Abstract: Techniques are provided for computing with private healthcare data. The techniques include a method comprising constructing an isolated memory partition that forms a secure enclave and pre-provisioning software within the secure enclave. The pre-provisioned software is configured to receive at least one of input data or the instructions for the one or more application computing processes in an encrypted form; decrypt the at least one of input data or instructions using one or more cryptographic keys; execute the one or more application computing processes based on the decrypted at least one of input data or instructions to generate output data; generate a proof of execution that indicates that the one or more application computing processes operated on the received input data; encrypt the output data using the one or more cryptographic keys; and provide external access to the encrypted output data and the proof of execution.

Abstract: System and methods are provided to create representations of geographic areas. Such representations enable users to search for items and services of interest and to quickly locate and utilize such items and services. Representations are created using user preferences thus reducing the amount of information presented to a user, i.e., user preferences control the contents of a representation. Control APIs contained within a representation may be used to control devices represented in a representation or to manufacture them using 3-D printing technologies. Methods to learn user preferences via his movements and other actions and impose a user's preferences upon an environment are shown. Some details of the invention are described by applying the invention to problems in retail marketing and figures depicting an implementation illustrate certain aspects of the invention.

Abstract: Techniques are provided for computing with private healthcare data. The techniques include a method comprising constructing an isolated memory partition that forms a secure enclave and pre-provisioning software within the secure enclave. The pre-provisioned software is configured to receive at least one of input data or the instructions for the one or more application computing processes in an encrypted form; decrypt the at least one of input data or instructions using one or more cryptographic keys; execute the one or more application computing processes based on the decrypted at least one of input data or instructions to generate output data; generate a proof of execution that indicates that the one or more application computing processes operated on the received input data; encrypt the output data using the one or more cryptographic keys; and provide external access to the encrypted output data and the proof of execution.

Abstract: A method of associating multiple user endpoints (UEs) with a single IMS session in an IMS network having a serving node for controlling at least one IMS session for a user and at least a first access network for providing access to UEs. The method involves associating a first UE with the user and with an IMS session; discovering a second UE in a proximity of the first UE; discovering information about the second UE; communicating the information about the second UE to the serving node; the serving node utilizing computer-implemented policy logic to determine whether to associate the second UE with the user and the IMS session; and if the policy logic determines that the second UE is to be associated, the serving node associating the second UE with the IMS session while retaining the association with the first UE.

Abstract: A method of controlling dissemination of content to communication devices over one or more communication networks includes receiving, by a content dissemination mechanism, a message reflecting a user-initiated action that is to cause dissemination of a given content item to a plurality of communication devices each associated with a user. Responsive to the message, a group of communication devices is identified to which the given content item is to be disseminated. A first subset of the identified group is determined. The content item is disseminated to a first subset of communication devices in the identified group. The determining is based at least in part on a first ratings formula derived at least in part from ratings of the given content item provided by users to whom the given content item has already been disseminated.

Abstract: In accordance a method for storing a dataset, the dataset may be split into fragments that are distributed among different nodes of a network for storage. The fragments may then be retrieved as and when needed and re-assembled. The method allows multiple different fragments to be stored and re-assembled on demand. The dataset is initially stored in a user computing device in communication with a data storage system and a custodial entity. The fragments are stored so that no single computing entity in the storage system or the custodian ever contains or gains knowledge of all the fragments. Additionally, the user computing device that was initially in possession of the dataset and which caused the fragments to be stored in the storage system may be replaced with different user computing devices without losing the capability of storing and re-assembling the user data on demand by the replacement user computing device.

Abstract: System and methods are provided to create representations of geographic areas. Such representations enable users to search for items and services of interest and to quickly locate and utilize such items and services. Representations are created using user preferences thus reducing the amount of information presented to a user, i.e., user preferences control the contents of a representation. Control APIs contained within a representation may be used to control devices represented in a representation or to manufacture them using 3-D printing technologies. Methods to learn user preferences via his movements and other actions and impose a user's preferences upon an environment are shown. Some details of the invention are described by applying the invention to problems in retail marketing and figures depicting an implementation illustrate certain aspects of the invention.

Abstract: A method for obtaining a representation of an environment includes requesting device context information from a user device. The request is sent to the user device from a virtual machine environment established by a database processor. The virtual machine environment is established by the database processor in response to a request received from the user device over a network for a representation of an environment. User preference information is requested and the device context information and the user preference information are received in the virtual machine environment. Based on the device context information, an environmental data set (EDS) is identified that includes information reflective of the environment. The EDS is received in the virtual machine environment and the EDS is modified based at least in part on the user preference information. Executable computer code is constructed for generating a representation from the modified EDS and sent to the user device.

Abstract: A system and method is presented that extracts snippets form web pages according to specially designed logic. The extracted snippets might be made relevant to, i.e., indexed by, a location and time/day applicability. Such snippets may be thought of as apps or services that are defined only when a mobile terminal is in a pre-defined geographical area at a certain time and day (e.g., as defined by a calendar of events). Extracted snippets are stored and made searchable. Methods and a system are described to control the display of snippet search results. Snippets may be selected by user or by programmed logic and executed on the mobile terminal or in remote servers without the need to download the app or source code associated with the snippet.

Abstract: A method and system for accessing stored data includes receiving a request to access data stored in a data storage unit. The request requires one or more data operations to be performed by a system having access to the stored data. Responsive to the data request, one or more locks are derived and assigned to one or more of the data operations. Each of the locks control invocation of the data operations to which the respective lock is assigned. The deriving is based in part on (i) user context data obtained from a user issuing the request and (ii) data context comprising one or more attributes of the request. Each of the one or more locks is unlocked and the one or more data operations are invoked after the one or more locks are unlocked.

Abstract: An online service provisioning process is provided during which the service provider's knowledge about the user to whom the service is delivered does not increase. This is accomplished by presenting user attribute information to the service provider as obfuscated objects that can be independently verified and which are privacy preserving.

Abstract: Secure computing environments are employed to effectuate execution of algorithms to process datasets. For this purpose a secure data pipeline is used in which trusted and isolated computing environments receive and process the algorithms and datasets. A trusted and isolated computing environment is a computing environment whose computer code is able to be attested by comparing a digest of the computing environment to a baseline digest of the computing environment that is available to third parties to thereby verify computing environment integrity while also being a computing environment in which only a specified maximum number of application processes and specified system processes implementing the computing environment are able to operate.

Abstract: Applications of the privacy switch technology are shown for handling data breaches in database systems, thereby providing fundamental improvements to the security and utility of database technology.

Abstract: Techniques are provided for computing with private healthcare data. The techniques include a method comprising constructing an isolated memory partition that forms a secure enclave and pre-provisioning software within the secure enclave. The pre-provisioned software is configured to receive at least one of input data or the instructions for the one or more application computing processes in an encrypted form; decrypt the at least one of input data or instructions using one or more cryptographic keys; execute the one or more application computing processes based on the decrypted at least one of input data or instructions to generate output data; generate a proof of execution that indicates that the one or more application computing processes operated on the received input data; encrypt the output data using the one or more cryptographic keys; and provide external access to the encrypted output data and the proof of execution.

Abstract: Techniques are provided for computing with private healthcare data. The techniques include a method comprising constructing an isolated memory partition that forms a secure enclave and pre-provisioning software within the secure enclave. The pre-provisioned software is configured to receive at least one of input data or the instructions for the one or more application computing processes in an encrypted form; decrypt the at least one of input data or instructions using one or more cryptographic keys; execute the one or more application computing processes based on the decrypted at least one of input data or instructions to generate output data; generate a proof of execution that indicates that the one or more application computing processes operated on the received input data; encrypt the output data using the one or more cryptographic keys; and provide external access to the encrypted output data and the proof of execution.

Abstract: A method for communicating information relating to test results of a user includes obtaining test results of a user. An assertion is derived from the test results of the user. The test results are input to a pre-provisioned first algorithm. The assertion is encapsulated in a first data object by a PGE that controls an environment in which the first algorithm is executed. A first proof is generated which is configured to be usable to verify that the first algorithm used the test results to produce the assertion when provided to a PVE along with the first data object. The test results itself are excluded from the first proof and the first data object such that privacy of the test results is maintained. The first proof and the first data object are communicated to a receiving communication device from an enterprise communication device associated with the user and an enterprise.

Abstract: A method for sharing information has an assertion associated therewith such that the receiving communication device is able to verify the assertion without the sender revealing underlying data demonstrating the validity of the assertion. The assertion is derived from underlying data input to a pre-provisioned first algorithm. The assertion is encapsulated in a first data object by a PGE that controls an environment in which the first algorithm is executed. A first proof is generated that is configured to verify that the first algorithm used the underlying data to produce the assertion when provided to a PVE along with the first data object. The underlying data is excluded from the first proof and the first data object such that privacy of the underlying data is maintained. The information, the first proof and the first data object are sent to the receiving communication device from the sending communication device.

Abstract: Systems and methods are presented for processing a dataset in a sequence of steps that define at least a portion of a data pipeline. The method includes: providing a plurality of trusted and isolated computing environments; providing one or more algorithms in each of the trusted and isolated computing environments, the one or more algorithms in each of the trusted and isolated computing environments being configured to process data in accordance with a different step in the data pipeline; receiving the dataset in a first of the trusted and isolated computing environments and causing the dataset to be processed by the one or more algorithms therein to produce a first processed output dataset; and causing the first processed output dataset to be processed in a second of the trusted and isolated computing environments by the one or more algorithms therein.

Abstract: A method for obtaining a representation of an environment includes requesting device context information from a user device. The request is sent to the user device from a virtual machine environment established by a database processor. The virtual machine environment is established by the database processor in response to a request received from the user device over a network for a representation of an environment. User preference information is requested and the device context information and the user preference information are received in the virtual machine environment. Based on the device context information, an environmental data set (EDS) is identified that includes information reflective of the environment. The EDS is received in the virtual machine environment and the EDS is modified based at least in part on the user preference information. Executable computer code is constructed for generating a representation from the modified EDS and sent to the user device.

Abstract: A system and method is presented that extracts snippets form web pages according to specially designed logic. The extracted snippets might be made relevant to, i.e., indexed by, a location and time/day applicability. Such snippets may be thought of as apps or services that are defined only when a mobile terminal is in a pre-defined geographical area at a certain time and day (e.g., as defined by a calendar of events). Extracted snippets are stored and made searchable. Methods and a system are described to control the display of snippet search results. Snippets may be selected by user or by programmed logic and executed on the mobile terminal or in remote servers without the need to download the app or source code associated with the snippet.