Microsoft Technology Licensing, LLC

Bradley Joseph Litterell

Ling Tony Chen

Ankur Choudhary

Felix Stefan Domke

Tony Edward Schreiner

Kevin Michael Babbitt

Matthew Allen Rakow

Praveen Kumar Muralidhar Rao

Justin Rogers

Christian Fortini

Arron J Eicholz

Sylvain Pierre Galineau

Felix Domke

A TPM is implemented in an SOC for thwarting PIN state replay attacks. Programmable fuses are used as a counter and an on-die RAM stores a blown-fuse count and a TPM state that includes a PIN-failure count and a fuse count. TPM initialization includes incrementing the TPM state PIN-failure count if the blown-fuse count is greater than the TPM state fuse count. Once a PIN is received, if the TPM state PIN-failure count satisfies a PIN failure policy and the PIN is correct, the TPM state PIN-failure count is cleared, and if the PIN is incorrect, a fuse is blown and the blown-fuse count is incremented. If the fuse blow fails, TPM activity is halted. If the fuse blow succeeds, the TPM state PIN-failure count is incremented and the TPM state fuse count is set equal to the blown-fuse count. The TPM state is saved to off-die non-volatile memory.

Fuse based replay protection with conservative fuse usage

A TPM with programmable fuses in an SOC includes an on-die RAM storing a blown-fuse count and a TPM state read from off-die NV memory. During initialization, if the blown-fuse count is greater than a TPM state fuse count, a TPM state PIN-attempt-failure count is incremented, thereby thwarting a replay attack. If a PIN satisfies a PIN failure policy, and if a TPM state previously-passed-PIN indicator is set to true, a fuse is blown and the blown-fuse count incremented depending on the PIN being incorrect, but if the TPM state previously-passed-PIN indicator is set to false, a fuse is blown and the blown-fuse count incremented independent of whether the PIN is correct or incorrect. The TPM state fuse count is set equal to the blown-fuse count. If a counter cleared before processing the PIN remains cleared during the next initialization, a fuse voltage cut is detected and a penalty imposed.

Fuse based replay protection with dynamic fuse usage and countermeasures for fuse voltage cut attacks

A TPM with programmable fuses in an SOC includes an on-die RAM storing a blown-fuse count and a TPM state including a PIN-attempt-failure count and a fuse count, read from off-die NV memory. During initialization, if the blown-fuse count is greater than TPM state fuse count, TPM state PIN-attempt-failure count is incremented, thereby thwarting a replay attack. A PIN is received for access, and if the TPM state PIN-attempt-failure count satisfies a policy, a fuse is blown and the blown-fuse count incremented. If the fuse blow fails, TPM activity is halted. If the fuse blow succeeds and the PIN is correct, the TPM state PIN-attempt-failure count is cleared, but if the PIN is incorrect the TPM state PIN-attempt-failure count is incremented. TPM state fuse count is set equal to the blown-fuse count, and the TPM state is saved to off-die NV memory.

Fuse based replay protection with aggressive fuse usage and countermeasures for fuse voltage cut attacks

In at least some embodiments, a mechanism is provided for web developers to request specific default behaviors, such as touch behaviors, on their webpages. In at least some implementations, a Cascading Style Sheets (CSS) rule is utilized to enable or disable manipulations such as panning, pinch zoom, and double-tap-zoom manipulations. The mechanism can be extensible to accommodate additional default behaviors that are added in the future. In various embodiments, the behaviors are declared up front and thus differ from solutions which employ an imperative model. The declarative nature of this approach allows achievement of full independence from the main thread and deciding the correct response using independent hit testing.

Declarative style rules for default touch behaviors

In one or more embodiments, a hit test thread which is separate from the main thread, e.g. the user interface thread, is utilized for hit testing on web content. Using a separate thread for hit testing can allow targets to be quickly ascertained. In cases where the appropriate response is handled by a separate thread, such as a manipulation thread that can be used for touch manipulations such as panning and pinch zooming, manipulation can occur without blocking on the main thread. This results in the response time that is consistently quick even on low-end hardware over a variety of scenarios.

Independent hit testing

In at least some embodiments, a mechanism is provided for web developers to request specific default behaviors, such as touch behaviors, on their webpages. In at least some implementations, a Cascading Style Sheets (CSS) rule is utilized to enable or disable manipulations such as panning, pinch zoom, and double-tap-zoom manipulations. The mechanism can be extensible to accommodate additional default behaviors that are added in the future. In various embodiments, the behaviors are declared upfront and thus differ from solutions which employ an imperative model. The declarative nature of this approach allows achievement of full independence from the main thread and deciding the correct response using independent hit testing.

Growing community of inventors

Bellevue, WA, United States of America

Bradley Joseph Litterell