Abstract: Methods and systems for implementing one-time pad (OTP) encryption in industrial wireless instruments advantageously make use of data storage devices now available that can store a large number of encryption keys or pads in a small enough package to fit within an industrial wireless instrument. In some embodiments, the wireless instruments use solid-state memory devices that can easily hold a sufficient number of pads to last the expected lifetime of the wireless instruments. The solid-state memory devices are installed only during manufacturing of the wireless instruments where tamper-resistant manufacturing and assembly techniques may be used to ensure security for the pads. Likewise, the solid-state memory devices of the wireless instruments are also replaced or replenished only at an authorized manufacturer should additional pads be needed.

Abstract: To improve adaptation of network infrastructure to address rotations performed by wireless client device, embodiments provide for an exchange of a stable machine identifier (SMI) between a network access device and an authentication service. Some embodiments define a new SMI attribute that is included in a authentication service access-request and/or access-accept message. When a network access device obtains an SMI for a particular wireless client device, the network access device passes the SMI to the authentication service. Similarly, if an authentication service obtains a SMI value for a wireless client device, this information is provided to a network access device.

Abstract: A radio communication apparatus makes it possible to prevent contents of communication from being intercepted. The radio communication apparatus includes a generation unit configured to generate a first unique word based on operation time information of the radio communication apparatus before communication with a radio communication apparatus is started, and generate, for each radio frame, an ith unique word (i: an integer equal to or greater than two) based on an (i?1)th unique word when the communication is started, and a transmitting unit configured to transmit a first radio frame including the first unique word and an ith radio frame including the ith unique word to the radio communication apparatus.

Abstract: Techniques for protecting data using two password asymmetric encryption based on time-constrained password-based partner tokens. To encrypt data, a first partner computing device receives a first partner token from a second computing device. The first partner computing device decrypts the first partner token to recover first public key data generated by the second partner computing device. The first partner computing device derives a cryptographic encryption key to encrypt the data based on the first public key data, and based on first private key data generated by the first partner computing device. The second computing device may decrypt the encrypted data based on a second partner token generated by the first partner computing device, using a cryptographic decryption key derived using second private key data generated by the second computing device and second public key data generated by the first computing device and embedded and encrypted in the second partner token.

Abstract: An encryption interface provides secure, low-latency communications between processors. A first processor block transforms initial data into encrypted data using a cipher for receipt by a second processor block, which transforms the encrypted data into decrypted data. The first processor block utilized a crypto circuit having a plurality of stages, each of which generate a subset of a cipher digit stream for encrypting the data. The second processor block receives and decrypts the encrypted data using a respective decryption circuit.

Abstract: In accordance with some embodiments, an apparatus includes a crypto engine that provides device independent crypto services. The apparatus includes a housing arranged to hold a device. The apparatus also includes a non-transitory memory that further includes a key store for storing a first key. The apparatus further includes a communication device at least partially supported by the housing and connectable to the device to establish a communication channel with the device. The apparatus also includes a controller (e.g., a crypto engine) that receives, via the communication channel, a first portion of data from the device, performs a cryptographic operation on the first portion of the data using the first key to generate a modified first portion, sends, via the communication channel, the modified first portion to the device, and enables the device to derive a second portion of the data using the modified first portion.

Abstract: A system and method for providing secure Single-Sign-On (SSO) authentication in a zero-knowledge architecture. A first server component may operate as a first relying party in a first SSO flow. When the user of an application successfully authenticates to a first identity provider, a first part of a secret key may be provided to the application. Additionally, a second server component may operate as a second relying party in a second SSO flow. When the first part of the secret key is received by the application, authentication information may be provided to a second identity provider. Based on a successful authentication, a second part of the secret key may be provided to the application. The first and second parts of the secret key may be combined by the application to generate a final secret key that may be used to decipher encrypted user data.

Abstract: A software and hardware infrastructure is provided that can generate traceable and verifiably random number sequences provided from multiple random number sources, including quantum entropy sources, potentially located at multiple points of origin, and distribute the verifiable number sequences across multiple channels and protocols to multiple ultimate destinations in a distributed computing environment. Random number sequences obtained from unique entropy sources can be tagged with information on the provenance and/or other details of the creation of each number sequence. Tags can be used to verify the reliability of each tagged number sequence and/or its associated source. Tags can also include a use indicator to avoid re-use of a tagged number sequence.

Abstract: Techniques for real-time delivery of personalized content are provided. An example method includes detecting that a delivery server invoked an API in response to the delivery server detecting that a client device is accessing a communication provided to the client device by the delivery server, the communication formatted in accordance with a template; receiving a request for offers, the request including a user identifier associated with a user of the client device and offer query criteria based on the template; building the offers by: retrieving candidate offers specific to the user from a database server using an API request; and, based on the offer query criteria, identifying the offers, from the candidate offers, to deliver to the delivery server; and transmitting the offers to the delivery server to cause the delivery server to populate the communication with content corresponding to the offers.

Abstract: A functional component and having a partial plastic housing element with a plastic housing wall, the plastic housing wall having a device identification region integrated into the plastic housing wall and thus realizing a constituent part of the plastic housing wall. The device identification region comprising identification elements integrated into the plastic housing wall, those identification elements that realize part of a surface of the plastic housing wall realizing device identification elements, the device identification region being realized individually for the device by the device identification elements, such that the device can be unambiguously identified by means of the device identification region.

Abstract: A device and method manage digital data. The device and method may receive a trusted-phrase text string at a client device. The device and method may receive an application pin number (APN) associated with a user. The device and method may process the APN to determine a selector value. The device and method may extract a portion of the trusted-phrase text string based on the selector value to yield a sub-trusted-phrase text string, generating a storage access ID (SAID), the SAID including the APN and the sub-trusted-phrase-text string encrypted using the trusted-phrase text string as an encryption phrase; and, outputting the SAID to an external device, for creation of a data storage location at a storage server, the data storage location having a name based on the SAID. The device and method may include ability to recover the trusted-phrase text string.

Abstract: Provided is a process that establishes user identities within a decentralized data store, like a blockchain. A user's mobile device may establish credential values within a trusted execution environment of the mobile device. Representations of those credentials may be generated on the mobile device and transmitted for storage in association with an identity of the user established on the blockchain. Similarly, one or more key-pairs may be generated or otherwise used by the mobile device for signatures and signature verification. Private keys may remain resident on the device (or known and input by the user) while corresponding public keys may be stored in associated with the user identity on the blockchain. A private key is used to sign representations of credentials and other values as a proof of knowledge of the private key and credential values for authentication of the user to the user identity on the blockchain.

Abstract: An integrated-circuit device comprises a physical-unclonable-function (PUF) unit, a secure module, and an interconnect system communicatively coupled to the PUF unit and to the secure module. The device transfers a PUF key from the PUF unit to the secure module, over the interconnect system. In order to do this, the secure module generates a random value. The secure module then sends the random value to the PUF unit. The PUF unit then performs a bitwise XOR operation between the received random value and the PUF key, to generate a masked value. The PUF unit then transfers the masked value over the interconnect system to the secure module. The secure module then unmasks the PUF key by performing a bitwise XOR operation between the received masked value and the random value.

Abstract: Systems and methods of generating a security key for an integrated circuit device include generating a plurality of key bits with a physically unclonable function (PUF) device. The PUF can include a random number generator that can create random bits. The random bits may be stored in a nonvolatile memory. The number of random bits stored in the nonvolatile memory allows for a plurality of challenge and response interactions to obtain a plurality of security keys from the PUF.

Abstract: Cryptographic method for verifying data method, implemented by at least one apparatus, for comparing a first dataset and a second dataset, in particular with a view to determining whether these two datasets are identical, this method not requiring the presence of these two datasets in the apparatus, and comprising the following steps: a) mixing a number, called the mixer number, with the first dataset, using a mixing function in order to obtain mixed data, b) hashing the mixed data using a hash function, and c) comparing the hash thus obtained in step b) with a third dataset assumed to be the hash of the second dataset mixed with the same mixer number as that used in step a) and with the same mixing function.

Abstract: A method includes generating a data signal based on data, scrambling the data signal with a pseudo-random signal thereby generating a scrambled data signal, generating an amplitude shift keying (ASK) signal based on the scrambled data signal, and transmitting, by a transceiver, the ASK signal.

Abstract: A method, implemented by at least one apparatus, for comparing a first dataset and a second dataset, in particular with a view for determining whether these two datasets are identical. The method not requiring the presence of these two datasets in the apparatus, and including the following steps of: a) mixing a number, called the mixer number, with the first dataset, using a mixing function, in order to obtain mixed data, b) hashing the mixed data using a hash function, and c) comparing the hash thus obtained in step b) with a third dataset assumed to be the hash of the second dataset mixed with the same mixer number as that used in step a) and with the same mixing function.

Abstract: A method includes obtaining, from a server, a filter including a set of encrypted identifiers each encrypted with a server key controlled by the server. The method includes obtaining a request that requests determination of whether a query identifier is a member of a set of identifiers corresponding to the set of encrypted identifiers. The method also includes transmitting an encryption request to the server that requests the server to encrypt the query identifier. The method includes receiving, from the server, an encrypted query identifier including the query identifier encrypted by the server key and determining, using the filter, whether the encrypted query identifier is not a member of the set of encrypted identifiers. When the encrypted query identifier is not a member of the set of encrypted identifiers, the method includes reporting that the query identifier is not a member of the set of identifiers.

Abstract: A method of securely encrypting data whereby a computing device can utilize a seed and a pin to generate a mantissa of an irrational number. The computing device can then utilize a portion of the mantissa as a one-time pad to encrypt data. The seed can be transmitted to a recipient via a graphical code to enable secure decryption by a recipient's computing device.

Abstract: The present disclosure relates to a communication method and system for converging a 5th-Generation (5G) communication system for supporting higher data rates beyond a 4th-Generation (4G) system with a technology for Internet of Things (IoT). The present disclosure may be applied to intelligent services based on the 5G communication technology and the IoT-related technology, such as smart home, smart building, smart city, smart car, connected car, health care, digital education, smart retail, security and safety services. The disclosure relates to a method and apparatus for connecting communication by downloading and installing one or more communication services in a terminal in a wireless communication system. In addition, the disclosure relates to a method and apparatus for remotely downloading and installing a profile in a terminal, and managing a plurality of installed profiles.

Abstract: A communication system authorizes a User Equipment (UE) for a wireless data service and a media-conferencing service. A network core receives UE authentication data from the UE that is based on a secret key. The network core determines network authentication data for the UE that is also based on the secret key. The network core authorizes the UE for the wireless data service based on the UE authentication data and the network authentication data. The network core transfers the network authentication data for the UE to a media-conferencing server in response to the authorization of the UE for the wireless data service. The media-conferencing server receives other UE authentication data from the UE that is based on the secret key. The media-conferencing server authorizes the UE for the media-conferencing service based on the other UE authentication data from the UE and the network authentication data from the network core.

Abstract: This document describes techniques for expanding user groups while preserving user privacy and data security. In one aspect, a method includes receiving, by a content platform and from a client device of a user, a request for a digital component that also includes a user identifier. A determination is made that the user identifier is included in a user list that includes multiple user identifiers respectively corresponding to multiple users in a user action group. In response to determining that the unique identifier is included in the user list, a digital component of the entity for which the user list is generated is selected and provided to the client device of the user for display to the user of the client device.

Abstract: A request for a transaction between a client system and a server system may be processed. The transaction may be associated with transmission of data between the client system and the server system. The data may be encrypted using a transient encryption key to form encrypted data. The transient encryption key may be a synced-clock random number configured to automatically change when a designated time interval elapses. The encrypted data may be transmitted between the client system and the server system.

Abstract: A method for preventing side-channel attack according to an embodiment includes generating an order table which includes a position index value for each bit value of a bit string that is secret information to be generated through a decryption algorithm of an Nth Degree Truncated Polynomial Ring Units (NTRU) LPRime algorithm, shuffling a sort order of the position index value for the each bit value in the order table based on a random number, determining a generation order for the each bit value according to the sort order of the position index value for the each bit value in the order table, and generating the secret information through the decryption algorithm. The secret information is generated by generating the each bit value according to the determined generation order.

Abstract: An electronic device generates a first key pair associated with the electronic device. A first secret key of the first key pair is generated based on device properties including identification information of the electronic device. The electronic device transmits a communication request to a verifier device. The electronic device generates zero-knowledge information which is based on the generated first secret key. A first public key of the first key pair is stored in the verifier device. The electronic device transmits the zero-knowledge information to the verifier device for a verification of the transmitted communication request. The verification of the communication request is based on the first public key. The electronic device receives verification information from the verifier device based on the transmitted zero-knowledge information and a successful verification of the verification of the transmitted communication request.

Abstract: A method for Serial Peripheral Interface (SPI) operating-mode synchronization between an SPI host and an SPI device, which communicate over an SPI bus, includes predefining, in the SPI device, one or more values on the SPI bus as indicative of lack of synchronization of an SPI operating mode between the SPI host and the SPI device. Re-synchronization of the SPI operating mode is initiated in response to receiving any of the predefined values in the SPI device.

Abstract: A MAC tag list generation apparatus includes: a message input part; a group testing matrix generation part which generates a t×m group testing matrix H that is a parameter(s) of combinatorial group testing with respect to the number s (s being a positive integer) of the MACs to be generated, a decodable linear group testing MAC application part which, with respect to the message M, using the group testing matrix H, a variable-length-input fixed-length-output pseudorandom function F; and a Tweakable block cipher G for which a row index of the group testing matrix H is a Tweak, generates a MAC tag list T=(T[1], . . . , T[t]); and a MAC tag list output part which outputs the MAC tag list.

Abstract: Cryptographic methods and systems are described. Certain examples relate to performing cryptographic operations by updating a cryptographic state. The methods and systems may be used to provide cryptographic functions such as hashing, encryption, decryption and random number generation. In one example, a non-linear feedback shift register or expander sequence is defined. The non-linear feedback shift register or expander sequence has a plurality of stages to receive the cryptographic state, wherein at least one of the plurality of stages is updated as a non-linear function of one or more other stages. In certain examples, a cryptographic state is updated over a plurality of rounds. Examples adapted for authenticated encryption and decryption, hashing, and number generation are described.

Abstract: The invention provides an information processing apparatus, method, and security protocol for secure storage and transfer of data using two-level encryption by combining RSA and AES keys. The apparatus includes circuitry (100) configured to receive encryption request, encrypt the data to generate first encryption data. The encryption of the data is based on an AES user key (103) and the received encryption request. The circuitry is further configured to encrypt the first encryption data to generate second encryption data, decrypt the second encryption data to generate first decryption data. The decryption of the second encryption data is based on a company AES key (107). The circuitry (100) is further configured to decrypt the first decryption data to generate the original data. The decryption of the first decryption data is based on an AES user key (103), and the second decryption data corresponds to the transmitted data.

Abstract: Provided is a security authentication method of a network video recorder (NVR) including assigning a terminal unique index to each of pseudo-random functions included in a pseudo-random function set using terminal information; transmitting a session key having a predetermined expiry time and the pseudo-random function set with the assigned terminal unique index to a terminal; calculating a first terminal unique index for authenticating a first message using a predetermined bitstream of the first message received from the terminal; selecting a first pseudo-random function for authenticating the first message using the calculated first terminal unique index; generating a first independent private key of the terminal for authenticating the first message by inputting the session key and a MAC address of the terminal to the first pseudo-random function; and generating a message authentication code for the first message using the first independent private key and authenticating the first message.

Abstract: The method involves drying down dye-conjugated reagents in separate locations in a reaction vessel so that the dyes don't non-specifically interact with each other during drying. This invention thus improves multiplex binding assays by eliminating erroneous results caused by dyes' being non-specifically attached to each other when dried down together.

Abstract: A circuit and corresponding method enable bitcoin mining in a blockchain network. The circuit comprises a nonce generator that generates a nonce value, on a cycle-by-cycle basis, and changes only one binary digit of the nonce value per cycle. The circuit further comprises a hash engine that inserts, on the cycle-by-cycle basis, the nonce value into a block header of a block candidate and generates a digest by applying a hash function to the block header. The block header includes a representation of a target value. The circuit further comprises a validator that compares, on the cycle-by-cycle basis, the digest to the target value. In an event the digest satisfies the target value, the validator submits the block candidate to the blockchain network, causing newly minted bitcoin to be mined from the blockchain network. Changing only one binary digit of the nonce value, per cycle, reduces power consumption of the circuit.

Abstract: A method comprises generating, during an enrollment process conducted in a controlled environment, a dark bit mask comprising a plurality of state information values derived from a plurality of entropy sources at a plurality of operating conditions for an electronic device, and using at least a portion of the plurality of state information values to generate a set of challenge-response pairs for use in an authentication process for the electronic device.

Abstract: A MAC tag list generation apparatus, on reception of a nonce N unique value to each MAC generation process and a message M, generates a t×m group test matrix H serving as combinatorial group testing parameters for s (a positive integer) which is the number of the MACs to be generated, generates a MAC tag list T=(T[1], . . . , T[t]) by generating a MAC value T[i] corresponding to the i-th test (i=1, . . . , t) using the group test matrix H, the nonce N, and pseudorandom functions F and G with variable length input and fixed length output for the message M, and outputs the MAC tag list.

Abstract: A method for remote attestation includes establishing, using a cryptographic protocol, a communication session between a first computing device and a second computing device. The communication session includes communications encrypted by an ephemeral session key. The method includes receiving, at the first communication device via the communication session, from the second computing device, an attestation request requesting the first computing device to provide an attestation report. The method includes generating, by the first computing device, the attestation report based on the ephemeral session key and sending, using the communication session, the attestation report to the second computing device.

Abstract: An integrated infrastructure secure communication system includes at least one chassis, and a plurality of computing devices that are located in the at least one chassis and that are coupled to each other. A first computing device included in the plurality of computing device receives a communication from a first component in the first computing device, retrieves a vendor-based key, and encrypts the communication using the vendor-based key to provide a first-level encrypted communication. The first computing device also generates a first random key, encrypts the first-level encrypted communication with the first random key to provide a second-level encrypted communication, and transmits the second-level encrypted communication to a second computing device that is included in the plurality of computing devices.

Abstract: A method for secure path discovery in a mesh network at a destination device is disclosed. The method includes receiving a path discovery request from an originator device and selecting a path selection in response to the path discovery request. The method also includes transmitting the path selection to the originator device and receiving a random seed from a provisioner device. The method also includes generating an authentication code based on the random seed, transmitting an authentication code message to an originator device and receiving communications from the originator device only if the originator device receives a verification response message from the provisioner device which confirms that the destination device has been verified.

Abstract: A block cipher encryption device for encrypting a data unit plaintext into blocks of ciphertexts, the data unit plaintext being assigned a tweak value and being divided into one or more plaintext blocks. The block cipher encryption device comprises: a combinatorial function unit associated with each plaintext block, the combinatorial function unit being configured to determine a tweak block value by applying a combinatorial function between a value derived from the tweak value and a function of a block index assigned to the plaintext block, a first masking unit in association with each plaintext block, the first masking unit being configured to determine a masked value by applying a data masking algorithm to the tweak block value determined by the combinatorial function unit associated with the plaintext block.

Abstract: Methods and systems for managing cryptographic keys in on-premises and cloud computing environments and performing multi-party cryptography are disclosed. A cryptographic key can be retrieved from a hardware security module by a key management computer. The key management computer can generate key shares from the cryptographic key, and securely distribute the key shares to computer nodes or key share databases. The computer nodes can use the key shares in order to perform secure multi-party cryptography.

Abstract: A sensor module includes at least one sensor configured to generate sensor information and processing circuitry configured to generate a sensor signal based on the sensor information. The sensor signal includes a sync frame, including two sync signal edges defining the sync frame and indicating a pre-determined synchronization time interval, and the sensor signal further includes a plurality of data signal portions, including at least one data signal portion transmitted within the sync frame. The at least one data signal portion is provided within the sync frame located between the two sync signal edges, wherein each of the at least one data signal portion is defined by at least one data signal edge interposed in the sensor signal between the two sync signal edges.

Abstract: A control method implemented by a computer which is configured to be operated as a terminal apparatus, the control method including: transmitting, from the terminal apparatus to a first management server, a first request for transmission of a certificate of a first server, the first server being one of a plurality of servers, the first management server being configured to manage certificates for the plurality of servers; in response to the transmitting of the first request, receiving the certificate of the first server from the first management server; in response to the receiving of the certificate, determining a certificate authority by using information included in the received certificate, the certificate authority being a server from which the received certificate has been issued; and transmitting, from the terminal apparatus to the determined certificate authority, a second request for transmission of first address information on the first server.

Abstract: Systems and methods are provided for managing the order of data written to a transaction log in a distributed storage system. In a system with multiple nodes, if sequencers are naively generated without taking into consideration inconsistencies among the different nodes generating the sequencers, then the sequencers may not increase for each data transaction. To alleviate this problem, the node committing the transaction to the transaction log may perform a consistent read and verifies that the sequencer advances. If the sequencer does not advance, the node can perform a context-dependent operation such as adjusting the sequencer, acknowledging the write without committing it to the transaction log, or rejecting the write altogether.

Abstract: A method for enrolling a node in a network including steps of: providing a hub having a network communications element, established ownership, an owner, a private key and a public key; providing a first node having a network communications element, established ownership status, a network location status, a private key and a public key; scanning an environment to identify active hub devices; selecting a most likely hub device from among identified hub devices; receiving a hub public key from the selected hub; encrypting a string using the received public key; sending the encrypted string; receiving a decrypted copy of the string; validating the hub; sending an authentication request through the hub, the request including the public key of the first node; receiving an encrypted string; decrypting the string using the node's private key; sending the decrypted string through the hub; and updating the network location status of the node.

Abstract: A solution for controlling access to a resource such as a digital wallet implemented using a blockchain. Use of the invention during set-up of the wallet can enable subsequent operations to be handled in a secure manner over an insecure channel. An example method comprises splitting a verification element into multiple shares; determining a common secret at multiple nodes in a network; and using the common secret to transmit a share of the verification element between nodes. The shares can be split such that no share is sufficient to determine the verification element and can be stored at separate locations. Upon share unavailability, the share can be retrieved a location accessibility. For safe transmission of the share(s), the common secret is generated at two different nodes independently and used to generate an encryption key for encrypting at least one share of the verification element to be transmitted securely.

Abstract: Systems, methods, and computer-readable media are disclosed for systems and methods for sending and receiving anonymized signals or beacons. Example methods may include determining an authentication code and sending a signal associated with the authentication code from an electronic device to a server via a connected device. Example methods may include determining an authentication code by a server or a second electronic device and requesting signal information from the server corresponding to the signal associated with the authentication code.

Abstract: Systems, methods, and computing device readable media for implementing fast oblivious transfer between two computing devices may improve data security and computational efficiency. The various aspects may use random oracles with or without key agreements to improve the security of oblivious transfer key exchanges. Some techniques may include public/private key strategies for oblivious transfer, while other techniques may use key agreements to achieve simultaneous and efficient cryptographic key exchange.

Abstract: Embodiments of the present invention provide a system for generating duplicate layered electronic data logs for monitored events on a network. The system is configured for identifying one or more entity resources associated with an entity, continuously monitoring the one or more entity resources, identifying at least a first event and a second event associated with at least one entity resource of the one or more entity resources, storing the first event and the second event in at least a first log and a second log, and generating at least one other log to record activities associated with at least one of the first log and second log.

Abstract: A random number generator according to one embodiment includes a write circuit, a read circuit, and a signal output circuit. The write circuit inverts magnetization of a magnetic layer of a magnetic tunnel junction element stochastically by supplying current to the magnetic layer. The read circuit reads the magnetization. The signal output circuit generates a random number on the basis of the magnetization read by the read circuit. The random number generator includes a sequence control circuit that controls the write circuit and the read circuit. The sequence control circuit regulates the write circuit to supply the current to the write circuit in a first period, and causes the read circuit to read the magnetization after the first period is finished and then a second period longer than the first period is elapsed.

Abstract: A method and system. An instruction to encrypt plaintext to generate encrypted data from the plaintext is received. The encrypted data is to be stored in a database device in response to a first request received from a client terminal to store the plaintext in the database device. The first request includes the plaintext. Ciphertext is generated by applying both an initialization vector and an encryption key directly to the plaintext. An embedding rule used to generate the encrypted data is selected from a sequence of embedding rules. The encrypted data is stored in the database device, A second request to receive the plaintext data is received from the client terminal. The plaintext is obtained from the encrypted data, by separating the encrypted data into the ciphertext and the initialization vector; and generating the plaintext by decrypting the ciphertext that was separated from the encrypted data.

Abstract: Methods, systems, and apparatuses associated with hardware mechanisms for link encryption are disclosed. In various embodiments, an interconnect interface is coupled to a processor core to interconnect a peripheral device to the processor core via a link established between the peripheral device and the interconnect interface. The interconnect interface is to select a cryptographic engine of a plurality of cryptographic engines instantiated in the interconnect interface for the link. The cryptographic engine is to symmetrically encrypt data to be transmitted through the link. In more specific embodiments, each of the plurality of cryptographic engines is instantiated for one of a request type on the link, a virtual channel on the link, or a request type within a virtual channel on the link.