Policy based cryptographic application programming interface in secure memory

A method for software execution by a computer, comprising:

• executing an application in a first secure memory location of a secure cryptographic module;
• transmitting a call from the application to an application programming interface (API) of the application, the API being in a second secure memory location of the secure cryptographic module, the second secure memory location being separate and secure from the first secure memory location;
• evaluating the call in the second secure memory location to determine whether the call complies with a security policy before executing the call;
• and
• encrypting the call with a cryptographic algorithm before transmitting the call from the application to the API.

A computer system, comprising:

• means for storing an application in a first secure memory location;
• means for formatting a request to comply with a security policy;
• means for transmitting the request from the application to a cryptographic application programming interface (API) of the application, the API being stored in a second secure memory location that is secure and separate from the first secure memory location;
• means for verifying, in the second secure memory location, that the request complies with the security policy before executing the request;
• means for enclosing the first and second memory locations in a secure module that detects physical intrusions;
• and
• means for encrypting the request with a cryptographic algorithm before transmitting the request from the application to the API.

A computer system, comprising:

• memory having first and second secure portions, the first secure portion storing an application and the second secure portion storing a policy checking algorithm and an application programming interface (API) of the application;
• a processor coupled to the memory for executing the application, the API, and the policy checking algorithm to:
• transmit a call from the application to the API,
• encrypt the call with a cryptographic algorithm before transmitting the call from the application to the API;
• evaluate the call to determine whether the call complies with a security policy of the policy checking algorithm,
• execute the call if the call complies with the security policy, and
• deny the call if the call does not comply with the security policy;
• and
• a cryptographic module enclosing the memory and the processor.