Systems and methods for provisioning and using multiple trusted security zones on an electronic device

• US 9,811,672 B2
• Filed: 09/15/2015
• Issued: 11/07/2017
• Est. Priority Date: 08/10/2012
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Bye, Stephen J., Paczkowski, Lyle W., Parsel, William M., Persson, Carl J., Schlesener, Matthew C., Shipley, Trevor D.
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Torres-Diaz, Lizbeth
• Application Number:
  US14/855,364
• Publication Number:
  US 20160004876A1
• Time in Patent Office: 784 Days
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode

Abstract

A method of provisioning a subordinate trusted security zone in a processor having a trusted security zone. The method comprises receiving by a master trusted application executing in a master trusted security zone of the processor a request to provision a subordinate trusted security zone in the processor, wherein the request comprises a master trusted security zone key, wherein the request designates the subordinate trusted security zone, and wherein the request defines an independent key. The method further comprises provisioning by the master trusted application the subordinate trusted security zone to be accessible based on the independent key.

Claims

1. A method of changing the memory size of a subordinate trusted security zone in a processor having a trusted security zone, comprising:

transmitting an indication of memory utilized by a first subordinate trusted security zone of the processor to a master trusted application executing in a master trusted security zone of the processor;

determining an average memory utilized by the first subordinate trusted security zone based on the indication of memory utilized by the first subordinate trusted security zone;

receiving, by the master trusted application from a second subordinate trusted security zone of the processor, a request to increase the memory size of the second subordinate trusted security zone of the processor, wherein the master trusted application is mediating transfer of memory resources to the first subordinate trusted security zone and the second subordinate trusted security zone without accessing or monitoring either of the first subordinate trusted security zone and the second subordinate trusted security zone, and wherein the master trusted application has no visibility into a first memory space associated with the first subordinate trusted security zone and has no visibility into the processing of a first trusted application that executes in the first subordinate trusted security zone;

in response to receiving the request from the second subordinate trusted security zone, reducing, by the master trusted application, the memory size of the first subordinate trusted security zone based at least in part on the indication of memory utilized by the first subordinate trusted security zone and the average memory utilized by the first subordinate trusted security zone; and

increasing, by the master trusted application, the memory size of the second subordinate trusted security zone.

2. The method of claim 1, wherein the indication of memory utilized by the first subordinate trusted security zone is transmitted when the first trusted subordinate trusted security zone discontinues executing.

3. The method of claim 1, wherein the average memory utilized by the first subordinate trusted security zone is determined based on a predefined number of the most recently transmitted indications of memory utilized by the first subordinate trusted security zone.

4. The method of claim 1, further comprising determining a maximum quantity of memory utilized by the first subordinate trusted security zone based on the indication of memory utilized by the first subordinate trusted security zone, wherein reducing the memory size of the first subordinate trusted security zone is further based on the maximum quantity of memory utilized by the first subordinate trusted security zone.

5. The method of claim 1, further comprising reducing the memory size of a third subordinate trusted security zone of the processor based at least in part on one of an average memory utilization of the third subordinate trusted security zone or a maximum memory utilization of the third subordinate trusted security zone determined from an indication of memory utilized by the third subordinate trusted security zone.

6. The method of claim 1, wherein reducing the memory size of the first subordinate trusted security zone is further based on a daily schedule associated with a mobile device that comprises the processor having the trusted security zone.

7. The method of claim 1, wherein the trusted security zone comprises at least four subordinate trusted security zones.

8. The method of claim 1, further comprising installing, via the master trusted application executing in the master trusted security zone, a first trusted application in the first subordinate trusted security zone.

9. The method of claim 8, further comprising disabling execution of the master trusted security zone and any other subordinate trusted security zones while a first trusted application in the first subordinate trusted security zone is executing.

10. The method of claim 1, wherein an independent key corresponds to only one of the first subordinate trusted security zone or the second subordinate trusted security zone.