Digital field of view

Abstract

To provide a method for validating and sharing view information for devices in a system.SOLUTION: The method includes validating software and hardware instances for the devices in a system; obtaining device identifiers for the devices in the system; generating a spatial representation of a local digital field of view (DFoV) using a confidential variable and / or a spatial representation of an external DFoV using an external confidential variable from one or more external parties; and exporting the local DFoV and / or the external DFoV to another device in the system to represent information about the device in a spatial map.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] (CROSS-REFERENCE TO RELATED APPLICATIONS) This application claims the benefit of earlier filed U.S. Provisional Patent Application No. 63 / 553,533, filed February 14, 2024 (the '533 application), and U.S. Provisional Patent Application No. 63 / 728,815, filed December 6, 2024 (the '815 application). The '533 application and the '815 application are incorporated herein by reference. [Background technology]

[0002] Global markets are undergoing a digital transformation in which high-performance computing, communications, and software technologies are essential enablers for the coming autonomous and intelligent command and control used in new commerce and infrastructure. Data integrity and software integrity are continuously exposed to attacks from hackers and insiders. Software and data corruption leads to high vulnerabilities in devices and systems that contain and / or use data and software, with devastating consequences. Intellectual property theft and reverse engineering by insiders and espionage result in billions of dollars in lost return on investment and competitiveness each year. To execute the digital transformation, global markets and governments must apply digital engineering, which relies heavily on data and software integrity.

[0003] As referred to herein, digital field of view (DFoV) refers to a process for employing continuous digital engineering data / software integrity verification across a range of data and software applications. Maintaining integrity in a DFoV is challenging for the following reasons: 1. A central authority may not be feasible. 2. The digital environment is dynamic and constantly changing. 3. The environment must maintain interoperability and backward compatibility. 4. The DFoV may contain proprietary commercial software or service elements. 5. Verifying that elements, including open source, are trustworthy is expensive.

[0004] Companies are reluctant to subject their hardware and software offerings to independent validation testing because it would expose their critical IP to theft, malware insertion, or reverse engineering. These and other challenges slow progress in advancing digital transformation.

[0005] As data sets grow, new methods for securely managing digital configurations are needed. Digital configurations must allow for validation of the DFoV while accounting for necessary and constant changes within the DFoV. DFoVs change due to software version updates, the inclusion or removal of elements, patches, etc. Traditional methods of cryptographic authentication are the basis for data validation at the application module level. However, as the DFoV grows and incorporates more modules, the use of hash functions becomes unreliable due to the propagation delay of corresponding hash digest values, which may cause changes before the means to validate them are available. Furthermore, the threat of insider corruption of data or software code results in loss of traceability despite cryptographic practices. Failure to resolve an item can result in denial of service and outages for the system as a whole. Solutions are needed that enable digital transformation to progress. Summary of the Invention

[0006] A method is provided for validating and sharing view information of a device in a system, the method including validating software and hardware instances of a device in the system, obtaining a device identifier for the device in the system, generating a spatial representation of a local digital field of view using secret variables and / or a spatial representation of an external digital field of view using external secret variables from one or more external parties, and exporting the local digital field of view and / or the external digital field of view to another device in the system to represent information about the device in a spatial map. [Brief explanation of the drawings]

[0007] Example embodiments are described with additional specificity and detail using the accompanying drawings, with the understanding that the drawings depict only some embodiments and therefore should not be considered limiting in scope. [Figure 1] FIG. 1 is a flow diagram of an exemplary method for protecting data. [Figure 2] FIG. 1 is a flow diagram for converting data into a watermarked mutant image. [Figure 2A] FIG. 2 is a diagram of an example of protected data. [Figure 2B] FIG. 2B is a diagram of an exemplary watermarking of the data shown in FIG. 2A. [Figure 2C] FIG. 2B is a diagram of exemplary watermarked mutation data generated from the data shown in FIG. 2A. [Figure 3] FIG. 1 is a flow diagram of an exemplary method for data validation. [Figure 4] FIG. 10 is a flow diagram of another exemplary method for data validation. [Figure 5A] FIG. 2B is an exemplary randomly distributed pixelated image derived from the data shown in FIG. 2A. [Figure 5B] FIG. 10 is an exemplary 3D mutation image derived from the data. [Figure 5C] FIG. 1 is a diagram of an exemplary probability distribution derived from data. [Figure 5D]FIG. 1 is a diagram of an exemplary probability distribution derived from data. [Figure 6] FIG. 1 is a flow diagram of an exemplary method for validating and sharing view information. [Figure 7A] FIG. 1 is a diagram of a universal digital field of view. [Figure 7B] FIG. 1 is a diagram of multiple digital views for different authorities. [Figure 8] FIG. 1 is a block diagram of an exemplary system. [Figure 9] FIG. 1 is a block diagram of a system that uses digital vision to provide data integrity verification of a design environment, according to one embodiment of the present invention.

[0008] In accordance with common practice, the various illustrated features are not drawn to scale but rather to emphasize specific features relevant to the exemplary embodiments. DETAILED DESCRIPTION OF THE INVENTION

[0009] In the following detailed description, reference is made to the accompanying drawings that form a part hereof, and in which are shown by way of illustration specific illustrative embodiments. It should be understood, however, that other embodiments may be utilized and that logical, mechanical, and electrical changes may be made. Furthermore, the methods presented in the drawings and specification should not be construed as limiting the order in which individual steps may be performed. Therefore, the following detailed description is not to be construed in a limiting sense.

[0010] Data protection through randomized spatial imaging Global markets are undergoing a digital transformation in which high-performance computing, communications, and software technologies are essential enablers for the coming autonomous and intelligent command and control used in new commerce and infrastructure. Data integrity and software integrity are continuously exposed to attacks from hackers and insiders. Software and data corruption leads to high vulnerabilities in devices and systems that contain and / or use data and software, with devastating consequences. Intellectual property theft and reverse engineering by insiders and espionage result in billions of dollars in lost return on investment and competitiveness each year. To execute the digital transformation, global markets and governments must apply digital engineering, which relies heavily on data and software integrity.

[0011] Traditionally, data undergoes several processes before being stored in a data file. For example, symmetric and / or asymmetric hashing tools are used to encrypt the data file before storage or transmission. However, if an unauthorized actor has access to the data file (e.g., if they are employed by the company that created the data file), they can decrypt the data file and obtain the original data. If this occurs, they can modify the data, rehash the data, and encrypt the data with a timestamp that hides the modification. In these situations, this corrupted data file, when used and distributed, appears to be a normal data file with legitimate encryption. Current technologies for data integrity are unable to detect this type of corrupted data file.

[0012] Companies are reluctant to subject their hardware and software offerings to independent validation testing because it would expose their valuable intellectual property (IP) to the risk of theft, malware insertion, or reverse engineering. These and other challenges slow progress in advancing digital transformation.

[0013] Exemplary techniques for protecting data described herein ensure data integrity through conversion of the data into a three-dimensional (3D) variant image and analysis of the 3D variant image. The 3D variant image contains randomly distributed pixels and imperfections that can be analyzed and used for data validation to ensure that the received data has not been altered from the original version. Some of the randomly distributed pixels may contain watermarks used to identify strategically important or exploitable data that is likely to be targeted by malicious actors.

[0014] 1 illustrates a flow diagram of an exemplary method 100 for securing data. In the example described with respect to FIG. 1, the data may include any data that may be a target for insider threats. For example, the data may include, but is not limited to, software code, tools, images, drawings, digitized data, and / or text. Typically, software code is created using a text editor or visual programming tool.

[0015] The method 100 includes transforming data into a watermarked mutant image (block 102). This transformation includes adding one or more types of strategically placed watermarks to the original data to be protected, mutating the watermarked data, and mutating the watermarked mutant data into an image (the watermarked mutant image). In other examples, the transformation includes converting the watermarked data into an image and mutating the watermarked image to generate the watermarked mutant image. In some examples, mutating the data or mutating the image includes applying a mutation function to the data or image. In some examples, the PUF value and / or TRN are used to disrupt traditional mutation conditions of the data, which provides further protection against potential brute-force reassembly of the mutant image by a malicious actor.

[0016] 2 is a flow diagram of an exemplary method 200 for transforming data into a watermarked mutant image. The blocks of the flow diagram of FIG. 2 are arranged in a generally sequential manner for ease of explanation. However, it should be understood that this organization is merely exemplary, and it should be recognized that the operations associated with method 200 (and the blocks shown in FIG. 2) may occur in a different order, or that at least some of the operations associated with the blocks may be performed in parallel in an event-driven manner. For example, the watermarked data may be transformed into an image (block 206) before applying a mutant function (block 204).

[0017] Method 200 includes watermarking data (block 202). The data is watermarked using one or more different types of watermarks (e.g., watermarks of different colors). In some examples, different types of watermarks are used to mark different characteristics of the data. For example, if the data is software code, a first type of watermark may be used to identify lines of code that are easily exploitable, a second type of watermark may be used to identify lines of code that are easily obfuscated, and a third type of watermark may be used to identify lines of code that could cause the most damage if modified. Other selection criteria for watermarking may also be used. Typically, the one or more different types of watermarks are strategically placed to increase traceability of important characteristics of the data that are tracked for data verification. Examples of original code and that code after watermarking are shown in FIGS. 2A-2B. Different watermarks are shown as different colors (as identified by a color key) in the example shown in FIG. 2B.

[0018] In some instances, the watermarking of the data is performed automatically using an algorithm. In other instances, the watermarking of the data is performed manually, which may be less predictable and more random. It may be performed by a known individual, typically one or only of an exclusive community of individuals with access to the data. In some instances, the watermarking is performed proximately when the data is converted into an image. Additional safeguards regarding the individuals or algorithms used to watermark the data may also be used.

[0019] The method 200 includes applying a mutation function (block 204). In some examples, applying the mutation function includes transforming the watermarked data into an unattributable object / feature. In some examples, applying the mutation function includes using pseudorandom numbers, or using a PUF and / or a TRNG. In some examples, the mutation function is applied to the watermarked data to generate the object / feature. Other techniques can also be used as long as those processes generate objects / features that are not attributable to the original data. However, the watermark is preserved in the unattributable object / feature. An example of a mutated watermarked code is shown in FIG. 2C (the color of the watermark is identified in the included key).

[0020] Method 200 further includes converting to an image (block 206). The specific mechanism for converting to an image depends on the specific format of the data being converted. For example, if the protected data is Python code, some exemplary steps for converting the Python code to an image may include installing Aspose.Words for Python via .NET, adding a library reference to the Python project, opening the source text file in Python, calling the “save()” method and passing an output filename with an image extension, and obtaining the result of the text conversion as an image. Techniques for converting other types of data to images known in the art may be used for their respective types of data. In some examples, the resolution of the image may be selected depending on the amount of content to be inspected, cost, and time considerations.

[0021] Referring again to FIG. 1 , method 100 further includes converting the watermarked mutant image into a randomly distributed pixelated image (block 104). The randomly distributed pixelated image is two-dimensional and includes dots (or particles) and defects. In some examples, the watermark is represented by different colors in the 2D randomly distributed pixelated image. For purposes of this specification, colors in the 2D randomly distributed pixelated image are represented by grayscale with appropriate keys included in the figures.

[0022] An exemplary 2D randomly distributed pixelated image generated from the data shown at various stages in FIGS. 2A-2C is shown in FIG. 5A. The use of grayscale to represent color along with the key is advanced in FIGS. 5A-5D. For purposes of this description, the points of the 2D randomly distributed pixelated image are randomly distributed in the XZ plane. In some examples, the watermarked mutant image is converted to the randomly distributed pixelated image using a pseudo-random-based algorithm. In some examples, the pseudo-random-based algorithm converts bits of data represented by the watermarked mutant image to point coordinates in the XZ plane so that the bits are represented by points in the 2D randomly distributed pixelated image. An example algorithm for this conversion can be found in MINITAB or a similar program. In some examples, the PUF function and / or TRN function of a MEMS device are used in combination with an algorithm to generate the random distribution and pixelation. It should be understood that any technique for converting an image to a randomly distributed pixelated image can be used to convert the watermarked mutant image to a randomly distributed pixelated image.

[0023] The method 100 further includes converting the randomly distributed pixelated image into a three-dimensional (3D) mutant image (block 106). In some examples, the points of the 2D randomly distributed pixelated image are randomly shifted in height / altitude on the Y-axis so that the points are distributed in the 3D image. In some examples, a pseudo-random number-based numerical algorithm is used to assign height / amplitude to the points of the 2D randomly distributed pixelated image. In other examples, a TRNG function is used to assign height / amplitude to the points of the 2D randomly distributed pixelated image. In some such examples, the TRNG utilizes at least one MEMS sensor to provide random numbers used as the height / amplitude of the points. An exemplary 3D mutant image generated from the 2D randomly distributed pixelated image of FIG. 5A is shown in FIG. 5B.

[0024] The method 100 further includes analyzing the 3D mutant image to determine the probability of finding points and defects in the 3D mutant image (block 108). In some examples, the analysis includes determining the probability of finding various grades of pixels in the three-dimensional image. Some example probability distributions generated from the 3D mutant image of FIG. 5B are shown in FIGS. 5C-5D.

[0025] In some examples, the 3D mutation image is analyzed using a spatial point process (e.g., a Poisson spatial process). In such examples, the process includes selecting a boundary for analysis, selecting an occupancy mode and a defect mode, selecting a homogeneity mode, and selecting a spatial model. In some examples, the spatial model can include running a uniform time-based sequence across a sphere. In other words, a point is created at the center of gravity. Exemplary spatial point processes are discussed in detail, for example, in A. Baddeley, "Spatial point processes and their applications," in Stochastic Geometry Lecture Notes in Mathematics, Berlin: Springer-Verlag, pp. 1-75, 2007, which is incorporated herein by reference.

[0026] In some examples, the density function used in a spatial point process (e.g., a Poisson spatial process) is determined based on the output of the PUF module. For example, the output of the PUF module is used to modify the density function in the Poisson spatial process. Because each PUF module is unique, using the output of the PUF module results in a different set of generated points and probabilities of finding defects.

[0027] In other examples, alternative techniques can be used to analyze the 3D mutant image to determine the probability of finding points and defects within the 3D mutant image. For example, a high frequency reflectance function can be implemented that reflects in a random pattern from defined boundary walls. Other techniques for identifying points and defects within the boundary can also be used.

[0028] In some instances, the techniques used to analyze 3D mutation images apply a temporal ordering of point and defect detection as part of the analysis, which results in the detection of points and defects in a particular order around the space under analysis, which can be used for validation as discussed herein.

[0029] In some instances, the boundary of the analysis of the 3D mutation image is limited to less than the entire boundary of the 3D mutation image, which can be beneficial to reduce the time it takes to perform and later verify the analysis. The boundary can be strategically defined to include at least some of the watermarked points so that it can be verified whether significant portions of the data have been altered.

[0030] While the above description of block 108 describes using a single spatial point process or alternative technique to determine the probability of finding points and defects, it should be understood that multiple spatial point processes or alternative techniques may be used with different boundaries as part of the analysis. In some instances, different processes or techniques may be performed in parallel so that the overall time required to obtain probabilities for multiple separate boundaries may be reduced.

[0031] The method 100 further includes storing the determined probabilities (block 110). In some examples, the probabilities of finding points and defects are stored. In some examples, the probabilities for different grades of pixels (e.g., points, points with watermarks, defects) may be stored for future use for data verification and distributed to various devices within a trusted network.

[0032] 3 is a flow diagram of an example method 300 for verifying whether data stored on a device has been altered. Method 300 may be performed by the device whenever the data is called up for use or as a condition for using the data to ensure that the data image, and therefore the data itself, has not been altered.

[0033] Method 300 includes converting the data into a 3D mutant image (block 302). Techniques for converting data into a 3D mutant image are discussed above with respect to blocks 102, 104, and 106. In some examples, the device generates the 3D mutant image using the same process, random numbers, etc. that was used to create the 3D mutant image from the original data. In examples where the device generated the original data, information regarding the process, random numbers, etc. used to generate the 3D mutant image from the original data may be stored in the device's memory after generation by the device. In other examples where a different device generated the original data, information regarding the process, random numbers, etc. used to generate the 3D mutant image from the original data may be provided to the device by another entity (e.g., a master device) after a verification process has been performed, and the device can then store the information in its memory.

[0034] Method 300 further includes analyzing the 3D mutant image to generate a first probability (block 304). In some examples, analyzing the 3D mutant image according to block 304 is similar to the analysis discussed above with respect to block 108. In examples where a device analyzes the 3D mutant image generated from the original data, information regarding the process, density function, etc. used to analyze the 3D mutant image from the original data can be stored in the device's memory after analysis by the device. In other examples where a different device analyzes the 3D mutant image generated from the original data, information regarding the process, density function, probability, etc. used to analyze the 3D mutant image from the original data can be provided to the device by another entity (e.g., a master device) after the verification process is performed, and the device can then store the information in the device's memory. Additionally, the probabilities generated from the analysis are stored in the device and are referred to herein as "stored probabilities."

[0035] The method 300 further includes comparing the first probability to the stored probability (block 306) and determining whether the first probability and the stored probability match (block 308). In some examples, the determination is whether the first probability and the stored probability match exactly, which may indicate that no changes to the original data have been made. In other examples, the determination is whether the first probability and the stored probability match by more than a threshold amount, which may allow for a small amount of deviation from the original data (e.g., due to processing error, etc.).

[0036] As discussed above, in some instances, there is a temporal order of point and defect detection that results in point and defect detection in a particular order around the space under analysis. In such instances, determining includes determining whether the temporal order of point and defect detection for the first probability matches the temporal order of point and defect detection for the stored probability.

[0037] If it is determined that the first probability matches the stored probability, the method 300 proceeds to verify that the data has not been altered (block 310). In some examples, the device proceeds to use the data as intended in response to determining that the first probability matches the stored probability. In some examples, a user of the device or a system administrator is notified that the data has not been altered.

[0038] If it is determined that the first probability does not match the stored probability, method 300 proceeds to provide a notification that the data has been altered (block 312). It is important to note that the lack of a match may be due to a different location of the point in the spatial representation, additional points not found in the 3D variant image generated from the original data (missing defects), different characteristics of the points included in the spatial representation, etc. In some examples, the notification is provided to a user of the device. In some examples, the notification is provided to a system administrator. The notification may be auditory, visual, or a combination. It should be understood that any mechanism for providing a notification may be used.

[0039] In some examples, if it is determined that the first probability does not match the stored probability, the data is stopped from being used by the device for its intended purpose. For example, if the data includes software code, the software code is not executed by the device in response to a determination that the first probability does not match the stored probability. In some examples, the data may be transmitted to a system administrator or other entity for evaluation and analysis to determine changes made to the original code, who made the changes, etc. In some examples, if a watermarked point (having a different color than the non-watermarked point in the 3D mutant image) is missing or modified, there may be more confidence that the change was intentional and malicious rather than an accident or glitch.

[0040] 4 is a flow diagram of an example method 400 for verifying whether data received by a device has been altered. Method 400 may be performed by a device whenever data is received from another device or as a condition for using the data to ensure that the data image, and therefore the data itself, has not been altered.

[0041] The method 400 includes receiving data and a first 3D mutation image from a different device (block 402). The data and the first 3D mutation image can be received from the different devices via wired or wireless communication. In some examples, the master device is configured to collect the complete PUF output of the MEMS modules (e.g., including MEMS-based PUFs and TRNGs) in each device of the system that is part of the exclusive user community. In such examples, the master device is configured to generate a first 3D mutation image of the data using the PUF output or other characteristics unique to each device. When sending data to a particular device, the data is sent along with the respective 3D mutation image. In some examples, the first 3D mutation image is associated with the particular device to which the data is being sent. In other examples, the first 3D mutation image is associated with a different device that is sending the data, and can also provide or determine the PUF output used for analysis in block 406. For example, the PUF output can be provided or determined during machine-to-machine provenance verification. In some examples, the first 3D mutant image and / or the PUF output may be encrypted using symmetric and / or asymmetric encryption methods for an exclusive community of users.

[0042] Method 400 further includes converting the received data into a second 3D mutant image (block 404). Techniques for converting data into a 3D mutant image are discussed above with respect to blocks 102, 104, and 106. In some examples, the device generates the 3D mutant image using the same process, random numbers, etc. that was used to create the first 3D mutant image from the original data. In some examples, information regarding the process, random numbers, etc. used to generate the first 3D mutant image from the original data is also provided to the device by another entity (e.g., a master device) after a verification process has been performed, and the device can then store the information in its memory.

[0043] Method 400 further includes analyzing the first 3D mutation image to generate a first probability and analyzing the second 3D mutation image to generate a second probability (block 406). In some examples, analyzing the first 3D mutation image and the second 3D mutation image according to block 406 is similar to the analysis discussed above with respect to block 108. The same process, density function, etc. is used by the device to analyze the first 3D mutation image and the second 3D mutation image.

[0044] The method 400 further includes comparing the first probability to a second probability (block 408) and determining whether the first probability and the second probability match (block 410). In some examples, the determination is whether the first probability and the second probability match exactly, which may indicate that no changes to the original data have been made. In other examples, the determination is whether the first probability and the second probability match by more than a threshold amount, which may allow for a small amount of deviation from the original data (e.g., due to processing errors, transmission errors, etc.).

[0045] As discussed above, in some instances, there is a temporal order of point and defect detection that results in point and defect detection in a particular order around the space under analysis. In such instances, determining includes determining whether the temporal order of point and defect detection for the first probability matches the temporal order of point and defect detection for the second probability.

[0046] If it is determined that the first probability matches the second probability, method 400 proceeds to verify that the data has not been altered (block 412). In some examples, the device proceeds to use the data as intended in response to determining that the first probability matches the second probability. In some examples, a user of the device or a system administrator is notified that the data has not been altered.

[0047] If it is determined that the first probability does not match the second probability, the method 400 proceeds to provide a notification that the data has changed (block 414). In some examples, the notification is provided to a user of the device. In some examples, the notification is provided to a system administrator. The notification may be audible, visual, or a combination. It should be understood that any mechanism for providing a notification may be used.

[0048] In some examples, if it is determined that the first probability does not match the second probability, the data is stopped from being used by the device for its intended purpose. For example, if the data includes a firmware update, the firmware update is not implemented by the device in response to a determination that the first probability does not match the second probability. In some examples, the data may be transmitted to a system administrator or other entity for recording, evaluation, and analysis to determine changes made to the original firmware update, who made the changes, etc. In some examples, if watermarked points (having a different color than non-watermarked points in the 3D mutant image) are missing or altered, there may be more confidence that the change was intentional and malicious, rather than an accident or glitch.

[0049] In some examples, in addition to (or instead of) receiving a first 3D mutation image from another device, the device may receive a first probability for the first 3D mutation image generated from the original data. In some examples, the master device is configured to collect the complete PUF output of the MEMS modules (e.g., including a MEMS-based PUF and a TRNG) in each device of the system that is part of the exclusive user community. In such examples, the master device is configured to use the PUF output to generate a 3D mutation image of the data and to generate a first probability for each device using the PUF output or other characteristics specific to each device as part of a density function for analysis. When sending data to a particular device, the data is transmitted along with the respective 3D mutation image and / or the respective first probability associated with the particular device generated from the original data. In some examples, the first 3D mutation image and / or the respective first probability can be encrypted using symmetric and / or asymmetric encryption methods for the exclusive community of users.

[0050] While Figures 3-4 above are described as methods for verifying whether data has been altered, it should be understood that similar techniques can also be used to determine whether data stored on or received by a device is the correct version. For example, respective mutation 3D images and probabilities for each version of software can be generated and used to verify the software version on the device in a manner similar to that described above with respect to Figures 3-4. If the probabilities for the 3D mutation images generated from the software on the device do not match the probabilities for the 3D mutation images of the correct software version, it can be determined that the software on the device needs to be updated. In some examples, a notification can be sent to the device user and / or system administrator to update the device's software in response to the discrepancy.

[0051] An exemplary use case for data protection through randomized spatial imaging techniques is for cybersecurity, and in particular to reduce the burden on analysts assigned to determining anomalies in data, such as software code, images, etc. It should be understood that the specific data that may be represented using spatial maps is not limited to the examples described herein and may be applied to a wide variety of additional applications and use cases.

[0052] An exemplary application of the above-described techniques is real-time voting and vote data integrity. In some examples, images generated by voting machines can be captured and processed by the above-described methods. This can provide the integrity and provenance of ballots used in an election. Furthermore, this can provide a real-time vote record that does not violate voter privacy but tracks any unwanted changes or altered votes from the moment the first vote is cast until the time the complete election results are archived. In some examples, the system is configured to immediately track when and where the record is altered by a watermark, allowing forensics to be applied with high integrity.

[0053] Another exemplary application of the above-described techniques is in medical applications, particularly for mapping the brain. In some instances, an initial high-resolution mapping profile can be generated, and the imaging and analysis techniques described above can be applied. Patients can be examined for various activities that target areas of the brain that may be of concern (inflammation, weak blood vessels, thermal dead zones, etc.). Real-time analysis of millions of brain cells can be characterized with very short time lag assessments, enabling a level of analysis not yet achieved.

[0054] Another exemplary application of the above-described technology is high-density airborne vehicle traffic management. High-resolution real-time analysis of hundreds of thousands of airborne vehicles (commuting, transporting goods at ports, etc.) and high-risk management of upcoming high-density airborne commuter traffic, goods, and services distribution in port areas can be implemented. The capabilities required for these new and emerging transportation systems are achieved through the use of real-time frame-by-frame imaging and application of the above-described processes.

[0055] Another application of the above mentioned technology is the management and analysis of global financial transactions. Managing all electronic transactions in the global financial market (over $14,000 trillion annually) can be a catastrophic obstacle to graft and corruption. With full protection of client identities, trillions of dollars in daily transactions can be monitored with AI to identify major anomalies that may require further investigation (e.g., stopping most of the $283 million lost to electronic fraud every day). Qualification and privacy / IP protection can be enabled through the use of instant frame-by-frame imaging and application of the above mentioned processes.

[0056] Other example applications of the techniques described herein may include management of power grid networks (e.g., restoring last known good balance between substations), food and water resources, supply chains, corporate inventories, Securities and Exchange Commission (SEC) integrity, etc.

[0057] While particular use cases and example applications are discussed above, it should be understood that the techniques described above are not limited to the examples described herein, but may be applied to a wide variety of additional applications and use cases.

[0058] By using the above-described techniques for randomized spatial imaging and analysis, it is possible to verify in an efficient manner whether data has been altered from the original data. The techniques can also enable the detection of specific changes, even if they are subtle, through the use of strategic watermarking that identifies particularly important or vulnerable portions of the data. The above-described techniques can benefit microelectronics, software companies, EDA tool providers, digital engineering reference architectures, and full-scale digital transformation areas worldwide.

[0059] By utilizing 3D mutation images and probabilistic analysis, the techniques described herein can perform data integrity verification in a more efficient manner in terms of execution time, storage demands, and power demands compared to previous techniques. The techniques described herein can be used to verify terabytes of data (including software code, images, algorithms, etc.) in an accelerated manner that enables 24 / 7 continuous monitoring and data integrity verification, which was not feasible using previous techniques due to the required time, storage, and power demands.

[0060] Digital Vision Current cryptographic processes rely on basic building block algorithms invoked by operating modes and higher-level processes to address an ever-changing number of unique applications. State-of-the-art cryptography provides a means to transform digital data between understandable plaintext and an unintelligible cryptographic test form as a means to maintain data confidentiality and integrity, validate data authenticity cryptographic techniques, and provide the use of collision-free one-way functions such as hash algorithms that use digital data as input and provide an accurate representation of the data. Collision-free means that no two files will yield the same number. An exemplary application of a hash function is as follows: When digitally stamping a file (digital file image), the digital bytes are run through a hashing process to generate a hash digest value from the message to be protected. The image is then validated by repeating the hash process and comparing it to the expected hash digest value. One example of a hash function is the Secure Hash Algorithm (SHA).

[0061] To maintain integrity, the authenticating party must be able to independently validate the hash digest value. That is, without access to the hash value through a trusted source, the authenticating party may have no assurance that the file is authentic, since the only security assumption is being able to repeat the hash routine and compare the hash digests. Hash-Based Message Authentication Code (HMAC) algorithms use a hash function and a secret variable to verify the integrity and authenticity of a data file. The use of HMAC must work in concert with a means to securely share the secret variable. The exchange of the secret variable is often performed using asymmetric cryptography, which uses digital certificates to securely share the secret variable between parties.

[0062] While digital cryptographic processes are effective at maintaining the integrity and confidentiality of files, the scale of digital transformation brings additional challenges that cannot be solved by existing methods alone. New methods for securely managing digital configurations are needed, especially as data sets grow. Furthermore, maintaining integrity in a digital environment is difficult for several reasons, including the fact that a central authority may not be feasible, the digital environment is dynamic and constantly changing, the environment must maintain interoperability and backward compatibility, the digital environment may include proprietary and commercial software or service elements, and even open source elements are costly to verify to ensure they are to be trusted in the first place, and someone must ensure that open source is free of threats.

[0063] Traditional methods of cryptographic authentication are the basis for data validation at the application module level, but as the amount of information becomes larger and more modules are incorporated, the use of hash functions becomes unreliable due to the possibility that something may change before the means to validate them (e.g., due to propagation delays of the corresponding hash digest values). Failure to resolve an item can cause a denial of service failure for the system as a whole. Digital environments change frequently due to the inclusion or removal of software version updates, elements, patches, etc. A method is needed to manage the ever-increasing amount of data that is critical for digital transformation.

[0064] Examples described herein include techniques for organizing and managing large data sets while maintaining data integrity. In particular, the techniques described herein use a spatial representation of data and relationships (referred to herein as a "digital view") to provide an efficient framework for real-time data and asset integrity verification management without sacrificing quality of service. The techniques described herein enable validation of the digital view while accounting for necessary and constant changes within the digital view. The digital view representation can represent data, devices, assets, etc. in a way that allows information to be organized, searchable, and discoverable. The types of data that can be represented, analyzed, and managed spatially are not limited. The techniques described herein can be used to group, track, and manage large amounts of information while also making it intuitive to analyze. In other words, the techniques described herein enable maintaining integrity like current cryptographic techniques, but provide the flexibility needed to manage and analyze larger data sets that current methods do not offer.

[0065] Figure 6 is a flow diagram of an example method 600 of validating and sharing view information of devices in a system. The blocks of the flow diagram of Figure 6 are arranged in a generally sequential manner for ease of explanation; however, it should be understood that this arrangement is merely exemplary, and it should be recognized that the processing associated with method 600 (and the blocks shown in Figure 6) may occur in a different order, or that at least some of the processing associated with the blocks may be performed in parallel in an event-driven manner.

[0066] The method 600 includes validating the software and hardware instances (block 602). In some examples, validating the software and hardware instances includes using current techniques. In other examples, the techniques described above for random spatial imaging and analysis can be used to validate the software and hardware instances. A combination of techniques can also be used for a subset of devices.

[0067] The method 600 further includes obtaining a device identifier (block 604). In some examples, obtaining the device identifier includes using a PUF. In some examples, obtaining the device identifier includes using software. In some examples, obtaining the device identifier includes using hardware. In some examples, obtaining the device identifier includes using a hash token. In some examples, obtaining the device identifier includes using version information. A combination of techniques may also be used for a subset of devices.

[0068] The method 600 further includes generating a spatial representation of the local digital field of view using the secret variable (block 606). In some examples, generating the spatial representation of the local digital field of view includes generating a 3D representation similar to the individual views shown in FIG. 7A. In other examples, because the spatial representation of the local digital field of view is virtual, the representation can be generated in more dimensions than 3D (e.g., 4D, 5D, or more) depending on the resolution and information desired for the application. The local digital fields of view (View 1, View 2, View 3 in FIG. 7A) are partial views of the universal digital field of view shown in FIG. 7B. In some examples, the local digital field of view is generated by an individual device and provides information related to itself and its nearest neighbors or one or more digital landmarks defined within the digital universal field of view. In some examples, the local digital field of view is generated by an authority or entity that receives information about a subset (less than all) of the devices, assets, etc., of the digital environment. In some examples, the spatial representation is generated using the secret variable (e.g., the output of a local PUF module generated by the device or entity).

[0069] In some examples, generating a spatial representation of the local digital field of view using the secret variables also includes analyzing the data using a spatial point process or a similar process to provide probabilities of finding points and defects within the 3D representation. The process may be similar to that described above with respect to blocks 308 and 406. Such processing can create an abstraction layer that can be used to efficiently form a persistent “fuzzy” digital field of view representation (similar to that shown in FIGS. 5C-5D). Fuzzy digital field of view representations, unlike hash values, can tolerate change and can then be used by intelligent algorithms trained or programmed to detect anomalies. In some examples, the data validation information description is organized in the form of a special point process map that can be used to represent details such as asset types and corresponding relationships as a spatial map.

[0070] Method 600 further includes generating a spatial representation of the external digital field of view using external secret variables from one or more external parties (block 608). In some examples, generating the spatial representation of the external digital field of view is similar to the approach discussed above with respect to block 606, except that the secret variables used to generate the spatial representation are provided by one or more external parties rather than by the device itself.

[0071] The method 600 further includes exporting the local digital field of view based on the local secret variable (block 610). The local secret variable is kept secret by the device or entity. In some examples, cryptographic techniques such as, for example, checksums or hashes, can be used to facilitate the exchange of the local digital field of view.

[0072] The method 600 further includes exporting the external digital field of view based on the external secret variable (block 612). Because the external secret variable was provided to the device or entity, the external secret variable may be known to multiple devices and kept secret among those devices. In some examples, cryptographic techniques such as, for example, checksums or hashes may be used to facilitate the exchange of the external digital field of view.

[0073] Method 600 further includes generating a global field of view (block 614). In some examples, the external party is configured to aggregate the local (and external) digital field of view and combine them into a global (universal) digital field of view similar to the 3D representation shown in Figure 7B. In some examples, the external party is configured to combine the local (and external) digital field of view using digital markers so that the digital field of view can be oriented along the same axis.

[0074] The method 600 further includes importing the global digital view (block 616). In some examples, the external party is configured to output the global (universal) digital view to one or more devices in the system so that those devices can access the larger digital view as needed.

[0075] As discussed above, Figures 7A-7B illustrate exemplary digital view diagrams. Specifically, Figure 7A is a diagram of multiple digital views of different authorities, and Figure 7B is a diagram of a universal digital view. A spatial representation approach provides an efficient means of representing, organizing, and attributing meaning to many objects. These views can be used to represent a wide variety of different data as a spatial map.

[0076] An exemplary use case of a digital field of view is when the field of view is used to represent battlefield assets. In such an example, the position of a point on the X, Y, and Z axes can be used to represent different characteristics of the represented battlefield asset. In some examples, the color of the point, the size of the point, etc. can also be used to convey further characteristics of the battlefield asset. In one example, the position of the point on the X and Y axes can be used to represent the latitude and longitude of the asset on the battlefield, and the position of the point on the Z axis can be used to represent the type of asset, such that all assets of a particular type fall within the same range on the Z axis. It should be understood that other characteristics of battlefield assets can also be represented using a digital field of view other than those described above, and specific characteristics can be selected as desired for a particular application.

[0077] Another exemplary use case for a digital field of view is when the view is used to represent devices in an enterprise. In such an example, the position of a point on the X, Y, and Z axes can be used to represent different characteristics of the represented device. In some examples, the color of the point, the size of the point, etc. can also be used to convey further characteristics of the device. In one example, the position of the point on the X axis can represent the age of the device, the position of the point on the Y axis can represent the version of software currently installed on the device, and the position of the point on the Z axis can represent the location of the device (e.g., building number). It should be understood that other characteristics of devices within an enterprise can also be represented using digital fields other than those described above, and the particular characteristics can be selected as desired for a particular application.

[0078] Another exemplary use case for the digital field of view is when the view is used to represent and track an aircraft. In such an example, the position of a point on the X-axis, Y-axis, and Z-axis can be used to represent different characteristics of the represented aircraft. In some examples, point color, point size, etc. can also be used to convey additional characteristics of the aircraft. In one example, the position of a point on the X-axis can represent the fuel level of the aircraft, the position of a point on the Y-axis can represent the length of the flight, and the position of a point on the Z-axis can represent the altitude of the aircraft. It should be understood that other characteristics of the aircraft can also be represented using the digital field of view other than those described above, and the particular characteristics can be selected as desired for a particular application.

[0079] Another exemplary use case for a digital field of view is when the view is used to represent and analyze surveillance and / or security data. In such an example, the location of points may be used to represent different characteristics of features in an image captured using a security camera, satellite, etc. For example, the location of points may be used to represent the physical location of the feature as well as the identity of the feature (e.g., type of feature, threat level, etc.). It should be understood that other characteristics of features may also be represented using a digital field of view other than those described above, and particular characteristics may be selected as desired for a particular application.

[0080] It should be understood that the specific data that can be represented using spatial maps is not limited to the examples described herein, but can be applied to a wide variety of additional applications and use cases.

[0081] Figure 8 is a block diagram of an exemplary system including five devices. In the example shown in Figure 8, device 1 is associated with and communicatively coupled to four other devices. Although five devices are shown in the example shown in Figure 8, it should be understood that any number of devices may be included in the system.

[0082] In the example shown in Figure 8, each device is configured to validate content or data on that device using a cryptographic validation instance. Each device in the example shown in Figure 8 is configured to create trusted exchanges. In some examples, each respective device is configured to create a digital field of view with that device at the center of view, for example, via a digital field of view management function. In such examples, the device is configured to use its digital field of view to validate the health and integrity of its environment.

[0083] In some examples, the digital vision management function is deployed as a module on the device. In some examples, the digital vision management function is a software application whose operation has been virtualized to the point that it is hardware independent and can be applied to existing hardware and software platforms. The particular hardware and software of the device may depend on the desired use and role of the device within the system.

[0084] It is desirable to avoid over-installing excessive functionality on a device, if possible. In some examples, the digital vision management function is deployed as a lightweight core application (e.g., targeted to a specific operating system of the device), and the digital vision management function is configured to determine whether additional add-ons are required for a particular device. In some examples, the digital vision management function is configured to query the environment or network to determine the type of platform (hardware and / or software) included in the device. Based on the type of platform, the network, and / or the device role, the digital vision management function is configured to download additional features to right-size the application for the particular device. In some examples, the query is performed in a manner that is transparent to the user.

[0085] In some examples, one or more authentication processes are performed to verify user or device credentials prior to interrogation and download by the digital field of view management function (or even prior to installing the digital field of view management function itself). The one or more authentication processes may include, but are not limited to, a registration process, signing in using an account profile, entering predefined credentials, entering identification information, providing appropriate PUF and / or TRNG outputs, and / or a trusted platform module process.

[0086] In some examples, installation of the digital field management function is performed within a high-value or high-level network (e.g., a central location) that performs the installation of the digital field management function. In some such examples, further validation can be performed using other devices or systems (including neighboring devices). In some examples, further validation includes communicating with the closest neighbor via Bluetooth or other distance-limiting technology, querying the round-trip delay, and verifying the device location based on the round-trip delay. In some examples, further validation includes attempting to communicate with the nearest neighbor via Bluetooth or other distance-limiting technology and verifying that the device is not in proximity to the nearest neighbor based on a lack of response. In some examples, further validation can include physically meeting the device to validate the device and the user. It should be understood that other additional validation techniques may be used in addition to or in place of the techniques described above.

[0087] In some examples, after user / device installation and authentication, the system is configured to provide device-specific rules, boundaries, and behaviors based on the platform (or resource) type and the device's role in the system or network. For example, the rules, boundaries, and behaviors may include rules about where the device is allowed to go, what the device should do in the event of a failure or nearest neighbor problem, how to detect status, etc. In some examples, the rules are periodically distributed and updated by at least one authority responsible for the digital view utilized by the system. In some examples, different groups / authorities responsible for the digital view each provide different rules, boundaries, and behaviors for devices in the system under their authority. In some examples, the rules, boundaries, and / or behaviors of a particular authority may change periodically. For example, synchronization and timing of communications, sequences of communications, and / or time-based or event-based behaviors may be periodically modified.

[0088] The use of defined rules, boundaries, and behaviors can help the system quickly identify outliers, safety issues, security issues, etc. by making it easier to identify devices that are behaving in an unauthorized manner. If a device is not following the rules, staying within boundaries, or performing expected behavior, this can indicate a problem with the device that requires further investigation. If anomalous activity is detected, a notification can be provided to a system administrator or other entity for further investigation. For safety and security issues, the detection of anomalies for a particular level or type of device or a particular type of violation can be reported to regulatory or law enforcement agencies.

[0089] The shared universal digital field of view can be represented spatially, allowing for the creation of a composite view at a higher level that encompasses more devices. In some examples, to create the universal digital field of view, devices are configured to provide their local field of view information to a central device (e.g., a hub or device 1), which compiles the digital field of view information and combines it into the universal digital field of view.

[0090] In some examples, virtual markers are included in the digital field of view to allow devices to orient themselves within the environment represented by the universal digital field of view. In such examples, the central device can use the virtual markers to help combine the digital field of view information from each of the devices in the system.

[0091] In some examples, digital views generated by different authorities can be securely shared with each other and compared to facilitate validation and / or corroboration of data in or changes within the digital views. In some examples, different authorities may utilize different types of digital views. For example, the digital views may have different resolutions (3D vs. 4D), different organizations of data, different parameters captured in the digital views, etc. For a global network to operate effectively, interoperability between different digital views is desirable. In some examples, boundaries can be used to define where specific rules and behaviors are applicable. A central network device or network center can be located between authorities or at boundaries to facilitate the secure exchange of digital views and the translation of digital views across boundaries to accommodate disparate devices, rules, and behaviors for different authorities.

[0092] In some examples, a central network device can be used to match parameters in digital views that organize data differently. The central network device can shift or transform the organization of data from one digital view to match the organization of data from another digital view. An example of this might be when altitude is organized on the X-axis in one digital view and on the Y-axis in another digital view.

[0093] In some examples, the central network device can convert a higher resolution digital view into a lower resolution digital view. For example, if a first digital view captures data in four or five dimensions, but a second digital view captures data in three dimensions, the central network device can convert the first digital view to have the lower resolution.

[0094] In some examples, a central network device can virtually recreate a global (or combined) digital view of a device using data from multiple digital views. In such examples, a subset of the data used for the global (or combined) digital view may be provided by the device (and the authority that provides the device with its rules, boundaries, and behavior), with the remainder of the data being emulated in the digital view by the central network device. For example, a global digital view may show data for tracking 10 assets, but the device (and its authority) is directly tracking five assets, and an additional five assets are tracked via network virtualization using data from other digital views.

[0095] In some examples, when a dataset is large enough, verifying and validating all changes to data points and defects can be difficult and time-consuming. To improve efficiency and conserve resources, inconsistencies and discrepancies between different digital views can be used to focus efforts on further verification and validation techniques (e.g., using conventional techniques) to determine which data is correct. For example, if two digital views are compared and there are differences between the characteristics of the same point representing a device in the different digital views, the system can identify the discrepancy and trigger a more thorough investigation of the device's state. In some examples, the presence of differences in characteristics for the same point can indicate a potential anomaly or problem with the device. In some examples, changes that are consistent across multiple digital views can be assumed to be valid if the authority of the digital views is trusted.

[0096] An example application of the system shown in FIG. 8 may be for economic analysis. In the case of digital (or fiat) currencies, global information is used to calculate relative exchange rates, which may change rapidly depending on the situation. In some situations, there may be significant changes that could alter behavior if actors are made aware of the changes in time. For example, a buyer may not want to proceed with a purchase, or a company may not want to place an order due to a change in exchange rate. Early warning of such changes can be invaluable in such an agile environment.

[0097] In some examples, the techniques described herein can be used to generate digital views that represent different characteristics, such as financial conditions, exchange rates, currency rates, economic data, etc. Each authority for the different digital views can be, for example, a different official publication or verified source of economic information, and a verified community of users / devices can be established to securely share the economic data captured in the different digital views.

[0098] In some examples, one or more devices in the system include functionality configured to estimate relative exchange rates (or changes in relative exchange rates) based on economic data within a digital landscape. Data can be rapidly distributed and analyzed using the techniques described herein, allowing devices in the system to obtain independent economic data and project changes to exchange rates, interest rates, etc. based on authenticated data provided within an exclusive user community. This information can be distributed to devices (e.g., applications running on mobile phones) and used or audited by any device in the system. This type of system can be particularly useful for point-of-sale and decision-maker reference.

[0099] Another exemplary application of the system shown in Figure 8 may be digital voting. In current voting systems, vote counts may be difficult to verify due to human error, and verification may require a recount of the votes. In current electronic voting systems, there are concerns about validating information because the source of the data is not always available.

[0100] In some examples, the techniques described herein can be used to generate digital views to represent votes at various levels of granularity. Each authority for a different digital view can be, for example, a different level of election (e.g., precinct, district, county, state, national), a different political party, etc. In such examples, each voter is digitally authenticated or verified before being able to cast their vote, and the voting information is maintained in the data captured in the digital view.

[0101] In some examples, voting systems utilizing digital views can provide a tool for independent validation by any device within a user community without the need to manually recount ballots. All data can be made available via the digital view to tally votes, ensure there is no voter fraud, and verify the identity of individuals who voted. If discrepancies are detected between different digital views, this can provide a means to focus resources for further validation and investigation.

[0102] Use Case: Digital Vision Applied to a Design Environment DFoV is a technology for protecting integrated circuit (IC) supply chain targets, such as microelectronics lifecycle data, software code, and other early design-stage artifacts, at rest or in transit and for monitoring the design environment without interfering with development team activities. To combat persistent threats, including insider threats, the system must persistently monitor for changes and identify threats. DFoV system embodiments monitor and detect changes to design flow work products, watermark the materials, evaluate the changes, and develop statistical representations that can be used to calculate the probability that a given change is malicious. By being autonomous, DFoV system embodiments provide a means to transparently track changes as designers and tools generate deliverables, the ability to create remote backups, and re-create designs in a remote, trusted environment. Design re-creation in a remote, trusted environment provides a means to a) prevent data loss, b) achieve design recovery, and c) perform trusted, offline, independent validation. When all multiple development parties are chained together to have DFoV compliance connectivity, it can be used to verify integrity throughout the development supply chain. DFoV takes into account third-party inputs through software-enforced controls and validation requirements to control inputs and require that Intellectual Property (IP) being introduced into the environment has been independently verified or authenticated by an authorized or trusted source.

[0103] 9 is a block diagram of a system 900 that provides data integrity verification of a design environment 902 using Digital Field of View (DFoV), according to one embodiment of the present invention. In one embodiment, the design environment 902 includes functionality (described below) that allows a user to design and program a Field Programmable Gate Array (FPGA). It is understood that the use of DFoV to provide data integrity verification of an FPGA design environment in this embodiment is provided as an example and not for implementation purposes. In other embodiments, DFoV can be used to provide data integrity verification for other data that may be subject to insider threats, such as software code, visual programming tools, images from tools such as Computer-Aided Drafting and Computer-Aided Design and Drafting (CADD) tools, digitized output of sensors, and text.

[0104] In this embodiment, DFoV is developed to autonomously establish real-time assessments of digital design artifacts and communicate the real-time status to a trusted source. DFoV has particular application for evidence-based assurance purposes by providing a quantitative and relevant scoring tool for critical artifacts generated throughout the design stages of the software, firmware, and microelectronics lifecycle.

[0105] For the purposes of this application, the term "artifact" as applied to a digital field of view means any data associated with a device that exists at rest or in motion at a selected point in time. Furthermore, in the context of a design environment, "design artifact" means any data that exists at rest or in motion at any point during the design process, that is input to, output from, or generated by the design environment. From a design perspective, "data" covers: 1. System design requirements (behavioral, functional, and architectural) generated at all levels, such as image-based representations of operational concepts, software system requirements, and information technology drawings that describe how the system functions and what it provides. 2. All forms of software code, application code, configuration management code, and related software proficiency / security applications. 3. All expected edge detection data collected for the design of the virtual model in the digital twin, including the test design and the design of the physical half of the digital twin with all the code. 4. All design input, intermediate, or output files from the design process, including computer-aided design studies, requirements, source code, source code listings, object code listings, schematics, design specifications, algorithms, processes, flowcharts, formulas, etc. 5. A collection of data recorded in a format that can be processed by a computer (computer database) 6. Recorded information of a scientific or technical nature (technical data), regardless of the form or method of recording.

[0106] This definition of data is equally applicable to the section above under the heading "Data Protection Through Randomized Spatial Imaging."

[0107] DFoV is implemented in an embodiment of system 900 via elevated privileged resources 904. In one embodiment, elevated privileged resources 904 are software functions that run on a computing platform such as a computer, a server, etc. Elevated privileged resources 904 include the following functions: 1. A region of interest (ROI) filter 906 that selects what areas of design artifacts, folders, files, user changes, etc. should be monitored; 2. Cryptographic functions 908 that perform tasks such as hash-tagging of file and folder contents, as well as encryption, decryption, and authentication of critical processes, and compression of select artifacts for archiving and remote validation; 3. A change management function 910 that uses file information along with hashtags to generate a statistical representation that highlights areas of change in the design artifact, flags threat probabilities based on context, and provides a timeline record; 4. A physical unclonable function (PUF) 912 provides validation for establishing and maintaining the identity of the physical location of the design environment.

[0108] In other embodiments, elevated privilege resources 904 also include a module that implements threat scoring, which may be implemented as part of change management functions 910. Threat scoring uses statistical expressions to determine the probability that an observed change is a legitimate, non-malicious change.

[0109] An embodiment of system 900 can be implemented on off-the-shelf computer hardware. System 900 can autonomously track changes to a design environment throughout a design cycle without input from the design team. System 900 is tunable to select and monitor specific file directories and files within a development flow, securely transmit changes, and enable remote reconstruction of the entire design flow on a remote, trusted system, such as remote PC 934. System 900 employs hashing techniques combined with techniques for mapping collections of hash data to statistical representations that enable high-level identification of system changes along with rules that can use such representations to automatically detect anomalies.

[0110] System 900 includes design environment 902, which in one embodiment is a design environment for an FPGA where code is written for a programmable device. In other embodiments, design environment 902 is implemented in other tool environments, such as an Application Specific Integrated Circuit (ASIC) or software development tool flow. Design environment 902 includes sources of external inputs. These external inputs can be used by an insider to introduce threats into the FPGA design. To address this, elevated privilege resources 904 validate all external inputs before they are imported into design environment 902.

[0111] In the embodiment shown in FIG. 9 , design environment 902 receives two external inputs. First, design environment 902 receives external design input (along with hashes and checksums) from a third party at external design input 914. This may include third-party IP. In addition, design environment 902 can import tools and update them into design environment 902 for use by users (designers) of design environment 902 with validation data for tool 916 (e.g., including license, tool version, and installation). In addition, tool 916 creates design tool data 918 as designers provide inputs to tool 916, such as configuration files, input design files, etc. Tool 916 then processes the inputs and creates databases and other outputs required for the design. In addition to external inputs, design environment 902 also allows local design input 917, e.g., deliverables of users of design environment 902. Each of these inputs (external and internal) provides the basis for design artifacts that can be tracked by system 900.

[0112] As described above, elevated privilege resources 904 validate all external design inputs before importing them into design environment 902. Specifically, elevated privilege resources 904 include file validation function 920 that provides data integrity verification, e.g., verifying that a file is from a trusted source and does not introduce any threats to the FPGA design. In an embodiment of elevated privilege resources 904, file validation function 920 operates under user control by a party with elevated privileges to set parameters for which external inputs are allowed into design environment 902. A designer operates within design environment 902, and a user with elevated privileges operates within elevated privilege resources 904 to access controls, e.g., to update rules that go into validation or to implement change management.

[0113] To allow new tools into the design environment 902, a user may have to provide credentials at an elevated privilege level via the change management function 925 in order to have the new tools installed and run in the design environment 902.

[0114] Elevated privilege resources 904 include a "region of interest" (ROI) filter 906 that defines which design artifacts are monitored by elevated privilege resources 904. ROI filter 906 includes a directory and file filter 926 for each component in design environment 902. Each directory and file filter 926 receives data from a corresponding portion of design environment 902 and highlights possible design artifacts of interest.

[0115] One challenge for elevated privileged resource 904 is the large amount of data regarding changes to design environment 902 during the process of FPGA design. Therefore, a strategic decision can be made to not monitor aspects of the data that are changing too frequently, but instead focus on locking down portions that are solid and consistent. Advantageously, using DFoV, elevated privileged resource 904 can detect malicious behavior by selectively looking at data related to changes in the design environment that have a tendency to indicate malicious behavior. Advantageously, ROI filter 906 defines the aspects of the design environment that are intended to be monitored. Changes to elements of design environment 902 are queued in corresponding directory and file filters 926 of ROI filter 906.

[0116] The elevated privilege resource 904 also includes a crypto function 908 that receives output from the corresponding directory and file filter 926 of the ROI filter 906. The crypto function 908 then assigns a hash tag to the data from the directory and file filter 926 and compresses selected artifacts for archival and remote validation.

[0117] The change management function 910 receives the encrypted and compressed output of the ROI filter 906. The data from the encryption function 908 allows areas of change in the design artifact to be identified. The change management function 910 uses the timeline record function 936 to build a timeline of changes in the design environment 902 from the data from the encryption function 908.

[0118] An embodiment of the elevated privileged resource 904 identifies changes in the design environment 902. Additionally, an embodiment of the elevated privileged resource 904 identifies specific change areas of interest to enable tracking of changes over time so that the progression and sequence of changes can be tracked. For example, if a change is made to an external design input after local design input is completed and a tool has already run, the elevated privileged resource 904 can flag that as a potential bad action because design input should not be changed after the tool has already run. Similarly, if a tool is updated after the final output has been generated, the elevated privileged resource 904 can also flag that as a potential bad action because the tool change may make the output difficult to reproduce. By setting up profiles in the change management function 910, the elevated privileged resource 904 can flag and identify bad actions in the design environment 902.

[0119] The change management function 910 communicates with a digital view engine 928 to form a local digital view (associated with the design environment 902 and elevated privilege resources 904 of the system 900) and a global digital view (e.g., associated with the system 900 in relation to other similar systems interconnected via a network). The digital view engine 928 enables the generation of representations that highlight areas of change in the design environment 902. In one embodiment, the digital view engine 928 generates representations of changes to design artifacts using the teachings described above in the section entitled "Data Protection Through Randomized Spatial Imaging." Advantageously, representing changes to design artifacts using this technique can help distinguish between threats.

[0120] The elevated privilege resources 904 also include a remote health management function 930, which communicates with other elevated privilege resources associated with other design environments (see, for example, FIG. 8). In one embodiment, the remote health management function 930 streams encrypted, compressed data to a remote DFoV user management interface 932 on a remote PC 934. This may allow the design environment 902 to be recreated on the remote PC 934 using this digital vision platform. This may be used for secure collaboration or secure archiving for contingency planning. Additionally, the remote trusted environment has the ability to monitor and validate design activities occurring on the development computer, access design artifacts, and reconstruct the design environment for independent validation.

[0121] In some embodiments, elevated privilege resources 904 include a user management dashboard interface used to define directory and file filters 926 for ROI filters 906, hashing, encryption and compression aspects for cryptographic functions 908, filters for change management functions 910, and provides a local DFoV representation for testing and debugging.

[0122] The digital field of view approach described herein allows for distributed participation in system integrity. In the example described herein, each device has the ability to participate in that digital field of view according to the rules that apply to that digital field of view and each device's role in the digital field of view. The view then uses the spatial point representation of the field of view with the ability to use spatial point processes to validate observed changes in the digital environment and determine whether the changes are genuine.

[0123] By developing a digital field of view methodology using the approaches discussed herein, the processing / computational burden can be reduced for a device or subsystem and / or can run on low-cost hardware even as the digital field of view grows. The digital field of view approach also allows data validation and management to be scaled in spatial dimensions to account for nearest-neighbor completeness. For example, instead of knowing the universal view, a device or subsystem need only know its relationship to its nearest neighbors or digital landmarks defined within the digital universal field of view.

[0124] In various aspects, the system elements, method steps, or examples (e.g., systems, or components thereof) described throughout this disclosure may be implemented on one or more computer systems including central processing units (CPUs), graphics processing units (GPUs), field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), and / or similar devices with hardware that execute code to implement those elements, processes, or examples, where that code is stored on non-transitory data storage devices. These devices contain or function with software programs, firmware, or other computer-readable instructions to perform various methods, process tasks, computations, and control functions.

[0125] These instructions are typically stored on any suitable computer-readable medium used for storing computer-readable instructions or data structures. Computer-readable media can be implemented as any available medium that can be accessed by a general-purpose or specialized computer or processor, or any programmable logic device. Suitable processor-readable media can include storage or memory media such as magnetic or optical media. For example, storage or memory media may include volatile or non-volatile media such as conventional hard disks, Compact Disk-Read Only Memory (CD-ROM), Random Access Memory (RAM) (including, but not limited to, Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate (DDR) RAM, RAMBUS Dynamic RAM (RDRAM), Static RAM (SRAM), etc.), Read Only Memory (ROM), Electrically Erasable Programmable ROM (EEPROM), and flash memory. Suitable processor-readable media may also include transmission media such as electrical, electromagnetic, or digital signals conveyed over a communications medium such as a network and / or wireless link.

[0126] The methods and techniques described herein may be implemented in digital electronic circuitry, or with a programmable processor (e.g., a special-purpose processor or a general-purpose processor such as a computer), firmware, software, or combinations thereof. Apparatus embodying these techniques may include suitable input and output devices, a programmable processor, and a storage medium tangibly embodying program instructions for execution by the programmable processor. Processes embodying these techniques may be performed by the programmable processor executing a program of instructions to perform a desired function by operating on input data and generating appropriate output. The techniques may advantageously be implemented in one or more programs executable on a programmable system including at least one programmable processor coupled to receive data and instructions from, and transmit data and instructions to, a data storage system, at least one input device, and at least one output device. Generally, the processor receives instructions and data from a read-only memory and / or a random-access memory. Suitable storage devices for tangibly embodying computer program instructions and data include, for example, all forms of non-volatile memory, including semiconductor memory devices (such as EPROM, EEPROM, and flash memory devices), magnetic disks (such as internal hard disks or removable disks), magneto-optical disks, and DVD disks, any of the foregoing may be supplemented by, or incorporated in, specially-designed application-specific integrated circuits (ASICs).

[0127] Illustrative Embodiments While specific embodiments have been illustrated and described herein, those skilled in the art will recognize that any arrangement which is expected to achieve the same purpose may be substituted for the specific embodiments shown. Therefore, it is manifestly intended that this invention be limited only by the claims and the equivalents thereof.

[0128] Example 1 includes a method for validating and sharing view information of a device in a system, the method including validating software and hardware instances of a device in the system, obtaining a device identifier for the device in the system, generating a spatial representation of a local digital field of view using secret variables and / or a spatial representation of an external digital field of view using external secret variables from one or more external parties, and exporting the local digital field of view and / or the external digital field of view to another device in the system to represent information about the device in a spatial map.

[0129] Example 2 includes the method of example 1, in which validating the software and hardware instances includes using spatial imaging and analysis.

[0130] Example 3 includes the method of example 1 or 2, in which obtaining the device identifier includes obtaining the device identifier using one or more of a physically unclonable function (PUF), software, hardware, a hash token, and version information.

[0131] Example 4 includes the method of any of examples 1-3, wherein the local digital field of view is generated by each device and provides information relating to the device and its nearest neighbors.

[0132] Example 5 includes the method of any of examples 1-4, wherein the local digital view is generated by an authority that receives information from a subset of devices, assets, etc., of the digital environment.

[0133] Example 6 includes the method of any of examples 1-5, wherein generating the spatial representation includes using a spatial point process to provide probabilities of finding points and defects in the spatial representation.

[0134] Example 7 includes the method of any of examples 1-6, further including generating a global digital view from the plurality of local digital views.

[0135] Example 8 includes the method of example 7, wherein the local digital views are combined using digital markers such that the local digital views are oriented within a common frame of reference.

[0136] Example 9 includes the method of example 7, further including exporting the global digital field of view to one or more devices in the system.

[0137] Example 10 includes an enhanced privileged resource for maintaining integrity in a design environment, the enhanced privileged resource including a file validation function configured to reject file input from sources that are not trusted sources; a change management function configured to authorize the import of tools into the design environment based on receipt of appropriate credentials; a region of interest filter configured to select and monitor design artifacts created in the design environment; an encryption function configured to encrypt design artifacts received from the region of interest filter (wherein the change management function is further configured to use the file information together with the encryption information to generate a statistical representation that highlights areas of change in the design artifacts); and a digital view engine configured to create a local digital view, a global digital view, and a representation that highlights areas of change in the design environment.

[0138] Example 11 includes the enhanced privileged resource of example 10, wherein the encryption function further compresses the encrypted design artifact.

[0139] Example 12 includes the enhanced privileged resource of example 10 or 11, wherein the change management function is further configured to generate a timeline record of changes to the design artifact.

[0140] Example 13 includes the enhanced privileged resource of any of Examples 10 to 12, and the change management function further includes a threat scoring function that uses statistical expressions to detect the probability that an observed change is a legitimate, non-malicious change.

[0141] Example 14 includes the enhanced privileged resource of any of Examples 10 to 13, and the design environment is a design environment for a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or a software development environment.

[0142] Example 15 includes the enhanced privileged resource of any of Examples 10 to 14, and the region of interest filter is configured to receive external design inputs, local design inputs, tool inputs, and design tool data inputs and select design artifacts therefrom.

[0143] Example 16 includes the enhanced privileged resource of example 15, wherein the digital view engine generates a local digital view from the selected design artifacts using randomized spatial imaging and analysis.

[0144] Example 17 includes the enhanced privileged resource of any of Examples 10 to 16, and further includes a user management dashboard interface configured to allow a user to define directory and file filters for region of interest filters, hash, encryption and compression aspects of cryptographic functions, filters for change management functions, and provide a local digital field of view representation for testing and debugging.

[0145] Example 18 includes the enhanced privileged resource of any of Examples 12 to 17, and further includes a remote health management function configured to stream the encrypted compressed design artifact to a remote digital vision user management interface on a remote device.

[0146] Example 19 includes the enhanced privileged resource of example 18, wherein the digital user management interface recreates the design environment on the remote device.

[0147] Example 20 includes the enhanced privileged resources of example 18, wherein the recreated design environment on the remote device provides a secure collaboration environment or a secure archival environment.

Claims

1. 1. A method for validating and sharing view information of devices in a system, the method comprising: Validating (602) the software and hardware instances of the device within the system; Obtaining a device identifier for the device in the system (604); generating (606 / 608) a spatial representation of the local digital field of view using the secret variables and / or a spatial representation of the external digital field of view using external secret variables from one or more external parties; and exporting the local digital view and / or the external digital view to another device in the system to represent information about the device in a spatial map (610 / 612).

2. 10. The method of claim 1, wherein the local digital view is generated by an individual device and provides information related to the device and its nearest neighbors, or is generated by an authority that receives information from a subset of devices, assets, etc., of a digital environment.

3. An enhanced privileged resource (904) for maintaining integrity in a design environment, said privileged resource comprising: a file validation function (902) configured to reject file input from sources that are not trusted sources; a change management function (910) configured to authorize the import of tools into the design environment upon receipt of appropriate credentials; a region of interest filter (906) configured to select and monitor design artifacts created in the design environment; an encryption function (908) configured to encrypt the design artifacts received from the region of interest filter; wherein the change management function is further configured to use file information together with cryptographic information to generate a statistical representation highlighting areas of change in the design artifact; and a digital view engine (928) configured to create a local digital view, a global digital view, and a representation highlighting areas of change in the design environment.

Images