US 9,807,608 B2Granted

System of multiple domains and domain ownership

AssigneeInterDigital Patent Holdings, Inc.

InventorsInhyok Cha, Louis J. Guccione, Yogendra C. Shah, Andreas U. Schmidt, Sudhir B. Pattar

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods and instrumentalities are disclosed that enable one or more domains on one or more devices to be owned or controlled by one or more different local or remote owners, while providing a level of system-wide management of those domains. Each domain may have a different owner, and each owner may specify policies for operation of its domain and for operation of its domain in relation to the platform on which the domain resides, and other domains. A system-wide domain manager may be resident on one of the domains. The system-wide domain manager may enforce the policies of the domain on which it is resident, and it may coordinate the enforcement of the other domains by their respective policies in relation to the domain in which the system-wide domain manager resides. Additionally, the system-wide domain manager may coordinate interaction among the other domains in accordance with their respective policies.

Claims75

Dependent claims

A system comprising:

a device comprising a plurality of domains supported by at least one platform, each domain comprising a configuration of computing resources executing on the at least one platform and each domain being configured to perform functions for an owner of the domain that may be located locally or remotely from the domain, wherein each domain may have a different owner, and wherein each owner may specify policies for operation of its domain, and the domains are isolated from each other such that their respective computing resources cannot be accessed by the other domains without authorization by the respective domain owner;
and
a system-wide domain manager resident on one of the domains, the system-wide domain manager configured to:
enforce the policies of the domain on which it is resident,
coordinate the enforcement of respective policies of the other domains in relation to the domain in which the system-wide domain manager resides,
coordinate the interaction among the other domains in accordance with their respective policies and the policies of the domain in which the system-wide domain manager resides,
make a request that the other domains produce a respective integrity attestation, wherein the request comprises authorization data, such that the other domains can verify, using the authorization data, that the system-wide domain manager has authority to make the request for the integrity attestation;
evaluate whether the computing resources are sufficient to load a new domain that is isolated from the other domains on the device,
and if the computing resources are sufficient, determine to load the new domain based on one or more policies of at least one of the domains, wherein the computing resources comprise memory and virtual machine threads.

6 more elements

In a system comprising a device that comprises a plurality of domains supported by at least one platform, wherein each domain comprises a configuration of computing resources executing on the at least one platform and each domain is configured to perform functions for an owner of the domain that may be located locally or remotely from the domain, wherein each domain may have a different owner, and wherein each owner may specify policies for operation its domain, and the domains are isolated from each other such that their respective computing resources cannot be accessed by the other domains without authorization by the respective domain owner, a method comprising:

at least two of the domains authenticating each other and communicating with each other via a secure channel set up between them;
and
managing, by a system-wide domain manager residing in one of the domains, the operation of said domains, said managing comprising:
enforcing the policies of the domain on which the system-wide domain manager is resident;
coordinating the enforcement of respective policies of the other domains in relation to the domain in which the system-wide domain manager resides;
coordinating the interaction among the other domains in accordance with their respective policies and the policies of the domain in which the system-wide domain manager resides;
making a request that the other domains produce a respective integrity attestation, wherein the request comprises authorization data, such that the other domains can verify, using the authorization data, that the system-wide domain manager has authority to make the request for the integrity attestation;
evaluating whether the computing resources are sufficient to load a new domain that is isolated from the other domains on the device;
and if the computing resources are sufficient, determining to load the new domain based on one or more policies of at least one of the domains, wherein the computing resources comprise memory and virtual machine threads.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 12/763,827Filed 20 Apr 2010 · us provisional application
Priority: 20 Apr 2009
Published: US 2011/0099605 A128 Apr 2011
Granted: 31 Oct 2017
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04W 12/06
Security arrangements; Authentication; Protecting privacy or anonymity: authentication
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04W 12/04
Security arrangements; Authentication; Protecting privacy or anonymity: key management, e.g. using generic bootstrapping architecture [GBA]
H04W 12/086
Access security: using security domains