Intuit, Inc.

Gleb Keselman

Yaron Sheffer

Sergey Banshats

Jeffery Weber

Olla Nasirov

Ernesto Nebel

Noah Kauhane

Vinu Somayaji

Margarita Vald

Alon Rosen

Shimon Shahar

Liron Hayman

Noah Eyal Altman

Noa Haas

Shir Meir Lador

Boaz Sapir

Tzvika Barenholz

Guy Maman

Mike Rooz

Noam Kachko

Michael Gvirtzman

Yair Tayeb

Asaf Brill

The present disclosure relates to deriving cryptographic keys for use in encrypting data based on a plaintext to be encrypted. An example method generally includes receiving, from a querying device, a request for a cryptographic key. The request generally includes data derived from a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted. A cryptographic key is generated based, at least in part, on the derived data and the type of the plaintext value to be encrypted. The key deriver transmits the generated cryptographic key to the querying device.

Cryptographic key generation for logically sharded data stores

Systems and methods that may be used to provide multitenant key derivation and management using a unique protocol in which key derivation may be executed between the server that holds the root key and a client that holds the derivation data and obtains an encryption key. In one or more embodiments, the derivation data may be hashed. The disclosed protocol ensures that the server does not get access to or learn anything about the client's derived key, while the client does not get access to or learn anything about the server's root key.

System and method for multitenant key derivation

Certain aspects of the present disclosure provide techniques for access control. Embodiments include receiving, by a satellite component of an access control system, a request from a computing device to verify an identity of the computing device, wherein the request comprises one or more characteristics of the computing device. Embodiments include verifying, by the satellite component, that the one or more characteristics of the computing device are valid, the verifying comprising one or more interactions with a management entity related to the computing device. Embodiments include generating, by the satellite component, a signed document that is trusted by a control component of the access control system. Embodiments include providing, by the satellite component, the signed document to the computing device for use in requesting credentials from the control component to access a secure resource.

Satellite service for machine authentication in hybrid environments

A processor of a remote crypto cluster (RCC) may receive a public key from a client device through at least one network. The processor of the RCC may obtain an encrypted specific key and a blinded project key from at least one data source through the at least one network. The processor of the RCC may derive a derived key in blind based on the encrypted specific key and the blinded project key. The processor of the RCC may send the derived key in blind to the client device.

Homomorphic key derivation

Aspects of the present disclosure provide techniques for encrypted data management. Embodiments include determining an encrypted data item in a data store that is related to a request from a data consuming user. Embodiments include determining a data owning user and an encryption key that correspond to the encrypted data item based on a key identifier associated with the encrypted data item. Embodiments include determining one or more additional encrypted data items and one or more additional encryption keys that correspond to the data owning user based on key identifiers associated with the one or more additional encrypted data items. Embodiments include generating a single data access ticket comprising information about the data consuming user, the data owning user, the encryption key, and the one or more additional encryption keys.

Encrypted data management system

At least one processor of a central authority separate from a computing process may establish a first trust relationship between the computing process and a central authority separate from the computing process. The establishing may include authenticating the computing process, which may include providing a signed token to the computing process, receiving a request for the certificate from the computing process including the signed token and policy ID data, determining that the computing process is eligible for the certificate according to a policy that associates the certificate with the policy ID data, and validating the signed token. In response to the establishing, the at least one processor may obtain the certificate. The certificate may be signed by a third-party certificate authority with which the central authority has a second trust relationship separate from the first trust relationship. The at least one processor may provide the certificate to the computing process.

Centralized authentication and authorization with certificate management

A processor of a remote crypto cluster (RCC) may obtain an encrypted specific key from at least one data source through at least one network. The processor of the RCC may derive intermediate data in blind based on the encrypted specific key. The intermediate data may include information from which a derived key is derived. The processor of the RCC may send the intermediate data in blind to a client device.

A method for detecting an unauthorized activity on a computer system involves obtaining current time stamps for a first type of access event related to the computer system, determining a current count of the first type of access event using the current time stamps, and predicting an expected count of the first type of access event using a current count of time stamps and a predictive model. The method further involves obtaining an actual count of the first type of access event, executing a first comparison of the actual count with the expected count, determining, based on a test comprising the first comparison, that the unauthorized access to the computer system occurred, and issuing an alert indicating the unauthorized activity occurred.

Intrusion detection based on anomalies in access patterns

The present disclosure relates to processing data queries on a logically sharded data store. An example method generally includes receiving, from a client device, a query. The query generally comprises one or more data items and wherein at least one of the one or more data items comprises sensitive data. A query processor obtains, from a key management server, a cryptographic key to use to encrypt the record based on data derived from the one or more data items comprising sensitive data and a type of the sensitive data. The query processor generates an encrypted query based on the query and the obtained cryptographic key and executes the encrypted query against the logically sharded database.

Processing data queries in a logically sharded data store

A system for distributed authentication provide third party authentication of access requests. A secure computing system is provided which ignores or otherwise denies all access requests from users that have not yet been validated by a separate validation computing system as being authorized to access the secure computing system, but once a given user is validated by a third party authentication system as being authorized to access the secure computing system, results data is made available on the third party validation computing system which effectively enables communication between a user computing system and the secure computing system. Communication is thereafter established and controlled with the user computing system by the secure computing system.

Method and system for providing distributed authentication

A method and system provides access control for sensitive data. An access control system defines a plurality of access policies for gaining access to the sensitive data. Each access policy includes a plurality of rules that indicate whether or not a client machine can gain access to an initial access secret under the policy. If a client machine requests access to the sensitive data, the access control system checks to see if the client machine satisfies the rules of the access policy. If the characteristics of the client machine satisfy the rules of the access policy, then the access control system provides a ticket to the client machine and instructs the client machine to write the ticket to a client machine information database. If the client machine writes the ticket to the client machine information database, then the access control system provides an initial access secret to the client machine.

Authorization to access a server in the cloud without obtaining an initial secret

A method and system provides access control for sensitive data. An access control system defines a plurality of access policies for gaining access to the sensitive data. Each access policy includes a plurality of rules that indicate whether or not the client machine can gain access to an initial access secret under the policy. When the access control system receives access request data from a client machine requesting access to the access control system under one of the policies, the access control system compares characteristics of the client machine to the rules of the access policy. If the characteristics of the client machine satisfy the rules of the access policy in the access control system provides an initial access secret, such as an application key, to the client machine.

Growing community of inventors

Modiin, Israel

Gleb Keselman