Secure processing systems and methods
AssigneeIntertrust Technologies Corporation
InventorsGilles Boccon-Gibod, Gary F. Ellison
Life of this patent
Estimating the term…
Abstract
This disclosure relates to systems and methods for enabling the use of secret digital or electronic information without exposing the sensitive information to unsecured applications. In certain embodiments, the methods may include invoking, by a client application executing in an open processing domain, a secure abstraction layer configured to interface with secret data protected by a secure processing domain. Secure operations may be securely performed on the secret data by the secure abstraction layer in the secure processing domain based on an invocation from a client application running in the open processing domain.
Claims18
A non-transitory computer-readable storage medium storing instructions that, when executed by at least one processor of a system, cause the system to perform a method comprising:
- receiving, by a secure abstraction layer of the system from an application executing within a first processing domain of the system, one or more first requests to invoke a secure processing domain of the system to perform one or more operations using secret data within the secure processing domain, the secure processing domain being different, at least in part, than the first processing domain and the secret data being generated from persisted secret data by unwrapping the persisted secret data using permanent secret data of the secure abstraction layer;
- generating, by the secure abstraction layer, one or more second requests, the one or more second requests being configured to cause the secure processing domain of the system to perform at least one cryptographic operation using the secret data;
- issuing, by the secure abstraction layer, the one or more second requests to the secure processing domain;
- receiving, by the secure abstraction layer from the secure processing domain in response to the one or more second requests, one or more responses, the one or more responses comprising second data, the second data being generated by the secure processing domain at least in part by performing the at least one cryptographic operation using the secret data;
- and
- sending, to the application executing within the first processing domain from the secure abstraction layer, the second data.
Dependencies are inferred from the claim text.