Intel Corporation

Derek L Davis

Howard C Herbert

Jean-Charles Korta

Lionel S Smith

Ashutosh J Bakhle

Lawrence T Clark

Peter D Jones

Pranav H Mehta

David J Shield

William J Spaw

Shawn C Beckman

An electronic system and method for providing secure communications between devices. The secure communications are maintained through use of an integrity check value (ICV) that accompanies a message. The ICV is used to determine whether the contents of a message have been modified during transmission. An efficient technique for producing the ICV involves bitwise arithmetic operations and 'exclusive OR' operations between data associated with the message (in its non-encrypted format) and coefficients of a matrix. The 'coefficients' are selected bits from a pseudo-random data stream created by a cipher engine from keying material used in communications between the devices.

Circuit and method for providing secure communications between devices

A cryptographic device formed as an integrated circuit encapsulated in an integrated circuit package. The cryptographic device decrypts information having a first encrypted format that is input into the cryptographic device producing information in a non-encrypted format. The information in the non-encrypted format is subsequently re-encrypted into a second encrypted format which is output from the cryptographic device. The decryption and re-encryption operations are accomplished entirely within the cryptographic device.

Apparatus and method for re-encrypting data without unsecured exposure of its non-encrypted format

A method and system for maintaining integrity and confidentiality of pages paged to an external storage unit from a physically secure environment. An outgoing page is selected to be exported from a physically secure environment to an insecure environment. An integrity check value is generated and stored for the outgoing page. In one embodiment, this takes the form of taking a one-way hash of the page using a well-known one-way hash function. The outgoing page is then encrypted using a cryptographically strong encryption algorithm. Among the algorithms that might be used in one embodiment of the invention are IDEA and DES. The encrypted outgoing page is then exported to the external storage. By virtue of the encryption and integrity check, the security of the data on the outgoing page is maintained in the insecure environment.

Cryptographically protected paging system

In one embodiment, a method is described to secure transfer data from one location to another for storage in an electronic component. The transfer occurs with part of the data routed to a first destination and the remaining data routed to a second destination. The data routed to the first destination is for securely loading a current sort encrypted key (SEK) and a next SEK into memory of the electronic component. The data routed to the second destination includes a private key which is recovered using the current SEK and the next SEK.

Method for secure distribution and configuration of asymmetric keying material into semiconductor devices

A cryptography unit having a cipher unit and a hash unit coupled in parallel for simultaneous ciphering and hashing. The cipher unit implements a cipher algorithm that operates on a data block having a first predetermined size M. The hash unit implements a hash algorithm on a data block having a second predetermined size N. Buffers of a size Q, where Q is an integer multiple of M and N, are employed to receive the input data into the present invention. A security unit that ensures that the cipher unit and the hash unit operate on the same data block of size Q is also provided.

Method and apparatus for integrated ciphering and hashing

A platform and a corresponding method for protecting the integrity of data transferred between the user input device and a secure processing unit. In one embodiment, this can be accomplished by establishing a virtual secure path between a device controller of the user input device and the secure processing unit. Thereafter, when sensitive information is input by the user via the user input device, the device controller is placed in a first mode of operation to securely transfer the sensitive information from the user input device to the secure processing unit over the virtual secure path. Additionally, a security indicator is placed in an Active state to indicate to the user that the sensitive information is being securely transferred to the secure processing unit.

Platform and method for securing data provided through a user input device

Cryptographically protected paging subsystem

A Basic Input/Output System (BIOS) device is designed to control access to a portion of BIOS code loaded in its internal memory. For example, during a boot process, an internal state machine permits access to the portion of the BIOS code in response to authentication of a portable token in communication with the BIOS device. Otherwise, the BIOS device precludes access to the portion of the BIOS code until the portable token is authenticated.

Electronic system and method for controlling access through user authentication

A cryptographic device comprising a processing logic and memory associated with the processing logic. The memory is loaded with a first segment of code to control execution of cryptographic functions and hash functions, and a second segment of code to perform cryptographic functions on behalf of a third party having no physical control of hardware employing the cryptographic device.

Platform and method for assuring integrity of trusted agent communications

A cryptographic device is implemented in communication with a host processor to prevent the host processor from performing a standard boot-up procedure until a basic input output system (BIOS) code is authenticated. This is accomplished by a cryptographic device which is addressed by the host processor during execution of a first instruction following a power-up reset. The cryptographic device includes a first integrated circuit (IC) device and a second IC device. The first IC device includes a memory to contain firmware and a root certification key. The second IC device includes logic circuitry to execute a software code to authenticate the BIOS code before permitting execution of the BIOS code by the host processor.

Method for BIOS authentication prior to BIOS execution

An anonymity system including a cryptographic device. The cryptographic device of the anonymity system is adapted to initially determine whether a response to an incoming electronic message is requested. If so, an address of the anonymity system is encrypted with a key. In one embodiment, the key may be a public key of a system targeted to receive an outgoing electronic message from the anonymity system inclusive of data contained in the incoming electronic message. The encrypted address is placed into an outgoing electronic message before re-routing to the target system to allow the target system to re-route the response back to the anonymity system.

Anonymity server

The system and method to protect integrity of a data set during post-processing operations. In general, integrity is protected by operations performed by a manipulation agent including a processor connected to dedicated memory. The operations of the manipulation agent include at least providing a data set and recording characteristics of each post-processing operation into the data set. The data set includes data and a record. The record includes a number of entries (fields) to contain the various characteristics of a post-processing operation such as an incoming hash value of the data, an extended digital signature, and the like.

System and method for ensuring integrity throughout post-processing

In one embodiment, a method to provide reliable electronic distribution of information between a first system and a second system remotely located from the first system coupled together by a communication link. The method comprises storing a public key, a private key, and signed key parameters in a semiconductor device associated with the first system. The signed key parameters are output from the semiconductor device to the second system via the communication link. Then, the first system is authenticated by the second system; and the information is transmitted from the second system to the first system, provided the first system is authenticated.

Apparatus and method for providing secured communications

A cryptographic device and corresponding method for producing a cloaked watermark which is a private watermark having the functionality of a public watermark. In one embodiment, the cryptographic device comprises an internal memory and a processor contained in a package. The internal memory provides a region for storage of key information used at least to produce the cloaked watermark. The processor is coupled to the internal memory and is responsible for producing a cloaked watermark based on the key and for inserting the cloaked watermark into an outgoing data set.

Growing community of inventors

Phoenix, AZ, United States of America

Derek L Davis