Method and apparatus for securing and storing executable content

• US 5,933,826 A
• Filed: 03/21/1997
• Issued: 08/03/1999
• Est. Priority Date: 03/21/1997
• Status: Expired due to Term

• Current Assignee: Apple Inc.
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Ferguson, Daniel T.
• Primary Examiner(s): HUA, LY
• Application Number:
  US08/822,116
• Time in Patent Office: 865 Days
• Field of Search: 395/186, 395/187.01, 395/188.01, 707/9, 711/163, 711/164, 380/4
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Computer system for storing and securing executable content is disclosed. A plurality of interconnected nodes access the distributed directory. The distributed directory has a hierarchy of objects each having one or more associated attributes. An access control mechanism is operative to control access to the distributed directory. A target object within the distributed directory has a target attribute, wherein access to a target object is controlled by the access control mechanism. A program is stored as a value in the target attribute, such that access to the program is controlled by the access control mechanism.

Claims

1. A system, comprising:

a) a plurality of interconnected nodes;

b) a distributed directory being accessed by the plurality of nodes;

c) a hierarchy of objects in the distributed directory, one or more of said objects having one or more associated attributes;

d) an access control mechanism operative to control access to the distributed directory;

e) a target object having a target attribute, wherein access to said target object is controlled by the access control mechanism; and

f) a program being stored as a value in said target attribute, wherein access to said program is controlled by the access control mechanism.

2. A system as recited in claim 1, further comprising an interpreter capable of translating the program into a functional form.

3. A system as recited in claim 2, wherein the program is pseudo code.

4. A system as recited in claim 1, wherein the program is object code.

5. A system as recited in claim 1, wherein the value is a stream.

6. A system as recited in claim 1, wherein the access control mechanism comprises login security or directory security.

7. A system as recited in claim 1, wherein the program is stored as a file in a nonvolatile computer readable medium, said file not being registered in the index of the nonvolatile computer readable medium.

8. A system as recited in claim 1, further comprising a replication system capable of replicating the value from one node to at least one other node.

9. A system as recited in claim 1, further comprising an encryption system and a decryption system for encrypting and decrypting the program, respectively.

10. A system as recited in claim 1, wherein the program is a method for the target object.

11. A system as recited in claim 10, wherein the method is triggered by an event.

12. A method for storing a program in a computer system, comprising the steps of:

a) accessing a distributed directory having a hierarchy of objects, one or more of said objects having associated attributes, said distributed directory having an access control mechanism for controlling access to at least a portion of the distributed directory;

b) identifying a target object in the distributed directory, said target object having a target attribute;

c) accessing a program;

d) storing the program as a value in the target attribute; and

e) preventing access to the value through the access control mechanism, whereby the program cannot be executed unless access has been permitted by the access control mechanism.

13. A method as recited in claim 12, wherein the program requires an interpreter to be executed.

14. A method as recited in claim 13, wherein the program is pseudo code.

15. A method as recited in claim 12, wherein the program is object code.

16. A method as recited in claim 12, wherein the step of storing involves entering the program as a stream.

17. A method as recited in claim 12, further comprising the step of replicating the value to one or more computers accessing the directory.

18. A method as recited in claim 12, further comprising the step of encrypting the program before the step of storing.

19. A method as recited in claim 12, wherein the program is a method which is executed upon the occurrence of an event.

20. A computer readable medium, comprising a sequence of at least partially compiled instructions stored as a value in a target attribute, said target attribute being associated with a target object in a distributed directory having a hierarchy of objects with associated attributes, wherein access to the value is controlled by an access control mechanism adapted to control access to at least a portion of the distributed directory.

21. A computer readable medium as recited in claim 20, wherein the sequence of instructions is pseudo code or object code.

22. A computer readable medium as recited in claim 20, wherein the value is a stream.

23. A computer readable medium as recited in claim 20, wherein the computer readable medium is nonvolatile.