Sri International

Karim Eldefrawy

Tancrede Lepoint

Hassen Saidi

Gabriela F Ciocarlie

Michael E Locasto

Tancrède Lepoint

Ivan De Oliveira Nunes

Benjamin Terner

Norrathep Rattanavipanon

Titouan Tanguy

In general, this disclosure describes techniques for replacing target cryptographic primitives in executable binary files with other, potentially more secure, cryptographic primitives. In some examples, a computing system for augmenting cryptographic executables includes a locator to determine if an executable program in an executable binary file includes a target cryptographic primitive. The computing system can include a patch generator to generate patch instructions in response to a determination by the locator that the executable program includes the target cryptographic primitive. The patch instructions cause the executable program to execute a replacement cryptographic primitive instead of the target cryptographic primitive. A rewriter engine of the computing system can modify, based on the patch instructions, the executable program to generate a modified executable binary file.

Augmenting executables having cryptographic primitives

A multiparty computing system includes at least a first compute node and a second compute node, each of the first compute node and the second compute node each configured to execute a multiparty computation. The first compute node is configured to perform first operations of the multiparty computation over a share of first secret data and a share of second secret data; detect a checkpoint event; and, in response to detection of the checkpoint event, save a state of the multiparty computation on the first compute node to a checkpoint storage. In response to detection of a resume event, the first compute node executes a resume protocol with the second compute node, where the resume protocol includes exchanging messages with the second compute node, and determining, based on the messages, an operation in the multiparty computation to be the starting point to resume the multiparty computation.

Checkpointable secure multi-party computation

A method, apparatus and system for providing controlled access to data in a distributed computing environment include storing received data to be accessed via the distributed computing environment in at least one storage device, generating at least one integrity data structure identifying at least a storage location of at least a respective portion of the stored data, storing the generated at least one integrity data structure in a block of a blockchain, encrypting the at least one integrity data structure in the block of the blockchain, and selectively providing at least a portion of at least one decryption key for decrypting the encrypted at least one integrity data structure to enable access to the respective portion of the stored data for which the at least one integrity data structure is generated. Additionally, the stored data can be encrypted and a decryption key can be provided for decrypting the stored data.

Smart privacy and controlled exposure on blockchains

Systems and methods for selectively sharing of portion of unstructured data containers/documents based on security attributes or policies used to encrypt/decrypt data within the unstructured data containers using standard encryption schemes are provided herein. In some embodiments, a system includes a key generation authority to generate encryption keys based on a selected cryptographic security scheme and one or more security attributes or security policies; an encryption service to selectively encrypt one or more data subgroups using the one or more public keys and based on one or more security attributes or security policies assigned to the one or more data subgroups with the unstructured data containers; and a decryption service to decrypt the one or more data subgroups within unstructured data containers using the one or more secret keys and the one or more public keys.

Selectively sharing data in unstructured data containers

An example system can include a reference biometric template (RBT) reader, an authenticator, and an auxiliary system. In some examples, during an initial enrollment process, the RBT reader obtains a biometric from a user, transforms the biometric into an RBT, and provides different shares of the RBT to the authenticator and the auxiliary system. The authenticator and the auxiliary system create respective shares of helper data. In some examples, the authenticator and the auxiliary system use a non-commutative transformation function to embed a secret key in their respective shares of the helper data. The auxiliary system provides its share of the helper data to the authenticator. The authenticator combines its share of the helper data with the share provided by the auxiliary system to create a full version of the helper data. The helper data can be used in a subsequent authentication process between the RBT reader and the authenticator.

Biometric authentication with template privacy and non-interactive re-enrollment

An example computing device includes a functional encryption unit configured to generate a master secret key and public key; apply functional encryption using the public key to biometric information of a user to produce functionally encrypted biometric information, the functional encryption is based on an encryption function that encodes the biometric information, a computation engine configured to perform re-enrollment by at least one of 1) retrieving a pre-generated function key from a memory, or 2) retrieving a dynamically generated function key from the one or more storage nodes that can be inaccessible during user authentication, the function key dynamically generated using the master secret key, and applying, using the function key and functionally encrypted biometric information, a decryption operation to generate new helper data, wherein the new helper data is generated as an evaluation of a cryptographic function during the decryption operation without the need to decrypt the biometric information.

Secure re-enrollment of biometric templates using functional encryption

This disclosure is related to devices, systems, and techniques for automatically generating software packages to provide Secure Computation as a Service (SCaaS). For example, a computing device includes processing circuitry configured to receive a set of information comprising an indication of a first party and an indication of a second party. Additionally, the processing circuitry is configured to generate, based on the set of information, a first software package corresponding to the first party, the first software package configured to implement a secure computation, and generate, based on the set of information, a second software package corresponding to the second party, the second software package configured to implement the secure computation. Additionally, the processing circuitry is configured to export the first software package and export the second software package, enabling the first party device and the second party device to perform the secure computation.

Creating software packages for performing secure computations

An example computing device includes a shares generation unit configured to generate secret shares of biometric information of a user; a storage interface configured to interface with storage nodes for storing each of the secret shares to a corresponding one of the storage nodes; and a computation engine configured to perform re-enrollment by outputting a plurality of messages to instruct each of the storage nodes to generate a respective share of a new helper data in accordance with the secret shares of the biometric information and a secure computation protocol, receive the respective share of the new helper data from two or more storage nodes, and determine the new helper data based on the respective share of the new helper data from each of the two or more storage nodes for subsequent authentication of the user, wherein the re-enrollment occurs without receiving additional/repeat biometric information, thereby resulting in faster re-enrollment.

Growing community of inventors

Palo Alto, CA, United States of America

Karim Eldefrawy