Providing remotely defined security data to a local application extension

• US 8,677,476 B2
• Filed: 11/26/2007
• Issued: 03/18/2014
• Est. Priority Date: 11/26/2007
• Status: Active Grant

• Current Assignee: Adobe Inc.
• Original Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Inventors: Chanda, Rupen, Minns, Steve, Zheng, Jian
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US11/945,246
• Publication Number:
  US 20140041016A1
• Time in Patent Office: 2,304 Days
• Field of Search: 726/21, 726/22, 726/27, 713/165, 713/168, 713/187, 713/189, 380/201, 380/203, 380/211, 380/242, 725/1, 725/9, 725/25, 725/56, 725/62, 725/86, 725/104
• US Class Current: 726/21
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Systems and methods, including computer software adapted to perform certain operations, can be implemented for providing remotely defined security data to an application extension on a client device. A sequence of instructions and at least one permission indicator associated with the sequence of instructions are received. A first permission indicator is associated with a code extension to a software application adapted to execute at least a portion of the sequence of instructions. The code extension is adapted to perform one or more operations that supplement the operations supported by the software application. An instruction within the sequence of instructions associated with adapted for execution by the code extension and with an activity is identified. The first permission indicator is provided to the code extension. The code extension determines whether performance of the activity is permitted based, at least in part, on the first permission indicator.

Claims

1. A method comprising:

receiving, from an information channel repository of a computing device, a sequence of instructions executable on the computing device and at least one permission indicator associated with the sequence of instructions, a first of the at least one permission indicators associated with a code extension to a virtual machine on the computing device adapted to execute at least a portion of the sequence of instructions and the code extension adapted to perform one or more operations that supplement the operations supported by the virtual machine, wherein the sequence of instructions are adapted to provide at least one of an interactive user interface or services on the computing device based on content included in the information channel repository;

identifying an instruction, within the sequence of instructions, adapted for execution by the code extension, the instruction further adapted to perform an activity related to at least one operation that supplements the operations supported by the virtual machine; and

providing, to the code extension, the first permission indicator, wherein the code extension determines whether performance of the activity is permitted based, at least in part, on the first permission indicator.

2. The method of claim 1, wherein the sequence of instructions and the at least one permission indicator are received in a single transmission.

3. The method of claim 1, wherein the code extension operates in a mobile device, the method further comprising:

storing the received at least one permission indicator in a persistent storage device on the mobile device.

4. The method of claim 3, wherein the at least one permission indicator is received from a remote source in communication with the mobile device.

5. The method of claim 4, wherein the value of the first permission indicator is set at the remote source.

6. The method of claim 1, wherein the at least one permission indicator comprises a plurality of permission bits, the first permission indicator corresponds to a first of the plurality of permission bits, and the first permission bit is interpreted by the code extension.

7. The method of claim 6, wherein a second permission indicator corresponds to a second of the plurality of permission bits, the second permission bit is interpreted by the code extension, and the second permission bit is associated with a different instruction than the identified instruction.

8. The method of claim 6, wherein at least one of the plurality of permission bits is interpreted by a different code extension to the software application.

9. The method of claim 1, wherein a SWF file comprises the sequence of instructions.

10. A computer program product, encoded on a non-transitory computer-readable medium, operable to cause data processing apparatus to perform operations comprising:

receiving, from an information channel repository of a mobile device, a permission indicator associated with a sequence of instructions and a code extension to a virtual machine adapted to execute at least a portion of the sequence of instructions, wherein the code extension is adapted to perform one or more operations that supplement execution of instructions supported by the virtual machine and the sequence of instructions are adapted to provide at least one of an interactive user interface or services on the mobile device based on content included in the information channel repository, the permission indicator further associated with an information source;

storing, in a persistent storage device on the mobile device, the permission indicator;

identifying an instruction associated with the information source, the instruction further adapted for execution by the code extension and related to at least one operation that supplements the operations supported by the virtual machine;

retrieving the permission indicator from the persistent storage device; and

providing, to the code extension, the permission indicator, wherein the code extension determines whether an activity is prohibited based, at least in part, on the permission indicator.

11. The computer program product of claim 10, the operations further comprising:

receiving, before identifying the instruction, a sequence of instructions comprising the instruction;

storing, in the persistent storage device on the mobile device, the sequence of instructions; and

retrieving the sequence of instructions from the persistent storage device in response to a stimulus from a user of the mobile device.

12. The computer program product of claim 11, wherein the permission indicator and the sequence of instructions are stored at a location in the persistent storage device, and the location is associated with the information source.

13. The computer program product of claim 11, wherein a SWF file comprises the sequence of instructions.

14. The computer program product of claim 11, wherein the permission indicator and the sequence of instructions are received from a remote source in communication with the mobile device.

15. The computer program product of claim 14, wherein the permission indicator occupies one of a plurality of permission indicator positions within a permissions data structure, and the permission indicator is assigned to the one permission indicator position at the remote source.

16. The computer program product of claim 15, wherein providing the permission indicator to the code extension comprises providing at least a portion of the permissions data structure to the code extension.

17. The computer program product of claim 10, wherein the value of the permission indicator is determined at least in part by a provider of the code extension.

18. A system comprising:

a user interface device;

a persistent storage device; and

one or more processors operable to interact with the user interface device and the persistent storage device, the one or more processors further operable to;

receive a transmission from a remote source, the transmission comprising a sequence of instructions and a permissions data structure associated with the sequence of instructions, the permissions data structure comprising at least one permission indicator associated with a code extension to a virtual machine, wherein the virtual machine is adapted to execute at least a portion of the sequence of instructions and the code extension is adapted to perform one or more operations that supplement the operations supported by the virtual machine, wherein the sequence of instructions are adapted to provide at least one of an interactive user interface or services on the user interface device based on content included in the persistent storage device;

store the sequence of instructions and the permissions data structure in an information channel repository of the persistent storage device;

retrieve the sequence of instructions and the permissions data structure from the persistent storage device in response to a stimulus received through the user interface device; and

provide, to the code extension, at least a portion of the permissions data structure related to at least one operation that supplements the operations supported by the virtual machine, wherein the code extension blocks a first activity attempted during execution of the sequence of instructions based, at least in part, on the at least one permission indicator.

19. The system of claim 18, wherein the one or more processors comprise a client operable to interact with the remote source through a data communication network, and the remote source is operable to interact with the client as a server.

20. The system of claim 18, wherein the value of the at least one permission indicator is set at the remote source.

21. The system of claim 18, wherein the permissions data structure comprises a plurality of permission bits, and each permission indicator corresponds to a permission bit.

22. The system of claim 21, wherein the number of permission bits is greater than the number of permission indicators.

23. The system of claim 18, wherein the at least one permission indicator comprises a first permission indicator and a second permission indicator, and wherein the code extension blocks the first activity based, at least in part, on the first permission indicator.

24. The system of claim 23, wherein the code extension blocks a second activity attempted during execution of the sequence of instructions based, at least in part, on the second permission indicator.

25. The system of claim 18, wherein a SWF file comprises the sequence of instructions.