Secure processing systems and methods
AssigneeIntertrust Technologies Corporation
InventorsGilles Boccon-Gibod, Gary F. Ellison
Life of this patent
Estimating the term…
Abstract
This disclosure relates to systems and methods for enabling the use of secret digital or electronic information without exposing the sensitive information to unsecured applications. In certain embodiments, the methods may include invoking, by a client application executing in an open processing domain, a secure abstraction layer configured to interface with secret data protected by a secure processing domain. Secure operations may be securely performed on the secret data by the secure abstraction layer in the secure processing domain based on an invocation from a client application running in the open processing domain.
Claims24
A non-transitory computer-readable storage medium storing instructions that, when executed by at least one processor of a system, cause the system to perform a method comprising:
- invoking, by a first processing domain of the system, a secure abstraction layer of the system, the secure abstraction layer being configured to interact with a secure processing domain of the system to perform one or more operations using secret data within said secure processing domain, the secure processing domain being different, at least in part, than the first processing domain;
- generating, by the first processing domain, one or more requests, the one or more requests being configured to cause the secure processing domain to:
- decrypt a protected data item to generate a first secret value using a first secret key protected by the secure processing domain, and
- perform a digital signature operation using the first secret value as a signing key,
- wherein the one or more requests comprise:
- the protected data item, the protected data item comprising at least one data value previously encrypted within the secure domain using the first secret key, and
- a first data item to be transformed, at least in part, within the secure processing domain;
- issuing, by the first processing domain, the one or more requests to the secure abstraction layer;
- and
- receiving, by the first processing domain from the secure abstraction layer in response to the one or more requests, a data object, the data object comprising a digital signature calculated at least in part using a hash value generated, at least in part, based on the first data item.
Dependencies are inferred from the claim text.