Thomson Licensing

Nxp B.v.

Interdigital Ce Patent Holdings

Marc Joye

Mohamed Karroumi

Benoit Libert

Joppe Willem Bos

Fariborz Salehi

Jan Hoogerbrugge

Wilhelmus Petrus Adrianus Johannus Michiels

Eric Diehl

Alain Durand

Fariborz Assaderaghi

Marc Eluard

Niclas Stahl

Yan Michalevsky

Jaideep Chandrashekar

Davide Alessio

Akshay Pushparaja

Jean-Marc Boucqueau

Azin Ashkan

Raveen Goundar

Benjamin Richard

Alvita Tran

Yan-Mei Tang Talpin

Swayambhoo Jain

Shi Zhi

Ahmed Ullah Qureshi

Junyang Qian

A method and data processing system for detecting tampering of a machine learning model is provided. The method includes training a machine learning model. During a training operating period, a plurality of input values is provided to the machine learning model. In response to a predetermined invalid input value, the machine learning model is trained that a predetermined output value will be expected. The model is verified that it has not been tampered with by inputting the predetermined invalid input value during an inference operating period. If the expected output value is provided by the machine learning model in response to the predetermined input value, then the machine learning model has not been tampered with. If the expected output value is not provided, then the machine learning model has been tampered with. The method may be implemented using the data processing system.

Method for preventing the extraction of a machine learning model

A method is provided for protecting a trained machine learning model that provides prediction results with confidence levels. The confidence level is a measure of the likelihood that a prediction is correct. The method includes determining if a query input to the model is an attempted attack on the model. If the query is determined to be an attempted attack, a first prediction result having a highest confidence level is swapped with a second prediction result having a relatively lower confidence level so that the first and second prediction results and confidence levels are re-paired. Then, the second prediction result is output from the model with the highest confidence level. By swapping the confidence levels and outputting the prediction results with the swapped confidence levels, the machine learning model is more difficult for an attacker to extract.

Method for hardening a machine learning model against extraction

A method for performing a secure evaluation of a decision tree, including: receiving, by a processor of a server, an encrypted feature vectorx=(x, . . . ,x) from a client; choosing a random mask &#x3bc;; calculatingmand sendingmto the client, whereinm=x&#x2212;t+&#x3bc;and tis a threshold value in the first node in the first level of a decision tree'; performing a comparison protocol on mand &#x3bc;, wherein the server produces a comparison bit band the client produces a comparison bit b&#x2032;; choosing a random bit s&#x2208;{0,1} and when s=1 switching a left and right subtrees of&#x2032;; sending b&#x2295;sto the client; and for each level=1, 2, . . . , d&#x2212;1 of the decision tree&#x2032;, where d is the number of levels in the decision tree&#x2032;, perform the following steps: receiving from the clientywhere k=0, 1, . . . ,&#x2212;1; performing a comparison protocol onand, whereinis a random mask andis based upon,x,,y, andand the server produces a comparison bitand the client produces a comparison bit; choosing a random bit&#x2208;{0,1} and when=1 switching all left and right subtrees at levelof&#x2032;; and sending&#x2295;to the client.

Privacy-preserving evaluation of decision trees

Various embodiments relate to a method of encrypting a message m using a Paillier cryptosystem, including: computing a ciphertext c based upon the message m, N, and r, where N is the product of two distinct primes p and q, and r is randomly chosen such that r&#x2208;[1, N); computing a first verification value based upon u and N, where u is randomly chosen such that u&#x2208;[1, N); computing a second verification value s based upon u, r, the ciphertext c, the verification value, and a hash function H.

Encryption schemes with additional properties

A method for producing a white-box implementation of a cryptographic function using garbled circuits, including: producing, by a first party, a logic circuit implementing the cryptographic function using a plurality of logic gates and a plurality of wires; garbling the produced logic circuit, by the first party, including garbling the plurality of logic gates and assigning two garbled values for each of the plurality of wires; and providing a second party the garbled logic circuit and a first garbled circuit input value.

White-box implementations with garbled circuits

The present disclosure provides a method () and apparatus () for inhibiting the interruption of the content being consumed by a user that is provided by an entertainment system. The method () and apparatus () of the present disclosure may detect an interruption event and determine, based on the current state of a user, whether the interruption event matches the current state of the user. If the method () and apparatus () of the present disclosure determine that the interruption event does not match the current state of the user, the method () and apparatus () of the present disclosure may inhibit the interruption of the content being consumed by the user.

Method and apparatus for inhibiting the interruption of content being consumed by a user

A method for performing a secure comparison between a first secret data and a second secret data, including: receiving, by a processor of a first party,encrypted bits of the second secret data y from a second party, whereis an integer; computing the Hamming weight h of first secret data x, wherein x hasbits; computing the value of a first comparison bit &#x3b4;such that &#x3b4;=0 when h&#x3e;&#x2514;/2&#x2518;, &#x3b4;=1 when h&#x3c;&#x250c;/2&#x2510;, and &#x3b4;is randomly selected when h=/2; forming a set of &#x2514;/2&#x2518; indexesthat includes at least the indexes i where x=&#x3b4;; selecting random invertible scalars rfor each i inand computingc*=(1+(1&#x2212;2&#x3b4;)x&#xb7;y&#xb7;(x&#x2295;y))whereinwdenotes the homomorphic encryption of w using a cryptographic key of the second party; selecting random invertible scalars rand computingc*=(&#x3b4;&#xb7;x&#x2295;y); transmitting ciphertextsc*in a random order to the second party.

Privacy preserving comparison

A method for protecting against faults in a computation of a point multiplication Q=[k]P on an elliptic curve E defined over a prime field, including: defining an integer r and a group'={&#x3b3;()|&#x2208;/r} represented with elements having a group law that coincides with a group law used in the representation for E() and isomorphic to an additive group (/r)through isomorphism &#x3b3;; forming a combined group E()&#xd7;&#x2032;E()&#xd7;(/r)which is isomorphic to a cross product of the groups E() and (/r); selecting an elementin/rand defining an element P&#x2032;=&#x3b3;() in group&#x2032;; forming a combined element {circumflex over (P)}=CRT(P,P&#x2032;) in the group E()&#xd7;&#x2032;; calculating {circumflex over (Q)}=[k]{circumflex over (P)} in the combined group E()&#xd7;&#x2032;; calculating kin/r; and checking whether {circumflex over (Q)}&#x2261;Q&#x2032;(mod r) where Q&#x2032;=&#x3b3;(k).

Protecting ECC against fault attacks

A method for computing the distance between two encrypted data vectors using elliptic curve cryptography.

Distance-revealing encryption

An asset, which is a graphical 3D object, is protected at a processor of an encryption device that obtains the asset and a proxy including polyhedrons, processes points of the asset to obtain transformed points lying within the polyhedrons of the proxy, and outputs a protected asset including the transformed points. A decryption device including a processor decrypts the protected asset by obtaining the transformed points of the protected asset, processing transformed points using a reverse of the transformation to obtain reconstructed points of the asset, and obtaining a reconstructed asset using the reconstructed points.

Devices and methods for encryption and decryption of graphical 3D objects

A user inputs a password at a user device whose processor receives the password, retrieves a stored derived value resulting from a derivation function, preferably a cryptographic one-way function, applied to a reference password, scrambles the received password using a function taking the derived value as a variable to obtain a scrambled password, and sends the scrambled password to an authentication server. In case the stored derived value cannot be retrieved, the processor uses the derivation function to generate a derived value from the received password. In case the password is received during generation of a new password, the processor generates and stores a derived value from the new password. In an embodiment, the apparatus comprises the authentication server.

Apparatus and method for password authentication

In one embodiment, it is proposed a signing method delivering a partial signature associated with a message, said partial signature being used in a threshold signing method, the signing method being executed on an electronic device. Such signing method is remarkable in that it comprises signing a hash of said message with a one-time linearly homomorphic structure preserving signature method with a partial secret key, said partial secret key being obtained from an output of a secret sharing scheme, and said signing delivering said partial signature associated with said message.

Signing method delivering a partial signature associated with a message, threshold signing method, signature verification method, and corresponding computer program and electronic devices

A threshold encryption system comprising a sender device configured to generate ciphertexts and at least one entity device configured to perform partial decryption of ciphertexts. The system is based on Cramer-Shoup encryption systems and use linearly homomorphic signatures as publicly verifiable proofs of ciphertext validity.

Threshold encryption using homomorphic signatures

In one embodiment, it is proposed a method of cryptographic processing of data, the method being executed by an electronic device, and comprising obtaining at least two points belonging to a same elliptic curve defined on an algebraic structure being a finite ring, each point being represented by at least two coordinates. The method is remarkable in that it comprises: obtaining a parameterization of an isomorphism between said elliptic curve and another elliptic curve, said parameterization defining some configuration parameters, each configuration parameter having a range of possible values; determining in function of values of coordinates of said at least two points said configuration parameters, delivering determined configuration parameters; and obtaining coordinates of another point corresponding to an image of an addition of said at least two points through said isomorphism, said another point belonging to said another elliptic curve, and said obtaining being performed without an inversion operation in said algebraic structure, due to said determined configuration parameters.

Method of cryptographic processing of data on elliptic curves, corresponding electronic device and computer program product

A cryptographic device performs modular addition between a first integer value x and a second integer value y in a processor by: obtaining a first masked input {circumflex over (x)}, a second masked input &#x177;, a first mask rand a second mask r, the first masked input {circumflex over (x)} resulting from the first integer value x masked by the first mask rand the second masked input &#x177; resulting from the second integer value y masked by the second mask r; computing a first iteration masked carry value &#x109;, using the first masked input {circumflex over (x)}, the second masked input &#x177;, the first mask r, the second mask rand a carry mask value &#x3bb;; recursively updating the masked carry value &#x109;to obtain a final masked carry value &#x109;, wherein the masked carry value is updated using the first masked input {circumflex over (x)}, the second masked input &#x177;, the first mask r, the second mask r, and the carry mask value &#x3bb;; combining the first masked input {circumflex over (x)} and the second masked input &#x177; and the final masked value &#x109;to obtain an intermediate value; combining the intermediate value with the carry mask value to obtain a masked result; and outputting the masked result and a combination of the first mask rand the second mask r. It is preferred that the combinations use XOR.

Growing community of inventors

Palo Alto, CA, United States of America

Marc Joye