Securing data across execution contexts

1. A method for securing data across execution contexts in a computing device, the method comprising:

running, by the computing device, first code in a first execution context, code running in the first execution context having access to a first set of resources of the computing device;

running, by the computing device, second code in a second execution context, code running in the second execution context having access to a second set of resources of the computing device, wherein the first set of resources is different than the second set of resources;

determining that first data is to be passed from the first code in the first execution context to the second code in the second execution context;

based on determining that the first data is to be passed, tokenizing the first data using a first tokenization method comprising a first homomorphic encryption scheme to generate tokenized first data, wherein tokenizing the first data comprises substituting the first data with second data that is based on the first data to secure the first data from the second code, the second data being the tokenized first data;

passing the tokenized first data from the first code to the second code;

modifying, by the second code, the tokenized first data to generate modified tokenized first data;

determining the modified tokenized first data is to be passed from the second code in the second execution context to the first code in the first execution context;

based on determining the modified tokenized first data is to be passed, de-tokenizing the modified tokenized first data to at least in part generate third data; and

passing the third data from the second code to the first code.

2. The method of claim 1 , wherein the first tokenization method used to tokenize the first data is selected from a plurality of tokenization methods based on one or more of a type of the first data or a destination of the first data, the destination being the second code.

3. The method of claim 2 , wherein the first tokenization method is selected based on a computation to be performed on the first data by the second code.

4. The method of claim 1 , wherein based on determining that the first data is to be passed, tokenizing the first data comprises:

based on determining that the first data is to be passed and based on determining the first data is one or more of: of a type of data requiring tokenization, associated with a security policy requiring tokenization, stored at a location requiring tokenization, associated with a source of data requiring tokenization, or has a content requiring tokenization, tokenizing the first data.

5. The method of claim 1 , wherein:

the third data is further generated based on tokenizing, using a second tokenization method, the de-tokenized modified tokenized first data.

6. A computing device comprising:

a memory; and

a processor coupled to the memory, the processor and memory being configured to:

run first code in a first execution context, code running in the first execution context having access to a first set of resources of the computing device;

run second code in a second execution context, code running in the second execution context having access to a second set of resources of the computing device, wherein the first set of resources is different than the second set of resources;

determine that first data is to be passed from the first code in the first execution context to the second code in the second execution context;

based on determining that the first data is to be passed, tokenize the first data using a first tokenization method comprising a first homomorphic encryption scheme to generate tokenized first data, wherein tokenizing the first data comprises substituting the first data with second data that is based on the first data to secure the first data from the second code, the second data being the tokenized first data;

pass the tokenized first data from the first code to the second code;

modify, by the second code, the tokenized first data to generate modified tokenized first data;

determine the modified tokenized first data is to be passed from the second code in the second execution context to the first code in the first execution context;

based on determining the modified tokenized first data is to be passed, de-tokenize the modified tokenized first data to at least in part generate third data; and

pass the third data from the second code to the first code.

7. The computing device of claim 6 , wherein the first tokenization method used to tokenize the first data is selected from a plurality of tokenization methods based on one or more of a type of the first data or a destination of the first data, the destination being the second code.

8. The computing device of claim 7 , wherein the first tokenization method is selected based on a computation to be performed on the first data by the second code.

9. The computing device of claim 6 , wherein based on determining that the first data is to be passed, tokenizing the first data comprises:

based on determining that the first data is to be passed and based on determining the first data is one or more of: of a type of data requiring tokenization, associated with a security policy requiring tokenization, stored at a location requiring tokenization, associated with a source of data requiring tokenization, or has a content requiring tokenization, tokenizing the first data.

10. The computing device of claim 6 , wherein:

the third data is further generated based on tokenizing, using a second tokenization method, the de-tokenized modified tokenized first data.

11. A non-transitory computer readable medium storing instructions that when executed by a computing device cause the computing device to perform a method for securing data across execution contexts in the computing device, the method comprising:

running, by the computing device, first code in a first execution context, code running in the first execution context having access to a first set of resources of the computing device;

running, by the computing device, second code in a second execution context, code running in the second execution context having access to a second set of resources of the computing device, wherein the first set of resources is different than the second set of resources;

determining that first data is to be passed from the first code in the first execution context to the second code in the second execution context;

based on determining that the first data is to be passed, tokenizing the first data using a first tokenization method comprising a first homomorphic encryption scheme to generate tokenized first data, wherein tokenizing the first data comprises substituting the first data with second data that is based on the first data to secure the first data from the second code, the second data being the tokenized first data;

passing the tokenized first data from the first code to the second code;

modifying, by the second code, the tokenized first data to generate modified tokenized first data;

determining the modified tokenized first data is to be passed from the second code in the second execution context to the first code in the first execution context;

based on determining the modified tokenized first data is to be passed, de-tokenizing the modified tokenized first data to at least in part generate third data; and

passing the third data from the second code to the first code.

12. The non-transitory computer readable medium of claim 11 , wherein the first tokenization method used to tokenize the first data is selected from a plurality of tokenization methods based on one or more of a type of the first data or a destination of the first data, the destination being the second code.

13. The non-transitory computer readable medium of claim 12 , wherein the first tokenization method is selected based on a computation to be performed on the first data by the second code.

14. The non-transitory computer readable medium of claim 11 , wherein based on determining that the first data is to be passed, tokenizing the first data comprises:

based on determining that the first data is to be passed and based on determining the first data is one or more of: of a type of data requiring tokenization, associated with a security policy requiring tokenization, stored at a location requiring tokenization, associated with a source of data requiring tokenization, or has a content requiring tokenization, tokenizing the first data.

15. The non-transitory computer readable medium of claim 11 , wherein:

the third data is further generated based on tokenizing, using a second tokenization method, the de-tokenized modified tokenized first data.