System and method for securely allocating a virtualised space

摘要

A method of securely allocating a virtual space to a third party in a memory of a device is described. The memory has both trusted and un-trusted areas. The method includes the steps of receiving a request for a virtual space allocation from a third party and authenticating the third party. The method also includes the steps of determining the existence of a unique virtual space controller for controlling access to a virtual space in an area of the memory, the unique virtual space controller being uniquely associated with the virtual space and requesting the creation of a unique virtual space controller if one does not exist. The unique virtual space controller is located in a trusted area of memory and arranged to enforce a security policy for communication with the virtual space. Finally, the method comprises the step of providing the third party with the security policy for communication with the virtual space.