Methods, systems, and data structures for loading and authenticating a module

• US 8,468,330 B1
• Filed: 06/30/2003
• Issued: 06/18/2013
• Est. Priority Date: 06/30/2003
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Reed, Edwards E., Acar, T Iga
• Primary Examiner(s): McNally, Michael S
• Assistant Examiner(s): Johnson, Carlton
• Application Number:
  US10/612,666
• Time in Patent Office: 3,641 Days
• Field of Search: 713/2, 713/156, 713/164, 713/194
• US Class Current: 713/2
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs

Abstract

Methods, systems, and data structures are provided for loading, authenticating, and configuring a module. A loader authenticates the identity of an instance of the module and configuration data associated with the instance of the module. Additionally, the loader generates a loadable executable instance of the module and loads the executable instance into a customized execution environment based on the configuration data. Moreover, the loader attests to the identity of the executable instance by providing one or more assertions as an attestation. The presence of the attestation provides evidence to support automatic identity and configuration authentication for the loaded executable instance, when the executable instance requests external resources that require authentication, or when the identity of the loadable executable instance is requested.

Claims

1. A method to load a module, comprising:

establishing, on a computer system, an execution environment for a plurality of executable instances of a module;

processing, by a loader module of the execution environment, restrictions embodied in a configuration data file, the restrictions defining processing capabilities for each of the plurality of executable instances, access levels for each of the plurality of executable instances within the execution environment, and an identity for each of the plurality of executable instances within the execution environment, each of the plurality of executable instances having its own independent access levels, unique identity, and attributes within the execution environment, the configuration data file also signed by a configuring authority;

loading, by the loader module, each of the plurality of executable instances in the execution environment based on the processing of the restrictions in the configuration data file; and

attesting to the identity of each of the plurality of executable instances by the loader module, attesting comprises generating, by the loader module and based at least in part on the configuration data file, attestation for an assertion of the instance and the assertion comprises an encrypted and digitally signed plurality of Security Assertion Markup Language (SAML) statements, the SAML statements comprising;

a statement identifying who made the assertion,

one or more statements identifying reasons for assuming the assertion is true,

one or more statements identifying evidence that forms the basis of the reasons,

one or more statements identifying a manner in which the assertion was verified,

a statement identifying by whom the assertion was verified,

a statement identifying when the assertion was verified,

one or more statements identifying indications as to what the instance of the module is authorized to do within a given context,

a statement indicating that a checksum for the instance was validated for integrity of the instance, and

one or more statements instructing a requesting resource on resource needs required by the instance within the execution environment;

wherein an external resource relies on the attestation as a testament that the identity is authentic and as an indication that the instance is permitted to access the external resource.

2. The method of claim 1 wherein establishing further includes authenticating the module and the identity of each of the plurality of instances.

3. The method of claim 1 further comprising providing, by the loader module, a response to an external resource that requests the identity or configuration of at least one of the plurality of instances.

4. The method of claim 3 further comprising providing a response to the external resource that attest to the identity of the at least one instance.

5. The method of claim 1, further comprising:

receiving, by the loader module from a loaded instance of the plurality of executable instances, a request to access a resource, the access requires authorization;

receiving, by the loader module from the loaded instance, an attestation that is associated with the loaded instance;

authenticating, by the loader module, the loaded instance based on the attestation and without the use of any keys, and

tracking, by the loader module, actions of the loaded instance within the execution environment.

6. The method of claim 5 further comprising, ensuring that a certificate associated with the instance has not expired or been revoked before granting the instance access to the resource.

7. The method of claim 6 wherein ensuring further includes, querying the certificate authority to determine if the certificate has been revoked since the loader provided the attestation.

8. The method of claim 5 wherein identifying further includes, a known to be secure and trusted loader as the loader.

9. A system comprising:

a processor; and

a memory coupled with and readable by the processor and having stored thereon a sequence of instructions which, when executed by the processor, causes the processor to establish an execution environment for a plurality of executable instances of a module and load the module into the execution environment by;

processing, by a loader module of the execution environment, restrictions embodied in a configuration data, the restrictions-defining processing capabilities for each of the plurality of executable instances, access levels for each of the plurality of executable instances within the execution environment, and an identity for each of the plurality of executable instances within the execution environment, each of the plurality of executable instances having its own independent access levels, unique identity, and attributes within the execution environment, the configuration data file also signed by a configuring authority,

loading, by the loader module, each of the plurality of executable instances in the execution environment based on the processing of the restrictions in the configuration data file, and

attesting to the identity of each of the plurality of executable instances by the loader module, attesting comprises generating, by the loader module and based at least in part on the configuration data file, attestation for an assertion of the instance and the assertion comprises an encrypted and digitally signed plurality of Security Assertion Markup Language (SAML) statements, the SAML statements comprising;

a statement identifying who made the assertion,

one or more statements identifying reasons for assuming the assertion is true,

one or more statements identifying evidence that forms the basis of the reasons,

one or more statements identifying a manner in which the assertion was verified,

a statement identifying by whom the assertion was verified,

a statement identifying when the assertion was verified,

one or more statements identifying indications as to what the instance of the module is authorized to do within a given context,

a statement indicating that a checksum for the instance was validated for integrity of the instance, and

one or more statements instructing a requesting resource on resource needs required by the instance within the execution environment;

wherein an external resource relies on the attestation as a testament that the identity is authentic and as an indication that the instance is permitted to access the external resource.

10. The system of claim 9 wherein establishing further includes authenticating the module and the identity of each of the plurality of instances.

11. The system of claim 9 further comprising providing, by the loader module, a response to an external resource that requests the identity or configuration of at least one of the plurality of instances.

12. The system of claim 11 further comprising providing a response to the external resource that attest to the identity of the at least one instance.

13. The system of claim 9, further comprising:

receiving, by the loader module from a loaded instance of the plurality of executable instances, a request to access a resource, the access requires authorization;

receiving, by the loader module from the loaded instance, an attestation that is associated with the loaded instance;

authenticating, by the loader module, the loaded instance based on the attestation and without the use of any keys; and

tracking, by the loader module, actions of the loaded instance within the execution environment.

14. The system of claim 13 further comprising, ensuring that a certificate associated with the instance has not expired or been revoked before granting the instance access to the resource.

15. The system of claim 14 wherein ensuring further includes, querying the certificate authority to determine if the certificate has been revoked since the loader provided the attestation.

16. The system of claim 13 wherein identifying further includes, a known to be secure and trusted loader as the loader.

17. A computer-readable memory having stored therein a sequence of instructions which, when executed by a processor, causes the processor to establish an execution environment for a plurality of executable instances of a module and load the module into the execution environment by:

processing, by a loader module of the execution environment, restrictions embodied in a configuration data, the restrictions-defining processing capabilities for each of the plurality of executable instances, access levels for each of the plurality of executable instances within the execution environment, and an identity for each of the plurality of executable instances within the execution environment, each of the plurality of executable instances having its own independent access levels, unique identity, and attributes within the execution environment, the configuration data file also signed by a configuring authority,

loading, by the loader module, each of the plurality of executable instances in the execution environment based on the processing of the restrictions in the configuration data file, and

attesting to the identity of each of the plurality of executable instances by the loader module, attesting comprises generating, by the loader module and based at least in part on the configuration data file, attestation for an assertion of the instance and the assertion comprises an encrypted and digitally signed plurality of Security Assertion Markup Language (SAML) statements, the SAML statements comprising;

a statement identifying who made the assertion,

one or more statements identifying reasons for assuming the assertion is true,

one or more statements identifying evidence that forms the basis of the reasons,

one or more statements identifying a manner in which the assertion was verified,

a statement identifying by whom the assertion was verified,

a statement identifying when the assertion was verified,

one or more statements identifying indications as to what the instance of the module is authorized to do within a given context,

a statement indicating that a checksum for the instance was validated for integrity of the instance, and

one or more statements instructing a requesting resource on resource needs required by the instance within the execution environment;

wherein an external resource relies on the attestation as a testament that the identity is authentic and as an indication that the instance is permitted to access the external resource.

18. The computer-readable memory of claim 17 wherein establishing further includes authenticating the module and the identity of each of the plurality of instances.

19. The computer-readable memory of claim 17 further comprising providing, by the loader module, a response to an external resource that requests the identity or configuration of at least one of the plurality of instances.

20. The computer-readable memory of claim 19 further comprising providing a response to the external resource that attest to the identity of the at least one instance.

21. The computer-readable memory of claim 17, further comprising:

receiving, by the loader module from a loaded instance of the plurality of executable instances, a request to access a resource, the access requires authorization;

receiving, by the loader module from the loaded instance, an attestation that is associated with the loaded instance;

authenticating, by the loader module, the loaded instance based on the attestation and without the use of any keys; and

tracking, by the loader module, actions of the loaded instance within the execution environment.

22. The computer-readable memory of claim 21 further comprising, ensuring that a certificate associated with the instance has not expired or been revoked before granting the instance access to the resource.

23. The computer-readable memory of claim 22 wherein ensuring further includes, querying the certificate authority to determine if the certificate has been revoked since the loader provided the attestation.

24. The computer-readable memory of claim 21 wherein identifying further includes, a known to be secure and trusted loader as the loader.