-
公开(公告)号：US11188638B2
公开(公告)日：2021-11-30
申请号：US16409654
申请日：2019-05-10
Applicant: Apple Inc.
Inventor： Jacques A. Vidrine , Nicholas C. Allegra , Simon P. Cooper , Gregory D. Hughes
Abstract: A data processing system can use a method of fine-grained address space layout randomization to mitigate the system's vulnerability to return oriented programming security exploits. The randomization can occur at the sub-segment level by randomizing clumps of virtual memory pages. The randomized virtual memory can be presented to processes executing on the system. The mapping between memory spaces can be obfuscated using several obfuscation techniques to prevent the reverse engineering of the shuffled virtual memory mapping.
-
公开(公告)号：US10521592B2
公开(公告)日：2019-12-31
申请号：US15490838
申请日：2017-04-18
Applicant: Apple Inc.
Inventor： Simon P. Cooper , Julien Oster , Robert J. Kendall-Kuppe , Christopher S. Linn , Jonathan Grynspan , Keith Stattenfield
Abstract: In one embodiment, a software application that is downloaded from an untrusted source is marked, based on the untrusted classification of the source, to be translocated when the software application is launched. When the software application is launched it is translocated, through a mirroring file system, to a random mount point that is a partial bind mount to the real file system that stores the image of the software application (e.g. the image of the software application's bundle).
-
公开(公告)号：US10410003B2
公开(公告)日：2019-09-10
申请号：US13913059
申请日：2013-06-07
Applicant: Apple Inc.
Inventor： Kelly B. Yancey , Jacques Anthony Vidrine , Eric Olaf Carlson , Paul William Chinn , Simon P. Cooper
Abstract: The disclosed technology addresses the need in the art for assigning multiple containers to a single application. A container can be a specified area of a file system that an assigned application can access to store data, while other applications are restricted access to the container. In some instances, it may be beneficial for multiple applications to share some data, while still maintaining other data in a secure location, thus an application can be assigned to multiple containers, a personal container that can only be accessed by the application, and a shared container that can be accessed by multiple applications. Further, an application can be assigned an alternate container, in addition to the personal container. The alternate container can be used when an alternate user is using the client device, thus restricting the alternate user from accessing any sensitive data stored in the personal container.
-
14.发明授权公开(公告)号：US10311227B2
公开(公告)日：2019-06-04
申请号：US14503195
申请日：2014-09-30
Applicant: Apple Inc.
Inventor： Gregory D. Hughes , Simon P. Cooper , Jacques A. Vidrine , Nicholas C. Allegra
Abstract: A data processing system can use a method of fine-grained address space layout randomization to mitigate the system's vulnerability to return oriented programming security exploits. The randomization can occur at the sub-segment level by randomizing clumps of virtual memory pages. The randomized virtual memory can be presented to processes executing on the system. The mapping between memory spaces can be obfuscated using several obfuscation techniques to prevent the reverse engineering of the shuffled virtual memory mapping.
-
公开(公告)号：US09811381B2
公开(公告)日：2017-11-07
申请号：US15219052
申请日：2016-07-25
Applicant: Apple Inc.
Inventor： Jussi-Pekka Mantere, III , Alexander Tony Maluta , John William Scalo , Eugene Ray Tyacke , Bruce Gaya , Michael John Smith , Peter Kiehtreiber , Simon P. Cooper
CPC classification number: G06F9/5005 , G06F9/54 , G06F21/44 , G06F21/602 , H04L63/104
Abstract: Resource restrictions are associated with a user identifier. A resource restriction agent receives operating system calls related for resources and provides resource request data to a resource agent. The resource agent determines whether the resource is restricted based on the resource request data and resource restriction data and generates access data based on the determination. The resource restriction agent grants or denies the system call based on the access data.
-
Patent Agency Ranking
公开(公告)号：US20170316211A1
公开(公告)日：2017-11-02
申请号：US15490838
申请日：2017-04-18
Applicant: Apple Inc.
Inventor： Simon P. Cooper , Julien Oster , Robert J. Kendall-Kuppe , Christopher S. Linn , Jonathan Grynspan , Keith Stattenfield
Abstract: In one embodiment, a software application that is downloaded from an untrusted source is marked, based on the untrusted classification of the source, to be translocated when the software application is launched. When the software application is launched it is translocated, through a mirroring file system, to a random mount point that is a partial bind mount to the real file system that stores the image of the software application (e.g. the image of the software application's bundle).
-
公开(公告)号：US20170083370A1
公开(公告)日：2017-03-23
申请号：US15219052
申请日：2016-07-25
Applicant: Apple Inc.
Inventor： Jussi-Pekka Mantere, III , Alexander Tony Maluta , John William Scalo , Eugene Ray Tyacke , Bruce Gaya , Michael John Smith , Peter Kiehtreiber , Simon P. Cooper
CPC classification number: G06F9/5005 , G06F9/54 , G06F21/44 , G06F21/602 , H04L63/104
Abstract: Resource restrictions are associated with a user identifier. A resource restriction agent receives operating system calls related for resources and provides resource request data to a resource agent. The resource agent determines whether the resource is restricted based on the resource request data and resource restriction data and generates access data based on the determination. The resource restriction agent grants or denies the system call based on the access data.
-
公开(公告)号：US09400688B2
公开(公告)日：2016-07-26
申请号：US14491970
申请日：2014-09-19
Applicant: Apple Inc.
Inventor： Jussi-Pekka Mantere, III , Alexander Tony Maluta , John William Scalo , Eugene Ray Tyacke , Bruce Gaya , Michael John Smith , Peter Kiehtreiber , Simon P. Cooper
CPC classification number: G06F9/5005 , G06F9/54 , G06F21/44 , G06F21/602 , H04L63/104
Abstract: Resource restrictions are associated with a user identifier. A resource restriction agent receives operating system calls related for resources and provides resource request data to a resource agent. The resource agent determines whether the resource is restricted based on the resource request data and resource restriction data and generates access data based on the determination. The resource restriction agent grants or denies the system call based on the access data.
-
公开(公告)号：US20160092674A1
公开(公告)日：2016-03-31
申请号：US14503195
申请日：2014-09-30
Applicant: Apple Inc.
Inventor： Gregory D. Hughes , Simon P. Cooper , Jacques A. Vidrine , Nicholas C. Allegra
CPC classification number: G06F21/52 , G06F21/53 , G06F2221/033
Abstract: A data processing system can use a method of fine-grained address space layout randomization to mitigate the system's vulnerability to return oriented programming security exploits. The randomization can occur at the sub-segment level by randomizing clumps of virtual memory pages. The randomized virtual memory can be presented to processes executing on the system. The mapping between memory spaces can be obfuscated using several obfuscation techniques to prevent the reverse engineering of the shuffled virtual memory mapping.
Abstract translation: 数据处理系统可以使用细粒度的地址空间布局随机化方法来减轻系统的漏洞，从而导致面向对象的编程安全漏洞。 随机化可以通过随机分组虚拟内存页面在子分段级别进行。 随机虚拟内存可以呈现给在系统上执行的进程。 可以使用几种混淆技术来模糊存储空间之间的映射，以防止混洗的虚拟内存映射的反向工程。
-
公开(公告)号：US08874905B2
公开(公告)日：2014-10-28
申请号：US13729014
申请日：2012-12-27
Applicant: Apple Inc.
Inventor： Jussi-Pekka Mantere, III , Alexander Tony Maluta , John William Scalo , Eugene Ray Tyacke , Bruce Gaya , Michael John Smith , Peter Kiehtreiber , Simon P. Cooper
CPC classification number: G06F9/5005 , G06F9/54 , G06F21/44 , G06F21/602 , H04L63/104
Abstract: Resource restrictions are associated with a user identifier. A resource restriction agent receives operating system calls related for resources and provides resource request data to a resource agent. The resource agent determines whether the resource is restricted based on the resource request data and resource restriction data and generates access data based on the determination. The resource restriction agent grants or denies the system call based on the access data.
Abstract translation: 资源限制与用户标识符相关联。 资源限制代理接收与资源相关的操作系统调用，并向资源代理提供资源请求数据。 资源代理基于资源请求数据和资源限制数据确定资源是否被限制，并且基于该确定生成访问数据。 资源限制代理根据访问数据授予或拒绝系统调用。
-
-
-
-
-
-
-
-
-
Search Results
20
records
(took 0.028 seconds)
