Microsoft Technology Licensing, LLC

Srinath T V Setty

Ramarathnam R Venkatesan

Nishanth Chandran

Sebastian G Angel

Josh D Benaloh

Michael James Zwilling

Jacob Rubin Lorch

Sergey M Yekhanin

Hao Chen

Ganesh Ananthanarayanan

Panagiotis Antonopoulos

Joshua Stanley Allen

Stavros Volos

Bolin Ding

Melissa Erin Chase

Kim Laine

Ulrich Homann

Harsha Prasad Nori

Olga Ohrimenko

Janardhan Dattatreya Kulkarni

Daniel John Carroll, Jr

Trinabh Gupta

Jonathan D Lee

Basil Cherian

Jason Sydney Barnwell

Rishabh Poddar

Christoph Berlin

An entity is enabled to access encrypted resources in response to verifying access criteria of a region-based security policy is met. For example, a resource request to access an encrypted resource is received from an entity. A determination that the encrypted resource is assigned to a first region and is protected by a region-based security policy is made. A proof of a region attribute indicating that the entity possesses the region attribute is received from the entity, the region attribute indicates the entity is associated with the first region. An encrypted version of the region attribute is obtained from a ledger database. The resource request is validated based at least on the encrypted attribute and the proof of the region attribute. A verification is made that an access criteria of the region-based security policy is met. The entity is provided access to the encrypted resource.

Region-based security policies for cloud resources

Embodiments described herein enable at least one of a plurality of entities to access data protected by a security policy in response to validating respective digital access requests from the entities. The respective digital access requests are received, each comprising a proof. For each request, an encrypted secret share is obtained from a respective ledger database. Each request is validated based at least on the respective encrypted secret share and the proof, without decrypting the respective encrypted secret share. In response to validating all of the requests, a verification that an access criteria of a security policy is met is made. If so, at least one of the entities is provided with access to data protected by the security policy. In an aspect, embodiments enable a blind subpoena to be performed. In another aspect, embodiments enable the at least one entity to access the data for an isolated purpose.

Blind subpoena protection

This document relates to performing video analytics on a cloud device that preserves privacy. One example uses data-oblivious algorithms to process input video data, where the data-oblivious algorithms can assist with preventing attackers from exploiting side-channels induced by data-dependent access patterns.

Private data analytics

In one embodiment, a service receives a one or more digests to verify a plurality of requests that were performed by a request handler for one or more clients. The digests summarize processing of the plurality of requests using a first contract. The information for the one or more digests is stored in a plurality of blocks in a distributed ledger. A second contract is executed to verify the processing of the plurality of requests. The second contract generates a first set that stores states for reads of values from the data store; generates a second set that stores states for values written to the data store, and verifies the processing by checking states in the first set are a subset of states in the second set.

Verifiable state machines

This document relates to hardware protection of differential privacy techniques. One example obtains multiple instances of encrypted telemetry data within a secure enclave and processes the encrypted telemetry data to obtain multiple instances of unencrypted telemetry data. The example also processes, within the secure enclave, the multiple instances of unencrypted telemetry data to obtain a perturbed aggregate. The example also releases the perturbed aggregate from the secure enclave.

Hardware protection for differential privacy

Systems, methods, and computer-executable instructions for reducing amortized computational costs for a query that includes receiving at least two indexes for elements stored in an n-element database. The n-element database is encoded into at least three buckets. Each element is stored within at least two buckets. Each bucket stores a proper subset of the n-elements. For each of the two indexes, a bucket is determined to retrieve the element at the index. The determined buckets are queried to retrieve the elements. The elements at the indexes are retrieved based on the querying the determined buckets.

Private information retrieval with probabilistic batch codes

Growing community of inventors

Redmond, WA, United States of America

Srinath T V Setty