Techniques for permitting access across a context barrier in a small footprint device using global data structures

• US 7,395,535 B2
• Filed: 11/22/2004
• Issued: 07/01/2008
• Est. Priority Date: 01/22/1999
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Streich, Andy, Susser, Joshua, Butler, Mitchel B.
• Primary Examiner(s): An; Meng-Ai
• Assistant Examiner(s): Truong; Camquy
• Application Number:
  US10/995,926
• Publication Number:
  US 20050102679A1
• Time in Patent Office: 1,317 Days
• Field of Search: 718/1, 718100-108
• US Class Current: 718/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/3576 Multiple memory zones on card
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A small footprint device can securely run multiple programs from unrelated vendors by the inclusion of a context barrier isolating the execution of the programs. The context barrier performs security checks to see that principal and object are within the same namespace or memory space and to see that a requested action is appropriate for an object to be operated upon. Each program or set of programs runs in a separate context. Access from one program to another program across the context barrier can be achieved under controlled circumstances by using a global data structure.

Claims

1. A small footprint device comprising:

at least one processing element configured to execute each group of groups of one or more program modules in a different context, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts wherein each different context owns at least one group of said groups associated with said different context and further wherein said each context comprises a protected object instance space such that at least one of said object definitions is instantiated in association with that context, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of executable instructions of a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first context and whether said at least one instruction is requesting access to an instance of an object definition associated with a second context different from said first context, said context barrier further configured to prevent said access if said access is unauthorized and to enable said access if said access is authorized; and

a global data structure for permitting at least one program module in a first group of said groups of one or more program modules to access information from at least another program module in a second group of said groups of one or more program modules by bypassing said context barrier through using said global data structure directly.

2. The small footprint device of claim 1 wherein said context barrier allocates separate name spaces for each program module.

3. The small footprint device of claim 2 wherein at least two program modules can access said global data structure even though they are located in different respective name spaces.

4. The small footprint device of claim 1 wherein said context barrier allocates a separate memory space for each program module.

5. The small footprint device of claim 4 wherein at least two program modules can access said global data structure even though they are located in different respective memory spaces.

6. The small footprint device of claim 1 wherein said program modules comprise at least one of a principal or an object and wherein said context barrier enforces security checks on at least one of a principal, an object and an action.

7. The small footprint device of claim 6 wherein at least one security check is based on partial name agreement between a principal and an object.

8. The small footprint device of claim 7 wherein at least one program module can access said global data structure without said at least one security check.

9. The small footprint device of claim 6 wherein at least one security check is based on memory space agreement between a principal and an object.

10. The small footprint device of claim 9 wherein at least one program can access a global data structure without said at least one security check.

11. The small footprint device of claim 1 wherein

said memory comprises object header data, said object header data comprising information associated with at least one of said instances of objects;

and

said controlling execution is based at least in part on said object header data.

12. The small footprint device of claim 1 wherein

said memory is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of memory spaces;

and

said controlling execution is based at least in part on determining the memory space allocated to an executing object instance and an accessed object instance.

13. A method of operating a small footprint device that includes a processing machine, wherein program modules are executed on the processing machine, the method comprising:

separating contexts using a context barrier;

controlling execution, by said context barrier, of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of one or more separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said one or more separate contexts, said separating further comprising;

preventing said access if said access is unauthorized; and

enabling said access if said access is authorized;

executing groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, wherein each different context owns at least one group of said groups associated with said different context and further wherein each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context; and

permitting access to information across said context barrier by bypassing said context barrier using a global data structure wherein said global data structure permits at least one program module in a first group, in a first context, of said groups of one or more program modules to directly access information from at least another program module in a second group, in a second context, of said groups of one or more program modules.

14. The method of claim 13 wherein said controlling execution is based at least in part on object header data comprising information associated with at least one of said instances of objects.

15. The method of claim 13 wherein

a memory of said small footprint device is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of memory spaces;

and

said controlling execution is based at least in part on determining the memory space allocated to an executing object instance and an accessed object instance.

16. The method of claim 13 wherein said program modules comprise at least one of a principal or an object and further comprising:

preventing, by said context barrier, a principal from performing an action on an object unless both principal and object are part of the same context unless the request is for access to a global data structure.

17. A method of permitting access to information on a small footprint device from a first program module to a second program module separated by a context barrier, said small footprint device comprising:

at least one processing element configured to execute each group of groups of one or more program modules in a different context, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts wherein each different context owns at least one group of said groups associated with said different context and further wherein said each context comprises a protected object instance space such that at least one of said object definitions is instantiated in association with that context, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of executable instructions of a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first context and whether said at least one instruction is requesting access to an instance of an object definition associated with a second context different from said first context, said context barrier further configured to prevent, said access if said access is unauthorized and to enable said access if said access is authorized, the method comprising;

creating a global data structure which may be accessed by at least two program modules; and

using said global data structure to permit access to information across said context barrier by bypassing said context barrier wherein said global data structure permits at least one program module in a first group, in a first context, of said groups of one or more program modules to directly access information from at least another program module in a second group, in a second context, of said groups of one or more program modules.

18. The method of claim 17 wherein said controlling execution is based at least in part on object header data comprising information associated with at least one of said instances of objects.

19. The method of claim 17 wherein

a memory of said small footprint device is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of memory spaces;

and

said controlling execution is based at least in part on determining the memory space allocated to an executing object instance and an accessed object instance.

20. A method of communicating across a context barrier separating program modules on a small footprint device, said small footprint device comprising:

at least one processing element configured to execute each group of groups of one or more program modules in a different context, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts wherein each different context owns at least one group of said groups associated with said different context and further wherein said each context comprises a protected object instance space such that at least one of said object definitions is instantiated in association with that context, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of executable instructions of a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first context and whether said at least one instruction is requesting access to an instance of an object definition associated with a second context different from said first context, said context barrier further configured to prevent said access if said access is unauthorized and to enable said access if said access is authorized, the method comprising;

creating a global data structure;

permitting at least one program module, in a first group, in a first context, of said groups of one or more program modules, to write information to said global data structure; and

having at least one other program module, in a second group, in a second context, of said groups of one or more program modules, read information directly from said global data structure, bypassing said context barrier.

21. The method of claim 20 wherein said controlling execution is based at least in part on object header data comprising information associated with at least one of said instances of objects.

22. The method of claim 20 wherein

a memory of said small footprint device is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of memory spaces;

and

said controlling execution is based at least in part on determining the memory space allocated to an executing object instance and an accessed object instance.

23. A computer program product, comprising:

a memory storage medium having stored therein a computer controlling element comprising instructions for implementing a context barrier on a small footprint device and for bypassing said context barrier using a global data structure wherein said global data structure permits at least one program module in a first group, in a first context, of groups of one or more program modules to directly access information from at least another program module in a second group, in a second context, of said groups of one or more program modules, said small footprint device comprising;

at least one processing element configured to execute each group of said groups of one or more program modules in a different context, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts wherein each different context owns at least one group of said groups associated with said different context and further wherein said each context comprises a protected object instance space such that at least one of said object definitions is instantiated in association with that context, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of executable instructions of a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first context and whether said at least one instruction is requesting access to an instance of an object definition associated with a second context different from said first context, said context barrier further configured to prevent said access if said access is unauthorized and to enable said access if said access is authorized.

24. A computer program product, comprising:

a memory storage medium having stored therein a computer controlling element comprising instructions for separating a plurality of programs on a small footprint device by running them in respective contexts and for permitting at least one program to access information from at least another program by bypassing a context barrier using a global data structure wherein said global data structure permits said at least one program in a first context to directly access said information from said at least another program module in a second context, said small footprint device comprising;

at least one processing element configured to execute each group of groups of one or more program modules in a different context, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions;

a memory comprising instances of objects; and

a context barrier for separating and isolating said contexts wherein each different context owns at least one group of said groups associated with said different context and further wherein said each context comprises a protected object instance space such that at least one of said object definitions is instantiated in association with that context, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of executable instructions of a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first context and whether said at least one instruction is requesting access to an instance of an object definition associated with a second context different from said first context, said context barrier further configured to prevent said access if said access is unauthorized and to enable said access if said access is authorized.