Securely sharing cached data

Patent metadata

Field	Value
Publication number	US-9870166-B2
Application number	US-201414486999-A
Country	US
Kind code	B2
Filing date	Sep 15, 2014
Priority date	Sep 15, 2014
Publication date	Jan 16, 2018
Grant date	Jan 16, 2018

Abstract

Various embodiments of a system and method for securely caching and sharing image data. A process can generate image data and store the image data into the protected cache using a UUID that is cryptographically derived from the image data. Any process with access to the UUID may retrieve the image data. Because the UUID is uniquely derived from the actual data of the generated file, a process will only be able to retrieve image data that could have been generated by a process associated with the user account, or from a process associated with a user account that could have generated the image data, or that otherwise has a record of the image data.

First claim

What is claimed is:

1. A non-transitory machine readable storage medium storing instructions which, when executed by one or more processors, cause the one or more processors to perform operations comprising:
creating a memory buffer to store generated image data;
computing a digest of the generated image data stored in the memory buffer;
sharing the image data with a process in response to a request for the image data;
checking an image data cache for image data having a unique identifier of the generated image data; and
mapping the memory buffer to a location in the image data cache associated with the unique identifier.

2. The medium of claim 1 wherein creating the memory buffer includes creating an anonymous shared virtual memory buffer.

3. The medium of claim 1 wherein computing the digest of the generated image data includes computing a cryptographic hash of the memory buffer storing the generated image data.

4. The medium of claim 1 wherein sharing the image data with the process includes mapping the memory buffer to the process in response to the request for the image data.

5. The medium of claim 1 wherein checking the image data cache for image data having the unique identifier includes determining if a file associated with the unique identifier of the generated image data exists in a directory associated with the image data cache.

6. The medium of claim 1 further comprising sending a storage request to store the memory buffer to a file in the image data cache, the storage request including the unique identifier of the generated imaged image data stored in the memory buffer.

7. The medium of claim 1 wherein mapping the memory buffer to the location in the image data cache associated with the unique identifier includes transparently remapping the memory buffer to a file in the image data cache, the file having a filename including the unique identifier.

8. A system comprising:
one or more processors coupled to memory;
one or more storage devices to store a protected image data cache;
an operating system executing on the one or more processors, the operating system including a virtual memory system to map a location on the one or more storage devices to an address in the memory;
a first process to execute on the one or more processors, the first process to access composited image data stored in the protected image data cache using a unique identifier derived from the image data; and
a second process to execute on the one or more processors, the second process to access the composited image data stored in the protected image data cache using the unique identifier derived from the image data, wherein the first process and the second process to access the composited image data via the virtual memory system.

9. The system of claim 8 wherein the protected image data cache is a directory of a file system for the one or more storage devices, the directory is owned by a restricted user account with write access to the directory, the first process and the second process have read-only access to the directory, and the first process and the second process cannot enumerate contents of the directory.

10. The system of claim 9 wherein the first process or the second process to access the composited image data from the protected image data cache by performing operations to cause the one or more processors to:
derive a key for the image data based on attributes of the image data;
retrieve a stored digest of the image data using the key;
derive a filename for the image data using the digest; and
use the filename to cause the image data to be loaded into memory from the protected image data cache, wherein the filename is a universally unique identifier (UUID) based on the digest of the image data and the digest of the image data is computed using a message digest algorithm.

11. A method of caching image data for a user interface of a data processing system, the method comprising:
rendering the image data into a buffer in memory of the data processing system;
computing a digest of the image data;
storing the digest; and
storing the image data in a protected image data cache using a unique identifier derived from the digest of the image data.

12. The method of claim 11 further comprising receiving a request to generate image data from a user process executing on the data processing system, the user process associated with a first user account, and rendering the image data in response to the request.

13. The method of claim 12 further comprising sharing the image data with the user process.

14. The method of claim 11 further comprising retrieving image data from the protected image data cache using the digest of the image data.

15. The method of claim 11 further comprising creating the buffer in a virtual memory before rendering the image data.

16. The method of claim 15 wherein storing the image data in the protected image data cache includes mapping the virtual memory buffer to an address in the protected image data cache associated with the unique identifier.

17. The method of claim 16 wherein mapping the virtual memory buffer to the address in the protected image data cache includes mapping the virtual memory buffer to a file in the protected image data cache.

18. The method of claim 17 wherein the file in the protected image data cache has a filename derived from the unique identifier.

19. The method of claim 18 wherein the protected image data cache is a file system directory on a data storage device of the data processing system, file system configurations prevent a user process from enumerating contents of the directory, and the file in the protected image data cache is read-only to the user process.

Assignees

• Apple Inc

Inventors

• Carter David A
• Stattenfield Keith
• Remahl Jr David P
• Linn Christopher S

Classifications

• G06F12/0875 Primary

  with dedicated cache, e.g. instruction or stack · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F16/172

  Caching, prefetching or hoarding of files · CPC title

• G06F2212/455

  Image or video data · CPC title

• G06F3/0643

  Management of files · CPC title