The Impact of Cryptography on Platform Security
|
|
|
- Rodger Haynes
- 10 years ago
- Views:
Transcription
1 The Impact of Cryptography on Platform Security Ernie Brickell Intel Corporation 2/28/2012 1
2 Security is Intel s Third Value Pillar Intel is positioning itself to lead in three areas: energy-efficient performance silicon, connectivity, and security. Paul Otellini Intel CEO There s an urgent need for security innovation as people are spending more time online and the amount of data is growing. 2 Intel Architecture Group
3 Outline Digital signatures on FW updates Hardware Random number generation Anonymous platform attestation Trusted Boot Improved protection for user authentication Enhancements for cryptographic performance Protection from Side Channel Attacks 3 Intel Architecture Group
4 Digital Signatures on FW Updates Intel FW updates are validated with a digital signature NIST recommending digital signatures for BIOS updates. NIST SP BIOS protection Guidelines Use digital signatures to verify the authenticity of BIOS updates. BIOS updates verified using a Root of Trust for Update which includes: The key store used to verify signatures on updates. The digital signature verification algorithm. Use of NIST-approved crypto algorithms. Recommend rollback protection. 4 Intel Architecture Group
5 Outline Digital signatures on FW updates Hardware Random number generation Anonymous platform attestation Trusted Boot Improved protection for user authentication Enhancements for cryptographic performance Protection from Side Channel Attacks 5 Intel Architecture Group
6 Digital Random Number Generator (DRNG) Entropy Source BIST Online Health Tests Test Port DRNG Combined Conditioner/ Deterministic Random Bit Generator (DRBG) DRNG Wrapper Interface (embedding specific) A reusable circuit that provides an autonomous/self contained, complete DRNG Provides a hardware source of high quality, high performance entropy to be embedded across Intel products. It is composed of An all-digital Entropy Source, (3 Gbps, 90% Entropic) Runtime Entropy Source health measurement via Online Health Test, Conditioning (via AES CBC-MAC mode) and DRBGing (via AES CTR mode) post processing and Built In Self Test (BIST) and Test Port Standards compliant (NIST SP ) 6
7 RDRAND Performance Preliminary data from pre-production Ivy Bridge sample 1 RdRands (Millions/sec) Throughput (MB/sec) RdRand new CPU instruction which provides access to DRNG Up to 70 million RdRand invocations per second Throughput (RdRands/s) Million Bytes of random data per second Throughput ceiling is insensitive to number of contending parallel threads Steady state maintained at peak performance Number of Parallel Threads Throughput (MB/s) Number of Parallel Threads 1 Data taken from Intel processor codename Ivy Bridge early engineering sample board. Quad core, 4 GB memory, hyper-threading enabled. Software: LINUX* Fedora 14, gcc version (experimental) with RdRand support, test uses pthreads kernel API. 7 Intel Architecture Group
8 RdRand Response Time and Reseeding Frequency Preliminary data from pre-production Ivy Bridge sample 1 Response Time (Clock cycles) DRNG 128-bit Outputs 300 RdRand Response Time RdRand Response Time ~150 clocks per invocation Little contention until 8 threads (or 4 threads on 2 core chip) Simple linear increase as additional threads are added DRNG Reseed Frequency Single thread worst case: Reseeds every 4 RdRand invocations Multiple thread worst case: Reseeds every 23 RdRand invocations At slower invocation rate, can expect reseed before every 2 RdRand calls NIST SP recommends Number of Parallel Threads DRNG Reseed Frequency Number of Parallel Threads 1 Data taken from Intel processor codename Ivy Bridge early engineering sample board. Quad core, 4 GB memory, hyper-threading enabled. Software: LINUX* Fedora 14, gcc version (experimental) with RdRand support, test uses pthreads kernel API. 8 Intel Architecture Group
9 Outline Digital signatures on FW updates Hardware Random number generation Anonymous platform attestation Trusted Boot Improved protection for user authentication Enhancements for cryptographic performance Protection from Side Channel Attacks 9 Intel Architecture Group
10 Overview of EPID EPID pub-key Message Message, EPID Signature Sign Verify pvt-key 1 pvt-key 2 pvt-key n EPID Signature True / False EPID is a digital signature scheme with special properties One group public key corresponds to multiple private keys Each unique private key can be used to generate a signature Signature can be verified using the group public key 10 Intel Architecture Group
11 Enhanced Privacy ID (EPID) Direct Anonymous Attestation (DAA) A crypto scheme for providing anonymous signatures DAA is designed specifically for TPM RSA based DAA scheme adopted by TCG TPM Spec v1.2 EPID is an extension of DAA Flexible key generation and signature creation options Additional revocation capabilities Pairing based EPID scheme has improved efficiency 11 Intel Architecture Group
12 Knows Issuer Secret Join Each Member obtains a unique EPID private key Knows Private key Sign Signs a message using his private key and outputs a signature What is EPID Issuer Member EPID group public key Verifier Verify Verifies EPID signature using the group public key 12 Intel Architecture Group
13 Privacy Features of DAA/EPID EPID key issuing can be blinded Issuer does not need to know Member Private Key EPID signatures are anonymous EPID signatures are untraceable Nobody including the issuer can open an EPID signature and identify the member This is the main difference between group signatures Unlinkability property depends upon Base Signature includes a pseudonym B f where B is base chosen for a signature and revealed during the signature f is unique per member and private Random base: Pseudonym R f where R is random signatures are unlinkable Name base: Pseudonym N f all where N is name of verifier Signatures still unlinkable for different verifiers Signatures using common N are linkable 13 Intel Architecture Group
14 Revocations in EPID Private key revocation (Revealed Key List) Ex: Private key is corrupted and is published Revocation check performed by verifier Verifier Local Revocation using name base Ex: Verifier can revoke a Pseudonym for his name (N f ) Revocation check performed by verifier Signature based revocation (Signature Revocation List) Issuer and/or verifier decide that they no longer want to accept signatures from whatever signed a revoked message with pseudonym B f For each future signature, Member signs as normal Member proves he didn t sign the revoked message Retains same anonymity and unlinkability properties 14 Intel Architecture Group
15 More on signature based revocation Signature Revoke list K i = B i fi for many pseudonyms Member produces a pseudonym K = B f in a signature The Member performs a Not My Pseudonym Proof, for each pseudonym in Signature Revoke list, i.e., for each (B i, K i ), the member proves that K i B i f Signature Revoke list signed by Revocation authority and checked by Member device 15 Intel Architecture Group
16 Outline Digital signatures on FW updates Hardware Random number generation Anonymous platform attestation Trusted Boot Improved protection for user authentication Enhancements for cryptographic performance Protection from Side Channel Attacks 16 Intel Architecture Group
17 TPM Measured Boot Measured boot Boot anything Store a trusted measurement of the boot process Provide trusted reporting of the measurement TPM Trusted Platform Module Separate microprocessor During platform boot, the HW does a hash of the initial boot code and sends that to the TPM. TPM can digitally sign the hash 17 Intel Architecture Group
18 Verified Boot Verified boot Boot only code that passes verification Uses Intel s Trusted execution Technology Launch Control Policy The HW verifies that the measurements made during launch are good If not, then the selected policy option is invoked. Examples: Platform boots to a fall back environment Platform does not boot 18 Intel Architecture Group
19 Outline Digital signatures on FW updates Hardware Random number generation Anonymous platform attestation Improved protection for user authentication Enhancements for cryptographic performance Protection from Side Channel Attacks 19 Intel Architecture Group
20 IPT 1.0: One Time Password (OTP) The first generation of Intel IPT is a dynamic code generated on an embedded microprocessor that is protected from malware in the OS. Single use, (i.e. 30 second, time-limited code OTP ) A hardware level 2nd factor of authentication Works with leading OTP Solutions from Symantec & Vasco Traditional hardware token CPU OTP Client App / Browser Intel IPT Middleware ME Embedded OTP App Now embedded into your PC Intel ISV No system can provide absolute security under all conditions. Requires an Intel IPT enabled system, including a 2 nd generation Intel Core processor, enabled chipset, firmware and software. Available only on participating websites. Consult your system manufacturer. Intel assumes no liability for lost or stolen data and/or systems or any resulting damages. For more information, visit 20 [ Intel Architecture Group
21 Outline Digital signatures on FW updates Hardware Random number generation Anonymous platform attestation Improved protection for user authentication Enhancements for cryptographic performance Protection from Side Channel Attacks 21 Intel Architecture Group
22 Crypto Performance Software improvements Multi-buffer Function Stitching Hardware improvements AES-NI PCLMULQDQ Microarchitecture improvements 22 Intel Architecture Group
23 Multi Buffer Performance 1 WSM Core Multi-buffer: Perform the same function on multiple independent data buffers 9,000 8,000 7,000 AES: Total Cycles / Buffer Single Buffer 8,438 6,000 5,000 Multi Buffer 3X 4,000 3,000 2,528 2,841 2,000 1, , Byte Distribution 0 Distribution Byte Excellent performance on AES CBC Encrypt 23 Intel Architecture Group *See Intel technical paper # 2 for full description of methodology and results.
24 Function Stitching Protocols such as SSL/TLS and IPsec apply two functions, confidentiality and integrity Improved performance by using multiple execution units more efficiently Fine grain integration achieves higher performance 1.4X Speedup on AES128 CBC-Encrypt with SHA1 (Cycles/Byte) Method to speedup combined Encrypt/Authenticate 24 Intel Architecture Group *See Intel technical paper # 3 for full description of methodology and results.
25 OpenSSL Performance Improvements Intel developed and released highly optimized cryptographic functions into OpenSSL ~28 Gigabits/second of large secure connections using AES256-SHA1 with RSA1024 for session setup 4.8x faster than latest default version at the system level Dual Intel Xeon Processor X5680 system running the Apache Web-Server application, sending HTTP over SSL to clients on a network. 25 Intel Architecture Group *See Intel technical paper # 14 for full description of methodology and results.
26 Sandy Bridge Performance SNB 2 nd Generation Intel Core improves: AES-NI Throughput SIMD Processing via AVX ISA extensions Large-integer processing (public-key crypto) Multi Buffer Performance (Cycles/byte) Algorithm i5-650 i i Gain MD SHA SHA AES128-CBC-Encrypt Modular Exponentiation Performance (Cycles) Algorithm i5-650 i i Gain 512-bit Modular Exponentiation 360, , bit Modular Exponentiation 2,722,590 1,906, X additional performance gain on SNB! 26 Intel Architecture Group *See Intel technical paper # 10 for full description of methodology and results.
27 Outline Digital signatures on FW updates Hardware Random number generation Anonymous platform attestation Improved protection for user authentication Enhancements for cryptographic performance Protection from Side Channel Attacks 27 Intel Architecture Group
28 Software Side Channels Not Hardware Side Channel where adversary has physical access. Not Software Covert Channel where adversary has malware in a high security partition and a low security partition Software Side Channel Adversary has malware executing in a spy process, and tries to obtain information about an uncompromised target process executing on same platform. Target App with Protected Asset Spy App Inside trust boundary Outside trust boundary OS 28 Intel Architecture Group
29 Protection from software side channels Platform approach for software side channels AES-NI: CPU instructions for a round of AES PCLMULQDQ: CPU instructions for GF(2) Multiplication Recommend side channel mitigated implementations of other crypto algorithms No secret key or data dependent memory access (at coarser than cache line granularity) No secret key or data dependent code branching Ex: RSA implemented with <6% performance reduction in OpenSSL 29 Intel Architecture Group
30
31 Technical Papers Breakthrough AES performance with Intel AES New Instructions 2. Processing Multiple buffers in parallel 3. Fast Cryptographic computation on IA processors via Function Stitching 4. Fast and Constant-time Implementation of Modular Exponentiation 5. Fast CRC Computation for iscsi Polynomial using CRC32 Instruction 6. Optimized Galois-Counter-Mode Implementation on IA Processors 7. High Performance Storage Encryption on Intel Architecture Processors 31 Intel Architecture Group
32 Technical Papers Fast CRC Computation for Generic Polynomials using PCLMULQDQ Instruction 9. High Performance DEFLATE Decompression on Intel Architecture Processors 10.Cryptographic Performance on the 2 nd Generation Intel Core Processor 11.Fast Parallel CRC Computation using the Nehalem CRC32 instruction 12.Using Intel AES New Instructions and PCLMULQDQ to Significantly Improve IPSec Performance on Linux 13.IDF 2010 Presentation with Voice: Examining the Performance of Intel AES New Instructions on Intel Core i7 Processor l 14.Improving OpenSSL Performance on IA 32 Intel Architecture Group
Technologies to Improve. Ernie Brickell
Technologies to Improve Platform Security Ernie Brickell Intel Corporation 9/29/2011 1 Security is Intel s Third Value Pillar Intel is positioning itself to lead in three areas: energy-efficient efficient
Enhanced Privacy ID (EPID) Ernie Brickell and Jiangtao Li Intel Corporation
Enhanced Privacy ID (EPID) Ernie Brickell and Jiangtao Li Intel Corporation 1 Agenda EPID overview EPID usages Device Authentication Government Issued ID EPID performance and standardization efforts 2
Haswell Cryptographic Performance
White Paper Sean Gulley Vinodh Gopal IA Architects Intel Corporation Haswell Cryptographic Performance July 2013 329282-001 Executive Summary The new Haswell microarchitecture featured in the 4 th generation
Improving OpenSSL* Performance
White Paper Vinodh Gopal Jim Guilford Erdinc Ozturk Sean Gulley Wajdi Feghali IA Architects Intel Corporation Improving OpenSSL* Performance October 2011 326232-001 Executive Summary The SSL/TLS protocols
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy 21 June 2010 Table of Contents Introduction Module Specification Ports and Interfaces Approved Algorithms Test Environment Roles
AES-GCM software performance on the current high end CPUs as a performance baseline for CAESAR competition
Directions in Authenticated Ciphers DIAC 2013, 11 13 August 2013, Chicago, USA AES-GCM software performance on the current high end CPUs as a performance baseline for CAESAR competition Shay Gueron University
Security Policy for FIPS 140 2 Validation
BitLocker Windows OS Loader Security Policy for FIPS 140 2 Validation BitLocker Windows OS Loader (winload) in Microsoft Windows 8.1 Enterprise Windows Server 2012 R2 Windows Storage Server 2012 R2 Surface
FIPS 140-2 Non- Proprietary Security Policy. McAfee SIEM Cryptographic Module, Version 1.0
FIPS 40-2 Non- Proprietary Security Policy McAfee SIEM Cryptographic Module, Version.0 Document Version.4 December 2, 203 Document Version.4 McAfee Page of 6 Prepared For: Prepared By: McAfee, Inc. 282
Symantec Corporation Symantec Enterprise Vault Cryptographic Module Software Version: 1.0.0.2
Symantec Corporation Symantec Enterprise Vault Cryptographic Module Software Version: 1.0.0.2 FIPS 140 2 Non Proprietary Security Policy FIPS Security Level: 1 Document Version: 1.1 Prepared for: Prepared
GCM-SIV: Full Nonce Misuse-Resistant Authenticated Encryption at Under One Cycle per Byte. Yehuda Lindell Bar-Ilan University
GCM-SIV: Full Nonce Misuse-Resistant Authenticated Encryption at Under One Cycle per Byte Shay Gueron Haifa Univ. and Intel Yehuda Lindell Bar-Ilan University Appeared at ACM CCS 2015 How to Encrypt with
SkyRecon Cryptographic Module (SCM)
SkyRecon Cryptographic Module (SCM) FIPS 140-2 Documentation: Security Policy Abstract This document specifies the security policy for the SkyRecon Cryptographic Module (SCM) as described in FIPS PUB 140-2.
Intel Identity Protection Technology Enabling improved user-friendly strong authentication in VASCO's latest generation solutions
Intel Identity Protection Technology Enabling improved user-friendly strong authentication in VASCO's latest generation solutions June 2013 Dirk Roziers Market Manager PC Client Services Intel Corporation
Processing Multiple Buffers in Parallel to Increase Performance on Intel Architecture Processors
White Paper Vinodh Gopal Jim Guilford Wajdi Feghali Erdinc Ozturk Gil Wolrich Martin Dixon IA Architects Intel Corporation Processing Multiple Buffers in Parallel to Increase Performance on Intel Architecture
Security Technical. Overview. BlackBerry Enterprise Service 10. BlackBerry Device Service Solution Version: 10.2
BlackBerry Enterprise Service 10 BlackBerry Device Service Solution Version: 10.2 Security Technical Overview Published: 2014-09-10 SWD-20140908123239883 Contents 1 About BlackBerry Device Service solution
Security Policy. Trapeze Networks
MP-422F Mobility Point Security Policy Trapeze Networks August 14, 2009 Copyright Trapeze Networks 2007. May be reproduced only in its original entirety [without revision]. TABLE OF CONTENTS 1. MODULE
VASCO Data Security International, Inc. DIGIPASS GO-7. FIPS 140-2 Non-Proprietary Cryptographic Module Security Policy
VASCO Data Security International, Inc. DIGIPASS GO-7 FIPS 140-2 Non-Proprietary Cryptographic Module Security Policy Security Level: 2 Version: 1.7 Date: August 12, 2015 Copyright VASCO Data Security
Overview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Note The information in this chapter applies to both the ACE module and the ACE appliance unless otherwise noted. The features in this chapter apply to IPv4 and IPv6 unless otherwise noted. Secure
Opal SSDs Integrated with TPMs
Opal SSDs Integrated with TPMs August 21, 2012 Robert Thibadeau, Ph.D. U.S. Army SSDs Must be Opal s We also Studied using the TPM (Trusted Platform Module) with an Opal SSD (Self-Encrypting Drive) 2 Security
IoT Security Platform
IoT Security Platform 2 Introduction Wars begin when the costs of attack are low, the benefits for a victor are high, and there is an inability to enforce law. The same is true in cyberwars. Today there
SECURE USB FLASH DRIVE. Non-Proprietary Security Policy
SECURE USB FLASH DRIVE Non-Proprietary Security Policy FIPS 140-2 SECURITY POLICY VERSION 9 Page 1 of 10 Definitions and Acronyms AES Advanced Encryption Standard CBC Cipher Block Chaining CRC Cyclic Redundancy
Kaseya US Sales, LLC Virtual System Administrator Cryptographic Module Software Version: 1.0
Kaseya US Sales, LLC Virtual System Administrator Cryptographic Module Software Version: 1.0 FIPS 140-2 Non-Proprietary Security Policy FIPS Security Level: 1 Document Version: 1.0 Prepared for: Prepared
Northrop Grumman M5 Network Security SCS Linux Kernel Cryptographic Services. FIPS Security Policy Version 2.42. www.northropgrumman.
Northrop Grumman M5 Network Security SCS Linux Kernel Cryptographic Services FIPS Security Policy Version 2.42 www.northropgrumman.com/m5/ SCS Linux Kernel Cryptographic Services Security Policy Version
Using etoken for SSL Web Authentication. SSL V3.0 Overview
Using etoken for SSL Web Authentication Lesson 12 April 2004 etoken Certification Course SSL V3.0 Overview Secure Sockets Layer protocol, version 3.0 Provides communication privacy over the internet. Prevents
FIPS 140 2 Non Proprietary Security Policy: Kingston Technology DataTraveler DT4000 Series USB Flash Drive
FIPS 140 2 Non Proprietary Security Policy Kingston Technology Company, Inc. DataTraveler DT4000 G2 Series USB Flash Drive Document Version 1.8 December 3, 2014 Document Version 1.8 Kingston Technology
Ciphire Mail. Abstract
Ciphire Mail Technical Introduction Abstract Ciphire Mail is cryptographic software providing email encryption and digital signatures. The Ciphire Mail client resides on the user's computer between the
AES-GCM for Efficient Authenticated Encryption Ending the Reign of HMAC-SHA-1?
Workshop on Real-World Cryptography Stanford University Jan. 9-11, 2013 AES-GCM for Efficient Authenticated Encryption Ending the Reign of HMAC-SHA-1? Shay Gueron University of Haifa Department of Mathematics,
CS 356 Lecture 28 Internet Authentication. Spring 2013
CS 356 Lecture 28 Internet Authentication Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Pulse Secure, LLC. January 9, 2015
Pulse Secure Network Connect Cryptographic Module Version 2.0 Non-Proprietary Security Policy Document Version 1.1 Pulse Secure, LLC. January 9, 2015 2015 by Pulse Secure, LLC. All rights reserved. May
SecureDoc Disk Encryption Cryptographic Engine
SecureDoc Disk Encryption Cryptographic Engine FIPS 140-2 Non-Proprietary Security Policy Abstract: This document specifies Security Policy enforced by SecureDoc Cryptographic Engine compliant with the
Overview of Cryptographic Tools for Data Security. Murat Kantarcioglu
UT DALLAS Erik Jonsson School of Engineering & Computer Science Overview of Cryptographic Tools for Data Security Murat Kantarcioglu Pag. 1 Purdue University Cryptographic Primitives We will discuss the
Security in the Cloud
solution brief Cloud Computing Security in the Cloud Intel Xeon Processor E5-4600/2600/2400/1600 Intel Technologies Enable More Secure Business Computing in the Cloud Would you like to begin transforming
Performance of Software Switching
Performance of Software Switching Based on papers in IEEE HPSR 2011 and IFIP/ACM Performance 2011 Nuutti Varis, Jukka Manner Department of Communications and Networking (COMNET) Agenda Motivation Performance
Accellion Secure File Transfer Cryptographic Module Security Policy Document Version 1.0. Accellion, Inc.
Accellion Secure File Transfer Cryptographic Module Security Policy Document Version 1.0 Accellion, Inc. December 24, 2009 Copyright Accellion, Inc. 2009. May be reproduced only in its original entirety
Intel Identity Protection Technology (IPT)
Intel Identity Protection Technology (IPT) Enabling improved user-friendly strong authentication in VASCO's latest generation solutions June 2013 Steve Davies Solution Architect Intel Corporation 1 Copyright
Analyzing the Security Schemes of Various Cloud Storage Services
Analyzing the Security Schemes of Various Cloud Storage Services ECE 646 Project Presentation Fall 2014 12/09/2014 Team Members Ankita Pandey Gagandeep Singh Bamrah Pros and Cons of Cloud Storage Services
RELEASE NOTES. Table of Contents. Scope of the Document. [Latest Official] ADYTON Release 2.12.9 - corrections. ADYTON Release 2.12.
![RELEASE NOTES. Table of Contents. Scope of the Document. [Latest Official] ADYTON Release 2.12.9 - corrections. ADYTON Release 2.12.](/thumbs/25/6654548.jpg "RELEASE NOTES. Table of Contents. Scope of the Document. [Latest Official] ADYTON Release 2.12.9 - corrections. ADYTON Release 2.12.")
Table of Contents Scope of the Document... 1 [Latest Official] ADYTON Release 2.12.9... 1 ADYTON Release 2.12.4... 1 ADYTON Release 2.9.3... 3 ADYTON Release 2.7.7... 3 ADYTON Release 2.6.2... 4 ADYTON
Communication Security for Applications
Communication Security for Applications Antonio Carzaniga Faculty of Informatics University of Lugano March 10, 2008 c 2008 Antonio Carzaniga 1 Intro to distributed computing: -server computing Transport-layer
Using AES 256 bit Encryption
Using AES 256 bit Encryption April 16 2014 There are many questions on How To Support AES256 bit encryption in an Industrial, Medical or Military Computer System. Programmable Encryption for Solid State
Intel Software Guard Extensions(Intel SGX) Carlos Rozas Intel Labs November 6, 2013
Intel Software Guard Extensions(Intel SGX) Carlos Rozas Intel Labs November 6, 2013 Legal Disclaimers INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR
Authentication requirement Authentication function MAC Hash function Security of
UNIT 3 AUTHENTICATION Authentication requirement Authentication function MAC Hash function Security of hash function and MAC SHA HMAC CMAC Digital signature and authentication protocols DSS Slides Courtesy
CycurHSM An Automotive-qualified Software Stack for Hardware Security Modules
CycurHSM An Automotive-qualified Software Stack for Hardware Security Modules Dr. Frederic Stumpf, ESCRYPT GmbH Embedded Security, Stuttgart, Germany 1 Introduction Electronic Control Units (ECU) are embedded
Hormuzd Khosravi, Principal Engineer, Intel Corporation
Hormuzd Khosravi, Principal Engineer, Intel Corporation Legal Information Intel technologies, features and benefits depend on system configuration and may require enabled hardware, software or service
M-Shield mobile security technology
Technology for Innovators TM M-Shield mobile security technology making wireless secure Overview As 3G networks are successfully deployed worldwide, opportunities are arising to deliver to end-users a
CS155. Cryptography Overview
CS155 Cryptography Overview Cryptography Is n A tremendous tool n The basis for many security mechanisms Is not n The solution to all security problems n Reliable unless implemented properly n Reliable
Using BroadSAFE TM Technology 07/18/05
Using BroadSAFE TM Technology 07/18/05 Layers of a Security System Security System Data Encryption Key Negotiation Authentication Identity Root Key Once root is compromised, all subsequent layers of security
Secure Sockets Layer (SSL ) / Transport Layer Security (TLS) Network Security Products S31213
Secure Sockets Layer (SSL ) / Transport Layer Security (TLS) Network Security Products S31213 UNCLASSIFIED Example http ://www. greatstuf f. com Wants credit card number ^ Look at lock on browser Use https
Side Channel Analysis and Embedded Systems Impact and Countermeasures
Side Channel Analysis and Embedded Systems Impact and Countermeasures Job de Haas Agenda Advances in Embedded Systems Security From USB stick to game console Current attacks Cryptographic devices Side
CS 393 Network Security. Nasir Memon Polytechnic University Module 11 Secure Email
CS 393 Network Security Nasir Memon Polytechnic University Module 11 Secure Email Course Logistics HW 5 due Thursday Graded exams returned and discussed. Read Chapter 5 of text 4/2/02 Module 11 - Secure
eid Security Frank Cornelis Architect eid fedict 2008. All rights reserved
eid Security Frank Cornelis Architect eid The eid Project > Provides Belgian Citizens with an electronic identity card. > Gives Belgian Citizens a device to claim their identity in the new digital age.
Chapter 11 Security+ Guide to Network Security Fundamentals, Third Edition Basic Cryptography
Chapter 11 Security+ Guide to Network Security Fundamentals, Third Edition Basic Cryptography What Is Steganography? Steganography Process of hiding the existence of the data within another file Example:
Chapter 7 Transport-Level Security
Cryptography and Network Security Chapter 7 Transport-Level Security Lectured by Nguyễn Đức Thái Outline Web Security Issues Security Socket Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell
2014 IBM Corporation
2014 IBM Corporation This is the 27 th Q&A event prepared by the IBM License Metric Tool Central Team (ICT) Currently we focus on version 9.x of IBM License Metric Tool (ILMT) The content of today s session
Smart Card- An Alternative to Password Authentication By Ahmad Ismadi Yazid B. Sukaimi
Smart Card- An Alternative to Password Authentication By Ahmad Ismadi Yazid B. Sukaimi Purpose This paper is intended to describe the benefits of smart card implementation and it combination with Public
Trusted Platforms for Homeland Security
Trusted Platforms for Homeland Security By Kevin Schutz, Product Manager Secure Products Summary Ongoing threats from hackers, viruses, and worms continue to make security a top priority for IT and business
Performance Investigations. Hannes Tschofenig, Manuel Pégourié-Gonnard 25 th March 2015
Performance Investigations Hannes Tschofenig, Manuel Pégourié-Gonnard 25 th March 2015 1 Motivation In we tried to provide guidance for the use of DTLS (TLS) when used in
Software Token Security & Provisioning: Innovation Galore!
Software Token Security & Provisioning: Innovation Galore! Kenn Min Chong, Principal Product Manager SecurID, RSA Emily Ryan, Security Solution Architect, Intel Michael Lyman, Product Marketing Manager,
Using the TPM to Solve Today s Most Urgent Cybersecurity Problems
Using the to Solve Today s Most Urgent Cybersecurity Problems May 20, 2014 10:00AM PDT 2 Stacy Cannady, Technical Marketing Trustworthy Computing, Cisco Stacy Cannady, CISSP, is technical marketing - Trustworthy
Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP)
Security Protocols Security Protocols Necessary to communicate securely across untrusted network Provide integrity, confidentiality, authenticity of communications Based on previously discussed cryptographic
Announcement. Final exam: Wed, June 9, 9:30-11:18 Scope: materials after RSA (but you need to know RSA) Open books, open notes. Calculators allowed.
Announcement Final exam: Wed, June 9, 9:30-11:18 Scope: materials after RSA (but you need to know RSA) Open books, open notes. Calculators allowed. 1 We have learned Symmetric encryption: DES, 3DES, AES,
High-speed cryptography and DNSCurve. D. J. Bernstein University of Illinois at Chicago
High-speed cryptography and DNSCurve D. J. Bernstein University of Illinois at Chicago Stealing Internet mail: easy! Given a mail message: Your mail software sends a DNS request, receives a server address,
[SMO-SFO-ICO-PE-046-GU-
Presentation This module contains all the SSL definitions. See also the SSL Security Guidance Introduction The package SSL is a static library which implements an API to use the dynamic SSL library. It
Applying Cryptography as a Service to Mobile Applications
Applying Cryptography as a Service to Mobile Applications SESSION ID: CSV-F02 Peter Robinson Senior Engineering Manager RSA, The Security Division of EMC Introduction This presentation proposes a Cryptography
Transport Layer Security Protocols
SSL/TLS 1 Transport Layer Security Protocols Secure Socket Layer (SSL) Originally designed to by Netscape to secure HTTP Version 2 is being replaced by version 3 Subsequently became Internet Standard known
Fastboot Techniques for x86 Architectures. Marcus Bortel Field Application Engineer QNX Software Systems
Fastboot Techniques for x86 Architectures Marcus Bortel Field Application Engineer QNX Software Systems Agenda Introduction BIOS and BIOS boot time Fastboot versus BIOS? Fastboot time Customizing the boot
Breakthrough AES Performance with. Intel AES New Instructions
White Paper Breakthrough AES Performance with Intel AES New Instructions Kahraman Akdemir, Martin Dixon, Wajdi Feghali, Patrick Fay, Vinodh Gopal, Jim Guilford, Erdinc Ozturk, Gil Wolrich, Ronen Zohar
Chapter 1: Introduction
Chapter 1 Introduction 1 Chapter 1: Introduction 1.1 Inspiration Cloud Computing Inspired by the cloud computing characteristics like pay per use, rapid elasticity, scalable, on demand self service, secure
Acronym Term Description
This glossary contains definitions of terms created by TCG, or terms that have a particular meaning in trusted computing, or terms that cause particular confusion in trusted computing. Acronym Term Description
Security Policy Revision Date: 23 April 2009
Security Policy Revision Date: 23 April 2009 Remote Desktop Support Version 3.2.1 or later for Windows Version 3.1.2 or later for Linux and Mac 4 ISL Light Security Policy This section describes the procedure
SENSE Security overview 2014
SENSE Security overview 2014 Abstract... 3 Overview... 4 Installation... 6 Device Control... 7 Enrolment Process... 8 Authentication... 9 Network Protection... 12 Local Storage... 13 Conclusion... 15 2
Attribute-proving for Smart Cards
Attribute-proving for Smart Cards progress made over the past two years ir. Pim Vullers [email protected] Institute for Computing and Information Sciences Digital Security 5th October 2011 Pim Vullers
Summary of Results. NGINX SSL Performance
NGINX SSL NGINX is commonly used to terminate encrypted SSL and TLS connections on behalf of upstream web and application servers. SSL termination at the edge of an application reduces the load on internal
Disk encryption... (not only) in Linux. Milan Brož [email protected]
Disk encryption... (not only) in Linux Milan Brož [email protected] FDE - Full Disk Encryption FDE (Full Disk Encryption) whole disk FVE (Full Volume Encryption) just some volumes (dis)advantages? + for
OpenFlow with Intel 82599. Voravit Tanyingyong, Markus Hidell, Peter Sjödin
OpenFlow with Intel 82599 Voravit Tanyingyong, Markus Hidell, Peter Sjödin Outline Background Goal Design Experiment and Evaluation Conclusion OpenFlow SW HW Open up commercial network hardware for experiment
Introduction to Cryptography
Introduction to Cryptography Part 3: real world applications Jean-Sébastien Coron January 2007 Public-key encryption BOB ALICE Insecure M E C C D channel M Alice s public-key Alice s private-key Authentication
Cryptography and Key Management Basics
Cryptography and Key Management Basics Erik Zenner Technical University Denmark (DTU) Institute for Mathematics [email protected] DTU, Oct. 23, 2007 Erik Zenner (DTU-MAT) Cryptography and Key Management
UM0586 User manual. STM32 Cryptographic Library. Introduction
User manual STM32 Cryptographic Library Introduction This manual describes the API of the STM32 cryptographic library (STM32-CRYP-LIB) that supports the following cryptographic algorithms: AES-128, AES-192,
Index. BIOS rootkit, 119 Broad network access, 107
Index A Administrative components, 81, 83 Anti-malware, 125 ANY policy, 47 Asset tag, 114 Asymmetric encryption, 24 Attestation commercial market, 85 facts, 79 Intel TXT conceptual architecture, 85 models,
Dr. Cunsheng DING HKUST, Hong Kong. Security Protocols. Security Protocols. Cunsheng Ding, HKUST COMP685C
Cunsheng Ding, HKUST Lecture 06: Public-Key Infrastructure Main Topics of this Lecture 1. Digital certificate 2. Certificate authority (CA) 3. Public key infrastructure (PKI) Page 1 Part I: Digital Certificates
Efficient Framework for Deploying Information in Cloud Virtual Datacenters with Cryptography Algorithms
Efficient Framework for Deploying Information in Cloud Virtual Datacenters with Cryptography Algorithms Radhika G #1, K.V.V. Satyanarayana *2, Tejaswi A #3 1,2,3 Dept of CSE, K L University, Vaddeswaram-522502,
Achieving Nanosecond Latency Between Applications with IPC Shared Memory Messaging
Achieving Nanosecond Latency Between Applications with IPC Shared Memory Messaging In some markets and scenarios where competitive advantage is all about speed, speed is measured in micro- and even nano-seconds.
Overview of CSS SSL. SSL Cryptography Overview CHAPTER
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet, ensuring secure transactions such as the transmission of credit card numbers
Network Security Essentials Chapter 5
Network Security Essentials Chapter 5 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 5 Transport-Level Security Use your mentality Wake up to reality From the song, "I've Got
OPTIMIZE DMA CONFIGURATION IN ENCRYPTION USE CASE. Guillène Ribière, CEO, System Architect
OPTIMIZE DMA CONFIGURATION IN ENCRYPTION USE CASE Guillène Ribière, CEO, System Architect Problem Statement Low Performances on Hardware Accelerated Encryption: Max Measured 10MBps Expectations: 90 MBps
Table of Contents. Bibliografische Informationen http://d-nb.info/996514864. digitalisiert durch
1 Introduction to Cryptography and Data Security 1 1.1 Overview of Cryptology (and This Book) 2 1.2 Symmetric Cryptography 4 1.2.1 Basics 4 1.2.2 Simple Symmetric Encryption: The Substitution Cipher...
How To Understand And Understand The Security Of A Key Infrastructure
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 12 Applying Cryptography Objectives Define digital certificates List the various types of digital certificates and how they are used
Communication Systems 16 th lecture. Chair of Communication Systems Department of Applied Sciences University of Freiburg 2009
16 th lecture Chair of Communication Systems Department of Applied Sciences University of Freiburg 2009 1 25 Organization Welcome to the New Year! Reminder: Structure of Communication Systems lectures
Dashlane Security Whitepaper
Dashlane Security Whitepaper November 2014 Protection of User Data in Dashlane Protection of User Data in Dashlane relies on 3 separate secrets: The User Master Password Never stored locally nor remotely.
Certicom Security for Government Suppliers developing client-side products to meet the US Government FIPS 140-2 security requirement
certicom application notes Certicom Security for Government Suppliers developing client-side products to meet the US Government FIPS 140-2 security requirement THE PROBLEM How can vendors take advantage
SECURE IMPLEMENTATIONS OF CONTENT PROTECTION (DRM) SCHEMES ON CONSUMER ELECTRONIC DEVICES
SECURE IMPLEMENTATIONS OF CONTENT PROTECTION (DRM) SCHEMES ON CONSUMER ELECTRONIC DEVICES Contents Introduction... 3 DRM Threat Model... 3 DRM Flow... 4 DRM Assets... 5 Threat Model... 5 Protection of
SECUDE AG. FinallySecure Enterprise Cryptographic Module. FIPS 140-2 Security Policy
SECUDE AG FinallySecure Enterprise Cryptographic Module (SW Version: 1.0) FIPS 140-2 Security Policy Document Version 2.4 04/22/2010 Copyright SECUDE AG, 2010. May be reproduced only in its original entirety
Proof of Concept Guide
Proof of Concept Guide Version 4.0 Published: OCT-2013 Updated: 2005-2013 Propalms Ltd. All rights reserved. The information contained in this document represents the current view of Propalms Ltd. on the
CLOUD SECURITY: Secure Your Infrastructure
CLOUD SECURITY: Secure Your Infrastructure 1 Challenges to security Security challenges are growing more complex. ATTACKERS HAVE EVOLVED TECHNOLOGY ARCHITECTURE HAS CHANGED NIST, HIPAA, PCI-DSS, SOX INCREASED
Security Overview for Windows Vista. Bob McCoy, MCSE, CISSP/ISSAP Technical Account Manager Microsoft Corporation
Security Overview for Windows Vista Bob McCoy, MCSE, CISSP/ISSAP Technical Account Manager Microsoft Corporation Agenda User and group changes Encryption changes Audit changes User rights New and modified
Secure Storage. Lost Laptops
Secure Storage 1 Lost Laptops Lost and stolen laptops are a common occurrence Estimated occurrences in US airports every week: 12,000 Average cost of a lost laptop for a corporation is $50K Costs include
SNAPcell Security Policy Document Version 1.7. Snapshield
SNAPcell Security Policy Document Version 1.7 Snapshield July 12, 2005 Copyright Snapshield 2005. May be reproduced only in its original entirety [without revision]. TABLE OF CONTENTS 1. MODULE OVERVIEW...3
MySQL Security: Best Practices
MySQL Security: Best Practices Sastry Vedantam [email protected] Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes
Software Execution Protection in the Cloud
Software Execution Protection in the Cloud Miguel Correia 1st European Workshop on Dependable Cloud Computing Sibiu, Romania, May 8 th 2012 Motivation clouds fail 2 1 Motivation accidental arbitrary faults
Patterns for Secure Boot and Secure Storage in Computer Systems
Patterns for Secure Boot and Secure Storage in Computer Systems Hans Löhr, Ahmad-Reza Sadeghi, Marcel Winandy Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany {hans.loehr,ahmad.sadeghi,marcel.winandy}@trust.rub.de