Process for executing a downloadable service receiving restrictive access rights to at least one profile file

• US 20040025060A1
• Filed: 07/09/2003
• Published: 02/05/2004
• Est. Priority Date: 02/19/2001
• Status: Active Grant

• Current Assignee: Hewlett-Packard Company (HP Inc.)
• Original Assignee: Hewlett-Packard Company (HP Inc.)
• Inventors: Brebner, Gavin, Raffaele, Eric
• Granted Patent: US 8,275,791 B2
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: Y10S 707/99936 Pattern matching access

Abstract

A process for executing a downloadable service with specific access rights to at least one profile file in a user'"'"'s computer. The web browser is used for accessing a web server through a first set of communication port and socket. Therefore is arranged a confined runtime environment such as for example an extended sandbox (11) and used in Java programming which Is assigned a second communication port and s ockets and which is used for executing downloadable service with restricted access on at least one profile file. The process can be used for executing services under the form of a signed archive file which signature is used for both validating the archive file and for selecting one particular secure class loader prior to the generation of the compiled code of the service.

Claims

1. A process for executing a downloadable service with specific access rights to at least one profile file in a user'"'"'s computer, said computer comprising a web browser communication to the internet or intranet via a first communication port and socket, said process being characterized in that it involves the steps of:

arranging a confined run time environment (11) which is assigned a second communication port and socket and providing restricted access to at least one profile file;

downloading said service through said second communication port so that it is received by said confined run time environment (11); and

executing said service within said confined run time environment whereby said service is given an access to said at least one profile file in a secure environment.

2. The process according to claim 1 characterized in that said confined run time environment is an extended sandbox having restrictive access to said at least one profile file.

3. The process according to claim 2 characterized in that the service is downloaded under the form of a set of java code containing classes structure packaged within a signed archive file. Three parts compose the service:

remote Internet data, a list of requested data that are needed to personalise the service, and code to sort remote internet data using request accessible data.

4. The process according to claim 2 characterized in that it further involves the step of:

downloading a signed archive file which is received via said second communication port;

checking the signature of the archive file and, if corrupted, discarding said archiv file; and

selecting one particular secure class loader corresponding to said signature for the purpose of creating additional security java classes allowing the restricted access to said at least one profile file.

5. The process according to claim 4 characterized in that said secure class loader further includes restricted access to some specific sections of said at least one profile files.

8. The process according to claim 1 wherein said at least on profile is arranged in a hierarchical manner with a technical section comprising data representative of the user'"'"'s machine configuration, user'"'"'s comportments, habits and preferences.

9. The process according to claim 8 wherein said technical section is automatically filled with data extracted from information available at the Basic Input Output System (BIOS) level and profile building tools.

10. The process according to claim 8 wherein said technical section is automatically filled by means of interrogatiing standardised systems management interfaces present in the client computer.

11. The process according to claim 8 wherein said technical section is automatically filled by means of interrogation via the Distributed Management Interface (DMI) or Window Management Interface (WMI).

12. The process according to claim 1 wherein said downloadable service is an authentication service cooperating with a master card.

13. A transaction aid for assisting a transaction between an user and at least one remote server (3, 4), said transaction aid comprising program code elements for carrying out a process as chimed in any preceding claim.

14. A transaction aid as claimed in claim 11 in the form of a personal computer, the program code elements being implemented as a downloadable service having access to said at least one profile file.

15. A transaction aid computer program product having program code elements for carrying out a process as claimed in any of claims 1 to 9.

6. A process for receiving a signed archive file containing class structures representative of at least one service to be downloaded to and executed on a client computer, characterized in that said at least one service is associated with a corresponding set of access rights to some profile files and the process further involves the steps of:

receiving said archive file;

validating said archive file with said signature;

selecting one secure class loader associated with said signature, said class loader being representative of the set of access rights associated to said service;

generating said classes in accordance with the secure class loader being selected for the purpose of generating a compiled code; and

executing said compiled code.

7. A process for generating compiled executable code in a client machine, comprising the steps of:

receiving a signed archive file containing classes of a service to be executed on said local machine;

checking and validating the signature associated to said archive file;

associating said signature to one predetermined secure class loader for the purpose of defining a predetermined java security policy and assigning access rights to at least one profile file;

invoking generating said access control classes in addition to the classes of said service; and

generating compiled cod and executing said compiled code.