Secure Zone for Secure Purchases

Patent metadata

Field	Value
Publication number	US-2016366139-A1
Application number	US-201615247193-A
Country	US
Kind code	A1
Filing date	Aug 25, 2016
Priority date	Apr 20, 2012
Publication date	Dec 15, 2016
Grant date	—

Abstract

An apparatus according to the present disclosure may comprise a secure zone configured to execute a task having a subtask. The task and subtask may have respective executable code and may be digitally signed by respective code providers. The secure zone may be further configured to apply respective sets of permissions while the respective executable code of the task and subtask are executed. The respective set of permissions for the task may be based on at least one of information associated with the signed task and information in a digital certificate of the respective code provider for the task. The respective set of permissions for the subtask may be based on at least one of information associated with the signed subtask and information in a digital certificate of the respective code provider for the subtask.

First claim

1 - 21 . (canceled)

22 . An apparatus, comprising:
a secure zone configured to execute a task, and a non-secure zone, wherein the secure zone is configured to use network capabilities of the non-secure zone to connect to a network.

23 . The apparatus of claim 22 , wherein the secure zone is configured to provide network capabilities to the task.

24 . The apparatus of claim 22 , wherein the network capabilities of the non-secure zone include a TCP/IP stack.

25 . The apparatus of claim 22 , wherein the task has a subtask, the task and the subtask have respective executable code, and the task and the subtask are digitally signed by respective code providers, and
wherein the secure zone is configured to apply respective sets of permissions while the respective executable code of the task and subtask are executed, wherein the respective set of permissions for the task are based on at least one of information associated with the signed task and information in a digital certificate of the respective code provider for the task, and wherein the respective set of permissions for the subtask are based on at least one of information associated with the signed subtask and information in a digital certificate of the respective code provider for the subtask.

26 . A method, comprising:
receiving a task at a secure zone; and executing the task by the secure zone, wherein execution of the task comprises communicating with a network using network capabilities provided by a non-secure zone.

27 . The method of claim 26 , further comprising providing network capabilities to the task by the secure zone.

28 . The method of claim 26 , wherein the network capabilities of the non-secure zone include a TCP/IP stack.

29 . The method claim 26 , wherein the task has a subtask, the task and the subtask have respective executable code, and the task and the subtask are digitally signed by respective code providers, and the method further comprises applying respective sets of permissions while the respective executable code of the task and subtask are executed, wherein the respective set of permissions for the task are based on at least one of information associated with the signed task and information in a digital certificate of the respective code provider for the task, and wherein the respective set of permissions for the subtask are based on at least one of information associated with the signed subtask and information in a digital certificate of the respective code provider for the subtask.

Assignees

• Ologn Technologies Ag

Inventors

• Ignatchenko Sergey
• Ivanchykhin Dmytro

Classifications

• G06F21/54

  by adding security routines or objects to programs · CPC title

• G06F9/468

  Specific access rights for resources, e.g. using capability register · CPC title

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title