Architecture for virtual security module
View Patent ↗A device supports the processing of multiple active applications in a processor through a mapping system that securely identifies and differentiates commands issued by clients. An entity selection signal is generated by the mapping system to signal the processor to process an algorithm and provide services for a specific client using the commands identified for that client and data permitted by a client tracking system for that client. Other data accesses and commands identified for other clients are restricted when processing the algorithm.
1. A processing system comprising:
a mapping device to receive a first command issued by a first client and a second command issued by a second client, and to generate a dedicated signal, the dedicated signal being separate from the first command and the second command, to uniquely identify the first command issued by the first client from the second command issued by the second client, the mapping device further to identify the first client based upon an Address Space Identifier (ASID); and
a processing device to receive the first command, the second command, and the dedicated signal, the processing device having access to stored data for the first client and the second client where operations requested through the first command identified by the dedicated signal as being from the first client are restricted to data attached with rights previously assigned to the first client and operations requested through the second command identified by the dedicated signal as being from the second client are restricted to data attached with rights previously assigned to the second client.
2. The processing system of claim 1 wherein the mapping device to receive the first command and the second command issued by the first and the second clients is embedded with the processing device.
3. The processing system of claim 1 wherein the processing system further includes a transceiver to receive over the air signals.
4. The processing system of claim 1 wherein the data attached with rights previously assigned to the first client includes secrets reserved for the first client.
5. A method of supporting multiple active applications in a processor, the method comprising:
identifying first commands issued by a first client from other commands issued by other clients and generating an entity selection signal to identify the first commands issued by the first client, the first client being identified based upon an Address Space Identifier (ASID) and the entity selection signal being separate and distinct from the first commands and the other commands; and
processing an algorithm for the first client using the entity selection signal and the first commands identified for the first client that access data permitted by a client tracking system for the first client while restricting access to data and restricting performing the other commands identified for the other clients when processing the algorithm.
6. The method of claim 5 further including using the entity selection signal to identify the first client before using the first commands in processing the algorithm.
7. The method of claim 5 wherein the processor further includes processing the multiple active applications simultaneously by differentiating the first commands from the other commands and access to data for the first client using the entity selection signal.
8. A device, comprising:
a mapping device to uniquely identify, by an entity selection signal, a first command issued by a client from other commands issued by other clients; and
a tracking system to receive the entity selection signal and link the first command issued from the first client and each of the other commands issued by each of the other clients, respectively, with the entity selection signal, the entity selection signal being configured to restrict performing any commands and restrict access to data in performing operations for applications associated with the client that issued the command, the command being linked to the entity selection signal based upon an Address Space Identifier (ASID).
9. The device of claim 8 wherein the tracking system further enables access to data and commands in accordance with the entity selection signal.
10. The device of claim 8 wherein the tracking system supports the processing of multiple active applications in a processor through a mapping system that identifies and differentiates the first command issued by the client from each of the other commands issued by each of the other clients.
11. The device of claim 8 wherein the tracking system further includes mapping associations between the other clients and secrets to allow multiple clients to simultaneously associate with a same set of secrets.
12. The device of claim 8 where multiple instances of a same program are running under different virtual machines and a single virtual machine is associated with several sets of secrets.
13. A non-transitory computer readable storage medium containing instructions, which when executed by one or more processors cause at least one of the one or more processors to perform operations comprising:
identifying first commands issued by a first client from other commands issued by other clients and generating an entity selection signal to identify the first commands issued by the first client, the first client being identified based upon an Address Space Identifier (ASID) and the entity selection signal being separate and distinct from the first commands and the other commands; and
processing an algorithm for the first client using the entity selection signal and the first commands identified for the first client that access data permitted by a client tracking system for the first client while restricting access to data and restricting performing the other commands identified for the other clients when processing the algorithm.