Patent ID: 7882352
Filing Date: 2011-02-01
Classification: G06F

Abstract:
1. An apparatus comprising at least one processor and a memory storing installed native executable code, the apparatus further comprising: a plurality of protected resources stored on said apparatus; a plurality of servers; and a trusted computing base having a kernel; wherein access to each said protected resource is provided by a corresponding server; the native executable code is assigned a set of capabilities which define the protected resource(s) on the apparatus which the native executable code can access; said corresponding servers are configured, with the at least one processor, to police access to said protected resource(s) on the basis of the capabilities assigned to the native executable code; the capabilities are stored in a location in the memory that is only accessible to the trusted computing base, wherein prior to install time, the executable code already contains the capabilities it has been granted, and wherein a loader is configured to refuse to load executables not permanently stored in the location in the memory which is only accessible to the trusted computing base; and the kernel is configured, for each client-server communication, to pass the client capabilities to said servers.