Abstract

A method and apparatus for establishing and maintaining complex security rules is provided. The security rules are established through the use of "permission" classes that take advantage of the power and simplicity various features of object oriented programming, including the ability to inherit attributes and methods. For example, a permission super class is established that defines an interface to a validation method. A permission subclass may then be created which provides an implementation of the validation method. When invoked, the validation method indicates whether a given permission represented by one object belonging to a permission class encompasses the permission represented by another object belonging to a permission class. Classes are also provided for grouping permissions into sets, and for establishing protection domains for classes of objects.

Other References

• Gong Li, et al.: "Going Beyond the Sandbox: An Overview of the New Security Architecture in the Java™ Development Kit 1.2", Proceedings of the Usenix Symposium on Internet Technologies and Systems, Monterey, CA, USA, Dec. 8-11, 1997, ISBN 1-880446-91-S, 1997, Berkeley, CA, USA, Usenix Assoc., USA, pp. 103-112, XP002100907
• Wallach, D. S., et al.: "Extensible Security Architecture for Java", 16^th ACM Symposium on Operating Systems Principles, Sain Malo, France, Oct. 5-8, 1997, ISSN 0163-5980, Operating Systems Review, Dec. 1997, ACM, USA, pp. 116-128, XP-0021010681
• Dean, D., et al., "Java Security: From HotJava to Netscape and Beyond," Proceedings of the 1996 IEEE Symposium on Security and Privacy, Oakland, CA, May 6-8, 1996
• Hamilton, M.A., "Java and the Shift to Net-Centric Computing," Computer, vol. 29, No. 8, Aug. 199