US6189103B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Authority delegation with secure operating system queues
Assignee: RPX Corp
•
Filing: 1998-07-21
•
Granted: 2001-02-13
•
Expires: 2018-07-21
Abstract
Abstract Methods, systems, and devices are provided for delegating security rights to Java servlets and other executable tasks by using secure operating system queues. In particular embodiments, the invention allows secure loading of Java servlets on a Novell NetWare server. The invention allows users to run servlets from various locations with the same rights, namely, the user's rights. The servlet submitted by a given user runs in the context of that user's rights. A system according to the invention verifies that the user has the right to submit the task to a given task queue; the queue is managed by the system, and the user is authenticated to the system. Queue servers which receive tasks from the queue and service them by executing the tasks are likewise authenticated by the system. When a queue server attempts to service a task in a queue, the system verifies that the queue server has rights to service that queue and that job. This two way verification—that a user has rights to submit the task, and that the queue server has rights to service the task—allows the user and the queue server to establish a trusted relationship using the operating system's trusted queues. Moreover, existing user rights databases and access control systems can be used to determine and enforce rights and trust levels.
Inventors
- 👤 Carlos A Nevarez
- 👤 Grant G Echols
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-09 18:43
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/08; G; G06; G06F; G06F21/00; G06F21/10; G06F21/12; G06F21/121; G06F21/128; H04L63/10; H04L63/105; H04L63/16; H04L63/168
Claims Analysis
Total Claims: 46
Claim 1
Independent Claim
107 words
A method for delegating user authority in a distributed computer system, the method comprising the steps of: associating an authenticated user of the distributed computer system with an executable task submitted for execution by the authenticated user, the authenticated user having security rights enforced in the computer system; placing the executable task in an operating system queue; transmitting the queued executable task to an authenticated queue server for execution, wherein the transmitting step comprises serializing classes stored in a first computer's memory and sending the serialized classes to another computer's memory; and delegating user rights to the task by enforcing the authenticated user's rights on the task.
Claim 2
Independent Claim
107 words
A method for delegating user authority in a distributed computer system, the method comprising the steps of: associating an authenticated user of the distributed computer system with an executable task submitted for execution by the authenticated user, the authenticated user having security rights enforced in the computer system; placing the executable task in an operating system queue; transmitting the queued executable task to an authenticated queue server for execution, wherein the transmitting step comprises serializing classes stored in a first computer's memory and sending the serialized classes to another computer's memory; and delegating user rights to the task by enforcing the authenticated user's rights on the task.
Claim 3
Dependent Claim
23 words
The method of claim 1 , wherein the associating step comprises placing an identification of the user in the queue with the task.
Claim 4
Dependent Claim
21 words
The method of claim 1 , wherein the placing step comprises placing a Java servlet task in an operating system queue.
Claim 5
Dependent Claim
21 words
The method of claim 1 , wherein the placing step comprises placing a Java applet task in an operating system queue.
Claim 6
Dependent Claim
21 words
The method of claim 1 , wherein the placing step comprises placing a platform-independent application task in an operating system queue.
Claim 7
Dependent Claim
22 words
The method of claim 1 , wherein the placing step comprises placing a native code application task in an operating system queue.
Claim 8
Dependent Claim
27 words
The method of claim 1 , wherein the transmitting step comprises sending the queue server a resource locator identifying the location of executable code of the task.
Claim 9
Dependent Claim
20 words
The method of claim 1 , wherein the transmitting step comprises sending the queue server a stream of executable bytecodes.
Claim 10
Dependent Claim
21 words
The method of claim 1 , wherein the transmitting step comprises sending the queue server information across a network signal line.
Claim 11
Dependent Claim
30 words
The method of claim 1 , wherein the delegating step comprises executing at least part of the executable task and execution of the task is managed by the queue server.
Claim 12
Dependent Claim
21 words
The method of claim 10 , wherein the executing step comprises spawning a virtual machine to interpret bytecodes of the task.
Claim 13
Dependent Claim
217 words
A distributed computer system comprising: a user database correlating user identities with corresponding rights; an access control system for enforcing user rights by comparing the rights of a user seeking access to a system resource with the rights needed to access the resource and allowing access only if the user has sufficient rights; a user authentication system for authenticating users, the database and access control system and authentication system cooperating such that the access control system gives a user the rights corresponding to a user identity in the user database if the authentication system associates the user with that user identity; a secure queue that associates authenticated remote users with tasks they submit to the queue, the tasks containing executable code; an authenticated queue server for servicing the queue, the queue server capable of executing at least part of a task submitted to the queue; and an authority delegation system which associates a submitting remote user's identity with a task submitted by the remote user, thereby permitting the access control system to enforce the identified remote user's rights on the task while the task is being serviced by the queue server, wherein the authority delegation system maintains separate user and delegate identities and the access control system catalogs the task as a delegate of the identified user.
Claim 14
Dependent Claim
217 words
A distributed computer system comprising: a user database correlating user identities with corresponding rights; an access control system for enforcing user rights by comparing the rights of a user seeking access to a system resource with the rights needed to access the resource and allowing access only if the user has sufficient rights; a user authentication system for authenticating users, the database and access control system and authentication system cooperating such that the access control system gives a user the rights corresponding to a user identity in the user database if the authentication system associates the user with that user identity; a secure queue that associates authenticated remote users with tasks they submit to the queue, the tasks containing executable code; an authenticated queue server for servicing the queue, the queue server capable of executing at least part of a task submitted to the queue; and an authority delegation system which associates a submitting remote user's identity with a task submitted by the remote user, thereby permitting the access control system to enforce the identified remote user's rights on the task while the task is being serviced by the queue server, wherein the authority delegation system maintains separate user and delegate identities and the access control system catalogs the task as a delegate of the identified user.
Claim 15
Dependent Claim
14 words
The system of claim 12 , wherein the user database comprises a directory service.
Claim 16
Dependent Claim
15 words
The system of claim 12 , wherein the access control system comprises access control lists.
Claim 17
Dependent Claim
24 words
The system of claim 12 , wherein the user authentication system comprises a credential checker for checking a credential issued by a certification authority.
Claim 18
Dependent Claim
16 words
The system of claim 12 , wherein the queue is managed by a network operating system.
Claim 19
Dependent Claim
15 words
The system of claim 12 , wherein the queue server comprises a Java virtual machine.
Claim 20
Dependent Claim
40 words
The system of claim 12 , wherein the user database and the access control system define roles, such that a user may assume different roles having different security rights while the user is logged in on a single user account.
Claim 21
Dependent Claim
26 words
The system of claim 12 , wherein a task submitted by a user is stored in a repository in a location identified by a resource locator.
Claim 22
Dependent Claim
141 words
A computer storage medium having a configuration that represents data and instructions which will cause at least a portion of a computer system to perform method steps for delegating authority from a user, the method comprising the steps of: providing a secure queue that associates remote users with tasks they submit to the queue; placing in the queue an executable task submitted by an authenticated remote user, the authenticated remote user having security rights which are enforced by an access control system, the executable task identifying executable code; executing at least part of the executable code of the task, execution of the code being managed by the queue server; and delegating user rights to the task by enforcing the authenticated remote user's rights on the task during its execution, wherein the delegating step maintains separate remote user and delegate task identities.
Claim 23
Dependent Claim
141 words
A computer storage medium having a configuration that represents data and instructions which will cause at least a portion of a computer system to perform method steps for delegating authority from a user, the method comprising the steps of: providing a secure queue that associates remote users with tasks they submit to the queue; placing in the queue an executable task submitted by an authenticated remote user, the authenticated remote user having security rights which are enforced by an access control system, the executable task identifying executable code; executing at least part of the executable code of the task, execution of the code being managed by the queue server; and delegating user rights to the task by enforcing the authenticated remote user's rights on the task during its execution, wherein the delegating step maintains separate remote user and delegate task identities.
Claim 24
Dependent Claim
21 words
The configured storage medium of claim 20 , wherein the providing step provides a queue managed by a network operating system.
Claim 25
Dependent Claim
22 words
The configured storage medium of claim 20 , wherein the placing step comprises placing a platform-independent task in an operating system queue.
Claim 26
Independent Claim
97 words
A method for delegating user authority in a distributed computer system, the method comprising the steps of: associating an authenticated user of the distributed computer system with an executable task submitted for execution by the authenticated user, the authenticated user having security rights enforced in the computer system; placing the executable task in an operating system queue; transmitting the queued executable task to an authenticated queue server for execution; and delegating user rights to the task by enforcing the authenticated user's rights on the task, wherein the delegating step maintains separate remote user and delegate task identities.
Claim 27
Independent Claim
97 words
A method for delegating user authority in a distributed computer system, the method comprising the steps of: associating an authenticated user of the distributed computer system with an executable task submitted for execution by the authenticated user, the authenticated user having security rights enforced in the computer system; placing the executable task in an operating system queue; transmitting the queued executable task to an authenticated queue server for execution; and delegating user rights to the task by enforcing the authenticated user's rights on the task, wherein the delegating step maintains separate remote user and delegate task identities.
Claim 28
Dependent Claim
23 words
The method of claim 23 , wherein the associating step comprises placing an identification of the user in the queue with the task.
Claim 29
Dependent Claim
21 words
The method of claim 23 , wherein the placing step comprises placing a Java servlet task in an operating system queue.
Claim 30
Dependent Claim
21 words
The method of claim 23 , wherein the placing step comprises placing a Java applet task in an operating system queue.
Claim 31
Dependent Claim
21 words
The method of claim 23 , wherein the placing step comprises placing a platform-independent application task in an operating system queue.
Claim 32
Dependent Claim
22 words
The method of claim 23 , wherein the placing step comprises placing a native code application task in an operating system queue.
Claim 33
Dependent Claim
28 words
The method of claim 23 , wherein the transmitting step comprises serializing classes stored in a first computer's memory and sending the serialized classes to another computer's memory.
Claim 34
Dependent Claim
27 words
The method of claim 23 , wherein the transmitting step comprises sending the queue server a resource locator identifying the location of executable code of the task.
Claim 35
Dependent Claim
20 words
The method of claim 23 , wherein the transmitting step comprises sending the queue server a stream of executable bytecodes.
Claim 36
Dependent Claim
21 words
The method of claim 23 , wherein the transmitting step comprises sending the queue server information across a network signal line.
Claim 37
Dependent Claim
30 words
The method of claim 23 , wherein the delegating step comprises executing at least part of the executable task and execution of the task is managed by the queue server.
Claim 38
Dependent Claim
21 words
The method of claim 33 , wherein the executing step comprises spawning a virtual machine to interpret bytecodes of the task.
Claim 39
Dependent Claim
225 words
A distributed computer system comprising: a user database correlating user identities with corresponding rights; an access control system for enforcing user rights by comparing the rights of a user seeking access to a system resource with the rights needed to access the resource and allowing access only if the user has sufficient rights; a user authentication system for authenticating users, the database and access control system and authentication system cooperating such that the access control system gives a user the rights corresponding to a user identity in the user database if the authentication system associates the user with that user identity; a secure queue that associates authenticated remote users with tasks they submit to the queue, the tasks containing executable code; an authenticated queue server for servicing the queue, the queue server capable of executing at least part of a task submitted to the queue; and an authority delegation system which associates a submitting remote user's identity with a task submitted by the remote user, thereby permitting the access control system to enforce the identified remote user's rights on the task while the task is being serviced by the queue server; wherein the user database and the access control system define roles, such that a user may assume different roles having different security rights while the user is logged in on a single user account.
Claim 40
Dependent Claim
225 words
A distributed computer system comprising: a user database correlating user identities with corresponding rights; an access control system for enforcing user rights by comparing the rights of a user seeking access to a system resource with the rights needed to access the resource and allowing access only if the user has sufficient rights; a user authentication system for authenticating users, the database and access control system and authentication system cooperating such that the access control system gives a user the rights corresponding to a user identity in the user database if the authentication system associates the user with that user identity; a secure queue that associates authenticated remote users with tasks they submit to the queue, the tasks containing executable code; an authenticated queue server for servicing the queue, the queue server capable of executing at least part of a task submitted to the queue; and an authority delegation system which associates a submitting remote user's identity with a task submitted by the remote user, thereby permitting the access control system to enforce the identified remote user's rights on the task while the task is being serviced by the queue server; wherein the user database and the access control system define roles, such that a user may assume different roles having different security rights while the user is logged in on a single user account.
Claim 41
Dependent Claim
14 words
The system of claim 35 , wherein the user database comprises a directory service.
Claim 42
Dependent Claim
15 words
The system of claim 35 , wherein the access control system comprises access control lists.
Claim 43
Dependent Claim
24 words
The system of claim 35 , wherein the user authentication system comprises a credential checker for checking a credential issued by a certification authority.
Claim 44
Dependent Claim
16 words
The system of claim 35 , wherein the queue is managed by a network operating system.
Claim 45
Dependent Claim
15 words
The system of claim 35 , wherein the queue server comprises a Java virtual machine.
Claim 46
Dependent Claim
26 words
The system of claim 35 , wherein a task submitted by a user is stored in a repository in a location identified by a resource locator.
References Cited (Backward Citations)
US5481720A
Cited
US5349642A
Cited
US5499358A
Cited
US5628007A
Cited
US5671414A
Cited
US5677851A
Cited
US5633931A
Cited
US5692129A
Cited
US5692129B1
Cited
US5761499A
Cited
US5737523A
Cited
US5758069A
Cited
US5737518A
Cited
US5751812A
Cited
US5781724A
Cited
US6061790A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-02-13 | 2004-08-14 | 2005-02-13 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-02-13 | 2008-08-14 | 2009-02-13 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-02-13 | 2012-08-14 | 2013-02-13 | $7700.00 | Window Closed / Lapsed |