Arm Limited

Trustonic Limited

Donald Kenneth Felton

Daniel Kershaw

James Ian McNiven

Daren Croxford

Jan-Erik Gustav Ekberg

Dominic Hugo Symes

Andrew Brookfield Swaine

Stuart David Biles

Sachin Satish Idgunji

Richard Hayton

Emre Özer

Nigel C Paver

Ola Hugosson

Sean Tristram Ellis

Peter William Harris

Chris Loreskar

Ashley Miles Stevens

Peter Brian Wilson

George James Milne

Robert John Brown

Anthony Paul Thompson

A method for validating an electronic device 2 includes receiving attestation information provided by the electronic device 2 attesting that the electronic device 2 has received a plurality of event attestations. Each event attestation provides a cryptographically authenticated attestation to the occurrence of a respective event during a lifecycle of the electronic device. A validation result is determined that indicates whether the attestation information is valid. Providing separate cryptographically authenticated attestations for respective events in the lifecycle of the device can simplify manufacturing of the devices in a multistage manufacture process compared to an approach using a single device-specific attestation attesting that the entire process is trusted.

Event attestation for an electronic device

A device has an installed cryptographic program that performs cryptographic operations in dependence upon a received diversification value. The diversification value is generated by an obfuscated personalisation program installed in the device and is dependent upon a personalisation input to the personalisation program. The personalisation input is characteristic of the particular execution environment provided by the device, and may take the form of a proper subset selected from among variables characterising the device, such as hardware properties, static software configuration and results from processing dynamic variables to check that they have expected properties. The diversification value generated by the personalisation program is returned (in encrypted form) to a server which also has a copy of the cryptographic program. Thus, the server and the device may communicate using a secure channel provided by the combination of the cryptographic program and the diversification value. The personalisation program installed may be obfuscated by code flattening, reordering and variable fragmentation.

Cryptographic program diversification

An apparatus comprises a dynamic random-access memory (DRAM) for storing data. Refresh control circuitry is provided to control the DRAM to periodically perform a refresh cycle for refreshing the data stored in each memory location of the DRAM. A refresh address sequence generator generates a refresh address sequence of addresses identifying the order in which memory locations of the DRAM are refreshed during the refresh cycle. To deter differential power analysis attacks on secure data stored in the DRAM, the refresh address sequence is generated with the addresses of at least a portion of the memory locations in a random order which varies from refresh cycle to refresh cycle.

Apparatus and method for controlling refreshing of data in a DRAM

A data processing apparatus and method are provided for managing access to content within the data processing apparatus. The data processing apparatus has a secure domain and a non-secure domain and comprises at least one device which is operable when seeking to access content stored in memory to issue a memory access request pertaining to either the secure domain or the non-secure domain. Further, writeable memory is provided which can store content required by the at least one device, with the writeable memory having at least one read only region whose content is stored therein under control of a secure task, the secure task being a task executed by one of the devices in the secure domain. Protection logic is then used in association with the writeable memory, which on receipt of a memory access request seeking to access content in the at least one read only region, prevents access to that read only region if that memory access request pertains to the non-secure domain and is seeking to write content to the read only region. This enables the speed, power and flexibility benefits of placing content in writeable memory to be achieved without prejudicing the security of that content, by ensuring that that content cannot be modified from the non-secure domain.

Managing access to content in a data processing apparatus

A data processing apparatus comprises a primary processor, a secondary processor configured to perform secure data processing operations and non-secure data processing operations and a memory configured to store secure data used by the secondary processor when performing the secure data processing operations and configured to store non-secure data used by the secondary processor when performing the non-secure data processing operations, wherein the secure data cannot be accessed by the non-secure data processing operations, wherein the secondary processor comprises a memory management unit configured to administer accesses to the memory from the secondary processor, the memory management unit configured to perform translations between virtual memory addresses used by the secondary processor and physical memory addresses used by the memory, wherein the translations are configured in dependence on a page table base address, the page table base address identifying a storage location in the memory of a set of descriptors defining the translations, wherein the page table base address is defined by the primary processor and cannot be amended by the secondary processor.

Management of data processing security in a secondary processor

A data processing apparatus and a method of indicating operation of a data processor within a secure domain. The apparatus comprising a display for displaying data; a processor operable in a secure domain, said processor when operating in said secure domain having access to a user specific image; wherein said processor is operable to indicate operation within said secure domain by displaying said user specific image on at least a portion of said display when operating within said secure domain.

Secure operation indicator

A data processing device is provided with a processor corethat can operate in either a secure domain or a non-secure domain. Data stored within a secure regionof a memorycan only be accessed when the processor coreis executing in the secure domain. A frame bufferfor storing a display imageto be displayed is stored within a non-secure region of memory which can be accessed by the processor coreirrespective of whether it is in the secure domain or the non-secure domain as well as a display controller. When a subject imageis written to the frame buffer, validation data for the subject imageis stored within the secure region. When a user input is received the displayed data stored at a validated display area to which the subject image was written is read back and used to generate check data with is compared with the validation data before the user input is authenticated.

Security provision for a subject image displayed in a non-secure domain

A handheld devicegenerates a verification image to indicate that the device is operating in a secure domain. The verification image is generated in dependence upon secure data stored within a secure regionof a memoryand user input data captured from a user input device. The secure data may be data defining a three-dimensional object. The user image data may be captured from accelerometersdefining a viewpoint of the secret three-dimensional object.

Display of a verification image to confirm security

A data processor for processing data in a secure mode having access to secure data that is not accessible to the data processor when processing data in the non-secure mode. A further processing device for performing a task in response to a request from the data processor issued from the non-secure mode. The further processing device including a secure data store not accessible to processes running on the data processor when in the non-secure mode. Prior to issuing requests, the data processor in the secure mode performs a set up operation on the further data processing device storing secure data in the secure data store. In response to receipt of the request from the data processor operating in the non-secure mode, the further data processing device performs the task using data stored in the secure data store to access any secure data required.

Providing secure services to a non-secure application

A data processing system is provided with at least one processor, a main memoryand a cache memory. Cache data within the cache memoryhas validity data V and control data associated therewith. The control data controls access to the cached data. Program instructions executed by the processorscontrol a cache controllerto modify the control data associated with the cached data while it remains stored within the cache memoryand remains valid. The control data may, for example, specify a security flags indicating whether access is restricted to secure processes or processors.

Control data modification within a cache memory

A data processing apparatus and method are provided for controlling access to memory. The data processing apparatus comprises main processing logic operable to execute a sequence of instructions in order to perform a process, and subsidiary processing logic operable to perform at least part of the process on behalf of the main processing logic. A memory is provided that is accessible by the main processing logic when performing the process, the main processing logic defining a portion of the memory to be allocated memory accessible to the subsidiary processing logic when performing part of the process on behalf of the main processing logic. Further, a memory management unit is provided that is programmable by the main processing logic and operable to control access to the allocated memory by the subsidiary processing logic. The main processing logic is arranged to program the memory management unit such that for an access request issued by the subsidiary processing logic relating to the allocated memory, the memory management unit produces a memory address and one or more associated memory attributes identifying one or more properties of the allocated memory at that memory address.

Data processing apparatus and method for controlling access to memory

Test access to an integrated circuitis controlled by the use of test access enabling keys. A plurality of different test access enabling levels may be supported corresponding to different keys. The test access control may be performed by dedicated hardware or software executing a secure privilege mode.

Growing community of inventors

Ely, United Kingdom

Donald Kenneth Felton