Patent ID: 7284107

Claim:
A system for managing at least two different classes of data, wherein at least one of the classes is a class that comprises a cryptographic key, the system comprising: one or more memory management components that create plural heaps, there being different sets of rules regarding use of data on each of the heaps, wherein said plural heaps comprise a first heap, said sets of rules calling for said cryptographic key to be stored on said first heap and further comprising a first rule that data on said first heap not to be transferred out of the system through an output device, said one or more memory management components exposing functions for use by a program, said functions including a first function to create a cryptographic key, said functions being configured to store and/or consume data, said functions further being configured to: (1) determine which of said heaps to store data in based on the nature or intended use of the data, including determining that said cryptographic key created by said first function is to be stored on said first heap; and (2) determine whether a request to transfer an item of data out of the system through said output device is consistent with the rules applicable to the item of data based on which heap the item of data is located on; wherein each of said plural heaps is stored within one or more ranges of memory locations, said ranges being known to said one or more components, wherein said functions determine which of said plural heaps a given datum is located on based on which of the ranges the address of said datum falls into; and wherein said functions take one or more measures to prevent violation of the rules applicable to each of the heaps, said one or more measure comprising one or more of: raising an alarm, rendering a warning message, and refusing to perform said requested use of data.