SYSTEM AND METHOD FOR LOADING APPLICATION CLASSES

• US 20110138460A1
• Filed: 12/03/2009
• Published: 06/09/2011
• Est. Priority Date: 12/03/2009
• Status: Active Grant

• Current Assignee: OL Security LLC (Intellectual Ventures LLC)
• Original Assignee: Recursion Software, Inc.
• Inventors: Wheeler, Thomas
• Granted Patent: US 8,677,506 B2
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

In an application, variants of a class may be generated and associated with different security permissions for the application. When a class is to be loaded, a determination is made as to the application'"'"'s security permissions, e.g. by decoding a security token. The class is then retrieved from a repository that stores class variants matching the required security level. The retrieved class variant, which may have a full or a reduced functionality as appropriate for the security permission may then by loaded.

Claims

1. A method, comprising:

determining, at a processing device, a class requirement;

determining, at the processing device, a security permission in response to receiving a class invocation;

retrieving, from at least one depository, a class variant associated with the class requirement in response to the security permission; and

loading the class variant.

2. The method according to claim 1, wherein determining, at the processing device, the security permission further comprises decoding a security token.

6. The method according to claim 1, further comprising:

establishing a plurality of class variants for a class; and

associating each of the plurality of class variants with a corresponding security permission.

7. The method according to claim 6, further comprising storing each of the plurality of class variants in separate repositories.

8. The method according to claim 6, wherein each of the plurality of class variants comprises a same namespace.

9. The method according to claim 6, wherein each of the plurality of class variants comprises a same application programming interface.

10. The method according to claim 6,

wherein a first class variant provides a first functionality and

wherein a second class variant provides a reduced functionality in comparison to the first class variant.

11. The method according to claim 6, further comprising associating each of the corresponding security permissions with a class variant repository.

12. The method according to claim 11, wherein the plurality of class variants for the class are stored in a repository with a plurality of class variants for at least another class having equivalent security permissions.

3-5. -5. (canceled)

13. An apparatus, comprising:

a memory device; and

a processing device operatively coupled to the memory device comprising;

a request handler; and

at least one class loader;

wherein the request handler is configured to;

process a request for a class; and

determine a security permission associated with the request for the class; and

wherein the class loader is configured to load a class variant from a depository associated with the class in response to the security permission.

16. The apparatus according to claim 13, wherein the request handler is further configured to decode a security token to determine the security permission.

17. The apparatus according to claim 13, comprising a plurality of classes wherein at least one class comprises a plurality of class variants.

18. The apparatus according to claim 17,

wherein a first class variant provides a first functionality;

and

wherein a second class variant provides a reduced functionality in comparison to the first class variant.

19. The apparatus application according to claim 18,

wherein the first class variant is associated with a first security permission;

and

wherein the second class variant is associated with a second security permission.

14-15. -15. (canceled)

20. A computer-readable storage device including computer-executable instructions stored thereon that configure a processing device to perform operations comprising:

decoding a security token;

determining a security permission level from the security token;

selecting a class repository associated with the security permission level; and

loading a class variant from the selected class repository.

21. The computer-readable storage device of claim 20 wherein the processing device is configured to perform operations further comprising:

establishing a plurality of class variants for a class; and

associating each of the plurality of class variants with a corresponding security permission level.

22. The computer-readable storage device of claim 21 wherein the processing device is configured to perform operations further comprising:

storing each of the plurality of class variants in distinct repositories.

23. The computer-readable storage device of claim 22 wherein the processing device is configured to perform operations further comprising:

associating each of the corresponding security permissions levels to a distinct repository.

24. The computer-readable storage device of claim 21 wherein each of the plurality of class variants comprises a common namespace.

25. The computer-readable storage device of claim 21 wherein each of the plurality of class variants comprises a common application programming interface.

26. The computer-readable storage device of claim 21 wherein the plurality of class variants for the class are stored in a repository with a plurality of class variants for at least another class having equivalent security permission levels.

27. The computer-readable storage device of claim 20

wherein a first class variant provides a first functionality;

and

wherein a second class variant provides a reduced functionality in comparison to the first class variant.

28. A device, comprising:

means for decoding a security token;

means for determining a security permission level from the security token;

means for selecting a class repository associated with the security permission level; and

means for loading a class variant from the selected class repository.

29. The device of claim 28 further comprising:

means for establishing a plurality of class variants for a class; and

means for associating each of the plurality of class variants with a corresponding security permission level.

30. The device of claim 29 further comprising:

means for storing each of the plurality of class variants in distinct repositories.

31. The device of claim 29 further comprising:

means for associating each of the corresponding security permissions levels to a distinct repository.

32. The device of claim 29 wherein each of the plurality of class variants comprises a common namespace.

33. The device of claim 29 wherein each of the plurality of class variants comprises a common application programming interface.

34. The device of claim 29 further comprising:

means for storing the plurality of class variants for the class in a repository with a plurality of class variants for at least another class having equivalent security permission levels.

35. The device of claim 28

wherein a first class variant provides a first functionality;

and

wherein a second class variant provides a reduced functionality in comparison to the first class variant.