-
11.发明授权公开(公告)号：US09536080B2
公开(公告)日：2017-01-03
申请号：US14726292
申请日：2015-05-29
Applicant: Apple Inc.
Inventor： Gregory I. Kerr , Pierre-Olivier J. Martel , Love Hornquist Astrand , Peter Kiehtreiber , Ivan Krstic
CPC classification number: G06F21/52 , G06F21/51 , G06F21/64 , G06F2221/033
Abstract: According to one embodiment, in response to a request received from an application by a launch module hosted by an operating system and executed by a processor to dynamically load a library, a library validation module hosted by the operating system extracts a first team identifier (ID) from the application, where the first team ID identifies an application provider that provides the application. The library validation module extracts a second team ID from the library, where the second team ID identifies a library provider that provides the library. The first team ID and the second team ID are compared to determine whether the first team ID matches the second team ID. In response to determining that the first team ID matches the second team ID, the launch module launches the library to allow the application communicate with the library; otherwise, the request is denied.
Abstract translation: 根据一个实施例，响应于由操作系统托管并由处理器执行并由处理器执行以动态加载库的从应用程序接收到的请求，由操作系统托管的库验证模块提取第一团队标识符（ID ），其中第一个团队ID标识提供应用程序的应用程序提供程序。 库验证模块从库中提取第二个团队ID，其中第二个团队ID标识提供该库的库提供程序。 比较第一个团队ID和第二个团队ID，以确定第一个团队ID是否与第二个团队ID相匹配。 为了响应确定第一个团队ID与第二个团队ID相匹配，启动模块启动该库以允许应用程序与库通信; 否则，请求被拒绝。
-
公开(公告)号：US08966574B2
公开(公告)日：2015-02-24
申请号：US13624832
申请日：2012-09-21
Applicant: Apple Inc.
Inventor： Peter Kiehtreiber , Jacques A. Vidrine , Christopher S. Linn , Randy D. Saldinger , Braden J. Thomas
IPC: G06F21/51
CPC classification number: H04L63/20 , G06F21/51 , H04L63/1433 , H04L63/1441
Abstract: A novel security framework that is part of an operating system of a device is provided. The framework includes a security assessor that performs security policy assessments for different operations that need to be performed with respect to an application executing on the device. Examples of such operations include the installation of the application, execution of the application, and the opening of content files (e.g., opening of documents) by the application.
-
公开(公告)号：US08880897B2
公开(公告)日：2014-11-04
申请号：US13725957
申请日：2012-12-21
Applicant: Apple Inc.
Inventor： Peter Kiehtreiber , Michael Brouwer
CPC classification number: G06F21/50 , G06F21/54 , H04L9/3239 , H04L9/3247 , H04L2209/38
Abstract: The present invention discloses a method for quickly and easily authenticating large computer program. The system operates by first sealing the computer program with digital signature in an incremental manner. Specifically, the computer program is divided into a set of pages and a hash value is calculated for each page. The set of hash values is formed into a hash value array and then the hash value array is then sealed with a digital signature. The computer program is then distributed along with the hash value array and the digital signature. To authenticate the computer program, a recipient first verifies the authenticity of the hash value array with the digital signature and a public key. Once the hash value array has been authenticated, the recipient can then verify the authenticity of each page of the computer program by calculating a hash of a page to be loaded and then comparing with an associated hash value in the authenticated hash value array. If the hash values do not match, then execution may be halted.
Abstract translation: 本发明公开了一种快速轻松地认证大型计算机程序的方法。 该系统通过以数字签名方式首先密封计算机程序来运行。 具体地说，将计算机程序划分为一组页面，并为每个页面计算哈希值。 哈希值集合形成一个哈希值数组，然后用数字签名封装哈希值数组。 然后将计算机程序与哈希值数组和数字签名一起分发。 为了对计算机程序进行认证，接收者首先使用数字签名和公钥验证散列值数组的真实性。 一旦哈希值数组已被认证，接收者就可以通过计算要加载的页面的散列值，然后与经鉴别的散列值数组中相关的散列值进行比较来验证计算机程序的每一页面的真实性。 如果哈希值不匹配，则执行可能会停止。
-
14.发明授权公开(公告)号：US08782807B2
公开(公告)日：2014-07-15
申请号：US13759030
申请日：2013-02-04
Applicant: Apple Inc.
Inventor： Peter Kiehtreiber
IPC: G06F7/04 , G06F17/30 , H04N7/16 , G06F21/52 , G06F21/12 , G06F21/50 , G06F21/51 , G06F11/00 , G06F12/14 , H04L29/06 , G06F9/44
Abstract: A code authentication architecture is used to sign code by adding one or more digital signatures to it. The digital signatures identify what authority signed the code, what the code contains, what type of program the code is, or other identifying information. When the signed code is later executed on a computer system, its identity is obtained by accessing encrypted information of the code stored on disk. The architecture then determines whether the identity satisfies at least one requirement imposed on the code for some purpose. If the code has been altered from when it was signed or it fails to satisfy a requirement imposed, the code will not have a valid identity. In addition to verifying the identity of the code, the architecture also validates executing code immediately responsible for managing the code and additional executing code in a chain of hosts responsible for managing one another.
Abstract translation: 代码认证架构用于通过向其添加一个或多个数字签名来对代码进行签名。 数字签名标识了哪些权限签署了代码，代码包含什么，代码是什么类型的程序，还是其他标识信息。 当签名代码稍后在计算机系统上执行时，其身份通过访问存储在磁盘上的代码的加密信息获得。 该体系结构然后确定身份是否满足至少一个强制在代码上的要求。 如果代码已经从签署的时候被更改或者不能满足强制要求，代码将不具有有效的身份。 除了验证代码的身份之外，架构还验证执行代码，它们立即负责管理代码和负责管理彼此的主机链中的附加执行代码。
-
公开(公告)号：US20130205362A1
公开(公告)日：2013-08-08
申请号：US13624828
申请日：2012-09-21
Applicant: Apple Inc.
Inventor： Peter Kiehtreiber , Jacques A. Vidrine , Christopher S. Linn , Randy D. Saldinger , Braden J. Thomas
IPC: G06F21/00
CPC classification number: H04L63/20 , G06F21/51 , H04L63/1433 , H04L63/1441
Abstract: A novel security framework that is part of an operating system of a device is provided. The framework includes a security assessor that performs security policy assessments for different operations that need to be performed with respect to an application executing on the device. Examples of such operations include the installation of the application, execution of the application, and the opening of content files (e.g., opening of documents) by the application.
Abstract translation: 提供了作为设备的操作系统的一部分的新颖的安全框架。 该框架包括一个安全评估员，该执行者对于在设备上执行的应用程序需要执行的不同操作执行安全策略评估。 这种操作的示例包括安装应用程序，执行应用程序以及应用程序打开内容文件（例如打开文档）。
-
Patent Agency Ranking
公开(公告)号：US20130111216A1
公开(公告)日：2013-05-02
申请号：US13725957
申请日：2012-12-21
Applicant: Apple Inc.
Inventor： Peter Kiehtreiber , Michael Brouwer
IPC: G06F21/50
CPC classification number: G06F21/50 , G06F21/54 , H04L9/3239 , H04L9/3247 , H04L2209/38
Abstract: The present invention discloses a method for quickly and easily authenticating large computer program. The system operates by first sealing the computer program with digital signature in an incremental manner. Specifically, the computer program is divided into a set of pages and a hash value is calculated for each page. The set of hash values is formed into a hash value array and then the hash value array is then sealed with a digital signature. The computer program is then distributed along with the hash value array and the digital signature. To authenticate the computer program, a recipient first verifies the authenticity of the hash value array with the digital signature and a public key. Once the hash value array has been authenticated, the recipient can then verify the authenticity of each page of the computer program by calculating a hash of a page to be loaded and then comparing with an associated hash value in the authenticated hash value array. If the hash values do not match, then execution may be halted.
Abstract translation: 本发明公开了一种快速轻松地认证大型计算机程序的方法。 该系统通过以数字签名方式首先密封计算机程序来运行。 具体地说，将计算机程序划分为一组页面，并为每个页面计算哈希值。 哈希值集合形成一个哈希值数组，然后用数字签名封装哈希值数组。 然后将计算机程序与哈希值数组和数字签名一起分发。 为了对计算机程序进行认证，接收者首先使用数字签名和公钥验证散列值数组的真实性。 一旦哈希值数组已被认证，接收者就可以通过计算要加载的页面的散列值，然后与经鉴别的散列值数组中相关的散列值进行比较来验证计算机程序的每一页面的真实性。 如果哈希值不匹配，则执行可能会停止。
-
公开(公告)号：US09811393B2
公开(公告)日：2017-11-07
申请号：US14488126
申请日：2014-09-16
Applicant: Apple Inc.
Inventor： Peter Kiehtreiber , Olivier Gutknecht , Ivan Krstic , Adele Peterson , Samuel M. Weinig , Yongjun Zhang , Ian J. Baird
Abstract: According to one embodiment, in response to an inquiry received from a first application for an extension service associated with a first of a plurality of extension points of an operating system, a list of one or more extensions is identified that have been registered for the first extension point with the operating system, where the first application is executed within a first sandboxed environment. The identified list of extensions is displayed to prompt a user to select one of the extensions to be associated with the first application. In response to a selection of one of the extensions, the selected extension is launched in a second sandboxed environment. The selected extension and the second application were packaged in an application bundle, and when the application bundle was installed, the selected extension and the second application appeared in a registry of the operating system as separate applications.
-
公开(公告)号：US09811381B2
公开(公告)日：2017-11-07
申请号：US15219052
申请日：2016-07-25
Applicant: Apple Inc.
Inventor： Jussi-Pekka Mantere, III , Alexander Tony Maluta , John William Scalo , Eugene Ray Tyacke , Bruce Gaya , Michael John Smith , Peter Kiehtreiber , Simon P. Cooper
CPC classification number: G06F9/5005 , G06F9/54 , G06F21/44 , G06F21/602 , H04L63/104
Abstract: Resource restrictions are associated with a user identifier. A resource restriction agent receives operating system calls related for resources and provides resource request data to a resource agent. The resource agent determines whether the resource is restricted based on the resource request data and resource restriction data and generates access data based on the determination. The resource restriction agent grants or denies the system call based on the access data.
-
公开(公告)号：US20170083370A1
公开(公告)日：2017-03-23
申请号：US15219052
申请日：2016-07-25
Applicant: Apple Inc.
Inventor： Jussi-Pekka Mantere, III , Alexander Tony Maluta , John William Scalo , Eugene Ray Tyacke , Bruce Gaya , Michael John Smith , Peter Kiehtreiber , Simon P. Cooper
CPC classification number: G06F9/5005 , G06F9/54 , G06F21/44 , G06F21/602 , H04L63/104
Abstract: Resource restrictions are associated with a user identifier. A resource restriction agent receives operating system calls related for resources and provides resource request data to a resource agent. The resource agent determines whether the resource is restricted based on the resource request data and resource restriction data and generates access data based on the determination. The resource restriction agent grants or denies the system call based on the access data.
-
公开(公告)号：US09400688B2
公开(公告)日：2016-07-26
申请号：US14491970
申请日：2014-09-19
Applicant: Apple Inc.
Inventor： Jussi-Pekka Mantere, III , Alexander Tony Maluta , John William Scalo , Eugene Ray Tyacke , Bruce Gaya , Michael John Smith , Peter Kiehtreiber , Simon P. Cooper
CPC classification number: G06F9/5005 , G06F9/54 , G06F21/44 , G06F21/602 , H04L63/104
Abstract: Resource restrictions are associated with a user identifier. A resource restriction agent receives operating system calls related for resources and provides resource request data to a resource agent. The resource agent determines whether the resource is restricted based on the resource request data and resource restriction data and generates access data based on the determination. The resource restriction agent grants or denies the system call based on the access data.
-
-
-
-
-
-
-
-
-
Search Results
22
records
(took 0.018 seconds)
