Cyberark Software Ltd.

Ofer Rivlin

Disclosed embodiments relate to systems and methods for deterministic cryptography deidentification enabling granular destruction. Techniques include preparing a table of name-token pair groupings with unique tokens, storing data deidentified in association with the deidentification process in a centralized repository, identifying a token from the table of name-token pair groupings, and enabling reidentifying of a specific data item of the deidentified data based on the token provided from the table.

Deterministic cryptography deidentification with granular data destruction

Disclosed embodiments relate to improving network security through real-time analysis of character similarities. Techniques include identifying a reference name, identifying a domain name, and performing a real-time analysis of the domain name. The real-time analysis may include applying a language processing protocol to the domain name, generating a score indicating a similarity between the domain name and the reference name, accessing a similarity threshold, and comparing the generated score with the similarity threshold. Further techniques include determining that the score exceeds the threshold and performing a security action.

Improving network security through real-time analysis of character similarities

Disclosed embodiments relate to performing secure and flexible searches of encrypted data. Operations may include maintaining a database of a plurality of sets of encrypted data; receiving a transformed search query for the database, the transformed search query having undergone a transformation process at a client including: identifying a plaintext string in a search query at the client, applying the plaintext string to a language dictionary accessible to the client, receiving, based on the language dictionary, one or more plaintext search strings, and encrypting, at the client, the one or more plaintext search strings; and returning a result based on the transformed search query, the result being based on the encrypted one or more plaintext search strings.

Secure, efficient, and flexible searchable-encryption techniques

Disclosed embodiments relate to securely facilitating decentralized management of identity data. Operations may include receiving, from an identity, encrypted data and an index associated with the encrypted data; receiving, from the identity, a first request including: the index, a first part of a first cryptographic key, and a target service cryptographic key; identifying, using the index, the encrypted data; encrypting a copy of the encrypted data using the target service cryptographic key to form a doubly encrypted data; sending a challenge token to the identity; receiving a second request, from a target service, the second request including: the index and a challenge response created based on the challenge token; and sending to the target service the doubly encrypted data and the first part of the first cryptographic key; wherein the target service is operable to decrypt the doubly encrypted data.

Decentralized management of data access and verification using data management hub

Disclosed embodiments relate to dynamically changing an encryption technique for encrypted data to be stored in a searchable database. Operations may include receiving encrypted data for storage in the searchable database, the encrypted data having been encrypted by a client using a cryptographic key based on an encryption alteration scheme; receiving a search query from the client, the search query comprising a plurality of search strings including at least: an encrypted version of a plaintext string that was encrypted by the client using the cryptographic key, and one or more encrypted versions of the plaintext string that were encrypted by the client using one or more other cryptographic keys; processing the search query; and returning a response to the search query to the client.

Variable encryption techniques for secure and efficient searchable encryption

Disclosed embodiments relate to securely facilitating decentralized management of identity data. Operations may include identifying a prompt to perform an attestation process for an identity; receiving, from the identity, a first request including: an index associated with encrypted data, a second part of a first cryptographic key, and a challenge token; generating a challenge response based on the challenge token; sending a second request to a data management hub including: the index and the challenge response; receiving a response to the second request, from the data management hub, the response including: doubly encrypted data formed by encrypting a copy of the encrypted data and a first part of the first cryptographic key; and decrypting the doubly encrypted data.

Disclosed embodiments relate to implementing, as a microservice at a client, a searchable-encryption service. Operations may include executing the microservice at the client to perform operations including: encrypting data based on a cryptographic key accessible to the client; sending the encrypted data to a network storage resource; identifying, at the microservice, a search query in plaintext; encrypting the search query according to the cryptographic key; sending the encrypted search query to the network storage resource; and receiving a response to the encrypted search query from the network storage resource.

Growing community of inventors

Petach-Tikva, Israel

Ofer Rivlin