Crypto4a Technologies Inc.

Ati Technologies Ulc

Mosaid Technologies Corporation

Advanced Micro Devices Corporation

Ciypto4a Technologies Inc.

James Ross Goodman

Bruno Couillard

Bradley Clare Ritchie

Jean-Pierre Fiset

Collis Quinn Carter

Nicholas J Chorney

David A Kaplan

Winthrop Wu

Creighton Eldridge

Martin Kiernicki

Yoichi Shimokawa

William Thomas Morrison

Described are various embodiments of a digital data comparison filter, system and method, and applications therefor. In one embodiment, a digital data comparator system comprises two or more transformation engines each having securely stored in association therewith a common key, a common designated comparator threshold number, and a respective identifier; and a reconstitution engine operable to access partial encryption information from each transformation engine and, only upon relating to identical digital data, process each partial encryption information to successfully release the identical digital data.

Digital data comparison filter, system and method, and applications therefor

Described are various embodiments of an integrated network appliance and system. In one embodiment, the appliance comprises: a hardware-integrated processing engine operable to implement a trusted network-related resource; an integrated digital data processor operable to execute said processing engine; an integrated data storage resource accessible to said processing engine to implement said trusted network-related resource; an integrated location sensor; and an embedded hardware security module (HSM) hardwired to interface with said hardware-integrated processing engine via a dedicated hardware-isolated communication path, and operable to execute a trusted internal cryptographic process associated with said trusted network-related resource as a function of location data output from said integrated location sensor.

Integrated network security appliance, platform and system

Described are various embodiments of a hardware security module, hardwired port interconnection matrix, and embedded communication channel resources operable on selected hardware port-specific data communicated via this matrix.

Hardware security module, and trusted hardware network interconnection device and resources

Described are various embodiments of a secure cloud-based system. In one such embodiment, the secure cloud-based system includes a distribution of digital network processing resources and a central digital processing environment. The central processing environment includes a secure network interface to each of said digital processing resources; a digital hardware processor; and a deployment engine operable to serially deploy a unique ephemeral machine executable code instance, via said secure network interface, to a given one of said digital processing resources to be executed thereon for a predetermined runtime period, wherein execution of each said unique ephemeral machine executable code instance is automatically terminated after said predetermined runtime period to be operatively replaced by a subsequent unique ephemeral machine executable code instance.

Secure cloud-based system, and security application distribution method to be automatically executed therein

Described are various embodiments of an integrated multi-level or cross-domain network security appliance and system. In one embodiment, a cross-domain network traffic management appliance comprises: an external hardware network domain port to interface with an external network corresponding with a first network security domain, and exchange domain-specific data therethrough; a cross-domain hardware port to interface with a second network security domain and exchange cross-domain data therethrough; one or more hardware-integrated processing engines; and a hardware-integrated interconnection matrix configured to define, in hardware, designated data communication paths to interconnect said processing engines; wherein said one or more hardware-integrated processing engines are operable to: process and validate ingress first domain data received from said first network security domain via said external hardware port for cross-domain egress via said cross-domain hardware port; and process cross-domain ingress data received via said cross-domain hardware port for dispatch to said first network security domain via said external hardware network port; wherein cross-domain egress and ingress data is internally encrypted and decrypted, respectively, in accordance with a designated destination-domain encryption process.

Integrated multi-level or cross-domain network security management appliance, platform and system, and remote management method and system therefor

Described are various embodiments of a machine executable code deployment method and system. In one such embodiment, a machine executable code deployment method is described to comprise: compiling machine readable code in a secure digital processing environment to produce a unique ephemeral machine executable code instance representative thereof; deploying the unique ephemeral machine executable code instance to a distinct digital processing environment to be executed thereon for a predetermined runtime period, wherein execution of the unique ephemeral machine executable code instance is automatically terminated after the predetermined runtime period; and repeating the deploying for subsequent unique ephemeral machine executable code instances.

Secure machine executable code deployment and execution method and system

Described include various embodiments of an integrated multi-level network appliance and system, and remote management system and method therefor. In one embodiment, the appliance can comprise: two or more hardware-integrated processing engines each operable to implement a corresponding network-related resource associated with a respective network level in accordance with a designated multi-level network architecture; an integrated processor operable to execute the processing engines; one or more integrated data storage resources accessible to the processing engines to implement each corresponding network-related resource; and a trusted single-chip switch having a plurality of hardware ports associated therewith and configured to define in hardware multiple data communication paths embedded therein.

Integrated multi-level network appliance, platform and system, and remote management method and system therefor

Described are various embodiments of a hardware security module. For example, in one embodiment, a hardware security module is described to comprise: two or more hardware ports, each one of which operable to electronically receive given input hardware port-specific cryptographic data thereon to initiate execution of an internal cryptographic process as a function thereof; two or more segregated hardware port-specific storage spaces each operatively linked to a corresponding one of said hardware ports via a corresponding hardware link, and storing respective secured hardware port-specific cryptographic data thereon exclusively retrievable as a function of said given input hardware port-specific cryptographic data corresponding thereto; and a cryptographic engine operable to execute said cryptographic process based on said secured port-specific cryptographic data retrieved from said segregated hardware port-specific storage spaces as a function of said given input port-specific cryptographic data.

Hardware security module

The present disclosure presents methods, apparatuses, and systems to bolster communication security, and more particularly to utilize a constant time cryptographic co-processor engine for such communication security. For example, the disclosure includes a method for secure communication, comprising receiving encrypted data at a receiving device; obtaining a randomization for at least one bit of the encrypted data; modifying an execution of a cryptographic algorithm on the at least one bit to obtain a randomized cryptographic algorithm based on the randomization; and executing the randomized cryptographic algorithm on the at least one bit of encrypted data to recover original data associated with the encrypted data.

Method and system for constant time cryptography using a co-processor

A method of providing cipher data during a period of time when output of a primary source of cipher data is unavailable is disclosed. The method comprises switching from a primary source of cipher data to an alternate source of cipher data at a beginning of the period of time; using the cipher data from the alternate source during the period of time; and switching back to the primary source at an end of the period of time.

Method, module and system for providing cipher data

Control symbols taking the form {k1-k2-k2-k1} are inserted in a serial stream including m bit data words. k1 and k2 are each predefined m bit control words differing from the m bit data words. The Hamming distance between k1 and k2 is at least 2. Such control symbols may be robustly detected in the presence of a one bit error in the symbol, or a data word immediately preceding or following the symbol. The m bit words may be 8B/10B encoded data, or defined control words. The control symbols may be used for data delineation, stream synchronizaiton, transmitter/receiver synchronization or for other control signalling.

Robust control/delineation in serial streams

Control symbols taking the form {k1-k2-k2-k1} are inserted in a serial stream including m bit data words. k1 and k2 are each predefined m bit control words differing from the m bit data words. The Hamming distance between k1 and k2 is at least 2. Such control symbols may be robustly detected in the presence of a one bit error in the symbol, or a data word immediately preceding or following the symbol. The m bit words may be 8B/10B encoded data, or defined control words. The control symbols may be used for data delineation, stream synchronization, transmitter/receiver synchronization or for other control signalling.

A method and circuit for preventing external access to secure data of an integrated circuit while supporting DFT is disclosed. In accordance with the method the integrated circuit is automatically placed into the test mode at integrated circuit power-up from a power-down state. At power up, secure data is other than present within a secure data-path of the integrated circuit. Access is provided to the secure data path via a second data path coupled with the first secure data-path. Via the access path, data other than secure data is provided to the integrated circuit, the data for performing test functions of the integrated circuit operating in the test mode. Once data other than secure data is provided to first secure data path, the test mode is terminated and access via other than the secure ports is disabled. The test mode is only re-entered by powering down the integrated circuit and re-initialising it.

Growing community of inventors

Ottawa, Canada

James Ross Goodman