Permit for controlling access to services in protected memory systems

Abstract

One embodiment of the present invention provides a method and an apparatus for controlling access to services in a protected memory system. The method makes use of a permit, which includes an access control mechanism that resides in a memory space that is protected from a user of the permit. The method includes receiving a request for a service through a permit, the permit comprising an object defined within an object-oriented programming system. In response to the request, the method activates an access control mechanism within the permit. This access control mechanism controls access to the service and resides in a memory space that is protected from a user of the permit, such that the access control mechanism is triggered by invoking a method on the permit. If the access is allowed, the method accesses the service by performing an invocation on a controlled object. This controlled object includes methods to perform the service, and is otherwise protected from the user of the permit. Another variation of the above embodiment includes receiving, at a permit issuing authority, a request for the permit from an entity (such as a person, a computer program or a computer process) requiring access to the service. If the request includes valid authorization information, a permit is issued to the entity. A further variation of the above embodiment includes creating a copy of the permit and transferring the copy to an entity requiring access to the service.