Apparatus for processing with a secure system manager

A head mounted display, comprising:

• a body adapted to be worn on a user's head;
• a processor adapted for executing executable instructions;
• at least one input unit in communication with said processor;
• at least one output unit in communication with said processor, said at least one output unit comprising at least one graphical display disposed proximate at least one of said user's eyes;
• a data storage unit in communication with said processor;
• a plurality of non-secure data entities, comprising:
• a non-secure program instantiated on said processor, said non-secure program comprising non-secure executable instructions;
• a non-secure data store disposed on said storage unit, said non-secure data store comprising non-secure executable instructions stored therein;
• a non-secure input, said non-secure input being adapted to input to said apparatus via said at least one input unit;
• a non-secure output, said non-secure output being adapted to output from said apparatus via said at least one output unit;
• a plurality of secure data entities, comprising:
• a communication monitor instantiated on said processor, said communication monitor comprising secure executable instructions, said communication monitor being adapted to detect communication among any of said at least one secure data entity and said at least one non-secure data entity;
• a permitted instruction record instantiated on said processor;
• a first prohibitor instantiated on said processor, said first prohibitor comprising said secure executable instructions, said first prohibitor being adapted to prohibit execution of said non-secure executable instructions on said at least one secure data entity unless said non-secure executable instructions are recorded in said permitted instruction record;
• a prohibited instruction record instantiated on said processor;
• and
• a second prohibitor instantiated on said processor, said second prohibitor comprising said secure executable instructions, said second prohibitor being adapted to prohibit execution of said non-secure executable instructions on said at least one non-secure data entity if said non-secure executable instructions are recorded in said prohibited instruction record;
• a secure data store disposed on said data storage unit, said secure data store comprising secure executable instructions stored therein;
• a secure input, said secure input being adapted to input to said apparatus via said at least one input unit;
• a secure output, said secure output being adapted to output from said apparatus via said at least one output unit;
• a loader adapted to instantiate said communication monitor, said permitted instruction record, said first prohibitor, said prohibited instruction record, and said second prohibitor on said processor from said secure executable instructions stored in said secure data store, and to instantiate said non-secure program on said processor from said non-secure executable instructions in said non-secure data store;
• wherein
• said permitted instruction record excludes all said non-secure executable instructions reading from said any of said secure data entities;
• and
• said permitted instruction record excludes all said non-secure executable instructions writing to any of said secure data entities.

An apparatus, comprising:

• processing means for executing executable instructions;
• at least one non-secure data means, comprising:
• a non-secure instructing means for delivering non-secure executable instructions to said processing means, said non-secure instructing means being instantiated in said processing means;
• a plurality of secure data means, comprising:
• a monitoring means for detecting communication among said secure data means and said non-secure data means, said monitoring means being instantiated in said processing means;
• means for recording permitted instructions;
• first prohibiting means for prohibiting said processing means from executing said non-secure executable instructions on said secure data means unless said non-secure executable instructions are recorded in said means for recording permitted instructions, said first prohibiting means being instantiated in said processing means;
• means for recording prohibited instructions;
• and
• second prohibiting means for prohibiting said processing means from executing said non-secure executable instructions on said non-secure data means if said non-secure executable instructions are recorded in said means for recording prohibited instructions, said second prohibiting means being instantiated in said processing means.