Abstract: An apparatus includes an interface and a processor. The interface is configured for communicating over a bus. The processor is configured to disrupt on the bus a transaction in which a bus-master device attempts to access a peripheral device without authorization, by forcing one or more dummy values on at least one line of the bus in parallel to at least a part of the transaction.

Abstract: A security device includes an interface and a processor. The interface is configured for connecting to a bus that serves one or more peripheral devices. The bus includes (i) one or more dedicated signals that are each dedicated to a respective one of the peripheral devices, and (ii) one or more shared signals that are shared among the peripheral devices served by the bus. The processor is connected to the bus as an additional device in addition to the peripheral devices, and is configured to disrupt on the bus a transaction in which a bus-master device attempts to access a given peripheral device, by disrupting a dedicated signal associated with the given peripheral device.

Abstract: A method for data storage includes storing data in a set of memory blocks of a non-volatile memory. Each memory block, which holds a respective portion of the data, is classified as valid or invalid depending on whether the memory block holds a most updated version of the portion, and as anchor or non-anchor depending on whether the portion belongs to a coherent snapshot of the data. Upon recovering from a power interruption, the coherent snapshot of the data is reconstructed from the memory blocks, based on classification of the memory blocks as valid or invalid and as anchor or non-anchor.

Abstract: An apparatus for detecting fault injection includes functional circuitry and fault detection circuitry. The functional circuitry is configured to receive one or more functional input signals and to process the functional input signals so as to produce one or more functional output signals. The functional circuitry meets a stability condition that specifies that stability of a designated set of one or more of the functional input signals during a first time interval guarantees stability of a designated set of one or more of the functional output signals during a second time interval that is derived from the first time interval. The fault detection circuitry is configured to monitor the designated functional input and output signals, to evaluate the stability condition based on the monitored functional input and output signals, and to detect a fault injection attempt in response to detecting a deviation from the stability condition.

Abstract: A system for improving utilization of a nonvolatile flash memory device which has pages whose guaranteed per-cycle erase time and guaranteed number of cycles are known, the system comprising erase time determination functionality for individual pages; de-facto total erase-time accumulation functionality incrementing, for each erase cycle to which an individual page is subjected, by the individual page's de facto erase time per cycle as provided by the erase time measurement functionality; and flash memory page usage monitoring functionality operative to control usage of pages in flash memory including selecting at least one individual flash memory page depending on a comparison between the individual flash memory page's de facto total erase time and a guaranteed erase time computed as a product of the guaranteed per-cycle erase time and of the guaranteed number of cycles.

Abstract: An apparatus includes an interface and logic circuitry. The interface is configured to communicate over a communication link. The logic circuitry is configured to convert between a first stream of plaintext bits and a second stream of ciphered bits that are exchanged over the communication link, by applying a cascade of a stream ciphering operation and a mixing operation that cryptographically maps input bits to output bits.

Abstract: A computing device includes an input bridge, an output bridge, a processing core, and authentication logic. The input bridge is coupled to receive a sequence of data items for use by the device in execution of a program. The processing core is coupled to receive the data items from the input bridge and execute the program so as to cause the output bridge to output a signal in response to a given data item in the sequence, and the authentication logic is coupled to receive and authenticate the data items while the processing core executes the program, and to inhibit output of the signal by the output bridge until the given data item has been authenticated.

Abstract: An apparatus for detecting fault injection includes a high-fanout network, which spans an Integrated Circuit (IC), and circuitry. In some embodiments, the high-fanout network is continuously inactive during functional operation of the IC, and the circuitry is configured to sense signal levels at multiple sampling points in the high-fanout network, and to identify a fault injection attempt by detecting, based on the sensed signal levels, a signal abnormality in the high-fanout network. In some embodiments, the circuitry is configured to sense signal levels at multiple sampling points in the high-fanout network, to distinguish, based on the sensed signal levels, between legitimate signal variations and signal abnormalities in the high-fanout network during functional operation of the IC, and to identify a fault injection attempt by detecting a signal abnormality.

Abstract: An apparatus includes an interface and a processor. The interface is configured for communicating over a bus. The processor is configured to disrupt on the bus a transaction in which a bus-master device attempts to access a peripheral device without authorization, by forcing one or more dummy values on at least one line of the bus in parallel to at least a part of the transaction.

Abstract: An apparatus includes an interface and logic circuitry. The interface is configured to communicate over a communication link. The logic circuitry is configured to convert between a first stream of plaintext bits and a second stream of ciphered bits that are exchanged over the communication link, by applying a cascade of a stream ciphering operation and a mixing operation that cryptographically maps input bits to output bits.

Abstract: An apparatus includes an interface and logic circuitry. The interface is configured to communicate over a communication link. The logic circuitry is configured to convert between a first stream of plaintext bits and a second stream of ciphered bits that are exchanged over the communication link, by applying a cascade of a stream ciphering operation and a mixing operation that cryptographically maps input bits to output bits.

Abstract: A method for data storage includes storing data in a set of memory blocks of a non-volatile memory. Each memory block, which holds a respective portion of the data, is classified as valid or invalid depending on whether the memory block holds a most updated version of the portion, and as anchor or non-anchor depending on whether the portion belongs to a coherent snapshot of the data. Upon recovering from a power interruption, the coherent snapshot of the data is reconstructed from the memory blocks, based on classification of the memory blocks as valid or invalid and as anchor or non-anchor.

Abstract: An apparatus for detecting fault injection includes functional circuitry and fault detection circuitry. The functional circuitry is configured to receive one or more functional input signals and to process the functional input signals so as to produce one or more functional output signals. The functional circuitry meets a stability condition that specifies that stability of a designated set of one or more of the functional input signals during a first time interval guarantees stability of a designated set of one or more of the functional output signals during a second time interval that is derived from the first time interval. The fault detection circuitry is configured to monitor the designated functional input and output signals, to evaluate the stability condition based on the monitored functional input and output signals, and to detect a fault injection attempt in response to detecting a deviation from the stability condition.

Abstract: A method in a security device that provides a security service to a host includes receiving a security command from an application program running on the host. The security command is executed by accessing a Non-Volatile Memory (NVM) device external to the security device transparently to the application program via a dedicated device driver, which runs on the host and mediates between the NVM device and the security device.

Abstract: A touch sensing system comprising a set of touch surfaces in a touch panel including a population of touch surfaces; and at least one touch alert generator separately alerting for touch on each of, and both of, at least first and second touch surfaces from among the population of touch surfaces, wherein the alert generator is operative to determine capacitance of said first touch surface, determine touch object capacitance of said first and second touch surfaces, and compute a difference between the two capacitances, thereby to generate an approximation for touch object capacitance of said second touch surface.

Abstract: An apparatus for detecting fault injection includes a high-fanout network, which spans an Integrated Circuit (IC), and circuitry. In some embodiments, the high-fanout network is continuously inactive during functional operation of the IC, and the circuitry is configured to sense signal levels at multiple sampling points in the high-fanout network, and to identify a fault injection attempt by detecting, based on the sensed signal levels, a signal abnormality in the high-fanout network. In some embodiments, the circuitry is configured to sense signal levels at multiple sampling points in the high-fanout network, to distinguish, based on the sensed signal levels, between legitimate signal variations and signal abnormalities in the high-fanout network during functional operation of the IC, and to identify a fault injection attempt by detecting a signal abnormality.

Abstract: A multi touch sensing module comprising a plurality of electrically conductive touch surfaces, each connected to at least one trace, wherein the touch surfaces are arranged in more than two columns, each including more than two touch surfaces, wherein touch surfaces in corresponding positions in said columns form staggered rows, and all touch surfaces reside in a single layer of electrically conductive material.

Abstract: An apparatus includes an interface and logic circuitry. The interface is configured to communicate over a communication link. The logic circuitry is configured to convert between a first stream of plaintext bits and a second stream of ciphered bits that are exchanged over the communication link, by applying a cascade of a stream ciphering operation and a mixing operation that cryptographically maps input bits to output bits.

Abstract: Surface-capacitance-based multi-touch touch panel apparatus including a multiplicity of electrically conductive shapes e.g. diamonds arranged along at least one of rows and columns whose capacitance is measured by capacitive sensors; wherein the rows and columns include a set of linear arrays including at least one individual linear array which includes a plurality of first sets of shapes, each first set including n>=1 shapes all shorted to a single set-specific capacitive sensor such that no two first sets are both shorted to a common capacitive sensor.

Abstract: A computing device includes an input bridge, an output bridge, a processing core, and authentication logic. The input bridge is coupled to receive a sequence of data items for use by the device in execution of a program. The processing core is coupled to receive the data items from the input bridge and execute the program so as to cause the output bridge to output a signal in response to a given data item in the sequence, and the authentication logic is coupled to receive and authenticate the data items while the processing core executes the program, and to inhibit output of the signal by the output bridge until the given data item has been authenticated.