Secure enclave-rendered contents

Patent metadata

Field	Value
Publication number	US-2016006754-A1
Application number	US-201514743172-A
Country	US
Kind code	A1
Filing date	Jun 18, 2015
Priority date	Jul 1, 2014
Publication date	Jan 7, 2016
Grant date	—

Abstract

By way of example, a computing system may include an enclave or other similar secured memory location or process. When the system receives new content or data, it may classify the content as potentially harmful and initially render and display the content in the enclave. The user may then select portions of the content to enable or disable in a final version. The content may also be converted to a known “safe” equivalent format that always renders in the enclave. Enclave-rendered content may be signed by the enclave so that they can be considered “trusted” so long as the certificate remains valid and the content is correctly signed.

First claim

What is claimed is:

1 . An apparatus, comprising:
a memory including a secure environment; and logic, at least partly implemented in hardware, operable for: receiving a payload; classifying the payload as potentially-unwanted content (PUC); and rendering the payload in the secure environment.

2 . The apparatus of claim 1 , wherein the logic is further operable for converting the content to a secured format in the secure environment.

3 . The apparatus of claim 2 , wherein the logic is further operable for signing the secured format content within the secure environment.

4 . The apparatus of claim 2 , wherein the secured format content is read-only.

5 . The apparatus of claim 2 , wherein the secured format content is read-write.

6 . The apparatus of claim 2 , wherein the secured format content includes active content.

7 . The apparatus of claim 1 , wherein the logic is further operable for receiving an input identifying a portion of the content as unwanted.

8 . The apparatus of claim 7 , wherein the logic is further operable for removing the identified portion from the content.

9 . The apparatus of claim 7 , wherein the logic is further operable for:
converting the content to secured format within the secure environment; and removing the identified portion from the secured format content.

10 . The apparatus of claim 1 , wherein the secure environment is an enclave comprising a restricted memory region that can be entered or exited only by means of a secured branching instruction.

11 . The apparatus of claim 10 , wherein the enclave further comprises an anti-malware engine.

12 . The apparatus of claim 10 , wherein the enclave further comprises an interface for manipulating the content.

13 . The apparatus of claim 12 , wherein the interface comprises graphical elements for interactively selecting portions of the content to limit or exclude.

14 . One or more computer-readable mediums having stored thereon instructions operable to instruct a processor for:
receiving a payload; classifying the payload as a candidate for potentially-unwanted content (PUC); and rendering the payload in a secure environment.

15 . The one or more mediums of claim 14 , wherein the instructions are further operable for converting the content to a secured format in the secure environment.

16 . The one or more mediums of claim 15 , wherein the instructions are further operable for signing the secured format content within the secure environment.

17 . The one or more mediums of claim 15 , wherein the secured format content is read-only.

18 . The one or more mediums of claim 15 , wherein the secured format content is read-write.

19 . The one or more mediums of claim 15 , wherein the secured format content includes active content capabilities.

20 . The one or more mediums of claim 14 , wherein the instructions are further operable for receiving an input identifying a portion of the content as unwanted.

21 . The one or more mediums of claim 20 , wherein the instructions are further operable for removing the identified portion from the content.

22 . The one or more mediums of claim 20 , wherein the instructions are further operable for:
converting the content to secured format within the enclave; and removing the identified portion from the secured format content.

23 . The one or more mediums of claim 14 , wherein the secure environment is an enclave comprising a restricted memory region that can entered or exited only by means of a secured branching instruction.

24 . A method comprising:
receiving a payload; classifying the payload as a candidate for potentially-unwanted content (PUC); and rendering the payload in a secure environment.

25 . The method of claim 24 , further comprising:
converting the content to a secured format in the secure environment; and signing the secured format content.

Assignees

• Mcafee Inc

Inventors

• Woodward Carl
• Arkin Ofir

Classifications

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1491

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title