International Business Machines Corporation

Eduarda Freire Stögbuchner

Jan Leonard Camenisch

Anja Lehmann

Christian Cachin

Emmanuel Delamarche

Onur Gökçe

Data masking is provided by, for at least one predetermined data item in data to be sent, applying a one-way function to that data item to produce a first value, producing a masked data item by encrypting the first value via a deterministic encryption scheme using a current encryption key for a current epoch, and replacing that data item by the masked data item. A data-provider computer sends the masked data to the data-user computer. On expiry of the current epoch, the data-provider computer generates a new encryption key for the encryption scheme in a new epoch, produces mask-update data, dependent on the current and new encryption keys, and sends the mask-update data to the data-user computer. The mask-update data permits updating, at the data-user computer, of masked data items produced with the current encryption key into masked data items produced with the new encryption key.

Data masking

Methods are provided for authenticating a container of items to be sent by a sender to a receiver. The method includes: packing a plurality of items, each having a respective item identifier, in the container; providing a container identifier on the container; and generating a first digital signature by signing a message, comprising the container identifier and each item identifier, using a secret signing key skof a signing-verification key pair (sk, pk) of a digital signature scheme. The method further comprises providing the first digital signature for access by the receiver, and sending the container to the receiver. A corresponding verification method comprises accessing the first digital signature, and verifying the first digital signature for the container identifier and the item identifier for each item in the container using the verification key pkof the sender key pair (sk, pk).

Authentication in distribution systems

Methods are provided for producing an authenticated packaged product. The method includes providing on the product a security code encoding security data for the product, packing the product in packaging, and providing a tag carrying encrypted product data on the packaging. The product data comprises the security data for the product. The method further comprises storing a decryption key for the encrypted product data at a network server, and providing on the packaging access data for accessing the decryption key at the network server. Corresponding methods and systems are provided for verifying authenticity of such an authenticated packaged product.

Growing community of inventors

Unterhaching, Germany

Eduarda Freire Stögbuchner