Intel Corporation

Nds Corporation

Gyora M Benedek

Chaim Shen-Orr

Reuven Elbaum

Yaacov Belenky

David Novick

Hillel Michael Solow

Yossi Tsuria

Eliphaz Hibshoosh

Avinash Laxmisha Varna

Yonatan Shlomovich

Zvi Shkedy

Elad Peer

Omer Ben-Shalom

Jacob Doweck

Baruch Chaikin

Uri Bear

Dror Shilo

Arie Haenel

Dimitry Kloper

Yoni Wolf

Hila Yitzhaki

Ezra Caltum

Chaim Shen Orr

An apparatus is described including cryptography circuitry to generate authentication tags to provide integrity protection for plaintext and ciphertext.

Plaintext integrity protection mechanism

Various embodiments are generally directed to techniques for library behavior verification, such as by generating executables for software with indications of permitted behaviors by the library. Some embodiments are particularly directed to monitoring library behavior and performing one or more protective actions based on abnormal or unpermitted library behavior. In many embodiments, libraries and library manifests may be validated based on one or more signatures. In various embodiments, library behavior data comprising a set of permitted behaviors for the library may be determined based on the library manifest. In various such embodiments, a compiler may embed indications of the permitted library behavior in executables.

Techniques for library behavior verification

The present disclosure is directed to systems and methods to protect against SCA and fault injection attacks through the use of a temporary or ephemeral key to cryptographically alter input data portions. Universal resistant block (URB) circuitry receives a seed data value and a at least one secret key data value and generates an ephemeral key output data value. Cryptographic circuitry uses the ephemeral key data value to transform an input data portion to produce an transformed output data portion. The use of an SCA or fault injection attack on the transformed output data portion will reveal only the ephemeral key data value and not the at least one secret key data value. Further, where a unique ephemeral key data value is used to transform each input data portion, an attacker cannot discover the ephemeral key in a piecemeal manner and must instead discover the complete ephemeral key data value&#x2014;significantly increasing the difficulty of performing a successful SCA or fault injection attack.

Circuits supporting improved side channel and fault injection attack resistance

Various systems and methods for detecting and preventing side-channel attacks, including attacks aimed at discovering the location of KASLR-randomized privileged code sections in virtual memory address space, are described. In an example, a computing system includes electronic operations for detecting unauthorized attempts to access kernel virtual memory pages via trap entry detection, with operations including: generating a trap page with a physical memory address; assigning a phantom page at an open location in the privileged portion of the virtual memory address space; generating a plurality of phantom page table entries corresponding to an otherwise-unmapped privileged virtual memory region; placing the trap page in physical memory and placing the phantom page table entry in a page table map; and detecting an access to the trap page via the phantom page table entry, to trigger a response to a potential attack.

Mitigating attacks on kernel address space layout randomization

A system and a method for providing variable security mechanisms for securing digital content, in which a single security mechanism is not used for all content. Instead, at least one characteristic or feature of the security mechanism is varied between units, instances or categories of content. Therefore, even if unauthorized access is gained to a single unit of content, the overall integrity and security of the system for content distribution is not compromised. Preferably, security is provided though a general mechanism, which is then varied in order to provide variable, dissimilar security schemes for different types of content. By 'type of content', it is meant any of a single unit of content, a single instance of content or a single category of content. For example, for a category of content, the content may be characterized according to the identity of the content itself, such as the title of a movie for example, and/or according to the owner of a particular copy of the content. Thus, different security schemes may optionally and preferably be generated from a particular root structure. Related apparatus and methods are also provided.

Digital rights management system and method

A system and a method for providing variable security mechanisms for securing digital content, in which a single security mechanism is not used for all content. Instead, at least one characteristic or feature of the security mechanism is varied between units, instances or categories of content. Therefore, even if unauthorized access is gained to a single unit of content, the overall integrity and security of the system for content distribution is not compromised. Preferably, security is provided through a general mechanism, which is then varied in order to provide variable, dissimilar security schemes for different types of content. By 'type of content', it is meant any of a single unit of content, a single instance of content or a single category of content. For example, for a category of content, the content may be characterized according to the identity of the content itself, such as the title of a movie for example, and/or according to the owner of a particular copy of the content. Thus, different security schemes may optionally and preferably be generated from a particular root structure. Related apparatus and methods are also provided.

Growing community of inventors

Kiriat Bialik, Israel

Gyora M Benedek