# US 9,438,627 B2 · Shared security utility appliance for secure application and data processing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,627 B2 - Document ID: US9438627B2 - Status: Granted - Kind: B2 - Application number: 14/301,498 - Filed: 2014-06-11 - Published: 2015-12-17 - Granted: 2016-09-06 - Earliest claimed: 2014-06-11 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Ronald L. Billau; Vincenzo V. Di Luoffo - Web page: https://patentgrep.com/patent/US9438627B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/86: Secure or tamper-resistant housings - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04W 12/069: using certificates or pre-shared keys - H04W 12/08: Access security - H04L 2463/102: applying security measure for e-commerce - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A security information technology element (ITE) is disclosed for secure application and data processing, the security ITE including a physical enclosure defining a protection envelope and a secure computing device disposed within the protection envelope. The security ITE provides security services to applications and a secure processing environment for hosting applications, and includes cryptographic services and hardware acceleration. A security manager within the security ITE is configured to erase data within the protection envelope upon detecting physical tampering. ## Claims ### Claim 1 A computer-readable device containing a program which, when executed using one or more computer processors, performs operations comprising: registering a first application with a security information technology element (ITE), the security ITE comprising a secure computing device located within a protection envelope and configured to provide security services for one or more applications; creating an application profile corresponding to the registered application and specifying an industry type of the registered application, the industry type associated with one or more security requirements for the registered application; receiving, over a secure communications link, a request from the registered application specifying a first data item; determining, based on the industry type, one or more security operations to perform on the first data item, wherein the one or more security operations are adapted to satisfy the one or more security requirements for the registered application; performing the one or more security operations on the first data item in accordance with the application profile, thereby producing a modified first data item; and returning, over the secure communications link, the modified first data item to the registered application. ### Claim 2 (depends on 1) The computer-readable device of claim 1, wherein the security ITE is configured to erase data within the protection envelope upon detecting a tampering event. ### Claim 3 (depends on 2) The computer-readable device of claim 2, wherein registering a first application comprises establishing the secure communications link between the first application and the security ITE. ### Claim 4 (depends on 3) The computer-readable device of claim 3, wherein registering a first application further comprises generating a key for authenticating the first application, and wherein the data erased upon detecting a tampering event includes the key. ### Claim 5 (depends on 1) The computer-readable device of claim 1, wherein the security services include one or more of encrypting data and data splitting. ### Claim 6 (depends on 1) The computer-readable device of claim 1, wherein the application profile is configured to include one or more preferences for the security services. ### Claim 7 (depends on 1) The computer-readable device of claim 1, wherein the industry type is one of healthcare and finance. ### Claim 8 (depends on 1) The computer-readable device of claim 1, wherein determining, based on the industry type, one or more security operations to perform on the first data item comprises: identifying one or more minimum security requirements having a predetermined association with the industry type; and determining whether to apply more stringent security requirements than the minimum security requirements, wherein the one or more security operations to perform on the first data item are selected from the one or more minimum security requirements and the more stringent security requirements. ### Claim 9 (depends on 8) The computer-readable device of claim 8, wherein the more stringent security requirements are applied by default. ### Claim 10 (depends on 9) The computer-readable device of claim 9, wherein the more stringent security requirements have a predetermined association with the industry type. ### Claim 11 A system, comprising: a computing device comprising a processor and configured to execute at least a first application; a security information technology element (ITE) comprising a secure computing device located within a protection envelope and configured to provide security services for one or more applications, wherein the security ITE is configured to perform operations comprising: registering the first application; creating an application profile corresponding to the registered application and specifying an industry type of the registered application, the industry type associated with one or more security requirements for the registered application; receiving, over a secure communications link, a request from the registered application specifying a first data item; determining, based on the industry type, one or more security operations to perform on the first data item, wherein the one or more security operations are adapted to satisfy the one or more security requirements for the registered application; performing the one or more security operations on the first data item in accordance with the application profile, thereby producing a modified first data item; and returning, over the secure communications link, the modified first data item to the registered application. ### Claim 12 (depends on 11) The system of claim 11, wherein the security ITE is further configured to erase data within the protection envelope upon detecting a tampering event. ### Claim 13 (depends on 12) The system of claim 12, wherein registering the first application comprises establishing the secure communications link between the first application and the security ITE. ### Claim 14 (depends on 13) The system of claim 13, wherein registering the first application further comprises generating a key for authenticating the first application, and wherein the data erased upon detecting a tampering event includes the key. ### Claim 15 (depends on 11) The system of claim 11, wherein the security services include one or more of encrypting data and data splitting. ### Claim 16 (depends on 11) The system of claim 11, wherein the application profile is further configured to include one or more preferences for the security services. ### Claim 17 (depends on 11) The system of claim 11, wherein the industry type is one of healthcare and finance. ### Claim 18 (depends on 11) The system of claim 11, wherein determining, based on the industry type, one or more security operations to perform on the first data item comprises: identifying one or more minimum security requirements having a predetermined association with the industry type; and determining whether to apply more stringent security requirements than the minimum security requirements, wherein the one or more security operations to perform on the first data item are selected from the one or more minimum security requirements and the more stringent security requirements. ### Claim 19 (depends on 18) The system of claim 18, wherein the more stringent security requirements are applied by default. ### Claim 20 (depends on 19) The system of claim 19, wherein the more stringent security requirements have a predetermined association with the industry type.