Samuel H Nelson

US Patent:

20220303115, Sep 22, 2022

Filed:

Mar 19, 2021

Appl. No.:

17/207031

Inventors:

- Cambridge MA, US
Samuel Cunningham Nelson - Sudbury MA, US
William Timothy Strayer - West Newton MA, US

International Classification:

H04L 9/06
H04L 9/08
H04L 9/14
G06F 16/22

Abstract:

Techniques for subscriber revocation in a publish-subscribe network using attribute-based encryption (ABE) are disclosed, including: generating a tree data structure including leaf nodes representing subscribers, subtrees of the tree data structure representing subsets of subscribers having different likelihoods of ABE key revocation; generating ABE keys associated with edges in the tree data structure; assigning ABE keys to the leaf nodes, each leaf node being assigned a subset of the ABE keys associated with edges that form a path from a root node to the leaf node; based at least on a revocation record that indicates one or more revoked subscribers, determining a minimal subset of ABE keys that covers all non-revoked subscribers; and encrypting a payload using an encryption policy requiring at least one ABE key in the minimal subset of the ABE keys, to obtain a ciphertext that is not accessible to the one or more revoked subscribers.

US Patent:

20220303127, Sep 22, 2022

Filed:

Mar 19, 2021

Appl. No.:

17/207042

Inventors:

- Cambridge MA, US
Samuel Cunningham Nelson - Sudbury MA, US
William Timothy Strayer - West Newton MA, US

International Classification:

H04L 9/08
H04L 29/08
H04L 9/14
H04L 9/06

Abstract:

Techniques for stream-based key management are disclosed. A system obtains a first payload to be published to a first set of one or more subscribers, encrypts the first payload using a symmetric key, to obtain a first payload ciphertext, encrypts the symmetric key using an attribute-based encryption (ABE) policy associated with the first payload, to obtain a key ciphertext, and publishes the first payload ciphertext and the key ciphertext. The system obtains a second payload to be published to a second set of one or more subscribers. Responsive at least to determining that each subscriber in the second set of one more subscribers is in the first set of one or more subscribers and the ABE policy is associated with the second payload, the system encrypts the second payload using the symmetric key, to obtain a second payload ciphertext, and publishes the second payload ciphertext without republishing the key ciphertext.

US Patent:

20210306227, Sep 30, 2021

Filed:

Mar 27, 2020

Appl. No.:

16/832039

Inventors:

- Cambridge MA, US
Stephane Yannick Blais - Framingham MA, US
Samuel Cunningham Nelson - Sudbury MA, US

International Classification:

H04L 12/24
H04L 29/06
H04L 29/08
G06F 16/907

Abstract:

Techniques for metadata-based information provenance are disclosed. A node in a data provisioning layer receives encrypted payload data to be delivered to a recipient. The node generates provenance metadata that describes at least one action taken by the node with respect to the encrypted payload data. The node transmits the encrypted payload data and the provenance metadata via the data provisioning layer toward the recipient.