US 5,852,666 A · Capability security for distributed object systems

Abstract

A system providing capability security for distributed object systems is disclosed. The basic tenet of capability security is that the right to do something to an object (e.g., invoke a particular object's methods) is represented solely by the holding of a reference to that object. In each of the preferred embodiments described herein, an object is presumed to hold legitimately a reference to a particular object only if the object knows some unpublicized (except under the conditions required by capability security) key associated with the particular object. That is, an object's key is required along with the object's reference. So that capability security is preserved when object references are passed between objects in different processes, the object references being passed are encrypted upon transmission and then decrypted upon arrival at their intended destination. This cryptography can be performed by objects or processes using a variety of techniques, including Diffie-Helman or public/private key cryptography. The cryptography performed in the various embodiments ensures that only the intended recipient of the message can decode the object reference and that a misbehaving object cannot convince another object that it possesses a capability it does not have. Some of the disclosed embodiments provide capability security for distributed object systems wherein the objects and processes directly handle inter-object and inter-process communications and message encryption and decryption.

Claims28

Dependent claims

A capability security system for distributed object systems, comprising:

a plurality of objects;
a public and private key associated with each of said objects, said public key constituting the object reference of its associated object;
one of said objects being accessible only to other of said objects that know said one object's public key, said one object's public key being made available to said other objects according to rules of capability security, said one object being configured to determine whether said other objects know said one obiect's public key when said other objects attempt to access said one object;
a sending object being configured to pass a public key associated with one of said objects to a receiving object using an object reference message wherein the public key being passed is encrypted with said receiving object's public key;
said encryption preventing a first misbehaving object from unauthorized access to another object and preventing a second misbehaving object from intercepting object reference messages encrypted with another object's public key.

2 more elements

A method for passing an object reference between a sending object and a receiving object that preserves capability security, said method comprising the steps of:

generating a public and private key for each of said objects, said public key constituting the object reference of its associated object;
one of said objects being accessible only to other of said objects that know said one object's public key, said one object's public key being made available to said other objects according to rules of capability security said one object determining whether said other objects know said one object's public key when said other objects attempt to access said one object;
said sending object forming an object reference message whose contents include the public key associated with said one object;
and
said sending object encrypting said object reference message with said receiving object's public key and issuing the encrypted object reference message to said receiving object.

2 more elements

A capability security system for distributed object systems, comprising:

a plurality of objects;
a public and private key associated with each of said objects, said public key constituting the object reference of its associated object;
one of said objects being accessible only to other of said objects that know said one object's public key, said one object's public key being made available to said other objects according to rules of capability security;
a sending object being configured to pass a public key associated with one of said objects to a receiving object using an object reference message wherein the public key being passed is encrypted with said receiving object's public key;
said encryption preventing a first misbehaving object from unauthorized access to another object and preventing a second misbehaving object from intercepting object reference messages encrypted with another object's public key;
said receiving object being configured, upon receiving said object reference message, to decrypt said encrypted public key using said receiving object's private key, said receiving object thereby gaining the authority to access said one object;
a plurality of processes;
said plurality of objects being distributed among said processes;
each of said sending objects being configured to pass a public key associated with one of said objects to a receiving object in a different one of said processes using an object reference message wherein the public key being passed is encrypted;
said receiving object in a different one of said processes being configured to, upon receiving said object reference message, decrypt said encrypted public key, said receiving object thereby gaining the authority to access said one object;
said encryption and decryption preventing a first misbehaving object from unauthorized access to another object and preventing a second misbehaving object from intercepting object reference messages encrypted with another object's public key;
and
each of said sending objects being configured to pass a public key associated with one of said objects to a receiving object in the same processes using language-level pointers, said receiving object in said same process being configured to receive directly said object reference message and thereby gain the capability to access said one object;
wherein
said sending objects are configured to encrypt said public key being passed using an agreed key previously negotiated by said sending object passing the reference and said receiving object;
and
said receiving objects are configured to decrypt said encrypted public key using said agreed key.

14 more elements

A capability security system for distributed object systems, comprising:

a plurality of objects;
a public and private key associated with each of said objects, said public key constituting the object reference of its associated object;
one of said objects being accessible only to other of said objects that know said one object's public key, said one object's public key being made available to said other objects according to rules of capability security;
a sending object being configured to pass a public key associated with one of said objects to a receiving object using an object reference message wherein the public key being passed is encrypted with said receiving object's public key;
said encryption preventing a first misbehaving object from unauthorized access to another object and preventing a second misbehaving object from intercepting object reference messages encrypted with another object's public key;
said receiving object being configured, upon receiving said object reference message, to decrypt said encrypted public key using said receiving object's private key, said receiving object thereby gaining the authority to access said one object;
a plurality of processes;
wherein said plurality of objects are distributed among said processes;
a key exchange method associated with each of said processes;
a registrar in each of said processes;
a secret number table maintained by said registrar for local objects in its own process, each entry in said secret number table including:
a practically unguessable secret code associated solely with one of said local objects, and
a strong pointer to said one local object;
one of said objects being accessible only to other of said objects that know the local public key of said process hosting said one object and the secret code of said one object, said one object's secret code and local public key being made available to said other objects according to rules of capability security;
a sending object in a sending process being configured to pass said local public key and secret code associated with said one object to a receiving object in a different, receiving process using an object reference message whose contents include:
said local public key and secret code of said one object;
and
the secret code of said receiving object;
said contents being encrypted by said sending object using an agreed key established for said sending and receiving processes using said key exchange method;
said receiving process being configured, upon receipt of said object reference message to decrypt said message using said agreed key and forwarding the decrypted message to said registrar resident in said receiving process;
said registrar in said receiving process being configured, upon receiving said object reference message, to check said secret code of said receiving object from said decrypted message against entries in said secret number table and, when there is a match, to forward said public key and secret code for said one object to said matching object, said receiving object thereby gaining the authority to access said one object.

18 more elements

A method for passing an object reference between a sending object and a receiving object that preserves capability security, wherein said sending and receiving objects can be in different respective sending and receiving processes, said method comprising the steps of:

generating a public and private key for each of said objects, said public key constituting the object reference of its associated object;
one of said objects being accessible only to other of said objects that know said one object's public key, said one object's public key being made available to said other objects according to rules of capability security;
said sending object forming an object reference message whose contents include the public key associated with said one object;
said sending object encrypting said object reference message with said receiving object's public key and issuing the encrypted object reference message to said receiving object;
said receiving object, upon receiving said encrypted object reference message, decrypting said encrypted object reference message using said receiving object's private key, said receiving object thereby gaining the authority to access said one object;
generating a unique public and private key for each of said processes;
generating an agreed key for said processes;
maintaining a secret number table in each process, each entry in said secret number table including:
a unique, practically unguessable secret code associated with one object in said local process;
and
a strong pointer to said one object;
said one object being accessible only to other of said objects that know the public key of said process hosting said one object and the secret code of said one object, said one object's secret code and public key being made available to said other objects according to rules of capability security;
said sending object forming an object reference message whose contents include:
said public key and secret code of said one object;
and
a receiving secret code of said receiving object;
said sending object encrypting said object reference message using said agreed key established for said sending and receiving processes and forwarding the encrypted object reference message to said receiving object;
said receiving process, upon receiving said encrypted object reference message, decrypting said encrypted message using said agreed key and forwarding the decrypted message to said registrar resident in said receiving process;
said registrar in said receiving process checking said secret code of said receiving object from said decrypted message against entries in said secret number table and, when there is a match, forwarding said public key and secret code for said one object to said receiving object, said receiving object thereby gaining the authority to access said one object.

16 more elements

generating a public and private key for each of said objects, said public key constituting the object reference of its associated object;
one of said objects being accessible only to other of said objects that know said one object's public key, said one object's public key being made available to said other objects according to rules of capability security;
said sending object forming an object reference message whose contents include the public key associated with said one object;
said sending object encrypting said object reference message with said receiving object's public key and issuing the encrypted object reference message to said receiving object;
said receiving object, upon receiving said encrypted object reference message, decrypting said encrypted object reference message using said receiving object's private key, said receiving object thereby gaining the authority to access said one object;
when said sending object and said receiving objects are in different respective sending and receiving processes:
generating a public and private key for each of said objects, said public key constituting the object reference of its associated object;
said one object being accessible only to other of said objects that know said one object's public key, said one object's public key being made available to said other objects according to rules of capability security;
said sending object forming an object reference message whose contents include the public key and location of said one object;
said sending object encrypting said object reference message and issuing the encrypted object reference message to said receiving object in said receiving process;
and
said receiving object, upon receiving said encrypted object reference message, decrypting said encrypted object reference message and obtaining said public key and location of said one object, said receiving object thereby gaining the authority to access said one object;
when said sending object, said receiving object and said one object are in the same process:
said sending object forming an object reference message whose contents include a language-level pointer to said one object;
said sending object issuing said object reference message to said receiving object in clear, said receiving object thereby gaining the authority to access said one object.

12 more elements

Dependencies are inferred from the claim text.

Capability security for distributed object systems

Life of this patent

Capability security for distributed object systems

Life of this patent

Abstract

Claims28