Intel Corporation

Cisco Technology, Inc.

Nds Corporation

Reuven Elbaum

Chaim Shen-Orr

Yonatan Shlomovich

Uri Bear

Yigal Shapiro

Zvi Shkedy

Gyora M Benedek

Elad Peer

Lior Amarilio

Yaacov Belenky

David Novick

Reuben Sumner

Itsik Mantin

Baruch Chaikin

Avinash Laxmisha Varna

Yaakov (Jordan) Levy

Ahmad Yasin

Jacob Doweck

Steve J Brown

Rami Sudai

Elena Sidorov

Dimitry Kloper

Assaf Admoni

Chaim D Shen-Orr

Yaakov Levy

The disclosure generally provides methods, systems and apparatus to construct a Physically Unclonable Function (PUF) value for an electronic package based on the package's internal components and their interconnects. In one embodiment, the package is a System-On-Chip (SOC) having a plurality of dielets and a plurality of interconnect connecting the dielets. Each of the dielets and each of the interconnects (at one or more locations) may define an entropy source. each entropy source may have an entropy value. Each entropy source communicates an initial entropy value to a PUF aggregator. The PUF aggregator receives and/or aggregates the various entropies from the various entropy sources to construct the native SOC PUF value. The native SOC PUF value defines the authentic PUF value of the SOC at SOC release. Any deviation from the native SOC PUF value may be deemed a security breach of the SOC.

Method, system and apparatus for protection of multi-die structures

An apparatus is described including cryptography circuitry to generate authentication tags to provide integrity protection for plaintext and ciphertext.

Plaintext integrity protection mechanism

In one embodiment, memory cell includes a control gate, a floating gate, a substrate comprising a source region and a drain region, a first isolator between the control gate and floating gate, and a second isolator between the floating gate and the substrate. The memory cell is configured to have a retention time that is within a statistical window around a selected lifespan. The selected lifespan may be less than ten years, such as, for example, less than one year, less than one month, or less than one week.

Memory structure for self-erasing secret storage

Micro-architectural fault detectors are described. An example of storage mediums includes instructions for receiving one or more micro instructions for scheduling in a processor, the processor including one or more processing resources; and performing fault detection in performance of the one or more micro instructions utilizing one or more of a first idle canary detection mode, wherein the first mode includes assigning at least one component as an idle canary detector to perform a canary process with an expected outcome, and a second micro-architectural redundancy execution mode, wherein the second mode includes replicating a first micro instruction to generate micro instructions for performance by a set of processing resources.

Detection of faults in performance of micro instructions

The present disclosure is directed to systems and methods of detecting a side-channel attack detecting a translation lookaside buffer (TLB) miss on a virtual address lookup caused by the speculative execution of an instruction and determining that the physical memory address associated with the virtual address lookup contains a privileged object or a secret object. Range register circuitry determines whether the physical memory address is located in an address range containing privileged objects or secret objects. Performance monitoring counter (PMC) circuitry generates an interrupt in response to receipt of information indicative of the TLB miss and information indicative that the physical memory address contains a privileged object or a secret object. The PMC circuitry causes the storage of information associated with the speculatively executed instruction causing the virtual address lookup.

Active side-channel attack prevention

The present disclosure is directed to systems and methods to protect against SCA and fault injection attacks through the use of a temporary or ephemeral key to cryptographically alter input data portions. Universal resistant block (URB) circuitry receives a seed data value and a at least one secret key data value and generates an ephemeral key output data value. Cryptographic circuitry uses the ephemeral key data value to transform an input data portion to produce an transformed output data portion. The use of an SCA or fault injection attack on the transformed output data portion will reveal only the ephemeral key data value and not the at least one secret key data value. Further, where a unique ephemeral key data value is used to transform each input data portion, an attacker cannot discover the ephemeral key in a piecemeal manner and must instead discover the complete ephemeral key data value&#x2014;significantly increasing the difficulty of performing a successful SCA or fault injection attack.

Circuits supporting improved side channel and fault injection attack resistance

Various systems and methods for detecting and preventing side-channel attacks, including attacks aimed at discovering the location of KASLR-randomized privileged code sections in virtual memory address space, are described. In an example, a computing system includes electronic operations for detecting unauthorized attempts to access kernel virtual memory pages via trap entry detection, with operations including: generating a trap page with a physical memory address; assigning a phantom page at an open location in the privileged portion of the virtual memory address space; generating a plurality of phantom page table entries corresponding to an otherwise-unmapped privileged virtual memory region; placing the trap page in physical memory and placing the phantom page table entry in a page table map; and detecting an access to the trap page via the phantom page table entry, to trigger a response to a potential attack.

Mitigating attacks on kernel address space layout randomization

In one embodiment, an integrated circuit comprises a volatile memory including a plurality of memory cells, a detector to detect one or more in-specification conditions, and a discharger, external to the volatile memory, to discharge electric charge stored in the integrated circuit, including electric charge stored in the volatile memory, unless the detector detects the one or more conditions.

Discharging electric charge in integrated circuit unless in-specification condition(s) detected

A method for data transfer includes receiving a control signal triggering a transfer of a secret value into an element () of a circuit (). In response to the control signal, a dummy value () and the secret value are inserted in succession into the element of the circuit.

Preventing data extraction by side-channel attack

An electronic device () includes an array () of memory cells, which are configured to store data values. One or more sense amplifiers () have respective inputs for receiving signals from the memory cells and are configured to output the data values corresponding to the received signals. Switching circuitry () is coupled between the array of the memory cells and the sense amplifiers and is configured to receive an indication of a temporal pattern and to route the signals from the memory cells among the inputs of the sense amplifiers in accordance with the temporal pattern.

Preventing unauthorized data extraction

A method for hindering detection of information unintentionally leaked from a secret held in a memory unit is described, the method including receiving a triggering event waiting for at least a first amount of time to pass after the receipt of the triggering event, the memory unit being in a non-operational state during the at least a first amount of time after the at least a first amount of time has passed, changing at least one first condition under which the memory unit operates, thereby causing the memory unit to enter an operational state, waiting for a second amount of time to pass after the changing at least one first condition, and changing, after the second amount of time, at least one second condition under which the memory unit operates, thereby causing the memory unit to enter the non-operational state, wherein access to the secret information is enabled only during the second amount of time, and detection of secret information unintentionally leaked is limited during the first amount of time. Related apparatus and methods are also described.

Security within integrated circuits

An integrated circuit device () includes a plurality of memory cells (), which are configured to store data. Multiple P-N junctions () are arranged so that a single, respective P-N junction is disposed in proximity to each memory cell and is configured to emit optical radiation during readout from the memory cell with a wavelength matching an emission wavelength of the memory cell.

Protection of stored data using optical emitting elements

A system, comprising an external memory operative to store data therein, the data including a plurality of sections, each of the sections being associated with a signature, and an internal memory operationally connected to the external memory, and a processor arrangement operationally connected to the internal memory, the processor arrangement including a transfer module to transfer one section from the external to the internal memory, an authentication module to authenticate the signature of the section transferred from the external memory, a validity status module to identify the section as valid if the signature is authentic, and an execution module to utilize the section of the data only if the section is valid, wherein the validity status module is operative to invalidate the section, if the content of the section is changed while stored in the internal memory. Related apparatus and methods are also described.

Growing community of inventors

Haifa, Israel

Reuven Elbaum