Cryptography Research, Inc.

Rambus Inc.

Intrinsic Id B.v.

Helena Handschuh

Mark Evan Marson

Scott C Best

Winthrop Wu

Paul Carl Kocher

Michael Alexander Hamburg

John Eric Linstadt

Evan Lawrence Erickson

Geert Jan Schrijen

Torsten Partsch

Philippe Alain Martineau

Ambuj Kumar

Pim Theo Tuyls

Matthew Evan Orzen

William Craig Rawlings

Erik Van Der Sluis

Michael Hutter

Disclosed systems and techniques involve low-latency multi-key encryption processing in which block keys are precomputed based on multiple cryptographic keys, stored, and then selected for encryption or decryption of data during run-time cryptographic operations. The block keys may be precomputed, for each cryptographic key, in such quantities that allow uninterrupted flow of encryption or decryption operations. Replacement block keys may be concurrently generated to replace the blocks being consumed and authentication values may be computed or updated. Various described techniques allow parallel processing for efficient low-latency block key generation and cryptographic operations.

Low-latency multi-key encryption and decryption engine and techniques

Aspects of the present disclosure involve a method and a system to perform the method to obtain a cryptographic output of a plurality of rounds of a cipher, by performing a plurality of modified rounds of the cipher, each of the modified rounds computing an unmasking transform, an operation of a respective round of the cipher, and a masking transform, the unmasking transform being an inverse of the masking transform of a previous round of the cipher.

Protection of cryptographic substitution-permutation networks from fault injection attacks

Technologies for modal encryption are described. One memory buffer device includes a compression block and an in-line memory encryption (IME) block. The compression block can output compressed data. The IME block can encrypt uncompressed data at a first granularity and encrypt the compressed data at a second granularity, wherein the second granularity is larger than the first granularity.

Memory buffer devices with modal encryption

A value corresponding to a physical variation of a device may be received. Furthermore, helper data associated with the physical variation of the device may be received. A result data may be generated based on a combination of the value corresponding to the physical variation of the device and the helper data. An error correction operation may be performed on the result data to identify one or more code words associated with the error correction operation. Subsequently, a target data may be generated based on the one or more code words.

Generating a target data based on a function associated with a physical variation of a device

Aspects of the present disclosure involve implementations that may be used to protect neural network models against adversarial attacks by obfuscating neural network operations and architecture. Obfuscation techniques include obfuscating weights and biases of neural network nodes, obfuscating activation functions used by neural networks, as well as obfuscating neural network architecture by introducing dummy operations, dummy nodes, and dummy layers into the neural networks.

Protection of neural networks by obfuscation of neural network operations and architecture

Aspects of the present disclosure involve a method and a system to perform a cryptographic operation that involves a number theoretic transformation of a first vector to a second vector by obtaining components of the first vector, performing a plurality of iterations that each include determining a plurality of output values, wherein each of the plurality of output values is a linear combination of two or more input values, the input values into a first iteration being the components of the first vector and the output values of the last iteration being representative of components of the second vector, and wherein one or more of the output values of at least one iteration are randomized by multiplying at least one input value by a random number, and determining, based on the output values of the last of the plurality of iterations, the components of the second vector.

Protection of transformations by intermediate randomization in cryptographic operations

Described herein are technologies for application authentication and/or data encryption without stored pre-shared keys. In one resource controller, a processing device receives an application identifier (ID) from the application. The processing device provides a current nonce responsive to the application ID and provides the application access to the system resource responsive to determining that a hash of a current key received from the application equals a current tag. The current key is generated by the application based on code of the application and the current nonce. The current tag was previously provided from the application to the resource controller. The current tag can also be hashed by the application using the current key.

Application authentication and data encryption without stored pre-shared keys

Hardware masking may be used as a countermeasure to make power analysis attacks more difficult. Masking attempts to decouple the secret and/or processed values of a cryptographic algorithm from its intermediate values. One method of masking probabilistically splits each bit of a computation into multiple shares. Mask-share domains (i.e., the wires and gates that perform a computation on a share) are physically spaced to reduce coupling between mask-share domains. The mask-share domains may be connected to the same power supply network. The physical distance between mask-share domains along the power-supply network may be selected to reduce coupling between mask-share domains that may occur via the power supply network. The mask-share domains may each be connected to different on-chip power supply networks.

Share domain arrangements for masked hardware implementations

Protection of neural networks by obfuscation of activation functions

Protection of neural networks by obfuscation of neural network architecture

An indication of a key generation function may be received from a server. A random value may be received based on a volatile memory of a device. A cryptographic key may be generated based on the key generation function from the server and the random value that is based on the volatile memory of the device. The cryptographic key may be stored at a non-volatile memory of the device.

Generating a key at a device based on a memory of the device

A block of dynamic memory in a DRAM device is organized to share a common set of bitlines may be erased/destroyed/randomized by concurrently activating multiple (or all) of the wordlines of the block. The data held in the sense amplifiers and cells of an active wordline may be erased by precharging the sense amplifiers and then writing precharge voltages into the cells of the open row. Rows are selectively configured to either be refreshed or not refreshed. The rows that are not refreshed will, after a time, lose their contents thereby reducing the time interval for attack. An external signal can cause the isolation of a memory device or module and initiation of automatic erasure of the memory contents of the device or module using one of the methods disclosed herein. The trigger for the external signal may be one or more of temperature changes/conditions, loss of power, and/or external commands from a controller.

Data destruction

DRAM security erase

An encrypted sequence that includes an authentication key may be received. A base key stored at a device may be identified and the encrypted sequence may be decrypted with the base key to obtain the authentication key. A challenge value may be received and the authentication key may be combined with the challenge value to generate a device ephemeral key. An authentication result may be generated for the device based on a combination of the device ephemeral key and the challenge value. Furthermore, the authentication result may be transmitted to a mobile network to authenticate the device.

Growing community of inventors

Palo Alto, CA, United States of America

Helena Handschuh