Cellsec, Inc.

Intel Corporation

Other

Pulse Secure, LLC

Yoav Weiss

Karl L Ginter

David Moshe Goldschlag

Michael Bartman

Etay Bogner

This invention provides secure, policy-based separation of data and applications on computer, especially personal computers that operate in different environments, such as those including personal applications and corporate applications, so that both types of applications can run simultaneously while complying with all required policies. The invention enables employees to use their personal devices for work purposes, or work devices for personal purposes. The secure, policy-based separation is created by dividing the data processing device into two or more 'domains,' each with its own policies. These policies may be configured by the device owner, an IT department, or other data or application owner.

Dividing a data processing device into separate security domains

Methods, apparatus, systems, and non-transitory computer-readable media for managing a plurality of disparate computer application and data control policies on a computing device, especially a computing device connected to a computer network, are described. In one example, at least one policy distribution point is provided that includes least one policy distribution point including at least one information management policy. A plurality of policy enforcement points, including a first policy enforcement point operating at a first policy enforcement level, and a second enforcement point operating at second policy enforcement level, are also provided. A first policy element to the first policy enforcement point, and a second policy element to the second policy enforcement point, are allocated. A management compartment in computer memory in communication with said computing device including one or more computer applications, data, and metadata specified and controlled by the information management policy is also provided.

Automated multi-level federation and enforcement of information management policies in a device network

This invention creates separation between personal applications and corporate applications on a data processing device, so that both types of applications can run simultaneously while complying with all required policies. This enables employees to use their personal devices for work purposes, or work devices for personal purposes. The separation is created by dividing the data processing device into two or more 'domains', each with its own policies. These policies may be configured by the device owner, an IT department, or other data or application owner.

A method includes assessing a trustworthiness level of a user computer by communication between the user computer and a first server. A record indicating the trustworthiness level is sent from the first server to the user computer, for storage by the user computer. A request is sent from the user computer to a second server, different from the first server, for a service to be provided to the user computer by the second server. The record is provided from the user computer to the second server by communicating between the user computer and the second server. At the second server, the trustworthiness level is extracted from the record, and the requested service is conditionally allowed to be provided to the user computer depending on the extracted trustworthiness level.

Stateless attestation system

A method and device may, in a computing system executing a operating system and having a mass storage device, rewrite the boot sector of the operating system on the storage device to execute a hypervisor operating system in a boot process, copy a file including the hypervisor kernel to a first sub-area on the storage device, copy software components of the hypervisor to a second sub-area on the storage device, boot to execute the hypervisor as an operating system, execute the operating system, retrieve information indicative of absolute mapping of sectors used by the operating system on the storage device, allocate for the sectors on a third sub-area of the mass storage device, perform a second boot to run the hypervisor as a host operating system, and execute the operating system as guest operating system.

Growing community of inventors

Petach Tikva, Israel

Yoav Weiss