# US 10,482,237 B2 · Method for processing security of application and electronic device supporting the same > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,237 B2 - Document ID: US10482237B2 - Status: Granted - Kind: B2 - Application number: 15/661,534 - Filed: 2017-07-27 - Published: 2018-02-01 - Granted: 2019-11-19 - Earliest claimed: 2016-07-29 - Assignees: Samsung Electronics Co., Ltd. - Applicants: Samsung Electronics Co., Ltd. - Inventors: Hyung Deuk Kim; Bum Taek Lim; Yu Jin Jung; Sang Youl Ha - Web page: https://patentgrep.com/patent/US10482237B2 ## CPC - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/44: Program or device authentication - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 2221/033: Test or assess software - G06F 2221/2149: Restricted operating environment - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An electronic device is provided. The electronic device includes a memory to store an application, a communication interface to communicate with an external device, and a processor operatively connected with the memory and the communication interface. The processor determines whether the application is authenticated if receiving an installation request or an execution request of the application, generates a policy file associated with a domain of the application if the application is authenticated, and assigns the application to a specified domain, which is accessible to a secure area of the memory, based on the generated policy file. ## Claims ### Claim 1 An electronic device comprising: a memory comprising a normal area and a secure area, wherein data stored in the normal area may be shared without security processing while data stored in the secure area is required for the security processing, and wherein the normal area comprises a plurality of domains; a communication interface configured to communicate with an external server; and at least one processor operatively connected with the memory and the communication interface, wherein the at least one processor is configured to: control the communication interface to download an application from the external server, determine whether the application downloaded from the external server is authenticated by analyzing metadata of the application, in response to receiving an installation request or an execution request of the application, in response to determining that the application downloaded from the external server is authenticated, generate a first policy file associated with a domain which is accessible to the secure area among the plurality of domains based on identification information included in the metadata, and assign the application downloaded from the external server to the domain, which is accessible to the secure area, based on the generated first policy file and a second policy file which is stored in the memory in advance. ### Claim 2 (depends on 1) The electronic device of claim 1, wherein the at least one processor is further configured to: determine whether the application is authenticated further based on authentication information of the application included in the metadata. ### Claim 3 (depends on 2) The electronic device of claim 2, wherein the authentication information of the application is obtained from an authentication server when the application is created. ### Claim 4 (depends on 1) The electronic device of claim 1, wherein the first policy file comprises: the identification information assigned based on at least one of signature information and package information of the application. ### Claim 5 (depends on 1) The electronic device of claim 1, wherein the at least one processor is further configured to: store the generated first policy file in the memory. ### Claim 6 (depends on 1) The electronic device of claim 1, wherein the at least one processor is further configured to: release the application from the domain in response to receiving a request to delete the application. ### Claim 7 (depends on 1) The electronic device of claim 1, wherein the at least one processor is further configured to: delete information of the application from the generated first policy file in response to receiving a request to delete the application. ### Claim 8 A method for processing security of an application, the method comprising: downloading, at an electronic device, the application from an external server; determining, by the electronic device, whether the application downloaded from the external server is authenticated, by analyzing metadata of the application, in response to receiving an installation request or an execution request of the downloaded application; in response to determining that the application downloaded from the external server is authenticated, generating, by the electronic device, a first policy file associated with a domain which is accessible to a secure area of the electronic device based on identification information included in the metadata; and assigning, by the electronic device, the application downloaded from the external server to the domain, which is accessible to the secure area, based on the generated first policy file and a second policy file which is stored in a memory of the electronic device in advance, wherein the memory of the electronic device comprises a normal area and the secure area, wherein data stored in the normal area may be shared without security processing while data stored in the secure area is required for the security processing, and wherein the domain included in the normal area. ### Claim 9 (depends on 8) The method of claim 8, wherein the determining of whether the application is authenticated comprises: determining whether the application is authenticated further based on authentication information of the application included in the metadata. ### Claim 10 (depends on 8) The method of claim 8, further comprising: storing the generated first policy file in the memory. ### Claim 11 (depends on 8) The method of claim 8, wherein the assigning of the application to the specified domain comprises: assigning at least one of an execution code of the application and data that the application uses to the specified domain. ### Claim 12 (depends on 8) The method of claim 8, further comprising: releasing the application from the domain in response to receiving a request to delete the application. ### Claim 13 (depends on 8) The method of claim 8, further comprising: deleting information of the application from the generated first policy file in response to receiving a request to delete the application. ### Claim 14 A non-transitory computer-readable recording medium having recorded thereon instructions that, when executed by at least one processor of an electronic device, configure the at least one processor for: downloading an application from an external server; determining, by the electronic device, whether the application downloaded from the external server is authenticated, by analyzing metadata of the application, in response to receiving an installation request or an execution request of the downloaded application; in response to determining that the application downloaded from the external server is authenticated, generating, by the electronic device, a first policy file associated with a domain which is accessible to a secure area of the electronic device based on identification information included in the metadata; and assigning, by the electronic device, the application downloaded from the external server to the domain, which is accessible to the secure area, based on the generated first policy file and a second policy file which is stored in a memory of the electronic device in advance, wherein the memory of the electronic device comprises a normal area and the secure area, wherein data stored in the normal area may be shared without security processing while data stored in the secure area is required for the security processing, and wherein the domain included in the normal area.