Architecture for denied permissions in Java

• US 6,708,276 B1
• Filed: 08/03/1999
• Issued: 03/16/2004
• Est. Priority Date: 08/03/1999
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Shrader, Theodore Jack London, Yarsa, Julianne, Rich, Bruce Arland, Skibbie, Donna
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): CALLAHAN, PAUL E
• Application Number:
  US09/366,403
• Time in Patent Office: 1,687 Days
• Field of Search: 713/164, 713/166, 713/167, 713/201, 713/200, 709/315, 709/316, 709/331, 709/332, 707/102, 707/103, 707/104, 717/166
• US Class Current: 726/6
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing

Abstract

An architecture for extending the Java security model to allow a user or administrator to explicitly deny permissions. By itself, the Java 2 security model does not allow additions to the collections of policy permissions after they have been loaded from the Java policy file. The inventive architecture allows Java applets and applications to dynamically prompt the user to deny a permission that does not exist in the Java policy file. If the user denies the permission, the present invention denies the permission for the ProtectionDomain to which the class asking for the permission belongs. Attributes for the denied permission may be set during runtime and saved across browser sessions.

Claims

1. A method for determining access to objects in a Java runtime environment, the method comprising:

responsive to instantiation of a protection domain, reading a policy configuration file having a list of granted and/or denied permissions, retrieving the granted and/or denied permissions, and associating the granted and/or denied permissions with a private attribute of a protection domain class;

defining a second attribute of the protection domain class to identify a permission as a statically or dynamically defined permission;

defining a third attribute of the protection domain class to identify whether to save a dynamically defined permission to the policy configuration file;

operative at an access control point during execution of a Java applet, determining the protection domain of a class being examined;

accessing a private attribute of the associated protection domain class to obtain a permission that is identified by the second attribute of the protection domain class as a statically defined permission;

prompting a user to obtain a permission that is identified by the second attribute of the protection domain class as a dynamically defined permission;

analyzing the obtained permission to determine whether access to a requested object has been denied to the protection domain; and

saving a dynamically defined permission into the policy configuration file in accordance with the third attribute of the protection domain class.

2. The method as described in claim 1 wherein the method is practiced in an object-oriented system and the permissions are stored as attributes in a permission class.

3. The method as described in claim 1 further comprising:

throwing an access exception to deny access to a requested object in response to determining that the requested access has been denied.

4. The method as described in claim 1 further comprising:

determining whether the requested permission has been granted in response to determining that the requested access has not been denied.

5. The method as described in claim 1 further comprising:

granting the requested access to a requested object in response to determining that the obtained permission indicates that access should be granted.

6. An apparatus comprising:

means, responsive to instantiation of a protection domain, for reading a policy configuration file having a list of granted and/or denied permissions, for retrieving the granted and/or denied permissions, and for associating the granted and/or denied permissions with a private attribute of a protection domain class;

means for defining a second attribute of the protection domain class to identify a permission as a statically or dynamically defined permission;

means for defining a third attribute of the protection domain class to identify whether to save a dynamically defined permission to the policy configuration file;

means, operative at an access control point during execution of a Java applet, for determining the protection domain of a class being examined;

means for accessing a private attribute of the associated protection domain class to obtain a permission that is identified by the second attribute of the protection domain class as a statically defined permission;

means for prompting a user to obtain a permission that is identified by the second attribute of the protection domain class as a dynamically defined permission;

means for analyzing the obtained permission to determine whether access to a requested object has been denied to the protection domain; and

means for saving a dynamically defined permission into the policy configuration file in accordance with the third attribute of the protection domain class.

7. The apparatus as described in claim 6 further including means responsive to the analyzing means determining that the requested access has been denied for throwing an access exception and denying access to a requested object.

8. The apparatus as described in claim 6 further including means responsive to the analyzing means determining that the requested access has not been denied for determining whether the requested permission has been granted.

9. A computer program product in a computer readable medium for denying access to an object in a Java runtime environment, the computer program product comprising:

means, responsive to instantiation of a protection domain, for reading a policy configuration file having a list of granted and/or denied permissions, for retrieving the granted and/or denied permissions, and for associating the granted and/or denied permissions with a private attribute of a protection domain class;

means for defining a second attribute of the protection domain class to identify a permission as a statically or dynamically defined permission;

means for defining a third attribute of the protection domain class to identify whether to save a dynamically defined permission to the policy configuration file;

means, operative at an access control point during execution of a Java applet, for determining the protection domain of a class being examined;

means for accessing a private attribute of the associated protection domain class to obtain a permission that is identified by the second attribute of the protection domain class as a statically defined permission;

means for prompting a user to obtain a permission that is identified by the second attribute of the protection domain class as a dynamically defined permission;

means for analyzing the obtained permission to determine whether access to a requested object has been denied to the protection domain; and

means for saving a dynamically defined permission into the policy configuration file in accordance with the third attribute of the protection domain class.

10. The computer program product as described in claim 9 further including means responsive to the analyzing means determining that the requested access has been denied for throwing an access exception and denying access to a requested object.

11. The computer program product as described in claim 9 further including means responsive to the analyzing means determining that the requested access has not been denied for determining whether the requested permission has been granted.

12. The computer program product as described in claim 11 further including means responsive to a determination that the requested access has been granted for granting a user access to a requested object.

13. A computer comprising:

a Java runtime environment;

means, responsive to instantiation of a protection domain, for reading a policy configuration file having a list of granted and/or denied permissions, for retrieving the granted and/or denied permissions, and for associating the granted and/or denied permissions with a private attribute of a protection domain class;

means for defining a second attribute of the protection domain class to identify a permission as a statically or dynamically defined permission;

means for defining a third attribute of the protection domain class to identify whether to save a dynamically defined permission to the policy configuration file;

means, operative at an access control point during execution of a Java applet, for determining the protection domain of a class being examined;

means for accessing a private attribute of the associated protection domain class to obtain a permission that is identified by the second attribute of the protected domain class as a statically defined permission;

means for prompting a user to obtain a permission that is identified by the second attribute of the protection domain class as a dynamically defined permission;

means for analyzing the obtained permission to determine whether access to a requested object has been denied to the protection domain; and

means for saving a dynamically defined permission into the policy configuration file in accordance with the third attribute of the protection domain class.

14. The computer as described in claim 13 further including means responsive to the analyzing means determining that the requested access has been denied for throwing an access exception and denying access to a requested object.

15. The computer program product as described in claim 14 further including means responsive to the analyzing means determining that the requested access has not been denied for determining whether the requested permission has been granted.

16. The computer as described in claim 15 further including means responsive to a determination that the requested access has been granted for granting a user access to a requested object.