Samsung Electronics Co., Ltd.

Peng Ning

Ahmed M Azab

Xun Chen

Michael C Grace

Rohan Bhutkar

Wenbo Shen

Yong Choi

Stephen E McLaughlin

Ken Chen

Dongho Jang

Yifei Wang

Bulent Kasman

Siejoon Cho

Guruprasad Ganesh

Ruowen Wang

Youngjip Kim

Khaled Elwazeer

Haining Chen

Abdul Syed-Ebrahim

Yong Uk Shin

Mooyoung Kim

Xinwen Zhang

Min-Jung Kim

Geng Chen

Moo-Young Kim

Youngkyoo Kim

Abraham J Kang

Pai Peng

Donguk Seo

Junyong Choi

Hyungseok Yu

Myungsu Cha

Kyungsun Lee

Haiqing Jiang

Balakrishna Venkataraman

Shyam Prasad

An Liu

Yueh-Hsun Lin

Yurak Choe

Wei Yang

Injong Rhee

Kunal M Patel

Kyoung-Joong Shin

Ivan Getta

Jinlin Xu

Renuka Srinivasan

Song Wei

Yu-Seung Kim

Sudhi Herle

Roy Heeseung Yoo

David Thomson

Se-Hyeon Jang

Quan Chen

KyungBae Park

Sami Orava

S J Oh

Sangwoo Ryu

Kwanghwan Moon

Mengmeng Li

Se Young Choi

Jitesh Shah

Sj Oh

Dingbang Xu

Hyunchul Woo

Sang-Hyup Cho

Rathinamoorthy Mylsamy

Gurupradsad Ganesh

A method of providing continuous user authentication for resource access control includes launching a continuous authentication service at a boot time of a first device, wherein the first device includes a processor, a memory, and one or more sensors configured to collect authentication information. Additionally, the method includes receiving authentication information comprising one or more of explicit authentication information or implicit authentication information, and receiving a request for access to a resource of the first device. Further, the method includes the operations of determining, by the continuous authentication service, a current value of a security state, the current value of the security state based in part on a time interval between a receipt time of the authentication information and a current time and controlling access to the resource based on the current value of the security state.

System and method for resource access authentication

A mobile communications device includes a near field communications (NFC) port and processor. The processor executes a trusted application within a trusted execution environment (TEE) for processing sensitive data. Additionally, the processor executes a NFC driver within the TEE for providing a secure channel between the trusted application and the NFC port such that sensitive data being exchanged across the secure channel are inaccessible to other processes being executed by the processor.

System and method for secure transactions with a trusted execution environment (TEE)

A method for operating an electronic device, the method including spawning a name space tool (NST) as part of a boot process of a host OS, wherein the NST is a process with a plurality of root privileges of the host OS. The method further includes spawning, by the NST, a container for a guest OS, wherein the container for the guest OS is mapped to a dedicated domain in the host OS, and dropping, by the NST, a root privilege of the host OS in response to spawning the container for the guest OS.

System and method for guest operating system using containers

A method and apparatus for data security incorporating device state. The method includes encrypting sensitive data written to an electronic device while the electronic device is in a locked state using a public key of an asymmetric master key pair. The method also includes, in response to detecting that the electronic device enters an unlocked state, converting asymmetric encryption of the sensitive data into symmetric encryption of the sensitive data using a symmetric master key. Encrypting of the sensitive data may include encrypting the sensitive data using a data encryption key (DEK) and encrypting the DEK using the public key. Converting of the asymmetric encryption of the sensitive data into the symmetric encryption may include decrypting the encrypted DEK using a private key of the asymmetric master key pair and re-encrypting the DEK using the symmetric master key without decrypting and re-encrypting the sensitive data.

Adaptive and efficient database protection and migration with device state changes

A connected device includes an application processor, a secure element, and a control module. The application processor is configured to receive a control command from an electronic device. The secure element is connected between the application processor and a control module and is configured to authenticate the control command. The control module is configured to receive the control command when the control command is authenticated by the secure element, execute the control command to activate at least one function of the connected device, and transmit a response to the electronic device.

Authorized control of an embedded system using end-to-end secure element communication

A user device comprising: i) transmit path circuitry and receive path circuitry configured to communicate with a payment server; and ii) processing circuitry configured to control the transmit path circuitry and receive path circuitry. The processing circuitry is further configured to: a) receive a user input related to a payment process; b) calculate a risk score indicative of a likelihood of fraudulent activity associated with the payment process, wherein the risk score calculation is based on confidential information associated with the user that is stored on the user device; and c) transmit to the payment server a payment action and the risk score associated with the payment action without disclosing the confidential information. The confidential information comprises personally identifiable information and/or private information of the user. The processing circuitry calculates the risk score using a risk base model received from a model server.

System and method for fraud detection in a mobile device

A method is provided for wireless data transfer. The method includes determining, at a mobile device, communication capability of another device for receiving data. The method also includes selecting an optimal communication protocol for communicating the data based on the determined communication capability. The method also includes communicating the data with the other device using the selected optimal communication protocol.

Method and apparatus for intelligent communication selection

An apparatus and method of a hardware isolated secure element protecting a plurality of mission critical subsystems are provided. The method includes performing an actuation operation received across an unsecure path that modifies the state of a mission critical subsystem, performing a diagnostic operation received across the unsecure path that requests state information of the mission critical subsystem, storing information used to determine which of the diagnostic operation and the actuation operation received across the unsecure path are performed, and flashing an execution image of an electronic control unit when the execution image of the electronic control unit is received across the unsecure path.

Apparatus and method for protection of critical embedded system components via hardware-isolated secure element-based monitor

An apparatus and method for operating a relational database (DB) are provided. The method includes determining a sensitivity classification for a column of a table in the DB, performing encryption, using a data encryption key (DEK), of sensitive data when writing the sensitive data to the column determined to be sensitive, performing decryption, using the DEK, of the encrypted sensitive data when reading the sensitive data from the column determined to be sensitive, and performing writing to the column and reading from the column of unencrypted non-sensitive data when the column is determined to be non-sensitive.

Column wise encryption for lightweight DB engine

An apparatus and method of an attachment device for interfacing with an on-board diagnostic system of a vehicle is provided. The device includes an application processor configured to receive input from a terminal, control processing of the input by the on-board diagnostic system, transmit a result of the processing of the input by the on-board diagnostic system to the terminal, and a secure element interposed in the communication path between the application processor and the on-board diagnostic system, the secure element configured to filter the input of an on-board diagnostic operation that is untrusted.

Apparatus and method for transparent, secure element-based mediation of on-board diagnostic operations

An apparatus and method for generating an application container are provided. The method includes selecting a target application from among a plurality of applications included in an electronic device, acquiring a policy file corresponding to the target application, determining whether the policy file includes a category of the target application, and executing the application container which includes the target application.

Method and apparatus to sandbox run-time android applications with lightweight container

A method for verifying data integrity of a block device is provided. The method includes providing a secure world execution environment configured to monitor changes to data blocks of a block device, within the secure world execution environment, generating a hash for changed data blocks of the block device, and within the secure world execution environment, verifying and generating a cryptographic signature.

Methods and apparatus to enable runtime checksum verification of block device images

A method for supporting change of the authentication means for secure booting with the change of the trust root (root of trust) of the readymade electronic device and the electronic device therefor is provided. The secure boot generation method of an electronic device of the present disclosure includes storing plural initial certificates including a first initial certificate and a second initial certificate, designating the first initial certificate as a root certificate for secure booting of the electronic device, and switching the initial certificate from the first initial certificate to the second initial certificate in response to a request. Various other embodiments are possible.

Method and apparatus for supporting dynamic change of authentication means secure booting

An apparatus and a method for encrypting and decrypting data in a device are provided. The apparatus includes a processor and a memory. The processor is configured to transmit a data command from an application to an encryption driver that executes in a kernel space, determine if the application is authenticated to perform the data command based on an access policy, transmit, when the application is authenticated, a first key to a cryptographic library that executes in an application space, and perform the data command based on the first key after receiving a response via the cryptographic library. The first key is stored in an encryption driver in the kernel space and is not available to applications in the application space.

Method and apparatus for device state based encryption key

An apparatus and method for protecting kernel data integrity in an electronic device are provided. The method includes mapping a specified type of data to a read-only memory area, detecting a write attempt to the specified type of data, determining whether a process attempting to write to the specified type of data is permitted according to a specified condition, and allowing the write attempt if the process attempting to write to the specified type of data satisfies the specified condition.

Methods and apparatus for protecting operating system data

Growing community of inventors

Saratoga, CA, United States of America

Peng Ning