专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20130054948A1 Attestation Protocol for Securely Booting a Guest Operating System 有权
标题翻译：用于安全引导客户机操作系统的认证协议
公开(公告)号：US20130054948A1
公开(公告)日：2013-02-28
申请号：US13222379
申请日：2011-08-31
申请人： Himanshu Raj , Stefan Saroiu , Alastair Wolman , Paul England , Anh M. Nguyen , Shravan Rayanchu
发明人： Himanshu Raj , Stefan Saroiu , Alastair Wolman , Paul England , Anh M. Nguyen , Shravan Rayanchu
IPC分类号： G06F15/177
CPC分类号： G06F9/4406 , G06F9/4416 , G06F9/45533 , G06F9/45558 , G06F21/50 , G06F21/53 , G06F21/57 , G06F21/575 , G06F2009/45587 , G06F2221/034 , G06F2221/2105 , G06F2221/2149
摘要： In a cloud computing environment, a production server virtualization stack is minimized to present fewer security vulnerabilities to malicious software running within a guest virtual machine. The minimal virtualization stack includes support for those virtual devices necessary for the operation of a guest operating system, with the code base of those virtual devices further reduced. Further, a dedicated, isolated boot server provides functionality to securely boot a guest operating system. The boot server is isolated through use of an attestation protocol, by which the boot server presents a secret to a network switch to attest that the boot server is operating in a clean mode. The attestation protocol may further employ a secure co-processor to seal the secret, so that it is only accessible when the boot server is operating in the clean mode.
摘要翻译：在云计算环境中，最小化生产服务器虚拟化堆栈，以减少在虚拟机中运行的恶意软件的安全漏洞。最小的虚拟化堆栈包括对客户操作系统的操作所需的那些虚拟设备的支持，这些虚拟设备的代码基础进一步减少。此外，专用的隔离引导服务器提供安全引导客户机操作系统的功能。引导服务器通过使用认证协议进行隔离，引导服务器向网络交换机提供秘密，以证明引导服务器以干净的模式运行。认证协议可以进一步采用安全协处理器来密封秘密，使得仅当引导服务器以干净模式操作时才可访问。

2. 发明授权

US08812830B2 Attestation protocol for securely booting a guest operating system 有权
标题翻译：用于安全引导客户机操作系统的认证协议
公开(公告)号：US08812830B2
公开(公告)日：2014-08-19
申请号：US13222379
申请日：2011-08-31
申请人： Himanshu Raj , Stefan Saroiu , Alastair Wolman , Paul England , Anh M. Nguyen , Shravan Rayanchu
发明人： Himanshu Raj , Stefan Saroiu , Alastair Wolman , Paul England , Anh M. Nguyen , Shravan Rayanchu
IPC分类号： G06F9/00 , G06F15/177 , G06F9/455 , G06F7/04
CPC分类号： G06F9/4406 , G06F9/4416 , G06F9/45533 , G06F9/45558 , G06F21/50 , G06F21/53 , G06F21/57 , G06F21/575 , G06F2009/45587 , G06F2221/034 , G06F2221/2105 , G06F2221/2149
摘要： In a cloud computing environment, a production server virtualization stack is minimized to present fewer security vulnerabilities to malicious software running within a guest virtual machine. The minimal virtualization stack includes support for those virtual devices necessary for the operation of a guest operating system, with the code base of those virtual devices further reduced. Further, a dedicated, isolated boot server provides functionality to securely boot a guest operating system. The boot server is isolated through use of an attestation protocol, by which the boot server presents a secret to a network switch to attest that the boot server is operating in a clean mode. The attestation protocol may further employ a secure co-processor to seal the secret, so that it is only accessible when the boot server is operating in the clean mode.
摘要翻译：在云计算环境中，最小化生产服务器虚拟化堆栈，以减少在虚拟机中运行的恶意软件的安全漏洞。最小的虚拟化堆栈包括对客户操作系统的操作所需的那些虚拟设备的支持，这些虚拟设备的代码基础进一步减少。此外，专用的隔离引导服务器提供安全引导客户机操作系统的功能。引导服务器通过使用认证协议进行隔离，引导服务器向网络交换机提供秘密，以证明引导服务器以干净的模式运行。认证协议可以进一步采用安全协处理器来密封秘密，使得仅当引导服务器以干净模式操作时才可访问。

3. 发明授权

US10496824B2 Trusted language runtime on a mobile platform 有权
公开(公告)号：US10496824B2
公开(公告)日：2019-12-03
申请号：US13167699
申请日：2011-06-24
申请人： Himanshu Raj , Nuno Santos , Paul England , Stefan Saroiu , Alastair Wolman
发明人： Himanshu Raj , Nuno Santos , Paul England , Stefan Saroiu , Alastair Wolman
IPC分类号： G06F21/57 , G06F21/53
CPC分类号： G06F21/575 , G06F21/53
摘要： Disclosed is a trusted language runtime (TLR) architecture that provides abstractions for developing a runtime for executing trusted applications or portions thereof securely on a mobile device (e.g., a smartphone). TLR offers at least two abstractions to mobile developers: a trustbox and a trustlet. The trustbox is a runtime environment that offers code and data integrity, and confidentiality. Code and data running inside a trustbox cannot be read or modified by any code running outside the trustbox. A trustlet is the code portion of an application that runs inside a trustbox. With TLR, programmers can write applications in .NET and specify which parts of the application handle sensitive data, and thus, run inside the trustbox. With the TLR, the developer places these parts in a trustlet class, and the TLR provides all support needed to run the parts in the trustbox.

4. 发明申请

US20120331550A1 TRUSTED LANGUAGE RUNTIME ON A MOBILE PLATFORM 审中-公开
标题翻译：在移动平台上的TRUSTED语言运行
公开(公告)号：US20120331550A1
公开(公告)日：2012-12-27
申请号：US13167699
申请日：2011-06-24
申请人： Himanshu Raj , Nuno Santos , Paul England , Stefan Saroiu , Alastair Wolman
发明人： Himanshu Raj , Nuno Santos , Paul England , Stefan Saroiu , Alastair Wolman
IPC分类号： G06F21/00
CPC分类号： G06F21/575 , G06F21/53
摘要： Disclosed is a trusted language runtime (TLR) architecture that provides abstractions for developing a runtime for executing trusted applications or portions thereof securely on a mobile device (e.g., a smartphone). TLR offers at least two abstractions to mobile developers: a trustbox and a trustlet. The trustbox is a runtime environment that offers code and data integrity, and confidentiality. Code and data running inside a trustbox cannot be read or modified by any code running outside the trustbox. A trustlet is the code portion of an application that runs inside a trustbox. With TLR, programmers can write applications in .NET and specify which parts of the application handle sensitive data, and thus, run inside the trustbox. With the TLR, the developer places these parts in a trustlet class, and the TLR provides all support needed to run the parts in the trustbox.
摘要翻译：公开了一种可信赖语言运行时（TLR）架构，其提供用于开发用于在移动设备（例如，智能电话机）上执行可信应用或其部分的运行时的抽象。 TLR至少向移动开发人员提供两个抽象：一个信托框和一个信托。 trustbox是提供代码和数据完整性以及机密性的运行时环境。在信托箱内运行的代码和数据不能被任何在信托箱外部运行的代码读取或修改。 trustlet是在一个信任框内运行的应用程序的代码部分。使用TLR，程序员可以在.NET中编写应用程序，并指定应用程序的哪些部分处理敏感数据，从而在trustbox内运行。使用TLR，开发人员将这些部件放置在trustlet类中，并且TLR提供在trustbox中运行部件所需的所有支持。

5. 发明授权

US09411970B2 Sealing secret data with a policy that includes a sensor-based constraint 有权
标题翻译：使用包含基于传感器的约束的策略来密封秘密数据
公开(公告)号：US09411970B2
公开(公告)日：2016-08-09
申请号：US13213085
申请日：2011-08-19
申请人： Stefan Saroiu , Alastair Wolman , Himanshu Raj , He Liu
发明人： Stefan Saroiu , Alastair Wolman , Himanshu Raj , He Liu
IPC分类号： G06F21/00 , G06F21/62 , H04L29/06
CPC分类号： H04L63/107 , G06F9/45558 , G06F21/6209 , G06F2009/45587 , G06F2221/2111 , G06Q40/02 , H04L9/14 , H04L9/30 , H04L9/3247 , H04L63/0435 , H04L63/06 , H04L63/08 , H04L63/083 , H04L63/102 , H04L63/168 , H04W4/021 , H04W12/04 , H04W12/06 , H04W12/08 , H04W12/12
摘要： Technologies pertaining to limiting access to secret data through utilization of sensor-based constraints are described herein. A sensor-based constraint is a constraint that can only be satisfied by predefined readings that may be output by at least one sensor on a mobile computing device. If the sensor on the mobile computing device outputs a reading that satisfies the sensor-based constraint, secret data is provided to a requesting application. Otherwise, the requesting application is prevented from accessing the secret data.
摘要翻译：本文描述了通过利用基于传感器的约束限制对秘密数据的访问的技术。基于传感器的约束是仅能够由移动计算设备上的至少一个传感器输出的预定读数来满足的约束。如果移动计算设备上的传感器输出满足基于传感器的约束的读数，则秘密数据被提供给请求应用。否则，阻止请求应用访问秘密数据。

6. 发明申请

US20140006805A1 Protecting Secret State from Memory Attacks 审中-公开
标题翻译：保护秘密状态免受记忆攻击
公开(公告)号：US20140006805A1
公开(公告)日：2014-01-02
申请号：US13535578
申请日：2012-06-28
申请人： Patrick J. Colp , Himanshu Raj , Stefan Saroiu , Alastair Wolman
发明人： Patrick J. Colp , Himanshu Raj , Stefan Saroiu , Alastair Wolman
IPC分类号： G06F12/14
CPC分类号： G06F12/1425 , G06F21/78 , G06F21/79
摘要： Described is a technology by which classes of memory attacks are prevented, including cold boot attacks, DMA attacks, and bus monitoring attacks. In general, secret state such as an AES key and an AES round block are maintained in on-SoC secure storage, such as a cache. Corresponding cache locations are locked to prevent eviction to unsecure storage. AES tables are accessed only in the on-SoC secure storage, to prevent access patterns from being observed. Also described is securely preparing for an interrupt-based context switch during AES round computations and securely resuming from a context switch without needing to repeat any already completed round or round of computations.
摘要翻译：描述了一种防止内存攻击类别的技术，包括冷启动攻击，DMA攻击和总线监视攻击。通常，诸如AES密钥和AES循环的秘密状态被保持在诸如高速缓存之类的SoC安全存储中。相应的缓存位置被锁定，以防止驱逐不安全的存储。 AES表只能在on-SoC安全存储中访问，以防止访问模式被观察。还描述了在AES循环计算期间安全地准备用于基于中断的上下文切换，并且从上下文切换安全地恢复，而不需要重复任何已经完成的一轮或一轮的计算。

7. 发明授权

US08375221B1 Firmware-based trusted platform module for arm processor architectures and trustzone security extensions 有权
标题翻译：基于固件的信任平台模块，用于ARM处理器架构和信任域安全扩展
公开(公告)号：US08375221B1
公开(公告)日：2013-02-12
申请号：US13193945
申请日：2011-07-29
申请人： Stefan Thom , Jeremiah Cox , David Linsley , Magnus Nystrom , Himanshu Raj , David Robinson , Stefan Saroiu , Rob Spiger , Alastair Wolman
发明人： Stefan Thom , Jeremiah Cox , David Linsley , Magnus Nystrom , Himanshu Raj , David Robinson , Stefan Saroiu , Rob Spiger , Alastair Wolman
IPC分类号： G06F11/30 , G06F7/04
CPC分类号： G06F21/552 , G06F21/46 , G06F21/57 , G06F21/572 , G06F21/575 , G06F21/71 , G06F21/74 , G06F2221/034
摘要： A “Firmware-Based TPM” or “fTPM” ensures that secure code execution is isolated to prevent a wide variety of potential security breaches. Unlike a conventional hardware based Trusted Platform Module (TPM), isolation is achieved without the use of dedicated security processor hardware or silicon. In general, the fTPM is first instantiated in a pre-OS boot environment by reading the fTPM from system firmware or firmware accessible memory or storage and placed into read-only protected memory of the device. Once instantiated, the fTPM enables execution isolation for ensuring secure code execution. More specifically, the fTPM is placed into protected read-only memory to enable the device to use hardware such as the ARM® architecture's TrustZone™ extensions and security primitives (or similar processor architectures), and thus the devices based on such architectures, to provide secure execution isolation within a “firmware-based TPM” without requiring hardware modifications to existing devices.
摘要翻译：基于固件的TPM或fTPM确保安全代码执行被隔离，以防止各种潜在的安全漏洞。与传统的基于硬件的可信平台模块（TPM）不同，在不使用专用安全处理器硬件或硅片的情况下实现隔离。通常，通过从系统固件或固件可访问的存储器或存储器读取fTPM并将其放置在设备的只读受保护的存储器中，fTPM首先在前OS引导环境中实例化。一旦实例化，fTPM就能实现执行隔离，以确保执行安全的代码。更具体地说，将fTPM放置到受保护的只读存储器中，以使设备能够使用诸如ARM®架构的TrustZone™扩展和安全原语（或类似的处理器架构）之类的硬件，从而使基于这种架构的设备提供基于固件的TPM中的安全执行隔离，而不需要对现有设备进行硬件修改。

8. 发明授权

US08965330B2 Split billing for a mobile device 有权
标题翻译：拆分移动设备的帐单
公开(公告)号：US08965330B2
公开(公告)日：2015-02-24
申请号：US13278179
申请日：2011-10-21
申请人： Himanshu Raj , Stefan Saroiu , Alastair Wolman
发明人： Himanshu Raj , Stefan Saroiu , Alastair Wolman
IPC分类号： H04M11/00 , H04M15/00 , H04L12/14 , H04W4/24
CPC分类号： H04M15/07 , H04L12/1457 , H04L12/1475 , H04M15/09 , H04M15/43 , H04W4/24
摘要： The claimed subject matter provides a method for split billing. The method includes receiving a requested token. The requested token specifies conditions under which network traffic is allowed to be billed against a third party for content requested from a mobile computing device. The method also includes matching network traffic between the mobile computing device and a content provider to the specified conditions. The method further includes metering the matched network traffic to a billing account for the third party.
摘要翻译：所要求保护的主题提供了分割计费的方法。该方法包括接收所请求的令牌。所请求的令牌指定了允许从移动计算设备请求的内容向第三方开帐单的网络流量的条件。该方法还包括在指定条件下将移动计算设备与内容提供商之间的网络流量相匹配。该方法还包括将匹配的网络流量计量到第三方的记帐帐户。

9. 发明申请

US20130047197A1 SEALING SECRET DATA WITH A POLICY THAT INCLUDES A SENSOR-BASED CONSTRAINT 有权
标题翻译：用包含基于传感器的约束的政策密封秘密数据
公开(公告)号：US20130047197A1
公开(公告)日：2013-02-21
申请号：US13213085
申请日：2011-08-19
申请人： Stefan Saroiu , Alastair Wolman , Himanshu Raj , He Liu
发明人： Stefan Saroiu , Alastair Wolman , Himanshu Raj , He Liu
IPC分类号： G06F21/00
CPC分类号： H04L63/107 , G06F9/45558 , G06F21/6209 , G06F2009/45587 , G06F2221/2111 , G06Q40/02 , H04L9/14 , H04L9/30 , H04L9/3247 , H04L63/0435 , H04L63/06 , H04L63/08 , H04L63/083 , H04L63/102 , H04L63/168 , H04W4/021 , H04W12/04 , H04W12/06 , H04W12/08 , H04W12/12
摘要： Technologies pertaining to limiting access to secret data through utilization of sensor-based constraints are described herein. A sensor-based constraint is a constraint that can only be satisfied by predefined readings that may be output by at least one sensor on a mobile computing device. If the sensor on the mobile computing device outputs a reading that satisfies the sensor-based constraint, secret data is provided to a requesting application. Otherwise, the requesting application is prevented from accessing the secret data.
摘要翻译：本文描述了通过利用基于传感器的约束限制对秘密数据的访问的技术。基于传感器的约束是仅能够由移动计算设备上的至少一个传感器输出的预定读数来满足的约束。如果移动计算设备上的传感器输出满足基于传感器的约束的读数，则秘密数据被提供给请求应用。否则，阻止请求应用访问秘密数据。

10. 发明授权

US10061718B2 Protecting secret state from memory attacks 有权
公开(公告)号：US10061718B2
公开(公告)日：2018-08-28
申请号：US13535578
申请日：2012-06-28
申请人： Patrick J. Colp , Himanshu Raj , Stefan Saroiu , Alastair Wolman
发明人： Patrick J. Colp , Himanshu Raj , Stefan Saroiu , Alastair Wolman
IPC分类号： G06F21/78 , G06F12/14 , G06F21/79
CPC分类号： G06F12/1425 , G06F21/78 , G06F21/79
摘要： Described is a technology by which classes of memory attacks are prevented, including cold boot attacks, DMA attacks, and bus monitoring attacks. In general, secret state such as an AES key and an AES round block are maintained in on-SoC secure storage, such as a cache. Corresponding cache locations are locked to prevent eviction to unsecure storage. AES tables are accessed only in the on-SoC secure storage, to prevent access patterns from being observed. Also described is securely preparing for an interrupt-based context switch during AES round computations and securely resuming from a context switch without needing to repeat any already completed round or round of computations.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式