-
公开(公告)号：US10754931B2
公开(公告)日：2020-08-25
申请号：US15001085
申请日：2016-01-19
Applicant: Apple Inc.
Inventor： Pierre-Olivier J. Martel , Austin G. Jennings
Abstract: According to one embodiment, a security manager of a first operating system executed by a processor of a data processing system receives a request received from an application to modify a security settings of the data processing system. In response to the request, the data processing system is restarted into a second operating system, where the second operating system includes functionalities that are fewer than the first operating system. The security settings of the data processing system is modified within the second operating system. After the security settings of the data processing system has been modified, the data processing is rebooted back to the first operating system. A security measure within the first operating system is enforced based on the modified security settings.
-
2.发明申请公开(公告)号：US20130283344A1
公开(公告)日：2013-10-24
申请号：US13922188
申请日：2013-06-19
Applicant: Apple Inc.
Inventor： Ivan Krstic , Austin G. Jennings , Richard L. Hagy
IPC: G06F21/10
CPC classification number: G06F21/6281 , G06F21/10 , G06F21/51 , G06F21/53 , G06F21/629 , G06F2221/033 , G06F2221/0735
Abstract: In response to a request for launching a program, a list of one or more application frameworks to be accessed by the program during execution of the program is determined. Zero or more entitlements representing one or more resources entitled by the program during the execution are determined. A set of one or more rules based on the entitlements of the program is obtained from at least one of the application frameworks. The set of one or more rules specifies one or more constraints of resources associated with the at least one application framework. A security profile is dynamically compiled for the program based on the set of one or more rules associated with the at least one application framework. The compiled security profile is used to restrict the program from accessing at least one resource of the at least one application frameworks during the execution of the program.
Abstract translation: 响应于启动程序的请求，确定在程序执行期间由程序访问的一个或多个应用程序框架的列表。 确定在执行期间表示由程序授权的一个或多个资源的零个或多个授权。 从应用程序框架中的至少一个获得基于程序的权利的一组或多个规则。 所述一个或多个规则的集合指定与所述至少一个应用框架相关联的资源的一个或多个约束。 基于与所述至少一个应用框架相关联的一个或多个规则的集合，为所述程序动态地编译安全简档。 编译的安全简档用于在程序执行期间限制程序访问至少一个应用程序框架的至少一个资源。
-
公开(公告)号：US20210397716A1
公开(公告)日：2021-12-23
申请号：US17092030
申请日：2020-11-06
Applicant: Apple Inc.
Inventor： Xeno S. Kovah , Nikolaj Schlej , Thomas P. Mensch , Wade Benson , Jerrold V. Hauck , Josh P. de Cesare , Austin G. Jennings , John J. Dong , Robert C. Graham , Jacques Fortier
Abstract: Techniques are disclosed relating to securing computing devices during boot. In various embodiments, a secure circuit of a computing device generates for a public key pair and signs, using a private key of the public key pair, configuration settings for an operating system of the computing device. A bootloader of the computing device receives a certificate for the public key pair from a certificate authority and initiates a boot sequence to load the operating system. The boot sequence includes the bootloader verifying the signed configuration settings using a public key included in the certificate and the public key pair. In some embodiments, the secure circuit cryptographically protects the private key based on a passcode of a user, the passcode being usable by the user to authenticate to the computing device.
-
公开(公告)号：US11100242B2
公开(公告)日：2021-08-24
申请号：US14292705
申请日：2014-05-30
Applicant: Apple Inc.
Inventor： Ivan Krstic , Pierre-Olivier J. Martel , Austin G. Jennings
Abstract: Techniques for access control of a data processing system are described. In one embodiment, in response to a request from an application for accessing a resource of a data processing system, it is determined a first class of resources the requested resource belongs. A second class of resources the application is entitled to access is determined based on a resource entitlement encoded within the application and authorized by a predetermined authority. The application is allowed to access the resource if the first class and the second class of resources are matched. The application is denied from accessing the resource if the first class and the second class are not matched, regardless an operating privilege level of the application.
-
公开(公告)号：US11055438B2
公开(公告)日：2021-07-06
申请号：US15060837
申请日：2016-03-04
Applicant: Apple Inc.
Inventor： Ivan Krstic , Austin G. Jennings , Richard L. Hagy
Abstract: In response to a request for launching a program, a list of one or more application frameworks to be accessed by the program during execution of the program is determined. Zero or more entitlements representing one or more resources entitled by the program during the execution are determined. A set of one or more rules based on the entitlements of the program is obtained from at least one of the application frameworks. The set of one or more rules specifies one or more constraints of resources associated with the at least one application framework. A security profile is dynamically compiled for the program based on the set of one or more rules associated with the at least one application framework. The compiled security profile is used to restrict the program from accessing at least one resource of the at least one application frameworks during the execution of the program.
-
Patent Agency Ranking
公开(公告)号：US10032041B2
公开(公告)日：2018-07-24
申请号：US14874224
申请日：2015-10-02
Applicant: Apple Inc.
Inventor： Pierre-Olivier Martel , Austin G. Jennings
Abstract: Techniques for restricting access to a storage volume attached to a data processing system are described. In one embodiment, a storage management and access control logic in the data processing system can receive a message indicating the attachment of a storage volume. The logic can apply access restrictions to the storage volume by creating an association between a restricted resource class and the storage volume to limit programmatic access to the storage volume. An evaluation of the storage volume can be requested and based on the result of the evaluation the access restrictions can be removed or retained on the storage volume.
-
公开(公告)号：US20160357983A1
公开(公告)日：2016-12-08
申请号：US14874224
申请日：2015-10-02
Applicant: Apple Inc.
Inventor： Pierre-Olivier Martel , Austin G. Jennings
CPC classification number: G06F21/6218 , G06F9/545
Abstract: Techniques for restricting access to a storage volume attached to a data processing system are described. In one embodiment, a storage management and access control logic in the data processing system can receive a message indicating the attachment of a storage volume. The logic can apply access restrictions to the storage volume by creating an association between a restricted resource class and the storage volume to limit programmatic access to the storage volume. An evaluation of the storage volume can be requested and based on the result of the evaluation the access restrictions can be removed or retained on the storage volume.
Abstract translation: 描述了用于限制对连接到数据处理系统的存储卷的访问的技术。 在一个实施例中，数据处理系统中的存储管理和访问控制逻辑可以接收指示存储卷的附着的消息。 逻辑可以通过创建受限资源类和存储卷之间的关联来限制对存储卷的访问限制，以限制对存储卷的编程访问。 可以请求对存储卷的评估，并且基于评估结果，访问限制可被移除或保留在存储卷上。
-
8.发明申请公开(公告)号：US20160357950A1
公开(公告)日：2016-12-08
申请号：US15001085
申请日：2016-01-19
Applicant: Apple Inc.
Inventor： Pierre-Olivier J. Martel , Austin G. Jennings
CPC classification number: G06F21/126 , G06F21/575 , G06F21/6281 , G06F2221/2105
Abstract: According to one embodiment, a security manager of a first operating system executed by a processor of a data processing system receives a request received from an application to modify a security settings of the data processing system. In response to the request, the data processing system is restarted into a second operating system, where the second operating system includes functionalities that are fewer than the first operating system. The security settings of the data processing system is modified within the second operating system. After the security settings of the data processing system has been modified, the data processing is rebooted back to the first operating system. A security measure within the first operating system is enforced based on the modified security settings.
Abstract translation: 根据一个实施例，由数据处理系统的处理器执行的第一操作系统的安全管理器接收从应用程序接收到的修改数据处理系统的安全设置的请求。 响应于该请求，数据处理系统重新启动到第二操作系统中，其中第二操作系统包括少于第一操作系统的功能。 在第二操作系统内修改数据处理系统的安全设置。 在数据处理系统的安全设置被修改之后，数据处理被重新引导回到第一操作系统。 第一个操作系统中的安全措施是基于修改后的安全设置实施的。
-
公开(公告)号：US20160321471A1
公开(公告)日：2016-11-03
申请号：US15060837
申请日：2016-03-04
Applicant: Apple Inc.
Inventor： Ivan Krstic , Austin G. Jennings , Richard L. Hagy
CPC classification number: G06F21/6281 , G06F21/10 , G06F21/51 , G06F21/53 , G06F21/629 , G06F2221/033 , G06F2221/0735
Abstract: In response to a request for launching a program, a list of one or more application frameworks to be accessed by the program during execution of the program is determined. Zero or more entitlements representing one or more resources entitled by the program during the execution are determined. A set of one or more rules based on the entitlements of the program is obtained from at least one of the application frameworks. The set of one or more rules specifies one or more constraints of resources associated with the at least one application framework. A security profile is dynamically compiled for the program based on the set of one or more rules associated with the at least one application framework. The compiled security profile is used to restrict the program from accessing at least one resource of the at least one application frameworks during the execution of the program.
-
公开(公告)号：US11822664B2
公开(公告)日：2023-11-21
申请号：US17092030
申请日：2020-11-06
Applicant: Apple Inc.
Inventor： Xeno S. Kovah , Nikolaj Schlej , Thomas P. Mensch , Wade Benson , Jerrold V. Hauck , Josh P. de Cesare , Austin G. Jennings , John J. Dong , Robert C. Graham , Jacques Fortier
CPC classification number: G06F21/575 , G06F9/4406 , G06F21/72 , G06F21/73 , H04L9/0897 , H04L9/3226 , H04L9/3236 , H04L9/3268 , H04L63/123 , G06F2221/034
Abstract: Techniques are disclosed relating to securing computing devices during boot. In various embodiments, a secure circuit of a computing device generates for a public key pair and signs, using a private key of the public key pair, configuration settings for an operating system of the computing device. A bootloader of the computing device receives a certificate for the public key pair from a certificate authority and initiates a boot sequence to load the operating system. The boot sequence includes the bootloader verifying the signed configuration settings using a public key included in the certificate and the public key pair. In some embodiments, the secure circuit cryptographically protects the private key based on a passcode of a user, the passcode being usable by the user to authenticate to the computing device.
-
-
-
-
-
-
-
-
-
Search Results
12
records
(took 0.012 seconds)
