Emc IP Holding Company LLC

Digital Equipment Corporation

Microsoft Technology Licensing, LLC

International Business Machines Corporation

Digital Equipment Corp., Patent Law Group

Dell Products Inc.

Cabletron Systems, Inc.

Lotus Development Corporation

Lotus Development Coporation

Charles W Kaufman

Radia Joy Perlman

Butler W Lampson

Morrie Gasser

Xuan Tang

Paul J Leach

Melissa Wood Dunn

Raja Krishnaswamy

Carl Melvin Ellison

Ravindra Pandya

Joseph J Tardo

Gregory William Lazar

William R Hawe

Russell Holden

Jane B Marcus

Alan D Eldridge

Mark F Kempf

Amar Gupta

Floyd J Backes

Scott M Davidson

Srinivasa R Kolaparthi

Alan Joseph Kirby

Jeffrey M Cooperstein

Andrew C Goldstein

B J Herbison

Michael D Downen

Kannan Alagappan

Mark A Champine

Daryl Carvis Cromer

Kenneth D Ray

David Carroll Challener

James Peter Ward

Raymond Edward Ozzie

Mark Charles Davis

Michael Todd Kramer

Dmitry Nikolayevich Tylik

Adrian Mihail Marinescu

Stephen M Matyas

Yordan Ivanov Rouskov

Yossef Saad

Cormac E Herley

Ross W Callon

William R Tipton

Nikolaj Skallerud Bjorner

Carl Kraenzel

Dhruv Manmohandas Desai

Marc E Seinfeld

Akhilesh Kaza

James S Miller

Mark A Alcazar

Andrew M Herron

Jonathan White Keljo

Jonathan D Schwartz

Barry A Spinney

Senthil Ponnuswamy

G Paul Koning

Stuart Schechter

Asad Yaqoob

Jerry D Hutchison

Naizhong Chiu

John M Hawkins

Krassimir Emilov Karamfilov

George Varghese

Christopher William Gunner

Yi Fang

Aaron Ross Goldfeder

Viresh Ramdatmisier

Jackson Brandon Myers

Vasu Subramanian

Karthick Jayaraman

Gregory M Waters

Eric M Patey

Hernando Ovies

John D Immerman

Matthew Charles Setzer

Duncan G Bryce

Chris L Anderson

Stephen Alan Fisher

Ping Zhang

Steven Robert Beckhardt

Pankaj Mohan Kamat

Jingyan Zhao

Igal Figlin

Karen Elizabeth Corby

John Richard McDowell

George Papadopoulos

Gregory W Lazar

Arun Moorthy

Eric Baize

Venkata Rama Prasad Tammana

Jamie Pocas

Danny V Dhillon

Shailesh Padmakar Joshi

Radia J Pearlman

Andre A Needham

Jeff Cooperstein

Paul J Lach

Suze Berthold

Xiongfei Chen

Robert E Thomas

Techniques for providing increased support for deduplication and compression of encrypted storage volumes. The techniques include receiving, at a storage virtual machine (VM), a data encryption key (DEK) associated with encrypted volume data, in which the DEK is wrapped in a key encryption key (KEK). The techniques include receiving, at the storage VM from a client virtual machine (VM), a write request specifying the encrypted volume data. The techniques include obtaining, by the storage VM, the KEK from a key management system (KMS) embedded on the storage VM. The techniques include unwrapping, by the storage VM, the DEK using the KEK, and decrypting, by an IO decryptor hosted by the storage VM, the encrypted volume data using the DEK. The techniques include performing, by the storage VM, data reduction operations on the decrypted volume data, and storing, by the storage VM, the data-reduced volume data on a storage array.

Systems and methods of supporting deduplication and compression of encrypted storage volumes

One example method includes generating a biometric of a user, requesting, and receiving, biometric data from a card, comparing the biometric data with the biometric, and when the biometric data matches data of the biometric, authorizing a transaction requested by a user using the card. The request for biometric data may identify what particular type of biometric data is compatible with the device making the request, and the biometric data may be a subset of the data that makes up the biometric.

Secure, low-cost, privacy-preserving biometric card

One example method includes sending, by a sender, a commitment message, wherein the commitment message is digitally signed by the sender but is not verifiable by a recipient until a public key is revealed by the sender, transmitting, by the sender, the commitment message to the recipient, confirming, by the sender, that the commitment message has been received by the recipient, and only after receipt of the commitment message has been confirmed by the recipient, revealing in a second message, by the sender, the public key, wherein the public key is usable by the recipient to verify that the commitment message was validly signed by the sender.

Safe use of legacy digital signatures in a post-quantum world

A technique for managing communications between a server and multiple clients includes configuring the server to support multiple sets of certificates for respective clients having respective root certificates. The technique further includes determining an indicator associated with a client root certificate during an initial handshake between a client and the server and providing the client with a server certificate associated with the indicator.

Managing trusted communications between server and clients

A method of sending blocks of data from a client to be stored at a storage server, wherein for each block compression and encryption is performed at the client, and deduplication is performed at the server. Security is thus enhanced as the block is compressed and encrypted when it is sent over an unsecured network and when it is stored in potentially a third-party backup system. Provisions are made to enable addition of new compression algorithms and for retirement of old compression algorithms, while ensuring that a client would not receive a block which was compressed using an unsupported, e.g., retired, compression algorithm. In some examples a compression algorithm ID is tied to an encryption key version to enable refresh of blocks compressed with old algorithm.

Client-side compression

An encrypted data storage system includes a storage system that is configured to store encrypted data, and a first client device that is coupled to the storage system. The first client device performs a hash operation on first data to generate a Data Encryption Key (DEK), and uses the DEK to perform a data encryption operation on the first data to generate encrypted first data. The first client device then uses a first Key Encryption Key (KEK) to perform a first key encryption operation on the DEK to generate a first encrypted DEK, associates the first encrypted DEK with the encrypted first data, and transmits the encrypted first data to the storage system for storage.

Encrypted data storage system

Methods, apparatus, and processor-readable storage media for prioritizing patching of vulnerable components are provided herein. An example computer-implemented method includes obtaining information indicative of a first set of components embedded in a software package; determining risk levels for respective ones of the components in the first set based on a data flow representation of the software package; and assigning a priority for patching a software vulnerability in a given component of the first set based at least in part on the risk level of the given component.

Prioritizing patching of vulnerable components

One example method includes accessing stored data, associating a unique identifier with the data, creating a hash by hashing a combination that comprises the unique identifier and the data, transmitting the hash to a notary service, receiving, from the notary service, a digital signature that corresponds to the hash, appending the digital signature to the data, and storing, as an object, a combination that comprises the digital signature, the data, and the unique identifier.

Ensuring data authenticity using notary as a service

In a cloud-based multiple client encryption and deduplication environment, secret plaintext data of a client is encrypted to produce ciphertext in an enclave comprising a trusted execution environment which is inaccessible by unauthorized entities and processes even with administrator privileges. Encryption is performed with an initialization vector and an encryption key calculated in the enclave. The encrypted ciphertext is deduplicated prior to storage by comparing a hash of the corresponding plaintext data to hashes of previously stored plaintext data.

Protection of secret client data in a multiple client data deduplication environment

An apparatus in one embodiment includes at least one processing device comprising a processor coupled to a memory. The processing device is configured to implement a first ledger maintenance node. The first ledger maintenance node is configured to communicate over one or more networks with a plurality of additional ledger maintenance nodes, to identify a block for proposed addition to a distributed ledger collectively maintained by the first and additional ledger maintenance nodes, to apply a digital signature of the first ledger maintenance node to the block, and to receive digital signatures on the block from at least a subset of the additional ledger maintenance nodes. Responsive to receipt of sufficient digital signatures from respective ones of the additional ledger maintenance nodes to meet a specified quorum of digital signatures required for addition of the block to the distributed ledger, the first ledger maintenance node adds the block to the distributed ledger.

Efficient and secure distributed ledger maintenance

A method, computer program product, and computing system for coupling password-resetting content to an IT computing device. The password-resetting content is validated on the IT computing device. The password-resetting content is processed to reset one or more passwords associated with the IT computing device.

Password resetting system and method

A method for managing documents includes obtaining, from a first computing device, a first signed document, and in response to obtaining the first signed document: identifying a first plurality of validity services associated with the signed document, sending a verification request to the first plurality of validity services, wherein each of the plurality of verification requests specifies the first signed document, obtaining a plurality of verification responses from the first plurality of validity services, and making a determination, based on the plurality of verification responses, that the first signed document is valid.

Method and system for a signed document validity service

In general, embodiments of the invention relates to a method for managing data, the method includes obtaining, by an untrusted device and from a querying system, an item query, identifying a leaf block of a hierarchical block tree associated with the item query, identifying a plurality of indirect blocks that allow the querying system to calculate a top hash of the hierarchical block tree, and sending an item query response to the querying system, wherein the item query response specifies the leaf block, the plurality of indirect hashes corresponding to the plurality of indirect blocks, and a signature of the top hash, wherein the signature is obtained from a trusted system.

Method and system for querying a secure database located on an untrusted device

Techniques for providing secure deduplication in a data storage system using smaller hash values. The techniques employ a keyed hash function to generate keyed hash values for data blocks received at the data storage system. The keyed hash function can generate keyed hash values having an acceptable probability of accidental collision, in which each keyed hash value requires a reduced number of bits to represent them. By representing each keyed hash value with a number of bits less than the number required for a cryptographic hash value, the impact that an index table in main memory has on the amount of free memory space available can be reduced, while still providing an acceptable probability of accidental collision. The keyed hash function can be implemented as a keyed universal hash function, which can reduce the number of processor cycles required to generate a keyed hash value for each received data block.

Secure data deduplication with smaller hash values

An apparatus in an illustrative embodiment comprises a client device configured for communication with a storage system, with the client device comprising a processor coupled to a memory. The client device is further configured to identify a data item to be stored in the storage system, and to generate a data encryption key for the data item as a function of a first secret key and the data item. For example, the function may comprise hashing at least the data item. The client device is further configured to encrypt the data item using the data encryption key for the data item, and to send the encrypted data item to the storage system for storage therein. The client device in some embodiments is further configured to encrypt the data encryption key using a second secret key, and to send the encrypted data encryption key to the storage system for storage therein as metadata of the data item.

Client-side encryption supporting deduplication across single or multiple tenants in a storage system

Growing community of inventors

Redmond, WA, United States of America

Charles W Kaufman