Trusted intermediary realm

A data processing method comprising:

• performing data processing in response to one or more software processes;
• and
• enforcing ownership rights for a plurality of memory regions based on ownership information defining, for a given memory region, an owner realm specified from among a plurality of realms, each realm corresponding to at least a portion of at least one of the software processes, said owner realm having a right to exclude other realms from accessing data stored within said given memory region;
• and
• controlling operation of a given realm based on security configuration parameters associated with the given realm;
• in which:
• when the security configuration parameters for the given realm specify that the given realm is associated with a trusted intermediary realm identified by the security configuration parameters, the trusted intermediary realm is permitted to perform at least one realm management function for the given realm.

A computer program for controlling a host data processing apparatus to provide an instruction execution environment, comprising:

• memory access program logic to control access to a plurality of memory regions of a simulated memory address space based on ownership information defining, for a given memory region, an owner realm specified from among a plurality of realms, each realm corresponding to at least a portion of at least one of a plurality of software processes executed in the instruction execution environment, said owner realm having a right to exclude other realms from accessing data stored within said given memory region;
• and
• realm management program logic to control operation of a given realm based on security configuration parameters associated with the given realm;
• in which:
• when the security configuration parameters for the given realm specify that the given realm is associated with a trusted intermediary realm identified by the security configuration parameters, the realm management program logic is configured to permit the trusted intermediary realm to perform at least one realm management function for the given realm.