Mechanism for dynamically constructing customized implementations to enforce restrictions

• US 7,131,008 B1
• Filed: 01/14/2000
• Issued: 10/31/2006
• Est. Priority Date: 11/22/1999
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Luehe, Jan, Liu, Sharon S.
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): TRUONG, THANHNGA B
• Application Number:
  US09/483,724
• Time in Patent Office: 2,482 Days
• Field of Search: 713/182, 713/166, 713/164, 703/27, 709/313, 709/205, 709227-229
• US Class Current: 713/182
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

A mechanism for dynamically constructing service implementations to enforce restrictions on services provided to an application is disclosed. When an application desires an implementation for a particular service, the application makes a request to a framework. The framework receives the request and, in response, determines what restrictions, if any, need to be imposed on the requested implementation. Once the restrictions are determined, the framework dynamically constructs the requested implementation. The requested implementation is constructed such that it incorporates a general implementation of the service, the restrictions, and enforcement logic for enforcing the restrictions on the general implementation. Once the requested implementation is constructed, it is provided to the application. Thereafter, the application invokes the requested implementation directly for services. Since the requested implementation incorporates the restrictions and enforcement logic for enforcing the restrictions, it is not necessary for the application to further interact with the framework. The requested implementation itself will provide the services, and will guarantee that the restrictions are enforced. By dynamically constructing requested implementations in this manner, the framework ensures that the necessary restrictions are enforced on the services provided to the application.

Claims

1. In a system comprising at least one application and a framework, a method performed by the framework comprising:

receiving a request from the application for a customized implementation of a service;

determining a set of zero or more restrictions to be imposed upon said customized implementation;

dynamically constructing said customized implementation, said customized implementation incorporating said restrictions, and comprising enforcement logic for enforcing said restrictions; and

providing said customized implementation to the application;

wherein said customized implementation is invocable by the application without further interaction with the framework; and

wherein determining the set of zero or more restrictions comprises;

accessing information specifying one or more limitations;

determining permissions, if any, granted to the application; and

reconciling said limitations and said permissions to derive said restrictions.

2. The method of claim 1, wherein the system further comprises a general implementation for said service, wherein said general implementation is unrestricted, and wherein said customized implementation further incorporates said general implementation.

3. The method of claim 2, wherein said enforcement logic enforces said restrictions on said general implementation.

4. The method of claim 1, wherein said enforcement logic is invoked upon initialization of said customized implementation.

5. The method of claim 4, wherein said enforcement logic, when invoked:

receives a set of desired parameters from the application;

determines whether the desired parameters exceed said restrictions; and

in response to a determination that the desired parameters exceed said restrictions, prevents said customized implementation from operating.

6. The method of claim 4, wherein said service is an encryption/decryption service, and wherein said enforcement logic, when invoked:

determines whether a particular exemption mechanism has been invoked; and

in response to a determination that the particular exemption mechanism has not been invoked, prevents said customized implementation from operating.

7. The method of claim 1, wherein said service is an encryption/decryption service, and wherein said information comprises a set of one or more default encryption limitations.

8. The method of claim 7, wherein said default encryption limitations are derived by merging multiple jurisdiction policies and extracting therefrom the most restrictive encryption limitations.

9. The method of claim 1, wherein said limitations and said permissions are reconciled to derive restrictions which are least restrictive.

10. The method of claim 1, wherein said service is an encryption/decryption service, and wherein said information comprises a set of one or more default encryption limitations, and a set of zero or more exempt encryption limitations which apply when one or more exemption mechanisms are implemented.

11. The method of claim 10, wherein said default encryption limitations and said exempt encryption limitations are derived by merging multiple jurisdiction policies and extracting therefrom the most restrictive encryption limitations.

12. The method of claim 10, wherein reconciling said limitations and said permissions comprises:

determining whether the application has been granted any permissions; and

in response to a determination that the application has not been granted any permissions, deriving said restrictions from said set of default encryption limitations.

13. The method of claim 10, wherein reconciling said limitations and said permissions comprises:

determining whether the application has been granted any permissions which require implementation of a particular exemption mechanism;

in response to a determination that the application has been granted a permission which requires implementation of a particular exemption mechanism, determining whether said exempt encryption limitations allow said particular exemption mechanism to be implemented; and

in response to a determination that said exempt encryption limitations allow said particular exemption mechanism to be implemented, deriving said restrictions from said set of exempt encryption limitations.

14. The method of claim 1, wherein the system further comprises a general implementation for said service, and wherein dynamically constructing said customized implementation comprises:

instantiating the general implementation to give rise to a general implementation instance;

instantiating a wrapper object; and

encapsulating said general implementation instance and said restrictions within said wrapper object to derive said customized implementation.

15. The method of claim 14, wherein said wrapper object comprises one or more invocable methods, wherein said general implementation instance comprises one or more invocable methods, and wherein encapsulating comprises:

mapping one or more of the invocable methods of said wrapper object to one or more of the invocable methods of said general implementation instance.

16. The method of claim 15, wherein said wrapper object comprises initialization logic for enforcing said restrictions on said general implementation instance.

17. The method of claim 16, wherein said initialization logic is invoked prior to allowing any of the invocable methods of said general implementation instance to be invoked.

18. The method of claim 14, further comprising:

instantiating an exemption mechanism to give rise to an exemption mechanism instance; and

encapsulating said exemption mechanism instance within said wrapper object.

55. The method of claim 1, wherein said framework comprises Java Cryptography Extension to Java Platform.

19. In a system comprising at least one application, a framework comprising:

a mechanism for receiving a request from the application for a customized implementation of a service;

a mechanism for determining a set of zero or more restrictions to be imposed upon said customized implementation;

a mechanism for dynamically constructing said customized implementation, said customized implementation incorporating said restrictions, and comprising enforcement logic for enforcing said restrictions; and

a mechanism for providing said customized implementation to the application;

wherein said customized implementation is invocable by the application without further interaction with the framework; and

wherein the mechanism for determining the set of zero or more restrictions comprises;

a mechanism for accessing information specifying one or more limitations;

a mechanism for determining permissions, if any, granted to the application; and

a mechanism for reconciling said limitations and said permissions to derive said restrictions.

20. The framework of claim 19, wherein the system further comprises a general implementation for said service, wherein said general implementation is unrestricted, and wherein the mechanism for dynamically constructing said customized implementation further incorporates said general implementation within said customized implementation.

21. The framework of claim 20, wherein said enforcement logic enforces said restrictions on said general implementation.

22. The framework of claim 19, wherein said enforcement logic is invoked upon initialization of said customized implementation.

23. The framework of claim 22, wherein said enforcement logic, when invoked:

receives a set of desired parameters from the application;

determines whether the desired parameters exceed said restrictions; and

in response to a determination that the desired parameters exceed said restrictions, prevents said customized implementation from operating.

24. The framework of claim 22, wherein said service is an encryption/decryption service, and wherein said enforcement logic, when invoked:

determines whether a particular exemption mechanism has been invoked; and

in response to a determination that the particular exemption mechanism has not been invoked, prevents said customized implementation from operating.

25. The framework of claim 19, wherein said service is an encryption/decryption service, and wherein said information comprises a set of one or more default encryption limitations.

26. The framework of claim 25, wherein said default encryption limitations are derived by merging multiple jurisdiction policies and extracting therefrom the most restrictive encryption limitations.

27. The framework of claim 19, wherein said limitations and said permissions are reconciled to derive restrictions which are least restrictive.

28. The framework of claim 19, wherein said service is an encryption/decryption service, and wherein said information comprises a set of one or more default encryption limitations, and a set of zero or more exempt encryption limitations which apply when one or more exemption mechanisms are implemented.

29. The framework of claim 28, wherein said default encryption limitations and said exempt encryption limitations are derived by merging multiple jurisdiction policies and extracting therefrom the most restrictive encryption limitations.

30. The framework of claim 28, wherein the mechanism for reconciling said limitations and said permissions comprises:

a mechanism for determining whether the application has been granted any permissions; and

a mechanism for deriving, in response to a determination that the application has not been granted any permissions, said restrictions from said set of default encryption limitations.

31. The framework of claim 28, wherein the mechanism for reconciling said limitations and said permissions comprises:

a mechanism for determining whether the application has been granted any permissions which require implementation of a particular exemption mechanism;

a mechanism for determining, in response to a determination that the application has been granted a permission which requires implementation of a particular exemption mechanism, whether said exempt encryption limitations allow said particular exemption mechanism to be implemented; and

a mechanism for deriving, in response to a determination that said exempt encryption limitations allow said particular exemption mechanism to be implemented, said restrictions from said set of exempt encryption limitations.

32. The framework of claim 19, wherein the system further comprises a general implementation for said service, and wherein the mechanism for dynamically constructing said customized implementation comprises:

a mechanism for instantiating the general implementation to give rise to a general implementation instance;

a mechanism for instantiating a wrapper object; and

a mechanism for encapsulating said general implementation instance and said restrictions within said wrapper object to derive said customized implementation.

33. The framework of claim 32, wherein said wrapper object comprises one or more invocable methods, wherein said general implementation instance comprises one or more invocable methods, and wherein the mechanism for encapsulating comprises:

a mechanism for mapping one or more of the invocable methods of said wrapper object to one or more of the invocable methods of said general implementation instance.

34. The framework of claim 33, wherein said wrapper object comprises initialization logic for enforcing said restrictions on said general implementation instance.

35. The framework of claim 34, wherein said initialization logic is invoked prior to allowing any of the invocable methods of said general implementation instance to be invoked.

36. The framework of claim 32, further comprising:

a mechanism for instantiating an exemption mechanism to give rise to an exemption mechanism instance; and

a mechanism for encapsulating said exemption mechanism instance within said wrapper object.

56. The framework of claim 19, wherein said framework comprises Java Cryptography Extension to Java Platform.

37. In a system comprising at least one application, a computer readable medium having stored thereon instructions which, when executed by one or more processors, cause the one or more processors to implement a framework which dynamically constructs a customized implementation of a service, said computer readable medium comprising:

instructions for causing one or more processors to receive a request from the application for a customized implementation of a service;

instructions for causing one or more processors to determine a set of zero or more restrictions to be imposed upon said customized implementation;

instructions for causing one or more processors to dynamically construct said customized implementation, said customized implementation incorporating said restrictions, and comprising enforcement logic for enforcing said restrictions; and

instructions for causing one or more processors to provide said customized implementation to the application;

wherein said customized implementation is invocable by the application without further interaction with the framework;

wherein the instructions for causing one or more processors to determine the set of zero or more restrictions comprise;

instructions for causing one or more processors to access information specifying one or more limitations;

instructions for causing one or more processors to determine permissions, if any, granted to the application; and

instructions for causing one or more processors to reconcile said limitations and said permissions to derive said restrictions.

38. The computer readable medium of claim 37, wherein the system further comprises a general implementation for said service, wherein said general implementation is unrestricted, and wherein said customized implementation further incorporates said general implementation.

39. The computer readable medium of claim 38, wherein said enforcement logic enforces said restrictions on said general implementation.

40. The computer readable medium of claim 37, wherein said enforcement logic is invoked upon initialization of said customized implementation.

41. The computer readable medium of claim 40, wherein said enforcement logic, when invoked:

receives a set of desired parameters from the application;

determines whether the desired parameters exceed said restrictions; and

in response to a determination that the desired parameters exceed said restrictions, prevents said customized implementation from operating.

42. The computer readable medium of claim 40, wherein said service is an encryption/decryption service, and wherein said enforcement logic, when invoked:

determines whether a particular exemption mechanism has been invoked; and

in response to a determination that the particular exemption mechanism has not been invoked, prevents said customized implementation from operating.

43. The computer readable medium of claim 37, wherein said service is an encryption/decryption service, and wherein said information comprises a set of one or more default encryption limitations.

44. The computer readable medium of claim 43, wherein said default encryption limitations are derived by merging multiple jurisdiction policies and extracting therefrom the most restrictive encryption limitations.

45. The computer readable medium of claim 37, wherein said limitations and said permissions are reconciled to derive restrictions which are least restrictive.

46. The computer readable medium of claim 37, wherein said service is an encryption/decryption service, and wherein said information comprises a set of one or more default encryption limitations, and a set of zero or more exempt encryption limitations which apply when one or more exemption mechanisms are implemented.

47. The computer readable medium of claim 46, wherein said default encryption limitations and said exempt encryption limitations are derived by merging multiple jurisdiction policies and extracting therefrom the most restrictive encryption limitations.

48. The computer readable medium of claim 46, wherein the instructions for causing one or more processors to reconcile said limitations and said permissions comprises:

instructions for causing one or more processors to determine whether the application has been granted any permissions; and

instructions for causing one or more processors to derive, in response to a determination that the application has not been granted any permissions, said restrictions from said set of default encryption limitations.

49. The computer readable medium of claim 46, wherein the instructions for causing one or more processors to reconcile said limitations and said permissions comprises:

instructions for causing one or more processors to determine whether the application has been granted any permissions which require implementation of a particular exemption mechanism;

instructions for causing one or more processors to determine, in response to a determination that the application has been granted a permission which requires implementation of a particular exemption mechanism, whether said exempt encryption limitations allow said particular exemption mechanism to be implemented; and

instructions for causing one or more processors to derive, in response to a determination that said exempt encryption limitations allow said particular exemption mechanism to be implemented, said restrictions from said set of exempt encryption limitations.

50. The computer readable medium of claim 37, wherein the system further comprises a general implementation for said service, and wherein the instructions for causing one or more processors to dynamically construct said customized implementation comprises:

instructions for causing one or more processors to instantiate the general implementation to give rise to a general implementation instance;

instructions for causing one or more processors to instantiate a wrapper object; and

instructions for causing one or more processors to encapsulate said general implementation instance and said restrictions within said wrapper object to derive said customized implementation.

51. The computer readable medium of claim 50, wherein said wrapper object comprises one or more invocable methods, wherein said general implementation instance comprises one or more invocable methods, and wherein the instructions for causing one or more processors to encapsulate comprises:

instructions for causing one or more processors to map one or more of the invocable methods of said wrapper object to one or more of the invocable methods of said general implementation instance.

52. The computer readable medium of claim 51, wherein said wrapper object comprises initialization logic for enforcing said restrictions on said general implementation instance.

53. The computer readable medium of claim 52, wherein said initialization logic is invoked prior to allowing any of the invocable methods of said general implementation instance to be invoked.

54. The computer readable medium of claim 50, further comprising:

instructions for causing one or more processors to instantiate an exemption mechanism to give rise to an exemption mechanism instance; and

instructions for causing one or more processors to encapsulate said exemption mechanism instance within said wrapper object.

57. The computer readable medium of claim 37, wherein said framework comprises Java Cryptography Extension to Java Platform.