic key may be received or generated at a self-encrypting key management service application where the cryptographic key is received from another application provided on a server associated with the self-encrypting key management service application. The cryptographic key may be stored at a secure enclave corresponding to the self-encrypting key management service application. A request for a performance of a cryptographic operation associated with the cryptographic key may be received from the other application provided on the server. The cryptographic key at the secure enclave corresponding to the self-encrypting key management service application may be retrieved. The cryptographic operation may be performed with the cryptographic key to generate an output that is provided to the other application.

The disclosed computer-implemented method for identifying non-malicious files on computing devices within organizations may include (1) identifying a file on at least one computing device within multiple computing devices managed by an organization, (2) identifying a source of the file based on examining a relationship between the file and the organization, (3) determining that the source of the file is trusted within the organization, and then (4) concluding, based on the source of the file being trusted within the organization, that the file is not malicious. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for identifying non-malicious files on computing devices within organizations

The disclosed computer-implemented method for preventing targeted malware attacks may include (1) identifying at least one candidate risk factor for targets of previous targeted malware attacks that were directed to the targets based on characteristics of the targets, (2) calculating a degree of association between the candidate risk factor and the previous targeted malware attacks by comparing rates of targeted malware attacks between a group that possesses the risk factor and a group that does not possess the risk factor, (3) identifying a candidate target of a targeted malware attack that possesses the candidate risk factor, and (4) adjusting a security policy assigned to the candidate target of the targeted malware attack based on the calculated degree of association between the candidate risk factor and the previous targeted malware attacks. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for preventing targeted malware attacks

The disclosed computer-implemented method for determining the trustworthiness of files within organizations may include (1) identifying a file on a computing device within multiple computing devices managed by an organization, (2) in response to identifying the file, identifying at least one additional computing device within the multiple computing devices that is potentially associated with the file, (3) distributing at least a portion of the file to a user of the additional computing device with a request to receive an indication of the trustworthiness of the file, and then (4) receiving, from the additional computing device, a response that indicates the trustworthiness of the file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for determining the trustworthiness of files within organizations

Techniques are disclosed for dynamically managing hardening policies in a client computer (e.g., of an enterprise network). A hardening management application monitors activity on the client computer that is associated with a first hardening policy. The monitored activity is evaluated based on one or more metrics. Upon determining that at least one of the metrics is outside of a tolerance specified in the first hardening policy, the client computer is associated with a second hardening policy. The client computer is reconfigured based on the second hardening policy.

Practical and dynamic approach to enterprise hardening

The disclosed computer-implemented method for locating unrecognized computing devices may include (1) identifying a plurality of cooperating computing devices on a wireless network that are each configured with a device location application, (2) determining a physical location for each cooperating computing device within the plurality of cooperating computing devices, (3) receiving, from the device location application on the plurality of cooperating computing devices, data about packets intercepted by the plurality of cooperating computing devices that are directed to the wireless network by an unrecognized computing device, and (4) locating the unrecognized computing device based on information received from the plurality of cooperating computing devices that identifies both the physical location for each cooperating computing device and signal strengths of the packets intercepted by the plurality of cooperating computing devices. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Los Altos, CA, United States of America

Anand Kashyap