US 7,073,062 B2Granted

Method and apparatus to mutually authentication software modules

AssigneeInternational Business Machines Corporation

InventorsLok Yan Leung, Anthony Joseph Nadalin, Bruce Arland Rich, Thoedore Jack London Shrader

Life of this patent

Estimating the term…

Loading patent…

Abstract

In response to initiating a call from a first class to a second class, an instantiation of the second class is initiated. While performing the instantiation of the second class, a class constructor for the second class is called, which determines a codebase for the first class and attempts to verify a digital signature on it. In response to a successful verification, the instantiation of the second class is successfully completed. In response to successfully completing the instantiation of the second class, a codebase for the second class is determined by the first class, and an attempt is made by the first class to verify a digital signature on the codebase for the second class. In response to a successful verification of the digital signature on the codebase for the second class, the call from the instance of the first class to the instance of the second class is performed.

Claims18

Dependent claims

A method for authenticating software modules that execute on a data processing system, the method comprising:

executing an instance of a first class on the data processing system;
in response to initiating a call from the instance of the first class to a second class, initiating an instantiation of the second class to create an instance of the second class;
while performing the instantiation of the second class, calling a class constructor for the second class;
during execution of the class constructor for the second class, determining a codebase for the first class;
during execution of the class constructor for the second class, attempting by the second class to verify a digital signature on the codebase for the first class;
in response to a successful verification of the digital signature on the codebase for the first class, successfully completing the instantiation of the second class;
in response to successfully completing the instantiation of the second class, determining by the first class a codebase for the second class;
in response to determining by the first class the codebase for the second class, attempting by the first class to verify a digital signature on the codebase for the second class;
and
in response to a successful verification of the digital signature on the codebase for the second class, performing the call from the instance of the first class to the instance of the second class.

7 more elements

An apparatus for authenticating software modules that execute on a data processing system, the apparatus comprising:

means for executing an instance of a first class on the data processing system;
means for initiating an instantiation of the second class to create an instance of the second class in response to initiating a call from the instance of the first class to a second class;
means for calling a class constructor for the second class while performing the instantiation of the second class;
means for determining a codebase for the first class during execution of the class constructor for the second class;
means for attempting by the second class to verify a digital signature on the codebase for the first class during execution of the class constructor for the second class;
means for successfully completing the instantiation of the second class in response to a successful verification of the digital signature on the codebase for the first class;
means for determining by the first class a codebase for the second class in response to successfully completing the instantiation of the second class;
means for attempting by the first class to verify a digital signature on the codebase for the second class in response to determining by the first class the codebase for the second class;
and
means for performing the call from the instance of the first class to the instance of the second class in response to a successful verification of the digital signature on the codebase for the second class.

7 more elements

A computer program product on a computer readable medium for use in a data processing system for authenticating software modules that execute on the data processing system, the computer program product comprising:

instructions for executing an instance of a first class on the data processing system;
instructions for initiating an instantiation of the second class to create an instance of the second class in response to initiating a call from the instance of the first class to a second class;
instructions for calling a class constructor for the second class while performing the instantiation of the second class;
instructions for determining a codebase for the first class during execution of the class constructor for the second class;
instructions for attempting by the second class to verify a digital signature on the codebase for the first class during execution of the class constructor for the second class;
instructions for successfully completing the instantiation of the second class in response to a successful verification of the digital signature on the codebase for the first class;
instructions for determining by the first class a codebase for the second class in response to successfully completing the instantiation of the second class;
instructions for attempting by the first class to verify a digital signature on the codebase for the second class in response to determining by the first class the codebase for the second class;
and
instructions for performing the call from the instance of the first class to the instance of the second class in response to a successful verification of the digital signature on the codebase for the second class.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 09/740,600Filed 19 Dec 2000
Published: US 2003/0037239 A120 Feb 2003
Granted: 4 Jul 2006
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

G06F 9/468
Multiprogramming arrangements: specific access rights for resources, e.g. using capability register
G06F 9/465
Multiprogramming arrangements: distributed object oriented systems
G06F 21/445
Program or device authentication: by mutual authentication, e.g. between devices or programs
G06F 21/52
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: during program…