Security association mediator for java-enabled devices
View Patent ↗The invention provides a system and method for providing security against unauthorized access to a java enabled network device. The system includes multiple conventional class loaders, code verifiers, security managers, access managers, SAMs, a certificate authority and a policy server. The SAM verifies the authenticity of the entity and either allows a download/access to a device or rejects the download/access to a network device. The certificate authority is a repository for public key certificates and may be a part of the secure network or part of the unsecured network. The policy server is a repository for the rights (privileges) an entity is entitled to on the secure network. The code verifiers verify that the Byte Code is valid java code. The security manager is the conventional security manager. The class loader loads the code to the device and the access manager assigns access levels to each Java thread that is created.
1. A method of providing security against unauthorized access to internal resources of a network device comprising;
receiving a digital signature at a security association manager (SAM);
said SAM requesting a de-encryption code;
said SAM de-encrypting said digital signature with said de-encryption code;
said SAM authenticating said de-encrypted digital signature;
said SAM requesting allowed operations associated with said authenticated signature;
a policy server receiving said request for allowed operations associated with said authenticated signature;
said policy server comparing said authenticated signature with information stored on said policy server; and
said policy server sending a response to said SAM indicating an access level corresponding to said authenticated signature.
2. A method of providing security according to claim 1 further comprising:
said policy server authenticating said request for allowed operations associated with said authenticated signature prior to comparing said authenticated signature with said information stored on said policy server.
3. Apparatus for providing security against unauthorized access to internal resources of a network device comprising:
means, within a security association manager, for receiving a digital signature;
means, within said security association manager, for accessing a de-encryption code associated with said digital signature, and for decrypting and authenticating said digital signature; and
means, within a policy server, for receiving a request for allowed operations associated with said authenticated digital signature policy server; and
means, within said policy server, responsive to said request, and to a comparison of said authenticated digital signature with information within said policy server, for determining an access level for a java thread associated with said digital signature, and for sending an indication of said access level in a response to said security association manager.
4. Apparatus for providing security against unauthorized access to internal resources of a network device comprising:
a security association manager (SAM) configured to receive a digital signature;
wherein said SAM is configured to send a message including a portion of said digital signature;
wherein said message includes a request for an encryption decoder;
wherein said SAM is further configured to receive a response to said message; and
wherein said SAM is configured to send a digitally signed message requesting an access level for program code associated with said digital signature, in response to receiving said response message;
a policy server configured to receive said request for allowed operations associated with said authenticated signature;
said policy server including a comparison device configured to compare said authenticated signature with information stored on said policy server; and
said policy server being configured to send a response to said SAM indicating an access level corresponding to said authenticated signature.