Abstract: A kernel mode protection circuit includes a processor, a program counter, a kernel program fetch supervisor circuit, a kernel data fetch supervisor circuit, a program memory, a data memory, a flip-flop circuit and two AND circuits. The data memory includes two user memories, protected registers and random access memory (RAM). The program memory includes two user memories and a kernel read only memory (ROM). The circuit may operate in either a user mode (kernel ROM is not accessible) or a kernel mode (kernel ROM is accessible). When in the kernel mode the kernel RAM and certain protected registers are accessible only by a secure kernel. The kernel mode control circuit will reset the processor should a security violation occur, such as attempting to access the kernel RAM while in the user mode.

Abstract: A hardware secure memory area includes one or more secondary communication buses connected to a main communication bus. The secondary communication buses are coupled to the main communication bus by separate bus transceivers. The bus transceivers provide isolation between the communication buses and between unaccessed secondary buses and the main communication buses. Various external devices, such as memories, may be coupled to the communication buses. Only one bus transceiver may be activated at a time, thus making it impossible for two secondary communication buses to be linked.

Abstract: A method of generating a recovery key encryption key (RKEK) in a secure manner by an integrated circuit (IC) and a key recovery escrow agent includes the steps of generating by the IC a first number having a private component and a public component, and generating by the escrow agent a second number having a private component and a public component. The public component of the first number is provided to the escrow agent, and the public component of the second number is provided to the integrated circuit. A Diffie-Hellman modulo-exponentiation mathematical operation is performed by the integrated circuit using the private component of the first number, the public component of the first number and the public component of the second number to create the RKEK. A similar operation is performed by the escrow agent using the private component of the second number, the public number of the second number and the public component of the first number to create the RKEK at its end.

Abstract: A key management scheme for managing encryption keys in a cryptographic co-processor includes the first step of selecting a key from one of a symmetrical key type and an asymmetrical key type. Then, the key bit length is selected. The key is then generated and, lastly, the key is represented in either an external form or an internal form.

Abstract: A protection circuit operates in a user or kernel mode. In the kernel mode, a kernel memory is accessible only by a secure kernel. A processor is reset if a security violation occurs, such as by attempting to access kernel memory in user mode. A program fetch supervisor circuit compares addresses to a predetermined address to determine if a security violation has occurred. A data fetch supervisor circuit compares data addresses to a protected memory address range. A security violation occurs if the data address is in protected memory, which resets the processor. A method of kernel mode protection includes fetching a program opcode or data operand. If the program opcode or data operand is from kernel memory and the processor is in user mode, the processor is reset. If an opcode is fetched from user memory while in kernel mode, the processor reverts to user mode.

Abstract: A method of generating a recovery key encryption key (RKEK) in a secure manner by an integrated circuit (IC) and a key recovery escrow agent includes the steps of generating by the IC a first number having a private component and a public component, and generating by the escrow agent a second number having a private component and a public component. The public component of the first number is provided to the escrow agent, and the public component of the second number is provided to the integrated circuit. A Diffie-Hellman modulo-exponentiation mathematical operation is performed by the integrated circuit using the private component of the first number, the public component of the first number and the public component of the second number to create the RKEK. A similar operation is performed by the escrow agent using the private component of the second number, the public number of the second number and the public component of the first number to create the RKEK at its end.

Abstract: An axial flow metering valve includes a valve body having an inlet, an outlet, a valve chamber therebetween and a passage for fluid between the inlet and the valve chamber. A valve member is movable in the valve chamber and includes a number of guide pins which extend axially through guide slots and into grooves in the valve body. The guide pins are threadedly engaged with a rotatable actuating member which encircles them. Rotation of the actuating member moves the valve member toward and away from the valve seat to regulate fluid flow. The valve member may carry a check valve member which checks reverse flow or may carry an inner bypass valve member which permits full unregulated reverse flow.