Abstract: A method for preventing unauthorized use of a software program on a computing device includes updating a state of a software program on a computing device to an updated state. Transmitting an update signal from the software program to a hardware token coupled to the computing device and updating a state of the hardware token to an updated state in response to the received update signal. Performing a first cryptographic check using the updated state of the software program and the updated state of the hardware token with the hardware token. Transmitting the first cryptographic check from the hardware token to the software program and performing a second cryptographic check using the state of the hardware token and the state of the software program with the computing device.

Abstract: A method of detecting a fault attack during a cryptographic operation using at least one look-up table including a plurality of sub-tables each having a same number of values of a fixed bit length, a fixed relation existing between values at same locations in each sub-table, the method including: performing a load operation to retrieve from the look-up table data values from a same location in each sub-table; verifying that the fixed relation exists between at least two of the data values; and generating an output signal based on the verification.

Abstract: A device receives protected content and a license for the content, unprotects the content using an input key and retrieves a rule associated with the input key. The device then processes the content to create new content, retrieves at least one output key associated with the input key in the retrieved rule, protects the content using the output key and sends the newly protected content and the corresponding license. It is thus possible to impose a work flow as it is necessary for a device to store a particular key in order to access the content and as the rule imposes a particular output key depending on the input key. In a preferred embodiment, the content is scrambled using a symmetrical key that is encrypted by an asymmetrical key in the license. An alternate embodiment uses watermarking techniques instead of encryption. The invention finds particular use in video processing.

Abstract: A natural language dependent stream cipher is provided to increase complexity of stream cipher encryption. In one aspect, a message is received from a sender as an input in a first natural language and is translated into a selected second natural language. A binary Unicode representation of the input in the second natural language is created. An XOR operation is performed on the binary Unicode representation of the input in the second natural language and a binary key to generate an encrypted output. The encrypted output is sent to a receiver. The encrypted output may be decrypted by the receiver in the reverse of the encryption process. The decryption process yields the original message for viewing by an end-user of the system for a natural language dependent stream cipher.

Abstract: An improved method, apparatus, and computer instructions for processing outbound traffic passing through a port. This port is for a server and receives a request from a client. The request includes a universal resource identifier to a destination. A determination is made as to whether the request requires encryption using the universal resource identifier in the request. The request is sent through the port to the destination in an encrypted form, in response to a determination that the request requires encryption.

Abstract: An obfuscating apparatus creates a table for inputting the same number of arguments for multiplying and squaring operations, and sets the output values of the table so that the outputs may depend on the arguments. With regard to the squaring operations, there are added and tabulated adding operations using the arguments necessary only for the multiplications, so that the number of arguments is equal to that of the multiplication operations. The outputs depend on all the arguments, so that the presence or absence of the added arguments is unknown unlike the case in which dummy arguments that are not processed are added.

Abstract: Calls from an application in an emulated environment to a module in the operating system hosting the emulated environment may be combined to reduce the overhead of accessing the module. An application handling secure shell (SSH) communications may execute multiple calls to a cryptographic module in the host operating system. Because many calls to the cryptographic module during SSH communications follow patterns, two or more related calls may be combined into a single combined call to the cryptographic module. For example, a call to generate a server-to-client key and a call to generate a client-to-server key may be combined into a single call.

Abstract: A hardware-facilitated secure software execution environment provides protection of both program instructions and data against unauthorized access and/or execution to maintain confidentiality and integrity of the software or the data during distribution, in external memories, and during execution. The secure computing environment is achieved by using a hardware-based security method and apparatus to provide protection against software privacy and tampering. A Harvard architecture CPU core is instantiated on the same silicon chip along with encryption management unit (EMU) circuitry and secure key management unit (SKU) circuitry. Credential information acquired from one or more sources is combined by the SKU circuitry to generate one or more security keys provided to the EMU for use in decrypting encrypted program instructions and/or data that is obtained from a non-secure, off-chip source such as an external RAM, an information storage device or other network source.

Abstract: A method and apparatus for protecting against hardware attacks on system memory is provided. A mode of operation for block ciphers enhances the standard XTS-AES mode of operation to perform memory encryption by extending a tweak to include a “time stamp” indicator. An incrementing mechanism using the “time stamp” indicator generates a tweak which separates different contexts over different times such that the effect of “Type 2 replay attacks” is mitigated.

Abstract: A secure hardware comprises a secure pipe, a secure DMA, a secure assist and a secure bus, which connects between those blocks. The secure pipe stores a common encryption key in an encryption key table so as not to be able to access from software. The secure DMA comprises a data common key system process function and a hashing process function. The secure assist comprises a common key system process function and an authentication process function, receives an issued command from a program executed by the processor core via a public IF, and performs setting/control of the secure pipe and the secure DMA via the secure bus.

Abstract: A processor system comprising: performing a compilation process on a computer program; encoding an instruction with a selected encoding; encoding the security mutation information in an instruction set architecture of a processor; and executing a compiled computer program in the processor using an added mutation instruction, wherein executing comprises executing a mutation instruction to enable decoding another instruction. A processor system with a random instruction encoding and randomized execution, providing effective defense against offline and runtime security attacks including software and hardware reverse engineering, invasive microprobing, fault injection, and high-order differential and electromagnetic power analysis.

Abstract: The present invention provides systems and methods for secure transaction management and electronic rights protection. Electronic appliances such as computers equipped in accordance with the present invention help to ensure that information is accessed and used only in authorized ways, and maintain the integrity, availability, and/or confidentiality of the information. Such electronic appliances provide a distributed virtual distribution environment (VDE) that may enforce a secure chain of handling and control, for example, to control and/or meter or otherwise monitor use of electronically stored or disseminated information. Such a virtual distribution environment may be used to protect rights of various participants in electronic commerce and other electronic or electronic-facilitated transactions. Distributed and other operating systems, environments and architectures, such as, for example, those using tamper-resistant hardware-based processors, may establish security at each node.

Abstract: A process for testing an integrated circuit includes collecting a set of points of a physical property while the integrated circuit is executing a multiplication, dividing the set of points into a plurality subsets of lateral points, calculating an estimation of the value of the physical property for each subset, and applying to the subset of lateral points a step of horizontal transversal statistical processing by using the estimations of the value of the physical property, to verify a hypothesis about the variables manipulated by the integrated circuit.

Abstract: A technique of message-passing using shared memory of an RF tag involves storing a message in the shared memory while a security processor of the RF tag is in a sleep mode, the security processor being constructed and arranged to access the shared memory when the security processor is in a wakened mode. The technique further involves transitioning the security processor from the sleep mode to the wakened mode, and processing the message from the shared memory using the security processor after the security processor has transitioned from the sleep mode to the wakened mode. If the security processor is awakened only as needed (rather than remain in the wakened mode), lifetime of a battery which powers the security processor can be maximized.

Abstract: A system and method for modifying a processor system with hypervisor hardware to provide protection against malware. The processor system is assumed to be of a type having at least a CPU and a high-speed bus for providing data links between the CPU, other bus masters, and peripherals (including a debug interface unit). The hypervisor hardware elements are (1) a co-processor programmed to perform one or more security tasks; (2) a communications interface between the co-processor and the debug interface unit; (3) a behavioral interface on the high-speed bus, configured to monitor control signals from the CPU, and (4) an access controller on the high-speed bus, configured to store access control data, to intercept requests on the high-speed bus, to evaluate the requests against the access control data, and to grant or deny the requests.

Abstract: A cryptographically scrubbable disk performs erasure of a cryptographic key covering a body of data to render the body of data unintelligible. A scrub controller interfaced between a computing appliance and a storage volume generates a scrub key and encrypts each block of data written to the storage volume using the scrub key. Data read commands decrypt using the same key. The scrub controller is an electronically separate conduit having independent memory and power, thus the scrub key remains within the scrub controller and unexposed, and is thus inaccessible via the processor of the computing appliance. The scrub key remains in the scrub controller such that the scrub key never leaves the scrub controller and is also inaccessible to retrieval since the scrub controller does not share memory or access with the computer and is thus electronically separate from the supported computing appliance.

Abstract: Disclosed herein are systems, computer-implemented methods, and computer-readable storage media for obfuscating data based on a discrete logarithm. A system practicing the method identifies a clear value in source code, replaces the clear value in the source code with a transformed value based on the clear value and a discrete logarithm, and updates portions of the source code that refer to the clear value such that interactions with the transformed value provide a same result as interactions with the clear value. This discrete logarithm approach can be implemented in three variations. The first variation obfuscates some or all of the clear values in loops. The second variation obfuscates data in a process. The third variation obfuscates data pointers, including tables and arrays. The third variation also preserves the ability to use pointer arithmetic.

Abstract: The present invention provides a method for obtaining a proxy call session control function address, comprising when a terminal accesses an IP multi-media subsystem through a world interoperability for microwave access (WiMAX) network in roaming scenarios, a visited authentication, authorization, and accounting server (V-AAA) of the terminal retransmitting an access request message sent by an access service network (ASN) or a dynamic host configuration protocol (DHCP) or a home agent (HA) of said terminal to a home authentication, authorization, and accounting server (H-AAA) of said terminal after receiving the access request message, and H-AAA finally deciding whether the P-CSCF is located in a visited network or a home network according to a roaming protocol and visited network capability, and returning the determined P-CSCF address information, included by H-AAA in an access accept message corresponding to said access request message, to the sender of said access request message through V-AAA.

Abstract: A system, method, and computer program for protecting numerical control codes, comprising decrypting an encrypted text file that defines how an event for a tool path data set is processed; processing said decrypted text file to obtain a set of instructions; formatting said set of instructions according to a definition file; and outputting said set of formatted instructions; whereby postprocessed machine controls are written and appropriate means and computer-readable instructions.

Abstract: A method comprising the steps of creating a random permutation of data from a data input by executing at least one of a Pseudo-Random Permutation (PRP) and a Pseudo-Random Function (PRF), creating a first data block by combining the random permutation of data with a received second data block and executing an ?-differentially uniform function on the result of the combination, XORing the result of the ?-DU function evaluation with a secret key, and reducing the first data block to a first message authentication code.

Abstract: A data processing system 2 includes a single instruction multiple data register file 12 and single instruction multiple processing circuitry 14. The single instruction multiple data processing circuitry 14 supports execution of cryptographic processing instructions for performing parts of a hash algorithm. The operands are stored within the single instruction multiple data register file 12. The cryptographic support instructions do not follow normal lane-based processing and generate output operands in which the different portions of the output operand depend upon multiple different elements within the input operand.

Abstract: Embodiments may include generating an initial verifier for a first process, the initial verifier generated based on a trusted image of the first process. Embodiments may include, subsequent to generating an untransformed secret associated with the first process, using a reversible transform to transform the untransformed secret with the initial verifier to generate a transformed secret associated with the first process. Embodiments may also include, subsequent to the first process being launched outside of a secure domain, and dependent upon a second verifier generated from a current state of the first process being the same as the initial verifier: using the reversible transform to reverse transform the transformed secret with the second verifier to generate a de-transformed secret equal to the untransformed secret. Embodiments may include performing a secure communication protected with a cryptographic key generated based on the de-transformed secret.

Abstract: A method is provided for visually encrypting at least one part of an at least partially compressed video stream or video sequence, it being possible for said stream to be decomposed into a first type of objects and a second type of objects, the method being applied on each of the images contained in a video sequence, including at least the following steps: analyzing the sequence in the compressed domain so as to define for a given image N at least one first group of objects to be protected by visual encryption and a second group of objects, the transformed coefficients and the motion estimation vectors being transmitted directly to step d) of compression, predicting on the basis of the data arising from the analysis in the previous step of the compressed image N, the position of the objects for a following image N+1, determining the splitting into slices or into groups of slices of the image N+1, compressing the first group of objects of the image N+1 and ciphering at least one part thereof, transmitting t

Abstract: A system and method are provided enabling implicit redundancies such as constant differences and points that should be on the same curve, to be checked at the beginning, end and intermittently throughout the computation to thwart fault injection attacks. This can be implemented by checking the constant difference in point pairs during point multiplication, by checking constant scalings in exponentiation pairs, and by checking that any intermediate point is on the curve and/or in the correct subgroup of the curve.

Abstract: A method for providing security for plaintext data being transferred between units in a computer system includes steps of dividing a memory into a series of addressable locations, each of the addressable locations having an address at which can be stored version information, a data authentication tag, and ciphertext corresponding to the plaintext. The system retrieves the ciphertext, the version information, and the data authentication tag, and generates encryption keys for decrypting the information stored at the address. If the data authentication tag indicates the plaintext data are valid, then the system provides the decrypted plaintext to the requestor, or encrypts new plaintext data and stores the corresponding ciphertext with new authentication and version information at the first address.

Abstract: Devices and methods for securely storing data are provided. A device for constructing an encryption key comprising a tamper-protection barrier that encloses one or more memory devices is provided. The memory stores data for constructing the encryption key. The memory may include a single memory device or a plurality of memory devices. The tamper-protection barrier also encloses a security processor configured to combine the data stored in the memory based in part on a function, such as a logical exclusive-or (XOR) function, to construct the encryption key. The stored data in the memory may include partial keys. These partial keys may be created based in part on applying the XOR function to an encryption key.

Abstract: Systems and methods for selectively providing access to a media device based on a profile associated with the media device. In certain embodiments, the profile of the media device can be user-defined as a development profile or a personal profile. When the device is connected to a host computer system, the profile of the media device is accessed. If the profile of the media device is a development profile, an integrated development environment on the host computer system can access the media device. If the profile of the media device is a personal profile, the integrated development environment is prevented from accessing the device.

Abstract: Machine readable media, methods, and computing devices are disclosed which establish a protected memory channel between an operating system loader of a user partition and services of a management partition. One computing device includes protected storage, read only memory, firmware, a storage device and a processor. The storage device is to store the virtual machine monitor and an operating system having an operating system loader. The virtual machine monitor is to establish a protected memory channel between the one or more integrity services of a management partition and the operating system loader of a user partition in response to measuring and verifying the operating system loader based upon the manifest. The processor is to execute the code of the read only memory, the firmware, the virtual machine monitor, the operating system, the operating system loader, the management partition, and the user partition.

Abstract: A software defined radio device and a download server store a plurality of common keys in common key data. The download server arbitrarily determines a common key from the common key data and conveys information identifying the common key to be used to the software defined radio device. An authenticator of the software defined radio device identifies a common key from the common key data using the information identifying the common key, authenticates using the common key, and performs subsequent communications using the common key. When sending software, a hash value is attached for confirming the security. A device ID of the software defined radio device is also attached to data for confirming which software defined radio device receives the software. The software is securely downloaded by a common key encryption having smaller processing requirements than those of a public key encryption.

Abstract: A system, method, and apparatus is disclosed to control mail server in handling encrypted messages according to a policy.

Abstract: A method and apparatus to enable a user to send an action message including secure credential. The system comprises a receiving logic to receive the action message from a user, a repository including encrypted user-specific data, and an agent to access a resource through a network, the agent directed as specified by a connector object invoked by the action message. The agent further comprises logic to utilize the encrypted user-specific data from the repository to log into the resource through the network, and in one embodiment action logic to perform one or more actions as instructed by the connector invoked by the action message. The agent further comprises, in one embodiment, extraction logic for extracting information resulting from of the agent's access to the data resource specified by the connector, and communication logic to communicate a result to the user or to another agent for further use.

Abstract: Server-side encrypted pattern matching may minimize the risk of data theft due to server breach and/or unauthorized data access. In various implementations, a server for performing the server-side encrypted pattern matching may include an interface component to receive an encrypted query token. The server may further include a query component to find a match for the encrypted query token in the encrypted data string. The query component may find such a match without decrypting the encrypted data string and the encrypted query token by using an encrypted dictionary that includes information on the edges of the encrypted suffix tree.

Abstract: A technique to verify firmware. One embodiment of the invention uses a processor's micro-code to verify a system's firmware, such that the firmware can be included in a trusted chain of code along with the operating system.

Abstract: A method, system, and computer usable program product for providing consistent cryptographic operations in a data processing environment using protected structured data objects are provided in the illustrative embodiments. A data input is received from an originating application by a security plug-in, both the application and the security plug-in executing in the data processing system. A security schema object is received by the security plug-in, the security schema object describing a sequence of cryptographic operations, wherein the security schema object includes a plurality of components each component describing an aspect of the cryptographic operations. The data input is transformed into a secure structured data object by the security plug-in using the sequence of cryptographic operations. A property of the secure structured data object is populated using data about the security schema object. The secure structured data object is transmitted to a consumer application.

Abstract: Techniques relating to a processor including instruction support for implementing a cyclic redundancy check (CRC) operation. The processor may issue, for execution, programmer-selectable instructions from a defined instruction set architecture (ISA). The processor may include a cryptographic unit configured to receive instructions that include a first instance of a cyclic redundancy check (CRC) instruction defined within the ISA, where the first instance of the CRC instruction is executable by the cryptographic unit to perform a first CRC operation on a set of data that produces a checksum value. In one embodiment, the cryptographic unit is configured to generate the checksum value using a generator polynomial of 0x11EDC6F41.

Abstract: Various embodiments of a system and method for reporting and measuring consumption of media content are described. Embodiments may include computing a set of registration hash values for an encrypted content file representing each of one or more content items. To distribute a content item to a consumer, an encrypted content file representing the content item is delivered to a content viewer system. At the content viewer system, a set of playback sums is computed that corresponds to segments of the content item actually played on the content viewer system. The playback hash values can be matched with registration hash values to establish that one or more segments of a content item associated with the matched hash values have been played.

Abstract: A system detects an attack on the computer system. The system identifies the attack as polymorphic, capable of modifying itself for every instance of execution of the attack. The modification of the attack is utilized to defeat detection of the attack. In one embodiment, the system determines generation of an effective signature of the attack has failed. The signature is utilized to prevent execution of the attack. The system then adjusts access to an interface to prevent further damage caused to the computer system by the attack.

Abstract: A processor-based system such as a wireless communication module may implement security functions in a cost effective fashion by providing a virtual memory space whose addresses may be recognized. The memory is integrated with an application processor. When those addresses are recognized, access to special security protocols may be allowed. In another embodiment, a variety of dedicated hardware cryptographic accelerators may be provided to implement security protocols in accordance with a variety of different standards. By optimizing the hardware for specific standards, greater performance may be achieved.

Abstract: A method for security monitoring of an electronic device includes determining whether a storage system of the electronic device is a secured storage system according to a signal of a first switch of the electronic device, determining whether an encryption key of the secured storage system is modifiable according to a detected signal of a second switch of the electronic device. Decrypting the secured storage system using a decryption key if the decryption key is the same as a preset decryption key in the secured storage system.

Abstract: In order to protect a software program, at least one corruption function is included in the program. Also included in the program is at least one instruction that causes the program to be directed to the corruption function. An available breakpoint is then set such that, when the starting location of the corruption function is reached, an exception is generated and the handling of the exception causes the corruption function not to run. This has the effect that, if a malicious user attempts to use the available hardware breakpoint to perform unauthorized actions on the software program, the corruption function will run, and the software program will be unusable.

Abstract: Provided is an information updating apparatus that suppresses performance deterioration due to switching between writable recording areas in which information elements are to be written and readable recording areas from which the information elements are to be read. Also, the information updating apparatus updates a plurality of information elements recorded in a non-volatile recording medium with robustness against power discontinuity ensured. In order to achieve such effects, two groups of recording areas that are identical in number are allocated in the recording medium. The information elements are written in either group of the recording areas indicated by judgment information as the writable recording areas. Each time all the information elements have been written, the judgment information is updated. Thus, the writable recording areas are switched between the two groups of the recording areas.

Abstract: A method of processing digital content performed by an apparatus for storing digital content. In the method, a hardware regional code extracted from a memory of a content storage device is compared with a firmware regional code extracted from firmware, and the digital content is selectively encrypted and stored according to a corresponding regional code only when the hardware regional code matches the firmware regional code.

Abstract: A method (200) and program (100) for inhibiting attack upon a computer (120) is provided. The address (104) of a process (106) is produced (612), and encrypted (616) to produce an encrypted address (518), which is then stored in memory (128). When needed, the encrypted address (518) is retrieved (702) from memory (128) and decrypted (704) to reproduce the original process address (104). The reproduced process address (104) is then verified (708). If the process address (104) is determined (708) to be valid, i.e., there was no attack, then the process address (104) is placed (712) in the program counter (318), and a valid process (106) is executed. If the process address (104) is determined (708) to be invalid, i.e., there was an attack, then the address (108) of a crash and terminate process (110) is placed (716) in the program counter (318) and the computer (120) crashes. A nonce value (512) may be generated (602) and encrypted (616) and decrypted (704) in conjunction with the process address (104).

Abstract: Systems and method for partial encryption are disclosed. One example method comprises: creating a program association table to include a first program number which identifies a program encrypted in accordance with a first encryption scheme, and a second program number which identifies the same program encrypted in accordance with a second encryption scheme; and creating a program map table for the same program to include first audio and video identifiers associated with the first encryption scheme and second audio and video identifiers associated with the second encryption scheme.

Abstract: The embodiments protect an IC against Design-For-Test (DFT) or other test mode attack. Secrets in ROM or PROM are secured. One embodiment for securing information on an IC includes receiving a ROM read command, writing data from a plurality of ROM address locations to an encryption logic in response to receiving the ROM read command, and writing an encryption logic output of the encryption logic to a test control logic, the encryption logic output representing the data from the plurality of ROM address locations. Writing the data from the plurality of ROM address locations to the encryption logic may also include writing the data from the plurality of ROM address locations to a multiple input shift register (MISR) in response to the ROM read command, and writing an MISR output to the test control logic, the MISR output representing the data from the plurality of ROM address locations.

Abstract: A system and method efficiently deletes a file from secure storage, i.e., a cryptainer, served by a storage system. The cryptainer is configured to store a plurality of files, each of which stores an associated file key within a special metadata portion of the file. Notably, special metadata is created by a security appliance coupled to the storage system and attached to each file to thereby create two portions of the file: the special metadata portion and the main, “file data” portion. The security appliance then stores the file key within the specially-created metadata portion of the file. A cryptainer key is associated with the cryptainer. Each file key is used to encrypt the file data portion within its associated file and the cryptainer key is used to encrypt the part of the special metadata portion of each file. To delete the file from the cryptainer, the file key of the file is deleted and the special metadata portions of all other files stored in the cryptainer are re-keyed using a new cryptainer key.

Abstract: A device includes a first memory unit adapted to store encrypted instructions, a processor adapted to execute decrypted instructions, a second memory unit accessible by the processor, and a decryption unit. The device includes a key database and a key selection circuit, wherein the key selection circuit is adapted to select a selected decryption key from the key database for decrypting encrypted instructions. The selection is responsive to a fixed selection information stored within the integrated circuit and to received key selection information. A method includes a stage of receiving encrypted instructions; and executing decrypted instructions by a processor. The method includes receiving key selection information, selecting a selected decryption key out of a key database in response to fixed selection information and to the received key selection information, and decrypting encrypted instructions using the selected decryption key.

Abstract: In the field of computer enabled cryptography, such as a cipher using lookup tables, the cipher is hardened against an attack by a protection process which obscures the lookup tables using the properties of bijective functions and applying masks to the tables' input and output values, for encryption or decryption. This is especially advantageous in a “White Box” environment where an attacker has full access to the cipher algorithm, including the algorithm's internal state during its execution. This method and the associated computing apparatus are useful for protection against known attacks on “White Box” ciphers, by obfuscating lookup table data, thereby increasing the cipher's complexity against reverse engineering and other attacks.

Abstract: A processor, circuit and method provide for fast decryption of encrypted program instructions for execution by the processor. A programmable look-up coding is used to decode a field within the instructions. The decoded field for the instructions are recombined with the remaining portion of the same instructions to yield the decoded instructions. The programmable look-up coding can be programmed and controlled by a process executing at a higher privilege level than the program represented by the instructions, so that security against code-modifying attacks is enhanced.

Abstract: Methods and apparatuses for providing DRM interoperability are provided. Proxy re-encryption technique using bilinear map is used, and the same content can be used in different devices. According to the method of providing DRM interoperability includes in proxy agent with respect to digital rights management (DRM) service providers and device which supports predetermined DRM, first DRM service provider, second DRM service provider, the proxy agent, and the device identify each other, and proxy re-encrypt an interoperable content (IC) and provide the IC to the device. The IC is second-level encrypted by using a key of the first DRM service provider, and the proxy re-encryption is performed by using a proxy key generated from proxy key information provided from the first DRM service provider and the second DRM service provider. Therefore, a problem in which interoperability cannot be guaranteed since a DRM technique depends on a service provider is resolved.