Raytheon Bbn Technologies Corp.

Raytheon Company

Rtx Bbn Technologies, Inc.

Joud Khoury

Michael Brandon Kremer

William Timothy Strayer

Zachary Ratliff

Jeffery Jay Logan

Michael Hassan Atighetchi

Charles T Hansen

Christopher Paul Vander Valk

Christophe Jean-Claude Merlin

Samuel Cunningham Nelson

Dan Alan Coffin

Subramanian Ramanathan

Jerry Dwight Doty, Ii

Katarzyna Lucja Olejnik

Daniel Alan Gregory

Prithwish Basu

Siddharth Pal

Kimberly Gavin

Armando Luis Caro, Jr

Vikas Kawadia

Benjamin Montgomery

Samuel Cunningham Nelson, V

Jerry Dwight Ii Doty

Techniques for geospatial-temporal pathogen tracing in zero knowledge include: generating, by a first user device, a first proximity token for contact tracing; receiving, by the first user device, a second proximity token from a second user device; generating, by the first user device, a hash based on the first proximity token and the second proximity token; generating, by the first user device using a prover function of a preprocessing zero knowledge succinct non-interactive argument of knowledge (pp-zk-SNARK), a cryptographic proof attesting that an individual associated with the first user device tested positive for a pathogen; transmitting, by the first user device, first publicly verifiable exposure data including at least the cryptographic proof and the hash to a public registry; and applying at least the first publicly verifiable exposure data and second publicly verifiable exposure data to a machine learning model, to obtain actionable intelligence associated with the pathogen.

Geospatial-temporal pathogen tracing in zero knowledge

Techniques for verifiable computation for cross-domain information sharing are disclosed. An untrusted node in a distributed cross-domain solution (CDS) system is configured to: receive a first data item and a first cryptographic proof associated with the first data item; perform a computation on the first data item including one or more of filtering, sanitizing, or validating the first data item, to obtain a second data item; generate, using a proof-carrying data (PCD) computation, a second cryptographic proof that indicates (a) validity of the first cryptographic proof and (b) integrity of the first computation on the first data item; and transmits the second data item and the second cryptographic proof to a recipient node in the distributed CDS system. Alternatively or additionally, the untrusted node may be configured to transmit a cryptographic proof to a trusted aggregator in the CDS system.

Verifiable computation for cross-domain information sharing

Techniques for privacy-preserving contact tracing are disclosed, including: generating, by a first user device, a first proximity token for contact tracing; receiving, by the first user device, a second proximity token from a second user device; generating, by the first user device, a hash based on the first proximity token and the second proximity token; generating, by the first user device using a prover function of a preprocessing zero knowledge succinct non-interactive argument of knowledge (pp-zk-SNARK), a cryptographic proof attesting that an individual associated with the first user device tested positive for a pathogen; and transmitting, by the first user device, publicly verifiable exposure data including at least the cryptographic proof and the hash to a public registry.

Privacy-preserving contact tracing

Techniques for subscriber revocation in a publish-subscribe network using attribute-based encryption (ABE) are disclosed, including: generating a tree data structure including leaf nodes representing subscribers, subtrees of the tree data structure representing subsets of subscribers having different likelihoods of ABE key revocation; generating ABE keys associated with edges in the tree data structure; assigning ABE keys to the leaf nodes, each leaf node being assigned a subset of the ABE keys associated with edges that form a path from a root node to the leaf node; based at least on a revocation record that indicates one or more revoked subscribers, determining a minimal subset of ABE keys that covers all non-revoked subscribers; and encrypting a payload using an encryption policy requiring at least one ABE key in the minimal subset of the ABE keys, to obtain a ciphertext that is not accessible to the one or more revoked subscribers.

Subscriber revocation in a publish-subscribe network using attribute-based encryption

Techniques for cross-domain routing using a fractionated cross-domain solution (F-CDS) are disclosed. A first intermediate node operating in a first physical device in an assured pipeline of the F-CDS receives a data item originating at a source node in a first security domain. The first intermediate node applies a first data filter to determine that the data item complies with a data security requirement of the F-CDS. The first intermediate node transmits the data item to a second intermediate node operating in a second physical device in the assured pipeline of the F-CDS. The second intermediate node applies a second data filter to redundantly determine that first data item complies with the data security requirement of the F-CDS. The second intermediate node transmits the data item to a recipient node in a second security domain via the assured pipeline.

Fragmented cross-domain solution

Techniques for stream-based key management are disclosed. A system obtains a first payload to be published to a first set of one or more subscribers, encrypts the first payload using a symmetric key, to obtain a first payload ciphertext, encrypts the symmetric key using an attribute-based encryption (ABE) policy associated with the first payload, to obtain a key ciphertext, and publishes the first payload ciphertext and the key ciphertext. The system obtains a second payload to be published to a second set of one or more subscribers. Responsive at least to determining that each subscriber in the second set of one more subscribers is in the first set of one or more subscribers and the ABE policy is associated with the second payload, the system encrypts the second payload using the symmetric key, to obtain a second payload ciphertext, and publishes the second payload ciphertext without republishing the key ciphertext.

Stream-based key management

Discussed herein is technology for verifiable network configuration repair. A method can include adding a routing adjacency or route redistribution edge to a router of an aETG to generate an enhanced aETG (eaETG), adding, for each dETG of dETGs, static route edges to a destination of the dETG to generate an enhanced dETG (edETG), determining, for each of the edETGs, all simple paths from all sources to the destination of the edETG, determining a set of paths (pathtset) over the determined simple paths that satisfies the policies, and translating the edge additions and/or removals in the eaETG and in the edETGs to an addition and/or removal of one or more of a routing adjacency, routing filter, or static route based on the determined pathset.

Rapid and verifiable network configuration repair

Generally discussed herein are systems, devices, and methods for generating multi-function waveforms. A device can include input circuitry to receive parameters indicating respective frequencies and codes for the multi-function waveforms, one or more memories to store the respective frequencies and codes, waveform management circuitry configured to produce a series of values based on the frequencies and codes, respectively, and refine the series of values by reducing a cost associated with a waveform produced using the series of values, and a transceiver to generate the waveform.

Polymorphic waveform generation

Generally discussed herein are systems, devices, and methods for scheduling node performance of communication and/or function. A method can include receiving, from a plurality of nodes, parameters indicating a trajectory and position of each of the plurality of nodes, creating a directed communication graph, creating a communications conflict graph, creating a function conflict graph indicating which function performed by one node of the plurality of nodes interferes with at least one of a function and communication performed by another node of the plurality of nodes, creating a universal conflict graph based on the communications conflict graph and the function conflict graph, creating a schedule for communication and function performance for each of the nodes based on the universal conflict graph, and providing data indicative of the schedule to nodes of the plurality of nodes.

Scheduling access to a shared medium

Techniques for cryptographically secure, cross-domain information sharing are described. A first information domain including a first attribute-based encryption (ABE) authority defines a first universe of ABE attributes. Plaintext is encrypted using ABE encryption, producing ABE ciphertext. The ABE encryption uses an ABE access control expression defined with a set of ABE attributes comprising a first ABE attribute subset from the first universe of ABE attributes and second ABE attribute subset from a second universe of ABE attributes defined by a second ABE authority of a second information domain. The ABE ciphertext and the ABE access control expression are combined to produce an ABE package. The ABE package is encrypted, using predicate-based encryption (PBE), producing a PBE ciphertext. The PBE encryption uses a first set of PBE attributes from a universe of PBE attributes defined by a PBE authority.

Cryptographically secure cross-domain information sharing

Generally discussed herein are systems, apparatuses, and methods for scheduling node access to a shared resource. A method can include determining a position assignment for each of a plurality of nodes to create a ring schedule, the ring schedule defining time frames in which each node of the plurality of nodes has access to a resource that is shared among the plurality of nodes, the ring schedule comprising a plurality of epochs, and each of the plurality of epochs comprising a plurality of positions that define a time at which access to the resource begins, each of a plurality of nodes including a position assignment each epoch, and updating the ring schedule including permuting positions of the ring schedule with the position assignment remaining static or changing at least one position assignment in an epoch of the plurality of epochs.

Systems and methods for scheduling of a shared resource

Systems and techniques for policy-based access control in content networks are herein described. Content and metadata describing the content may be encrypted by using an access control policy and a cryptographic key associated with the access control policy. The access control policy may be defined with a set of access control attributes. Each node in the content-based network may be assigned a set of access control attributes and a cryptographic key generated as a function of its assigned set of access control attributes. Each node in the content-based network may be configured to decrypt successfully the metadata or the content if and only if the assigned set of access control attributes of the node satisfies the access control policy used to encrypt the metadata or content.

Policy-based access control in content networks

Embodiments for providing for dissemination of packets in a network performing distributed beamforming are generally described herein. In some embodiments, distributing packets from nodes in a squad local area network using a first waveform to beamforming nodes, providing scheduling to a long link interface for delivering a stream of packets free of scheduling conflict and distributing a copy of the packets from a long link interface based on the provided scheduling and using a second waveform, the first waveform being different from the second waveform.

Growing community of inventors

Boston, MA, United States of America

Joud Khoury