Stack-based system and method to combine security requirements of methods

• US 6,226,746 B1
• Filed: 03/20/1998
• Issued: 05/01/2001
• Est. Priority Date: 03/20/1998
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Scheifler, Robert W.
• Primary Examiner(s): Etienne, Ario
• Application Number:
  US09/044,944
• Time in Patent Office: 1,138 Days
• Field of Search: 713/200, 713/202, 713/201, 710/240, 710/107, 710/36
• US Class Current: 726/1
• CPC Class Codes: G06F 9/52 Program synchronisation; Mutual exclusion, e.g. by means of semaphores

Abstract

A system obtains the security requirements for an action requested by a thread executing on a computer. The thread invokes a plurality of methods during its execution. The system includes a call stack and a determination unit. The call stack stores an identifier and security requirements for each of the methods in the order that the methods were invoked by the thread. The determination unit combines the method security requirements from the call stack to obtain the security requirements for the requested action.

Claims

1. A system that obtains security requirements for an action requested by a caller executing on a computer, the caller invoking at least one of a plurality of methods during execution, the system comprising:

a call stack that stores representations of the plurality of methods in an order of invocation by the caller and security requirements for the plurality of methods; and

a determination unit that dynamically combines the method security requirements from the call stack to obtain the security requirements for the requested action.

2. The system of claim 1, wherein the call stack stores representations and security requirements of only ones of the methods that are currently invoked.

3. The system of claim 1, wherein the method security requirements include a confidentiality requirement through which the caller ensures privacy during communication.

4. The system of claim 1, wherein the method security requirements include an integrity requirement through which the caller ensures that communication remains unaltered during transmission.

5. The system of claim 1, wherein the method security requirements include an anonymity requirement through which the caller can remain anonymous in the requested action.

6. The system of claim 1, wherein the method security requirements include a server authentication requirement through which the caller requests a device to authenticate itself.

7. The system of claim 1, wherein the method security requirements include a delegation requirement through which the caller authorizes a device to delegate under the caller'"'"'s identity.

8. The system of claim 1, wherein the determination unit includes:

a combination unit that combines the method security requirements from the call stack, overriding weaker method security requirements with stronger method security requirements.

9. The system of claim 1, wherein the caller is a thread executing on the computer.

10. The system of claim 1, wherein the caller is a program executing on the computer.

11. A system that obtains security requirements for an action requested by a thread executing on a computer, the thread invoking at least one of a plurality of methods during execution, the system comprising:

means for storing a method identifier and storing security requirements for a plurality of methods when invoked by the thread;

means for dynamically combining the stored method security requirements; and

means for obtaining the security requirements for the requested action from the combined method security requirements.

12. A computer-implemented method for determining security requirements of an action requested by an operation executing on a computer, the operation invoking at least one of a plurality of functions during execution, the method comprising the steps of:

storing a function identifier and storing security requirements for a plurality of functions when invoked by the operation;

receiving a request for the action from the operation;

dynamically combining the stored function security requirements; and

determining the security requirements of the requested action from the combined function security requirements.

13. A computer-readable medium containing instructions for controlling a computer to perform an action requested by an operation executing on the computer, the operation invoking a plurality of functions during execution, said instructions comprising:

storing a function identifier and storing security requirements for a plurality of functions when invoked by the operation;

receiving a request for the action from the operation;

dynamically combining the stored function security requirements;

determining security requirements of the requested action from the combined function security requirements; and

performing the requested action using the determined security requirements.

14. A data processing system comprising:

a memory including;

a program that invokes a plurality of methods during execution,

a call stack that stores identifiers of the methods when invoked by the program and security requirements requested by each of the methods, and

a runtime environment that receives a request for an action from the program, that combines the method security requirements of the methods in the call stack, that determines security requirements for the requested action from the combined method security requirements, and that performs the requested action using the determined security requirements; and

a processor for executing the runtime environment and the program.

15.

A method for determining the security requirements for an action requested by a thread executing on a computer, the method comprising:

receiving a request for the action from the thread;

storing on a call stack a plurality of frames, including security requirements, corresponding to a plurality of methods invoked by the thread in an order of invocation by the thread; and

dynamically combining the method security requirements from the call stack to obtain the security requirements for the requested action.

16. The method of claim 15, wherein the action includes invoking a remote method on a server, and wherein the step of storing on the call stack the plurality of frames, includes the step of obtaining the security requirements for the server.