Abstract: A dummy write operation is disclosed that mimics an actual write operation to a memory array. In some implementations, a dummy write operation mimics an actual write operation by starting a charge pump, selecting a correct data line in the memory array, and by following the sequencing of an actual write operation. By mimicking an actual write operation, an attacker cannot use power analysis to distinguish between dummy and actual write operations. For example, PIN comparison operations would present the same or substantially the same power trace for both positive and negative comparisons, making it difficult for an attacker to determine if a retry count was written to NVM.

Abstract: A method including monitoring whether an externally originating signal reaches a predetermined threshold value in a host, producing an output value based on the monitoring, and identifying a power environment for the host based on the output value is described. Also described is a method for determining the power environment of a host. Systems and hosts for implementing the methods are also described.

Abstract: A microcontroller system, such as a system-on-a-chip integrated circuit, including a processor (e.g., a Von Neumann processor), memory, and a memory protection unit (MPU), where the MPU provides execute-only access rights for one or more protected areas of the memory. The MPU can allow instructions fetched from within a protected area to access data in the protected area while preventing instructions fetched from outside the protected area from accessing data in the protected area.

Abstract: An apparatus includes a first interface having a communication channel through which data is transmitted to or received from a target device and a first control register that is configured to control, based at least in part on its contents, transmission or reception of data through the communication channel. The apparatus also includes a second interface having a second control register that is configured to control, based at least in part on its contents, transmission or reception of data through the communication channel. A circuit in the apparatus harmonizes the contents of the first control register and the second control register, such that an external controller can control transmission or reception of data through the communication channel by providing control data in a first format to the first control register or by providing alternate control data in a second different format to the second control register.

Abstract: A multi-interface integrated circuit (IC) comprises a plurality of transistors, and a level detection block. At least one transistor of the plurality of transistors is in communication with a first terminal and either a first or a second lead of the multi-interface IC, and at least one of the plurality of transistors is in communication with the first terminal, a second terminal and either the first or a second lead of the multi-interface IC. The level detection block is in communication with at least one of the plurality of transistors and the first and second leads.

Abstract: A microcontroller system, such as a system-on-a-chip integrated circuit, including a processor (e.g., a Von Neumann processor), memory, and a memory protection unit (MPU), where the MPU provides execute-only access rights for one or more protected areas of the memory. The MPU can allow instructions fetched from within a protected area to access data in the protected area while preventing instructions fetched from outside the protected area from accessing data in the protected area.

Abstract: A cryptographically secure, computer hardware-implemented binary finite-field polynomial modular reduction method estimates and randomizes a polynomial quotient used for computation of a polynomial remainder. The randomizing error injected into the approximate polynomial quotient is limited to a few bits, e.g. less than half a word. The computed polynomial remainder is congruent with but a small random multiple of the residue, which can be found by a final strict binary field reduction by the modulus. In addition to a computational unit and operations sequencer, the computing hardware also includes a random or pseudo-random number generator for producing the random polynomial error. The modular reduction method thus resists hardware cryptoanalysis attacks, such as timing and power analysis attacks.

Abstract: In some implementations, a mobile device includes a first interface configured to communicably couple to a removable integrated circuit card; a second interface configured to wirelessly communicate with a contactless reader that is external to the mobile device; a communication interface that couples the first interface and the second interface and that is configured to obtain information from an integrated circuit card that is coupled to the first interface in response to receipt by the second interface of an information request from the contactless reader; and a programmable timer that is configured to be started in response to the second interface receiving an information request from the contactless reader, and that is further configured to, upon reaching a programmed value, cause the second interface to transmit the obtained information to the contactless reader.

Abstract: A deterministic blinding method for cipher algorithms that employ key-mixing and substitution (S-box) operations uses a masking table constructed with a true mask and a plurality of dummy masks corresponding to every possible S-box input. Each mask is applied in the key-mixing operation (e.g., bitwise XOR) to the cipher key or to round subkeys to generate true and dummy keys or subkeys that are applied to the data blocks within the overall cipher algorithm or within individual cipher rounds. The mask values prevent side-channel statistical analyses from determining the true from the dummy keys or subkeys. The true mask is identifiable to the cipher but not by external observers.

Abstract: A method of protecting secret key integrity in a hardware cryptographic system includes first obtaining an encryption result and corresponding checksum of known data using the secret key, saving those results, then masking the secret key and storing the masked key. When the masked key is to be used in a cryptographic application, the method checks key integrity against fault attacks by decrypting the prior encryption results using the masked key. If upon comparison, the decryption result equals valid data, then the key's use in the cryptographic system can proceed. Otherwise, all data relating to the masked key is wiped from the system and fault injection is flagged.

Abstract: A method and system for monitoring a frequency of a clock signal is disclosed. The method and system comprise dividing a clock signal into a plurality of clock signal components. The method and system further comprise adding a delay to each of the clock signal components and comparing the plurality of signal components with each of the delayed clock signal components to monitor whether the clock signal is within a predetermined frequency range. The method and system includes providing an output signal indicative of a condition of the clock signal based upon the comparing step.

Abstract: Methods, systems, IC packages, and electrical devices for providing data security for ICs. A substrate-on-substrate connector grid array package with an electrical shield can protect sensitive information in a secure IC from being accessed by physical attacks. A current flow in the electrical shield can be monitored for disturbances which can indicate an attack on the IC package.

Abstract: A cryptographically secure, computer hardware-implemented modular reduction method systematically underestimates and randomizes an approximate quotient used for computation of a remainder. The randomizing error injected into the approximate quotient is limited to a few bits, e.g. less than half a word. The computed remainder is congruent with but a small random multiple of the residue, which can be found by a final set of subtractions by the modulus. In addition to a computational unit and operations sequencer, the computing hardware also includes a random or pseudo-random number generator for producing the random error. The modular reduction method thus resists hardware cryptoanalysis attacks, such as timing and power analysis attacks.

Abstract: A cryptographically secure, computer hardware-implemented binary finite-field polynomial modular reduction method estimates and randomizes a polynomial quotient used for computation of a polynomial remainder. The randomizing error injected into the approximate polynomial quotient is limited to a few bits, e.g. less than half a word. The computed polynomial remainder is congruent with but a small random multiple of the residue, which can be found by a final strict binary field reduction by the modulus. In addition to a computational unit and operations sequencer, the computing hardware also includes a random or pseudo-random number generator for producing the random polynomial error. The modular reduction method thus resists hardware cryptoanalysis attacks, such as timing and power analysis attacks.

Abstract: Techniques for coding and decoding redundant coding for column defects cartography. Defective cell groups identified in a memory array are redundantly encoded with a different bit pattern than the bit pattern used for functional cell groups. The identified defective cell groups are repaired using redundant cell groups in the memory array. The defective cell groups are later re-identified by checking the redundant bit pattern encoded in the cell groups. If new defective cell groups are identified, the memory array is identified as failing. If no new defective cell groups are identified, the memory array is identified as passing, and the identified defective cell groups are repaired.

Abstract: A processor-executed computational method especially for use in cryptographic systems quickly determines a polynomial quotient under specific conditions. For a polynomial modulus f(x), a maximum degree for a polynomial i(x) to be reduced by this method is defined as the sum of the degree of f(x) and the difference d between the degrees of the two highest degree coefficients of f(x). Polynomials i(x) with degree less than this maximum can be divided by a^[deg(f(x))] instead of the full f(x) to quickly obtain the quotient value. With this quotient a residue value can be obtained, or optionally a random congruent value.