US6173404B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Software object security mechanism
Assignee: Microsoft Technology Licensing LLC
•
Filing: 1998-02-24
•
Granted: 2001-01-09
•
Expires: 2018-02-24
Abstract
Abstract A software object security mechanism addresses system security risks that arise due to interactions between software objects. Conditions are imposed on the accessing of targets by accessing object instances according to attributes of the accessing object and the target object that is being accessed. One security feature is that an owner identifier is incorporated into objects. The owner identifier includes identification of the user, person, or entity (e.g., corporation) who or that creates the object, or identification of a computer system used by the user, person, or entity to create the object definition. The owner identifier provides a basis for distinguishing the creator of an object from the user of that object. Another security feature is a set of access authorizations that allow different access rights to be made available to different object creators. In one implementation the access authorizations are All, Owner, and Exemplar. Another security feature is that exemplar identifiers are encoded into properties and methods in which the properties and methods are defined. Since exemplars may be authored by anyone and may be changed at run time, these security features insure that inheritance from exemplars of questionable lineage is safe. These security features prevent an exemplar in the hierarchy for an object or object instance from damaging the instance data.
Inventors
- 👤 Alex Colburn
- 👤 Steven M. Drucker
- 👤 Kirk J. Marple
- 👤 Don P. Mitchell
- 👤 Manny Vellon
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 23:04
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/50; G06F21/52; G06F21/54; G06F2221/00; G06F2221/21; G06F2221/2145; Y; Y10; Y10S; Y10S707/00; Y10S707/99941; Y10S707/99944
Claims Analysis
Total Claims: 37
Claim 1
Independent Claim
147 words
In a computer-readable medium having stored thereon a first software object that is defined by a person or entity to receive a call from a second software object, the call being to an operation on a service that includes a method or property, the improvement comprising: an access authorization security condition associated with the service and conditioning access to the service by the second object on whether the second object is in one of plural object security classes, one of which being a security class in which the first and second objects are defined by the same person or entity, wherein the first object is one of plural objects that have between them hierarchical relationships by which services are inherited between the objects, another of the plural object security classes relating to whether the call from the second object has a hierarchical relationship with the first object.
Claim 2
Dependent Claim
147 words
In a computer-readable medium having stored thereon a first software object that is defined by a person or entity to receive a call from a second software object, the call being to an operation on a service that includes a method or property, the improvement comprising: an access authorization security condition associated with the service and conditioning access to the service by the second object on whether the second object is in one of plural object security classes, one of which being a security class in which the first and second objects are defined by the same person or entity, wherein the first object is one of plural objects that have between them hierarchical relationships by which services are inherited between the objects, another of the plural object security classes relating to whether the call from the second object has a hierarchical relationship with the first object.
Claim 3
Dependent Claim
32 words
The computer-readable medium of claim 1 further comprising an owner identifier associated with each of the first and second objects and identifying the person or entity that defined each of the objects.
Claim 4
Dependent Claim
40 words
The computer-readable medium of claim 1 in which another of the plural object security classes is unrestricted as to the person or entity that defined each of the objects but provides access only to limited operations available from the service.
Claim 5
Dependent Claim
17 words
The computer-readable medium of claim 3 in which the limited operations include only read and execute operations.
Claim 6
Dependent Claim
16 words
The computer-readable medium of claim 3 in which the limited operations do not include write operations.
Claim 7
Dependent Claim
49 words
The computer-readable medium of claim 1 in which the object security class relating to whether the call from the second object has a hierarchical relationship with the first object is based upon it and the call from the second object originating from a common object in the hierarchical relationship.
Claim 8
Dependent Claim
55 words
The computer-readable medium of claim 1 in which the object security class relating to whether the call from the second object has a hierarchical relationship with the first object is based upon the call from the second object and the operation on the service originating in objects in the hierarchical relationship of the first object.
Claim 9
Dependent Claim
20 words
The computer-readable medium of claim 1 in which the first and second objects represent entities in a virtual world environment.
Claim 10
Dependent Claim
44 words
The computer-readable medium of claim 1 in which the person or entity defining an object is its owner and the security class in which the first and second objects are defined by the same owner allows owners to access properties of objects they own.
Claim 11
Dependent Claim
86 words
The computer-readable medium of claim 1 in which the first object is one of plural objects that have between them hierarchical relationships by which services are inherited from exemplar objects, an exemplar one of the plural object security classes relating to whether the call from the second object has a hierarchical relationship with the first object, the exemplar security class allowing a method of the first object defined by one exemplar to execute methods defined by another exemplar in the hierarchical relationship of the first object.
Claim 12
Dependent Claim
89 words
The computer-readable medium of claim 1 in which the first object is one of plural objects that have between them hierarchical relationships by which services are inherited from exemplar objects, an exemplar one of the plural object security classes relating to whether the call from the second object has a hierarchical relationship with the first object, the exemplar security class allowing a method of the first object defined by one exemplar to add to a collection property defined by another exemplar in the hierarchical relationship of the first object.
Claim 13
Dependent Claim
168 words
A computer-readable medium having stored thereon software instructions by which a first software object accesses a service from a second software object, the service including access to a method or a property, comprising: software instructions for obtaining an owner identifier associated with each of the first and second objects, each owner identifier identifying the person or entity that defined each of the objects; software instructions for determining whether the first object is in one of plural object security classes, one of which being an owner security class in which the first and second objects have a common owner identifier; and software instructions for conditioning access to the service by the first object on whether it is in the owner security class, wherein the second object is one of plural objects that have between them hierarchical relationships by which services are inherited between the objects, another of the plural object security classes relating to whether the call from the first object has a hierarchical relationship with the second object.
Claim 14
Dependent Claim
168 words
A computer-readable medium having stored thereon software instructions by which a first software object accesses a service from a second software object, the service including access to a method or a property, comprising: software instructions for obtaining an owner identifier associated with each of the first and second objects, each owner identifier identifying the person or entity that defined each of the objects; software instructions for determining whether the first object is in one of plural object security classes, one of which being an owner security class in which the first and second objects have a common owner identifier; and software instructions for conditioning access to the service by the first object on whether it is in the owner security class, wherein the second object is one of plural objects that have between them hierarchical relationships by which services are inherited between the objects, another of the plural object security classes relating to whether the call from the first object has a hierarchical relationship with the second object.
Claim 15
Dependent Claim
33 words
The computer-readable medium of claim 12 in which another of the plural object security classes is unrestricted as to the owner identifier but provides access only to limited operations available from the service.
Claim 16
Dependent Claim
17 words
The computer-readable medium of claim 13 in which the limited operations include only read and execute operations.
Claim 17
Dependent Claim
16 words
The computer-readable medium of claim 13 in which the limited operations do not include write operations.
Claim 18
Dependent Claim
55 words
The computer-readable medium of claim 12 in which the object security class relating to whether the call from the second object has a hierarchical relationship with the first object is based upon the call from the second object and the operation on the service originating in objects in the hierarchical relationship of the first object.
Claim 19
Dependent Claim
49 words
The computer-readable medium of claim 12 in which the object security class relating to whether the call from the first object has a hierarchical relationship with the second object is based upon it and the call from the second object originating from a common object in the hierarchical relationship.
Claim 20
Dependent Claim
145 words
In a computer-readable medium having stored thereon a first software object having at least one object for receiving a call from a second software object, the call being to an operation on a service that includes a method or property, the improvement comprising: a hierarchical relationship between the first object and at least one other object by which relationship services are inherited between the objects; and an access authorization security condition associated with the service and conditioning access to the service by the second object on whether the second object is in one of plural object security classes, one of which being a security class in which the first and second objects have a hierarchical relationship between them and another of the plural object security classes is a security class in which the first and second objects are defined by the same person or entity.
Claim 21
Dependent Claim
145 words
In a computer-readable medium having stored thereon a first software object having at least one object for receiving a call from a second software object, the call being to an operation on a service that includes a method or property, the improvement comprising: a hierarchical relationship between the first object and at least one other object by which relationship services are inherited between the objects; and an access authorization security condition associated with the service and conditioning access to the service by the second object on whether the second object is in one of plural object security classes, one of which being a security class in which the first and second objects have a hierarchical relationship between them and another of the plural object security classes is a security class in which the first and second objects are defined by the same person or entity.
Claim 22
Dependent Claim
49 words
The computer-readable medium of claim 18 in which the object security class relating to whether the call from the second object has a hierarchical relationship with the first object is based upon it and the call from the second object originating from a common object in the hierarchical relationship.
Claim 23
Dependent Claim
32 words
The computer-readable medium of claim 18 further comprising an owner identifier associated with each of the first and second objects and identifying the person or entity that defined each of the objects.
Claim 24
Dependent Claim
40 words
The computer-readable medium of claim 18 in which another of the plural object security classes is unrestricted as to the person or entity that defined each of the objects but provides access only to limited operations available from the service.
Claim 25
Dependent Claim
17 words
The computer-readable medium of claim 21 in which the limited operations include only read and execute operations.
Claim 26
Dependent Claim
16 words
The computer-readable medium of claim 21 in which the limited operations do not include write operations.
Claim 27
Dependent Claim
128 words
A computer-readable medium having stored thereon software instructions by which a first software object accesses a service from a second software object, the service including access to a method or a property, comprising: software instructions for identifying a hierarchical relationship between the first and second objects; software instructions for determining whether the first object is in one of plural object security classes, one of which being a security class in which the first and second objects have a hierarchical relationship between them and another of which is a security class in which the first and the second objects are defined by the same person or entity; and software instructions for conditioning access to the service by the first object on whether it is in the owner security class.
Claim 28
Dependent Claim
128 words
A computer-readable medium having stored thereon software instructions by which a first software object accesses a service from a second software object, the service including access to a method or a property, comprising: software instructions for identifying a hierarchical relationship between the first and second objects; software instructions for determining whether the first object is in one of plural object security classes, one of which being a security class in which the first and second objects have a hierarchical relationship between them and another of which is a security class in which the first and the second objects are defined by the same person or entity; and software instructions for conditioning access to the service by the first object on whether it is in the owner security class.
Claim 29
Dependent Claim
44 words
The computer-readable medium of claim 24 in which another of the plural object security classes is unrestricted as to whether the first and second objects are defined by the same person or entity but provides access only to limited operations available from the service.
Claim 30
Dependent Claim
17 words
The computer-readable medium of claim 23 in which the limited operations include only read and execute operations.
Claim 31
Dependent Claim
16 words
The computer-readable medium of claim 25 in which the limited operations do not include write operations.
Claim 32
Dependent Claim
137 words
In a computer-readable medium having stored thereon a first software object that is defined by a person or entity to receive a call from a second software object, the call being to an operation on a service that includes a method or property, the improvement comprising: an access authorization security condition associated with the service and conditioning access to the service by the second object on whether the second object is in one of plural object security classes, one of which being a security class in which the first and second objects are defined by the same person or entity, wherein the person or entity defining an object is its owner and the security class in which the first and second objects are defined by the same owner allows owners to access properties of objects they own.
Claim 33
Dependent Claim
137 words
In a computer-readable medium having stored thereon a first software object that is defined by a person or entity to receive a call from a second software object, the call being to an operation on a service that includes a method or property, the improvement comprising: an access authorization security condition associated with the service and conditioning access to the service by the second object on whether the second object is in one of plural object security classes, one of which being a security class in which the first and second objects are defined by the same person or entity, wherein the person or entity defining an object is its owner and the security class in which the first and second objects are defined by the same owner allows owners to access properties of objects they own.
Claim 34
Dependent Claim
159 words
A computer-implemented process by which a first software object accesses a service from a second software object, the service including access to a method or a property, the process comprising the steps of: obtaining an owner identifier associated with each of the first and second objects, each owner identifier identifying the person or entity that defined each of the objects; determining whether the first object is in one of plural object security classes, one of which being an owner security class in which the first and second objects have a common owner identifier; and conditioning access to the service by the first object on whether it is in the owner security class, wherein the second object is one of plural objects that have between them hierarchical relationships by which services are inherited between the objects, another of the plural object security classes relating to whether the call from the first object has a hierarchical relationship with the second object.
Claim 35
Dependent Claim
159 words
A computer-implemented process by which a first software object accesses a service from a second software object, the service including access to a method or a property, the process comprising the steps of: obtaining an owner identifier associated with each of the first and second objects, each owner identifier identifying the person or entity that defined each of the objects; determining whether the first object is in one of plural object security classes, one of which being an owner security class in which the first and second objects have a common owner identifier; and conditioning access to the service by the first object on whether it is in the owner security class, wherein the second object is one of plural objects that have between them hierarchical relationships by which services are inherited between the objects, another of the plural object security classes relating to whether the call from the first object has a hierarchical relationship with the second object.
Claim 36
Dependent Claim
118 words
A computer-implemented process by which a first software object accesses a service from a second software object, the service including access to a method or a property, the process comprising the steps of: identifying a hierarchical relationship between the first and second objects; determining whether the first object is in one of plural object security classes, one of which being a security class in which the first and second objects have a hierarchical relationship between them and another of which is a security class in which the first and the second objects are defined by the same person or entity; and conditioning access to the service by the first object on whether it is an owner security class.
Claim 37
Dependent Claim
118 words
A computer-implemented process by which a first software object accesses a service from a second software object, the service including access to a method or a property, the process comprising the steps of: identifying a hierarchical relationship between the first and second objects; determining whether the first object is in one of plural object security classes, one of which being a security class in which the first and second objects have a hierarchical relationship between them and another of which is a security class in which the first and the second objects are defined by the same person or entity; and conditioning access to the service by the first object on whether it is an owner security class.
References Cited (Backward Citations)
EP0472487A2
Cited
JPH04239354A
Cited
US5280614A
Cited
US5720033A
Cited
US5826266A
Cited
US5757914A
Cited
US5970145A
Cited
US5850346A
Cited
US5787427A
Cited
US5878415A
Cited
US5995973A
Cited
US5999978A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-01-09 | 2004-07-10 | 2005-01-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-01-09 | 2008-07-10 | 2009-01-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-01-09 | 2012-07-10 | 2013-01-09 | $7700.00 | Window Closed / Lapsed |