Huawei Technologies Co., Limited

Yin Tan

Zhiwei Shang

Haohao Liao

Mohanish Chandrapalsingh Pachlore

Dongjin Kim

Nikolay Gigov

Dong Jin Kim

Robert John Lambert

Wei Xiong

Yuri Poeluev

Tao Hu

Alan Pak-Lun Ho

Teng Wu

Zhijun Mo

Stephen Sui Luen Li

Lionel Lianhong Zhang

Jinghui Lu

Amirhossein Vakili

Mikhail Kazaev

Zhongyuan Zheng

Denis Remezov

Jingshun Chen

Robert Lambert

The disclosed systems, structures, and methods are directed to a computer system including a PCIe protection controller as a part of a PCIe root complex that includes at least one root port. Each root port is configured to optionally connect to at least one endpoint device, and each endpoint device is designated as a secure endpoint device or a nonsecure endpoint device. The PCIe protection controller is configured to control outbound traffic to protect secure endpoint devices from access from any nonsecure components of the computer system. The PCIe protection controller may be further configured to control inbound traffic to prevent access to secure memory by nonsecure endpoint devices. The PCIe protection controller may be dynamically configured at runtime to designate endpoint devices as either secure or nonsecure.

Peripheral component interconnect express protection controller

A low latency relinearization process can be performed in an FPGA cluster for accelerating homomorphic encryption. The low-latency process performs an early calculation of matrix rows to make the summation result available earlier in the relinearization to reduce waiting of subsequent operations.

Low-latency pipeline and method for use of a low latency pipeline in homomorphic encryption

A field-programmable gate array (FPGA) cluster, comprising a plurality of FPGA devices, can be used to accelerate homomorphic encryption functionality. In particular, the FPGA cluster can accelerate the relinearization process used in homomorphic encryption by using multiple FPGA devices to perform portions of the relinearization process in parallel. Further, the use of the FPGA cluster provides sufficient memory resources to allow data used by the relinearization process, namely the keyswitch keys, to be stored on-chip.

Field-programmable gate array (FPGA) clusters and methods of using an FPGA cluster for homomorphic encryption acceleration

Systems and memory devices are disclosed for fully homomorphic encryption (FHE). The system may include a processing unit including: a data memory for storing coefficients for a polynomial; a twiddle factor (TF) memory for storing TF values associated with the polynomial; a TF register connected to the TF memory; a plurality of first registers connected to the data memory; a plurality of first MUXs connected to the first registers; a plurality of second registers connected to the plurality of first MUXs; a plurality of Butterfly (BF) cores connected to the plurality of the second registers and the TF register; wherein each of the plurality of BF cores is configured to, responsive to a control signal, perform a Butterfly Transform (BFT) operation based on two coefficients from the data memory and a TF value from the TF memory.

Hardware architecture for memory organization for fully homomorphic encryption

A method and system for application security. The methods and systems of the present disclosure improve application security and may be used to secure a host application and operating system from malicious fast applications. A request to access resources of the computing device is received from an application adapter of a fast application operating within a host application on the computing device. In response to a determination that the request is associated with resources included in a permission list of the fast application, the unique user identifier (UID) of the application adapter to the UID of the host application is translated by the operating system, which determines whether to allow the request based on the UID of the host application. Otherwise, the operating system determines whether to allow the request based on the UID of the application adapter.

Method and system for application security

Methods and devices for secure data sharing with granular access control are described. A modified attribute-based encryption (ABE) scheme is used to perform cryptographically-enforced ABE using attributes of a file access policy. A sender sends to a receiver a file encrypted using a file encryption key, the file encryption key encrypted using ABE based on a file access policy set by the sender, and a set of private ABE keys decryptable using a key stored in a trusted execution environment (TEE) of the receiver. The private ABE keys are decrypted by the receiver TEE when the file is accessed, decrypting a file encryption key only when the attributes of the receiver access action satisfy the file access policy. The decrypted file encryption key grants access to the file contents via a trusted viewer application. A user password may also be required and cryptographically enforced as part of the ABE decryption.

Methods and systems for secure data sharing with granular access control

The present disclosure is drawn to systems and methods for implementing authentication protocols based on trusted execution environments. Each of a principal device, an identity provider server and a service provider server are associated with a respective trusted execution environment. Authentication protocols are provided for registering the principal device to the identity provider server; authenticating the principal device to the identity provider server; and authenticating the principal device to a service provider server.

Security enhanced technique of authentication protocol based on trusted execution environment

A method for verifying a property of plaintext using ciphertext is disclosed. In an embodiment, a computing device may receive the ciphertext at a trusted execution environment (TEE) of the computing device. The TEE may decrypt the ciphertext to generate the plaintext using a private encryption key of an encryption key pair. The encryption key pair comprises a public encryption key and the private encryption key. The TEE may generate a digitally signed validation result by encrypting the validation result using a private signing key of a signing key pair. The signing key pair comprises a public signing key and the private signing key. The private key is retrieved from secure memory of the computing device, and the secure memory may only be accessible by the TEE. The computing device may then transmit the digitally signed validation result.

Verifiable encryption based on trusted execution environment

Systems, devices, and methods for hybrid secret sharing are disclosed. In accordance with embodiments, a computing device may encrypt the secret message using a first encryption key to generate an encrypted secret message. The computing device may also split a second encryption key into a plurality of key shares in accordance with a threshold number. The threshold number is less than or equal to the number of the plurality of key shares. Then, the computing device may transmit a plurality of messages. Each message of the plurality of messages comprises the encrypted secret message and one of the plurality of key shares.

Systems, devices, and methods for hybrid secret sharing

A computer-implemented method of performing inter-process communication includes a first process in a first operating system (OS) level container in a user space sending a message to a buffer process. The message is addressed to a second process in a second OS-level container in the user space. The buffer process communicates the message to the second process. A device for performing the computer-implemented method is also provided.

Method and system of performing inter-process communication between OS-level containers in user space

A method for securely receiving a cipher key from a key provider to a key requester is provided. The method includes generating a session key shared between the key requester and the key provider, determining at least one key in accordance with the session key. The method also includes transmitting a request from the key requester to the key provider, and receiving a response from the key provider, where the response comprises an encrypted payload and an authentication tag. The method also includes authenticating the response and decrypting the encrypted payload using the at least one key to obtain the cipher key.

Secure key transmission protocol without certificates or pre-shared symmetrical keys

Methods and systems for providing an endpoint device with access to a remote resource are disclosed. A first secure tunnel with the endpoint device is established from an intermediate device, the first tunnel terminating within a trusted execution environment (TEE) in the intermediate device. At least one credential is received within the TEE and via the first secure tunnel from the endpoint device. The at least one credential is transmitted from the intermediate device to the remote resource via a second secure tunnel, the second tunnel located between the remote resource and the intermediate device and originating within the TEE. In response to the at least one credential being accepted by the remote resource, communications between the endpoint device and the remote resource via the TEE in the intermediate device through the first and second secure tunnels are enabled.

Securing delegated credentials in third-party networks

The present disclosure provides systems, methods, and computer-readable media for setting up a network. A plurality of virtual devices are created. Each one of the virtual devices is associated to a corresponding virtual container. Then, the virtual devices are connected to a real device, which is associated with a host container, in order to enable communication between the virtual devices and the real device across a namespace of the network.

Device virtualization for containers

Systems and processes for mobile device management (MDM) implement scoped MDM policies. A mobile device has containers to isolate data and processes on the mobile device from the others of the containers. The scoped MDM policies involve container level commands and device level commands. The mobile device has a first agent residing in a first container and a controller residing within a second container. The controller executes a first device level command to control access to the resources of the mobile device for all containers. The first agent or the controller executes a first container level command to control access to the resources of the mobile device by only the first container.

Systems devices and processes to support mobile device management of multiple containers in virtualization environment

A system and method for virtual hardware control includes accessing, by a controller, a first driver message from at least one hardware device driver for at least one hardware resource on a user device, the at least one hardware device driver located in a kernel space on an operating system of the user device, sending, by the controller, the first driver message to a first virtual device driver, the first virtual device driver located in the kernel space, and forwarding, by the first virtual device driver, the first driver message to a first virtual container, the first virtual container being a first user space that is outside the kernel space of the operating system.

Growing community of inventors

Waterloo, Canada

Yin Tan