Microsoft Technology Licensing, LLC

Victor V Boyko

Ramarathnam R Venkatesan

Sriram Kottarakurichi Rajamani

Baskar Sridharan

Mitica Manu

Peter L Montgomery

Raghunath Ramakrishnan

Pushkar Vijay Chitnis

Shastry M C Shankara

Dan Boneh

David Jao

David Y Jao

Operating upon encrypted data with a particular data scope. A base encryption key is established and associated with the particular data scope, and then stored in a base encryption key store. That base encryption key store might be managed by an application or service that stores base encryption keys for multiple data scopes. A proxy encryption key acts as a kind of proxy for the base encryption key. The proxy encryption key may be used for frequent operations on encrypted data within the particular data scope. Thus, the principles described herein act as a frequency amplifier that allows key-based operations upon the particular data scope to be performed at much higher frequencies than otherwise would be possible by operating directly using the base encryption key.

Data operations using a proxy encryption key

Data may be encrypted using a derived block encryption key for each of at least one append blocks of data. A data operation associated with manipulating particular data associated with a user may be received. The particular data may comprise at least one append block of data. In response to the received data operation, for each append block of data of the at least one append block of data, parameters associated with deriving a block encryption key for a given append block of data of the at least one append block of data may be accessed. The parameters may comprise at least a data encryption key associated with the user and a nonce. A block encryption key may be derived for the given append block of data utilizing the parameters. The given append block of data may be encrypted utilizing the block encryption key.

Encryption using multi-level encryption key derivation

Software protection using data structures is described. In one implementation, an engine between the processor and the memory of a computing device encrypts and stores data and program variables in blocks of memory that correspond to nodes of a tree-like data structure. When accessed, the nodes of this search tree are rearranged according to various schemata to obscure memory access patterns from being detected by cache attacks or side-channel attacks. In one implementation, the data structure is a splay tree that self-rearranges upon access and increases efficiency while providing security.

Software protection using data structures

Techniques are described for generating and validating signatures. In an implementation, a method includes generating a signature by utilizing a plurality of isogenies included on a private key and incorporating the signature and a public key on a product, in which the public key is configured to validate the signature.

Systems and methods for generation and validation of isogeny-based signatures

In at least one implementation, described herein, P and Q, . . . , Qare public points on an elliptic curve over a finite field, but the ratios of Qto P are private. Those ratios are the components (&#x3b1;, . . . , &#x3b1;) of a private key, where Q=&#x3b1;P. This implementation generates short digital ciphers (i.e., signatures), at least in part, by mapping a message M to a point T on the elliptic curve and then scaling that point T based upon the private key &#x3b1; to get S. At least one other implementation, described herein, verifies those ciphers by comparing pairing values of two pairs, where one pair is the public point P and the scaled point S and another pair is public Q and the point T. This implementation tests whether log(Q)/log(P)=log(S)/log(T), without computing any elliptic curve discrete logarithm directly.

Growing community of inventors

Brooklyn, NY, United States of America

Victor V Boyko