System and method for controlling the use of a method in an object-oriented computing environment

1. A method, comprising:

performing by one or more processors:

a first object creating a second object in an object-oriented computing environment, wherein the second object comprises a restricted method;

the second object providing an access-token to the first object to share the access-token with the first object, wherein the second object retains the access-token, and wherein the access-token is useable to control access to the restricted method by particular object instances subsequent to said providing;

the second object receiving a method call to the restricted method accompanied by a caller access-token;

the second object authenticating the caller access-token against the shared access-token; and

executing the restricted method if the caller access-token is valid; or

denying the access to the restricted method if the caller access-token is not valid.

2. The method according to claim 1 , further comprising providing the access-token to the first object in response to the first object making a call to said restricted method.

3. The method according to claim 1 , further comprising the second object generating the access-token prior to said providing the access-token to the first object.

4. The method according to claim 1 , wherein said access-token comprises an identity indicator of the first object.

5. The method according to claim 4 , further comprising a runtime environment automatically providing said identity indicator of the first object to the second object at creation of the second object.

6. The method according to claim 1 , wherein the second object receives the caller access-token as an argument of the method call.

7. The method according to claim 6 , wherein the second object receives the caller access-token in encrypted form.

8. The method according to claim 1 , wherein the caller access-token is passed implicitly as part of a runtime environment to accompany said method call.

9. The method according to claim 1 , further comprising:

the first object providing a third object with the access-token;

the third object making a method call to the restricted method accompanied by the access-token provided by the first object; and

the third object being allowed access to the restricted method.

10. The method according to claim 1 , further comprising:

sharing a second access-token between the first object and the second object, the second object retaining said second access-token; and

the second object authenticating a caller access-token against said second access-token.

11. The method according to claim 10 , further comprising invalidating the access-token originally shared with the first object.

12. The method according to claim 10 , wherein said sharing a second access-token comprises the first object providing the second access-token to the second object in conjunction with a caller access-token, further comprising the second object authenticating the caller access-token provided in conjunction with the second access-token against the originally shared access-token prior to accepting the second access-token for use in authentication.

13. The method according to claim 10 , wherein said sharing a second access-token comprises the second object providing the second access-token to the first object in response to the first object providing the second object with a caller access-token, further comprising the second object authenticating the caller access-token provided by the first object against the originally shared access-token prior to providing the second access-token to the first object.

14. The method according to claim 1 , further comprising raising a notification if the caller access-token does not match the shared access-token.

15. The method according to claim 14 , wherein the notification is a security exception.

16. The method according to claim 1 , wherein the first object is the owner of the second object.

17. The method according to claim 1 , wherein the object-oriented computing environment is a protected runtime environment.

18. A system, comprising:

a processor; and

a memory coupled to the processor;

wherein the memory comprises program instructions executable by the processor to implement:

a first object creating a second object in an object-oriented computing environment, wherein the second object comprises a restricted method;

the second object providing an access-token to the first object to share the access-token with the first object, wherein the second object retains the access-token, and wherein the access-token is useable to control access to the restricted method by particular object instances subsequent to said providing;

the second object receiving a method call to the restricted method accompanied by a caller access-token;

the second object authenticating the caller access-token against the shared access-token to control use of the method; and

executing the restricted method if the caller access-token is valid; or

denying the access to the restricted method if the caller access-token is not valid.

19. The system of claim 18 , wherein the program instructions are further executable to implement said providing the access-token to the first object in response to the first object making a call to said restricted method.

20. The system of claim 18 , wherein the program instructions are further executable to implement the second object generating the access-token prior to said providing the access-token to the first object.

21. The system of claim 18 , wherein said access-token comprises an identity indicator of the first object.

22. The system of claim 21 , wherein the program instructions are further executable to implement a runtime environment automatically providing said identity indicator of the first object to the second object at creation of the second object.

23. The system of claim 18 , wherein the second object receives the caller access-token as an argument of the method call.

24. The system of claim 23 , wherein the second object receives the caller access-token in encrypted form.

25. The system of claim 18 , wherein the caller access-token is passed implicitly as part of a runtime environment to accompany said method call.

26. The system of claim 18 , wherein the program instructions are further executable to implement:

the first object providing a third object with the access-token;

the third object making a method call to the restricted method accompanied by the access-token provided by the first object; and

the third object being allowed access to the restricted method.

27. The system of claim 26 , wherein the program instructions are further executable to implement:

sharing a second access-token between the first object and the second object;

the second object retaining said second access-token; and

the second object authenticating a caller access-token against said second access-token.

28. The system of claim 27 , wherein the program instructions are further executable to implement invalidating the access-token originally shared with the first object.

29. The system of claim 27 , wherein said sharing a second access-token comprises the first object providing the second access-token to the second object in conjunction with a caller access-token, and wherein the program instructions are further executable to implement the second object authenticating the caller access-token provided in conjunction with the second access-token against the originally shared access-token prior to accepting the second access-token for use in authentication.

30. The system of claim 27 , wherein said sharing a second access-token comprises the second object providing the second access-token to the first object in response to the first object providing the second object with a caller access-token, wherein the program instructions are further executable to implement the second object authenticating the caller access-token provided by the first object against the originally shared access-token prior to providing the second access-token to the first object.

31. The system of claim 18 , wherein the program instructions are further executable to implement raising a notification if the caller access-token does not match the shared access-token.

32. A method, comprising:

performing by one or more processors:

a first object creating a second object in an object-oriented computing environment;

the second object providing an access-token to the first object to share the access-token with the first object;

the second object retaining the access-token;

the first object making a call to a restricted method of the second object, wherein said call is accompanied by the access-token;

the second object authenticating the access-token accompanying the call against the shared access-token, wherein the shared access-token is useable to control access to the restricted method by particular object instances subsequent to said providing; and

executing the restricted method if the access-token accompanying the call is valid; or

denying the access to the restricted method if the access-token accompanying the call is not valid.

33. A method, comprising:

performing by one or more processors:

an object comprising a restricted method providing an access-token to a second object that created the object to share the access-token with the second object in an object-oriented computing environment;

the object storing the shared access-token;

the object receiving a method call to the restricted method accompanied by an access-token;

the object authenticating the access-token accompanying the method call against the access-token shared with the second object, wherein the shared access-token is useable to control access to the restricted method by particular object instances subsequent to said providing; and

executing the restricted method if the access-token accompanying the call is valid; or

denying the access to the restricted method if the access-token accompanying the call is not valid.

34. A method for controlling the use of a method in an object-oriented computing environment, comprising:

performing by one or more processors:

receiving a call from a first object to a method of a second object in the object-oriented computing environment, said call representing a first call to said method;

the second object providing an access-token to the first object to share the access-token with the first object in response to said first call, wherein the second object retains the access-token, and wherein the access-token is useable to control access to the method of the second object by particular object instances subsequent to said providing;

the second object receiving a subsequent call to said method of the second object accompanied by a caller access-token;

the second object being capable of controlling the use of the method of the second object by authenticating the caller access-token against the shared access-token; and

executing the restricted method if the caller access-token is valid; or

denying the access to the restricted method if the caller access-token is not valid.

35. A method for controlling the use of a method in an object-oriented computing environment, comprising:

performing by one or more processors:

a second object providing an access-token to a first object to share the access-token with the first object in the object-oriented computing environment;

retaining the access-token in the second object;

receiving a call to a method of the second object, said call being accompanied by a caller access-token;

the second object authenticating the caller access-token against the shared access-token, wherein the access-token is useable to control access to the method of the second object by particular object instances subsequent to said providing; and

executing the method of the second object if the caller access-token is valid; or

denying the access to the restricted method if the caller access-token is not valid.

36. A computer-readable storage medium comprising program instructions, said program instructions being computer-executable to implement:

a first object creating a second object in an object-oriented computing environment, wherein the second object comprises a restricted method;

the second object providing an access-token to the first object to share the access-token with the first object, wherein the second object retains the access-token, and wherein the access-token is useable to control access to the restricted method by particular object instances subsequent to said providing; and

the second object receiving a method call to the restricted method accompanied by a caller access-token;

wherein the second object is capable of controlling use of the method by authenticating the caller access-token against the shared access-token; and

executing the restricted method if the caller access-token is valid; or

denying the access to the restricted method if the caller access-token is not valid.

37. A computer-readable storage medium comprising program instructions, said program instructions being computer-executable to implement:

receiving a call from a first object to a method of a second object in an object-oriented computing environment, said call representing the first call to said method;

the second object providing an access-token to the first object to share the access-token with the first object in response to said first call, wherein the second object retains the access-token, and wherein the access-token is useable to control access to said method by particular object instances subsequent to said providing;

the second object receiving a subsequent call to said method accompanied by a caller access-token;

the second object authenticating the caller access-token against the shared access-token; and

executing the method if the caller access-token is valid; or

denying the access to the restricted method if the caller access-token is not valid.

38. A computer-readable storage medium comprising program instructions, said program instructions being computer-executable to implement:

a second object providing an access-token to a first object to share the access-token with the first object in an object-oriented computing environment;

retaining the access-token in the second object; and

receiving a call to a method of the second object, said call being accompanied by a caller access-token;

the second object authenticating the caller access-token against the shared access-token, wherein the access-token is useable to control access to said method by particular object instances subsequent to said providing; and

executing the method if the caller access-token is valid; or

denying the access to the restricted method if the caller access-token is not valid.