公开(公告)号：US10454679B2

公开(公告)日：2019-10-22

申请号：US15274706

申请日：2016-09-23

Applicant: Apple Inc.

Inventor： Eric B. Tamura ,  Dominic B. Giampaolo ,  Kelly B. Yancey

IPC: H04L9/16 ,  G06F21/60 ,  G06F21/62 ,  G06F16/16 ,  H04L9/08

Abstract: This application sets forth a key rolling technique for a file system of a computing device. The key rolling technique allows for files to be transparently re-encrypted in a background process while still allowing applications to access the files being re-encrypted. During re-encryption, at least one file extent of a file is decrypted using a current key for the file extent and re-encrypted using a new key for the file extent. Moreover, the file extent can be relocated to another location in memory during re-encryption to enhance accessibility and crash protection features. Metadata associated with the file can be updated to include information pertaining to both the location of the re-encrypted file extent as well as the new key that can be used to decrypt the re-encrypted file extent. In this manner, the metadata can be used to properly construct a complete file when the file needs to be accessed.

公开(公告)号：US10216928B2

公开(公告)日：2019-02-26

申请号：US15663432

申请日：2017-07-28

Applicant: Apple Inc.

Inventor： Pierre-Olivier J. Martel ,  Kelly B. Yancey ,  Richard L. Hagy

IPC: G06F17/00 ,  H04L29/06 ,  G06F21/53 ,  G06F21/62

Abstract: In response to a request for launching an application within an operating system of a data processing system, one or more extended entitlements are extracted from the application, where the one or more extended entitlements specify one or more resources the application is entitled to access. One or more security profile extensions corresponding to the one or more extended entitlements are dynamically generated. A security profile specifically for the application is created based on the one or more security profile extensions and a base security profile that has been previously compiled, where the base security profile specifies a list of a plurality of base resources. The application is then launched in a sandboxed operating environment that is configured based on the security profile specifically generated for the application.

公开(公告)号：US20170053113A1

公开(公告)日：2017-02-23

申请号：US15162449

申请日：2016-05-23

Applicant: Apple Inc.

Inventor： Pierre-Olivier J. Martel ,  Kelly B. Yancey ,  Richard L. Hagy

IPC: G06F21/53 ,  G06F21/62

CPC classification number: G06F21/53 ,  G06F21/6218 ,  G06F2221/03 ,  G06F2221/034

Abstract: In response to a request for launching an application within an operating system of a data processing system, one or more extended entitlements are extracted from the application, where the one or more extended entitlements specify one or more resources the application is entitled to access. One or more security profile extensions corresponding to the one or more extended entitlements are dynamically generated. A security profile specifically for the application is created based on the one or more security profile extensions and a base security profile that has been previously compiled, where the base security profile specifies a list of a plurality of base resources. The application is then launched in a sandboxed operating environment that is configured based on the security profile specifically generated for the application.

Abstract translation: 响应于在数据处理系统的操作系统内启动应用程序的请求，从应用程序中提取一个或多个扩展授权，其中一个或多个扩展授权指定应用程序有权访问的一个或多个资源。 动态地生成与一个或多个扩展授权相对应的一个或多个安全简档扩展。 基于一个或多个安全配置文件扩展和先前已经编译的基本安全配置文件，其中基本安全配置文件指定多个基本资源的列表来创建专用于该应用的安全配置文件。 然后，应用程序将在基于为应用程序专门生成的安全配置文件配置的沙箱操作环境中启动。

公开(公告)号：US20140366157A1

公开(公告)日：2014-12-11

申请号：US13913059

申请日：2013-06-07

Applicant: Apple Inc.

Inventor： Kelly B. Yancey ,  Jacques Anthony Vidrine ,  Eric Olaf Carlson ,  Paul William Chinn ,  Simon P. Cooper

IPC: G06F21/62 ,  G06F21/53

CPC classification number: G06F21/62 ,  G06F21/53 ,  G06F21/6245

Abstract: The disclosed technology addresses the need in the art for assigning multiple containers to a single application. A container can be a specified area of a file system that an assigned application can access to store data, while other applications are restricted access to the container. In some instances, it may be beneficial for multiple applications to share some data, while still maintaining other data in a secure location, thus an application can be assigned to multiple containers, a personal container that can only be accessed by the application, and a shared container that can be accessed by multiple applications. Further, an application can be assigned an alternate container, in addition to the personal container. The alternate container can be used when an alternate user is using the client device, thus restricting the alternate user from accessing any sensitive data stored in the personal container.

Abstract translation: 所公开的技术解决了本领域对单个应用分配多个容器的需要。 容器可以是分配的应用程序可以访问以存储数据的文件系统的指定区域，而其他应用程序被限制访问容器。 在某些情况下，多个应用程序共享一些数据可能是有益的，同时仍然将其他数据保持在安全位置，因此应用程序可以分配给多个容器，只能由应用程序访问的个人容器，以及 可以由多个应用程序访问的共享容器。 此外，除了个人容器之外，还可以为应用分配备用容器。 当替代用户使用客户端设备时，可以使用备用容器，从而限制备用用户访问存储在个人容器中的任何敏感数据。

公开(公告)号：US20180336343A1

公开(公告)日：2018-11-22

申请号：US15952026

申请日：2018-04-12

Applicant: Apple Inc.

Inventor： Kelly B. Yancey ,  Pierre-Olivier J. Martel

IPC: G06F21/53 ,  H04L29/06 ,  G06F21/62

CPC classification number: G06F21/53 ,  G06F21/62 ,  H04L63/145

Abstract: A method and apparatus of a device for security management by sandboxing third-party components is described. The device can determine whether a third-party component supports network access. If the third-party component supports network access, the device can request a user input regarding whether to restrict the network access of the component. The device can receive a user input to restrict network access of the third-party component. Upon receiving the user input to restrict network access, the device can construct a sandbox for the third-party component to restrict network access of the component and prevent the component from performing data exfiltration. Other embodiments are also described and claimed.

公开(公告)号：US09959405B2

公开(公告)日：2018-05-01

申请号：US14483543

申请日：2014-09-11

Applicant: Apple Inc.

Inventor： Kelly B. Yancey ,  Pierre-Olivier J. Martel

IPC: H04L29/06 ,  G06F21/00 ,  G06F21/53 ,  G06F21/62

CPC classification number: G06F21/53 ,  G06F21/62 ,  H04L63/145

Abstract: A method and apparatus of a device for security management by sandboxing third-party components is described. The device can determine whether a third-party component supports network access. If the third-party component supports network access, the device can request a user input regarding whether to restrict the network access of the component. The device can receive a user input to restrict network access of the third-party component. Upon receiving the user input to restrict network access, the device can construct a sandbox for the third-party component to restrict network access of the component and prevent the component from performing data exfiltration. Other embodiments are also described and claimed.

公开(公告)号：US09734327B2

公开(公告)日：2017-08-15

申请号：US15162449

申请日：2016-05-23

Applicant: Apple Inc.

Inventor： Pierre-Olivier J Martel ,  Kelly B. Yancey ,  Richard L. Hagy

IPC: G06F17/00 ,  H04L29/06 ,  G06F21/53 ,  G06F21/62

CPC classification number: G06F21/53 ,  G06F21/6218 ,  G06F2221/03 ,  G06F2221/034

Abstract: In response to a request for launching an application within an operating system of a data processing system, one or more extended entitlements are extracted from the application, where the one or more extended entitlements specify one or more resources the application is entitled to access. One or more security profile extensions corresponding to the one or more extended entitlements are dynamically generated. A security profile specifically for the application is created based on the one or more security profile extensions and a base security profile that has been previously compiled, where the base security profile specifies a list of a plurality of base resources. The application is then launched in a sandboxed operating environment that is configured based on the security profile specifically generated for the application.

公开(公告)号：US20170199883A1

公开(公告)日：2017-07-13

申请号：US15273665

申请日：2016-09-22

Applicant: Apple Inc.

Inventor： Andrew S. Terry ,  Kelly B. Yancey ,  Pierre-Olivier J. Martel ,  Richard L. Hagy ,  Timothy P. Hannon ,  Alastair K. Fettes

IPC: G06F17/30

CPC classification number: G06F21/53 ,  G06F21/00

Abstract: Some embodiments provide a method for a device having multiple users. The method identifies a process installed on the device that requires an isolated storage in a file system of the device. For each of a set of the users of the electronic device, the method assigns at least one container for use by the process within a user-specific section of the file system. The containers assigned to the process in a section of the file system specific to a particular user are only accessible by the process when the particular user is logged into the device. The method assigns at least one container for use by the process within a non-user-specific section of the file system. The containers assigned to the process within the non-user-specific section of the file system are accessible by the process irrespective of which user is logged into the device.

公开(公告)号：US09361454B2

公开(公告)日：2016-06-07

申请号：US14292712

申请日：2014-05-30

Applicant: Apple Inc.

Inventor： Pierre-Olivier J. Martel ,  Kelly B. Yancey ,  Richard L. Hagy

IPC: G06F17/00 ,  H04L29/06 ,  G06F21/53

CPC classification number: G06F21/53 ,  G06F21/6218 ,  G06F2221/03 ,  G06F2221/034

Abstract: In response to a request for launching an application within an operating system of a data processing system, one or more extended entitlements are extracted from the application, where the one or more extended entitlements specify one or more resources the application is entitled to access. One or more security profile extensions corresponding to the one or more extended entitlements are dynamically generated. A security profile specifically for the application is created based on the one or more security profile extensions and a base security profile that has been previously compiled, where the base security profile specifies a list of a plurality of base resources. The application is then launched in a sandboxed operating environment that is configured based on the security profile specifically generated for the application.

Abstract translation: 响应于在数据处理系统的操作系统内启动应用程序的请求，从应用程序中提取一个或多个扩展授权，其中一个或多个扩展授权指定应用程序有权访问的一个或多个资源。 动态地生成与一个或多个扩展授权相对应的一个或多个安全简档扩展。 基于一个或多个安全配置文件扩展和先前已经编译的基本安全配置文件，其中基本安全配置文件指定多个基本资源的列表来创建专用于该应用的安全配置文件。 然后，应用程序将在基于为应用程序专门生成的安全配置文件配置的沙箱操作环境中启动。

公开(公告)号：US20150347746A1

公开(公告)日：2015-12-03

申请号：US14292712

申请日：2014-05-30

Applicant: Apple Inc.

Inventor： Pierre-Olivier J. Martel ,  Kelly B. Yancey ,  Richard L. Hagy

IPC: G06F21/53

CPC classification number: G06F21/53 ,  G06F21/6218 ,  G06F2221/03 ,  G06F2221/034

Abstract: In response to a request for launching an application within an operating system of a data processing system, one or more extended entitlements are extracted from the application, where the one or more extended entitlements specify one or more resources the application is entitled to access. One or more security profile extensions corresponding to the one or more extended entitlements are dynamically generated. A security profile specifically for the application is created based on the one or more security profile extensions and a base security profile that has been previously compiled, where the base security profile specifies a list of a plurality of base resources. The application is then launched in a sandboxed operating environment that is configured based on the security profile specifically generated for the application.

Abstract translation: 响应于在数据处理系统的操作系统内启动应用程序的请求，从应用程序中提取一个或多个扩展授权，其中一个或多个扩展授权指定应用程序有权访问的一个或多个资源。 动态地生成与一个或多个扩展授权相对应的一个或多个安全简档扩展。 基于一个或多个安全配置文件扩展和先前已经编译的基本安全配置文件，其中基本安全配置文件指定多个基本资源的列表来创建专用于该应用的安全配置文件。 然后，应用程序将在基于为应用程序专门生成的安全配置文件配置的沙箱操作环境中启动。