Sap Se

Sap Ag

Laurent Y Gomez

Cedric Hebert

Frederic Montagut

Slim Trabelsi

Cedric R J Hebert

Cedric Ulmer

Jochen Haller

Cedric S P Ulmer

Alessandro Sorniotti

Jose Marquez

Konrad Wrona

Annett Laube

Henrik Plate

Anderson Santana De Oliveira

Maarten E Rits

Roger Kilian-Kehr

Pascal T C Spadone

Cédric Hebert

Refik Molva

Cédric R J Hébert

Lorenzo Frigerio

Cédric Hébert

Ivonne Scherfenberg

Cédric Ulmer

Aymen Mouelhi

Ivonne Thomas

José Márquez

Pascal Spadone

Cédric S P Ulmer

Joachim Posegga

Patrick Duverger

Alessadro Sorniotti

Haller Jochen

Disclosed herein are system, method, and computer program product embodiments for intended usage driven data privacy enhancing technique selection. An embodiment operates by extracting insights from a document. The embodiment determines a security classification for the extracted insights. The embodiment determining a formula for the extracted insights. The embodiment extracts a processing requirement and a data requirement from the formula for the extracted insights. The embodiment maps a privacy enhancing encryption technique to the security classification and processing requirement for the extracted insights. The embodiment executes the privacy enhancing encryption technique corresponding to the security classification and processing requirement for the extracted insights.

Data privacy enhancing technique selection

A system and method include execution of program code within an enclave of a trusted execution environment to receive a query identifying an analytic, retrieve an analytic profile corresponding to the analytic from a first distributed ledger, the analytic profile identifying input data and including first code executable to compute the analytic from the input data, retrieve the input data from a second distributed ledger, retrieve cryptographic information associated with the retrieved input data from one or more other enclaves of the trusted execution environment, decrypt the retrieved input data using the cryptographic information, and execute the first code to compute the analytic from the decrypted input data.

Privacy-preserving data and process analytics

In an example embodiment, a combination of machine learning and rule-based techniques are used to automatically detect social engineering attacks in a computer system. More particularly, three phases of detection are utilized on communications in a thread or stream of communications: attack contextualization, intention classification, and security policy violation detection. Each phase of detection causes a score to be generated that is reflective of the degree of danger in the thread or stream of communications, and these scores may then be combined into a single global social engineering attack score, which then may be used to determined appropriate actions to deal with the attack if it transgresses a threshold.

Computer system attack detection

Fairness and output authenticity for secure distributed machine learning is provided by way of an encrypted output of a garbled circuit which is simultaneously provided to a garbler and an evaluator by an output discloser. Related systems, methods and articles of manufacture are also disclosed.

Fairness and output authenticity for secure distributed machine learning

Systems and methods are provided for receiving input data to be processed by an encrypted neural network (NN) model, and encrypting the input data using a fully homomorphic encryption (FHE) public key associated with the encrypted NN model to generate encrypted input data. The systems and methods further provided for processing the encrypted input data to generate an encrypted inference output, using the encrypted NN model by, for each layer of a plurality of layers of the encrypted NN model, computing an encrypted weighted sum using encrypted parameters and a previous encrypted layer, the encrypted parameters comprising at least an encrypted weight and an encrypted bias, approximating an activation function for the level into a polynomial, and computing the approximated activation function on the encrypted weighted sum to generate an encrypted layer. The generated encrypted inference output is sent to a server system for decryption.

Encrypted protection system for a trained neural network

Streaming data is received that is derived from at least one sensor (e.g., IoT sensors, etc.). At least one differential privacy algorithm is subsequently used to anonymize the received streaming data. The modified streaming data can then be provided (e.g., made available, stored, transmitted over a network, etc.) to at least one consuming computing device. Related apparatus, systems, techniques and articles are also described.

Differential privacy processing of IoT streaming data using generative adversarial networks

Disclosed herein are system, method, and computer program product embodiments for mitigating offline decryption attacks of ciphertext. An embodiment operates by inputting plaintext into an encryptor, writing ciphertext output from the encryptor into memory, inputting the ciphertext from memory into a noise generator, outputting ciphertext from memory to an output device in response to receiving a first timing signal from a timer, and outputting noise data generated by the noise generator to the output device in response to receiving a second timing signal from the timer. The output device may be a node in a distributed ledger, in some embodiments. The distributed ledger may include a blockchain, for example. Using techniques disclosed herein, encryption may be strengthened to thwart attempts by untrusted third-party attackers to crack encryption, e.g., of information that is sensitive and/or confidential, even when they use significant computational resources separate from host computers of legitimate parties.

Mitigation of offline ciphertext-only attacks

Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for providing secure mobile data sharing. Actions can include: receiving, by the one or more processors, a request for secure mobile data sharing, the request being received from a mobile device and comprising a security definition; obtaining, by the one or more processors, based at least in part on the security definition of the request: a decryption key, a recipient identifier, and a security policy; receiving, by the one or more processors, a decryption request from a third-party device, the decryption request comprising an identifier distinguishing the third-party device as a recipient of an encrypted message corresponding to the decryption key; and providing the decryption key to the third-party device in response to validating the decryption request.

Secure mobile data sharing

Embodiments are configured for automating security design in IoT systems. The achievable security level for any given IoT system may be assessed based on the capabilities of each of the entities involved in its data path to generate a set of security policies for the IoT system. The capabilities of each entity involved in the IoT data path can be evaluated together with the capabilities of the communication links between entities. Based on these capabilities and user security preferences, the security policies can be generated to achieve a target level security. Based on this approach, security designs of IoT architectures can be developed through automated information collection.

Automated security design for internet of things systems

Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for receiving goal data and start-up information, the goal data indicating a goal to be achieved during a penetration test, the start-up information indicating initial data for beginning the penetration test, receiving tool data from a register of tools, the tool data including one or more tools that can be used during the penetration test, and, for each tool, input data required to execute the tool and output data provided by the tool, processing the goal data, the start-up information and the tool data to automatically generate attack tree data, the attack tree data including a plurality of data sets and links between data sets, and providing the attack tree data to display a graphical representation of an attack tree on a display.

Penetration test attack tree generator

A request handler may be configured to receive an enforcement request for enforcement of an obligation required as a condition for a previously-granted first resource access request. n obligation enforcer may be configured to enforce the obligation, based on the enforcement request, and a compliance manager may be configured to obtain certification of execution of the obligation from an obligation certification service, and to provide the certification as a basis for granting a second resource access request.

Obligation enforcement for resource access control

A computer-implemented method for authentication involves defining a level of trust required for access to a resource independently of any particular authentication mechanism or instance, determining levels of trust associated with a plurality of authentication instances, and selecting and combining two or more of the authentication instances to meet or exceed the required level of trust.

Method and system for authentication by defining a demanded level of security

There are provided a method, a system and an initiator server for a secure execution of workflow tasks of a workflow to be executed according to a given execution pattern in a distributed workflow management system within a decentralized network system with a plurality of servers (b, b, . . . , b) including at least an initiator server and at least a number of groups of servers of the plurality of servers. Each group satisfies a policy (pol) of a vertex, and thus, knows a corresponding policy key pair including a policy private key (SK) and a policy public key (PK), respectively. Each vertex denotes a set of workflow tasks to be executed in accord with the execution pattern and is assigned a vertex key pair including a vertex private key and a vertex public key. The vertex private keys and the policy public keys are jointly encrypted within a first onion structure, the first onion structure being built up of a number of onion layers representing the execution pattern which defines a succession of vertices such that each layer is decryptable by using the policy private key of exactly one vertex thus revealing the corresponding vertex private key.

Method and a system for secure execution of workflow tasks in a distributed workflow management system within a decentralized network system

Embodiments include a system for tracing a collaborative workflow. The system includes an event collector and a transition engine. The event collector may be configured to receive data that represents an event of the collaborative workflow. The collaborative workflow has a local workflow part and a global workflow part. The transition engine may be configured to compute a new instance state of a model of the collaborative workflow. The new instance state represents an instance of the collaborative workflow obtained through the event of the collaborative workflow. The new instance state complies with rules of a local model of the local workflow part and with rules of a global model of the global workflow part.

Growing community of inventors

Le Cannet, France

Laurent Y Gomez