-
公开(公告)号：US12088696B2
公开(公告)日：2024-09-10
申请号：US17649549
申请日：2022-01-31
Applicant: salesforce.com, inc.
Inventor： Prasad Peddada , Taher Elgamal
CPC classification number: H04L9/0825 , H04L9/0841 , H04L9/085 , H04L9/0894 , H04L9/3213 , H04L9/3247 , H04L9/3263 , H04L2209/46
Abstract: A client application and a local security controller (LSC) executing on a host computing device use a Multiparty Computation (MPC) cryptographic key generation technique to create two fragments of a split private key, which are held by the client application and LSC, respectively. The client application generates a certificate signing request (CSR). The client application and LSC sign the CSR with the split private key using an MPC technique. The LSC then signs a token from the client application to indicate that the private key corresponding to the CSR is MPC-backed. A package with the CSR and the first and second signatures is then sent to a remote device acting as a certificate authority. The remote device verifies the two signatures and issues a certificate to the client application. The second signature is verified using information sent to the remote device from the LSC during a registration process.
-
公开(公告)号：US20230246845A1
公开(公告)日：2023-08-03
申请号：US17649513
申请日：2022-01-31
Applicant: salesforce.com, inc.
Inventor： Prasad Peddada , Matthew Schechtman , Taher Elgamal
CPC classification number: H04L9/3247 , G06F21/602 , H04L9/0894
Abstract: Techniques are disclosed relating to the protection of secrets within a software development lifecycle. Developers can use an encryption service to encrypt a secret to be used by an application within a package. The secret can be associated with the application, and then encrypted and included in a package that is signed and passed through a software automation pipeline to a data center that hosts the production server for the application. The application executing on the production server can request that the secret be decrypted by a decryption service after package verification. A developer can also specify, in a manifest file, a set of secrets needed for applications executing in the same data center. The manifest file may be passed from the software development environment to the data center, where the specified secrets are created and used by the applications without ever residing or being accessible outside the data center.
-
公开(公告)号：US20220029790A1
公开(公告)日：2022-01-27
申请号：US16938715
申请日：2020-07-24
Applicant: salesforce.com, inc.
Inventor： Prasad Peddada , Taher Elgamal , Aaron Marcus Johnson
Abstract: A client system may generate a new key pair for a secrets management process. The client may generate a shared secret using the private key of the new key pair and a public key of a secrets management server. Using the shared secret, the client may derive an encryption key and encrypt a data payload for subsequent decryption by the secrets management server. Upon encryption of the data payload, the client may erase the private key. Subsequently, the client or an associated client may call the secrets management server for decryption of the data payload. The secrets management server may derive the encryption key using the public key associated with the encrypted payload and the private key of the secrets management server and use the encryption key to decrypt the data payload for use by the client or an associated client.
-
公开(公告)号：US10356088B1
公开(公告)日：2019-07-16
申请号：US15627031
申请日：2017-06-19
Applicant: salesforce.com, inc.
Inventor： Prasad Peddada , Taher Elgamal
Abstract: An ID service provisioned on a server interacts with a corresponding ID app installed on a user device such as a smart phone for secure user authentication (login). A user acquires two asymmetric encryption keys pairs. One of the private keys is secured on SIM on the user device, and the other one stored in the ID app on the user device. At login attempt, the ID service generates two random challenge messages, and encrypts each of them with one of the public keys. Decryption of one challenge is conducted by the SIM and decryption of the other is done by the ID app. A token based on the two decrypted challenge results is returned to the ID service. Alternatively, a single challenge can be double-wrapped with the two keys. The verifies the results and enables secure login without requiring a password.
-
公开(公告)号：US11743044B2
公开(公告)日：2023-08-29
申请号：US17480806
申请日：2021-09-21
Applicant: salesforce.com, inc.
Inventor： Prasad Peddada , Taher Elgamal , Vishal Agarwal
CPC classification number: H04L9/3073 , H04L9/0841 , H04L9/0877 , H04L9/3271
Abstract: Multiple systems, methods, and computer program product embodiments for password-less authentication using key agreement and multi-party computation (MPC). In one or more embodiments, following an authentication request received by a host computing device, the host computing device and a user computing device generate a shared key using a key agreement algorithm. Then, the host computing device generates a challenge that is encrypted using the shared key and transmitted to the user computing device. The user computing device decrypts the challenge after regenerating the shared key and sends the decrypted result to the host computing device as the challenge response. The authentication request is granted by the host computing device if the challenge and the challenge response match. New keys and a new challenge are generated for each authentication request. This process relies on public key cryptography eliminating the needs for passwords.
-
Patent Agency Ranking
公开(公告)号：US20230089865A1
公开(公告)日：2023-03-23
申请号：US17480806
申请日：2021-09-21
Applicant: salesforce.com, inc.
Inventor： Prasad PEDDADA , Taher Elgamal , Vishal Agarwal
Abstract: Multiple systems, methods, and computer program product embodiments for password-less authentication using key agreement and multi-party computation (MPC). In one or more embodiments, following an authentication request received by a host computing device, the host computing device and a user computing device generate a shared key using a key agreement algorithm. Then, the host computing device generates a challenge that is encrypted using the shared key and transmitted to the user computing device. The user computing device decrypts the challenge after regenerating the shared key and sends the decrypted result to the host computing device as the challenge response. The authentication request is granted by the host computing device if the challenge and the challenge response match. New keys and a new challenge are generated for each authentication request. This process relies on public key cryptography eliminating the needs for passwords.
-
公开(公告)号：US11606348B2
公开(公告)日：2023-03-14
申请号：US17221340
申请日：2021-04-02
Applicant: salesforce.com, inc.
Inventor： Prasad Peddada , Taher Elgamal
Abstract: Techniques are disclosed relating to user authentication using multi-party computation and public key cryptography. In some embodiments, a server may receive, from a client, a request to authenticate a user to a service. The server may access key-pair information that includes, for a server key-pair, a first component of a server private key and, for a client key-pair, a client public key and a first component of a client private key. The server may generate a partial signature value that is based on the first component, but not the entirety, of the server private key. The server may send, to the client, an authentication challenge that includes challenge information and the partial signature value. The server may then determine whether to authenticate the user based on an authentication response from the client.
-
公开(公告)号：US11522686B2
公开(公告)日：2022-12-06
申请号：US16931226
申请日：2020-07-16
Applicant: salesforce.com, inc.
Inventor： Prasad Peddada , Taher Elgamal , Aaron Johnson , Ryan Guest
Abstract: Methods and systems for securing customer data in a multi-tenant database environment are described. A key identifier received from a security server may be stored by an application server. The key identifier may be associated with a private key that is accessible by the security server and not accessible by the application server. A request to derive a symmetric key may be transmitted from the application server to the security server, the request including a public key generated by the application server, a salt value, and the key identifier. The symmetric key may then be derived based on the transmitted public key and the private key using a key derivation function. The application server may then receive and store the symmetric key in an in-memory cache, and be used to securely encrypt data received by the application server from client devices.
-
公开(公告)号：US11233636B1
公开(公告)日：2022-01-25
申请号：US16938632
申请日：2020-07-24
Applicant: salesforce.com, inc.
Inventor： Prasad Peddada , Taher Elgamal
Abstract: A client may transmit an authentication request to a server. the server may initiate a key agreement process using a short-lived private key generated at the server and a public key of the device, generate a shared secret, and derive a symmetric key. The symmetric key may be used to encrypt a random challenge. Further, the server initiates a key agreement process for the client using the partial private key that was generated for the client and the short-lived public key generated at the server. A partial key agreement result and the encrypted random challenge may be transmitted to the client. The client may complete the key agreement process using the partial key agreement result and a respective portion of the private key. The client may derive the encryption key and decrypt the random challenge. An indication of the random challenge may be transmitted to the server, which authenticates the client.
-
公开(公告)号：US20200252382A1
公开(公告)日：2020-08-06
申请号：US16263871
申请日：2019-01-31
Applicant: salesforce.com, inc.
Inventor： Prasad Peddada, IV , Taher Elgamal
Abstract: Techniques are disclosed relating to user authentication using multi-party computation and public key cryptography. In some embodiments, a client system may receive, from a server system, an authentication challenge that includes a first partial signature value. The client system may access key-pair information that includes, for a server key-pair, a server public key and a second component of a server private key, where the server system has access to a first component of the server private key. The client system may then generate a second partial signature value using the second component of the server private key but not an entirety of the server private key, and may generate a final signature value based on the first and second partial signature values. Using the final signature value, the client system may then determine whether the authentication challenge was sent by the server system.
-
-
-
-
-
-
-
-
-
Search Results
37
records
(took 0.032 seconds)
