Sun Microsystems, Inc.

Efrem Lipkin

Theodore Charles Goldstein

One embodiment of the present invention provides a method and an apparatus for providing a client-side intermediary that communicates with an application on a second server computer system. The method operates by receiving a composite message at a client computer system from a first server computer system, and examining type information from the composite message. This type information specifies how the composite message is formatted, and can be used to select an application that is capable of processing the composite message. The method uses the type information to look up a network address of the application residing on the second server computer system. This address is used to forward the composite message to the application on the second server computer system. The above embodiment can be implemented within a browser on the client computer system, or within a separate application on the client computer system. A return communication can be facilitated by receiving a return composite message at the client computer system from the second server computer system, and examining type information from the return composite message. This type information is used to look up an address of a source application on the network, and this address is used to forward the return composite message to the source application.

Client intermediation of server applications

The present invention provides a method and an apparatus for providing a first computer program module with the ability to access a service from a second computer program module. The method includes receiving the first computer program module--for example, at a third party computer system, and determining whether the first computer program module has been digitally signed by an authority having power to confer access for the service. If so, the method provides the first computer program module with access to the service. A variation on this embodiment includes verifying that the first computer program module includes a chain of certificates establishing a chain of authorization for the service. This verification process includes verifying that a first certificate in the chain is signed by an entity that is originally authorized to confer access for the service, and verifying that subsequent certificates in the chain are signed by entities that have been delegated authorization to confer access for the service. In a further variation on the above embodiment, the act of providing the first computer program module with access to the service, includes providing the first computer program module with a permit that allows the first computer program module to perform a restricted set of operations on the service.

Controlling access to services between modular applications

One embodiment of the present invention provides a method and an apparatus for controlling access to services in a protected memory system. The method makes use of a permit, which includes an access control mechanism that resides in a memory space that is protected from a user of the permit. The method includes receiving a request for a service through a permit, the permit comprising an object defined within an object-oriented programming system. In response to the request, the method activates an access control mechanism within the permit. This access control mechanism controls access to the service and resides in a memory space that is protected from a user of the permit, such that the access control mechanism is triggered by invoking a method on the permit. If the access is allowed, the method accesses the service by performing an invocation on a controlled object. This controlled object includes methods to perform the service, and is otherwise protected from the user of the permit. Another variation of the above embodiment includes receiving, at a permit issuing authority, a request for the permit from an entity (such as a person, a computer program or a computer process) requiring access to the service. If the request includes valid authorization information, a permit is issued to the entity. A further variation of the above embodiment includes creating a copy of the permit and transferring the copy to an entity requiring access to the service.

Growing community of inventors

Berkeley, CA, United States of America

Efrem Lipkin