Telefonaktiebolaget Lm Ericsson (publ)

St-ericsson Sa

Unwired Planet, LLC

Håkan Englund

Mats Näslund

Tommy Arngren

Bernard Smeets

Harald Gustafsson

Hervé Sibert

Thomas Johansson

Per Ståhl

Mattias Johansson

Daniel Bergström

Niklas Lindskog

Christoffer Jerkeby

Martin Hovang

Systems and methods are disclosed herein for protecting data in a storage device by encrypting or decrypting the data with a Data Encryption Key (DEK). The storage device is communicatively coupled to a host and is locked with the host by secret sharing. In one example, the storage device comprises a Physically Unclonable Function (PUF) configured to, during a key generation phase of operation, generate a set of DEK responses based on a set of DEK challenges (chalDEK) and an assembler configured to obtain a set of SED DEK secret shares (SS) based on the first set of DEK responses, receive additional data, and assemble at least the set of SED DEK secret shares (SS) and the additional data to create a DEK master secret. The storage device also comprises a crypto module configured to receive a DEK based on the master secret and perform encryption and/or decryption of data using the DEK.

Storage device utilizing physically unclonable function (PUF) based secret sharing scheme for data encryption/decryption

A security component () for a device () is disclosed. The security component comprises a Physically Unclonable Function (PUF) () that is operable to accept a plurality of challenges and to generate a corresponding plurality of responses. The security component further comprises control logic () configured to generate a challenge for submission to the PUF on the basis of at least one of measurements of components booted on the device or a measurement of a hardware state of the device. The PUF comprises a plurality of sub functions (), and the challenge determines how the sub functions are used by the PUF to generate a PUF response. Also disclosed is a method () for operating a security component.

Security component having physically unclonable function (PUF) and method of operation

A security component () for a device () is disclosed. The security component () comprises a Physically Unclonable Function (PUF) () having a plurality of sub functions (), and a management module () that is configured to manage the PUF () in accordance with a policy. The management module () comprises a measurement module () configured to receive, from a device boot process, at least one of a measurement of a component on the device or a measurement of a hardware state of the device, and a rule module () configured to compare the received measurement to at least one rule that implements the policy, and to enter a policy state on the basis of the comparison. The management module further comprises a control module () configured to configure the PUF () in accordance with a policy state entered by the rule module. Also disclosed is a method () for operating a security component.

Security component and method of operation

There is provided a verifiable OTP memory device, the memory device including an MTP memory block and an OTP memory block for storing data, and a memory controller. The memory controller is configured to handle write requests and read requests. Each write request and read request pertains to writing data to, and reading data from, respectively, a requested position in either the MTP memory block or the OTP memory block. The memory controller is configured to, in response to the write requests, write the data to the requested position in either the MTP memory block or the OTP memory block. The memory controller is configured to, in response to the read requests, output data as combined from the requested position in the MTP memory block and the requested position in the OTP memory block, regardless if the read requests are for the MTP memory block or the OTP memory block.

Verifiable one-time programmable memory device

There is provided mechanisms for authenticating an OEM entity as manufacturer of a communication device comprising an identification module. A method is performed by a network entity. The method comprises providing, towards tire identification module, a challenge of a challenge-response authentication procedure. The method comprises obtaining, from the identification module, a first response of the challenge-response authentication procedure. The method comprises providing, towards the OEM entity and upon having obtained the response, the challenge. The method comprises obtaining, from the OEM entity, a second response of the challenge-response authentication procedure. The method comprises authenticating the OEM entity as the manufacturer of the communication device only when the second response matches the first response.

Authentication of an original equipment manufacturer entity

A method and a corresponding runtime environment for migrating an instance of an actor of an application are provided. An initiating runtime environment performs a method comprising selecting, based on obtained security attributes for a set of target runtime environments, a target runtime environment from the set of target runtime environments for migration of the instance of the actor. The method comprises migrating the instance of the actor to the selected target runtime environment once the target runtime environment has been selected.

Actor migration

A method () performed in an initiating runtime () is disclosed for migrating an actor instance () of an actor () to a target runtime (). The method () comprises obtaining (), from a blockchain entity (), an ownership token associated with the actor instance () of the actor (), the ownership token being verifiable by a blockchain () of the blockchain entity (), and using () the ownership token for migrating the actor instance (). A method in a blockchain entity (), a method in a target runtime (), entities, computer programs and computer program products are also disclosed.

Method for migrating an actor instance

An exemplary method of maintaining secure time in a computing device is disclosed in which one or more processors implements a Rich Execution Environment (REE), and a separate Trusted Execution Environment (TEE). The TEE maintains a real-time clock (RTC) that provides a RTC time to the REE. A RTC offset is stored in non-volatile memory, with the RTC offset indicating a difference between the RTC time and a protected reference (PR) time. Responsive to a request from the REE to read the RTC time, a current RTC time is returned to the REE. Responsive to a request from the REE to adjust the RTC time, the RTC time and the corresponding RTC offset are adjusted by a same amount, such that the PR time is not altered by the RTC adjustment. An exemplary computing device operable to implement the method is also disclosed.

Method and apparatus for maintaining secure time

A Mobile Station (MS), a Base Station System (BSS) and a Mobile Switching Center (MSC) of a cellular network, such as GSM, are disclosed. According to one embodiment, the MS is arranged to carry out one or more security features in its communication with the network. For example, the MS may be arranged to: &#x2022; by means of information received in a signalling message () from the network, discover if the network supports one or more of said security features, &#x2022; exchange information with the network in order to enable the use of one or more of the above-mentioned supported security features in the communication, &#x2022; carry out at least one of the one or more of the supported security features in the communication with the network.

Security feature negotiation between network and user terminal

A system, method, and owner node for securely changing a mobile device from an old owner to a new owner, or from an old operator network to a new operator network. The old owner initiates the change of owner or operator. The old owner or operator then commands the mobile device to change a currently active first key to a second key. The second key is then transferred to the new owner or operator. The new owner or operator then commands the mobile device to change the second key to a third key for use between the mobile device and the new owner or operator. Upon completion of the change, the new owner or operator does not know the first key in use before the change, and the old owner does not know the third key in use after the change.

Growing community of inventors

Lund, Sweden

Håkan Englund