Teleputers, LLC

Hewlett-packard Development Company, L.p.

Coresecure Technologies, LLC

Princeton University

Sri International

Ruby B Lee

Yu-Yuan Chen

Zhenghong Wang

Dale Calvin Morris

Pramod Jamkhedkar

Fangfei Liu

Yedidya Hilewitz

Zhijie Shi

Xiao Yang

David Champagne

Sek Meng Chai

Aswin Nadamuni Raghavan

Zecheng He

Guangyuan Hu

Jeffrey S Dwoskin

Tianwei Zhang

Champagne David

Manish Vachharajani

Devices and methods for smartphone impostor detection using behavioral and environmental data are provided. Impostors are attackers who take control of an electronic device (e.g., a smartphone) and gain access to confidential and private information of a legitimate user. Embodiments described herein propose a defense-in-depth mechanism to detect impostors quickly with simple deep learning algorithms, which can achieve better detection accuracy than previous works. Embodiments then consider protecting the privacy of the behavioral and/or environmental data (e.g., collected by one or more sensors) of a user by not exposing it outside the protected device. A recurrent neural network (RNN)-based deep learning algorithm is proposed which uses only sensor data of the legitimate user to learn their normal behavior. Prediction error distribution (PED) is used to enhance the detection accuracy. In some embodiments, a minimalist hardware module, dubbed smartphone impostor detector (SID), is integrated into smartphones for self-contained impostor detection.

Devices and methods for smartphone impostor detection using behavioral and environmental data

Systems and methods for random fill caching and prefetching for secure cache memories are provided. The system dynamically de-correlates fetching a cache line to the processor from filling the cache with this cache line, due to a demand memory access, in order to provide greater security from information leakage due to cache side-channel attacks on cache memories. The system includes a random fill engine which includes a random number generator and an adjustable random fill window. Also provided is an adaptive random fill caching system which dynamically adapts the random fill window to a wide variety of computational workloads. Systems and methods for cache prefetching to improve system performance using adaptive random fill prefetching and random fill prefetching are also provided.

Systems and methods for random fill caching and prefetching for secure cache memories

A system for security health monitoring and attestation of virtual machines in cloud computing systems is provided. The system includes a cloud server having a virtual machine and a hypervisor. The cloud server collects security measurement information and signs and hashes the security measurement information using a cryptography engine. The system also includes an attestation server for receiving the hashed security measurement information from the cloud server. The attestation server also verifies the signature and hash values, and interprets the security measurement information. The attestation server generates an attestation report based on the verification and interpretation of the security measurement information.

System and method for security health monitoring and attestation of virtual machines in cloud computing systems

A method, apparatus and system for anomaly detection in a processor based system includes training a deep learning sequence prediction model using observed baseline behavioral sequences of at least one processor behavior of the processor based system, predicting baseline behavioral sequences from the observed baseline behavioral sequences using the sequence prediction model, determining a baseline reconstruction error distribution profile using the baseline behavioral sequences and the predicted baseline behavioral sequences, predicting test behavioral sequences from observed, test behavioral sequences using the sequence prediction model, determining a testing reconstruction error distribution profile using the observed test behavioral sequences and the predicted test behavioral sequences, and comparing the baseline reconstruction error distribution profile to the testing reconstruction error distribution profile to determine if an anomaly exists in a processor behavior of the processor based system.

Anomalous behavior detection in processor based systems

Disclosed is a system comprising a physical memory, a processor and a software component. The software component includes a policy/domain handler for receiving data and a policy associated with the data; a hypervisor; and a file management module. The file management module receives a request from a third-party application to interact with a data file containing the data; sends an authorization and tag request to the policy/domain handler to check if the user and application are permitted to access the data, and if permitted, to generate hardware tags for the data file; and sends a secure data request to the hypervisor to create a secure data compartment for the data file and the hardware tags. Based on the authorization and tag request, and the security policy associated with the data, the policy/domain handler generates the hardware tags for the data file. Based on the secure data request, the hypervisor creates in the physical memory a secure data compartment containing the data file and the hardware tags, the hypervisor associating the hardware tags with the data in the secure data compartment. As the data is operated upon and moved to other memory areas, the hardware tags are propagated with the data according to tag propagation rules, and checked before performing operations that may lead to security breaches.

System and method for self-protecting data

A system and method for processor-based security is provided, for on-chip security and trusted computing services for software applications. A processor is provided having a processor core, a cache memory, a plurality of registers for storing at least one hash value and at least one encryption key, a memory interface, and at least one on-chip instruction for creating a secure memory area in a memory external to the processor, and a hypervisor program executed by the processor. The hypervisor program instructs the processor to execute the at least one on-chip instruction to create a secure memory area for a software area for a software module, and the processor encrypts data written to, and decrypts data read from, the external memory using the at least one encryption key and the verifying data read from the external memory using the at least one hash value.

System and method for processor-based security

A cache memory having enhanced performance and security feature is provided. The cache memory includes a data array storing a plurality of data elements, a tag array storing a plurality of tags corresponding to the plurality of data elements, and an address decoder which permits dynamic memory-to-cache mapping to provide enhanced security of the data elements, as well as enhanced performance. The address decoder receives a context identifier and a plurality of index bits of an address passed to the cache memory, and determines whether a matching value in a line number register exists. The line number registers allow for dynamic memory-to-cache mapping, and their contents can be modified as desired. Methods for accessing and replacing data in a cache memory are also provided, wherein a plurality of index bits and a plurality of tag bits at the cache memory are received. The plurality of index bits are processed to determine whether a matching index exists in the cache memory and the plurality of tag bits are processed to determine whether a matching tag exists in the cache memory, and a data line is retrieved from the cache memory if both a matching tag and a matching index exist in the cache memory. A random line in the cache memory can be replaced with a data line from a main memory, or evicted without replacement, based on the combination of index and tag misses, security contexts and protection bits. User-defined and/or vendor-defined replacement procedures can be utilized to replace data lines in the cache memory.

Cache memory having enhanced performance and security features

A trust system and method is disclosed for use in computing devices, particularly portable devices, in which a central Authority shares secrets and sensitive data with users of the respective devices. The central Authority maintains control over how and when shared secrets and data are used. In one embodiment, the secrets and data are protected by hardware-rooted encryption and cryptographic hashing, and can be stored securely in untrusted storage. The problem of transient trust and revocation of data is reduced to that of secure key management and keeping a runtime check of the integrity of the secure storage areas containing these keys (and other secrets). These hardware-protected keys and other secrets can further protect the confidentiality and/or integrity of any amount of other information of arbitrary size (e.g., files, programs, data) by the use of strong encryption and/or keyed-hashing, respectively. In addition to secrets the Authority owns, the system provides access to third party secrets from the computing devices. In one embodiment, the hardware-rooted encryption and hashing each use a single hardware register fabricated as part of the computing device's processor or System-on-Chip (SoC) and protected from external probing. The secret data is protected while in the device even during operating system malfunctions and becomes non-accessible from storage according to various rules, one of the rules being the passage of a certain time period. The use of the keys (or other secrets) can be bound to security policies that cannot be separated from the keys (or other secrets). The Authority is also able to establish remote trust and secure communications to the devices after deployment in the field using a special tamper-resistant hardware register in the device, to enable, disable or update the keys or secrets stored securely by the device.

Hardware trust anchors in SP-enabled processors

Microprocessor shifter circuits utilizing butterfly and inverse butterfly circuits, and control circuits therefor, are provided. The same shifter circuits can also perform complex bit manipulations at high speeds, including butterfly and inverse butterfly operations, parallel extract and deposit operations, group operations, mix operations, permutation operations, as well as instructions executed by existing microprocessors, including shift right, shift left, rotate, extract, deposit and multimedia mix operations. The shifter circuits can be provided in various combinations to provide microprocessor functional units which perform a plurality of bit manipulation operations.

Microprocessor Shifter Circuits Utilizing Butterfly and Inverse Butterfly Routing Circuits, and Control Circuits Therefor

Methods for accessing, storing and replacing data in a cache memory are provided, wherein a plurality of index bits and a plurality of tag bits at the cache memory are received. The plurality of index bits are processed to determine whether a matching index exists in the cache memory and the plurality of tag bits are processed to determine whether a matching tag exists in the cache memory, and a data line is retrieved from the cache memory if both a matching tag and a matching index exist in the cache memory. A random line in the cache memory can be replaced with a data line from a main memory, or evicted without replacement, based on the combination of index and tag misses, security contexts and protection bits. User-defined and/or vendor-defined replacement procedures can be utilized to replace data lines in the cache memory.

A functional unit is provided which allows for fast, parallel data read, write, and manipulation operations. The functional unit includes first and second source registers for receiving first and second data items to be processed by the functional unit, a plurality of memory tables, a combinational logic circuit, and a decoder. Each of the tables is indexed by an index comprising a portion of the first data item received by the first source register. The combinational logic circuit receives lookup results, and processes the lookup results and the second data item in the second source register to produce a result data item. The decoder circuit extracts an operational code from an instruction supplied to the functional unit, decodes the operational code, and controls the combinational logic circuit in accordance with the operational code.

Growing community of inventors

Princeton, NJ, United States of America

Ruby B Lee