Intel Corporation

Micron Technology Incorporated

John P Brizek

Robert N Hasbun

James R Vogt

Moinul H Khan

Mark Norman Fullerton

Anitha Kona

David Wheeler

Dennis M O'Connor

A device supports the processing of multiple active applications in a processor through a mapping system that securely identifies and differentiates commands issued by clients. An entity selection signal is generated by the mapping system to signal the processor to process an algorithm and provide services for a specific client using the commands identified for that client and data permitted by a client tracking system for that client. Other data accesses and commands identified for other clients are restricted when processing the algorithm.

Architecture for virtual security module

In an embodiment, an apparatus includes a cryptographic processor within a wireless device. The cryptographic processor includes at least one cryptographic unit. The cryptographic processor also includes a nonvolatile memory to store one or more microcode instructions, wherein at least one of the one or more microcode instructions is related to a sensitive operation. The cryptographic processor also includes a controller to control execution of the one or more microcode instructions by the at least one cryptographic unit, wherein the controller is to preclude execution of the sensitive operation if the apparatus is within an untrusted state.

Method and apparatus for a trust processor

A processor-based system such as a wireless communication module may implement security functions in a cost effective fashion by providing a virtual memory space whose addresses may be recognized. The memory is integrated with an application processor. When those addresses are recognized, access to special security protocols may be allowed. In another embodiment, a variety of dedicated hardware cryptographic accelerators may be provided to implement security protocols in accordance with a variety of different standards. By optimizing the hardware for specific standards, greater performance may be achieved.

Security protocols for processor-based systems

Trusted code may be patched in a manner that resists tampering from non-trusted sources. In some embodiments, the patches may be moved into a patch cache in a trusted processing module for execution.

Trusted patching of trusted code

A biometric-based security circuit in which the user database, processor, and biometric map generation functions are all located on the same integrated circuit whose secure contents are inaccessible from external to the integrated circuit. Biometric data, such as a fingerprint, retina scan, or voiceprint, is taken from a user requesting access to restricted resources. The biometric data is transferred into the integrated circuit, where it is converted to a biometric map and compared with a database of biometric maps stored in a non-volatile memory in the integrated circuit. The stored maps represent pre-authorized users, and a match triggers the security circuit to send a signal to a host processor authorizing the host processor to permit the requesting user access to the restricted resources. The integrated circuit essentially serves as a write-only memory for the secure data, because the secure data and security functions in the integrated circuit are not directly accessible through any pin or port, and therefore cannot be read or monitored through a dedicated security attack. A second non-volatile memory, accessible from external to the integrated circuit, can also be provided in the integrated circuit for holding non-secure data. This second memory has its own interface port, and is isolated from the security-related functions and memory so that secure and non-secure functions are physically isolated from each other and cannot be modified to overcome that isolation.

Biometric-based authentication in a nonvolatile memory device

A single wireless system that implements both baseband and non-baseband applications can be provided in a way that securely prevents inadvertent or deliberate alteration of protected code. For example, the possibility exists that with a common system and common storage that baseband processing code may be overwritten by non-baseband applications. By providing an address comparison register that recognizes particular addresses and ensures that those code accesses are routed only to the specific dedicated areas of storage appropriate to either base or non-baseband applications, inadvertent or deliverable overwriting can be reduced or eliminated.

Increasing code separation between applications

A method and device for providing hidden storage in non-volatile memory. A memory device is disclosed comprising a main flash array. A hidden storage area is connected to the main flash array. The hidden storage area can not be accessed without a valid password according to the present memory device.

Growing community of inventors

Placerville, CA, United States of America

John P Brizek