Qualcomm Incorporated

Brian Kelley

Ramesh Chandrasekhar

Robert G Walker

Laurence Geoffrey Lundblade

Matthew W Hohlfeld

Kenneth M Geib

Fatih Ulupinar

Punyaslok Purkayastha

Azzedine Touzni

Yinian Mao

Ivan Hugh McLean

Thomas Zeng

Mahesh Moorthy

Jason Miller

Tianyu D'Amore

Marc Edward Nijdam

Srinivas Patwari

Sudheer Koganti

Zhihong Qin

Kristopher Scott Urquhart

Ivan H Mclean

Exemplary features pertain to establishing an Exclusive Execution Environment domain that Trusted Execution Zone components are forbidden to access. In one example, a system-on-a-chip (SoC) is equipped with a Reduced Instruction Set Computing (RISC) processor along with an application DSP (ADSP) and/or Graphics Processing Unit (GPU), where the ADSP and/or GPU is configured to provide and enforce the Exclusive Execution Environment domain. By forbidding access to Trusted Execution Zone components, security can be enhanced, especially within minimally-equipped devices that do not have the resources to implement a full Trust Execution Environment, such as low-power devices associated with the Internet of Things (IoT). Among other features, the systems and methods described herein allow application clients to build exclusive execution environments and claim exclusive access to buffer objects and hardware resource groups. Method and apparatus examples are provided.

Exclusive execution environment within a system-on-a-chip computing system

Disclosed is a method for generating a privilege-based key using a computer. In the method, a privilege is received from an application, and verified as being associated with the application. The computer cryptographically generates a second key using a first key and the privilege. The second key is provided to the application.

Method and apparatus for generating a privilege-based key

According to some aspects, a transport accelerator of a client device may generate a chunk request that is derived from a fragment request and that has transport acceleration metadata. The transport acceleration metadata may indicate that the request is from a transport accelerator and/or indicate a fragment associated with the fragment request. The transport accelerator may receive a signal to cancel one or more chunk requests and/or wait to receive a full fragment. A client application of the client device may generate the signal upon receipt of an HTTP response from a server that complies with a handshaking procedure.

Transport accelerator systems and methods

Methods, apparatus, systems, and computer program products are provided for wirelessly synchronizing datasets that are stored on a wireless device and at a network device, such as a network server or database. Present aspects provide for a simplified and efficient synchronization process, whereby synchronization can be completed in a single round-trip of wireless communication between the wireless device and the network device. Single round-trip synchronization provides for less use of network resources, shorter overall synchronization cycle times and lessens the likelihood of wireless network failures, such as call drops or the like, causing the synchronization process to fail. Additionally, simplification and efficiency are further realized by creating a synchronization process that allows the network dataset to be independent of the wireless device datasets, i.e., the network server does not require a full change history nor is the network server required to know the wireless device dataset version.

Methods and apparatus for dataset synchronization in a wireless environment

Devices and methods use digital certificates and digital signatures to enable computing devices, such as mobile devices, to trust a server attempting to access a resource on the computing device. The server may present the computing device with a digital certificate issued by a trusted third party which includes information so that the computing device can determine which resources the server should be trusted to access. The computing device can determine that the digital certificate was issued by a trusted third party by examining the chain of digital certificates that may link the server with an inherently trusted authority.

Method and apparatus to create a secure web-browsing environment with privilege signing

A server for automatically installing a required application responsive to a client device is described. The server comprises an interface agent arranged to receive a first signal from a client wireless device where the first signal comprises an identifier. A retrieval application is arranged to obtain an executable application corresponding to the identifier and an installer application is arranged to install the executable application responsive to the retrieval application obtaining the executable application. The interface agent is arranged to cause execution of the installed executable application.

Apparatus and methods for client-driven server-side installation

Methods and devices provide for creating, managing, modifying, and/or enforcing flexible digital rights management license policies for protecting games, media, data, or other software with a time-based license. Embodiments are especially directed toward situations in which a source of time is unavailable, untrustworthy, or unreliable. Licenses are defined by a small number of parameters. Parameter values may be defined by and included with protected content or applications. The parameter values may be chosen to define and enforce a desired level of compromise between usability and security characteristics.

Method and apparatus for managing policies for time-based licenses on mobile devices

A method and system reuse data logs generated from testing of programmable devices in order to provide an input file of parameter values and settings for use in automatically configuring a device simulator. The programmable device testing process generates a data log output with data formatted so that parameter data are associated with unique variable labels. The data log output file is processed in a parser operation that filters out private and unnecessary information, organizes the data and generates a simulation input file in a format compatible with the simulator. The process can be fully automated.

Device test data reuse for device simulation

Methods, apparatus, systems, and computer program products for invoking remote process calls and facilitating inter-process communications in a protected memory system employ a kernel that supports remote invocation of objects by a system call. The system call may include an object identifier and a set of pointers to input and output buffers. The kernel locates the specified object in a separate server process domain and awakens a server thread within the server domain to invoke the object. Using provided memory pointers, the kernel can copy input and output data across the protection domains in a single step without the need for copying data into an intermediate buffer. This eliminates the overhead of multiple data copy steps that are required in conventional protected memory systems.

Methods, systems, and apparatus for object invocation across protection domain boundaries

Described are techniques and mechanisms for enforcing trust between an application and a library loaded by the application. Very generally stated, the application declares one or more trusted code groups ('TCGs') of which a library must be a member to be authorized for execution with the application. Libraries that are authorized to assert membership in one or more TCGs include a secure indicator of that membership. As the application executes and attempts to load a library, that libraries membership in a TCG authorized by the application is verified prior to loading the library.

Trusted code groups

A system for processing user interface actions generated from a user interface device, including generating a freshness status for the user interface action. The freshness status indicates a freshness state associated with the user interface action. The freshness status is associated wit the user interface action.

User interface action processing using a freshness status

System for selectively enabling operating modes of a device. The system includes a method for selectively enabling operating modes of a device during a device initialization, wherein the operating modes comprise a privileged mode and a non-privileged mode. The method includes determining during the device initialization whether the device is to operate in the privileged mode or in both the privileged and non-privileged modes, and enabling the privileged mode if it is determined that the device is to operate only in the privileged mode. The method also includes enabling both the privileged and the non-privileged modes if it is determined that the device is to operate in both the privileged and the non-privileged modes.

System for selectively enabling operating modes of a device

A system for saving application state history information, containing an historical snap-shot of dynamic application state information associated with execution of a first application on a computing device. The application state history information is saved for use in a subsequent re-launch of the first application.

Method, software and apparatus for using application state history information when re-launching applications

System for dynamic arbitration of a shared resource on a device. A method is provided for arbitrating the allocation of a device resource on a device. The method comprises receiving a request from a requesting application that requests allocation of the device resource, and determining that the device resource is owned by an owning application. The method also comprises associating owner information with requester information to form an arbitration request, wherein the owner information comprises information about the owning application and the requester information comprises information about the requesting application. The method also comprises arbitrating the arbitration request to produce an arbitration decision that indicates whether or not the device resource should be allocated to the requesting application, and allocating the device resource based on the arbitration decision.

Resource allocation among multiple applications based on an arbitration method for determining device priority

Methods and apparatuses are provided for dynamic registration of privileged mode hooks in a device that can operate in a privileged mode and a non-privileged mode. A data structure is provided which maps between identifiers and functions. An available slot in the data structure is used to store a pointer associated with a function. The identifier can then be made accessible to non-privileged applications.

Growing community of inventors

San Diego, CA, United States of America

Brian Kelley