Google Inc.

Facebook Technologies, LLC

Nagendra Modadugu

Darin W Fisher

Sudhir K Satpathy

Bennet S Yee

Neeraj Upasani

Wojciech Stefan Powiertowski

Systems on a chip (SoCs) include security logic configured to increase resistance to fault injection attacks (FIAs). The security logic includes a monitoring circuit and a cascaded series of substitution-boxes (S-Boxes) having a circuit delay that is designed to match (or most closely match) the computing device critical path length. The monitoring circuit monitors the number of iterations required for the cascaded series of S-Boxes to return to an initial value and generates an error signal if the monitored loop length is different from the expected loop length. In some examples, the error signal is received by a mitigation processor that executes one or more processes aimed at mitigating the attack.

Monitoring circuit including cascaded s-boxes for fault injection attack protection

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for offline shared security key calculation. In one aspect, a method includes entering a first secure communication session with a remote device. A plurality of nonces are provided to the remote device during the first secure communication session. The first secure communication session is exited. A communication is received from the remote device after exiting the first communication session. The communication includes an indication of one of the plurality of nonces. A session key is generated using the indicated one of the plurality of nonces. A second secure communication session is entered with the remote device using the generated session key. Other embodiments of this aspect include corresponding systems, apparatus, and computer programs, configured to perform the actions of the methods, encoded on computer storage devices.

Offline shared security key calculation

A method, computer-readable medium, and system for re-using a connection between a client computing device and a server system. The method includes receiving at a server system a request from a client computing device to initiate a connection; receiving over the connection a request from the client computing device for first content from a first domain hosted by the server system; sending information to the client computing device over the connection that specifies one or more additional domains hosted by the server system and acceptable to the server system for connection sharing; receiving over the connection a request for second content from a second domain that is hosted by the server system and that was specified in the information sent from the server system to the client computing device; and sending the second content to the client computing device over the connection in response to receiving the request.

Connection sharing

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for resolving keystrokes. One of the methods includes receiving at a server system a request from a client computing device to initiate a connection between the client and the server system. After a connection is formed, a request from the client for first content from a first domain hosted by the server system is received over the connection. Information is sent to the client over the connection that specifies one or more additional domains hosted by the server system and acceptable to the server system for connection sharing. A request for second content from a second domain that is hosted by the server system and that was specified in the information sent to the client is received over the connection, from the client. In response, the second content is sent to the client over the connection.

Growing community of inventors

San Francisco, CA, United States of America

Nagendra Modadugu