Abstract: Systems and methods for securely and privately monitoring risky web activities in an enterprise computing system. A service is provided that communicates with a first client-application deployed on a user device and a second client-application deployed on an administrator device. A secure enclave is deployed by the service that ensures zero-knowledge to store sensitive user data (e.g., activity logs of risky web activity logged by the first client-application). Team-Service Logged-Out keys and Team-Enclave Logged-Out keys are deployed to the user device. When an end user associated with the user device is not logged into the service, the Team-Service Logged-Out keys and Team-Enclave Logged-Out keys are used to authenticate the logged-out end user so that an activity log can be sent to the secure enclave and stored. The activity log can be accessed by the second client-application upon authentication of the administrator using a Device-Enclave key pair associated with the administrator.

Abstract: The present application describes a multi-factor anti-phishing system and method, featuring real-time local analysis of webpages on user devices. The system comprises a feature extraction system integrated with a web browser to extract a comprehensive set of features from visited webpages. These features include URL and host characteristics, content and structure indicators, resource files and scripts, form and action elements, and embedded media analysis. A machine learning (ML) model, trained on these features, analyzes the extracted data to predict phishing risks. The system uses a cloud secure enclave to manage allow lists and block lists, process encrypted feedback, and retrain the ML model, such that sensitive information remains confidential. The retrained ML model is periodically distributed to user devices to enhance phishing detection capabilities.

Abstract: A system and method for providing secure Single-Sign-On (SSO) authentication in a zero-knowledge architecture. A first server component may operate as a first relying party in a first SSO flow. When the user of an application successfully authenticates to a first identity provider, a first part of a secret key may be provided to the application. Additionally, a second server component may operate as a second relying party in a second SSO flow. When the first part of the secret key is received by the application, authentication information may be provided to a second identity provider. Based on a successful authentication, a second part of the secret key may be provided to the application. The first and second parts of the secret key may be combined by the application to generate a final secret key that may be used to decipher encrypted user data.

Abstract: A system and method for providing secure Single-Sign-On (SSO) authentication in a zero-knowledge architecture. A first server component may operate as a first relying party in a first SSO flow. When the user of an application successfully authenticates to a first identity provider, a first part of a secret key may be provided to the application. Additionally, a second server component may operate as a second relying party in a second SSO flow. When the first part of the secret key is received by the application, authentication information may be provided to a second identity provider. Based on a successful authentication, a second part of the secret key may be provided to the application. The first and second parts of the secret key may be combined by the application to generate a final secret key that may be used to decipher encrypted user data.