Samsung Electronics Co., Ltd.

Ahmed M Azab

Rohan Bhutkar

Wenbo Shen

Peng Ning

Xun Chen

Guruprasad Ganesh

Michael C Grace

Ruowen Wang

Yong Choi

Stephen E McLaughlin

Ivan Getta

Khaled Elwazeer

Haining Chen

Kirk R Swidowski

Junyong Choi

Myungsu Cha

Donguk Seo

Kyoung-Joong Shin

Ken Chen

James Gleeson

Sudhi Herle

Yong Uk Shin

Hyungseok Yu

Kyungsun Lee

Yueh-Hsun Lin

Yurak Choe

Wei Yang

Song Wei

David Thomson

Mengmeng Li

Se Young Choi

Jitesh Shah

Quan Chen

Gurupradsad Ganesh

A method of providing continuous user authentication for resource access control includes launching a continuous authentication service at a boot time of a first device, wherein the first device includes a processor, a memory, and one or more sensors configured to collect authentication information. Additionally, the method includes receiving authentication information comprising one or more of explicit authentication information or implicit authentication information, and receiving a request for access to a resource of the first device. Further, the method includes the operations of determining, by the continuous authentication service, a current value of a security state, the current value of the security state based in part on a time interval between a receipt time of the authentication information and a current time and controlling access to the resource based on the current value of the security state.

System and method for resource access authentication

An electronic device includes a memory and at least one processor coupled to the memory. The at least one processor is configured to identify a device change event in a host operating system, wherein the host operating system includes a host namespace, switch from the host namespace to a container namespace of a container, and update the container with information based on the device change event.

System and method for dynamic volume management

An apparatus and a method for protecting kernel control-flow integrity using static binary instrumentation are provided. The method includes configuring a compiler to reserve a register in a processor, compiling source code into a binary based on the configured compiler, and modifying the binary to prevent exploits using the reserved register, wherein the reserved register stores a first encryption key for encrypting and decrypting return addresses. The reserved register stores an encryption key that is used to encrypt and decrypt return addresses to prevent control flow exploits.

Method and apparatus for protecting kernel control-flow integrity using static binary instrumentation

A method for operating an electronic device, the method including spawning a name space tool (NST) as part of a boot process of a host OS, wherein the NST is a process with a plurality of root privileges of the host OS. The method further includes spawning, by the NST, a container for a guest OS, wherein the container for the guest OS is mapped to a dedicated domain in the host OS, and dropping, by the NST, a root privilege of the host OS in response to spawning the container for the guest OS.

System and method for guest operating system using containers

This disclosure relates to an electronic device including a memory and at least one processor coupled to the memory. The at least one processor is configured to execute a daemon process in one of a container or a host operating system, wherein the daemon process is configured to manage data transfer between the container and the host operating system, create, via the daemon process, an inter-process communication (IPC) channel between the container and the host operating system, receive incoming audio data, and buffer the incoming audio data to the IPC channel.

System and method for device audio

A method for implementing a shared memory buffer includes at an apparatus comprising a processor and a physical memory, running a host environment with a host virtual memory. The method further includes running a guest environment with a guest virtual memory, performing, by the host environment, an allocation of a frame buffer in the physical memory, and mapping the allocated frame buffer into the host virtual memory. Additionally, the method includes passing a handle of the allocated frame buffer to the guest environment and performing a mapping of the allocated frame buffer into the guest virtual memory, the mapping based on the handle of the allocated frame buffer.

System and method for frame buffer

A connected device includes an application processor, a secure element, and a control module. The application processor is configured to receive a control command from an electronic device. The secure element is connected between the application processor and a control module and is configured to authenticate the control command. The control module is configured to receive the control command when the control command is authenticated by the secure element, execute the control command to activate at least one function of the connected device, and transmit a response to the electronic device.

Authorized control of an embedded system using end-to-end secure element communication

An apparatus and method for reducing boot time of an electronic device are provided. The electronic device includes electronic device is provided. The electronic device includes a processor including at least one system register; and an Operating System (OS) including an OS component having at least one reserved area, each reserved area including a static memory structure. The OS component is configured to, during a booting process, copy addresses of the at least one static memory structure into at least one of the plurality of system registers, and initialize the static memory structures located at the copied addresses.

Apparatus and method for compile time construction of memory structures

An apparatus and method of a hardware isolated secure element protecting a plurality of mission critical subsystems are provided. The method includes performing an actuation operation received across an unsecure path that modifies the state of a mission critical subsystem, performing a diagnostic operation received across the unsecure path that requests state information of the mission critical subsystem, storing information used to determine which of the diagnostic operation and the actuation operation received across the unsecure path are performed, and flashing an execution image of an electronic control unit when the execution image of the electronic control unit is received across the unsecure path.

Apparatus and method for protection of critical embedded system components via hardware-isolated secure element-based monitor

An apparatus and method of an attachment device for interfacing with an on-board diagnostic system of a vehicle is provided. The device includes an application processor configured to receive input from a terminal, control processing of the input by the on-board diagnostic system, transmit a result of the processing of the input by the on-board diagnostic system to the terminal, and a secure element interposed in the communication path between the application processor and the on-board diagnostic system, the secure element configured to filter the input of an on-board diagnostic operation that is untrusted.

Apparatus and method for transparent, secure element-based mediation of on-board diagnostic operations

A Protected Walk-based Shadow Paging (PWSP) method includes storing a multiple level first stage (S1) page tables structure in second stage (S2) page tables. The method includes: when an S1 page table in an S2 page table entry is marked with a writable attribute: (i) permitting an operating system (OS) to write to the S1 page table, (ii) blocking a memory management unit (MMU) from reading the S1 page table for translation, and (iii) in response, verifying the S1 page table for translation and changing the marking of the S1 page table in the S2 page table entry to a read-only attribute, enabling the MMU to subsequently read the S1 page table. The method further includes: when the S1 page table in the S2 page table entry is marked with the read-only attribute: (i) permitting the OS to read the S1 page table for translating from a virtual address to an intermediate physical address, (ii) blocking the OS from writing to the S1 page table, and (iii) in response to blocking the OS, updating the S1 page table and changing the marking of the S1 page table in the S2 page table entry to the device memory attribute, enabling the OS to write to the S1 page table. Blocking the MMU from reading the S1 page table for translation may include generating a device memory permissions fault, and blocking the OS from writing to the S1 page table may include generating a read-only prefetch permissions fault.

Method and apparatus for performing protected walk-based shadow paging using multiple stages of page tables

A method for verifying data integrity of a block device is provided. The method includes providing a secure world execution environment configured to monitor changes to data blocks of a block device, within the secure world execution environment, generating a hash for changed data blocks of the block device, and within the secure world execution environment, verifying and generating a cryptographic signature.

Methods and apparatus to enable runtime checksum verification of block device images

An apparatus and method for protecting kernel data integrity in an electronic device are provided. The method includes mapping a specified type of data to a read-only memory area, detecting a write attempt to the specified type of data, determining whether a process attempting to write to the specified type of data is permitted according to a specified condition, and allowing the write attempt if the process attempting to write to the specified type of data satisfies the specified condition.

Growing community of inventors

Palo Alto, CA, United States of America

Ahmed M Azab