Abstract: A method comprises receiving an image of an update for a software module, a rate parameter, an index parameter, and a public key, generating a 32-byte aligned string, computing a state parameter using the 32-byte aligned string, generating a modified message representative, computing a Merkle Tree root node, and in response to a determination that the Merkle Tree root node matches the public key, forwarding, to a remote device, the image of the update for a software module, the state parameter; and the modified message representative.

Abstract: Time recovery techniques are described. A method comprises receiving messages from the first device by the second device in the first network domain, the messages to comprise time information to synchronize a first clock for the first device and a second clock for the second device to a network time, determining the second clock is to recover the network time for the second device without new messages from the first device, retrieving a first set of timestamps previously stored for events in the first network domain using the network time from the second clock, retrieving a second set of timestamps previously stored for the events in the first network domain using a redundant time from a third clock, where the third clock is not synchronized with the first and second clocks, and recovering the network time using a regression model and the redundant time from the third clock.

Abstract: Systems, apparatuses, and methods to identify an electronic control unit transmitting a message on a communication bus, such as an in-vehicle network bus, are provided. ECUs transmit messages by manipulating voltage on conductive lines of the bus. Observation circuitry can observe voltage signals associated with the transmission at a point on the in-vehicle network bus. A distribution can be generated from densities of the voltage signals. ECUs can be identified and/or fingerprinted based on the distributions.

Abstract: Techniques to secure a time sensitive network are described. An apparatus may establish a data stream between a first device and a second device in a network domain, the network domain includes a plurality of switching nodes, receive messages from the first device by the second device in the network domain, the messages to comprise time information to synchronize a first clock for the first device and a second clock for the second device to a network time for the network domain, update a correction field for a received message with a residence time and time delay value by the second device, determine whether the updated message is benign or malicious, update the correction field for the updated message with an inference time when the updated message is benign, and prevent relay of the updated message to other devices in the network domain when the updated message is malicious.

Abstract: Techniques are described for an instruction for a conditional rotate and XOR operation in a single instruction and triple input bitwise logical operations in a single instruction in an instruction set of a computing system.

Abstract: Systems and methods to detect attacks on the clocks of devices. In time sensitive networks are described. Particularly, the disclosed systems and methods provide detection and mitigation of timing synchronization attacks based on key performance indicators related to the protecting transmission windows in data streams of the time sensitive networks.

Abstract: Key encapsulation implemented by random sample generator circuitry to generate a plurality of pseudorandom bitstreams; polynomial multiplier circuitry to multiply a plurality of polynomial coefficients; and a controller to power off the polynomial multiplier circuitry and power on the random sample generator circuitry to generate the plurality of pseudorandom bitstreams, and power off the random sample generator circuitry and power on the polynomial multiplier circuitry to multiple the plurality of polynomial coefficients.

Abstract: Techniques are described for an instruction for a conditional rotate and XOR operation in a single instruction and triple input bitwise logical operations in a single instruction in an instruction set of a computing system.

Abstract: Techniques include a method, apparatus, system and computer-readable medium to detect, quantify and localize attacks to enhance security for time-synchronized networking. Embodiments include a diagnostic stream producer to produce diagnostic information providing evidence of a timing attack on a node of a time-synchronized network. Embodiments include a diagnostic stream consumer to consume diagnostic information, analyze the diagnostic information, and determine whether a node is under a timing attack. Other embodiments are described and claimed.

Abstract: An apparatus comprises an input register comprising an input polynomial, a processing datapath communicatively coupled to the input register comprising a plurality of compute nodes to perform a number theoretic transform (NTT) algorithm on the input polynomial to generate an output polynomial in NTT format. The plurality of compute nodes comprises at least a first butterfly circuit to perform a series of butterfly calculations on input data and a randomizing circuitry to randomize an order of the series of butterfly calculations.

Abstract: Systems, apparatuses, and methods to identify an electronic control unit transmitting a message on a communication bus, such as an in-vehicle network bus, are provided. ECUs transmit messages by manipulating voltage on conductive lines of the bus. Observation circuitry can observe voltage transitions associated with the transmission at a point on the in-vehicle network bus. A domain bitmap can be generated from the observed voltage transitions. ECUs can be identified and/or fingerprinted based on the domain bitmaps.

Abstract: Systems, apparatuses, and methods to response to distinguish a ghost target from an actual target based on radar signals is provided. In particular, the disclosure provides an intrusion detection system adapted to receive radar signals and distinguish a potential ghost target from a legitimate target based on a signal to noise ratio of the radar signals and a range to the ghost target and the legitimate target.

Abstract: Techniques and screening messages based on tags in an automotive environment, such as, messages communicated via a communication bus, like the CAN bus. Messages can be tagged with either a binary or probabilistic tag indicating whether the message is fraudulent. ECUs coupled to the CAN bus can receive the messages and the message tags and can determine whether to fully consume the message based on the tag.

Abstract: Embodiments are directed to a digital signature verification engine for reconfigurable circuit devices. An embodiment of an apparatus includes one or more processors; and a reconfigurable circuit device, the reconfigurable circuit device including digital signal processing (DSP) blocks and logic elements (LEs), wherein the one or more processors are to configure the reconfigurable circuit device to operate as a signature verification engine for a bit stream, the signature verification engine including a hybrid multiplication unit, the hybrid multiplication unit combining a set of LEs and a set of the DSPs to multiply operands for signature verification.

Abstract: Logic may implement observation layer intrusion detection systems (IDSs) to combine observations by intrusion detectors and/or other intrusion detection systems. Logic may monitor one or more control units at one or more observation layers of an in-vehicle network, each of the one or more control units to perform a vehicle function. Logic may combine observations of the one or more control units at the one or more observation layers. Logic may determine, based on a combination of the observations, that one or more of the observations represent an intrusion. Logic may determine, based at least on the observations, characteristics of an attack, and to pass the characteristics of the attack information to a forensic logging system to log the attack or pass the characteristics of the attack to a recovery system for informed selection of recovery procedures. Logic may dynamically adjust a threshold for detection of suspicious activity.

Abstract: Systems and methods to detect attacks on the clocks of devices in time sensitive networks are described. Particularly, the disclosed systems and methods provide detection and mitigation of timing synchronization attacks based on pseudo-random numbers generated and used to select and authenticate timing of transmission of messages in protected transmission windows.

Abstract: Techniques include receiving a message with time information from a clock leader by a clock follower in a time-synchronized network (TSN), the time information to synchronize a clock to a network time for the TSN, retrieving an actual time offset value for the message, the actual time offset value to comprise a value between an actual sending time and an actual receiving time of the message, retrieving an estimated time offset value for the message, the estimated time offset value to comprise a value between an estimated sending time and an estimated receiving time of the message, the estimated time offset value generated using a physics-aware model of the TSN and a clock adjustment value for the clock based on the time information, and determining whether the time information for the message was modified to cause the clock to desynchronize based on difference information. Other embodiments are described and claimed.

Abstract: Techniques include receiving a message with time information at an ingress queue for an ingress interface of an intrusion detection system (IDS), the IDS to monitor a network node of a time-synchronized network (TSN), generating an entrance timestamp for the message, the entrance timestamp to comprise a time value representing when the message is received at the ingress queue of the ingress interface of the IDS, inspecting the message for indications of a security attack by the IDS, generating an exit timestamp for the message, the exit timestamp to comprise a time value representing when the message is received at an egress queue of an egress interface of the IDS, and generating an inspection time interval associated with the IDS, the inspection time interval to represent a time interval between the entrance timestamp and the exit timestamp for the message while transiting the IDS. Other embodiments are described and claimed.

Abstract: A method comprises fetching, by fetch circuitry, an encoded XOR3P instruction comprising at least one opcode, a first source identifier to identify a first register, a second source identifier to identify a second register, a third source identifier to identifier a third register, and a fourth source identifier to identify a fourth operand, wherein the first register is to store a first value, the second register is to store a second value, and the third register is to store a third value, decoding, by decode circuitry, the encoded XOR3P instruction to generate a decoded XOR3P instruction, and executing, by execution circuitry, to execute the decoded XOR3P instruction to perform a rotate operation on the third value based on the fourth operand to generate a rotated third value, perform an XOR operation on the first value, the second value, and the rotated third value to generate an XOR result, perform a rotate operation on the XOR result based on the fourth operand to generate a rotated XOR, and store the rot

Abstract: A method comprises fetching, by fetch circuitry, an encoded XOR3P instruction comprising at least one opcode, a first source identifier to identify a first register, a second source identifier to identify a second register, a third source identifier to identifier a third register, and a fourth source identifier to identify a fourth operand, wherein the first register is to store a first value, the second register is to store a second value, and the third register is to store a third value, decoding, by decode circuitry, the encoded XOR3P instruction to generate a decoded XOR3P instruction, and executing, by execution circuitry, to execute the decoded XOR3P instruction to perform a rotate operation on the third value based on the fourth operand to generate a rotated third value, perform an XOR operation on the first value, the second value, and the rotated third value to generate an XOR result, perform a rotate operation on the XOR result based on the fourth operand to generate a rotated XOR, and store the rot