Abstract: Systems and techniques are provided for security. For instance, a process can include receiving, by a first process executing in a trusted execution environment, sensor information from a sensor based on an acquisition request transmitted to the sensor; processing, by the first process, the sensor information to generate a first hash of the sensor information; transmitting the first hash of the sensor information to a second process executing in a secure execution environment separate from the trusted execution environment for comparison with a second hash of the sensor information from the sensor; and receiving, from the second process, an indication that the first hash matches the second hash.

Abstract: Systems and techniques are provided for high assurance use cases. For instance, a process can include transmitting, to a secure element, a request to access an applet of the secure element based on a request received from an application executing within a high-level operating system (OS); receiving, from the secure element, a request to retrieve the applet from a portion of a first memory system; retrieving the applet from the first memory system; and providing the applet to the secure element for storage and execution within the secure element.

Abstract: Systems and techniques are provided for biometric security. For instance, a process can include generating, using a first biometric process executing in a trusted execution environment, a biometric template based on received first biometric information; generating a mask using a second biometric process executing in a secure execution environment separate from the trusted execution environment; transmitting the template to the second biometric process; applying the mask, by the second biometric process, to the biometric template to generate a masked template; and storing the masked template in a memory by the second biometric process.

Abstract: The disclosure relates to a method of obtaining a cryptographic key in a chipset (1). An initial configuration message may be generated using a physical unclonable function (hereinafter: PUF) (22) of the chipset (1). Said PUF (22) may generate a predetermined value when using the initial configuration message as input to the PUF (22). The initial configuration message may be transmitted to a client access server (31). An altered configuration message may be received from the client access server (31), wherein the altered configuration message is generated by the client access server (31) based on the initial configuration message. The cryptographic key may be obtained from the PUF (22) using the altered configuration message as input to the PUF (22).

Abstract: Systems and techniques are provided for secure computing. For instances, a process can include generating a master private key; generating a set of first dummy values; dividing the master private key into a first set of shares, wherein a sum of shares of the first set of shares equals a value of the master private key; initiating portions of an active memory bank with a sequence of integer modular additions, wherein the integer modular additions comprise: masking the first set of shares of the master private key; and adding the masked first set of shares of the master private key to portions of the active memory bank using a sequence of adds that adds and mixes the masked first set of shares of the master private key with dummy values.

Abstract: A device for generating at least one cryptographic key by selecting at least three input data selected among, on one hand, a predetermined data and, on the other hand, a function of at least one piece of data having a type belonging to the group including: a physical unclonable type, corresponding to physical unclonable function data, a hardwired type, corresponding to data hardwired within said device, and a software type, corresponding to software data, assembling the at least three input data to produce an assembled input data, and applying the assembled input data into a cryptographic element to produce a cryptographic key.

Abstract: Systems and techniques are provided for secure computing. For instances, a process can include generating a master private key; generating a set of first dummy values; dividing the master private key into a first set of shares, wherein a sum of shares of the first set of shares equals a value of the master private key; initiating portions of an active memory bank with a sequence of integer modular additions, wherein the integer modular additions comprise: masking the first set of shares of the master private key; and adding the masked first set of shares of the master private key to portions of the active memory bank using a sequence of adds that adds and mixes the masked first set of shares of the master private key with dummy values.

Abstract: A pairing method between a user device (1) and an operator device (2), the user device (1) being intended to receive conditional access data from the operator device (2), the user device having a user device identifier (UID), the operator having an operator device identifier (OID). The method comprises receiving, by the user device, a user device key (KUID) derived from a first cryptographically secure function and receiving, by the operator device, an operator key (KOID) derived from a second cryptographically secure function. The user device comprises a user device bilinear mathematical function (e(KUID, OID)) and the operator device comprises an operator bilinear mathematical function (e(UID, KOID)) which each define a pairing over an elliptic curve.

Abstract: Systems and techniques are provided for generating cryptographic keys. For instance, a process may include generating a plurality of master keys based on a plurality of generated random numbers, a second number, and a nonce number; storing a master key, of the plurality of master keys, along with a generated random number of the plurality of generated random numbers, the second number, and the nonce number used to generate the master key in a one-time programmable memory; generating public key-private key pairs for the plurality of master keys; transmitting public keys of the plurality of public key-private key pairs for audit; destroying an audited master key, along with the generated random number, second number, and the nonce number used to generate the audited master key, based on the audit; and storing a non-audited public key-private key pair corresponding to the master key that were not destroyed based on the audit.

Abstract: Systems and techniques are provided for generating cryptographic keys. For instance, a process may include generating a plurality of master keys based on a plurality of generated random numbers, a second number, and a nonce number; storing a master key, of the plurality of master keys, along with a generated random number of the plurality of generated random numbers, the second number, and the nonce number used to generate the master key in a one-time programmable memory; generating public key-private key pairs for the plurality of master keys; transmitting public keys of the plurality of public key-private key pairs for audit; destroying an audited master key, along with the generated random number, second number, and the nonce number used to generate the audited master key, based on the audit; and storing a non-audited public key-private key pair corresponding to the master key that were not destroyed based on the audit.

Abstract: Systems and techniques are provided for secure processing. For instance, a process can include receiving an indication to perform a secure process; determining, based on the indication to perform the secure process, to shut down a hardware component; transmitting, to the hardware component, an indication to shut down; receiving, from the hardware component, an indication that the hardware component has been shut down; monitoring a signal connection for perturbation signals, wherein the signal connection carries the perturbation signals, and wherein the perturbation signals comprise hardware signals; and performing the secure process based on the monitored signal connection.

Abstract: A pairing method between a user device (1) and an operator device (2), the user device (1) being intended to receive conditional access data from the operator device (2), the user device having a user device identifier (UID), the operator having an operator device identifier (OID). The method comprises receiving, by the user device, a user device key (KUID) derived from a first cryptographically secure function and receiving, by the operator device, an operator key (KOID) derived from a second cryptographically secure function. The user device comprises a user device bilinear mathematical function (e(KUID, OID)) and the operator device comprises an operator bilinear mathematical function (e(UID, KOID)) which each define a pairing over an elliptic curve.

Abstract: The disclosure relates to a method of obtaining a cryptographic key in a chipset (1). An initial configuration message may be generated using a physical unclonable function (hereinafter: PUF) (22) of the chipset (1). Said PUF (22) may generate a predetermined value when using the initial configuration message as input to the PUF (22). The initial configuration message may be transmitted to a client access server (31). An altered configuration message may be received from the client access server (31), wherein the altered configuration message is generated by the client access server (31) based on the initial configuration message. The cryptographic key may be obtained from the PUF (22) using the altered configuration message as input to the PUF (22).

Abstract: The disclosure relates to a method of obtaining a cryptographic key in a chipset (1). An initial configuration message may be generated using a physical unclonable function (hereinafter: PUF) (22) of the chipset (1). Said PUF (22) may generate a predetermined value when using the initial configuration message as input to the PUF (22). The initial configuration message may be transmitted to a client access server (31). An altered configuration message may be received from the client access server (31), wherein the altered configuration message is generated by the client access server (31) based on the initial configuration message. The cryptographic key may be obtained from the PUF (22) using the altered configuration message as input to the PUF (22).

Abstract: A method of programming a device comprising acquiring configuration data, loading the configuration data onto a programmable device, processing at least a portion of the configuration data through a one way function to form processed configuration data, and configuring at least one configurable module of the programmable device using the processed configuration data from the processing step.

Abstract: The disclosure relates to a method for enabling the secure functions of a chipset (1) and especially the encryption of the content of the secure memory (7) when the device goes into low power mode. The content of the secure memory (7) may be encrypted and stored in an external memory (20) during low power mode of the chipset (1).

Abstract: A device for generating at least one cryptographic key by selecting at least three input data selected among, on one hand, a predetermined data and, on the other hand, a function of at least one piece of data having a type belonging to the group including: a physical unclonable type, corresponding to physical unclonable function data, a hardwired type, corresponding to data hardwired within said device, and a software type, corresponding to software data, assembling the at least three input data to produce an assembled input data, and applying the assembled input data into a cryptographic element to produce a cryptographic key.

Abstract: The disclosure relates to a method for enabling the secure functions of a chipset (1) and especially the encryption of the content of the secure memory (7) when the device goes into low power mode. The content of the secure memory (7) may be encrypted and stored in an external memory (20) during low power mode of the chipset (1).

Abstract: A method for remotely programming a programmable device designed to provide an expected sensitive result. The method including transmitting a first program code to the programmable device, the first program code being configured to get at least one distinctive data unique and physically inherent to the programmable device, retrieving the distinctive data, and transmitting a second program code based on the retrieved distinctive data to the programmable device, so as to load the second program code into the programmable device.

Abstract: System and method for establishing secure conference calls. In one example system, a central conference call server establishes point-to-point connections with accessory devices comprising a secure element and connected to corresponding participant devices. The conference call server includes an interface to a plurality of secure elements configured to perform scrambling and unscrambling of media signals communicated to and from the accessory devices. In another example, one of the participant devices operates as the central conference call server. In other examples, participant devices communicate on a conference call via point-to-point connections between all accessory devices connected to the participant devices. The accessory devices include secure elements for decryption and encryption of media signals communicated between the accessory devices.