Systems and methods for providing object integrity and dynamic permission grants
View Patent ↗Systems and methods for securing the content integrity of and access to object data and code in a distributed system. Content protecting URLs provide a mechanism for checking code or data transmitted out-of-band. Dynamic permission grants are supported during program execution for code or users unknown prior to runtime.
1. A method comprising:
making a remote call to an object in a distributed system, the object comprising object code and object data, the object code corresponding to a code base Universal Resource Locator (URL);
downloading the code base URL in-band;
downloading the object, the download of the object being split into: an in-band download of the object data and an out-of-band download of the object code using the code base URL; and
verifying the integrity of the object code using a content integrity protecting feature of the code base URL.
2. The method of claim 1 , wherein the downloading of the object data and object code comprises downloading the object data and the object code in a remote method invocation.
3. The method of claim 1 , further comprising, prior to using the code base URL, confirming that the code base URL is a content integrity protecting URL.
4. The method of claim 1 , wherein the out-of-band download employs a protocol identified in the code base URL.
5. The method of claim 1 , wherein a message digest included in the code base URL is used to verify the integrity of the downloaded object code.
6. The method according to claim 1 , wherein the in-band downloads of the code base URL and the object data use an encrypted channel and the out-of-band download of the object code is independent of the encrypted channel.
7. The method according to claim 6 , wherein the encrypted channel is an SSL channel and the code base URL is an HTTPS URL.
8. The method according to claim 1 , wherein the code base URL is an HTTPMD URL containing a message digest.
9. The method according to claim 8 , wherein the downloaded object code is verified using the message digest.
10. A method comprising:
making a remote call to an object in a distributed system, wherein the object is split into object code and object data, the object code corresponding to a code base Universal Resource Locator (URL);
downloading the code base URL, wherein the code base URL is downloaded in-band;
downloading the object code, wherein the object code is downloaded out-of-band; and
verifying the integrity of the object code using a content integrity protecting feature of the code base URL.
11. The method of claim 10 wherein downloading the object code out-of-band occurs when it has been determined that the code base URL is a content integrity protecting URL.
12. A computer-readable medium containing instructions to perform a method in a distributed system, the method comprising:
making a remote call from a client to an object in a distributed system, the object comprising object data and object code, the object code corresponding to a code base Universal Resource Locator (URL);
downloading the code base URL in-band;
downloading the object, the download of the object being split into:
an in-band download of the object data and an out-of-band download of the object code using the code base URL; and
verifying the integrity of the object code using a content integrity protecting feature of the code base URL.