Emc Corporation

Emc IP Holding Company LLC

Peter Robinson

Eric Young

Sean Francis Parkinson

Nikolaos Triandopoulos

Jaimee Brown

David Paul Makepeace

Mark Hibberd

Salah Machani

David Alistair Healy

Michael Foley

Jacob Evans

Katherine Watts

Kanchan Kaur

Stefan Pingel

Geetu Preet Sandhu

Koji Onishi

Blockchain encryption techniques are provided. An exemplary method includes sending a signed transaction with at least two users to a blockchain; obtaining, by a first user, a public key of a second user from the blockchain; generating, by the first user, a symmetric key by combining a private key of the first user and the public key of the second user; encrypting, by the first user, a data item using the symmetric key; and providing the encrypted data item to the blockchain. The second user obtains the encrypted data item and a public key of the first user from the blockchain, and decrypts the encrypted data item using the symmetric key generated, by the second user, by combining a private key of the second user and the public key of the first user.

Methods and apparatus for blockchain encryption

A disclosed method includes operations of a control computer and interceptor computer. The control computer creates a certificate request and sends it to a certificate issuer, the certificate request created with an encrypted blob including a service private key S-PrK encrypted with an escrow server public key E-PuK. The control computer receives the certificate from the certificate issuer and provisions it to the service server along with S-PRK for use in secured communications with clients. The interceptor computer monitors session-establishment communications, e.g. a TLS handshake, between the service server and client to obtain the digital certificate, and retrieves the encrypted blob from the certificate and sends it to the escrow server. The escrow computer retrieves S-PrK by decrypting the encrypted blob using the escrow private key E-PrK, and returns S-PrK to the interceptor, where it is used to decrypt secure-session communications between the client and service server.

Communicating service encryption key to interceptor for monitoring encrypted communications

There is disclosed herein techniques for use in authentication. The techniques comprise providing multiple selectable image portions. The techniques also comprise selecting a first image portion of the multiple selectable image portions. The said selecting of the first image portion comprises performing a first operation to associate a first marking with the first image portion in an identifiable manner. The techniques further comprise generating information for use in authentication based on the first image portion and the first marking associated with the first image portion.

Graphical password generation

A computerized device and a process protect against denial-of-service (DoS) attacks by using a memory-time hard problem that a client (e.g., IoT device or mobile app) solves as part of a request such as an initial registration process. The process may use parameters obtained from a public source of randomness. The problem is designed such that all memory allocated for the algorithm is used in a random manner, making it difficult for attackers to use FPGA/ASIC approaches. The client provides a proof-of-work (PoW) value to a server, which performs a more directed version of the calculation done by the client to confirm that the PoW value is correct. When confirmation is not obtained, the server can refrain from further processing of the client request, thwarting DoS attacks.

Server using proof-of-work technique for hardening against denial of service attacks

Methods and apparatus are provided for proactivized threshold password-based secret sharing with key rotation. An exemplary method comprises determining a difference between updated and prior values of a share, wherein the updated value comprises a fixed share of a plurality of shares of a secret; setting at least one polynomial coefficient of a correction polynomial employed by a polynomial-based secret sharing scheme to a value that depends on the difference; applying the polynomial-based secret sharing scheme to obtain share correction values that comprise a share correction value for the fixed share derived from the at least one polynomial coefficient; and providing the share correction values to at least one party that generates the fixed share from the provided share correction value for the fixed share and the prior value of the share. The secret can optionally be updated. A key rotation scheduler optionally performs a new sharing of the secret based on a refreshing schedule and/or a refreshing policy.

Proactivized threshold password-based secret sharing with flexible key rotation

Techniques are provided for protecting encryption key(s) and other protected material on devices, such as mobile devices. A device stores an encrypted container received from an online authentication service, wherein the encrypted container is encrypted using a first key stored by the online authentication service, wherein the encrypted container comprises a data item stored on the device. The device transmits the encrypted container using an online connection to the online authentication service to decrypt the encrypted container using the first key, wherein the encrypted container is decrypted by the online authentication service to provide a decrypted container only if the online connection satisfies one or more predefined online connection criteria. The device then receives the decrypted container from the online authentication service and obtains the data item from the decrypted container. Online secure containers are also disclosed that are optionally protected using a multi-layer encryption scheme.

Secure containers for flexible credential protection in devices

Embodiments are directed to techniques to automatically propagate password updates onto other devices that use a shared password to protect respective secure keys or other secrets. This may be done by calculating update data using a new password and an old password entered onto one device as part of a password change operation, and sending the update data to the other devices for use in updating the password on those devices.

Automatic propagation of password updates on multiple devices

A computer-implemented method of protecting digital data includes applying a key derivation function to a first value to generate a first derived key, the first value being equal to or derived from a first input password. The first derived key is combined with the digital data to generate a protected record stored in the computer. Subsequently, the key derivation function is applied to a second value to generate a second derived key, the second value being equal to or derived from a second input password. The protected record is processed using the second derived key to permit access to the digital data when the second derived key matches the first derived key. The key derivation function includes iterations of a two-stage hashing operation creating and using an array of memory blocks whose size is specified independently of the number of iterations to decouple processing and memory requirements.

Computer data protection using tunable key derivation function

Secure storage and retrieval of data is provided with multiple data classes and data identifiers. Data values of a client are stored by receiving one or more authentication sets, at least one data value, an associated data class of the data value and a pseudo-random client value; calculating a data seed value based on the pseudo-random client value, a pseudo-random server value and the associated data class of the data value; generating a random data index value; generating a database index value based on the data seed value and the random data index value; storing the database index value; and providing the random data index value to the client. The client can be authenticated at the time of storage based on the one or more authentication sets. The authentication of the client and the storage of the data can be atomic such that only authenticated clients store the one or more data values. Techniques are also provided for the retrieval of stored data.

Secure storage and retrieval of data in a database with multiple data classes and multiple data identifiers

Secret values used in a multi-server authentication scheme are updated. Information is authenticated in a system comprising a plurality of processing devices each adaptable for communication with one or more other devices. The information is authenticated by generating at least first and second shares of a first password associated with a first device (such as a client device); storing the first and second shares in respective second and third devices of the plurality of devices; updating the first and second shares using a personalized proactivization value; assigning a version number to the updated first and second shares; and upon submission of additional information associated with the first device to at least one of the second and third devices, the second and third devices utilizing the respective updated first and second shares for a given version number to collectively determine a correspondence of the additional information with the first password.

Multi-server authentication using personalized proactivization

Methods and apparatus are provided for cryptographically linking data identifiers and authentication identifiers without storing the association between the authentication and data secrets in the database of the server. A data secret of a client is provided to a server for storage with an authentication identifier (AuthId) and a pseudo-random client value. The server provides the client with a sequence number of the stored data secret that is associated with a data identifier (DataId) identifying the data secret obtained using a Key Derivation Function and a storage seed. The client registers with the server to obtain the authentication identifier (AuthId). Techniques are also provided for retrieving and updating the data secret.

Cryptographically linking data and authentication identifiers without explicit storage of linkage

A first machine (e.g., server VM) authenticates an untrusted second machine (e.g., new client VM) as a condition to performing or allowing a protected operation. Authentication information is written to a library using one mechanism, and then read from the library using another mechanism. One of the mechanisms is an untrusted mechanism employing the untrusted second machine, while the other is a trusted mechanism performed by the first machine either alone or in combination with a trusted management component that has privileged access to the library. If a written and read value match, it can be inferred that the second machine is authentic, because the trusted management component has accessed an existing library that is also separately accessed by the second machine.

Computer system employing dual-band authentication

Secret values used in a multi-server authentication scheme are updated. Information is authenticated in a system comprising a plurality of processing devices each adaptable for communication with one or more other devices. The information is authenticated by generating at least first and second shares of a first password associated with a first device (such as a client device); storing the first and second shares in respective second and third devices (such as authentication server devices); updating the first and second shares using a secret value T; assigning a version number to the updated first and second shares; and upon submission of additional information associated with the first device to at least one of the second and third devices, the second and third devices utilizing the respective updated first and second shares for a given version number to collectively determine a correspondence of the additional information with the first password.

Multi-server authentication using proactivization journaling

Methods and apparatus are provided for an asymmetric encryption scheme with expiring revocable certificates having a predefined validity period. Communications between two devices are secured by obtaining an expiring revocable certificate; and securing said communicating with said expiring revocable certificate using asymmetric encryption. A prior expiring revocable certificate can be revoked when a new expiring revocable certificate is issued to at least one device. The expiring revocable certificate has a predefined validity period (based, for example, on a longest expected connection drop-out duration). A new expiring revocable certificate is requested at least once for each predefined revocation period. The expiring revocable certificate is revoked after the predefined revocation period, for example, only if a connection between the two devices is maintained.

Asymmetric encryption scheme with expiring revocable certificates having a predefined validity period

In an encrypted storage system employing data deduplication, encrypted data units are stored with the respective keyed data digests. A secure equivalence process is performed to determine whether an encrypted data unit on one storage unit is a duplicate of an encrypted data unit on another storage unit. The process includes an exchange phase and a testing phase in which no sensitive information is exposed outside the storage units. If duplication is detected then the duplicate data unit is deleted from one of the storage units and replaced with a mapping to the encrypted data unit as stored on the other storage unit. The mapping is used at the one storage unit when the corresponding logical data unit is accessed there.

Growing community of inventors

Enoggera Reservoir, Australia

Peter Robinson