Intel Corporation

David Novick

Reuven Elbaum

Gyora M Benedek

Avinash Laxmisha Varna

Mark P Baldwin

Katalin Klara Bartfai-Walcott

Vasudevan Srinivasan

William A Stevens, Jr

Yaacov Belenky

Rameshkumar G Illikkal

Paritosh Saxena

Nicholas D Triantafillou

Chaim Shen-Orr

Paul J Thadikaran

Xiaoyu Ruan

Arkadiusz Berent

Carlos Carrizo

Yonatan Shlomovich

Vasuki Chilukuri

Naresh K Sehgal

Elad Peer

Bartosz Gotowalski

Krishna Surya

Terry Ryun Bradfield

Zhaorong Hou

Bryan Hunt

Michael Beale

Srinivas Sundaravaradan

Francisco M Casares

An apparatus is described including cryptography circuitry to generate authentication tags to provide integrity protection for plaintext and ciphertext.

Plaintext integrity protection mechanism

Methods, apparatus, systems and articles of manufacture (e.g., physical storage media) for software defined silicon security are disclosed. Example apparatus include a trusted agent determiner to (i) determine respective reputation scores associated with a plurality of agents in a mesh network, the plurality of agents associated with a plurality of semiconductor devices, respective ones of the semiconductor devices including circuitry configurable to provide one or more features, and (ii) select, based on the respective reputation scores, a first agent from the plurality of the agents to transmit a request to activate or deactivate at least one of the one or more features. Example apparatus also include an agent interface to, in response to the request, broadcast an activation or deactivation of the least one of the one or more features to the mesh network to cause the trusted agent determiner to update the reputation score of the first agent.

Systems, methods, and apparatus for software defined silicon security

The present disclosure is directed to systems and methods to protect against SCA and fault injection attacks through the use of a temporary or ephemeral key to cryptographically alter input data portions. Universal resistant block (URB) circuitry receives a seed data value and a at least one secret key data value and generates an ephemeral key output data value. Cryptographic circuitry uses the ephemeral key data value to transform an input data portion to produce an transformed output data portion. The use of an SCA or fault injection attack on the transformed output data portion will reveal only the ephemeral key data value and not the at least one secret key data value. Further, where a unique ephemeral key data value is used to transform each input data portion, an attacker cannot discover the ephemeral key in a piecemeal manner and must instead discover the complete ephemeral key data value&#x2014;significantly increasing the difficulty of performing a successful SCA or fault injection attack.

Circuits supporting improved side channel and fault injection attack resistance

Embodiments described herein enable independently recoverable security for processor and peripheral communication, enabling a processor without native non-volatile memory to generate and recover credentials in response to a firmware update. The processor and peripheral can each have credentials burned into secure fuses. The processor can derive a shared secret from the secure fuses using security attributes that are based on the security version number of firmware within the processor and the peripherals to which the processor is to security communicate. The processor and peripherals can generate ephemeral session keys from the shared secret and nonces. The ephemeral session keys can be used to secure communications between the processor and the peripherals.

Independently recoverable security for processor and peripheral communication

Systems, methods, and apparatus to configure embedded devices are described. An example apparatus includes a network interface to communicatively couple the apparatus with a network, an antenna to receive a radio frequency signal including 1) configuration data and 2) power, a memory coupled to the antenna to receive the power and to store the configuration data, a network configurer to retrieve the configuration data from the memory and to configure the network interface based on the retrieved data, and a power source other than the antenna to provide power to the memory and the network configurer during operation of the network configurer.

Systems, methods, and apparatus to configure embedded devices

Embodiments of systems, apparatuses, and methods to enable a value-added storage service of a storage system coupled to a client are described. In some embodiments, a system establishes a secure root of trust for the client. In addition, the system establishes a secure tunnel between an application of the client and a storage system of the client. Furthermore, the system securely downloads a license for the value-added storage service to the storage system and provides the license from the storage system to an application via the secure tunnel.

Activation and monetization of features built into storage subsystems using a trusted connect service back end infrastructure

Growing community of inventors

Beaverton, OR, United States of America

David Novick