Techniques for permitting access across a context barrier on a small footprint device using an entry point object

• US 7,607,175 B2
• Filed: 09/09/2003
• Issued: 10/20/2009
• Est. Priority Date: 01/22/1999
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Streich, Andy, Susser, Joshua, Butler, Mitchel B.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): POLTORAK, PIOTR
• Application Number:
  US10/659,554
• Publication Number:
  US 20050193218A1
• Time in Patent Office: 2,233 Days
• Field of Search: 726/7
• US Class Current: 726/27
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

A small footprint device can securely run multiple programs from unrelated vendors by the inclusion of a context barrier isolating the execution of the programs. The context barrier performs security checks to see that principal and object are within the same namespace or memory space and to see that a requested action is appropriate for an object to be operated upon. Each program or set of programs runs in a separate context. Access from one program to another program across the context barrier can be achieved under controlled circumstances by using an entry point object. The entry point object can either perform accesses across the context barrier on behalf of a requesting program or can pass the request to the program to be accessed and switch contexts to the program to be accessed.

Claims

1. A small footprint device comprising:

at least one processing element, on said small footprint device, configured to execute groups of one or more program modules in separate contexts, wherein said separate contexts are included in a runtime environment on said small footprint device, and further wherein said runtime environment includes an operating system where said separate contexts are removed from and over said operating system on said small footprint device,

wherein said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions,

said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, and

each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context;

a memory, on the small footprint device, comprising instances of objects;

a context barrier, in said runtime environment and removed from and over said operating system, for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized; and

an entry point object, in said runtime environment and removed from and over said operating system, for permitting one program module, in one of said separate contexts, to directly access information from another program module, in another of said separate contexts, across said context barrier.

2. The small footprint device of claim 1 in which said context barrier allocates separate name spaces for each program module.

3. The small footprint device of claim 1 in which at least two program modules can access said entry point object even though they are located in different respective name spaces.

4. The small footprint device of claim 1 in which said context barrier allocates separate memory spaces for each program module.

5. The small footprint device of claim 4 in which at least two program modules can access said entry point object even though they are located in different respective memory spaces.

6. The small footprint device of claim 1 in which said context barrier enforces security checks on at least one of a principal, an object, and an action.

7. The small footprint device of claim 6 in which at least one security check is based on partial name agreement between a principal, and an object.

8. The small footprint device of claim 7 in which at least one program can access said entry point object without said at least one security check.

9. The small footprint device of claim 6 in which at least one security check is based on memory space agreement between a principal and an object.

10. The small footprint device of claim 9 in which at least one program can access said entry point object without said at least one security check.

11. The small footprint device of claim 1 wherein an object instance is associated with a context by recording the name of said context in a header of said object instance, information in said header inaccessible to said one or more program modules.

12. The small footprint device of claim 1 wherein

said memory comprises object header data, said object header data comprising information associated with at least one of said instances of objects;

and

said controlling execution is based at least in part on said object header data.

13. The small footprint device of claim 1 wherein

said memory is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of storage spaces;

and

said controlling execution is based at least in part on determining the storage space allocated to an executing object instance and an accessed object instance.

14. A method of operating a small footprint device that includes a processing machine, wherein program modules are executed on the processing machine, the method comprising:

separating contexts, on said small footprint device, using a context barrier, said context barrier configured for controlling execution of at least one instruction of one of zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said separate contexts, wherein said separate contexts and said context barrier are included in a runtime environment on said small footprint device and further wherein said runtime environment includes an operating system where said separate contexts and said context barrier are removed from and over said operating system,

said separating further comprising;

preventing said access if said access is unauthorized; and

enabling said access if said access is authorized;

executing groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context; and

permitting direct access to information from one program module, in one of said separate contexts, by another program module, in another of said separate contexts, across said context barrier using an entry point object wherein said entry point object is in said runtime environment and is removed from and over said operating system.

15. The method of claim 14 wherein an object instance is associated with a context by recording the name of said context in a header of said object instance, information in said header inaccessible to said one or more program modules.

16. The method of claim 14 wherein said controlling execution is based at least in part on object header data comprising information associated with at least one of said instances of objects.

17. The method of claim 14 wherein

a memory of said small footprint device is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of storage spaces;

and

said controlling execution is based at least in part on determining the storage space allocated to an executing object instance and an accessed object instance.

18. A method of permitting access to information on a small footprint device from a first program module to a second program module separated by a context barrier, said small footprint device comprising:

at least one processing element, on the small footprint device, configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context wherein said separate contexts are included in a runtime environment on the small footprint device and further wherein said runtime environment includes an operating system where said separate contexts are removed from and over said operating system;

a memory, on said small footprint device, comprising instances of objects; and

a context barrier, in said runtime environment and removed from and over said operating system, for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized, the method comprising;

creating an entry point object, in said runtime environment and removed from and over said operating system, which may be accessed by at least two program modules; and

using said entry point object to permit direct access to information from one program module of said at least two program modules, in one of said separate contexts, by an other program module of said at least two program modules, in another of said separate contexts, across said context barrier.

19. The method of claim 18 wherein an object instance is associated with a context by recording the name of said context in a header of said object instance, information in said header inaccessible to said one or more program modules.

20. The method of claim 18 wherein said controlling execution is based at least in part on object header data comprising information associated with at least one of said instances of objects.

21. The method of claim 18 wherein

a memory of said small footprint device is partitioned into a plurality of memory spaces with instances of objects allocated for storage in one of said plurality of storage spaces;

and

said controlling execution is based at least in part on determining the storage space allocated to an executing object instance and an accessed object instance.

22. A computer program product, comprising:

a memory storage medium; and

a computer controlling element comprising instructions for implementing a context barrier on a small footprint device and for bypassing said context barrier using an entry point object to permit direct access to information from one program module, in one context, by another program module, in a different separate context, wherein said context barrier and said entry point object are included in a runtime environment on the small footprint device and further wherein said runtime environment includes an operating system where said context barrier and said entry point are removed from and over said operating system, said small footprint device comprising;

at least one processing element, on said small footprint device, configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context where said separate contexts are included in said runtime environment and are removed from and over said operating system;

a memory, on the small footprint device, comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized.

23. A computer program product, comprising:

a memory storage medium; and

a computer controlling element comprising instructions for separating a plurality of programs on a small footprint device by running them in respective contexts and for permitting one program to access information from another program by bypassing a context barrier using an entry point object to permit direct access to information from one program, in one context, by another program in a different separate context, wherein said context barrier and said entry point object are included in a runtime environment on the small footprint device and further wherein said runtime environment includes an operating system where said context barrier and said entry point are removed from and over said operating system, said small footprint device comprising;

at least one processing element, on said small footprint device, configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context where said separate contexts are included in said runtime environment and are removed from and over said operating system;

a memory, on the small footprint device, comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized.

24. A method of transmitting code over a network, comprising transmitting a block of code from a server, said block of code comprising instructions for implementing an entry point object for bypassing a context barrier on a small footprint device over a communications link, wherein said context barrier and said entry point object are included in a runtime environment and further wherein said runtime environment includes an operating system where said context barrier and said entry point are removed from and over said operating system and further wherein said entry point object permits direct access to information from one program module, in one context, by another program module in another different context, said small footprint device comprising:

at least one processing element, on the small footprint device, configured to execute groups of one or more program modules in separate contexts, said one or more program modules comprising zero or more sets of executable instructions and zero or more sets of data definitions, said zero or more sets of executable instructions and said zero or more data definitions grouped as object definitions, each context comprising a protected object instance space such that at least one of said object definitions is instantiated in association with a particular context where said separate contexts are included in said runtime environment, on the small footprint device, and are removed from and over said operating system;

a memory, on the small footprint device, comprising instances of objects; and

a context barrier for separating and isolating said contexts, said context barrier configured for controlling execution of at least one instruction of one of said zero or more sets of instructions comprised by a program module based at least in part on whether said at least one instruction is executed for an object instance associated with a first one of said separate contexts and whether said at least one instruction is requesting access to an instance of an object definition associated with a second one of said separate contexts, said context barrier further configured to prevent said access if said access is unauthorized and enable said access if said access is authorized.