Techniques for permitting access across a context barrier on a small footprint device using run time environment privileges

• US 6,922,835 B1
• Filed: 01/22/1999
• Issued: 07/26/2005
• Est. Priority Date: 01/22/1999
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Streich, Andy, Susser, Joshua, Butler, Mitchel B.
• Primary Examiner(s): An, Meng-Al T.
• Assistant Examiner(s): Opie, George L.
• Application Number:
  US09/235,155
• Time in Patent Office: 2,377 Days
• Field of Search: 719/313, 719/315, 719/316, 713/167, 718/100, 718/108, 709/100, 709/108, 709/211, 709214-217, 709/380, 709/382.5, 709/310, 709/312, 709/235
• US Class Current: 719/316
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

A small footprint device can securely run multiple programs from unrelated vendors by the inclusion of a context barrier isolating the execution of the programs. The context barrier performs security checks to see that principal and object are within the same context or to see that a requested action is authorized for an object to be operated upon. Each program or set of programs runs in a separate context, however, one context has access to all program modules without context barrier constraints.

Claims

1. A small footprint device comprising:

at least one processing element configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory comprising instances of objects;

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized; and

one context having access to all program modules without context barrier constraints.

2. The small footprint device of claim 1 in which said context is used for access to at least one program module across a context barrier.

3. The small footprint device of claim 1 in which said context allocates separate name spaces for each program module.

4. The small footprint device of claim 3 in which said context can access at least one other program module even though it is located in a different name space.

5. The small footprint device of claim 1 in which said context allocates separate memory spaces for each program module.

6. The small footprint device of claim 5 in which said context can access at least one program module even though it is located in a different memory space.

7. The small footprint device of claim 1 in which said context barrier enforces security checks on at least one of a principal, an object and an action.

8. The small footprint device of claim 7 in which at least one security check is based on partial name agreement between a principal and an object.

9. The small footprint device of claim 8 in which said context can access at least one other context without said at least one security check.

10. The small footprint device of claim 7 in which at least one security check is based on memory space agreement between a principal and an object.

11. The small footprint device of claim 10 in which said context can access at least one other context without said at least one security check.

12. The small footprint device of claim 1 wherein an object instance is associated with a context by recording the name of said context in a header of said object instance, information in said header inaccessible to said one or more program modules.

13. The small footprint device of claim 1 wherein

said memory comprises object header data, said object header data comprising information associated with at least one of said instances of objects;

and

said controlling execution is based at least in part on said object header data.

14. The small footprint device of claim 1 wherein

said memory is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of storage spaces;

and

said controlling execution is based at least in part on determining the storage space allocated to an executing object instance and an accessed object instance.

15. A method of operating a small footprint device that includes a processing machine, wherein program modules are executed on the processing machine, the method comprising:

separating contexts using a context barrier, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said separating further comprising;

preventing said access if said access is unauthorized; and

enabling said access if said access is authorized;

executing groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context; and

permitting one context in said small footprint device access to at least one other context in said small footprint device without context barrier constraints.

16. The method of claim 15 in which the context barrier will not permit a principal to perform an action on an object unless both principal and object are part of the same context or the principal is part of said one context.

17. The method of claim 15 wherein an object instance is associated with a context by recording the name of said context in a header of said object instance, information in said header inaccessible to said one or more program modules.

18. The method of claim 15 wherein said controlling execution is based at least in part on object header data comprising information associated with at least one of said instances of objects.

19. The method of claim 15 wherein

a memory of said small footprint device is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of storage spaces;

and

said controlling execution is based at least in part on determining the storage space allocated to an executing object instance and an accessed object instance.

20. A method of permitting access to information on a small footprint device from a first program module to a second program module separated by a context barrier, the small footprint device comprising:

at least one processing element configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized, the method comprising;

creating a context in said small footprint device, said context having access to all program modules without context barrier constraints.

21. The method of claim 20 in which said context is a supercontext.

22. The method of claim 20 wherein an object instance is associated with a context by recording the name of said context in a header of said object instance, information in said header inaccessible to said one or more program modules.

23. The method of claim 20 wherein said controlling execution is based at least in part on object header data comprising information associated with at least one of said instances of objects.

24. The method of claim 20 wherein

a memory of said small footprint device is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of storage spaces;

and

said controlling execution is based at least in part on determining the storage space allocated to an executing object instance and an accessed object instance.

25. A method of communicating across a context barrier separating program modules on a small footprint device, the small footprint device comprising:

at least one processing element configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized, the method comprising;

creating a context in said small footprint device, said context having access to all program modules without context barrier constraints; and

permitting said context to access information of another program module across said context barrier.

26. The method of claim 25 wherein an object instance is associated with a context by recording the name of said context in a header of said object instance, information in said header inaccessible to said one or more program modules.

27. The method of claim 25 wherein said controlling execution is based at least in part on object header data comprising information associated with at least one of said instances of objects.

28. The method of claim 25 wherein

a memory of said small footprint device is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of storage spaces;

and

said controlling execution is based at least in part on determining the storage space allocated to an executing object instance and an accessed object instance.

29. A method of communicating across a context barrier separating program modules on a small footprint device;

the small footprint device comprising;

at least one processing element configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized, the method comprising;

creating a context in said small footprint device, said context having access to all program modules without context barrier constraints; and

permitting at least one program module to access information of another program module across said context barrier using said context.

30. The method of claim 29 wherein an object instance is associated with a context by recording the name of said context in a header of said object instance, information in said header inaccessible to said one or more program modules.

31. The method of claim 29 wherein said controlling execution is based at least in part on object header data comprising information associated with at least one of said instances of objects.

32. The method of claim 29 wherein

a memory of said small footprint device is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of storage spaces;

and

said controlling execution is based at least in part on determining the storage space allocated to an executing object instance and an accessed object instance.

33. A computer program product, comprising:

a memory medium; and

a computer controlling element comprising instructions for implementing a context barrier on a small footprint device and for giving one context in said small footprint device access to all program modules without context barrier constraints, said small footprint device comprising;

at least one processing element configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized.

34. The computer program product of claim 33 in which said medium is a carrier wave.

35. A computer program product, comprising:

a memory medium; and

a computer controlling element comprising instructions for separating a plurality of programs on a small footprint device by running them in respective contexts and for permitting one context in said resource constrained device to have access to all program modules without context barrier constraints, said small footprint device comprising;

at least one processing element configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized.

36. The computer program product of claim 35, in which said medium is a carrier wave.

37. A carrier wave carrying instructions over a communications link for implementing a context in said resource constrained device, said context having access to all program modules on a small footprint device without context barrier constraints, said small footprint device comprising:

at least one processing element configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized.

38. A carrier wave carrying instructions over a communications link for implementing a context barrier separating a plurality of programs on a small footprint device by running them in respective contexts and for permitting one context in said resource constrained device to access all programs without context barrier constraints, said small footprint device comprising:

at least one processing element configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized.

39. A method of transmitting code over a network, comprising transmitting a block of code from a server, said block of code comprising instructions for implementing a context in said small footprint device, said context having access to all program modules for providing access across a context barrier, said small footprint device comprising:

at least one processing element configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized.

40. An apparatus for communicating across a context barrier separating program modules on a small footprint device, said small footprint device comprising:

at least one processing element configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized, said apparatus comprising;

means for creating a context in said small footprint device, said context having access to all program modules without context barrier constraints; and

means for permitting said context to access information of another program module across said context barrier.

41. An apparatus for communicating across a context barrier separating program modules on a small footprint device, said small footprint device comprising:

at least one processing element configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized, said apparatus comprising;

means for creating a context in said small footprint device, said context having access to all program modules without context barrier constraints; and

means for permitting at least one program module to access information of another program module across said context barrier using said context.