Mobile code and method for resource management for mobile code

• US 20030079123A1
• Filed: 09/09/2002
• Published: 04/24/2003
• Est. Priority Date: 03/08/2000
• Status: Abandoned Application

• Current Assignee: Université catholique de Louvain
• Original Assignee: Université catholique de Louvain
• Inventors: Mas Ribes, Joan-Maria
• Application Number:
  US10/221,418
• Publication Number:
  US 20030079123A1
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

A mobile code linked to a certificate including at least a resource requirements list (RRL) including those resources needed by the mobile code to be properly executable plus those resources that are known a priori to be accessed when executing the mobile code. The unique certificate contains additionally an issuer of the certificate information identifying the entity issuing the certificate, a subject information identifying the mobile code to which the certificate is referred, and a validity period information stating the period of time within which the certificate is valid. When downloading or uploading a mobile code the RRL is transferred to the user informing the user of the resource requirements of the mobile code. An execution environment is provided in an execution peer of the user, the execution environment defining at least the resource access policy that will be applied to the mobile code on execution.

Claims

1. Mobile code comprising a resource usage needs section containing at least a resource requirements list including those resources needed by the mobile code to be properly executable plus those resources that are known a priori to be accessed when executing the mobile code.

2. Mobile code according to claim 1, wherein the resource usage needs section of the mobile code is a certificate which is unique for each different mobile code.

3. Mobile code according to claim 1 or 2, wherein the resource usage needs section of the mobile code or the certificate contains, in addition to the resource requirements list, any of the following information:

a) issuer of the certificate information identifying the entity issuing the certificate,

b) subject information identifying the mobile code to which the certificate is referred, and

c) validity period information stating the period of time within which the certificate is valid.

4. Mobile code according to claim 3, wherein the resource requirements list contains any of the following information:

a) name of the resource information specifying the type of resource,

b) action on the resource specifying as to how the resource should be used,

c) upper quantitative limit information stating the maximum usage of the resource from a quantitative point of view, and

d) upper qualitative limit information stating the maximum usage of the resource from a qualitative point of view.

5. Mobile code according to any of the preceding claims, wherein an execution program is provided in an execution environment of the user, the execution program defining at least the resource access policy that will be applied to the mobile code on execution.

6. Method for resource management for mobile code using a mobile code of any of the claims 1 to 5, wherein:

(a) in the case of downloading upon request a mobile code from a principal to a user, in a the negotiation phase in the beginning of the downloading process, a RRL list is transferred from the principal to the user informing the user of the resource requirements of the mobile code, and

(b) in the case of uploading upon request a mobile code from a resource owner to a user, in a the negotiation phase in the beginning of the uploading process, a RRL list is transferred from the resource owner to the user informing the user of the resource requirements of the mobile code.

7. Method according to claim 6, wherein, in the negotiation phase, the downloading process further includes user and/or platform authentication, specifying restrictions imposed by the mobile code distributor as to the user and/or platform involved, and/or payment/licensing evaluation, comprising the financial aspects of the mobile code transfer;

and wherein, in the negotiation phase, the uploading process further includes user and/or platform authentication information specifying restrictions imposed by the resource owner as to the user and/or platform involved, and/or payment/licensing evaluation information comprising the financial aspects of the mobile code transfer.

8. A method for transferring mobile code through an active network for resource management for mobile code using a mobile code of any of the claims 1 to 5, the network comprising a plurality of active network nodes, wherein the active flow is composed of the following information:

a) a mobile code that needs to be executed in a node which is crossed by the active flow,

b) a RRL-list issued by the entity that sends the mobile code to the network,

c) a certificate or a sequence of certificates whose first entry is a certificate from the network operator to the starting entity, and

e) the data themselves.

9. Method according to claim 8, further comprising any of the following steps:

a) verifying that the mobile code integrity has not been compromised,

b) reducing the certificate chain associated with the mobile code to verify trust transfer from the execution environment to the supplier, and

c) create a process-like structure for the mobile code which isolates the mobile code from other programs running on the same execution environment.

10. Method according to claim 8 or 9, wherein the mobile code or the execution program or its reduced program is configured to discover that a given resource is available through the execution environment and to request access to it thus to dynamically request access to other resources, and wherein the execution environment will decide on run time whether to grant or to deny such access.