Abstract: A computer-implemented method for updating system-level services within read-only system images may include (1) executing, during initialization of a mobile computing device, an update service stored within a read-only system image located on the mobile computing device, (2) identifying, via the update service, a writable partition located on the mobile computing device, (3) identifying, via the update service, a digitally signed update within the writable partition for at least one system-level service stored within the read-only system image, and (4) executing, via the update service, the digitally signed update within the writable partition instead of the system-level service stored within the read-only system image. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method for verifying an Executable and Linking File (ELF) object, that includes receiving a request for an ELF object from a client, obtaining the ELF object, determining whether a signature associated with the ELF object is valid, determining whether a usage restriction is associated with the ELF object, if the signature is valid, and restricting access to the ELF object, if the usage restriction is associated with the ELF object.

Abstract: A method for processing a request for a cryptographic function that includes calling into a user-level encryption framework to process the request, wherein calling into the encryption framework comprises sending the request from a user-level application, and processing the request and returning a result to the user-level application, wherein processing the request includes selecting a user-level cryptographic provider from available user-level providers and processing the request using the user-level cryptographic provider selected from the available user-level providers, if the request comprises a metaslot provider request, and selecting the user-level cryptographic provider specified in the request and processing the request using the specified user-level cryptographic provider, if the request is not the metaslot provider request.

Abstract: A mechanism is disclosed for allowing an application to perform specified operations in response to occurrences of a specified event relative to a specified Smart Card-accessing device. A customized API is exposed to the application. The application invokes an “addEventListener” method of the API. The invocation of the method specifies, as parameters of the method, at least a Smart Card-accessing device, a type of event, and a function. The server computer executing the application detects the invocation of the “addEventListener” method. In response to detecting the invocation, the server determines the type of the event specified by the invocation, and starts a mechanism that executes the specified function each time that an event of the specified type occurs relative to the specified Smart Card-accessing device. Consequently, the application does not need to be programmed to poll the specified Smart Card-accessing device at specific times during the application's execution.

Abstract: A method for installing an image on a client including obtaining a wanboot binary from the boot server, determining whether the wanboot binary is valid, obtaining a security payload from the boot server using the wanboot binary if the wanboot binary is valid, establishing a first secure connection between the client and boot server, obtaining a boot file system from the boot server using the first secure connection, installing the boot file system on the client to obtain a kernel, establishing a second secure connection between the client and an installation server using the security payload and the kernel, obtaining an installation image from the installation server using the kernel and the second secure connection, and installing the installation image on the client.

Abstract: A method for installing an image on a client including obtaining a wanboot binary from the boot server, determining whether the wanboot binary is valid, obtaining a security payload from the boot server using the wanboot binary if the wanboot binary is valid, establishing a first secure connection between the client and boot server, obtaining a boot file system from the boot server using the first secure connection, installing the boot file system on the client to obtain a kernel, establishing a second secure connection between the client and an installation server using the security payload and the kernel, obtaining an installation image from the installation server using the kernel and the second secure connection, and installing the installation image on the client.