Device, system, and method for secure supervisor system calls

1. A method for processing a request for allocation of a resource of an electronic device, comprising:

at a hypervisor of the electronic device:

(a) receiving a call from a first application of the electronic device, the call indicating the request for allocation of the resource of the electronic device;

(b) determining whether the first application is authorized to receive the resource of the electronic device by:

determining whether the call includes a signature, wherein the signature is received by the first application from a second application, and

when the call includes the signature, determining whether the signature is valid based upon a predetermined signature operation, wherein the predetermined signature operation is provided to the second application when the second application has been indicated as trusted, wherein the second application has been indicated as trusted based upon at least one of an installation procedure and a manual indication;

when the call does not include the signature, determining an identity of the first application and the second application, wherein the call includes the identity of the first application and the second application; and

determining whether the identity of the first application and the second application corresponds to an authorized application;

(c) processing the request for the allocation of the resource when the first application is determined by step (b) to be authorized.

2. The method of claim 1 , further comprising:

(d) rejecting the request when the first application is determined by step (b) to not be authorized.

3. The method of claim 1 , wherein the predetermined signature operation uses one of a hash-based message authentication code (HMAC) and a RSA.

4. The method of claim 1 , wherein the signature is included in each part of a chain of requests.

5. The method of claim 1 , wherein the second application is a supervisory application.

6. The method of claim 1 , wherein the resource is a memory of the electronic device.

7. An electronic device, comprising:

a memory including regions that are allocated for use by one or more applications; and

a processor configured to execute a hypervisor, wherein the hypervisor manages execution of a virtual machine, the hypervisor configured to:

receive a call from a first application of the virtual machine, the call including a signature and indicating a request for an allocation of a resource of the electronic device, wherein the signature is received by the first application from a second application,

determine whether the first application is authorized to receive the resource of the electronic device by determining whether the signature is based upon a predetermined signature operation, wherein the predetermined signature operation is provided to the second application when the second application has been indicated as trusted, wherein the second application has been indicated as trusted based upon at least one of an installation procedure and a manual indication,

when the first application is determined to be authorized, process the request for the allocation of the resource, and

when the call does not include the signature, determine an identity of the first application and the second application, wherein the call includes the identity of the first application and the second application and determine whether the identity of the first application and the second application corresponds to an authorized application.

8. The electronic device of claim 7 , wherein the hypervisor rejects the request when the first application is determined to not be authorized.

9. The electronic device of claim 7 , wherein the predetermined signature operation uses one of a hash-based message authentication code (HMAC) and a RSA.

10. The electronic device of claim 7 , wherein the signature is included in each part of a chain of requests.

11. The electronic device of claim 7 , wherein the second application is a supervisory application.

12. A non-transitory computer readable storage medium with an executable program stored thereon, wherein the program instructs a microprocessor to perform operations comprising:

at a hypervisor of the microprocessor:

(a) receiving a call from a first application of an electronic device, the call indicating a request for an allocation of a resource of the electronic device;

(b) determining whether the first application is authorized to receive the resource of the electronic device by:

determining whether the call includes a signature, wherein the signature is received by the first application from a second application, and

when the call includes the signature, determining whether the signature is valid based upon a predetermined signature operation, wherein the predetermined signature operation is provided to the second application when the second application has been indicated as trusted, wherein the second application has been indicated as trusted based upon at least one of an installation procedure and a manual indication;

when the call does not include the signature, determining an identity of the first application and the second application, wherein the call includes the identity of the first application and the second application; and

determining whether the identity of the first application and the second application corresponds to an authorized application;

(c) processing the request for the allocation of the resource when the first application is determined to be authorized.