Abstract: Systems and methods are described for removing unused encryption key files from a computing device. In an example, a key removal tool can identify three sets of keys to preserve. For the first set, the key removal tool can append a device identifier to known key names and add the resulting key file names to a whitelist. For the second set, the key removal tool can identify keys associated with certificates on the computing device and add their corresponding file names to the whitelist. The third set can correspond to keys created after a cutoff timestamp. The key removal tool can delete all key files with key file names not on the whitelist that were created before the cutoff timestamp.

Abstract: Proper use of a remote monitoring function is realized in an elevator-control-device that monitors an elevator. An elevator-control-device is connected with a remote-monitoring-server that remotely monitors an elevator, via a communication network. The elevator-control-device includes a processor that performs a monitoring-control-process for monitoring the elevator, and a memory. The memory stores a communication function in which a control program for communicating with the remote-monitoring-server for the elevator is stored, a remote-monitoring-function in which a control program for the monitoring-control-process is stored, and a maintenance terminal function in which a control program for connection with a maintenance terminal is stored. The remote-monitoring-function is encrypted and is stored in the memory.

Abstract: Disclosed is an input/output circuit for a physical unclonable function generator circuit. In one embodiment, a physical unclonable function (PUF) generator includes: a PUF cell array comprising a plurality of bit cells configured in a plurality of columns and at least one row, and at least one input/output (I/O) circuit each coupled to at least two neighboring columns of the PUF cell array, wherein the at least one I/O circuit each comprises a sense amplifier (SA) with no cross-coupled pair of transistors, wherein the SA comprises two cross-coupled inverters with no access transistor and a SA enable transistor, and wherein the at least one I/O circuit each is configured to access and determine logical states of at least two bit cells in the at least two neighboring columns; and based on the determined logical states of the plurality of bit cells, to generate a PUF signature.

Abstract: Disclosed example people monitoring methods include detecting a first watermark in a first audio signal obtained from an acoustic sensor, the first watermark identifying media presented by a monitored media device, determining whether a second watermark, different from the first watermark, is embedded in the first audio signal obtained from the acoustic sensor, the second watermark identifying at least one of a mobile device or a user of the mobile device, classifying the second watermark as a media watermark or a people monitoring watermark based on a characteristic of the second watermark, and when the second watermark is determined to be embedded in the first audio signal, reporting at least one of the second watermark or information decoded from the second watermark to identify at least one of the mobile device or the user of the mobile device as being exposed to the media presented by the monitored media device.

Abstract: A method for outsourcing exponentiation in a private group includes executing a query instruction to retrieve a query element stored on an untrusted server by selecting a prime factorization of two or more prime numbers of a modulus associated with the query element stored on the server, obtaining a group element configured to generate a respective one of the prime numbers, generating a series of base values using the prime factorization and the group element, and transmitting the series of base values from the client device to the server. The server is configured to determine an exponentiation of the group element with an exponent stored on the server using the series of base values. The method also includes receiving a result from the server based on the exponentiation of the group element with the exponent.

Abstract: Embodiments described herein relate to apparatuses and methods for registering and storing a local key associated with a local application of a communication device, including, but not limited to, receiving a request from the communication device to register and store the local key, evaluating the request based on at least one first policy, and sending the request to register and store the local key to a secure key storage.

Abstract: The method of the invention comprises: an identification step (E30-E50) of identifying the user of the mobile terminal; a generation step, triggered if identification is successful, of a secure element of the terminal generating (E70) at least one identification value for the terminal by using a first secret key shared between the secure element and a token service provider device; a sending step (E100) of sending a request to the token service provider device to obtain at least one security token, the request including said at least one identification value for the terminal; and a reception step (F90) of receiving from the token service provider device said at least one security token in encrypted form, each security token being associated with a random number generated by the token service provider device and being encrypted by means of an encryption key generated for that token from the random number and from a second secret key shared between the token service provider device and the secure element of th

Abstract: There is a need for more effective and efficient secure data transmission. This need can be addressed by, for example, solutions for secure data transmission that utilize per-user-functionality secret shares. In one example, a method includes generating a hashed user identifier based on a received user identifier; transmitting the hashed user identifier to an external computing entity; and receiving a data retrieval secret share from the external computing entity, wherein: (i) the data retrieval secret share is selected from a plurality of per-user-functionality secret shares, (ii) the plurality of per-user-functionality secret shares are generated based on a secret value, (iii) the secret value is generated based on the hashed user identifier, (iv) the secret value is used to generate a user data private key, and (v) the external computing entity is configured to encrypt user-provided data using the user data private key prior to transmission of the encrypted user-provided data.

Abstract: Securely re-encrypting homomorphically encrypted data by receiving fully homomorphically encrypted (FHE) information from a client device, training a machine learning model using the FHE information, yielding FHE ciphertexts, applying a first transform to the FHE ciphertexts, yielding obfuscated FHE ciphertexts, sending the obfuscated FHE ciphertexts to a secure device, receiving a re-encrypted version of the obfuscated FHE ciphertexts from the secure device, applying a second transform to the re-encrypted version of the obfuscated FHE ciphertexts yielding de-obfuscated re-encrypted FHE ciphertexts, determining FHE ML model parameters according to the de-obfuscated re-encrypted ciphertexts, and sending the FHE ML model parameters to the client device.

Abstract: A system and method is described for the touchless entry of a personal identification number (PIN) at a self-service terminal such as an automated teller machine (ATM). A mobile device includes a PIN entry application. The self-service terminal includes a wireless interface for communicating wirelessly with the PIN entry application in the mobile device. A communication channel is established between a particular customer's mobile device and the self-service terminal. The PIN entry application verifies a public key for the self-service terminal at the mobile device. The customer's PIN is encrypted by the PIN entry application at the mobile device using either an ephemeral symmetric encryption key or a one-time RSA PIN transport public key. The encrypted PIN is transmitted to an encryption processor at the self-service terminal. The encryption processor decrypts the PIN using the appropriate encryption key.

Abstract: A method for tracing a digital information element in a computer system including electronic devices of users and a system for archiving digital information elements including a blockchain-type distributed database, the method including a step of making the digital information element from the electronic device of one of the users, a step of archiving the digital information element, the archiving step including a substep of generating an identification element of the version of the digital information element, the method including a step of adding the identification element signed with a secure element associated to this user and/or to their electronic device in the distributed database, the addition step including a substep of encrypting the identification element from a cryptographic algorithm and the secure element, the cryptographic algorithm including at least one metric variable associated to the user.

Abstract: A wireless communication network performs quantum authentication for a wireless User Equipment (UE). In the wireless communication network, quantum circuitry selects polarization states for qubits, generates and transfers the qubits, exchanges cryptography information with edge quantum circuitry, generates cryptography keys based on polarization states and cryptography information, and transfers the cryptography keys to network authentication circuitry. The edge quantum circuitry receives and process the qubits, determines the polarization states for the qubits, exchanges the cryptography information with the network quantum circuitry, generates the cryptography keys based on the polarization states and cryptography information, and transfers the cryptography keys to the wireless UE. The wireless UE generates authentication data based on the cryptography keys and wirelessly transfers the authentication data for delivery to the network authentication circuitry.

Abstract: Methods, systems, and computer program products for a secure database-as-a-service are provided herein. A computer-implemented method includes obtaining, by a database service, data associated with one or more client devices to be stored in at least one encrypted database; encrypting, without mutation and in accordance with one or more security requirements, at least a portion of the data using an order preserving encryption scheme, wherein the encrypting comprises (i) computing a set of encryption parameters for the portion of the data and (ii) applying a process that converts a fixed-length cipher text corresponding to the portion of the data to a variable-length cipher text; and storing the encrypted data in the at least one encrypted database, wherein the database service enables one or more indexes to be built over the encrypted data to improve performance of query processing.

Abstract: The described technology provides a capability to perform in-session updates to entitlements associated with a user's access to content served by a web application. The content may be from one or more external servers. The technology provides for automatically detecting changes to entitlements, and without requiring a user of an active session to initiate a new session, updating entitlement data in a memory such that subsequent requests for data made by the client in the same active session are serviced using the updated entitlements.

Abstract: Instructions and logic provide for a Single Instruction Multiple Data (SIMD) SM4 round slice operation. Embodiments of an instruction specify a first and a second source data operand set, and substitution function indicators, e.g. in an immediate operand. Embodiments of a processor may include encryption units, responsive to the first instruction, to: perform a slice of SM4-round exchanges on a portion of the first source data operand set with a corresponding keys from the second source data operand set in response to a substitution function indicator that indicates a first substitution function, perform a slice of SM4 key generations using another portion of the first source data operand set with corresponding constants from the second source data operand set in response to a substitution function indicator that indicates a second substitution function, and store a set of result elements of the first instruction in a SIMD destination register.

Abstract: A key fob duplication device is disclosed. The duplication device may have a housing and a display device attached to the housing. The duplication device may also have a controller enclosed within the housing. The controller may read data stored in the first key fob. The controller may also determine whether the first key fob can be duplicated based on the data. When the data indicates that the first key fob can be duplicated, the controller may write the data of the first key fob and an indicator value on a second key fob. The indicator value may indicate that the second key fob cannot be duplicated. When, however, the data indicates that the first key fob cannot be duplicated, the controller may display a message on the display device, indicating that the first key fob cannot be duplicated.

Abstract: A system and method for securely encrypting and booting a headless appliance. A method includes providing the headless appliance with content stored in a memory, wherein the content is encrypted with a key, and wherein the key is separately stored on a remote computing device; booting the headless appliance and loading a fallback configuration; in response to a user device connecting to the headless appliance, directing the user device to a captive portal and capturing credentials of a user; forwarding the credentials to the remote computing device for verification by an identity provider; in response to the credentials being verified as a non-administrator, granting access to a public network for the user; and in response to the credentials being verified as an administrator, obtaining the key from the remote computing device to decrypt the content to provide access to a private network for the user.

Abstract: Systems and methods for inter-service authentication are disclosed. In one embodiment, a system may include a plurality of services and a cloud platform. The first service may generate a token comprising a first service identifier for communicating with a second service, and may request, from the cloud platform, a private key for the first service. The cloud platform may provide the private key to the first service. The first service may sign the token with the private key and may communicate a request to the second service with the signed token. The second service may retrieve the first service identifier and may request, from the cloud platform, a public key for the first service identifier. The cloud platform may provide the public key to the second service. The second service may validate the token using the public key, and may grant the request in response to the validation.

Abstract: Some embodiments are directed to an electronic cryptographic device arranged to perform a cryptographic operation on input data obtaining output data. The cryptographic device stores an internal state as sets of shares. Fourier coefficients corresponding to the sets of shares satisfy a predetermined relationship among them. The cryptographic operation is performed by repeatedly updating the internal state.

Abstract: Techniques are described herein for security hardened processing devices. For example, a method can include performing a secure boot of a processing device of a computer system. The processing device is configured as a root of trust for a secure boot process. The computer system can include the processing device and a non-volatile memory storing a basic input/output system (BIOS) for the secure boot process. The method can include identifying a set of programmable fuses of the processing device, deriving an encryption key using a value encoded by the set of programmable fuses in the processing device, and authenticating the BIOS to perform the secure boot process using a key derivation algorithm based on the encryption key.

Abstract: A physically unclonable function device includes a set of diode-connected MOS transistors having a random distribution of respective threshold voltages. A first circuit is configured to impose, on each first transistor, a fixed respective gate voltage regardless of the value of a current flowing in this first transistor. A second circuit is configured to impose, on each second transistor, a fixed respective gate voltage regardless of the value of a current flowing in this second transistor. A current mirror stage is coupled between the first circuit and the second circuit and is configured to deliver the reference current from a sum of the currents flowing in the first transistors. A comparator is configured to deliver a signal whose level depends on a comparison between a first current obtained from a reference current based on the first transistors and a second current of the second transistors.

Abstract: A method including determining a first master key based on receiving a master string; decrypting, based on utilizing the first master key, an encrypted first cryptographic key; decrypting, based on utilizing the first cryptographic key, first factor authentication information to enable determination of a first factor; transmitting the first factor for authentication of the first factor; transmitting, based on successful authentication of the first factor and on verifying biometric information, a decryption request including an encrypted second cryptographic key in association with an identifier to indicate that the encrypted second cryptographic key is to be decrypted based on utilizing a second master key identified by the second identifier; decrypting, based on receiving the second cryptographic key, second factor authentication information to enable determination of a second factor; and transmitting the second factor for authentication to enable receipt of a service based on successful authentication of th

Abstract: Provided are a computer program product, system, and method for determining key server type and key server redundancy information to enable encryption. A first key server type for a first protocol is indicated in a key server type field in response to determining a current protocol used to communicate with the key server comprises the first protocol. A query information request is submitted to the key server to determine a key server type in response to determining that the current protocol comprises the second protocol. The second key server type indicated in the response to the query information request is indicated in the key server type field in response to the response indicating the second key server type. The first or second type of key server indicated in the key server type field is used to determine information to include in a key retrieval request.

Abstract: Systems, methods, and computer program products for data security store, in memory, a plurality of ciphers in association with a plurality of public keys, the plurality of ciphers including a plurality of secret keys encrypted with a key encryption key, and the plurality of secret keys corresponding to the plurality of public keys; receive, a data chunk for encryption; generate, a data encryption key based on a hash function, a public key of the plurality of public keys, and a random number; encrypt, the data chunk with the data encryption key to generate an encrypted data chunk; generate, a header including a cipher of the plurality of ciphers corresponding to the public key of the plurality of public keys and key encapsulation data; and store, in a database, a cipher text including the header and the encrypted data chunk.

Abstract: Enhancing security achieved via encryption that is performed within an encryption device by combining entropy that is generated within the encryption device with additional entropy, that is generated external to the encryption device, into the generation of an encryption key. Prior to an encryption device utilizing a deterministic algorithm to generate the encryption key, multiple random numbers may be obtained from different entropy sources—at least one of which is internal to the encryption device and at least one of which is external to the encryption device. The encryption device combines the multiple random numbers into a combined entropy input that cannot be determined from either one of the random numbers alone. This combined entropy input is then utilized to generate the encryption key that is ultimately used to perform the device-internal encryption.

Abstract: A method including determining, by a user device, an assigned key pair including an assigned public key and an associated assigned private key; determining, for content to be encrypted, an access key pair including an access public key and an associated access private key; encrypting the access private key by utilizing the assigned public key; encrypting a randomly generated key by utilizing the access public key; and encrypting content utilizing the randomly generated key. Various other aspects are contemplated.

Abstract: A module such as an M2M device or a mobile phone can include a removable data storage unit. The removable data storage unit can include a nonvolatile memory, a noise amplifying memory, and a cryptographic unit. The nonvolatile memory can include (i) shared memory for access by both the module and the cryptographic unit, and (ii) protected memory accessible only by the cryptographic unit. The cryptographic unit can use a noise memory interface and noise amplifying operations in order to increase and distribute bit errors recorded in the noise amplifying memory. The cryptographic unit can (i) generate a random number using the noise amplifying memory and (ii) input the random number into a set of cryptographic algorithms in order to internally derive a PKI key pair. The private key can be recorded in protected memory and the public key signed by a certificate authority.

Abstract: Multiple systems, methods, and computer program product embodiments for password-less authentication using key agreement and multi-party computation (MPC). In one or more embodiments, following an authentication request received by a host computing device, the host computing device and a user computing device generate a shared key using a key agreement algorithm. Then, the host computing device generates a challenge that is encrypted using the shared key and transmitted to the user computing device. The user computing device decrypts the challenge after regenerating the shared key and sends the decrypted result to the host computing device as the challenge response. The authentication request is granted by the host computing device if the challenge and the challenge response match. New keys and a new challenge are generated for each authentication request. This process relies on public key cryptography eliminating the needs for passwords.

Abstract: A method including determining an assigned key pair associated with a device, the assigned key pair including an assigned public key and an associated assigned private key; determining an access key pair associated with content to be encrypted, the access key pair including an access public key and an associated access private key; encrypting the access private key using a combination encryption key determined based at least in part on the access private key and the assigned public key; encrypting a randomly generated key by utilizing the access public key; and encrypting the content utilizing the randomly generated key. Various other aspects are contemplated.

Abstract: The present disclosure relates to implementations of physically unclonable functions (PUFs) for cryptographic and authentication purposes. Specifically, the disclosure describes implementations of systems using PUFs that may replace existing public key infrastructures (PKIs).

Abstract: A device for generating a key has a multimode interferometer which can be coupled to a light source and has a light path having an electro-optical material, the light path being configured to obtain light at an input side, influence the light under the influence of a locally varying refraction index of the electro-optical material and provide influenced light at an output side. The device has a receiver configured to receive the influenced light at the output side, and has an evaluator configured to perform an evaluation based on the influenced light and to generate the key based on the evaluation.

Abstract: A method for space time region based communications in a data communication network is disclosed. The method includes performing an initial assignment of bubble data, the bubble data including a bubble spatio temporal information data representing a volume of space time, the bubble data further including a content data thereby assigned to the spatio temporal information data; providing a spatio temporal coordinate data associated with at least one user of the data communication network, determining if the spatio temporal coordinate data is deemed to be within the volume of space time represented by the bubble spatio temporal information data, and granting access to the content data to the at least one user of the data communication network if the spatio temporal coordinate data is determined to be deemed to be within the volume of space time represented by the bubble spatio temporal information data.

Abstract: A unique hardware key is recorded a secure hardware environment. A first logic circuit of the secure hardware environment is configured to generate a unique derived key from said unique hardware key and at least one piece of information. The at least one piece of information relates to one or more of an execution context and a use of a secret key. The secure hardware environment further includes a first encryption device that performs a symmetric encryption of the secret key using the unique derived key. This symmetric encryption generates an encrypted secret key for use outside of the secure hardware environment.

Abstract: Methods of quantum key distribution include receiving a frequency bin photon at a location, selecting a frequency bin photon quantum key distribution measurement basis, with a quantum frequency processor, performing a measurement basis transformation on the received frequency bin photon so that the frequency bin photon is measurable in the selected frequency bin photon quantum key distribution measurement basis, and detecting the frequency bin photon in the selected quantum key distribution measurement basis and assigning a quantum key distribution key value based on the detection to a portion of a quantum key distribution key. Apparatus and methods for encoding, decoding, transmitting, and receiving frequency bin photons are disclosed.

Abstract: Systems, devices, and methods are disclosed for exchanging electronic information over a communication network and, more specifically, to authenticating and verifying data integrity between two or more interacting users exchanging information. A client computing device generates a split secret that is transmitted to a server via two distinct communication channels. The split secret is generated based on a public key of a public-private key pair generated by the client computing device based on a unique identifier. Validity of the public key can authenticate source identity.

Abstract: A security device and an operating method thereof, which generate masking data for masking a key on the basis of a physically unclonable function (PUF), are provided. The security device includes a PUF circuit including a plurality of PUF cells outputting random key data and masking data, a key generator configured to generate a key through post-processing performed on the random key data, and a masking module configured to mask and store the key by using the masking data, wherein the random key data and the masking data are generated by different PUF cells.

Abstract: A method for cryptographic key management for managing access control is provided. A key is divided into a plurality of portions of the key. Pre-encryption contextual data is received for each of a plurality of devices. The pre-encryption contextual data indicates at least one attribute of a respective device of the plurality of devices before an encryption of the plurality of portions of the key is performed. The plurality of portions of the key are encrypted based at least on the pre-encryption contextual data of the plurality of devices to make the plurality of the portions of the key dependent at least on contextual data corresponding pre-encryption contextual data. Each of the plurality of encrypted portions of the key is distributed to a respective device of the plurality of devices for storage and retrieval.

Abstract: A method including determining an assigned key pair associated with a device, the assigned key pair including an assigned public key and an associated assigned private key; determining an access key pair associated with content to be encrypted, the access key pair including an access public key and an associated access private key; encrypting the access private key using a combination encryption key determined based at least in part on the access private key and the assigned public key; encrypting a randomly generated key by utilizing the access public key; and encrypting the content utilizing the randomly generated key. Various other aspects are contemplated.

Abstract: When it comes to monitoring human health, today's consumers are limited to so called “health trackers,” which count steps and calculate calorie burns. Traditional health trackers are only capable of measuring heart rate and are limited to external measurements. These devices are not capable of obtaining the internal body data and do not have access to human fluids. The personal health shield personal cloud case cover (or “health PCCC”) can not only analyze human fluids but also fluids being consumed by the user (food and drinks). The data collected from the fluids is then compared to a cloud or local data base. The results are displayed on a phone, tablet, personal computers, television, or any other device either mounted in the PCCC or connected to the health PCCC.

Abstract: Disclosed is a system, method, and computer program product for determining solvency of a digital asset exchange system. The method includes identifying a plurality of blockchain addresses corresponding to a plurality of users of the digital asset exchange system, generating a first commitment to an amount of digital assets corresponding to the plurality of blockchain addresses, generating a second commitment to a balance of each user of the plurality of users, generating a first component of a zero-knowledge algorithm configured to receive, as input, the first commitment, and to output a value generated based on each public key, generating a second component of the zero-knowledge algorithm configured to receive, as input, the second commitment, and to output a value generated based on each user balance, and determining, with at least one processor, that the digital asset exchange system is solvent based on the zero-knowledge algorithm.

Abstract: A processor-implemented encryption method using homomorphic encryption includes: receiving data; generating a ciphertext by encrypting the received data; determining a coefficient of an approximating polynomial for performing a modular reduction on a modulus corresponding to the ciphertext, based on an error between the approximating polynomial and a modular reduction function; and performing bootstrapping on the ciphertext by performing the modular reduction based on the determined coefficient of the approximating polynomial.

Abstract: Embodiments may be generally directed to techniques to encrypt and decrypt data in a first fuse block array using an encryption key of a second fuse block array, the second fuse block array having the encryption key comprising a plurality of segments of bits, an inverse encryption key comprising a second plurality of segments of bits, each segment of the inverse encryption key to correspond with a particular segment of the encryption key, and a random pattern having equally distributed bit values, the random pattern to enable detection of voltage attacks on the second fuse block array.

Abstract: A system for generating a blockchain including an input for receiving a plurality of groups of data. Blockchain processing circuitry generates the blockchain for the plurality of groups of data. The blockchain processing circuitry generates the blockchain by performing a first hash using the first group of data and a first nonce as an input to a hash function to generate a first digital signature for a first block, wherein the hash function uses encryption based on quantum key distribution and orbital angular momentum. The blockchain processing circuitry establishes the first block of the blockchain using the first group of data, the first nonce and the first digital signature.

Abstract: A method and system are provided for updating an elliptic curve (EC) base point G, with the EC basepoint used in encryption and coding of video data. A candidate base point G is generated that includes additional data used for validation purposes and checked as a valid base point before transmission and use.

Abstract: A system and method of secure communication between computing devices based on physical unclonable functions such as memories having dissolvable conductive paths is provided. The method involves enrolling a client device, the client device having a PUF such as a pristine ReRAM. The PUF is enrolled in a secure environment by reading and storing the resistances of the PUF's addressable memory cells. The cells are categorized into “rugged” and “vulnerable” categories on the basis of their resistance, the vulnerable cells being those more likely to be permanently altered during the generations of PUF responses. The rugged cells are used for the generation of PUF responses for cryptographic key generation, but the vulnerable cells may be inspected to detect unauthorized 3rd party access to the PUF.

Abstract: Disclosed is a method of verifying integrity of a pair of public and private cryptographic keys within the additive group of the integers modulo N, with N being the product of two primary numbers p and q, the method including: calculating a candidate private exponent d? corresponding to a private exponent d of the private key; and executing a test of integrity. The test of integrity includes a step for verifying the coherence of the candidate private exponent d? with respect to a public exponent e of the public key and to the numbers p and q, the verification step involving a first multiple modulo of the public exponent e of the public key and a second multiple modulo of the public exponent e of the public key.

Abstract: According to one perspective, the invention provides a technical arrangement to calculate, register and/or apportion costs and/or generate income in proportion to the current ownership of an asset. One or more embodiments also comprise a novel technique for generating cryptographic sub-keys. Thus, one benefit provided by the invention is that it allows the secure distribution of costs and income for an asset registered and maintained on the Blockchain. In turn, this increases the capability of such assets to meet the real-world needs of various entities such as the asset itself and investing parties.

Abstract: Methods and systems for dynamic wireless network configuration are provided. Aspects include receiving, by an application on a user device, a token, deriving, by the application, a unique identifier and passcode based at least in part on the token, and controlling remote access to a first computer system based on the unique identifier and passcode.

Abstract: This disclosure relates to a data storage device. A data port transmits data between a host computer system and the data storage device over a data channel. The device repeatedly broadcasts advertising packets over a wireless communication channel different from the data channel. Each advertising packet comprises a random value and a message authentication code calculated based on the random value and an identity key. The identity key is readable by a device to be connected and in proximity of the data storage device out of band of the data channel and the communication channel. The identity key enables the device to be connected to verify the message authentication code based on the random value and the identity key to thereby authenticate the data storage device.

Abstract: A processor comprises a first register to store an encoded pointer to a memory location. First context information is stored in first bits of the encoded pointer and a slice of a linear address of the memory location is stored in second bits of the encoded pointer. The processor also includes circuitry to execute a memory access instruction to obtain a physical address of the memory location, access encrypted data at the memory location, derive a first tweak based at least in part on the encoded pointer, and generate a keystream based on the first tweak and a key. The circuitry is to further execute the memory access instruction to store state information associated with memory access instruction in a first buffer, and to decrypt the encrypted data based on the keystream. The keystream is to be generated at least partly in parallel with accessing the encrypted data.