Secure dynamic loading

A data-processing unit loading, installing and executing items of software, referred to as loading units, having different confidentiality levels, the data-processing unit comprising, in addition to a central processing unit, a secure core which is contained in a lowest layer of an operating system and a secure physical zone which is a most secure portion of a hardware architecture of this data-processing unit, further comprising a security module which is installed in the secure physical zone, the security module carrying out in an autonomous manner, functions of:

• installing new loading units;
• controlling and implementing security policy rules by attributing and controlling access rights in accordance with the confidentiality level of each loading unit;
• maintaining a current status and integrity of a system in accordance with components of the operating system and loading units;
• and
• verifying the restrictions defined by a data structure of installation restrictions, associated with each loading unit,
• wherein the security module is an autonomous security module separate from each of the loading units.

A method for loading, verifying and executing a plurality of loading units in a data processing-unit, the method comprising:

• associating, via a programmed processor, a plurality of data structures defining identification information, installation restriction requirements and policy requests for each loading unit of the plurality of loading units, said associating step performed by an autonomous security module separate from each of the loading units;
• updating, via the programmed processor, a current security status of the data-processing unit upon a change of an internal status of the data-processing unit, said updating step performed by the autonomous security module separate from each of the loading units;
• validating, via the programmed processor, the loading unit by comparing the installation restriction requirements with the current security status of the data-processing unit and the policy requests with system resources of the data-processing unit, said validating step performed by the autonomous security module separate from each of the loading units;
• and
• loading and executing, via the programmed processor, the loading unit, the loading and executing of the loading unit changes the internal status of the data-processing unit, said load and executing step performed by the autonomous security module separate from each of the loading units.