Abstract: Systems and methods that approximate and use branching operations on data encrypted by fully homomorphic encryption (FHE). The systems and methods may use polynomial approximation to convert “if” statements into “soft if” statements that may be applied to the FHE encrypted data in a manner that preserves the security of the systems and methods.

Abstract: A method for detecting an unauthorized activity on a computer system involves obtaining current time stamps for a first type of access event related to the computer system, determining a current count of the first type of access event using the current time stamps, and predicting an expected count of the first type of access event using a current count of time stamps and a predictive model. The method further involves obtaining an actual count of the first type of access event, executing a first comparison of the actual count with the expected count, determining, based on a test comprising the first comparison, that the unauthorized access to the computer system occurred, and issuing an alert indicating the unauthorized activity occurred.

Abstract: The present disclosure relates to deriving cryptographic keys for use in encrypting data based on a plaintext to be encrypted. An example method generally includes receiving, from a querying device, a request for a cryptographic key. The request generally includes data derived from a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted. A cryptographic key is generated based, at least in part, on the derived data and the type of the plaintext value to be encrypted. The key deriver transmits the generated cryptographic key to the querying device.

Abstract: Certain aspects of the present disclosure provide techniques for performing computations on encrypted data. One example method generally includes obtaining, at a computing device, encrypted data, wherein the encrypted data is encrypted using fully homomorphic encryption and performing at least one computation on the encrypted data while the encrypted data remains encrypted. The method further includes identifying a clear data operation to perform on the encrypted data and transmitting, from the computing device to a server, a request to perform the clear data operation on the encrypted data, wherein the request includes the encrypted data. The method further includes receiving, at the computing device in response to the request, encrypted output from the server, wherein the encrypted output is of the same size and the same format for all encrypted data transmitted to the server.

Abstract: At least one processor of a central authority separate from a computing process may establish a first trust relationship between the computing process and a central authority separate from the computing process. The establishing may include authenticating the computing process, which may include providing a signed token to the computing process, receiving a request for the certificate from the computing process including the signed token and policy ID data, determining that the computing process is eligible for the certificate according to a policy that associates the certificate with the policy ID data, and validating the signed token. In response to the establishing, the at least one processor may obtain the certificate. The certificate may be signed by a third party certificate authority with which the central authority has a second trust relationship separate from the first trust relationship. The at least one processor may provide the certificate to the computing process.

Abstract: A processor of a central authority separate from a client and a service provider may receive an access request from the client. The access request may identify at least one of a client user and a client process. The processor may evaluate the access request to determine that the at least one of the client user and the client process complies with an access policy for the service provider. In response to determining that the at least one of the client user and the client process complies with the access policy, the processor may generate a credential including a key. The processor may send the credential to the client. The processor may receive the credential from the service provider. The processor may validate the key included in the credential. In response to the validating, the processor may cause the service provider to provide the client with access to the service.

Abstract: A processor of a remote crypto cluster (RCC) may obtain an encrypted specific key from at least one data source through at least one network. The processor of the RCC may derive intermediate data in blind based on the encrypted specific key. The intermediate data may include information from which a derived key is derived. The processor of the RCC may send the intermediate data in blind to a client device.

Abstract: The present disclosure relates to processing data queries on a logically sharded data store. An example method generally includes receiving, from a client device, a query. The query generally comprises one or more data items and wherein at least one of the one or more data items comprises sensitive data. A query processor obtains, from a key management server, a cryptographic key to use to encrypt the record based on data derived from the one or more data items comprising sensitive data and a type of the sensitive data. The query processor generates an encrypted query based on the query and the obtained cryptographic key and executes the encrypted query against the logically sharded database.

Abstract: A method and system provides access control encryption for a file system. A resource management module manages access to data on a storage container and hosts a virtual file system including files representing the data on the storage container. An access control and encryption module encrypts each of the files with a respective file encryption key. The access control module generates a plurality of application containers each associated with a respective user and that include respective lists of files that the respective user is authorized to access. The access control and encryption module generates decrypts the files and allows access to files based on the lists of files in the application containers.

Abstract: A method and system provides access control for sensitive data. An access control system defines a plurality of access policies for gaining access to the sensitive data. Each access policy includes a plurality of rules that indicate whether or not a client machine can gain access to an initial access secret under the policy. If a client machine requests access to the sensitive data, the access control system checks to see if the client machine satisfies the rules of the access policy. If the characteristics of the client machine satisfy the rules of the access policy, then the access control system provides a ticket to the client machine and instructs the client machine to write the ticket to a client machine information database. If the client machine writes the ticket to the client machine information database, then the access control system provides an initial access secret to the client machine.

Abstract: The present disclosure relates to processing data queries on a logically sharded data store. An example method generally includes receiving, from a client device, a query. The query generally comprises one or more data items and wherein at least one of the one or more data items comprises sensitive data. A query processor obtains, from a key management server, a cryptographic key to use to encrypt the record based on data derived from the one or more data items comprising sensitive data and a type of the sensitive data. The query processor generates an encrypted query based on the query and the obtained cryptographic key and executes the encrypted query against the logically sharded database.

Abstract: The present disclosure relates to deriving cryptographic keys for use in encrypting data based on a plaintext to be encrypted. An example method generally includes receiving, from a querying device, a request for a cryptographic key. The request generally includes data derived from a plaintext value to be encrypted and an indication of a type of the plaintext value to be encrypted. A cryptographic key is generated based, at least in part, on the derived data and the type of the plaintext value to be encrypted. The key deriver transmits the generated cryptographic key to the querying device.

Abstract: A method and system provides access control for sensitive data. An access control system defines a plurality of access policies for gaining access to the sensitive data. Each access policy includes a plurality of rules that indicate whether or not the client machine can gain access to an initial access secret under the policy. When the access control system receives access request data from a client machine requesting access to the access control system under one of the policies, the access control system compares characteristics of the client machine to the rules of the access policy. If the characteristics of the client machine satisfy the rules of the access policy in the access control system provides an initial access secret, such as an application key, to the client machine.

Abstract: A method and system provides access control for sensitive data. An access control system defines a plurality of access policies for gaining access to the sensitive data. Each access policy includes a plurality of rules that indicate whether or not the client machine can gain access to an initial access secret under the policy. When the access control system receives access request data from a client machine requesting access to the access control system under one of the policies, the access control system compares characteristics of the client machine to the rules of the access policy. If the characteristics of the client machine satisfy the rules of the access policy in the access control system provides an initial access secret, such as an application key, to the client machine.

Abstract: A method and system provides access control encryption for a file system. A resource management module manages access to data on a storage container and hosts a virtual file system including files representing the data on the storage container. An access control and encryption module encrypts each of the files with a respective file encryption key. The access control module generates a plurality of application containers each associated with a respective user and that include respective lists of files that the respective user is authorized to access. The access control and encryption module generates decrypts the files and allows access to files based on the lists of files in the application containers.

Abstract: The present invention discloses methods and devices for securing keys when key-management processes are subverted by an adversary. Methods include the steps of: upon receiving a creation request in the computing-environment, creating a secure key in at least one location in a computing environment by repetitively computing respective secure-key contributions: in at least one location; and in a set of N computing resources in the computing environment, wherein N is a non-negative integer; and applying the respective secure-key contributions to change a secure-key value, wherein: the respective secure-key contributions cannot be omitted or modified by at least one location; and the secure key is never revealed to the computing resources; thereby enabling the computing resources in the computing environment to ensure that the secure key is truly random; wherein at least one location is a region of memory located in a computing resource operationally connected to the computing-environment.

Abstract: The present invention discloses methods and devices for securing keys for a non-secure computing-environment.

Abstract: The present invention discloses methods for trusted protocols for a non-secure computing-environment. Methods include the steps of: upon request for determining that an untrusted computing resource is trustworthy, vouching for the untrusted resource as trustworthy by a trusted computing resource upon satisfying at least one criterion of: the trusted resource was directly involved in setting up and/or activating the untrusted resource; and/or has access to a database of identifying credentials and/or information which allow the trusted resource to verify that the untrusted resource is trustworthy; and concealing at least one secret that needs to be present on any computing resource, wherein at least one secret is concealed differently on each computing resource; and transmitting at least one secret from any computing resource to any other computing resource in a way that changes the step of concealing at least one secret without any computing resource knowing at least one secret.

Abstract: The present invention discloses methods and devices for securing keys when key-management processes are subverted by an adversary. Methods include the steps of: upon receiving a creation request in the computing-environment, creating a secure key in at least one location in a computing environment by repetitively computing respective secure-key contributions: in at least one location; and in a set of N computing resources in the computing environment, wherein N is a non-negative integer; and applying the respective secure-key contributions to change a secure-key value, wherein: the respective secure-key contributions cannot be omitted or modified by at least one location; and the secure key is never revealed to the computing resources; thereby enabling the computing resources in the computing environment to ensure that the secure key is truly random; wherein at least one location is a region of memory located in a computing resource operationally connected to the computing-environment.

Abstract: The present invention discloses methods and devices for securing keys for a non-secure computing-environment.