International Business Machines Corporation

Jan Leonard Camenisch

Anja Lehmann

Gregory Neven

Dieter M Sommer

Thomas R Gross

Kai Samelin

Maria Dubovitskaya

Franz-Stefan Preiss

Michael Waidner

Emmanuel Delamarche

Yossi Gilad

Zoltan Arnold Nagy

Eduarda Freire Stögbuchner

Robert R Enderlein

Matthias Schunter

Guenter Karjoth

Christian Cachin

Daniel Kovacs

Manu Drijvers

Stephan Krenn

Leah Shalev

Shmuel Ben-Yehuda

Julian Satran

Zorik Machulsky

Ilan Shimony

Dirk Husemann

Thomas Basil Smith, Iii

Anthony Bussani

Ton Engbersen

Diego Alejandro Ortiz-Yepes

Onur Goekce

Michael Backes

Endre Felix Bangerter

Kristiyan Haralambiev

Eduarda Freire-Stögbuchner

Peter Buhler

Angelo De Caro

Onur Gökçe

Charles Campbell Palmer

Steven B Adler

Arthur Miles Gilbert

Nigel Howard Julian Brown

Abhi A Shelat

Roger Daniel Zimmermann

Dogan Kesdogan

Adam Charles Nelson

Michael Schnyder

Michael Robert McCullough

Joy Algesheimer

Patrick Towa

Elsie Van Herrewegen

Patrik Bichsel

Birgit Monika Pfitzmann

Tamas Visegrady

Silvio Dragone

Xuan Liu

Michael Charles Osborne

Alessandro Sorniotti

Elli Androulaki

Oliver Augenstein

Gero Dittmann

Edith Gail Schonberg

Christopher J Giblin

Kathryn Ann Bohrer

Victor Shoup

Calvin Stacy Powers

Michael P Waidner

Anna Lysyanskaya

Tommaso Gagliardoni

Elsie A Van Herreweghen

Martin Joseph Clayton Presler-Marshall

Mark Korondi

Ansgar Schmidt

Kaoutar Elkhiyaoui

Andreas X Meier

Thomas Scott Heydt-Benjamin

Esha Ghosh

Matthew P Leonard

Maciej A Koprowski

Cecilia Boschini

Alfredo Rial Duran

Elsie Van Herreweghen

Endre-Feliz F Bangerter

Maciel Koprowski

Susan R Hohenberger

Maciej Koprowski

Joy Algesheimer-Muller

Gunter Karjoth

Methods are provided for producing an authenticated packaged product. A digital signature, dependent on unique message data for the product, is generated via a digital signature scheme using a secret signing key. The message data is provided on at least one of the product and packaging. The digital signature is provided on the other of the product and packaging, and the product is packed in the packaging. The digital signature can be generated via a fuzzy-message digital signature scheme having a verification algorithm for verifying the digital signature in relation to fuzzy data within a predetermined difference measure of the message data. Methods and systems for authenticating such packaged products are also provided.

Authentication of packaged products

Privacy-preserving leakage-deterring public-key encryption techniques are provided. A sender system sends to an authority system a commitment to leakage-deterring-data, and proves in zero-knowledge that the sender system has access to an opening to the commitment. The sender system receives a signature corresponding to a signed commitment to the leakage-deterring-data and an identifier of the sender system. The sender system encrypts a message to a receiver system by applying a one-time pad to the message using a one-time-pad key, and encrypts the result of the application with the public key of the receiver system. The sender system encrypts the one-time-pad key with an attribute-based encryption scheme with a public key of an oblivious decryptor system. The sender system forms a ciphertext from a combination of the encrypted message and the encrypted one-time-pad key and sends the ciphertext to the receiver system.

Privacy-preserving leakage-deterring public-key encryption from attribute-based encryptions

A computer-implemented method for protecting a mobile device against unauthorized access may be provided. The method comprises encrypting the user data stored in a volatile memory of the mobile device if the mobile device is switched to a locked status, and decrypting the user data stored in the volatile memory if the mobile device is switched from the locked status into an unlocked status.

Securing mobile device by RAM-encryption

A method and system for enabling performance of a transaction. A first representation of a transaction policy, which depicts transaction policy options for fulfilling the transaction policy is displayed by a client computer. After a user selects a first transaction policy option, the client computer displays a second representation of the transaction policy, depicting at least one mechanism pertaining to the first transaction policy option for satisfying the requirements of the first transaction policy option. After the user selects a first mechanism, the client computer displays evidence options for each requirement of the first transaction policy option. After the user selects an evidence option for each requirement of the first transaction policy option, the client computer sends to a server transaction enablement information that includes evidence dictated by the selected evidence options to enable the server to perform the transaction.

Enablement of performance of a transaction

An example operation may include one or more of connecting to a blockchain configured to store transactions executed by the participating node, executing a transaction to produce a transaction trail, assigning a transaction identifier (ID) to the transaction, generating a transaction tag based on the transaction ID, and sending to the blockchain the transaction tag and the transaction trail to be entered into the blockchain.

Unfalsifiable audit logs for a blockchain

An example operation may include one or more of connecting, by a participating node, to a blockchain configured to store user assets, receiving, by the participating node, login data from a user, receiving, by the participating node, an asset transfer request from the user identified by the login data, the asset transfer request including identification data of an asset recipient, confirming, by the participating node, that the user is an owner of the asset based on a previous asset transfer transaction associated with the user, verifying, by the participating node, integrity and validity of the asset based on blockchain records, determining, by the participating node, that the asset recipient is a registered user of the blockchain, in response to the determining, by the participating node, that the asset recipient is the registered user of the blockchain, encrypting, by the participating node, an asset transfer transaction by a public key associated with a private key of an auditor; and providing, by the participating node, the encrypted asset transfer transaction to the auditor.

Selective access to asset transfer data

Data masking is provided by, for at least one predetermined data item in data to be sent, applying a one-way function to that data item to produce a first value, producing a masked data item by encrypting the first value via a deterministic encryption scheme using a current encryption key for a current epoch, and replacing that data item by the masked data item. A data-provider computer sends the masked data to the data-user computer. On expiry of the current epoch, the data-provider computer generates a new encryption key for the encryption scheme in a new epoch, produces mask-update data, dependent on the current and new encryption keys, and sends the mask-update data to the data-user computer. The mask-update data permits updating, at the data-user computer, of masked data items produced with the current encryption key into masked data items produced with the new encryption key.

Data masking

Hardware security modules for executing zero-knowledge proofs are provided. Such a module includes multiple computational engines for executing respective primitive operations of zero-knowledge proofs, and memory storing multiple data-flow graphs. Each data-flow graph defines computational functionality of a respective one of the proofs, and comprises a set of nodes, each representing a said primitive operation, interconnected by edges representing input/output data of nodes. At least edges which represent security-sensitive data are indicated by edge-labels in the graphs. The module further comprises a set of registers, comprising at least a subset of secure registers, for storing data during execution of proofs, and a processor configured to control execution, using said engines, of proofs defined by the set of dataflow graphs such that data corresponding to a security-sensitive edge in a graph is stored in a secure register during execution. Corresponding methods and computer program products are also provided.

Hardware security modules for executing zero-knowledge proofs

Communicating a message via a leakage-deterring encryption scheme. A sender computer stores a public key pkof a recipient key-pair (pk, sk) of a message recipient, a commitment c, bound to the public key pk, to a secret s of the message recipient, and a public key pkof a decryptor key-pair (pk, sk). A receiver computer stores a secret key skof the recipient key-pair (pk, sk), the commitment c and an opening o to the commitment. A decryptor computer stores a secret key skof the decryptor key-pair (pk, sk). The sender computer is adapted to encrypt a message m for the message recipient by generating ciphertexts. The sender computer sends the ciphertexts to the receiver computer. The receiver computer is adapted to send a ciphertext to the decryptor computer and provide a proof. The decryptor computer is adapted to verify the proof.

Leakage-deterring encryption for message communication

A method and system configured to produce a cryptographic signature on a message, under a key, at a user computer wherein the key is shared between the user computer, which stores a first key-share, and an authentication computer, which stores a second key-share and a first authentication value. The user computer encodes the message to produce a blinded message, produces the first authentication value from a user password and a secret value, and produces a second authentication value by encoding the first authentication value and a nonce. The authentication computer uses the nonce to determine if the first authentication value is correct and, if so, encodes the blinded message using the second key-share to produce a partial signature. The user computer produces a signature on the message under the key by encoding the partial signature and the message using the first key-share and an unblinding function.

Production of cryptographic signatures

An example operation may include one or more of receiving a signed transaction from a blockchain member device, responsive to receiving the signed transaction, identifying a credential assigned to the blockchain member device, and the credential certifies a public key is assigned to the blockchain member device and was used to sign the signed transaction, determining whether to commit the signed transaction to a blockchain based on the credential, and responsive to determining to commit the signed transaction based on the credential, storing the signed transaction anonymously in the blockchain.

Delegating credentials with a blockchain member service

Methods are provided for authenticating a container of items to be sent by a sender to a receiver. The method includes: packing a plurality of items, each having a respective item identifier, in the container; providing a container identifier on the container; and generating a first digital signature by signing a message, comprising the container identifier and each item identifier, using a secret signing key skof a signing-verification key pair (sk, pk) of a digital signature scheme. The method further comprises providing the first digital signature for access by the receiver, and sending the container to the receiver. A corresponding verification method comprises accessing the first digital signature, and verifying the first digital signature for the container identifier and the item identifier for each item in the container using the verification key pkof the sender key pair (sk, pk).

Authentication in distribution systems

Methods and systems are provided for demonstrating authorization to access a resource to a verifier computer controlling access to the resource. The method comprises, at a user computer, storing an attribute credential certifying a set of attributes; and communicating with a revocation authority computer to obtain an auxiliary credential, bound to the attribute credential, certifying a validity status for each attribute in the attribute credential. The method further comprises, at the user computer, communicating with the verifier computer to prove possession of the attribute credential and the auxiliary credential such that the verifier computer can determine whether at least one attribute in the attribute credential, certified as valid by the auxiliary credential, satisfies an access condition for the resource.

Credential-based authorization

Growing community of inventors

Thalwil, Switzerland

Jan Leonard Camenisch