# US 8,788,841 B2 · Representation and verification of data for safe computing environments and systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,788,841 B2
- Document ID: US8788841B2
- Status: Granted
- Kind: B2
- Application number: 12/256,773
- Filed: 2008-10-23
- Published: 2010-04-29
- Granted: 2014-07-22
- Earliest claimed: 2008-10-23
- Assignees: Samsung Electronics Co., Ltd.
- Applicants: Onur Aciicmez; Jean-Pierre Seifert; Xinwen Zhang; Afshin Latifi
- Inventors: Onur Aciicmez; Jean-Pierre Seifert; Xinwen Zhang; Afshin Latifi
- Web page: https://patentgrep.com/patent/US8788841B2

## CPC

- G06F 16/24568: {Data stream processing; Continuous queries}
- G06F 21/565: {by checking file integrity}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Techniques for representation and verification of data are disclosed. The techniques are especially useful for representation and verification of the integrity of data (integrity verification) in safe computing environments and/or systems (e.g., Trusted Computing (TC) systems and/or environments). Multiple independent representative values can be determined independently and possibly in parallel for respective portions of the data. The independent representative values can, for example, be hash values determined at the same time for respective distinct portions of the data. The integrity of the data can be determined based on the multiple hash values by, for example, processing them to determine a single hash value that can serve as an integrity value.

## Claims

### Claim 1

A computer-implemented method for integrity verification of data in a computing device based on representative values for said data, wherein said computer-implemented method comprises:
determining a number of multiple independent processing streams;
dividing said data into said number of multiple independent processing streams for processing simultaneously and in parallel, wherein said multiple independent processing streams comprise a first data set including one or more data portions of said data in a first arrangement, and a second data set including one or more data portions of said data in a second arrangement, and wherein said first data set and said second data set are of equal or varying sizes, discrete or overlapping;
determining a first one-way mapping value for said first data set as a first representative value of said first data set, wherein said first one-way mapping value is not intended to map back to said first data set, and wherein said first one-way mapping value is based on each data portion of said first data set and said first arrangement; and
determining a second one-way mapping value for said second data set as a second representative value of said second data set, wherein said second one-way mapping value is not intended to map back to said second data set, wherein said second one-way mapping value is based on each data portion of said second data set and said second arrangement, and wherein said second one-way mapping value is determined independently from said first one-way mapping value, thereby determining simultaneously and in parallel two independent one-way mapping values based on said data;
wherein data partition information indicating how to divide said data into said multiple independent processing streams is generated; and
wherein said integrity verification of said data is based on said first representative value and said second representative value.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein:
said determining of said first one-way mapping value comprises determining a first hash value for said first data set; and
said determining of said second one-way mapping value comprises determining a second hash value for said second data set.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, wherein said first and second hash values are first and second cryptographic hash values intended to be irreversible.

### Claim 4 (depends on 3)

The computer-implemented method of claim 3, wherein said method further comprises:
determining, based on said first and second cryptographic hash values, a third value; and
digitally signing said third value to generate a digitally signed value for said data.

### Claim 5 (depends on 2)

The computer-implemented method of claim 2, wherein said method further comprises:
determining, based on said first and/or second representative values, a third value; and
authenticating said third value to effectively generate an authenticated value of said data.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein said first and second data sets are one or more of the following:
two discrete data portions of said data;
two overlapping data portions of said data that overlap with respect to content of said data; and
two data portions of said data that repeat a portion of the content of said data.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, wherein:
said determining of said second representative value and said determining of said first representative value are performed as two separate processing streams; and
said method further comprises:
determining, based on said first and second representative values, a third representative value to represent said data.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1, wherein said determining of said second representative value and said determining of said first representative value are performed at the same time.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1, wherein said determining of said second representative value and said determining of said first representative value are performed as two separate processing streams at the same time.

### Claim 10 (depends on 2)

The computer-implemented method of claim 2, wherein said determining of said second representative value and said determining of said first representative value are performed at the same time as a Single Instruction Multiple Data (SIMD) operation.

### Claim 11 (depends on 2)

The computer-implemented method of claim 2, wherein said determining of said second representative value and said determining of said first representative value are performed at the same time by a Multi Core processor.

### Claim 12 (depends on 1)

The computer-implemented method of claim 1, wherein:
each data set is subdivided in two or more data sub-portions that are processed in sequence when determining a one-way mapping value for said data set.

### Claim 13 (depends on 1)

The computer-implemented method of claim 1, wherein said method further comprises:
representing said data by using both of said first and second representative values;
wherein each data set comprises one of: one or more sequential data portions of said data, and one or more non-sequential data portions of said data.

### Claim 14 (depends on 1)

The computer-implemented method of claim 1, wherein said first and second representative values respectively represent first and second integrity values or measurements for said first and second data sets.

### Claim 15 (depends on 1)

The computer-implemented method of claim 1, wherein:
said data partition information is used for determining how to divide said data in order to recalculate said first and second representative values;
said first and second representative values are hash values and/or message digests of said first and second data sets, respectively; and
said first and second representative values are determined in parallel and/or simultaneously.

### Claim 16 (depends on 1)

The computer-implemented method of claim 1, wherein said determining of said second representative value and said determining of said first representative value are respectively performed by first and second processors.

### Claim 17 (depends on 11)

The computer-implemented method of claim 11, wherein said first and second processor can be one or more of the following:
a Central Processing Unit (CPU), a Graphical Processing Unit (GPU), a specialized processor, a MMX (or iwMMXT) instruction compliant processor for embedded systems, a Single Instruction Multiple Data processor (SIMD), a Multiple Instruction Multiple Data processor, a Dual Core processor, a Quad-core processor, a Multi Core processor.

### Claim 18 (depends on 1)

The computer-implemented method of claim 1, further comprising:
mapping said first and second representative values to first and second integer values, respectively.

### Claim 19 (depends on 1)

The computer-implemented method of claim 1, wherein said determining of said second representative value and said determining of said first representative value include evaluating a SHA function.

### Claim 20 (depends on 2)

The computer-implemented method of claim 2, wherein the method comprises one or more of the following:
determining based on said first and/or second representative value, a third representative value representative of said data;
concatenating said first and second representative values to determine a third representative value representative of said data; and
combining said first and second representative values to determine a third representative value representative of said data.

### Claim 21 (depends on 20)

The computer-implemented method of claim 20, wherein said method comprises one or more of the following:
representing said first portion of said data by said first representative value;
representing said second portion of said data by said second representative value
representing said data by first and/or second representative values;
representing said data by said third representative value; and
authenticating said first, second and/or third representative values.

### Claim 22 (depends on 1)

The computer-implemented method of claim 1, wherein said method further comprises:
obtaining said data; and
dividing said data into at least said first and second data sets, wherein each of said first and second data sets are further subdivided into a plurality of sub-portions arranged for sequential processing in order to determine said first and second representative values.

### Claim 23 (depends on 22)

The computer-implemented method of claim 22, wherein said obtaining of said data includes: receiving, reading, loading and/or determining said data.

### Claim 24 (depends on 22)

The computer-implemented method of claim 22, wherein the method further comprises:
wherein said third representative value represents an integrity value for said data, and
wherein said data includes for one or more of the following: executable code, an operating system, boot code, a file system, and one or more files.

### Claim 25

A computer-implemented method for integrity verification of data in a computing device based on one or more integrity values for said data,
wherein said computer-implemented method comprises:
determining a number of multiple independent processing streams;
dividing said data into said number of multiple independent processing streams for processing simultaneously and in parallel, wherein said multiple independent processing streams comprise a first data set including one or more data portions of said data in a first arrangement, and a second data set including one or more data portions of said data in a second arrangement, and wherein said first data set and said second data set are of equal or varying sizes, discrete or overlapping;
determining a first hash value for said first data set, wherein said first hash value is based on each data portion of said first data set and said first arrangement;
determining a second hash value for said second data set, wherein said second hash value is based on each data portion of said second data set and said second arrangement, and wherein said second hash value is determined independently from said first hash value, thereby determining two independent hash values simultaneously and in parallel; and
determining, based on said first and second hash values, one or more integrity values for said data, wherein said integrity verification of said data is based on said one or more integrity values;
wherein data partition information indicating how to divide said data into said multiple independent processing streams is generated.

### Claim 26 (depends on 25)

A computer-implemented method as recited in claim 25, wherein:
said determining of said first hash value and said determining of said second
hash value are performed at the same time as a Single Instruction Multiple Data (SIMD) operation; and
said data partition information is used for determining how to divide said data in order to determine said first and second hash values.

### Claim 27 (depends on 26)

The computer-implemented method of claim 26, wherein said determining of said one or more integrity values comprises one or more of the following:
determining, based on said first and second hash values, an integrity value for said data;
concatenating said first and second hash values to determine a concatenated value as an integrity value for said data;
determining said hash values of said concatenated value as an integrity value for value for said data; and
determining an integrity value for said data based on hash values of said first and/or second hash value.

### Claim 28

A computer-implemented method for integrity verification of data in a computing device based on one or more integrity values for said data, wherein said computer-implemented method comprises:
determining a number of multiple independent processing streams to process simultaneously and in parallel in order to generate simultaneously and in parallel multiple hash values for said data;
dividing said data into said number of multiple independent processing streams, wherein each independent processing stream comprises a corresponding data set including one or more data portions of said data in a corresponding arrangement, and wherein data sets of said multiple independent processing streams are of equal or varying sizes, discrete or overlapping;
process said multiple independent processing streams simultaneously and in parallel in order to generate an independent hash value for each one of said multiple independent processing streams, wherein each independent hash value for each independent processing stream is based on each data portion of a corresponding data set and a corresponding arrangement, and wherein said hash values are independent from one another; and
determining, based on said hash values, one or more integrity values for said data, wherein said integrity verification of said data is based on said one or more integrity values;
wherein data partition information indicating how to divide said data into said multiple independent processing streams is generated.

### Claim 29 (depends on 28)

The computer-implemented method of claim 28, wherein:
said multiple processing streams are processing using a Single Instruction Multiple Data (SIMD) operation; and
said data partition information is used for determining how to divide said data in order to generate said hash values.

### Claim 30 (depends on 28)

The computer-implemented method of claim 28, wherein:
said multiple processing streams are each subdivided into sub-portions in accordance with a specific hashing algorithm used; and
said sub-portions are processed as data using Single Instruction Multiple Data (SIMD) operation, wherein said single operation is a hashing operation that effectively maps said sub-portions to a hashing values in accordance with said specific hashing algorithm.

### Claim 31 (depends on 30)

The computer-implemented method of claim 30, wherein said specific hashing algorithm is of the following:
HA VAL, MD2, MD4, MD5, PANAMA, RadioGatun, RIPEMD, RIPEMD-128/256, RIPEMD-160/320, SHA-0, SHA-1, SHA-256/224, SHA-512/384, Tiger(2)-192/160/128, and WHIRLPOOL.

### Claim 32 (depends on 30)

The computer-implemented method of claim 30, wherein said computer-implemented method further comprises one or more of the following:
generating data partition information that indicates how to divide said data in order to determine said first and second hash values; and
generating integrity value generation information that indicates how to determine said one or more integrity values.

### Claim 33

A computer-implemented method of verifying the integrity of data, wherein said computer-implemented method comprises:
determining a number of multiple independent processing streams;
determining multiple independent hash values simultaneously and in parallel by dividing said data into said number of multiple independent processing streams, wherein each independent processing stream comprises a corresponding data set including one or more data portions of said data in a corresponding arrangement, wherein data sets of said multiple independent processing streams are of equal or varying sizes, discrete or overlapping, wherein said multiple independent hash values include an independent hash value for each independent processing stream, wherein each independent hash value for each independent processing stream is based on each data of a corresponding data set and a corresponding arrangement, and wherein said multiple independent hash values are independent from one another; and
verifying the integrity of said data based on said multiple independent hash values;
wherein data partition information indicating how to divide said data into said multiple independent processing streams is generated.

### Claim 34 (depends on 33)

The computer-implemented method of claim 33, wherein:
said verifying of said integrity of said data comprises one or more of the following:
determining, based on said multiple independent hash values, one or more integrity values; and
comparing said one or more integrity values to one or more integrity expected values; and said data partition information is used for determining how to divide said data in order to determine said multiple independent hash values.

### Claim 35

A non-transitory computer readable storage medium including at least executable computer program code embodied in a tangible form for integrity verification of data in a computing device based on representative values for said data, wherein said computer readable medium includes:
executable computer program code for determining a number of multiple independent processing streams;
executable computer program code for dividing said data into said number of multiple independent processing streams for processing simultaneously and in parallel, wherein said multiple independent processing streams comprise a first data set including one or more data portions of said data in a first arrangement, and second data set including one or more data portions of said data in a second arrangement, and wherein said first data set and said second data set are of equal or varying sizes, discrete or overlapping;
executable computer program code for determining a first one-way mapping value for said first data set as a first representative value of said first data set, wherein said first one-way mapping value is not intended to map back to said first data set, and wherein said first one-way mapping value is based on each data portion of said first data set and said first arrangement; and
executable computer program code for determining a second one-way mapping value for said second data set as a second representative value of said second data set, wherein said second one-way mapping value is not intended to map back to said second data set, wherein said second one-way mapping value is based on each data portion of said second data set and said second arrangement; and
executable computer program code for determining said first and second one-way mapping values at the same time, in parallel and simultaneously;
wherein data partition information indicating how to divide said data into said multiple independent processing streams is generated; and
wherein said integrity verification of said data is based on said first representative value and said second representative value.

### Claim 36 (depends on 35)

The non-transitory computer readable medium of claim 35, wherein: said data partition information is used for determining how to divide said data in order to recalculate said first and second representative values; and said first and second one-way mapping values are hash values.