# US 2016/0366139 A1 · Secure Zone for Secure Purchases

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2016/0366139 A1
- Document ID: US20160366139A1
- Status: Published application
- Kind: A1
- Application number: 15/247,193
- Filed: 2016-08-25
- Published: 2016-12-15
- Earliest claimed: 2012-04-20
- Assignees: OLogN Technologies AG
- Applicants: OLogN Technologies AG
- Inventors: Sergey IGNATCHENKO; Dmytro IVANCHYKHIN
- Web page: https://patentgrep.com/patent/US20160366139A1

## CPC

- G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode
- H04L 63/10: {for controlling access to devices or network resources}
- G06F 9/468: {Specific access rights for resources, e.g. using capability register}
- G06F 21/44: Program or device authentication
- G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/54: by adding security routines or objects to programs
- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/102: {Entity profiles}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An apparatus according to the present disclosure may comprise a secure zone configured to execute a task having a subtask. The task and subtask may have respective executable code and may be digitally signed by respective code providers. The secure zone may be further configured to apply respective sets of permissions while the respective executable code of the task and subtask are executed. The respective set of permissions for the task may be based on at least one of information associated with the signed task and information in a digital certificate of the respective code provider for the task. The respective set of permissions for the subtask may be based on at least one of information associated with the signed subtask and information in a digital certificate of the respective code provider for the subtask.

## Claims

### Claim at position 1

1-21. (canceled)

### Claim 22

An apparatus, comprising:
a secure zone configured to execute a task, and
a non-secure zone, wherein the secure zone is configured to use network capabilities of the non-secure zone to connect to a network.

### Claim 23 (depends on 22)

The apparatus of claim 22, wherein the secure zone is configured to provide network capabilities to the task.

### Claim 24 (depends on 22)

The apparatus of claim 22, wherein the network capabilities of the non-secure zone include a TCP/IP stack.

### Claim 25 (depends on 22)

The apparatus of claim 22, wherein the task has a subtask, the task and the subtask have respective executable code, and the task and the subtask are digitally signed by respective code providers, and
wherein the secure zone is configured to apply respective sets of permissions while the respective executable code of the task and subtask are executed, wherein the respective set of permissions for the task are based on at least one of information associated with the signed task and information in a digital certificate of the respective code provider for the task, and wherein the respective set of permissions for the subtask are based on at least one of information associated with the signed subtask and information in a digital certificate of the respective code provider for the subtask.

### Claim 26

A method, comprising:
receiving a task at a secure zone; and
executing the task by the secure zone, wherein execution of the task comprises communicating with a network using network capabilities provided by a non-secure zone.

### Claim 27 (depends on 26)

The method of claim 26, further comprising providing network capabilities to the task by the secure zone.

### Claim 28 (depends on 26)

The method of claim 26, wherein the network capabilities of the non-secure zone include a TCP/IP stack.

### Claim 29 (depends on 26)

The method claim 26, wherein the task has a subtask, the task and the subtask have respective executable code, and the task and the subtask are digitally signed by respective code providers, and the method further comprises applying respective sets of permissions while the respective executable code of the task and subtask are executed, wherein the respective set of permissions for the task are based on at least one of information associated with the signed task and information in a digital certificate of the respective code provider for the task, and wherein the respective set of permissions for the subtask are based on at least one of information associated with the signed subtask and information in a digital certificate of the respective code provider for the subtask.