Mobile code isolation cage

• US 6,065,118 A
• Filed: 09/24/1996
• Issued: 05/16/2000
• Est. Priority Date: 08/09/1996
• Status: Expired due to Term

• Current Assignee: APM Ltd. (Cloud Software Group), Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Bull, John Albert, Otway, David John
• Primary Examiner(s): LE, DIEU MINH T
• Application Number:
  US08/718,874
• Time in Patent Office: 1,330 Days
• Field of Search: 395/186, 395/187.01, 395/188.01, 395/704, 380/4, 380/23, 380/25, 713/200, 713/201, 713/202, 709/218, 709/223, 709/224, 709/225, 709/231, 709/250
• US Class Current: 726/22
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 9/44589 Program code verification, e.g. Java bytecode verification, proof-carrying code high-level semantic checks G06F8/43; testing and debugging software G06F11/36
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements

Abstract

The present invention reduces the risk of damage to data or programs in an end user computer system programmed to operate in response to an imported data stream containing one or more mobile program components from an external source. The incoming data stream is screened to identify mobile program components of that data stream. Some of the mobile program components are passed to a program execution location isolated from the end user system prior to being executed to operate in a desired manner. The execution location has an interface with the external source of the data stream and an interface with the end user system. The operation of the interface between the execution location and the end user system is programmed so that only data which has been interacted on by the program component within the execution location in a specified and controlled manner can be passed to and from the end user system.

Claims

1. An end user computer system programmed to operate in response to an imported data stream containing at least one mobile program component from an external source, characterized in that:

a. the data stream is screened to identify mobile program components of that data stream;

b. at least one of the mobile program components is passed to at least one program execution location physically isolated by separate hardware within the end user system prior to being executed to operate in a desired manner;

c. the execution location is one in which at least one program component is retained and which has at least one interface with the external source of the data stream and at least one interface with the end user system whereby the program component within the execution location can be executed within the execution location to interact with one of the external source of data and the data and a program held by the end user system; and

d. the operation of the interface between the execution location and the end user system is programmed so that only data which has been interacted on by the program component within the execution location in a specified and controlled manner and program components which operate in a specified manner can be passed to and from the end user system.

2. An end user computer system as claimed in claim 1, characterized in that the execution location is provided by a computer located intermediate the external source of the data stream and the end user system, which computer is isolated from the end user system and communicates with that end user system via at least one interface whose operation is controlled to permit the passage of at least one of data and program components in a selective and controlled manner.

3. An end user system as claimed in claim 2, characterized in that the execution location is programmed to operate with a single one of source of data and destination of data external to the end user system and to transmit and receive data to and from a single destination within the end user system.

4. An end user system as claimed in claim 1 which is provided with a plurality of execution locations, each programmed to operate with a different external data source and with a different destination within the end user system.

5. An end user system as claimed in claim 1, characterized in that the execution location is provided with at least one firewall between the execution location and one of the external source of data and the end user system.

6. An end user system as claimed in claim 1, characterized in that the execution location is provided with program means adapted to operate program components received from the external source in a specified manner and to permit transmission solely of one of data and program components which satisfy specific predetermined criteria to the end user system.

7. An end user system as claimed in claim 1, characterized in that the external data source operates under JAVA technology and the program components which are to be intercepted and run within the execution location are Applets.

8. An end user system as claimed in claim 1, characterized in that the end user system is a public access service provider.

9. An execution location for use in the apparatus of claim 1, characterized in that the execution location comprises a computer adapted to act as an interface between an external source of one of data and program components and an end user computer system which is to receive and transmit data to and from the computer, which computer is programmed to divert at least one of the program components from the external source to the computer and to execute those program components within the computer and to permit transfer of one of data and program components to the end user system which operate and have been operated on in selected and specified manners.

10. The end user computer system of claim 1 wherein the program execution location is physically isolated from the end user system.

11. A method for operating an end user computer system which comprises importing to the system a data stream containing at least one mobile program component which is to execute on the computer system from an external source, which method comprises:

a. screening the data stream to identify mobile program components of that data stream;

b. passing at least one mobile program component to at least one program execution location physically isolated by separate hardware within the end user system;

c. executing the mobile program component within the execution location so as to interact with data from one of the end user system and the external source;

d. passing one of the program components which operate in a specified manner and the interacted data and the resultant data from such interaction to the end user system via an interface which permits the transmission of one of data and program components which correspond to specified criteria to and from specified locations in one of the end user system and the external source.

12. The method of claim 11 wherein step (b) comprises:

b. passing at least one of the mobile program components to at least one of the program execution locations physically isolated from the end user system.

13. A program for operating a location for the execution of mobile program components in an incoming data stream imported to an end user computer system, of which at least one mobile program component is to be executed on the end user computer system, which program causes:

a. at least one of the incoming mobile program components to be directed to at least one execution location which is physically isolated by separate hardware within the end user system;

b. the mobile program component to be executed within the execution location so as to interact with data from one of the end user system and the external source; and

c. one of program components which operate in a specified manner and data and the resultant data from such interaction to be passed to the end user system via an interface which permits the transmission of one of data and program components which correspond to specified criteria to and from specified locations in one of the end user system and the external source.

14. The method of claim 13 wherein step (a) comprises:

a. passing at least one of the mobile program components to at least one of the program execution locations physically isolated from the end user system.