US 6,708,276 B1Granted

Architecture for denied permissions in Java

AssigneeInternational Business Machines Corporation

InventorsJulianne Yarsa, Bruce Arland Rich, Theodore Jack London Shrader, Donna Skibbie

Life of this patent

Estimating the term…

Loading patent…

Abstract

An architecture for extending the Java security model to allow a user or administrator to explicitly deny permissions. By itself, the Java 2 security model does not allow additions to the collections of policy permissions after they have been loaded from the Java policy file. The inventive architecture allows Java applets and applications to dynamically prompt the user to deny a permission that does not exist in the Java policy file. If the user denies the permission, the present invention denies the permission for the ProtectionDomain to which the class asking for the permission belongs. Attributes for the denied permission may be set during runtime and saved across browser sessions.

Claims16

Dependent claims

A method for determining access to objects in a Java runtime environment, the method comprising:

responsive to instantiation of a protection domain, reading a policy configuration file having a list of granted and/or denied permissions, retrieving the granted and/or denied permissions, and associating the granted and/or denied permissions with a private attribute of a protection domain class;
defining a second attribute of the protection domain class to identify a permission as a statically or dynamically defined permission;
defining a third attribute of the protection domain class to identify whether to save a dynamically defined permission to the policy configuration file;
operative at an access control point during execution of a Java applet, determining the protection domain of a class being examined;
accessing a private attribute of the associated protection domain class to obtain a permission that is identified by the second attribute of the protection domain class as a statically defined permission;
prompting a user to obtain a permission that is identified by the second attribute of the protection domain class as a dynamically defined permission;
analyzing the obtained permission to determine whether access to a requested object has been denied to the protection domain;
and
saving a dynamically defined permission into the policy configuration file in accordance with the third attribute of the protection domain class.

6 more elements

A computer program product in a computer readable medium for denying access to an object in a Java runtime environment, the computer program product comprising:

means, responsive to instantiation of a protection domain, for reading a policy configuration file having a list of granted and/or denied permissions, for retrieving the granted and/or denied permissions, and for associating the granted and/or denied permissions with a private attribute of a protection domain class;
means for defining a second attribute of the protection domain class to identify a permission as a statically or dynamically defined permission;
means for defining a third attribute of the protection domain class to identify whether to save a dynamically defined permission to the policy configuration file;
means, operative at an access control point during execution of a Java applet, for determining the protection domain of a class being examined;
means for accessing a private attribute of the associated protection domain class to obtain a permission that is identified by the second attribute of the protection domain class as a statically defined permission;
means for prompting a user to obtain a permission that is identified by the second attribute of the protection domain class as a dynamically defined permission;
means for analyzing the obtained permission to determine whether access to a requested object has been denied to the protection domain;
and
means for saving a dynamically defined permission into the policy configuration file in accordance with the third attribute of the protection domain class.

6 more elements

A computer comprising:

a Java runtime environment;
means, responsive to instantiation of a protection domain, for reading a policy configuration file having a list of granted and/or denied permissions, for retrieving the granted and/or denied permissions, and for associating the granted and/or denied permissions with a private attribute of a protection domain class;
means for defining a second attribute of the protection domain class to identify a permission as a statically or dynamically defined permission;
means for defining a third attribute of the protection domain class to identify whether to save a dynamically defined permission to the policy configuration file;
means, operative at an access control point during execution of a Java applet, for determining the protection domain of a class being examined;
means for accessing a private attribute of the associated protection domain class to obtain a permission that is identified by the second attribute of the protected domain class as a statically defined permission;
means for prompting a user to obtain a permission that is identified by the second attribute of the protection domain class as a dynamically defined permission;
means for analyzing the obtained permission to determine whether access to a requested object has been denied to the protection domain;
and
means for saving a dynamically defined permission into the policy configuration file in accordance with the third attribute of the protection domain class.

7 more elements

Dependencies are inferred from the claim text.