International Business Machines Corporation

Michael Steiner

Pankaj Rohatgi

Paul Ashley Karger

Shai Halevi

Sandeep Kishan Singhal

Ronald Perez

Grant W Wagner

Pau-Chen Cheng

Trent Ray Jaeger

Stefan Georg Hild

Luke James O'Connor

Carl Binding

Angela Marie Schuett

Victor Shoup

Charanjit Singh Jutla

Hugo M Krawczyk

Marcel Catalin Rosu

Yen-Min Huang

Charles D Cash

Stanislaw Jarecki

Zhen Liu

Anton Viktorovich Riabov

Genady Grabarnik

Suresh N Chari

Nagui Halim

Vincenzo Valentino DiLuoffo

Josyula R Rao

Elaine Rivette Palmer

Mark David Feblowitz

Tal D Rabin

Kay Schwendimann Anderson

David Claude Toll

Helmut Scherzer

Todd Eric Kaplinger

Nadarajah Asokan

Venkatraman Ramakrishna

Palanivel Andiappan Kodeswaran

Matthias Schunter

Michael Waidner

Sumeer K Bhola

Daniel Manual Dias

Prasad G Naldurg

Ran Canetti

Arvind Seshadri

Herve C Debar

A method for searching in an encrypted database includes the following steps. A search is formulated as a conjunct of two or more atomic search queries. One of the conjuncts is selected as a primary atomic search query. Search capabilities are generated for a secondary atomic search query using the primary atomic search query and the secondary atomic search query.

Masking query data access pattern in encrypted data

A method comprises receiving a first cryptographic token for one search term and a second cryptographic token is generated using the one search term and at least another search term. A first search is conducted using the first cryptographic token to generate a first result set, and the second cryptographic token is used for computing a subset of results of the first result set.

Conjunctive search in encrypted data

Methods and arrangements for protecting enterprise data with respect to a hybrid application in a mobile device that accesses a global computer information network using enterprise infrastructure. A hybrid application is recognized in a mobile device, the hybrid application being configured to communicate with an enterprise network and a non-enterprise network. There are provided, in communication with the hybrid application, controls for segregating data flows from the enterprise network and non-enterprise network. A policy service is provided, which applies a policy for the segregating and governed routing of data flows from the enterprise network and the non-enterprise network. Other variants and embodiments are broadly contemplated herein.

Governed routing of enterprise data in hybrid mobile applications

A method for encrypting a database includes the following step. Keywords in the database are encrypted to obtain encrypted search tags for the keywords. A table of reverse indices is generated for the encrypted search tags. A table of cross keyword indices is generated. A method for searching in an encrypted database includes the following steps. A search is formulated as a conjunct of two or more atomic search queries. One of the conjuncts is selected as a primary atomic search query. Search capabilities are generated for a secondary atomic search query using the primary atomic search query and the secondary atomic search query. Such methods mask query data and the actual composition of the database to reduce computation complexity and privacy leakage.

A random number generator (RNG) resistant to side channel attacks includes an activation pseudo random number generator (APRNG) having an activation output connected to an activation seed input to provide a next seed to the activation seed input. A second random number generator includes a second seed input, which receives the next seed and a random data output, which outputs random data in accordance with the next seed. An input seed memory is connected to the activation seed input and a feedback connection from the activation output so that the next seed is stored in the input seed memory to be used by the APRNG as the activation seed input at a next startup cycle.

Method, apparatus and system for resistance to side channel attacks on random number generators

The present invention relates to a method for protecting user data from unauthorized access, the method comprising the steps of, on a data processing system:

Method for protecting data from unauthorised access

The invention includes a method for key creation and recovery based on solutions to puzzles solvable by humans and not computers. In some exemplary embodiments, the key is created and recovered based on the solution(s) in conjunction with the password entered by the user. The puzzle(s) is selected based on the password used by the user from a puzzle database containing multiple puzzles that is greater in number to the number of puzzles used in conjunction with a particular password.

Mitigating dictionary attacks on password-protected local storage

An exemplary method is provided for managing and mitigating security risks through planning. A first security-related information of a requested product is received. A second security-related information of resources that are available for producing the requested product is received. A multi-stage process with security risks managed by the first security-related information and the second security-related information is performed to produce the requested product.

Method of managing and mitigating security risks through planning

An access control system and method includes a risk index module which computes a risk index for a dimension contributing to risk. A boundary range defined for a parameter representing each risk index such that the parameter above the range is unacceptable, below the range is acceptable and in the range is acceptable with mitigation measures. A mitigation module determines the mitigation measures which reduce the parameter within the range by mapping the effectiveness of performing the mitigation measures to determine a residual risk after a mitigation measure has been implemented.

Fuzzy multi-level security

Computer implemented methods () for protecting web based applications () from Cross Site Request Forgery (CSRF) attacks. The methods involve () classifying each resource offered by a web server application as a CSRF-protected resource or a not-CSRF-protected resource. The methods also involve () performing a user authentication, () initializing an authentication-token, and () initializing a CSRF protection secret that is used to validate CSRF protection parameters contained in resource identifiers for the resources. The methods further involve () performing a server-side rewriting process () to add the CSRF protection parameter to the resource identifiers for the resources and/or () performing a client-side rewriting process to add the CSRF protection parameter to a resource identifier for a second resource (e.g., a resource created at a client computer ()).

Systems and methods for protecting web based applications from cross site request forgery attacks

An access control system and method includes a risk index module which computes a risk index for a dimension contributing to risk. A boundary range defined for a parameter representing each risk index such that the parameter above the range is unacceptable, below the range is acceptable and in the range is acceptable with mitigation measures. A mitigation module determines the mitigation measures which reduce the parameter within the range.

System and method for fuzzy multi-level security

The invention is related to a system which allows a user to authenticate unknown terminals. The invention uses a first authentication step wherein the terminal authenticates itself to a server. Depending on whether the personal device has its own output means, such as a loudspeaker or a screen, the final message, whether the terminal can be trusted or not, can be output on the personal device or on the terminal itself. In the case where the device has no output means of its own, this message can originate in the device and be transmitted from there to the terminal. The user can input authentication information into his personal device, which can then be fully or partially transmitted to the terminal. In the end, the terminal may use the transmitted information to give out the authenticity output message. After the first authentication step follows a second authentication step, wherein the server authenticates itself to the personal device, if there is one. Upon success of both authentication steps, the authenticity output message can be given to the user.

Personal device, terminal, server and methods for establishing a trustworthy connection between a user and a terminal

A method, system, and computer program product for establishing security parameters that are used to exchange data on a secure connection. A piggy-backed key exchange protocol is defined, with which these security parameters are advantageously exchanged. By piggy-backing the key exchange onto other already-required messages (such as a client's HTTP GET request, or the server's response thereto), the overhead associated with setting up a secure browser-to-server connection is minimized. This technique is defined for a number of different scenarios, where the client and server may or may not share an encoding scheme, and is designed to maintain the integrity of application layer communication protocols. In one scenario, a client requests a server to propose a message encoding scheme. If the client has security-sensitive data to transmit with its request, it waits for the proposed scheme before sending this sensitive data to the server. Otherwise, the server may inform the client of the message encoding scheme in the same transmission used to send a response to a client's request.

Piggy-backed key exchange protocol for providing secure, low-overhead browser connections when a client requests a server to propose a message encoding scheme

Growing community of inventors

New York, NY, United States of America

Michael Steiner