Trust exception management

• US 8,739,292 B2
• Filed: 12/31/2008
• Issued: 05/27/2014
• Est. Priority Date: 03/04/2008
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Adler, Mitchell D., Brouwer, Michael Lambertus Hubertus, Sauerwald, Conrad
• Primary Examiner(s): CHEUNG, CALVIN K
• Application Number:
  US12/347,691
• Publication Number:
  US 20090228986A1
• Time in Patent Office: 1,973 Days
• Field of Search: 726/5, 726/21, 726/23, 726/27
• US Class Current: 726/26
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2211/009 Trust

Abstract

A machine implemented method includes storing a first data representing a prior exception to a first trust failure (e.g., expired certificate). The prior exception may be stored as part of establishing a first communication with a data processing system (e.g., a handheld device). The first communication may not be trustworthy. The method may determine, as part of establishing a second communication with the data processing system, that a second trust failure has occurred. The second trust failure (e.g., revoked certificate) indicates that the second communication may not be trustworthy. The method may determine whether the prior exception applies to the second trust failure. If the prior exception does not apply, the data processing system determines, automatically, whether to create a new exception for the second trust failure.

Claims

1. A machine implemented method, comprising:

storing, in a memory of a data processing system, a first data representing a first exception to a first trust failure, wherein the first trust failure indicates, prior to establishing a first communication with the data processing system, that the first communication is untrustworthy, and the first exception allows the data processing system to establish the untrustworthy first communication;

determining, by the data processing system and as part of establishing a second communication with the data processing system, that a second trust failure has occurred, the second trust failure indicating that the second communication is untrustworthy; and

creating, automatically by the data processing system, a second exception for the second trust failure in response to determining that the first exception applies to the second trust failure, wherein the second exception allows establishing the untrustworthy second communication.

2. The method as in claim 1, wherein the data processing system determines whether to create the second exception without requiring user interaction to create the second exception.

3. The method as in claim 2, wherein the data processing system determines whether to create the second exception by comparing the first trust failure and the second trust failure, and the comparing comprises comparing a context of the first trust failure and a context of the second trust failure.

4. A machine-readable non-transitory storage medium storing instructions that, when executed by a processor included in a data processing system, cause the data processing system to perform a method of processing data, the method comprising:

storing first data representing a first exception to a first trust failure, the first trust failure indicating, prior to establishing a first communication with the data processing system, that the first communication is untrustworthy, wherein the first exception allows the data processing system to establish the untrustworthy first communication;

determining, as part of establishing a second communication with the data processing system, that a second trust failure has occurred, the second trust failure indicating that the second communication is untrustworthy; and

creating automatically by the data processing system a second exception for the second trust failure in response to determining that the first exception applies to the second trust failure, and wherein the second exception allows establlishing the untrustworthy second communication.

5. The machine-readable non-transitory storage medium of claim 4, wherein the data processing system determines whether to create the second exception without requiring user interaction to create the second exception.

6. The machine readable non transitory storage medium of claim 5, wherein the data processing system determines whether to create the second exception by comparing the first trust failure and the second trust failure, and the comparing comprises comparing a context of the first trust failure and a context of the second trust failure.

7. A data processing system, comprising:

a processor; and

a memory configured to store instructions that when executed by the processor, cause the processor to perform steps that include;

storing first data representing a first exception to a first trust failure, the first trust failure indicating, prior to establishing a first communication with the data processing system, that the first communication is untrustworthy, wherein the first exception allows the data processing system to establish the untrustworthy first communication;

determining, as part of establishing a second communication with the data processing system, that a second trust failure has occurred, the second trust failure indicating that the second communication is untrustworthy; and

creating automatically by the data processing system a second exception for the second trust failure in response to determining that the first exception applies to the second trust failure, and wherein the second exception allows establishing the untrustworthy second communication.

8. The data processing system of claim 7, comprising determining whether to create the second exception without requiring user interaction to create the second exception.

9. The data processing system of claim 7, comprising determining whether to create the second exception by comparing the first trust failure and the second trust failure, and the comparing comprises comparing a context of the first trust failure and a context of the second trust failure.