Abstract: The subject disclosure is directed towards encryption and deduplication integration between computing devices and a network resource. Files are partitioned into data blocks and deduplicated via removal of duplicate data blocks. Using multiple cryptographic keys, each data block is encrypted and stored at the network resource but can only be decrypted by an authorized user, such as domain entity having an appropriate deduplication domain-based cryptographic key. Another cryptographic key referred to as a content-derived cryptographic key ensures that duplicate data blocks encrypt to substantially equivalent encrypted data.

Abstract: A cloud computing service to securely process queries on a database. A security device and method of operation are also disclosed. The security device may be provisioned with a private key of a subscriber to the cloud service and may have processing hardware that uses that key, sequestering the key and encryption processing in hardware that others, including operating personnel of the cloud service, cannot readily access. Processing within the security device may decrypt queries received from the subscriber and may encrypt responses for communication over a public network. The device may perform functions on clear text, thereby limiting the amount of clear text data processed on the cloud platform, while limiting bandwidth consumed in communicating with the subscriber. Such processing may include formatting data, including arguments in a query, in a security protocol used by the cloud platform.

Abstract: A computer-implementable method includes providing an instruction set architecture that comprises features to generate diverse copies of a program, using the instruction set architecture to generate diverse copies of a program and providing a virtual machine for execution of one of the diverse copies of the program. Various exemplary methods, devices, systems, etc., use virtualization for diversifying code and/or virtual machines to thereby enhance software security.

Abstract: Techniques are disclosed to provide randomized signal transforms and/or their applications. More particularly, a signal (e.g., an audio signal, an image, or a video signal) is transformed by applying randomly-selected basis functions to the signal. The applications of the randomized signal transforms include, but are not limited to, compression, denoising, hashing, identification, authentication, and data embedding (e.g., watermarking).

Abstract: A computer-implementable method includes providing an instruction set architecture that comprises features to generate diverse copies of a program, using the instruction set architecture to generate diverse copies of a program and providing a virtual machine for execution of one of the diverse copies of the program. Various exemplary methods, devices, systems, etc., use virtualization for diversifying code and/or virtual machines to thereby enhance software security.

Abstract: A secure cloud computing platform. The platform has a pool of secure computing devices such that each can be allocated to a customer as with other computing resources. Each secure computing device may be configured by a customer with a key and software for performing operations on sensitive data. The customer may submit data, defining a job for execution on the platform, as cyphertext. The secure computing device may perform operations on that data, which may include decrypting the data with the key and then executing the software to perform an operation on cleartext data. This operation, and the data on which it is performed, though in cleartext, may be inaccessible to the operator of the cloud computing platform. The device may operate according to a secure protocol under which the software is validated before loading and the device is provisioned with a key shared with the customer.

Abstract: Described is a technology by which program analysis uses rich invariant templates that may specify an arbitrary Boolean combination of linear inequalities for program verification. Also described is choosing a cut-set that identifies program locations, each of which is associated with an invariant template. The verification generates second-order constraints, converts second-order logic formula based on those constraints into first-order logic formula, then converts the first-order logic formula into a quantifier-free formula, which is then converted into a Boolean satisfiability formula. Off-the-shelf constraint solvers may then be applied to the Boolean satisfiability formula to generate program analysis results. Various templates may be used to convert the second-order logic formula into the first-order logic formula.

Abstract: A classification system is described for resilient classification of data. In various embodiments, the classification system divides a full set of the training data into a positive subset and a negative subset. The positive subset contains all training data with a positive classification value and the negative subset contains all training data with a negative classification value. The classification system constructs several subsets of the training data wherein each subset contains data randomly selected from both the positive subset and the negative subset. The classification system then creates at least two classifiers based on each of the randomly created subsets of the training data.

Abstract: Techniques are disclosed for generating complex invariants in a program using a Satisfiability Modulo Theories (SMT) solver. In one embodiment, the generated invariants may be used to validate assert statements in a program. Additionally or alternatively, a weakest pre-condition invariant may be generated such that parameters passed to the program that satisfy the weakest pre-condition are guaranteed to satisfy the program's assert statements. Additionally or alternatively, a strongest post-condition may be generated, determining what is guaranteed to be true about the state of the program upon completion of the program. In one embodiment, the SMT solver generates invariants by mapping predicates onto unknown variables in a template. The template may comprise unknown variables related by logical structures defined with disjunctions, universal quantifiers, and existential quantifiers. The predicates may comprise equalities and inequalities between program variables.

Abstract: Data formatting rules to convert data from one form to another form are automatically determined based on a user's edits. A machine learning heuristic is applied to a user's edits to determine a data formatting rule that may be applied to data. For example, a user may make edits that add/remove characters from data, concatenate data, extract data, rename data, and the like. The machine learning heuristic may be automatically triggered in response to an event (e.g. after a predetermined number of edits are made to a same type of data) or manually triggered (e.g. selecting a user interface option). The data formatting rule may be applied to other data and the results of the formatting reviewable by the user. Based on further edits/reviews, the data formatting rule may be updated. The data formatting rules may be stored for later use.

Abstract: Program obfuscation is accomplished with tamper proof token including an embedded oracle. A public obfuscation function can be applied to any program/circuit to produce a new obfuscated program/circuit that makes calls to the corresponding oracle to facilitate program execution. A universal circuit representation can be employ with respect to obfuscation to hide circuit wiring and allow the whole circuit to be public. Furthermore, the token or embedded oracle can be universal and stateless to enable a single token to be employed with respect to many programs.

Abstract: Which target functions in a target binary have target function basic blocks that match the source function basic blocks in a source function in a source binary is determined. For the target functions having matching target function basic blocks, a target function control flow graph is determined that has the greatest control flow matching strength to a source function control flow graph, wherein a node in the source function control graph represents a source function basic block, wherein a node in a target function control graph represents a target function basic block in a corresponding target function.

Abstract: Systems, methods, and/or techniques (“tools”) are described herein that relate to automated secure pairing for devices, and that relate to parallel downloads of content using devices. The tools for pairing the devices may perform authentication protocols that are based on addresses and on keys. The address-based authentication protocol may operate on address book entries maintained by the devices. The key-based authentication protocol may operate using a key exchange between the devices.

Abstract: Systems, methods, and/or techniques (“tools”) are described herein that relate to automated secure pairing for devices, and that relate to parallel downloads of content using devices. The tools for pairing the devices may perform authentication protocols that are based on addresses and on keys. The address-based authentication protocol may operate on address book entries maintained by the devices. The key-based authentication protocol may operate using a key exchange between the devices.

Abstract: The present invention leverages a series of media watermark locations to provide information relating to media ownership and/or distribution source. This provides a forensic means to establish a source of media with a high degree of certainty despite malicious and/or non-malicious attacks. By providing embedded user unique identification, a source of copied media can be determined without the embedded information substantially interfering with the intended purpose of the media itself. In one instance of the present invention, digital media is transformed into an N-dimensional media signal. User unique keys are then utilized along with a master key to determine locations for embedding a watermark signal that possesses substantially similar quantized statistics as the transformed media signal. The watermark signal is then embedded into the media signal, fingerprinting the media.

Abstract: Software protection using data structures is described. In one implementation, an engine between the processor and the memory of a computing device encrypts and stores data and program variables in blocks of memory that correspond to nodes of a tree-like data structure. When accessed, the nodes of this search tree are rearranged according to various schemata to obscure memory access patterns from being detected by cache attacks or side-channel attacks. In one implementation, the data structure is a splay tree that self-rearranges upon access and increases efficiency while providing security.

Abstract: Systems and methods provide an optionally keyed error-correcting code that is spectrally concentrated. Each codeword of the low dimensional spectral concentration code (LDSC code) typically has very few coefficients of large magnitude and can be constructed even with limited processing resources. Decoding can be performed on low power devices. Error-correcting code is constructed around a key using basic computer arithmetic for computations instead of finite field arithmetic, thus saving energy. A recipient who possesses the key enjoys correction of a relatively high percentage of noise errors. In one implementation, a direct list-decoder iteratively estimates a list of message words directly, instead of a list of codewords. In variations, a unique message word is selected from the list either by applying a randomness test or by using message passing.

Abstract: Techniques are disclosed to enable efficient implementation of secure hash functions and/or stream ciphers. More specifically, a family of graphs is described that has relatively large girth, large claw, and/or rapid mixing properties. The graphs are suitable for construction of cryptographic primitives such as collision resistant hash functions and stream ciphers, which allow efficient software implementation.

Abstract: A classification system is described for resiliently classifying data. In various embodiments, the classification system constructs a combined classifier based on multiple classifiers that are constructed to classify a set of training data. The combined classifier can be constructed in parallel with the multiple classifiers and applied to classify data.

Abstract: An implementation is described herein facilitates certification of goods and/or identifications of the source of such goods. At least one implementation, described herein, embeds a watermark into a relatively small amount of data in a deterministic manner. This abstract itself is not intended to limit the scope of this patent. The scope of the present invention is pointed out in the appending claims.