Secure desktop applications for an open computing platform

Patent metadata

Field	Value
Publication number	US-9342706-B2
Application number	US-201514800370-A
Country	US
Kind code	B2
Filing date	Jul 15, 2015
Priority date	Nov 7, 2011
Publication date	May 17, 2016
Grant date	May 17, 2016

Abstract

Example secure desktop applications for an open computing platform are disclosed. An example secure desktop method for a computing platform disclosed herein comprises establishing a secure communication connection between a secure desktop provided by the computing platform and a trusted entity, the secure communication connection being accessible to a trusted application authenticated with the secure desktop, the secure communication connection being inaccessible to an untrusted application not authenticated with the secure desktop, and securing data that is stored by the secure desktop in local storage associated with the computing platform, the stored data being accessible to the trusted application and inaccessible to the untrusted application.

First claim

What is claimed is:

1. A method for a computing platform, the method comprising:
establishing a secure communication connection between a secure desktop provided by the computing platform and a trusted entity, the secure communication connection being accessible to a trusted application authenticated with the secure desktop, the secure communication connection being inaccessible to an untrusted application not authenticated with the secure desktop;
securing, with a set of encryption keys, stored data that is related to the trusted entity and stored by the secure desktop in local storage associated with the computing platform, the stored data being accessible to the trusted application and inaccessible to the untrusted application; and
after the secure communication connection is terminated, waiting to revoke the set of encryption keys until the secure desktop has been terminated to permit the stored data related to the trusted entity to be accessed after the secure communication connection is terminated but while the secure desktop remains active.

2. The method of claim 1 , further including revoking the set of encryption keys after the secure desktop has been terminated.

3. The method of claim 1 , wherein the set of encryption keys is a first set of encryption keys, and the secure communication connection is established using a second set of encryption keys different from the first set of encryption keys.

4. The method of claim 3 , further including revoking the second set of encryption keys in response to determining the secure communication connection has terminated.

5. The method of claim 1 , wherein the secure communication connection is a first secure communication connection, the trusted entity is a first trusted entity, the set of encryption keys is a first set of encryption keys, the stored data is first stored data, and further including:
establishing a second secure communication connection between the secure desktop and a second trusted entity; and
securing, using a second set of encryption keys, second stored data that is related to the second trusted entity and stored by the secure desktop in the local storage associated with the computing platform.

6. The method of claim 5 , further including:
receiving the first set of encryption keys via the first secure communication connection; and
receiving the second set of encryption keys via the second secure communication connection.

7. A tangible computer readable medium including computer readable instructions which, when executed, cause a processor to perform operations comprising:
establishing a secure communication connection between a secure desktop provided by a computing platform and a trusted entity, the secure communication connection being accessible to a trusted application authenticated with the secure desktop, the secure communication connection being inaccessible to an untrusted application not authenticated with the secure desktop;
securing, with a set of encryption keys, stored data that is related to the trusted entity and stored by the secure desktop in local storage associated with the computing platform, the stored data being accessible to the trusted application and inaccessible to the untrusted application; and
after the secure communication connection is terminated, waiting to revoke the set of encryption keys until the secure desktop has been terminated to permit the stored data related to the trusted entity to be accessed after the secure communication connection is terminated but while the secure desktop remains active.

8. The tangible computer readable medium of claim 7 , wherein the operations further include revoking the set of encryption keys after the secure desktop has been terminated.

9. The tangible computer readable medium of claim 7 , wherein the set of encryption keys is a first set of encryption keys, and the secure communication connection is established using a second set of encryption keys different from the first set of encryption keys.

10. The tangible computer readable medium of claim 9 , wherein the operations further include revoking the second set of encryption keys in response to determining the secure communication connection has terminated.

11. The tangible computer readable medium of claim 7 , wherein the secure communication connection is a first secure communication connection, the trusted entity is a first trusted entity, the set of encryption keys is a first set of encryption keys, the stored data is first stored data, and the operations further include:
establishing a second secure communication connection between the secure desktop and a second trusted entity; and
securing, using a second set of encryption keys, second stored data that is related to the second trusted entity and stored by the secure desktop in the local storage associated with the computing platform.

12. The tangible computer readable medium of claim 11 , wherein the operations further include:
receiving the first set of encryption keys via the first secure communication connection; and
receiving the second set of encryption keys via the second secure communication connection.

13. A computing platform comprising:
memory including computer readable instructions; and
a processor to execute the computer readable instructions to perform operations including:
establishing a secure communication connection between a secure desktop provided by the computing platform and a trusted entity, the secure communication connection being accessible to a trusted application authenticated with the secure desktop, the secure communication connection being inaccessible to an untrusted application not authenticated with the secure desktop;
securing, with a set of encryption keys, stored data that is related to the trusted entity and stored by the secure desktop in local storage associated with the computing platform, the stored data being accessible to the trusted application and inaccessible to the untrusted application; and
after the secure communication connection is terminated, waiting to revoke the set of encryption keys until the secure desktop has been terminated to permit the stored data related to the trusted entity to be accessed after the secure communication connection is terminated but while the secure desktop remains active.

14. The computing platform of claim 13 , wherein the operations further include revoking the set of encryption keys after the secure desktop has been terminated.

15. The computing platform of claim 13 , wherein the set of encryption keys is a first set of encryption keys, and the secure communication connection is established using a second set of encryption keys different from the first set of encryption keys.

16. The computing platform of claim 15 , wherein the operations further include revoking the second set of encryption keys in response to determining the secure communication connection has terminated.

17. The computing platform of claim 13 , wherein the secure communication connection is a first secure communication connection, the trusted entity is a first trusted entity, the set of encryption keys is a first set of encryption keys, the stored data is first stored data, and the operations further include:
establishing a second secure communication connection between the secure desktop and a second trusted entity; and
securing, using a second set of encryption keys, second stored data that is related to the second trusted entity and stored by the secure desktop in the local storage associated with the computing platform.

18. The comput

Assignees

• At & T Ip I Lp

Inventors

• Chawla Deepak
• Muller Urs A

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/0442 Primary

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L63/04

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04W4/003

  Electricity · mapped topic