Afshin Latifi

US Patent:

8510805, Aug 13, 2013

Filed:

Apr 23, 2008

Appl. No.:

12/108455

Inventors:

Xinwen Zhang - San Jose CA, US
Jean-Pierre Seifert - Pettneu am Arlberg, AT
Onur Aciicmez - San Jose CA, US
Afshin Latifi - San Jose CA, US

Assignee:

Samsung Electronics Co., Ltd. - Suwon

International Classification:

G06F 15/16
H04L 29/06
G06F 17/30

US Classification:

726 4, 726 1, 713164, 713166

Abstract:

Improved techniques for controlling access to accessible components of computing environments are disclosed. The techniques, among other things, can be used to provide Mandatory Access Control (MAC) mechanisms for mobile and embedded systems. One or more accessible components (e. g. , accessible resources) which a component may attempt to access are determined so that one or more access permissions can be stored in a manner that they can be obtained if the component attempts to access the one or more accessible components, thereby allowing access to the one or more accessible components to be determined based on access permissions that are readily available. Generally, access permissions can be identified and stored in anticipation of need. Access permissions can be identified, for example, based on the likelihood of use, or all possible access permissions can be determined and stored. A safe (e. g.

US Patent:

8595834, Nov 26, 2013

Filed:

Feb 4, 2008

Appl. No.:

12/025678

Inventors:

Liang Xie - State College PA, US
Xinwen Zhang - San Jose CA, US
Jean-Pierre Seifert - San Jose CA, US
Onur Aciicmez - San Jose CA, US
Afshin Latifi - San Jose CA, US

Assignee:

Samsung Electronics Co., Ltd - Suwon

International Classification:

G06F 21/00
H04L 29/06

US Classification:

726 23, 726 22

Abstract:

Techniques for detecting unauthorized use (e. g. , malicious attacks) of the computing systems (e. g. , computing devices) are disclosed. Unauthorized use can be detected based on patterns of use (e. g. , behavioral patterns of use typically associated with a human being) of the computing systems. Acceptable behavioral pattern data can be generated for a computing system by monitoring the use of a support system (e. g. , an operating system, a virtual environment) operating on the computing system. For example, a plurality of system support provider components of a support system (e. g. , system calls, device drivers) can be monitored in order to generate the acceptable behavioral pattern data in a form which effectively defines an acceptable pattern of use (usage pattern) for the monitored system support provider components, thereby allowing detection of unauthorized use of a computing system by detecting any deviation from the acceptable pattern of use of the monitored system support provider components.

US Patent:

8621551, Dec 31, 2013

Filed:

Apr 18, 2008

Appl. No.:

12/106235

Inventors:

Xinwen Zhang - San Jose CA, US
Liang Xie - State College PA, US
Jean-Pierre Seifert - San Jose CA, US
Onur Aciicmez - San Jose CA, US
Afshin Latifi - San Jose CA, US

Assignee:

Samsung Electronics Company, Ltd. - Suwon

International Classification:

G06F 21/00

US Classification:

726 1

Abstract:

Techniques for managing and protecting computing environments are disclosed. A safe computing environment can be provided for ensuring the safety and/or management of a device. The safe computing environment can be secured by a safe component that isolates and protects it from unsafe computing environments which may also be operating. As a result, various security and management activities can be securely performed from a safe computing environment. A safe computing environment can, for example, be provided on a device as a safe virtual computing environment (e. g. , a safe virtual machine) protected by a safe virtual computing monitor (e. g. , a safe virtual machine monitor) from one or more other virtual computing environments that are not known or not believed to be safe for the device. It will also be appreciated that the safe components can, for example, be provided as trusted components for a device. As such, various trusted components (or agent) can operate in a trusted computing environment secured from interference by components that many not be trusted and perform various security and/or management tasks alone or in connection, for example, with other trusted components (e. g.

US Patent:

8631468, Jan 14, 2014

Filed:

Nov 10, 2008

Appl. No.:

12/267990

Inventors:

Xinwen Zhang - San Jose CA, US
Jean-Pierre Seifert - Santa Clara CA, US
Onur Aciicmez - San Jose CA, US
Afshin Latifi - San Jose CA, US

Assignee:

Samsung Electronics Co., Ltd. - Suwon

International Classification:

G06F 17/30
G06F 7/04
G06F 15/16

US Classification:

726 4, 726 1, 726 17, 726 26, 726 27, 709226

Abstract:

Techniques for controlling access are disclosed. The techniques can be used for reference monitoring in various computing systems (e. g. , computing device) including those that may be relatively more susceptible to threats (e. g. , mobile phones). Allowed access can be disallowed. In other words, permission to access a component can be effectively withdrawn even though access may be on-going. After permission to access a component has been allowed, one or more disallow access conditions or events can be effectively monitored in order to determine whether to withdraw the permission to access the component. As a result, allowed access to the component can be disallowed. Access can be disallowed by effectively considering the behavior of a component in the aggregate and/or over a determined amount of time. By way of example, a messaging application can be disallowed access to a communication port if the messaging application sends more messages than an acceptable limit during a session or in 4 hours. Disallow-access policies, rules and/or conditions can be defined and modified, for example, by end-users and system administrators, allowing a customizable and flexible security environment that is more adaptable to change.

US Patent:

20090300049, Dec 3, 2009

Filed:

Jun 3, 2008

Appl. No.:

12/132541

Inventors:

Xinwen ZHANG - San Jose CA, US
Jean-Pierre Seifert - San Jose CA, US
Onur Aciicmez - San Jose CA, US
Afshin Latifi - San Jose CA, US

Assignee:

SAMSUNG ELECTRONICS CO., LTD. - Suwon City

International Classification:

G06F 17/00

US Classification:

707102, 7071041, 707E17044

Abstract:

Improved verification techniques for verification of the integrity of various computing environments and/or computing systems are disclosed. Verifiable representative data can effectively represent verifiable content of a computing environment, thereby allowing the integrity of the computing environment to be verified based on the verifiable representative data instead of the content being represented. Verifiable representative data can effectively include selected portions of the content (e.g., selected content which may be of general and/or specific security interest) and can be generally smaller than the verifiable content it represents. As such, it may generally be more efficient to use the verifiable representative data instead of the content it represents. Verifiable representative data can also be organized. By way of example, unstructured content (e.g., a configuration file written in text) can be effectively transformed based on a scheme (e.g., an XML schema) into a structured text-based content written in a structured language (e.g., XML). Verifiable organized representative data can be organized in accordance with various organizational aspects including, for example, structural, semantics, parameter verification, parameter simplification, and other organizational rules and/or preferences. Organization of verifiable organized representative data can be verified as an additional measure of its integrity, and by in large the integrity of a computing environment and/or system being effectively represented by the verifiable representative data.

US Patent:

20100106976, Apr 29, 2010

Filed:

Oct 23, 2008

Appl. No.:

12/256773

Inventors:

Onur ACIICMEZ - San Jose CA, US
Jean-Pierre SEIFERT - Santa Clara CA, US
Xinwen ZHANG - San Jose CA, US
Afshin LATIFI - San Jose CA, US

Assignee:

SAMSUNG ELECTRONICS CO., LTD. - Suwon City

International Classification:

G06F 21/00

US Classification:

713189

Abstract:

Techniques for representation and verification of data are disclosed. The techniques are especially useful for representation and verification of the integrity of data (integrity verification) in safe computing environments and/or systems (e.g., Trusted Computing (TC) systems and/or environments). Multiple independent representative values can be determined independently and possibly in parallel for respective portions of the data. The independent representative values can, for example, be hash values determined at the same time for respective distinct portions of the data. The integrity of the data can be determined based on the multiple hash values by, for example, processing them to determine a single hash value that can serve as an integrity value. By effectively dividing the data into multiple portions in multiple processing streams and processing them in parallel to determine multiple hash values simultaneously, the time required for hashing the data can be reduced in comparison to conventional techniques that operate to determine a hash value for the data as a whole and in a single processing stream. As a result, the time required for integrity verification can be reduced, thereby allowing safe features to be extended to devices that may operate with relatively limited resources (e.g., mobile and/or embedded devices) as well as improving the general efficiency of device that are or will be using safety features (e.g., Trusted Computing (TC) device).

US Patent:

20100117873, May 13, 2010

Filed:

Nov 10, 2008

Appl. No.:

12/268001

Inventors:

Onur ACIICMEZ - San Jose CA, US
Jean-Pierre SEIFERT - Santa Clara CA, US
Xinwen ZHANG - San Jose CA, US
Afshin LATIFI - San Jose CA, US

Assignee:

SAMSUNG ELECTRONICS CO., LTD. - Suwon City

International Classification:

H03M 7/30

US Classification:

341 51

Abstract:

Techniques for hashing and decompression of data are disclosed. Hashing and decompression of compressed data can be integrated in order to effectively hash and decompress the compressed data at the same time. The integrated hashing and decompression techniques of the invention are useful for any computing environment and/or system where compressed data is hashed and decompressed. The invention is especially useful for safe computing environment and/or system (e.g., a Trusted Computing (TC) computing environment) where hashing decompression of compressed data can be routinely performed. The Integrity of a computing environment and/or system can be protected by integrating the decompressing and hashing of the compressed data or effectively hashing and decompressing the compressed data at the same time. A combined hashing and decompression function can be provided based on conventional hashing and compression functions by integrating their similar components and in an efficient manner.