Cisco Technology, Inc.

Nds Corporation

Cyber Armor Ltd.

Leonid Sandler

Yossi Tsuria

Ezra Darshan

Reuven Wachtfogel

Moshe Shlissel

Stephanie Wald

Aharon Rozenhauz

Benyamin Hirschberg

Michael Burns

David Delano Ward

James Neil Guichard

Paul M Quinn

Yaron Sella

Erez Waisbard

Darrin Joseph Miller

Michael E Lipman

Moshe Kravchik

Mike Milano

Alena Lifar

Systems and methods of generating a software module, including: receiving a cryptographic key identification (ID) and a cryptographic operation type from at least one executable program, generating a software module configured to perform the cryptographic operation with a cryptographic key, sending the software module to the at least one executable program, and performing the operation having the cryptographic operation type with the software module, wherein the software module is generated based on at least one of: a transformation of the cryptographic key corresponding to the received cryptographic key ID, and the received cryptographic operation.

System and method for generation of a disposable software module for cryptographic material protection

Systems and methods of verifying runtime integrity with a trusted execution environment (TEE) may include generating, by a processor in communication with the TEE, a secure communication channel between the TEE and at least one executable program attempting to communicate with the TEE, providing, by the processor, a moving target defense (MTD) module to the at least one executable program via the generated secure communication channel, wherein the MTD module comprises disposable polymorphic code, sending over the secured communication channel, by the processor: data, received from the at least one executable program, and a transformed runtime digest of the at least one executable program, and allowing, by the processor, communication with the TEE when the validity of the transformed runtime digest of the corresponding at least one executable program is verified.

System and method of verifying runtime integrity

Various systems and methods for determining whether to allow or continue to allow access to a protected data asset are disclosed herein. For example, one method involves receiving a request to access a protected data asset, wherein the request is received from a first user device; determining whether to grant access to the protected data asset, wherein the determining comprises evaluating one or more criteria associated with the first user device, and the criteria comprises first information associated with a first policy constraint; and in response to a determination that access to the protected data asset is to be granted, granting access to the protected data asset.

Digital data asset protection policy using dynamic network attributes

In one embodiment, a processing device includes a memory to store an executable program including a multiplicity of encrypted component blocks such that different combinations of blocks selected from the encrypted component blocks are operative when decrypted and executed to perform a same functionally equivalent data transformation, each of the component blocks being operative upon execution to convert input data into output data, and a processor operative to receive a selection of cryptographic keys, decrypt some of the encrypted component blocks using the cryptographic keys such that each one of the some encrypted component blocks is decrypted with a different one of the cryptographic keys yielding a multiplicity of decrypted component blocks, and execute the executable program including the multiplicity of decrypted component blocks to perform the same functionally equivalent data transformation. Related apparatus and methods are also described.

Code diversity method and system

A software diversity system including an executable provider to provide an executable program including component blocks such that different combinations of blocks are operative to perform a functionally encryption keys functionally equivalent data transformation, a cipher to encrypt the component blocks with cryptographic keys, a key selector to select a first selection of keys for a first device, such that the first selection is operative to decrypt a first combination of the blocks operative when executed to perform the same functionally equivalent data transformation, and select a second selection of keys for a second device, such that the second selection is operative to decrypt a second combination of the blocks operative when executed to perform the same functionally equivalent data transformation, and a transfer module to prepare for transfer the first and second selection of cryptographic keys for transfer to the first and second device, respectively. Related apparatus and methods are also included.

A method and system of securing content is described, the method including establishing communication between a secure module source and a content rendering device, loading a dynamically generated pseudo-unique secure module to the content rendering device from the secure module source, establishing communication between the secure module source and the dynamically generated pseudo-unique secure module, and transferring a decryption key from the secure module source to the dynamically generated pseudo-unique secure module, thereby enabling decryption of encrypted content, the encrypted content being encrypted according to the decryption key. Related methods and apparatus are also described.

Security device and building block functions

A method for controlling access to content, the method comprising: receiving content in an area in which access to the content is blacked out, the content corresponding to a blacked out event; preventing display of the content at the time of receipt; recording the received content; and allowing access to the recorded content after a time criterion is met, wherein the time criterion comprises an elapse of a predetermined period of time measured from a specified one of the following: commencement of the blacked out event and termination of the blacked out event.

Method and system for control of broadcast content access

A method for controlling access to content, including preventing access to content that corresponds to a blacked out event, until at least one of a time criterion and payment criterion is met. Related methods and apparatus are also disclosed.

Growing community of inventors

Jerusalem, Israel

Leonid Sandler