Patent ID: 7137004

Claim:
A method implemented at least in part by a computing device, the method comprising: obtaining a manifest that describes what types of binaries can be loaded into a process space for a trusted application, the manifest comprising: a first portion including data representing a unique identifier of the trusted application; a second portion including data indicating whether a particular one or more binaries can be loaded into the process space for the trusted application; a third portion derived from the data in both the first portion and the second portion by generating a digital signature over the first and second portions; and a fourth portion that includes data representing a list of one or more export statements that allow a secret associated with the trusted application to be exported to another trusted application; wherein each of the one or more export statements comprises: an identifier of the manifest; an identifier of another manifest that corresponds to the trusted application to which the secret is to be exported; and a digital signature over both the identifier of the manifest and the identifier of the other manifest; and using the manifest to control loading of binaries into the process space for the trusted application.