Method and apparatus to store extended security information in a data structure which shadows a java class object

• US 6,339,829 B1
• Filed: 07/30/1998
• Issued: 01/15/2002
• Est. Priority Date: 07/30/1998
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Nizinski, Leonard Robert Jr., Brown, Michael Wayne, Rothert, Douglas Scott, Beadle, Bruce Anthony
• Primary Examiner(s): Hayes, Gail
• Assistant Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US09/126,682
• Time in Patent Office: 1,265 Days
• Field of Search: 713/200, 713/201, 713/176, 713/167, 713/191, 709/313, 709/315, 709/316, 711/216, 707/103, 707/103.R, 707/103.Y, 707/103.Z, 717/11
• US Class Current: 726/15
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

The present invention modifies the implementation of the Netscape security model to use an apparatus to set and get extended class data. More specifically, use of the apparatus to store the additional security information for later retrieval at the point where this information would have been written into the Java class data structure, and retrieve this information at the point it would have been read from the Java class data structure. The apparatus is implemented by creating a hash table of objects that store the extended class information. The hash key function uses the original class reference to lookup the classes shadow data structure.

Claims

1. An apparatus for using class extension information with a Java-enabled browser, comprising:

(a) a shadow data structure containing one or more class extensions for one or more classes stored in a Java Virtual Machine associated with the Java-enabled browser, each of the one or more class extensions containing an array of security for a corresponding one of the one or more classes; and

(b) means for retrieving a class extension of the one or more class extensions from the shadow data structure based on a hash of a class name of the class corresponding to the class extension.

2. The apparatus of claim 1 wherein said one or more class extensions further comprise a security signature for a corresponding class of the one or more classes.

3. The apparatus of claim 1 wherein said one or more class extensions further comprise a signed JAR pointer.

4. The apparatus of claim 1 wherein said shadow data structure resides in a memory.

5. A method for providing a class extension of a class to be executed in a virtual machine of a data processing system, the method comprising the computer-implemented steps of:

(a) creating a hash value for a class stored in the virtual machine based on a class name of the class; and

(b) searching a hash table based on the hash value, the hash table comprising entries with class extension information, the class extension information identifying an array of security principals for a corresponding class.

6. The method of claim 5 further comprises:

(c) if a hash table entry is located by searching the hash table, updating the hash table entry with class extension information in response to a request to set a class extension.

7. The method of claim 5 further comprises:

(c) if a hash table entry is not located by searching the hash table, creating a new hash table entry with class extension information in response to a request to set a class extension.

8. The method of claim 5 further comprises:

(c) if a hash table entry is located by searching the hash table, retrieving class extension information for the class from the hash table entry in response to a request to get a class extension.

9. The method of claim 5 further comprises:

(c) if a hash table entry is not located by searching the hash table, returning with blank or null class extension information in response to a request to get a class extension.

10. A data processing system for providing a class extension of a class to be executed in a virtual machine in the data processing system, the data processing system comprising:

(a) creating means for creating a hash value for a class stored in the virtual machine based on a class name of the class; and

(b) searching means for searching a hash table based on the hash value, the hash table comprising entries with class extension information, the class extension information identifying an array of security principals for a corresponding class.

11. The data processing system of claim 10 further comprises:

(c) updating means for updating the hash table entry with class extension information if a hash table entry is located by searching the hash table in response to a request to set a class extension.

12. The data processing system of claim 10 further comprises:

(c) creating means for creating a new hash table entry with class extension information if a hash table entry is not located by searching the hash table in response to a request to set a class extension.

13. The data processing system of claim 10 further comprises:

(c) retrieving means for retrieving class extension information for the class from the hash table entry if a hash table entry is located by searching the hash table in response to a request to get a class extension.

14. The data processing system of claim 10 further comprises:

(c) returning means for returning blank or null class extension information if a hash table entry is not located by searching the hash table in response to a request to get a class extension.

15. A computer program product for use in a data processing system for providing a class extension of a class to be executed in a virtual machine in the data processing system, the computer program product comprising:

(a) first instructions for creating a hash value for a class stored in the virtual machine based on a class name of the class; and

(b) second instructions for searching a hash table based on the hash value, the hash table comprising entries with class extension information, the class extension information identifying an array of security principals for a corresponding class.

16. The computer program product of claim 15 further comprises:

(c) third instructions for updating the hash table entry with class extension information if a hash table entry is located by searching the hash table in response to a request to set a class extension.

17. The computer program product of claim 15 further comprises:

(c) third instructions for creating a new hash table entry with class extension information if a hash table entry is not located by searching the hash table in response to a request to set a class extension.

18. The computer program product of claim 15 further comprises:

(c) third instructions for retrieving class extension information for the class from the hash table entry if a hash table entry is located by searching the hash table in response to a request to get a class extension.

19. The computer program product of claim 15 further comprises:

(c) third instructions for returning blank or null class extension information if a hash table entry is not located by searching the hash table in response to a request to get a class extension.