Method and apparatus for verifying and ensuring safe handling of notifications

• US 20070130622A1
• Filed: 11/20/2006
• Published: 06/07/2007
• Est. Priority Date: 11/21/2005
• Status: Abandoned Application

• Current Assignee: NTT Docomo Incorporated (Nippon Telegraph and Telephone Corporation)
• Original Assignee: DOCOMO Communications Laboratories USA, Inc.
• Inventors: Chander, Ajay, Kikuchi, Haruka
• Application Number:
  US11/602,604
• Publication Number:
  US 20070130622A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 9/44589 Program code verification, e.g. Java bytecode verification, proof-carrying code high-level semantic checks G06F8/43; testing and debugging software G06F11/36
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method and apparatus for verifying and/or ensuring safe handling of notifications. In one embodiment, the method comprises receiving a notification and handling the notification safely using program code that has a notification handler that has been statically verified to handle the notification according to a notification acceptance policy.

Claims

1. A method comprising:

receiving a notification; and

handling the notification safely using program code that has a notification handler that has been statically verified to handle the notification according to a notification acceptance policy.

2. The method defined in claim 1 wherein the notification handler has been dynamically instrumented with dynamic checks to conform to the notification acceptance policy if the program code, prior to receiving the notification, was determined to be unable to handle notifications safely.

3. The method defined in claim 1 wherein the notification policy is specified algebraically.

4. The method defined in claim 1 wherein the notification policy specifies that the handler processes the notification based on its type and a policy predicate.

5. The method defined in claim 4 wherein the policy predicate is constructed from policy constructors specified in a specification for the notification with the same notification type.

6. The method defined in claim 1 wherein the notification acceptance policy is generated by another party, and further comprising verifying the notification acceptance policy prior to its use in handling the notification.

7. The method defined in claim 6 wherein verifying the notification acceptance policy comprises generating one or more policies using a notification specification and using a natural language description of policy descriptors to describe how the notification acceptance policy would operate.

8. The method defined in claim 1 further comprising performing static verification of the program code corresponding to the handler by:

generating an execution tree for the program code, where nodes in the execution tree correspond to individual commands in the program code; and

computing an update predicate for portions of the program code in which notifications are accessed.

9. The method defined in claim 1 further comprising checking a notification handler in the program code for safety compliance with the notification acceptance policy.

10. The method defined in claim 1 wherein the notification acceptance policy is specified by a consumer of the notifications.

11. The method defined in claim 1 wherein the unsolicited notification is specified as a first class data object.

12. The method defined in claim 1 wherein at least one of the first class data objects includes a specification indicating how the one first class data object may be computed upon and how the one data object may be used in a policy in the notification policy.

13. The method defined in claim 1 wherein at least one policy for safe handling of notifications in the set of one or more policies is specified as a Notification Acceptance Policy (NAP).

14. The method defined in claim 1 wherein the notification is sent from a server to a client executing the program code that has the notification handler.

15. The method defined in claim 1 wherein the notification in sent in response to a request from a client executing the program code.

16. The method defined in claim 1 wherein the notification in sent in response to a request from a first client that is different from a second client executing the program code.

17. The method defined in claim 1 wherein the notification in sent in response to an inter-server communication.

18. An article of manufacture having one or more computer readable storage media storing instructions thereon which, when executed by a system, cause the system to perform a method comprising:

receiving a notification; and

handling the notification safely using program code that has a notification handler that has been statically verified to handle the notification according to a notification acceptance policy.

19. The article of manufacture defined in claim 19 wherein the notification handler has been dynamically instrumented with dynamic checks to conform to the notification acceptance policy if the program code, prior to receiving the notification, was determined to be unable to handle notifications safely.

20. The article of manufacture defined in claim 19 wherein the notification policy is specified algebraically.

21. The article of manufacture defined in claim 19 wherein the notification policy specifies that the handler processes the notification based on its type if a policy predicate is in a predetermined logical state.

22. The article of manufacture defined in claim 21 wherein the policy predicate is constructed from policy constructors specified in a specification for the notification with the same notification type.

23. The article of manufacture defined in claim 19 wherein the method further comprises verifying the notification acceptance policy by generating one or more policies using a notification specification and using a natural language descriptions of policy descriptors to describe how the notification acceptance policy would operate.

24. The article of manufacture defined in claim 19 wherein the method further comprises performing static verification of the program code corresponding to the handler by:

generating an execution tree for the program code, where nodes in the execution tree correspond to individual commands in the program code; and

computing an update predicate for portions of the program code in which notifications are accessed.

25. A method comprising:

performing static verification on program code that handles a notification, wherein the static verification is performed according to a notification acceptance policy;

dynamically instrumenting the program code with dynamic checks to conform to the notification acceptance policy if the program code, prior to receiving a notification, is determined to be unable to handle notifications safely;

receiving a notification;

executing a program that includes a handler to handle the notification safely according to the notification acceptance policy.

26. The method defined in claim 25 wherein the notification policy is specified algebraically.

27. The method manufacture defined in claim 25 wherein the notification policy specifies that the handler processes the notification based on its type and a policy predicate.

28. The method defined in claim 25 wherein the policy predicate is constructed from policy constructors specified in a specification for the notification with the same notification type.

29. The method defined in claim 25 further comprising verifying the notification acceptance policy by generating one or more policies using a notification specification and using natural language descriptions of policy descriptors to describe how the notification acceptance policy would operate.

30. The method defined in claim 25 further comprising performing static verification of the program code corresponding to the handler by:

generating an execution tree for the program code, where nodes in the execution tree correspond to individual commands in the program code; and

computing an update predicate for portions of the program code in which notifications are accessed.