Cyberark Software Ltd.

Boris Spivak

Evgeni Aizikovich

Michael Yavnilovich

Yair Sade

Dima Barboi

Tal Kandel

Hadas Elkabir

Disclosed embodiments relate to verifying identities based on identity-inherent data that is inaccessible to the system. Techniques include receiving, from a client, an encrypted token, the encrypted token having been encrypted at the client using a cryptographic key created at the client based on identity-inherent data of an identity of the client; wherein the identity-inherent data of the identity is not itself received by the system, and wherein the cryptographic key is accessible only to the client; and storing the encrypted token in association with a hash of a decrypted version of the encrypted token to allow for comparing the stored hash with a created hash and determining whether to verify the identity based on a result of the comparing.

Verification of client identities based on non-distributed data

The disclosed embodiments include systems and methods for dynamically managing privileged access for non-privileged accounts. Operations may include receiving a request from a computer device associated with a network account to access a privileged resource, wherein the network account lacks any privileged account membership enabling the network account to access the privileged resource. Operations may include authenticating the network account, and assigning, based on the authentication, privileged on-demand membership for the network account, wherein the privileged on-demand membership enables the network account to access the privileged resource. Operations may also include identifying that the network account should no longer have access to the privileged resource, and removing, based on the identification, the privileged on-demand membership for the network account.

Providing privileged access to non-privileged accounts

Disclosed embodiments relate to systems and methods for authenticating users of personal computing devices using encoded versions of the temporary and unique codes. Techniques include receiving a first cryptographic key having been created by a personal computing device and corresponding to a second cryptographic key maintained on the personal computing device; associating a user identifier with the first cryptographic key; accessing a temporary and unique code; accessing an encoded version of the temporary and unique code; making available to the personal computing device the encoded version of the temporary and unique code; receiving, from the personal computing device, a signed version of the temporary and unique code, the signed version having been signed by the second cryptographic key; verifying, using the first cryptographic key, the signed version of the temporary and unique code; and determining, based on the verifying, whether to authenticate the user of the personal computing device.

Growing community of inventors

Petach-Tikva, Israel

Boris Spivak