Oracle America, Inc.

Oracle International Corporation

Thierry Violleau

Tanjore S Ravishankar

Matthew R Hill

Saqib J Ahmad

Sebastian Jürgen Hans

Patrick Van Haver

Sebastian J Hans

Nicolas Ponsini

Matt Hill

Tigran Igorevich Egiazarov

A method and system for receiving from an authenticated user, at an authorization server, via a service provider, an authorization request to perform a sensitive operation on a first device. The method also includes generating, by the authorization server and in response to receiving the authorization request, an authorization token that includes a device constraint and a binding code constraint, which includes a binding code. Additionally, the method includes transmitting the authorization token to an isolated execution environment of the first device, where the sensitive operation is not permitted on the first device unless the first device successfully performs a verification in the isolated execution environment using the authorization token. Furthermore, the method includes permitting the sensitive operation based on the verification.

Mechanism for enforcing user-specific and device-specific security constraints in an isolated execution environment on a device

A system and method can support on-device operation management. A token issuer on a backend server, and/or a tool, can generate an authorization token, which is bound to a user of one or more devices using a unique identifier (ID) that is assigned to the user. The unique ID can be known and/or shared between the an on-device authorizing entity and the token issuer. Then, the on-device authorizing entity can verify the authorization token before granting an execution of one or more protected on-device operations. Furthermore, the on-device authorizing entity may not grant the execution of the one or more protected on-device operations, when the unique ID is erased from the device.

System and method for managing tokens authorizing on-device operations

One particular implementation may take the form of a system or method for tracking application identification and application context in a context-isolated computing environment. The method may store such application information to reduce redundant information being stored on a stack. More particularly, the embodiment may store the application information in a context-specific marker frame. The context-specific marker frame may be stored once on the stack or it may be stored separately from the stack to maintain a small stack size. In another implementation, an invocation handler method may be called to store the redundant information about the executing application. The invocation handler may store the necessary information in a well-known location for later use by the virtual machine. The invocation handler may also provide further benefits, such as synchronization to ensure thread safety on shareable objects.

Method to track application context and application identification

In general, in one aspect, the invention relates to a method for executing applications. The method includes accessing a secure storage element via a host device including a computer processor; executing, by the computer processor, a hosted execution runtime environment (HERE) on the host device; identifying a persistent memory image of the HERE within the secure storage element; executing, by the computer processor, an application using the HERE; and applying, based on executing the application, a first set of changes to the persistent memory image.

Secure hosted execution architecture

A system and method is provided to facilitate secure communications for a server-application executing on a resource-constrained device. A request, from a client application executing on a client device to access a server application executing on the resource-constrained device is received on an application-specific secure port of a resource-constrained device. The request is authenticated using a security token stored in an application context of the server application. The authentication is performed by a transport security layer protocol executing within the application context of the server application. The security token is specific for the server application. A secure connection is established directly between the secure port and the client application upon the authentication being successful.

Transport-level web application security on a resource-constrained device

An authentication mechanism is provided to authenticate both client and user of a portable computing device when the user causes a client to request a protected resource on the portable computing device. Upon receiving a request a protected resource by the client, the authentication mechanism determines which authentication method is specified for authentication of the client, and authenticates the client accordingly. Upon a determination that the client is authentic, the authentication mechanism invokes a user interface that is separate and distinct from the client to solicit input from the user. Based on the input solicited from the user, the authentication mechanism determines whether the user is an authentic user of the portable computing device. If it is determined that the user is an authentic user, the authentication mechanism determines based on an indication from the user whether the client should be authorized to access the protected resource requested.

Complementary client and user authentication scheme

An approach for making an object owned by a first application that executes in a first isolated execution context accessible to a second application that executes in a second isolated execution context is described herein. According to this approach the object is associated with the first isolated execution context. A request is received to render the object accessible to the second application. Ownership of the object is transferred to the second application by changing the isolated execution context that is associated with the object to the second isolated execution context, thereby rendering the object accessible to the second application.

Method and apparatus for data transfer between isolated execution contexts

To execute legacy smart card applications in a next generation smart card environment, a mechanism converts the applications into a format executable by the next generation smart card platforms. For instance, in a Java-based environment, a normalizer tool translates a CAP file into a Java Class file. Additional mechanisms recreate, on next generation smart cards, a specialized environment that allows the legacy applications to execute without impacting legacy and non-legacy application performance. For example, mechanisms create new instances of previously shared objects so that legacy applications can continue to expect exclusive access to those objects. Moreover, mechanisms manage the communication between a legacy application and non-legacy applications by controlling how and when calls are sent to the legacy application.

Supporting applets on a high end platform

A access control mechanism is provided on a computing device to allow an application provider to set up a declarative security policy specific to an application module. When a runtime environment of the computing device receives a request from a second application instance in a second execution context to access a protected resource in a first application instance, the runtime environment invokes the access control mechanism to determine, based on a protection-domain-level domain security policy, whether the second application instance is allowed to access protected resources in the first execution context. If so, the runtime environment invokes the access control mechanism to determine, based on a declarative security policy for a first application module associated with the first application instance, whether the second application instance is allowed to access the protected resource. If so, the runtime environment allows the second application instance access to the protected resource requested.

Access control mechanism for shareable interface communication access control

A persistence management system facilitates porting servlet-based applications, such as Web applications, to an extremely mobile/nomadic system such as a resource-constrained device platform, e.g., a smart card, where sessions on a card acceptance device are intermittent by nature. Persistence management system (i) minimizes the startup time, and (ii) restores applications in a consistent state. The persistent management system supports: a) selective persistence of servlet model objects: both container-managed objects and application-managed objects; b) optional persistence of threads; and c) optional persistence of connection objects.

Persistence system for servlet-based applications on resource-constrained devices

In a smart card system in which applications executing in different execution contexts are allowed to communicate with each other only through shareable interface objects (SIO's), a registry mechanism is provided to mediate in inter-application communication between legacy applets, extended applets and servlets. A request by a client application for a SIO of a server application in a different execution context is routed to the registry mechanism by the system. Dependent on what types the client and server applications are, the registry mechanism provides call interfaces as would be expected by the applications to enable passing the SIO from the server application to the client application. In one embodiment, servlets and extended applets may also register and unregister their SIOs dynamically with the registration mechanism.

Seamless extension of shareable interface mechanism to servlet and extended applet model for inter-application communication

A first application instance is associated with a protection domain based on credentials (e.g.: a signed certificate) associated with a set of application code that, when executed, gives rise to the application instance. The first application instance executes in a first execution context. An indication is received that the first application instance seeks access to protected functionality associated with a second execution context. In response to receiving the indication, a determining is made as to whether the first application instance has permission to access the protected functionality. The determination is made by determining the protection domain with which the first application instance is associated, and determining if the protection domain with which the first application instance is associated is in the set of one or more protection domains.

Method and apparatus for protection domain based security

A generic event notification service for a resource-constrained device is provided. One method includes receiving an event having a unique event identifier, and determining whether an event-producing application is authorized to fire the event. Upon a determination of authorization to fire the event, a determination is made whether any event-consuming applications are authorized by the event-producing application to receive the event. Upon a determination of authorization to receive the event, the event is forwarded to each authorized event-consuming application. In this manner, secure, flexible, generic, and uniform application interaction is facilitated.

Growing community of inventors

Poissy, France

Thierry Violleau