System and method for loading application classes

• US 9,075,966 B2
• Filed: 01/27/2014
• Issued: 07/07/2015
• Est. Priority Date: 12/03/2009
• Status: Active Grant

• Current Assignee: OL Security LLC (Intellectual Ventures LLC)
• Original Assignee: Oscad Remote Limited Liability Company
• Inventors: Wheeler, Thomas
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US14/165,293
• Publication Number:
  US 20140143895A1
• Time in Patent Office: 526 Days
• Field of Search: 726/27, 726/30
• US Class Current: 1/1
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

In an application, variants of a class may be generated and associated with different security permissions for the application. When a class is to be loaded, a determination is made as to the application'"'"'s security permissions, e.g. by decoding a security token. The class is then retrieved from a repository that stores class variants matching the required security level. The retrieved class variant, which may have a full or a reduced functionality as appropriate for the security permission may then by loaded.

Claims

1. A method, comprising:

determining, at a processing device, a class invoked by an application at run time;

decoding, at the processing device, a security token encoded in the application upon installation of the application; and

retrieving, from at least one memory store, a class variant based at least in part on decoding the security token;

wherein the variant defines a level of functionality of the application consistent with the security token.

2. The method of claim 1, further comprising decoding, at the processing device, a security permission encoded in the security token.

3. The method of claim 1, wherein each of a plurality of class variants comprise a same namespace or a same application programming interface.

4. The method of claim 1,

wherein a first class variant provides a first functionality;

and

wherein a second class variant provides a reduced functionality in comparison to the first class variant.

5. The method of claim 1, further comprising associating each of a plurality of class variants with a class variant repository.

6. The method of claim 1, further comprising storing a plurality of class variants for the class in a repository with a plurality of class variants for at least another class having equivalent security permissions.

7. A device, comprising:

a memory device configured to store instructions; and

a processing device configured to execute the instructions stored in the memory device to;

determine a class invoked by an application at run time;

decode a security token encoded in the application upon installation of the application to extract a security permission; and

load a class variant from a corresponding class store based at least in part on the decoded security token;

wherein the class variant is configured to define a level of functionality of the application consistent with the security permission.

8. The device of claim 7, wherein the processing device is further configured to execute the instructions stored in the memory device to associate each of a plurality of class variants with corresponding security permissions.

9. The device of claim 7, wherein each of a plurality of class variants comprise a same namespace or a same application programming interface.

10. The device of claim 7, wherein the processing device is further configured to execute the instructions stored in the memory device to associate each of a plurality of class variants with a class variant repository.

11. The device of claim 7, wherein the processing device is further configured to execute the instructions stored in the memory device to store the class variant for the class together with a class variant for at least another class having equivalent permissions encoded in corresponding security tokens.

12. The device of claim 7,

wherein a first class variant provides a first functionality and is associated with a first security permission encoded in the security token;

and

wherein a second class variant provides a reduced functionality in comparison to the first class variant and is associated with a second security permission encoded in the security token.

13. A computer-readable storage device including computer-executable instructions stored thereon that, when executed by a processing device, configure the processing device to perform operations comprising:

decoding a security permission encoded in a security token upon installation of the application;

determining a class invoked by the application at run time of the application; and

accessing a variant of the class from a store corresponding to the class based at least in part on the security permission decoded from the security token;

wherein the variant of the class is associated with a level of functionality of the application consistent with the security permission.

14. The computer-readable storage device of claim 13, wherein the computer-executable instructions, when executed by the processing device, further configure the processing device to associate each of a plurality of class variants with corresponding security permissions.

15. The computer-readable storage device of claim 13, wherein each of a plurality of class variants comprise a same namespace or a same application programming interface.

16. The computer-readable storage device of claim 13, wherein the computer-executable instructions, when executed by the processing device, further configure the processing device to associate each of a plurality of class variants with a class variant repository.

17. The computer-readable storage device of claim 13, wherein the computer-executable instructions, when executed by the processing device, further configure the processing device to store the class variant for the class together with a class variant for at least another class having equivalent permissions encoded in corresponding security tokens.

18. The computer-readable storage device of claim 13,

wherein a first class variant provides a first functionality;

and

wherein a second class variant provides a reduced functionality in comparison to the first class variant.

19. The computer-readable storage device of claim 18,

wherein the first class variant corresponds to a first security permission encoded in the security token;

and

wherein the second class variant corresponds to a second security permission encoded in the security token.

20. The computer-readable storage device of claim 19, wherein the computer-executable instructions, when executed by the processing device, further configure the processing device to:

store the first class variant in a first repository; and

store the second class variant in a second repository distinct from the first repository.