Intuit, Inc.

Sergey Banshats

Yaron Sheffer

Gleb Keselman

Margarita Vald

Olla Nasirov

Julia Zarubinsky

Noam Kachko

Michael Gvirtzman

Yair Tayeb

Systems and methods that may be used to provide policies and protocols for blocking decryption capabilities in symmetric key encryption using a unique protocol in which key derivation may include injecting a random string into each key derivation. For example, a policy may be assigned to each client device indicating whether the client device has been assigned encryption only permission or full access permission to both encrypt and decrypt data. The disclosed protocol prevents client devices with encryption only permission from obtaining keys for decryption.

Systems and methods for blocking decryption capabilities in symmetric key encryption

Systems and methods that may be used to provide multitenant key derivation and management using a unique protocol in which key derivation may be executed between the server that holds the root key and a client that holds the derivation data and obtains an encryption key. In one or more embodiments, the derivation data may be hashed. The disclosed protocol ensures that the server does not get access to or learn anything about the client's derived key, while the client does not get access to or learn anything about the server's root key.

System and method for multitenant key derivation

Aspects of the present disclosure provide techniques for encrypted data management. Embodiments include determining an encrypted data item in a data store that is related to a request from a data consuming user. Embodiments include determining a data owning user and an encryption key that correspond to the encrypted data item based on a key identifier associated with the encrypted data item. Embodiments include determining one or more additional encrypted data items and one or more additional encryption keys that correspond to the data owning user based on key identifiers associated with the one or more additional encrypted data items. Embodiments include generating a single data access ticket comprising information about the data consuming user, the data owning user, the encryption key, and the one or more additional encryption keys.

Encrypted data management system

A system for distributed authentication provide third party authentication of access requests. A secure computing system is provided which ignores or otherwise denies all access requests from users that have not yet been validated by a separate validation computing system as being authorized to access the secure computing system, but once a given user is validated by a third party authentication system as being authorized to access the secure computing system, results data is made available on the third party validation computing system which effectively enables communication between a user computing system and the secure computing system. Communication is thereafter established and controlled with the user computing system by the secure computing system.

Growing community of inventors

Petah Tikva, Israel

Sergey Banshats