Abstract: A system includes an application TEE and a first cloud service of a trusted cloud provider. The first cloud service is configured to receive an encrypted disk image and to launch the application TEE. The system also includes a second cloud service of a first alternate cloud provider, which is configured to launch a first attestation service instance from an attestation disk image that includes a secret and to provide the secret to the application TEE instance. Additionally, the system includes a third cloud service of a second alternate cloud provider, which is configured to launch a second attestation service instance and to provide the secret to the application TEE instance when the second cloud service is unavailable.

Abstract: A storage device includes a first memory to which data can be written a plurality of times and a second memory that includes storage elements for which electrical characteristics can be changed only once. The first memory storing first encryption key information and the second memory storing second encryption key information. A controller generated an encryption key using the first encryption key information and the second encryption key information in combination and then encrypts and decrypts data written or read from the first memory. When a host requests an encryption erase, the controller attempts to erase the first encryption key information from the first memory. If the requested erase fails, the controller erases the second encryption key information from the second nonvolatile memory.

Abstract: A system and method are provided for generating access tokens on a user device rather than via a remote server computer. An access token can be generated on a second user device by combining and encrypting, with format preservation, a primary access identifier, variable value, and salt. The resulting value can be provided to a first user device that can subsequently can provide the access token to an access device as part of an interaction. The access device can generate an authorization request message that comprises the access token and transmit it to a remote server computer for processing. The remote server computer can process the access token to determine the primary access identifier despite not being involved in the generation of the access token, providing an improvement over conventional tokenization methods.

Abstract: A method and system is disclosed for protecting neural network models by segmenting partitions of the models into segments of pre-configured memory size, hashing the segmented models, and concatenating the hash segments. The concatenated hash segment may be further hashed, encrypted, and stored with the neural network models as an executable loadable file (ELF) in memories external to the neural network prior to the use of the models by the neural network. The models may include model weights of the inference layers and metadata. The model weights and the metadata may be hashed as separate hash segments and concatenated. Segmenting the models into segments of pre-configured memory size and hashing the segmented models offline prior to the operation of the neural network enables rapid validation of the models when the models are used in the inference layers during online operation of the neural network.

Abstract: Disclosed are a calculation device for encryption using a public key and an encryption method thereof. The present method comprises: a step for setting a secret key, and generating a public key using the secret key and an error extracted from a discrete Gaussian distribution or a distribution that is within a short statistical distance thereto; and a step for applying the public key to a message, and then performing a rounding process to encrypt the message. Accordingly, encryption efficiency can be enhanced.

Abstract: A computer-implemented method according to one embodiment includes receiving, at a first system, a command to start encryption. In response to receiving the command to start encryption, a pair of keys are created on the first system. The pair of keys includes a public key and a secret key. The method further includes outputting the public key to a second system and saving the secret key on the first system. A command encrypted using the public key is received by the first system. The encrypted command is decrypted on the first system using the secret key and the decrypted command is executed. A computer program product according to another embodiment includes a computer readable storage medium having program instructions embodied therewith. The program instructions are readable and/or executable by a computer to cause the computer to perform the foregoing method.

Abstract: The present embodiments relate to establishing secure data communication using an Elliptic-curve Diffie-Hellman ephemeral (ECDHE) key agreement procedure. Devices in a network environment can utilize a key agreement procedure to establish secure communication between multiple application layers in a micro service architecture. Particularly, a tunnel can be established between a mobile device and an encryption service by transmitting key information between the mobile device and the encryption service. This can allow for encryption keys to only be accurately generated by the mobile device and encryption service. Accordingly, intermediary nodes may be unable to decrypt the data, allowing for safe and secure transport of sensitive data.

Abstract: Systems and methods are disclosed for generating a key based on at least one hardware component identifier for hardware of a first device and/or at least one piece of firmware code of the first device. The key may then be stored at a storage area accessible to the first device via hypertext transfer protocol secure (HTTPS) communication and the key may also be used to encrypt storage of the first device. Booting of the first device may then be facilitated based on HTTPS communication with a second device and using an extensible firmware interface (EFI) file and/or an IMG file stored at the second device. Then subsequent to at least partially facilitating the booting of the first device and based on verifying authentication credentials, the key may be transmitted to the first device to decrypt the storage of the first device.

Abstract: This application claims the benefit of Belgian Application No. BE2016/5964 filed 22 Dec. 2016, Belgian Application No. BE2016/5965 filed 22 Dec. 2016, Belgian Application No. BE2016/5966 filed 22 Dec. 2016, PCT/IB2017/056624 filed 25 Oct. 2017 and PCT/EP2017/082803 filed Dec. 14, 2017, International Publication No. WO 2018/114587 A1, which are hereby incorporated by reference in their entirety as if fully set forth herein.

Abstract: A trust relationship may be established between a host system and a storage system. An asymmetric key pair including a private key unique to a host system and a public key may be generated. During provisioning of the host system to the storage system, the host system may send the public key to the storage system. The storage system may be configured to record the public key for the host system, for example, in a masking table that defines I/O connectivity for logical storage units between a host system and the storage system. The public key may be used later to validate the host system to the storage system. The private key may be stored on the host system and be unreadable, or may be encrypted with an unreadable encryption key stored on the host system.

Abstract: Apparatus and methods are disclosed for transparently and efficiently encrypting data-at-rest in a platform as a service (PaaS) environment. Disclosed techniques transparently transform any existing persistent data services in the PaaS environment into respective secure data services. For the deployment of the above secure data services, an encryption addon containing an addon core and activity-based callouts is provided. The addon core contains a kernel module for encryption/decryption. A coordinator in charge of the deployment executes a pre-filesystem-creation callout that encrypts a raw storage device before creating a filesystem on it. It then deploys a secure data service configured to use the filesystem. Thus, applications using the data service can now transparently store data as encrypted data-at-rest in the filesystem. Similarly, the coordinator also executes a pre-filesystem-mounting callout before mounting the filesystem for accessing encrypted-data-rest.

Abstract: Provided is a secret search device including an arithmetic processing unit configured to speed up secret search processing by, when the secret search processing is performed by executing a pairing operation relating to each element of an encrypted tag and each element of a trapdoor, and when the pairing operation is executed by using a pre-calculation table stored in a storage unit for each element to be used in the pairing operation. The arithmetic processing unit is configured to execute, based on information on a free space usable for the pre-calculation table, size adjustment of the pre-calculation table such that the pre-calculation table fits in the free space.

Abstract: Systems and methods for protecting secret or secure information involved in generation of ciphered data by circuitry. The circuitry includes data paths and key paths that operate to perform cipher operations to generate a plurality of key shares and a plurality of data shares using a key and data as input. The data and the key may be masked by at least one mask. The plurality of key shares may be generated using the key and a first mask. The plurality of data shares are generated using key shares, the data, and a second mask.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for a cryptoasset custodial system using power down of server computers to protect cryptographic keys. The cryptoasset custodial system includes a plurality of server computers. Each server computer of the plurality of server computers includes a volatile memory configured to store a cryptographic key associated with a cryptographic transaction to be performed, by the server computer, on a blockchain. A computing device is communicatively coupled to the volatile memory and configured to perform, using the cryptographic key, the cryptographic transaction on the blockchain. Responsive to detecting an interruption in an electrical power supply to the server computer, the stored cryptographic key is deleted from the volatile memory to prevent access to the cryptographic key.

Abstract: The present disclosure involves systems, software, and computer implemented methods for a efficient distributed secret shuffle protocol for encrypted database entries using independent shufflers. Each of multiple data providers provides an encrypted secret input value. A set of shuffling clients, independent of the data providers, participate with a service provider in a secret shuffling of the encrypted secret input values. The protocol includes generation and exchange of random numbers, random permutations and different blinding values. A last protocol step includes using homomorphism, for each client, to perform computations on intermediate encrypted data to homomorphically remove a first blinding value and a second blinding value, to generate a rerandomized encrypted secret input value. As a result, the rerandomized encrypted secret input values are generated in an order that is unmapped to an order of receipt, at the service provider, of the encrypted secret input values.

Abstract: A method for expiring tokens includes obtaining a list of valid key identifications (IDs) for at least one valid cryptographic key configured to sign authentication tokens. The method also includes receiving an authentication token from a client authenticating and authorizing the client to access a resource and comprising an ID of a cryptographic key used to sign the authentication token. The method also includes determining whether the cryptographic key used to sign the authentication token is valid based on the list of valid key IDs for the at least one valid cryptographic key. When the cryptographic key used to sign the authentication token is valid, the method includes allowing the client access to the resource.

Abstract: Provided are a computer program product, system, and method for determining key server type and key server redundancy information to enable encryption. A first key server type for a first protocol is indicated in a key server type field in response to determining a current protocol used to communicate with the key server comprises the first protocol. A query information request is submitted to the key server to determine a key server type in response to determining that the current protocol comprises the second protocol. The second key server type indicated in the response to the query information request is indicated in the key server type field in response to the response indicating the second key server type. The first or second type of key server indicated in the key server type field is used to determine information to include in a key retrieval request.

Abstract: Technologies for secure authentication and programming of an accelerator device include a computing device having a processor and an accelerator. The processor establishes a trusted execution environment, which receives a unique device identifier from the accelerator, validates a device certificate for the device identifier, authenticates the accelerator in response to validating the accelerator, validates attestation information of the accelerator, and establishes a secure channel with the accelerator. The trusted execution environment may securely program a data key and a bitstream key to the accelerator, and may encrypt a bitstream image and securely program the bitstream image to the accelerator. The accelerator and a tenant may securely exchange data protected by the data key. The trusted execution environment may be a secure enclave, and the accelerator may be a field programmable gate array (FPGA). Other embodiments are described and claimed.

Abstract: Disclosed techniques relate to caching tenant encryption keys for a multi-tenant database. In some embodiments, a computing system encrypts data for a database in a multi-tenant database system using encryption keys assigned to respective tenants that are using the database. The computing system may store the encryption keys in a cache and, in response to a key rotation request for a first tenant, invalidate an entry in the cache for the first encryption key of the first tenant. The computing system may block writes for the first tenant until a new key is cached (e.g., based on retrieval from a key management system). In various embodiments, disclosed techniques may reduce encryption latency.

Abstract: Described is a system for selective transparency in a public ledger. In operation, a first submission by a first entity is logged to the public ledger. The submission is a data entry with a message M and an identification number (ID). Separately, a linkage by a second entity is recorded. The linkage is an encryption and commitment linking the submission by the first entity to a second submission by the second entity. The linkage can be verified through a series of processes, such as by determining a value of linkage verification information. The value of the linkage verification information and corresponding block number is then transmitted to a third entity. The third entity reads the commitments from block Ni and verifies that the commitments are commitments to the same ID using the linkage verification information.