Abstract: A system includes an interface with a plurality of sub-addresses. The interface receives critical data and non-critical data. The critical data are received only at more specific sub-addresses of the interface. The interface transfers the critical data received at the sub-addresses to a critical processor, such that the critical data avoids being received by or being processed by a non-critical processor. The interface transfers the non-critical data from the interface to the non-critical processor. The configuration of the interface is hard-coded such that the configuration of the interface is fixed at power up of the interface and is non-changeable by the non-critical processor. The interface includes an external platform interface that is external to the critical processor, the non-critical processor, and a local controller. The external platform interface includes a limited ability to store the critical and non-critical data.

Abstract: An input content data managing system, includes a first electronic storing apparatus that stores encoded content data generated by encoding content data with a cryptographic key; a electronic second storing apparatus that stores the cryptographic key with corresponding digest-value data of the encoded content data capable of identifying sameness of the encoded content data; a matching unit that determines a matched cryptographic key stored in the second storing apparatus for the encoded content data stored in the first storing apparatus, the matching using, as a matching key, at a predetermined time, digest-value data of the encoded content data obtained from the encoded content data stored in the first storing apparatus to match with the digest-value data of the encoded content data stored in the second storing apparatus, in order to obtain the content data by decoding the encoded content data using the matched cryptographic key.

Abstract: According to an embodiment, a programmable logic device includes a plurality of logic blocks, memory, a plurality of connection control elements and a logic unit. The logic blocks are grouped into one or more programmed partitions. The memory stores authentication information and partition information. The connection control elements controllably interconnect different ones of the logic blocks. The logic unit controls external access to the one or more partitions based on the authentication information, controls reprogramming of the one or more partitions based on at least some of the partition information and configures the connection control elements based on at least some of the partition information.

Abstract: Database management and security is implemented in a variety of embodiments. In one such embodiment, data sets containing sensitive data elements are analyzed using aliases representing sensitive data elements. In another embodiment, the sensitive data elements are stored in an encrypted form for use from a secure access, while the alias is available for standard access.

Abstract: The present disclosure relates to systems and methods for secure and authentic electronic cross domain collaboration between a plurality of users using a combination of biometric security, a separate and secure network infrastructure, management processes, encrypted electronic storage, and collaborative templates. In an exemplary embodiment, an cross domain collaboration system includes a server including a network interface connected to the Internet, a data store including electronic data storage, and a processor, wherein each of the network interface, the data store and the processor are communicatively coupled, and wherein the network interface, the data store and the processor are collectively configured to: biometrically authenticate a plurality of users, wherein each of the plurality of users comprises a security level and a domain; and enable cross domain collaboration between the plurality of users based on the security level of each of the plurality of users.

Abstract: A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.

Abstract: A vehicle black box technique guarantees the integrity of vehicle data stored in a black box in real time by forming input data streams as block data and performing a signature using a signing key and nested hashing. Each vehicle black box includes a reliable unique signing key supporting a non-repudiation function. An error correction function is provided by a unique algorithm for generating integrity verification data even when an error occurs from the vehicle data.

Abstract: According to one embodiment, an encryption processing device includes a plurality of generating circuits to generate respective mask values for respective second data units, by using identification information to identify a first data unit and first key data, wherein the first data unit includes the second data units, each of which serves as a unit of an encryption operation, and a plurality of arithmetic circuits encrypting the respective second data units, by using the respective mask values, the second data units, and second key data, wherein the generating circuits perform parallel processing.

Abstract: A decryption key management system includes a memory, a memory controller, a decryption engine, and an on-chip crypto-accelerator. A key blob and an encrypted code are stored in the memory. The memory controller fetches the key blob and stores it in a memory buffer. The decryption engine fetches the key blob and decrypts it using an OTP key to generate a decryption key. The decryption key is used to decrypt the encrypted code and generate a decrypted code.

Abstract: A data processing system 2 includes a single instruction multiple data register file 12 and single instruction multiple processing circuitry 14. The single instruction multiple data processing circuitry 14 supports execution of cryptographic processing instructions for performing parts of a hash algorithm. The operands are stored within the single instruction multiple data register file 12. The cryptographic support instructions do not follow normal lane-based processing and generate output operands in which the different portions of the output operand depend upon multiple different elements within the input operand.

Abstract: A memory system comprises an encryption engine implemented in the hardware of a controller. In starting up the memory system, a boot strapping mechanism is implemented wherein a first portion of firmware when executed pulls in another portion of firmware to be executed. The hardware of the encryption engine is used to verify the integrity of at least the first portion of the firmware. Therefore, only the firmware that is intended to run the system will be executed.

Abstract: In the field of computer enabled cryptography, such as a keyed block cipher having a plurality of rounds, the cipher is hardened against an attack by protecting the cipher key by means of a key expansion process which obscures the cipher and/or the round keys by increasing their lengths to provide an expanded version of the keys for carrying out encryption or decryption using the cipher. This is especially advantageous in a “White Box” environment where an attacker has full access to the cipher algorithm, including the algorithm's internal state during its execution. This method and the associated computing apparatus are useful where the key is derived through a process and so is unknown when the software code embodying the cipher is compiled. This is typically the case where there are many users of the cipher and each has his own key, or where each user session has its own key.

Abstract: Information leaked from smart cards and other tamper resistant cryptographic devices can be statistically analyzed to determine keys or other secret data. A data collection and analysis system is configured with an analog-to-digital converter connected to measure the device's consumption of electrical power, or some other property of the target device, that varies during the device's processing. As the target device performs cryptographic operations, data from the A/D converter are recorded for each cryptographic operation. The stored data are then processed using statistical analysis, yielding the entire key, or partial information about the key that can be used to accelerate a brute force search or other attack.

Abstract: A method is provided for transferring data linked to an application installed on a security module associated with a mobile terminal, the data being stored in a first secure memory area of the security module, suitable for receiving a request to access the data, to read the data, and to transmit or store the data after encryption. A method is also provided for accessing these data suitable for transmitting a request to access, to receive and to decrypt the encrypted data. A security module, a management server, and a system implementing the transfer and access methods are also provided.

Abstract: According to one embodiment, a storage system includes a host device and a secure storage. The host device and the secure storage produce a bus key which is shared only by the host device and the secure storage by authentication processing, and which is used for encoding processing. The host device produces a message authentication code including a message which can be stored in the secure storage based on the bus key, and sends the produced message authentication code to the secure storage. The secure storage stores the message included in the message authentication code in accordance with instructions of the host device. The host device verifies whether the message stored in the secure storage is intended contents.

Abstract: A software authorization system has a server end and a user end. A software authorization method includes acquiring a software identification code of a protected software when the user end downloads the protected software from the server end; transmitting the software identification code and an inherent user identification code to the server end; acquiring a first key and main key by the server end according to the user identification code and the software identification code, respectively, so as to generate a second key by operating the main key and the first key and transmit the second key to the user end; restoring the main key by the user end with the second key combined with the first key; and decrypting the protected software by the main key. Therefore, the protected software is hard to be decrypted.

Abstract: A method and structure for enhancing protection for at least one of software and data being executed on a computer. A file to comprise a secure object is constructed, using a processor on a build machine, the secure object to be executed on a target machine different from the build machine. The secure object comprises at least one of code and data that is to be encrypted when the secure object is stored on the target machine. The encrypted stored secure object is decrypted by the target machine when executed by the target machine after retrieval from a memory on the target machine. The decryption uses a system key of the target machine. The secure object is stored, upon completion of construction, in an encrypted state as a completed secure object, and the secure object is completed without the build machine having the system key of the target machine.

Abstract: Techniques and apparatus for utilizing bits in a translation look aside buffer (TLB) table to identify and access security parameters to be used in securely accessing data are provided. Any type of bits in the TLB may be used, such as excess bits in a translated address, excess attribute bits, or special purpose bits added specifically for security purposes. In some cases, the security parameters may include an index into a key table for use in retrieving a set of one or more keys to use for encryption and/or decryption.

Abstract: Provided are a computer program product, system, and method to allocate blocks of memory in a memory device having a plurality of blocks. An unencrypted memory allocation function requests allocation of unencrypted blocks in the memory device. An encrypted memory allocation function requests allocation of encrypted blocks in the memory device. An unencrypted Input/Output (I/O) request performs an I/O operation against the unencrypted blocks in the memory device. An encrypted I/O request function performs an I/O operation against the encrypted blocks in the memory device. An operating system uses an encryption key associated with the encrypted blocks to encrypt or decrypt data in the encrypted blocks to perform the encrypted I/O operation in response to processing the encrypted I/O request functions, wherein the unencrypted and encrypted memory allocation functions and unencrypted and encrypted I/O request functions comprise different functions in a library of functions available to the application.

Abstract: A processor includes an instruction decoder to receive a first instruction to process a SHA-1 hash algorithm, the first instruction having a first operand to store a SHA-1 state, a second operand to store a plurality of messages, and a third operand to specify a hash function, and an execution unit coupled to the instruction decoder to perform a plurality of rounds of the SHA-1 hash algorithm on the SHA-1 state specified in the first operand and the plurality of messages specified in the second operand, using the hash function specified in the third operand.

Abstract: A system and method of processing an encrypted instruction stream in hardware is disclosed. Main memory stores the encrypted instruction stream and unencrypted data. A central processing unit (CPU) is operatively coupled to the main memory. A decryptor is operatively coupled to the main memory and located within the CPU. The decryptor decrypts the encrypted instruction stream upon receipt of an instruction fetch signal from a CPU core. Unencrypted data is passed through to the CPU core without decryption upon receipt of a data fetch signal.

Abstract: Method and apparatus for constructing an index that scales to a large number of records and provides a high transaction rate. New data structures and methods are provided to ensure that an indexing algorithm performs in a way that is natural (efficient) to the algorithm, while a non-uniform access memory device sees IO (input/output) traffic that is efficient for the memory device. One data structure, a translation table, is created that maps logical buckets as viewed by the indexing algorithm to physical buckets on the memory device. This mapping is such that write performance to non-uniform access SSD and flash devices is enhanced. Another data structure, an associative cache is used to collect buckets and write them out sequentially to the memory device as large sequential writes. Methods are used to populate the cache with buckets (of records) that are required by the indexing algorithm.

Abstract: Methods and systems for managing universal resource locators (URLs) at a server include receiving, at the server, a search query from a client device; creating, by the server, a compressed hash value based on the search query; processing, by the server, the search query to yield a search result; and transmitting the compressed hash value to the client for storage in a browser history.

Abstract: Embodiments of an invention for measuring a secure enclave are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first, a second, and a third instruction. The execution unit is to execute the first, the second, and the third instruction. Execution of the first instruction includes initializing a measurement field in a control structure of a secure enclave with an initial value. Execution of the second instruction includes adding a region to the secure enclave. Execution of the third instruction includes measuring a subregion of the region.

Abstract: A device streams assets to network-based storage in cooperation with servers administering the network-based storage. The servers manage and secure access to the stream of assets, on both an account level and an asset level, in accordance with asset metadata registered for the assets during streaming, and in accordance with account data associated with the assets being streamed and the device with which the assets are streamed. The servers operate to notify other authorized devices associated with the device that the assets are available to download, including initiating the download of assets automatically or in response to user input.

Abstract: Systems and methods are provided for mobile application protection. An executable code associated with an application is received. An encrypted code and a wrapper code are generated based at least in part on the executable code. The encrypted code is capable of being decrypted based at least in part on the wrapper code. An application package including the encrypted code and the wrapper code is generated for a mobile device.

Abstract: Techniques for a computing device operating in access-states are provided. One example method includes receiving, by the computing device operating in a first access state, an indication of first input and responsive to determining that at least one value of a characteristic of the first input exceeds a predetermined characteristic threshold, transitioning the computing device to operate in a second access state. While the computing device is operating in the second access state, the method further includes outputting instructions for transitioning the computing device from operating in the second access state. The method further includes receiving, by the computing device operating in the second access state, an indication of a second input and responsive to determining that the indication of the second input satisfies a threshold of compliance with the instructions, transitioning the computing device from operating in the second access state to operating in the first access state.

Abstract: An apparatus for encrypting an input memory address to obtain an encrypted memory address is provided. The apparatus comprises an input interface for receiving the input memory address being an address of a memory. Moreover, the apparatus comprises an encryption module for encrypting the input memory address depending on a cryptographic key to obtain the encrypted memory address. The encryption module is configured to encrypt the input memory address by applying a map mapping the input memory address to the encrypted memory address, wherein the encryption module is configured to apply the map by conducting a multiplication and a modulo operation using the cryptographic key and a divisor of the modulo operation, such that the map is bijective.

Abstract: Disclosed herein are systems, methods, computer readable media and special purpose processors for obfuscating code. The method includes extracting an operation within program code, selecting a formula to perform the equivalent computation as the extracted operation, and replacing the extracted operation with the selected formula. The formula can be selected randomly or deterministically. The extracted operation can be an arithmetic operation or a Boolean operation.

Abstract: Method and system for improving the security of storing digital data in a memory or its delivery as a message over the Internet from a sender to a receiver using one or more hops is disclosed. The message is split at the sender into multiple overlapping or non-overlapping slices according to a slicing scheme, and the slices are encapsulated in packets each destined to a different relay server as an intermediate node according to a delivery scheme. The relay servers relay the received slices to another other relay server or to the receiver. Upon receiving all the packets containing all the slices, the receiver combines the slices reversing the slicing scheme, whereby reconstructing the message sent.

Abstract: A memory device is operable to perform channel encryption wherein for communication between devices, each includes cryptographic logic and performs cryptographic operations. In an illustrative embodiment, the memory device can comprise memory operable to store data communicated via a communication channel from a processor, and logic operable to perform channel encryption operations on the communication channel that communicates information between the processor and the memory.

Abstract: A method for Remote Direct Memory Access (RDMA) of a memory of a processor. An address translation unit comprises an address translator and a signer. The address translator is configured to translate a received virtual address in a real address of the memory. The signer is configured to cryptographically sign the real address.

Abstract: An address translation unit for Remote Direct Memory Access (RDMA) of a memory of a processor is provided. The address translation unit comprises an address translator and a signer. The address translator is configured to translate a received virtual address in a real address of the memory. The signer is configured to cryptographically sign the real address.

Abstract: Systems and methods for reducing problems and disadvantages associated with traditional approaches to encryption and decryption of data are provided. An information handling system may include a processor, a memory communicatively coupled to the processor, and an encryption accelerator communicatively coupled to the processor. The encryption accelerator may be configured to encrypt and decrypt information in accordance with a plurality of cryptographic functions, receive a command from the processor to perform an encryption or decryption task upon data associated with an input/output operation, and in response to receiving the command, encrypt or decrypt the data associated with the input/output operation based on a particular one of the plurality of cryptographic functions.

Abstract: A method for encrypting data on a disk drive using self encrypting drive is provided. The method includes encryption of data chunks of a computing device. The method further includes associating the encrypted data chunks with encryption key indexes of the computing device. Moreover, the method further includes receiving the encryption key indexes for given logical block addresses of the data chunks. The method further includes determining the encryption keys to be used to encrypt the data chunks based on the encryption key indexes of the data chunks to the disk drive.

Abstract: Encryption techniques for securing data in a data cache are generally disclosed. Example methods may include one or more of reading the cache to identify data, determining whether the data is encrypted to identify previously unencrypted data and/or previously encrypted data, and encrypting selectively at least a portion of the previously unencrypted data. The present disclosure also generally relates to a computer system data processor configured to read a cache to identify data, determine whether the read data is encrypted, and encrypt selectively at least a portion of the previously unencrypted data. The present disclosure also generally relates to computer accessible mediums containing computer-executable instructions for data encryption upon execution of the instructions by a data processor. The instructions may configure the data processor to perform procedures that read the cache to identify data, determine whether the data is encrypted, and selectively encrypt data determined as unencrypted.

Abstract: Instructions and logic provide SIMD secure hashing round slice functionality. Some embodiments include a processor comprising: a decode stage to decode an instruction for a SIMD secure hashing algorithm round slice, the instruction specifying a source data operand set, a message-plus-constant operand set, a round-slice portion of the secure hashing algorithm round, and a rotator set portion of rotate settings. Processor execution units, are responsive to the decoded instruction, to perform a secure hashing round-slice set of round iterations upon the source data operand set, applying the message-plus-constant operand set and the rotator set, and store a result of the instruction in a SIMD destination register. One embodiment of the instruction specifies a hash round type as one of four MD5 round types. Other embodiments may specify a hash round type by an immediate operand as one of three SHA-1 round types or as a SHA-2 round type.

Abstract: Protection of interpreted programming language code filesystem files from access and alteration may be provided by encrypting a file to be protected in a boot sequence. Run-time examination of a virtual appliance may be deterred by hiding the boot sequence in a restricted virtual appliance platform. No shell or filesystem access may be provided. Thus, permissions on a read-only filesystem (for example) may be kept from being altered. The permissions may be set along with filesystem access control lists to prevent unauthorized examination of the source files.

Abstract: A technology is provided which ensures a high security without affecting a plant operation. A plant security managing device includes a determining unit that determines which one of control units multiplexed as a service system and a standby system associated with monitoring and controlling of a plant is the standby system, a security processing unit that performs a security process for detecting the presence/absence of a security abnormality on the control unit that is the standby system, and a change instructing unit that outputs an instruction for changing the control unit that is the standby system and the control unit that is the service system with each other after the completion of the security process by the security processing unit.

Abstract: This is a system for controlling and restricting access (reading, writing, creating, deleting, manipulating, and control) to data and data representations of arbitrary processing engines through the use of secure containers, an access processing engine, and cryptographic keys.

Abstract: A faithful execution system includes system memory, a target processor, and protection engine. The system memory stores a ciphertext including value fields and integrity fields. The value fields each include an encrypted executable instruction and the integrity fields each include an encrypted integrity value for determining whether a corresponding one of the value fields has been modified. The target processor executes plaintext instructions decoded from the ciphertext while the protection engine is coupled between the system memory and the target processor. The protection engine includes logic to retrieve the ciphertext from the system memory, decrypt the value fields into the plaintext instructions, perform an integrity check based on the integrity fields to determine whether any of the corresponding value fields have been modified, and provide the plaintext instructions to the target processor for execution.

Abstract: A method of enabling detection of tampering with data provided to a programmable integrated circuit is described. The method comprises modifying a portion of the data to establish randomness in the data; and inserting, by a computer, a redundancy check value in the portion, wherein the redundancy check value is based upon the modified portion of the data. A programmable integrated circuit is also described.

Abstract: A technique for secure computation obfuscates program execution such that observers cannot detect what instructions are being run at any given time. Rather, program execution and memory access patterns are made to appear uniform. A processor operates based on encrypted inputs and produces encrypted outputs. In various examples, obfuscation is achieved by exercising computational circuits in a similar way for a wide range of instructions, such that all such instructions, regardless of their operational differences, affect the processor's power dissipation and processing time substantially uniformly. Obfuscation is further achieved by limiting memory accesses to predetermined time intervals, with memory interface circuits exercised regardless of whether a running program requires a memory access or not. The resulting processor thus reduces leakage of any meaningful information relating to the program or its inputs, which could otherwise be detectable to observers.

Abstract: A processor comprising: an instruction processing pipeline, configured to receive a sequence of instructions for execution, said sequence comprising at least one instruction including a flow control instruction which terminates the sequence; a hash generator, configured to generate a hash associated with execution of the sequence of instructions; a memory configured to securely receive a reference signature corresponding to a hash of a verified corresponding sequence of instructions; verification logic configured to determine a correspondence between the hash and the reference signature; and authorization logic configured to selectively produce a signal, in dependence on a degree of correspondence of the hash with the reference signature.

Abstract: Examples disclosed herein relate to systems and methods for validating the authenticity of one or more media associated with a gaming system. The systems and methods may utilize a public key in association with a ROM-based algorithm to validate such media. The systems and methods may: decrypt the encrypted game assets media signature; determine a verified game assets hash signature from the decrypted game assets media signature; determine a game assets verification range from the decrypted game assets media signature; calculate a game assets hash signature based on the game assets verification range; and/or determine if the game assets verified hash signature matches the game assets calculated hash signature.

Abstract: Field programmable gate arrays can be used as a shared programmable co-processor resource in a general purpose computing system. Components of an FPGA are isolated to protect the FPGA and data transferred between the FPGA and other components of the computer system. Transferred data can be digitally signed by the FPGA or other component to provide authentication. Code for programming the FPGA can be encrypted and signed by the author, loaded into the FPGA in an encrypted state, and then decrypted and authenticated by the FPGA itself, before programming the FPGA with the code. This code can be used to change the cryptographic operations performed in the FPGA, including keys, or decryption and encryption algorithms, or both.

Abstract: Systems and methods are disclosed for embedding information in software and/or other electronic content such that the information is difficult for an unauthorized party to detect, remove, insert, forge, and/or corrupt. The embedded information can be used to protect electronic content by identifying the content's source, thus enabling unauthorized copies or derivatives to be reliably traced, and thus facilitating effective legal recourse by the content owner. Systems and methods are also disclosed for protecting, detecting, removing, and decoding information embedded in electronic content, and for using the embedded information to protect software or other media from unauthorized analysis, attack, and/or modification.

Abstract: A microprocessor includes an architected register having a bit. The microprocessor sets the bit. The microprocessor also includes a fetch unit that fetches encrypted instructions from an instruction cache and decrypts them prior to executing them, in response to the microprocessor setting the bit. The microprocessor saves the value of the bit to a stack in memory and then clears the bit, in response to receiving an interrupt. The fetch unit fetches unencrypted instructions from the instruction cache and executes them without decrypting them, after the microprocessor clears the bit. The microprocessor restores the saved value from the stack in memory to the bit in the architected register, in response to executing a return from interrupt instruction. The fetch unit resumes fetching and decrypting the encrypted instructions, in response to determining that the restored value of the bit is set.

Abstract: A system for locating and monitoring electronic devices utilizing a security system that is secretly and transparently embedded within the computer. This security system causes the client computer to periodically and conditionally call a host system to report its serial number via an encoded series of dialed numbers. A host monitoring system receives calls from various clients and determines which calls to accept and which to reject by comparing the decoded client serial numbers with a predefined and updated list of numbers corresponding to reported stolen computers. The host also concurrently obtains the caller ID of the calling client to determine the physical location of the client computer. The caller ID and the serial number are subsequently transmitted to a notifying station in order to facilitate the recovery of the stolen device. The security system remains hidden from the user, and actively resists attempts to disable it.

Abstract: The instruction code including an instruction code stored in the area where the encrypted instruction code is stored in a non-rewritable format is authenticated using a specific key which is specific to the core where the instruction code is executed or an authenticated key by a specific key to perform an encryption processing for the input and output data between the core and the outside.