Google Inc.

Cryptography Research, Inc.

Christopher Gori

Timothy Jay Chen

Eunchan Kim

Michael Stefano Fritz Schaffner

Pankaj Rohatgi

Ziv Hershman

Miguel Angel Osorio

Craig Edward Hampel

Paul Carl Kocher

Ambuj Kumar

Scott David Johnson

Andrew John Leiserson

Jean-Michel Cioranesco

Daniel Robert Beitel

Guilherme Ozari De Almeida

Rodrigo Portella Do Canto

Pirmin Robert Vogel

Lauren Gao

Gregory Andrew Chadwick

Philipp Wagner

Rupert James Swarbrick

This document discloses techniques, apparatuses, and systems for sparse encodings for control signals. Integrated circuits (ICs) may transmit various signals to manage interactions between circuit components of the IC. These critical signals are common targets for malicious attacks because, when altered, they can cause the IC to perform differently than is intended, and in some cases, bypass security measures. To protect against these attacks, the sparse encodings for control signals described herein transmit critical signals with sparse encodings. Further, multiple rails may be used to transmit a single bit of the sparsely encoded critical signals across each rail. In this way, the techniques described herein may provide a scalable solution that may be adjusted differently based on each implementation.

Sparse encodings for control signals

An IC chip can provide silicon root of trust (RoT) functionality. In described implementations, the IC chip includes a processor, an alert handler, and multiple peripheral devices, which generate alert indications. The alert handler processes the alert indications, which have security implications. The alert handler includes multiple alert receiver modules to communicate with the multiple peripheral devices. The alert handler also includes a controller, multiple accumulation units, multiple escalation timers, and multiple escalation sender modules. These components can be organized into a hierarchy of increasing escalation severity. In operation, the controller classifies an alert and flexibly implements an adaptable alert handler path that is established through the escalation components responsive to the classification and based on a source of the alert. A path can conclude with an escalation sender module commanding an escalation handler to implement a security countermeasure. The flexible paths can therefore handle different types of alerts.

Alert handling

This document includes techniques, apparatuses, and systems related to an interface for revision-limited memory, which can improve various computing aspects and performance. In aspects, confidentiality, integrity, and availability may be ensured while increasing the performance of revision-limited memory. In this example, the techniques also enable the digital computing device to interact with information related to the revision-limited memory.

Interface for revision-limited memory

Input signals may be received. Furthermore, a control signal controlling the implementation of a Differential Power Analysis (DPA) countermeasure may be received. One of the input signals may be transmitted as an output signal based on the control signal. A cryptographic operation may be performed based on the first output signal that is transmitted based on the control signal.

Configuring a device based on a DPA countermeasure

Systems and methods for implementing access control by systems-on-chip (SoCs). An example SoC may comprise an access control unit employed to: receive a message comprising an access control data item; validate the message using a value of a message digest function of contents of the message and a value of a state variable reflecting a state of communications between the access control unit and a programming agent that has initiated the message, wherein the value of the state variable is derived from a previous value of the message digest function calculated within a current communication session between the access control unit and the programming agent; update the state variable using the value of the message digest function of the contents of the message; and control, using the access control data item, access by an initiator device to a target device.

Implementing access control by system-on-chip

A computing device receives a feature name or key name for an integrated circuit comprising a security manager core and an additional component. At least one of a) the additional component is associated with the key name or b) a feature provided by the additional component is associated with the feature name. The computing device receives a specified number of bits associated with the feature name or the key name, and maps the feature name to a feature address space or the key name to a key interface of the security manager core based at on the specified number of bits. The computing device generates at least one hardware description logic (HDL) module based on the mapping, wherein the at least one HDL module is usable to configure the security manager core for delivery of payloads associated with the feature name or the key name to the additional component.

Configurator for secure feature and key manager

Growing community of inventors

San Francisco, CA, United States of America

Christopher Gori