Sun Microsystems, Inc.

Digital Equipment Corporation

Emc IP Holding Company LLC

Intel Corporation

Oracle America, Inc.

Novell, Inc.

Dell Products Inc.

Cabletron Systems, Inc.

Digital Equipment Corp., Patent Law Group

Enterasys Networks, Inc.

Oracle Amerca, Inc.

Radia Joy Perlman

Stephen R Hanna

Charles W Kaufman

Miriam C Kadansky

Dah Ming Chiu

William R Hawe

Anne H Anderson

Xuan Tang

Neal Dante Castagnoli

Amit Narayan Gupta

Anil Vasudevan

Thomas D Lovett

Ilango S Ganga

Hugh Wilkinson

Seth Jacob Rothschild

Sunay Tripathi

Thomas N Dibb

G Paul Koning

Guy Lewis Steele, Jr

Ross W Callon

Anthony G Lauck

Joseph E Provino

Alan Joseph Kirby

Naizhong Chiu

Philip N Shilane

Grant R Wallace

Frederick Douglis

Nicolas G Droux

Kalyan Chakravarthy Gunda

Joseph LaSalle White

Yen Hsiang Chew

Eliezer Tamir

Ben-Zion Friedman

Ariel Hendel

Yossef Saad

Eliel Louzoun

Robert Conrad Knauerhase

Eric C Rosen

David C Douglas

Wendy March

Yassir K Elley

Stephen A Hurst

Joseph S Wesley

Philip M Rosenzweig

Sean J Mullan

Greg J Regnier

Alain Gravel

Floyd J Backes

Christopher William Gunner

John A Harper

Greg Lazar

Eric A Guttman

Alex Robbins

Ygdal Naouri

John Reynders

Murat Yuksel

David J Mitton

Anton Rang

Daniel R Cassiday

Senthil Ponnuswamy

Ramakrishna Huggahalli

George Varghese

Dzung D Tran

Shivani A Sud

Cahya Adiansyah Masputra

Ian M Shand

Joe Shahram Ghalam

George A Harvey

Orlando Xavier Nieves

Benjamin Santaus

Jamie Pocas

Alampoondi E Natarajan

Senthilkumar Ponnuswamy

Mihai Lazar

John V W Reynders

Joseph L Gervais

Edwards E Reed

Robert E Thomas

Tammy G Carter

Michael D Allen

Donald D Crouse

Germano Carroni

Benjamin S Smith

Dah-Ming Chiu

Todd Anderson

A method for managing access to a web-based service includes obtaining, by an intermediate service manager and from a managing client, credentials for a managing account associated with the web-based service and an access condition of accessing the web-based service by a second account to the intermediate service manager, obtaining a request, by an accessing client associated with the second account, for accessing the web-based service using the managing account, and based on the request and the access condition, communicating with the web-based service to create a session with the web-based service, and providing access to site data of the session via a user interface and based on the access condition.

System and method to distribute access to shared accounts with a trusted intermediate service manager

One example method includes generating a biometric of a user, requesting, and receiving, biometric data from a card, comparing the biometric data with the biometric, and when the biometric data matches data of the biometric, authorizing a transaction requested by a user using the card. The request for biometric data may identify what particular type of biometric data is compatible with the device making the request, and the biometric data may be a subset of the data that makes up the biometric.

Secure, low-cost, privacy-preserving biometric card

One example method includes continuously performing key related operations. Each data set in a storage system is encrypted with a different key. New keys are repeatedly introduced and new data is encrypted only with the newest or latest key. Data being rekeyed is re-encrypted with the latest key. By repeatedly introducing new keys and rekeying data sets associated with older keys, the overall key age of the system can be kept low and the data is less susceptible to being compromised.

Key management and key policies for data encryption in a storage appliance

One example method includes sending, by a sender, a commitment message, wherein the commitment message is digitally signed by the sender but is not verifiable by a recipient until a public key is revealed by the sender, transmitting, by the sender, the commitment message to the recipient, confirming, by the sender, that the commitment message has been received by the recipient, and only after receipt of the commitment message has been confirmed by the recipient, revealing in a second message, by the sender, the public key, wherein the public key is usable by the recipient to verify that the commitment message was validly signed by the sender.

Safe use of legacy digital signatures in a post-quantum world

One example method includes maintaining a deduplication data structure including one or more entries that each identify a respective fingerprint, and pointer, and also maintaining a ClientBlockList data structure comprising one or more entries that each identify a respective handle, retention date, and block, receiving a write request that identifies a handle, retention date, and block, computing a fingerprint of the block identified in the write request, determining, by the server, whether the fingerprint is in the deduplication data structure, and when the fingerprint is not in the deduplication data structure, storing the block identified in the write request at location 'L' in the deduplication data structure, and adding, to the deduplication data structure, an entry that identifies the fingerprint and the location ‘L,’ and adding, to the ClientBlockList data structure, an entry that identifies the handle, retention date, and fingerprint.

Maintaining retention policies in a block storage, multi-client dedup domain

One example method includes logging into websites through devices including insecure devices. A logon device may store credentials. The logon device is configured to connect with an insecure device and then communicate with a website for authentication purposes without exposing a user's credentials to the insecure device. After the user is authenticated, the session is transferred to the insecure device.

Secure password log in on insecure devices

A method of sending blocks of data from a client to be stored at a storage server, wherein for each block compression and encryption is performed at the client, and deduplication is performed at the server. Security is thus enhanced as the block is compressed and encrypted when it is sent over an unsecured network and when it is stored in potentially a third-party backup system. Provisions are made to enable addition of new compression algorithms and for retirement of old compression algorithms, while ensuring that a client would not receive a block which was compressed using an unsupported, e.g., retired, compression algorithm. In some examples a compression algorithm ID is tied to an encryption key version to enable refresh of blocks compressed with old algorithm.

Client-side compression

A method for securing a secret of a client using an escrow agent operatively connected to the client includes initiating enrollment of the client with the escrow agent, wherein the enrollment results the escrow agent generating a key pair comprising a public key and a private key, obtaining the public key from the escrow agent, wherein the private key is not shared with the client, encrypting the secret with the public key to obtain an encrypted secret, and storing the encrypted secret on the client.

Method and system for encrypting and decrypting secrets using escrow agents

An encrypted data storage system includes a storage system that is configured to store encrypted data, and a first client device that is coupled to the storage system. The first client device performs a hash operation on first data to generate a Data Encryption Key (DEK), and uses the DEK to perform a data encryption operation on the first data to generate encrypted first data. The first client device then uses a first Key Encryption Key (KEK) to perform a first key encryption operation on the DEK to generate a first encrypted DEK, associates the first encrypted DEK with the encrypted first data, and transmits the encrypted first data to the storage system for storage.

Encrypted data storage system

A method for verifying a secret decryption of an escrow agent by a client operatively connected to the escrow agent includes initiating enrollment of the client with the escrow agent, wherein the enrollment results the escrow agent generating a key pair comprising a public key and a private key, obtaining the public key from the escrow agent, wherein the private key is not shared with the client, encrypting the secret with the public key to obtain an encrypted secret, after encrypting the secret, encrypting, based on a verification trigger, a verification value using the public key to obtain an encrypted verification value, sending the encrypted verification value to the escrow agent, obtaining a secret decryption response from the escrow agent, making a determination, based on the secret decryption response, that the escrow agent is not capable of decrypting the secret, and based on the determination, performing a remediation action.

Method and system for verifying secret decryption capability of escrow agents

One example method includes accessing stored data, associating a unique identifier with the data, creating a hash by hashing a combination that comprises the unique identifier and the data, transmitting the hash to a notary service, receiving, from the notary service, a digital signature that corresponds to the hash, appending the digital signature to the data, and storing, as an object, a combination that comprises the digital signature, the data, and the unique identifier.

Ensuring data authenticity using notary as a service

In a cloud-based multiple client encryption and deduplication environment, secret plaintext data of a client is encrypted to produce ciphertext in an enclave comprising a trusted execution environment which is inaccessible by unauthorized entities and processes even with administrator privileges. Encryption is performed with an initialization vector and an encryption key calculated in the enclave. The encrypted ciphertext is deduplicated prior to storage by comparing a hash of the corresponding plaintext data to hashes of previously stored plaintext data.

Protection of secret client data in a multiple client data deduplication environment

An apparatus in one embodiment includes at least one processing device comprising a processor coupled to a memory. The processing device is configured to implement a first ledger maintenance node. The first ledger maintenance node is configured to communicate over one or more networks with a plurality of additional ledger maintenance nodes, to identify a block for proposed addition to a distributed ledger collectively maintained by the first and additional ledger maintenance nodes, to apply a digital signature of the first ledger maintenance node to the block, and to receive digital signatures on the block from at least a subset of the additional ledger maintenance nodes. Responsive to receipt of sufficient digital signatures from respective ones of the additional ledger maintenance nodes to meet a specified quorum of digital signatures required for addition of the block to the distributed ledger, the first ledger maintenance node adds the block to the distributed ledger.

Efficient and secure distributed ledger maintenance

A method for managing documents includes obtaining, from a first computing device, a first signed document, and in response to obtaining the first signed document: identifying a first plurality of validity services associated with the signed document, sending a verification request to the first plurality of validity services, wherein each of the plurality of verification requests specifies the first signed document, obtaining a plurality of verification responses from the first plurality of validity services, and making a determination, based on the plurality of verification responses, that the first signed document is valid.

Method and system for a signed document validity service

In general, embodiments of the invention relates to a method for managing data, the method includes obtaining, by an untrusted device and from a querying system, an item query, identifying a leaf block of a hierarchical block tree associated with the item query, identifying a plurality of indirect blocks that allow the querying system to calculate a top hash of the hierarchical block tree, and sending an item query response to the querying system, wherein the item query response specifies the leaf block, the plurality of indirect hashes corresponding to the plurality of indirect blocks, and a signature of the top hash, wherein the signature is obtained from a trusted system.

Method and system for querying a secure database located on an untrusted device

Growing community of inventors

Redmond, WA, United States of America

Radia Joy Perlman