Symantec Corporation

Google Inc.

Veritas Technologies LLC

Scott D Schneider

Kent E Griffin

Sharada Sundaram

Walter Bogorad

Tzi-cker Chiueh

Haibin Zhang

Sheng Ma

Laura Grace Book

Xin Hu

Joseph Sean Cahill Goodknight Knightbrook

Michael Daub

Kevin Alejandro Roundy

Fanglu Guo

Sandeep B Bhatkar

Jeffrey Wilhelm

Brian T Witten

Hemant Puri

Ramzi Abi Antoun

Nathan Beckman

At least one aspect is directed to determining an estimate of an intersection of user identifiers in a first set of user identifiers and a second set of user identifiers. The first and second sets of user identifiers can be populated with user identifiers that have interacted with the same content item or content item campaign. Estimates of intersections of the first and the second sets can be determined based on a binomial vector approach, a vector of counts approach, or a hybrid approach. The binomial vector approach generates vectors based on k hashes of each user identifier in the first set and summing the vectors to generate a first vector. The intersection can be determined based on a dot product of the first vector and a second vector similarly generated from the second set of user identifiers.

Systems and methods for privacy preserving determination of intersections of sets of user identifiers

A computer-implemented method for maintaining encrypted search indexes on third party storage systems may include (1) identifying a plurality of encrypted files, (2) identifying a plurality of keywords contained in the plurality of encrypted files, and (3) generating an encrypted search index for searching the plurality of encrypted files by (i) identifying, for each keyword in the plurality of keywords, a list of encrypted files in the plurality of encrypted files that contain the keyword, (ii) encrypting the list of encrypted files, and (iii) storing the encrypted list of encrypted files such that the encrypted list of encrypted files can be identified using a lookup key generated by applying a pseudo-random function to the keyword. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for maintaining encrypted search indexes on third-party storage systems

A computer-implemented method for maintaining encrypted search indexes on third-party storage systems may include (1) identifying a plurality of encrypted files, (2) identifying a plurality of keywords contained in the plurality of encrypted files, and (3) generating an encrypted search index for searching the plurality of encrypted files by (i) identifying, for each keyword in the plurality of keywords, a list of encrypted files in the plurality of encrypted files that contain the keyword, (ii) encrypting the list of encrypted files, and (iii) storing the encrypted list of encrypted files such that the encrypted list of encrypted files can be identified using a lookup key generated by applying a pseudo-random function to the keyword. Various other methods, systems, and computer-readable media are also disclosed.

A method for protecting data files may include (1) identifying a data file to be protected against data loss, (2) identifying a set of software programs permitted to open the data file by (a) identifying a format of the data file and (b) identifying at least one software program capable of opening files of the format of the data file, (3) detecting an attempt to open the data file by a software program not included in the set of software programs, and (4) performing a security action in response to detecting the attempt to open the data file. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting data files

A computer-implemented method for enabling biometric authentication options may include (1) identifying a device that includes a biometric authentication option that provides access to a protected feature of the device and that is based on a biometric trait and an initial authentication option that provides access to the protected feature and that is not based on the biometric trait, (2) detecting an authentication action that is performed by a user on the device that provides access to the protected feature via the initial authentication option, (3) capturing biometric data describing the biometric trait of the user in connection with the user performing the authentication action on the device, and (4) using the biometric data as training data for the biometric authentication option to enable the user to access the protected feature of the device via the biometric authentication option. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for enabling biometric authentication options

Before backing up a user file to backup storage, a trust deduplication module is configured to ask a limited set of other trust deduplication modules to check if the user file has already been backed up. If the user file is already backed up, a backup receipt that corresponds to the user file (which was provided during backup of the user file) is communicated to the requesting trust deduplication module. The backup receipt provides the requesting trust deduplication module with access to the already-backed up user file in backup storage, and the requesting trust deduplication module need not back up the user file. Thus, a single copy of the user file can be stored in backup storage among several trusted users who own an instance of the user file. A user file can be restored from backup storage, using a backup receipt that corresponds to the user file.

Social deduplication using trust networks

A computer-implemented method for searching shared encrypted files on third-party storage systems may include (1) receiving, at a server-side computing system, a request from a user to search at least one encrypted file to which a group of users that includes the user shares access, (2) identifying, in response to the request, at least one encrypted search index compiled for and shared by the group of users that enables the encrypted file to be searched, (3) decrypting the encrypted search index with a key with which each user within the group of users has access, and (4) using the decrypted search index to respond to the request from the user. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for searching shared encrypted files on third-party storage systems

Techniques are disclosed for using a false positive-prone data structure to store normalization data for use in an encrypted search context. A file host server in a cloud provider network may provide search functionality for a user's encrypted data by use of a search index. In updating the search index, the server consolidates common identities of the user on different web services (e.g., an e-mail service or a social media service) into a normalized identifier. These normalization values are stored in the false positive-prone data structure (e.g., a colliding hash table, a Bloomier filter, etc.). Consequently, the data structure may return false positives after a search operation. The server may filter out these false positives before returning search results.

Encrypted search acceleration

A computer-implemented method for securing data at third-party storage services may include (1) receiving, at a server-side computing system, a request to provide a user with access to a file that is encrypted, (2) determining, in response to the request, whether a transitory symmetric key of the user is available to encrypt a decryption key with which the file may be decrypted, (3) encrypting the decryption key with the transitory symmetric key of the user if the transitory symmetric key of the user is available or encrypting the decryption key with the public key of an asymmetric key pair designated for the user if the transitory symmetric key of the user is unavailable, and (4) storing the encrypted decryption key. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for securing data at third-party storage services

A client sends a file information request to a security server, where the file information request identifies a URL from which the client is attempting to download a file. Upon receiving the request, the security server determines the stability information of the identified URL and provides the requested file information for the file provided by the URL. The security server determines the stability information of a URL by analyzing the file identifiers and URLs identified in downloaded file reports received from multiple clients. The determination of the stability information of a URL may be based on a variety of factors, such as stability of a URL over time, a textual analysis of the URL, and the set of files provided by the URL. A user of the client can review the file information and decide whether to expend the resources to download the file.

Providing file information to a client responsive to a file download stability prediction

A computer-implemented method for enhancing social networking content may include 1) identifying social networking content accessed from a social networking site, 2) parsing the social networking content to identify at least one content item that is potentially referenced in at least one of a plurality of social networking sites, 3) searching the plurality of social networking sites for an additional content item that relates to the content item, and 4) enhancing the social networking content with the additional content item. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for enhancing social networking content

A computer-implemented method for facilitating automatic malware signature generation may comprise disassembling a malware program, identifying one or more byte sequences within the disassembled malware program that have a likelihood of being representative of one or more library functions contained within the malware program, and preventing the one or more byte sequences from being included within one or more malware signatures. Corresponding systems and computer-readable storage media are also disclosed.

Systems and methods for library function identification in automatic malware signature generation

A method for hashing executable files may include identifying an executable file comprising non-variable executable content that contributes to the functionality of the executable file and does not vary among instances of the executable file. The method may also include identifying, within the executable file, non-executable content that does not contribute to the functionality of the executable file. The method may further include creating a normalized executable file by normalizing at least a portion of the non-executable content of the executable file without normalizing the non-variable executable content of the executable file. The method may include calculating a hash value that represents the normalized executable file. Various other methods, systems, and computer-readable media are also disclosed herein.

Growing community of inventors

Los Angeles, CA, United States of America

Scott D Schneider