Emc Corporation

Robert Damon Hopley

Ari Juels

Marten Van Dijk

Kenneth D Ray

Nikolaos Triandopoulos

Daniel Vernon Bailey

John Gordon Brainard

Alina Oprea

Samuel Curry

John G Linn

Aaron T Katz

Rachael Stockton

Craig R Paradis

Access control systems are provided that mediate access to derivatives of sensitive data. A method is provided for processing a data request from a client, the data request comprising a client identifier and an indication of the intended use of the data, by receiving the data request from the client; providing the client identifier and indicated use to an access manager, wherein the access manager assesses a risk of providing access to the data for the indicated use; if the access manager grants access for the indicated use, receiving one or more keys with corresponding computing restrictions from the access manager; computing a result; and providing the result to the client, wherein the provided result comprises the derivative of sensitive data. The access manager grants the access for the indicated use, for example, based on a risk score.

Methods and apparatus for mediating access to derivatives of sensitive data

An improved technique involves protecting a set of resources in a distributed computer system by scheduling epochs for replacing keys that have a variable duration. Along these lines, a Variable Epoch Scheduler (VES) generates schedules of key updates for a set of players in the distributed system such that at least two epochs in the schedules have different durations. For example, the epoch durations within a schedule may vary, or the epoch durations for different players may be different. At the end of each epoch, the VES notifies the distributed system to update the key identified in the schedule as corresponding to that epoch.

Variable epoch scheduler for proactive cryptography systems

A first cryptographic device is configured to store secret information that is refreshed in each of a plurality of epochs. The first cryptographic device receives an epoch control signal, and adjusts at least one epoch responsive to the received epoch control signal. Refreshed secret information associated with an adjusted epoch is utilized to authenticate the first cryptographic device to at least a second cryptographic device, where the second cryptographic device and one or more additional cryptographic devices store respective portions of the secret information in a distributed manner. By way of example, the epoch control signal may comprise an epoch advance signal directing that the first cryptographic device advance from a current one of the epochs to a subsequent one of the epochs. In an illustrative embodiment, the first cryptographic device comprises an authentication token and the second cryptographic device comprises an authentication server.

On-demand proactive epoch control for cryptographic devices

A technique protects source code and is performed in an electronic device. The technique involves performing, on the source code, a scanning operation which provides a scanning result indicating whether the source code includes a cryptographic key. The technique further involves performing a remedial operation (e.g., alerting an administrator, deleting the key, replacing the key, combinations thereof, etc.) to prevent undesired exposure of the cryptographic key when the scanning result indicates that the source code includes a cryptographic key. The technique further involves refraining from performing the remedial operation when the scanning result indicates that the source code does not include a cryptographic key.

Protecting against cryptographic key exposure in source code

Growing community of inventors

Fitchburg, MA, United States of America

Robert Damon Hopley