Atmel Corporation

International Business Machines Corporation

Microchip Technology Inc.

Kerry D Maletsky

Balaji Badam

David Durant

James Peter Ward

Michael J Seymour

Nicolas Schieli

Brad Phillip Garner

John Landreman

Nathanael J Bohlmann

Daryl Carvis Cromer

Michael Joseph Steinmetz

Randall Wayne Melton

Jeffrey S Hapke

Timothy Grai

Oscar Sanchez

Gregory Pruett

David Paul Arnold

Nicolas Auguste Constant Schieli

Randy Melton

Bryan Hunt

Systems, methods, and devices of the disclosure relate, generally, to secure boot assist for devices. In one or more embodiments, a first device includes firmware that needs to be verified as secure as part of a secure boot process, and a second device assists the first device to secure the secure boot process. In some embodiments the second device verifies security of the firmware responsive to security data provided by the first device, or verifies security of a program provided by the first device, the program for verifying security of the firmware. In some embodiments the second device provides a program for verifying security of the firmware to the first device.

Secure boot assist for devices, and related systems, methods and devices

Systems, methods, circuits and computer-readable mediums for message authentication with secure code verification are provided. In one aspect, a system includes a client device storing a code and a security device coupled to the client device. The security device is configured to receive a property of the code generated by the client device, verify correctness of the property of the code based on information associated with the code to determine that the code is an authorized code, the information being stored within the security device. In response to determining that the code is the authorized code, the security device enables to access data stored within the security device and generate a property of a message based on the data.

Message authentication with secure code verification

Systems, methods, circuits and computer-readable mediums for controlled secure code authentication are provided. In one aspect, a method performed by a host device includes transmitting a request to a client device, the request including a challenge for a property of a code stored within the client device, receiving a response to the request, the response comprising information associated with the property of the code, verifying correctness of the response based on the received information, and based on the verifying of the correctness of the response, determining that the code is an authorized code.

Controlled secure code authentication

Systems, methods, circuits and computer-readable mediums for controlled secure code authentication are provided. In one aspect, a non-transitory computer-readable storage medium having instructions stored thereon which, when executed by one or more processors, cause the one or more processors to perform a method including: sending a request to a client device, the request including a challenge for a property of a particular portion from among a plurality of portions of code stored within the client device, the challenge including data indicating a particular memory address range corresponding to the particular portion of the code, receiving a response to the request from the client device, the response including information associated with the property of the code, verifying correctness of the response based on the received information, and based on verifying correctness of the response, determining that the code is an authorized code.

Systems, methods, circuits and computer-readable mediums for adaptive speed single-wire communications. In one aspect, a method includes receiving a sensing signal from a device through a single-wire bus, analyzing one or more properties of the received sensing signal, the one or more properties including at least one of a pulse width of the sensing signal and a duration between sequential pulses in the sensing signal, adjusting one or more communication parameters for single-wire communications with the device based on the analyzed one or more properties, and transmitting a specific signal to the device through the single-wire bus at an adjusted transmission speed based on the adjusted one or more communication parameters.

Adaptive speed single-wire communications

Systems, methods, circuits and computer-readable mediums for a network message translator are disclosed. In an embodiment, a device includes a host processor and a translator. The host processor is configured to process messages and the translator is operable to: receive a first message from the host processor, the first message having a first frame format that is associated with a data time window; translate the first message into a first translated message having a second frame format such that the first translated message includes additional bits based on the second frame format; and sending the first translated message on a bus based on the second frame format such that the first translated message is sent on the bus during the data time window.

Message translator

An integrated circuit device comprises a processor and a secure protection zone with security properties that can be verified by a remote device communicating with the integrated circuit device. The secure protection zone includes a persistent storage that is configured for storing cryptographic keys and data. The secure protection zone also includes instructions that are configured for causing the processor to perform cryptographic operations using the cryptographic keys. In addition, the secure protection zone includes an ephemeral memory that is configured for storing information associated with the cryptographic operations. The instructions are configured for causing the processor to perform the cryptographic operations on the data stored in the persistent storage and the information in the ephemeral memory as part of a secure communication exchange with the remote device.

Generating signatures using a secure device

A method and device include a power pin, a ground pin, and a communications pin. A communications module receives power from the power pin and utilizes an edge counting communication protocol over the communication pin.

Single pin communication mechanism

A client device that is coupled to a host device sends a parent public key and an associated certificate to the host device. The parent public key, the certificate and a corresponding parent private key are stored in secure persistent storage included in a secure device associated with the client device. The client device receives instructions from the host device for generating a child private and public key pair. In response to receiving the instructions, the client device generates a child private key based on a first random number produced within the secure device, and a child public key associated with the child private key. The client device computes a first signature on the child public key using the parent private key. The client device sends the child public key and the first signature to the host device.

Generating keys using secure hardware

A hardware authentication device is disclosed that uses a cryptographic signature verification operation to authorize a subsequent cryptographic operation to be performed using the same or different keys and stores that authorization status in protected memory. The cryptographic algorithm may be an ECDSA signature, SHA-based Message Authentication Code (MAC) or any other cryptographic algorithm. The authorization status may be stored for a number of uses for a period of time or until a certain event occurs. In some implementations, the authorization status and the key that was authorized are stored in the same protected location in memory to preserve their relation to each other and prevent modification of either of them. Depending on system policy, the authorization mechanism might be a static stored external token that authorizes key use or an authorization process that is regenerated using a random (e.g., unique) number.

Stored authorization status for cryptographic operations

Systems and techniques for performing cryptographic operations based on public key validity registers are described. A described system includes a controller and a memory structure to store one or more public keys. The memory structure includes one or more validity registers that respectively correspond to the one or more public keys. The controller has exclusive write access to the validity register. The controller can be configured to perform an authentication of a public key, write an authentication status value to the corresponding validity register based on a result of the authentication, and perform one or more cryptographic operations using the public key that are conditional on the validity register indicating an authenticated status for the public key.

Stored public key validity registers for cryptographic devices and systems

Apparatus, systems, and methods send an interrogation command from an interrogation and timing apparatus to a timed identification (TID) apparatus. The TID apparatus receives the interrogation command, performs a series of logical operations to calculate a response, and returns the response within a maximum length of time established by the interrogation and timing apparatus. The interrogation and timing apparatus confirms that the length of time between sending the interrogation command and receiving the response is within the maximum length of time and that the response is correct. If so, the TID apparatus is authenticated. Additional embodiments are disclosed and claimed.

Cryptographic authentication apparatus, systems and methods

Aspects of the present invention include a method and system for generating a secure access code at a remote device in communication with a computer system having a secure storage device; conveying the secure access code to the system secure storage device; receiving the secure access code at the system secure storage device with unique data characteristics associated with remote device; and, securely providing content to the remote device.

Method and system for secure external TPM password generation and use

A counter is efficiently implemented in non-volatile memory by using two binary counters and selectively using one or the other as a current counter. Writes to the binary counters are minimized by using two linear counters and using the state of the binary counters to determine which binary counter contains the current count. Write operations can be performed to the 'not current' binary counter with the final write operation being to the linear counters. The linear counter write operations can be in program-only mode so that a power failure will not result in a loss of counts.

Growing community of inventors

Monument, CO, United States of America

Kerry D Maletsky