Apple Inc.

St-ericsson Sa

France Telecom

St-ericsson (france) Sas

Stmicroelectronics S.a.

Stmicroelectronics International N.v.

Université De Caen Basse Normandie

Orange

St-ericsson (grenoble) Sas

Oct Circuit Technologies International Limited

Hervé Sibert

Oren M Elrad

Jerrold Von Hauck

Onur E Tackin

Matthias Lerch

Zachary A Rosen

Yannick L Sierra

Ahmer Ali Khan

Marc Girault

Aline Gouget

Per Ståhl

Sudhakar N Mambakkam

Eric Daniel Friedman

Nicolas Anquet

Franck Farian Rakotomalala

Sylviane Roullier

Daniel Ben Pollack

Indranil S Sen

Gianpaolo Fasoli

Peng Liu

Timothy R Paaske

Gokul P Thirumalai

Julien F Freudiger

Alejandro J Marquez

Thomas P Mensch

Sébastien Canard

Erik C Neuenschwander

Loic Pallardy

Hannah S Story

Raman S Thiara

Håkan Englund

David P Remahl

David Picquenot

Ryan W Baker

Ramiro Calvo

Robert D Butler

Rahul Narayan Singh

Jonathon Sodos

Onar Vikingstad

David G Knipp

Max M Gunther

Jocelyn Leheup

Ahmad Saif

Valere Delong

Isabella M Funke

Michel Catrouillet

Martin Hovang

Pierre Ansel

Roderick Asselineau

Pascal Marty

Benoît Calmels

Jean-Francois Misarsky

Patrick Dehornoy

Alan W Yu

Eric Kar Wai Tong

Frank B Dancs

Techniques are disclosed relating to secure data storage. In various embodiments, a mobile device includes a wireless interface, a secure element, and a secure circuit. The secure element is configured to store confidential information associated with a plurality of users and to receive a request to communicate the confidential information associated with a particular one of the plurality of users. The secure element is further configured to communicate, via the wireless interface, the confidential information associated with the particular user in response to an authentication of the particular user. The secure circuit is configured to perform the authentication of the particular user. In some embodiments, the mobile device also includes a biosensor configured to collect biometric information from a user of the mobile device. In such an embodiment, the secure circuit is configured to store biometric information collected from the plurality of users by the biosensor.

Secure element having multiple CRS applets

This application relates to establishing a communication session between a host device and a trusted client device. A host device generates a one-time secret (OTS) and transmits the OTS to a trusted client device via an out-of-band communication channel. The trusted client device verifies an identity of a user of the trusted client device utilizing one or more sensors of the trusted client device. Responsive to verifying the identity of the user, the trusted client device negotiates an encryption key with the host device based on the OTS. The trusted client device then establishes a communication session with the host device utilizing the encryption key. The communication session can be utilized to pass credentials in a protected manner from the trusted client device to the host device that enable the host device to access a user account associated with a service.

Techniques for signing into a user account using a trusted client device

Certain embodiments disclosed herein provide attestation for a transient version of an application while reusing the attestation and the cryptographic key on which the attestation is based for the full version of the application should the user obtain the full version of the application prior to the transient version being deleted. As an example, a computing device can detect an upgrade event corresponding to replacing an application clip with the full version of the application, and associate the cryptographic key already stored in a key database with the full version of the application. Associating the existing key with the full version of the application enables the full application to automatically take over the attestation previously provided for the application clip, saving time and resources that would otherwise be used for establishing a new attestation for the full version of the application.

Integrity attestation for application clips

Techniques are disclosed relating to application verification. In various embodiments, a computing device includes a secure circuit configured to maintain a plurality of cryptographic keys of the computing device. In such an embodiment, the computing device receives, from an application, a request for an attestation usable to confirm an integrity of the application, instructs the secure circuit to use one of the plurality of cryptographic keys to supply the attestation for the application, and provides the attestation to a remote computing system in communication with the application. In some embodiments, the secure circuit is configured to verify received metadata pertaining to the identity of the application and use the cryptographic key to generate the attestation indicative of the identity of the application.

Application integrity attestation

Secure element having multiple users

Techniques are disclosed relating to authenticate a user with a mobile device. In one embodiment, a computing device includes a short-range radio and a secure element. The computing device reads, via the short-range radio, a portion of credential information stored in a circuit embedded in an identification document issued by an authority to a user for establishing an identity of the user. The computing device issues, to the authority, a request to store the credential information, the request specifying the portion of the credential information. In response to an approval of the request, the computing device stores the credential information in the secure element, the credential information being usable to establish the identity of the user. In some embodiments, the identification document is a passport that includes a radio-frequency identification (RFID) circuit storing the credential information, and the request specifies a passport number read from the RFID circuit.

Document importation into secure element

A secure ranging system can use a secure processing system to deliver one or more ranging keys to a ranging radio on a device, and the ranging radio can derive locally at the system ranging codes based on the ranging keys. A deterministic random number generator can derive the ranging codes using the ranging key and one or more session parameters, and each device (e.g. a cellular telephone and another device) can independently derive the ranging codes and derive them contemporaneously with their use in ranging operations.

Methods and architectures for secure ranging

Implementations of the subject technology provide for performing, by a device, a request for obtaining information related to a phone authentication certificate (PAC) that was generated for the device, the PAC authenticating that a particular phone number is associated with the device, the request including packets of data. The subject technology receives the information related to the PAC, the information including an indication that the PAC was generated for the device. The subject technology sends, from the device, a request for validating the PAC to a remote server based at least in part on the information related to the PAC. Further, the subject technology receives a confirmation of validating the PAC from the remote server based at least in part on the information related to the PAC.

Two-factor device authentication

Systems, methods, and computer-readable media for preserving trust data during operating system updates of a secure element of an electronic device are provide. An update package is received to update an existing secure element operating system to a new secure element operating system by exporting trust data from the existing secure element operating system, after the exporting, uninstalling the existing secure element operating system, migrating the exported trust data using a migration operating system when a data format version of the existing secure element operating system is different than a data format version of the new secure element operating system, installing the new secure element operating system, and importing the migrated trust data into the installed new secure element operating system.

Preserving trust data during operating system updates of a secure element of an electronic device

A signal is protected against an attack by an enhancement process that checks the conformity of an actual state of the signal with respect to an expected state. A protective action is exercised on the signal if the actual state of the signal is not in conformity with the expected state, so as to neutralize or nullify said attack.

Method and device for enhancing the protection of a signal, in particular a multimedia signal, against a malicious attack

A memory management unit (MMU) may manage address translations. The MMU may obtain a first intermediate physical address (IPA) based on a first virtual address (VA) relating to a first memory access request. The MMU may identify, based on the first IPA, a first memory page entry in a second address translation table. The MMU may store, in a second cache memory, a first IPA-to-PA translation based on the identified first memory page entry. The MMU may store, in the second cache memory and in response to the identification of the first memory page entry, one or more additional IPA-to-PA translations that are based on corresponding one or more additional memory page entries in the second address translation table. The one or more additional memory page entries may be contiguous to the first memory page entry.

Method in a memory management unit for managing address translations in two stages

A method is provided for managing public and private data input by a device such as a mobile handset, a personal digital assistant, a personal computer and an electronic tablet. Method provides for separating public and private data such that public data can be operated on by open operating system and private data is either encrypted while in the open operating environment but can be operated on and used when received by the secure operating environment.

Method for managing public and private data input at a device

An exemplary method of maintaining secure time in a computing device is disclosed in which one or more processors implements a Rich Execution Environment (REE), and a separate Trusted Execution Environment (TEE). The TEE maintains a real-time clock (RTC) that provides a RTC time to the REE. A RTC offset is stored in non-volatile memory, with the RTC offset indicating a difference between the RTC time and a protected reference (PR) time. Responsive to a request from the REE to read the RTC time, a current RTC time is returned to the REE. Responsive to a request from the REE to adjust the RTC time, the RTC time and the corresponding RTC offset are adjusted by a same amount, such that the PR time is not altered by the RTC adjustment. An exemplary computing device operable to implement the method is also disclosed.

Method and apparatus for maintaining secure time

Growing community of inventors

Le Mans, France

Hervé Sibert