Emc IP Holding Company LLC

Emc Corporation

Duality Technologies Inc.

Synamedia Limited

Marcelo Blatt

Alon Kaufman

Alex Zaslavsky

Yael Villa

Yedidya Dotan

Zohar Duchin

Liron Liptz

Lior Asher

Kevin Bowers

Carmit Sahar

Ezra Darshan

Alex Vaystikh

Oleg Freylafert

Oded Peer

Steven Jason Epstein

Vinod Vaikuntanathan

Anatoly Gendelev

Ika Bar-Menachem

Yuriy Polyakov

Uri Fleyder

Shachar Israeli

Brian P Girardi

Tomer Meidan

Lakshmi Suresh

John Watts

Ido Zilberberg

Yuval Harness

Alon Hazan

Boris Gorelik

Steven Carl Gorretta

Michael S Shreve

Lawrence N Friedman

Eyal Kolman

Salah Machani

Kayvan Alikhani

Ereli Eran

Kineret Raviv

Richard Chiles

Shay Amram

Maya Herskovic

Mikael Peres

Triinu Magi Shaashua

Ayelet Eliezer

Oren Menes

Lior Ben-Porat

Christopher Clifton McLaren

Arina Shainski

Ofri Mann

Ayelet Biger Levin

Elad Koren

Rafael Shachar

Peleg Yiftachel

Alex Zaslaysky

Roni Frumkes

Oren Karmi

Matthew Triplet

Oded Rosolio

Lior Liram

Methods and systems for performing an operation on at least one homomorphically encrypted ciphertext, the method include determining, by a computing device, a value that is an initial approximation of a result of the operation on the at least one homomorphically encrypted ciphertext; and iteratively improving, by the computing device, the value using a recurrence relation wherein a number of iterations is determined based on a predetermined accuracy to minimize an approximation error.

Accelerated division of homomorphically encrypted data

Methods and systems for improving homomorphic encryption include: receiving, by a computing device, a data set from at least two or more computing devices, each data set comprising: a plurality of encrypted identifiers, and a number indicating the number of the plurality of encrypted identifiers; creating, by the computing device, a single data set including each of the received data sets; creating, by the computing device, a common identifier vector that indicates each encrypted identifier in the single data set that has underlying unencrypted data that is the same in more than one of the received data sets; and transmitting, by the computing device, the common identifier vector to each of the at least two or more computing devices.

Privacy preserving column binding implementation

A device, system and method for debugging a homomorphically encrypted (HE) program. The HE program comprising real ciphertext data and encrypted operations in the HE space (production mode) may be mapped to an equivalent plaintext program comprising equivalent pseudo-ciphertext data and pseudo-encrypted operations in the unencrypted space (simulation mode). The plaintext program may be executed in a first full pass in simulation model and a sampling of the HE program may be executed in a second partial pass in production mode, the results of which are compared. The HE program and/or mapping may be validated if the results of simulation and production mode match and debugged if the results do not match. An integrated development environment (IDE) may switch among the HE space (production mode), the unencrypted space (simulation mode), and a combination of both HE and unencrypted spaces simultaneously (simultaneous production-simulation mode).

Efficiently debugging a program in homomorphically encrypted space

A device, system and method for linking encrypted data sets using common encrypted identifiers in encrypted space. A first and second parties' encrypted data sets may include first and second respective encrypted data and associated first and second respective encrypted identifiers. The first and second encrypted identifiers may be converted into a first and second respective sets of a plurality of elemental identifier components. Each of the plurality of elemental identifier components in each component set characterizes a distinct numeric property of the corresponding converted encrypted identifier. The first and second sets of the plurality of elemental identifier components may be composed, component-by-component, to generate a plurality of component-specific results. If the plurality of component-specific results are determined to satisfy a matching criterion indicating that the first and second encrypted identifiers match, the first and second encrypted data associated with the first and second matching encrypted identifiers may be linked.

Linking encrypted datasets using common identifiers

A system and method for secure searching in a semi-trusted environment by comparing first and second data (query and target data). A first data provider may map first secret data to a first plurality of tokens using a token codebook, concatenate the first plurality of tokens to generate a first token signature, and homomorphically encrypt the first token signature. A second data provider may map second data to a second plurality of tokens using the token codebook, concatenate the second plurality of tokens to generate a second token signature, and compare the homomorphically encrypted first token signature and an unencrypted or homomorphically encrypted second token signature to generate a homomorphically encrypted comparison. A trusted party may decrypt the homomorphically encrypted comparison, using a secret homomorphic decryption key, to determine if the token signatures match or not respectively indicating the search query is found or not in the target data.

Secure search of secret data in a semi-trusted environment using homomorphic encryption

A system, method, and non-transitory computer readable storage medium for privacy preserving routing of a data packet. The data packet may comprise a packet header and a data payload; the packet header comprising at least a homomorphically encrypted final destination address of a final destination device. An intermediate routing device may receive the data packet. At the intermediate routing device, in a non-TEE, homomorphic computations may be performed to determine a homomorphically encrypted address of a next intermediate routing device. At the intermediate routing device, in a TEE, one or more secret homomorphic decryption keys may be stored and used to decrypt the homomorphically encrypted address of the next address of the next intermediate routing device. The data packet may be transmitted to the decrypted address of the next intermediate routing device according to an updated packet header with the unencrypted address of the next intermediate routing device in the sequence.

Privacy preserving routing

A device, system and method for securely executing recursive computations over encrypted data in a homomorphically encrypted (HE) space. For a recursive algorithm with sequentially dependent recursive iterations, executing the recursive algorithm in parallel by computing multiple recursive iterations simultaneously over multiple parallel execution iterations and not in sequential order. Each parallel execution iteration may compute a partial HE solution of multiple sequential recursive iterations comprising a known HE part and leaves empty a placeholder call slot for an unknown HE part. Placeholder call slots remain empty and are filled at delayed times at a later parallel execution iteration from when the known part of the same HE computation is computed. A final HE solution is computed in fewer multiple parallel execution iterations than the number of sequential recursive iterations, thereby accelerating the recursive algorithm in HE space.

Recursive algorithms with delayed computations performed in a homomorphically encrypted space

A method of protecting a computer system from fraudulent use includes collecting and aggregating sets of risk predictor values for user-initiated events into user-specific aggregations and organization-wide aggregations, and in response to a current event initiated by a user, generating a risk indicator as a combination of a user-specific indicator and an organization-wide indicator based on current event parameters and the user-specific and organization-wide aggregations. Based on the risk indicator indicating that the current event may be a fraudulent use, a protective control action is taken (such as denying or modifying a requested access) to protect the computer system.

Self-learning online multi-layer method for unsupervised risk assessment

An improved technique involves including implicit feedback inferred from a fraud analyst's actions into a fraud detection model tuning process. Along these lines, as part of a tuning process, an authentication server sends electronic transactions carrying a certain amount of risk to a case management center in which fraud analysts investigate the electronic transactions to verify whether the transactions are fraudulent or non-fraudulent. In addition to receiving this explicit feedback from the case management center, however, the authentication server also receives implicit feedback indicative of attributes of the fraud analysts themselves. The authentication server then inputs these implicit feedback parameter values into a fraud detection model tuning engine that tunes the fraud detection model.

Combining explicit and implicit feedback in self-learning fraud detection systems

A method involves performing a mathematical estimation operation identifying a risk score threshold. The operation identifies the risk score threshold as a point on a curve rather than a value of a particular risk score. Such a curve approximates the distribution of risk score values output over a time interval and represents a function embodied by a plot of risk score percentile vs. risk score value. The risk engine, rather than selecting a particular risk score, selects a curve from a family of curves that is known to accurately represent such risk score distributions. For example, the risk engine may choose the curve that provides the best fit to the previous week's risk scores over the family of curves. The risk engine identifies the risk score threshold by finding a risk score value such that the function evaluated at that risk score value produces a specified risk score percentile.

Authenticating users in the presence of small transaction volumes

Methods and apparatus are provided for validating event scenarios using reference readings obtained from a plurality of sensors associated with one or more predefined event scenarios. If a reading from a first sensor satisfies a reference reading of the first sensor for at least one identified scenario in a scenario library, at least one additional sensor is identified from the identified scenario and a reading is obtained from the additional sensors. The identified scenario is validated when the readings of the additional sensors satisfy the reference reading for the additional sensors from the identified scenario. A confidence level is optionally determined based on the readings of the sensors in the identified scenario. The readings of the sensors are optionally monitored over time to update the confidence level of the identified scenario.

Methods and apparatus for validating event scenarios using reference readings from sensors associated with predefined event scenarios

Estimated quantiles and/or percentiles for streaming data are computed over a sliding window. An exemplary method comprises obtaining a stream of data values; obtaining a summary of a distribution of previously processed data values; adding streamed data values to a buffer; and when the buffer reaches a predefined fullness threshold, performing the following steps: processing tuples in the summary to apply a decay function to each tuple using the number of items in the stream in the stream at the time the tuple is created and a minimal rank bound; for each item in the buffer, creating a tuple; adding the tuple to the summary, and removing the item from the buffer; and building a search tree that is used to process one or more of percentile queries and quantile queries. The summary is optionally compressed by merging consecutive tuples that satisfy a predefined invariant constraint. The decay function maintains, for example, one or more of a predefined recent number of items or a predefined recent time window of items in the summary.

Methods and apparatus for computing estimated quantiles for streaming data over sliding windows

Techniques for use in determining redress measures for a television (TV) service outage based on impact analysis are described. A TV service outage may be associated with a TV system apparatus including a TV user interface (UI). In one illustrative example, one or more subscribers impacted by the TV service outage are determined. An impact score is determined for each one of the subscribers. A redress measure for each one of the subscribers is then determined in accordance with their corresponding impact scores. An impacted subscriber and/or an impact score may be determined based at least in part on subscriber TV usage data or subscriber TV UI usage data.

Method and device for determining redress measures for TV service outages based on impact analysis

An improved technique involves generating, from historical transaction data, a relational graph that represents connections between users who initiate transactions and transaction devices used to carry out the transactions. By supplementing traditional relational database models with a tool such as a graph database, a risk analysis server is able to express users and transaction devices as nodes in a graph and the connections between them as edges in the graph. The risk analysis server may then match the topology of the graph in a neighborhood of the user initiating the transaction to a known topology that is linked to an indication of risk. In some arrangements, this topology is an input into a risk model used to compute a risk score for adaptive authentication.

Network neighborhood topology as a predictor for fraud and anomaly detection

Growing community of inventors

Modiin, Israel

Marcelo Blatt