System and method for specifying access to resources in a mobile code system
Mobile code, such as an applet, is permitted to create a network connection with a content server on a network, without restricting the applet only to connections from the computer from which it was downloaded. This is achieved in accordance with the principles of the present invention by using network restriction software in the execution engine or runtime system under which the applet executes. When the applet attempts to create a network connection to a content server, the network restriction software checks a name file on the content server for the presence of an entry whose name corresponds to the name of the computer from which the applet was downloaded. If such an entry is present, then the network restriction software permits the network connection between the applet and the content server to be created. If not, the applet may not create a network connection with the content server.
1. A method of creating a network connection between an applet executing on a client computer and a content server computer, the method comprising:
providing a name file on the content server computer, the name file having at least one list specifying a type of access that is permissible between the content server computer and applets;
determining a home site name for the applet, the home site name corresponding to a host name of a computer from which the applet was downloaded to the client computer;
checking the name file for an association of a hostname entry with the at least one list in the name file, the hostname entry corresponding to the home site name for the applet, wherein checking the name file for an association comprises determining the at least one list in which the hostname entry is located and identifying the type of access that the at least one list specifies as permissible between the content server computer and the applet; and
making a decision to allow or deny permission for the applet to create a network connection with the content server computer based on the at least one list with which the hostname entry is associated.
2. The method of claim 1 ,
wherein an execution engine executes the applet on the client computer, and
wherein checking the name file comprises using network restriction software in the execution engine to check for the association of the hostname entry with the at least one list.
3. The method of claim 1 ,
wherein the at least one list is an allow list,
wherein, when the hostname entry is associated with the allow list, making the decision comprises allowing permission for the applet to create the network connection with the content server computer, and
wherein, when the hostname is not associated with the allow list, making the decision comprises denying permission for the applet to create the network connection with the content server computer.
4. The method of claim 1 , wherein the hostname entries are specified using wildcards.
5. The method of claim 1 ,
wherein the at least one list is an except list, and
wherein, when the hostname entry is associated with the except list, making the decision comprises denying permission for the applet to create the network connection with the content server computer.
6. The method of claim 1 ,
wherein the at least one list comprises an allow all entry indicating permission to allow all accesses to the content server computer, and
wherein making the decision comprises allowing permission for any applets downloaded from any host computer to create the network connection with the content server computer.
7. The method of claim 1 , further comprising using the hostname entry to determine types of network connections that are permitted between the applet and the content server computer.
8. The method of claim 1 , further comprising performing an address check by:
determining an address list for the content server computer;
determining an address list for the computer from which the applet was downloaded; and
denying permission for the applet to create the network connection with the content server computer when the address list for the content server computer is not a subset of the address list for the computer from which the applet was downloaded.
9. The method of claim 8 , wherein performing the address check further comprises denying permission for the applet to create the network connection with the content server computer when the home site name for the applet is in a selected form, and an address specified by the selected form is not identical to an address for the content server computer.
10. A computer-readable storage medium containing instructions for performing a method for creating a network connection between an applet executing on a client computer and a content server computer, the method comprising:
providing a name file on the content server computer, the name file having at least one list specifying a type of access that is permissible between the content server computer and applets;
determining a home site name for the applet, the home site name corresponding to a host name of a computer from which the applet was downloaded to the client computer;
checking the name file for an association of a hostname entry with the at least one list in the name file, the hostname entry corresponding to the home site name for the applet, wherein checking the name file for the association comprises determining the at least one list in which the hostname entry is located and identifying the type of access that the at least one list specifies as permissible between the content server computer and the applet; and
making a decision to allow or deny permission for the applet to create the network connection with the content server computer based on the at least one list with which the hostname entry is associated.
11. A computer system for creating a network connection comprising:
a client computer executing an applet;
a content server computer having a name file having at least one list specifying a type of access that is permissible between the content server computer and applets; and
a processor:
executing the applet on the client computer and determining a home site name for the applet, the home site name corresponding to a host name of a computer from which the applet was downloaded to the client computer;
checking the name file for an association of a hostname entry with the at least one list in the name file, the hostname entry corresponding to the home site name for the applet, wherein checking the name file for the association comprises determining the at least one list in which the hostname entry is located and identifying the type of access that the at least one list specifies as permissible between the content server computer and the applet; and
making a decision to allow or deny permission for the applet to create the network connection with the content server computer based on the at least one list with which the hostname entry is associated.
12. The method of claim 1 , further comprising denying permission for the applet to create the network connection with the content server computer when the hostname entry is not associated with any list.
13. The computer system of claim 11 , wherein the processor denies permission for the applet to create the network connection with the content server computer when the hostname entry is not associated with any list.
14. The method of claim 1 ,
wherein the at least one list comprises an except list and a second list, and
wherein, when the hostname is associated with the except list, making the decision comprises denying permission for the applet to create the network connection with the content server computer.
15. The method of claim 14 , wherein the second list comprises an allow list for allowing permission for the applet to create the network connection with the content server computer.
16. The method of claim 1 ,
wherein the at least one list comprises an except list for denying permission for the applet to create the network connection with the content server computer and an allow all entry indicating permission to allow all accesses in the name file, and
wherein, when the hostname is associated with the allow all entry, making the decision comprises allowing permission for an applet downloaded from any host computer to create the connection with the content server computer.
17. A method for determining permissions to create a network connection between an applet executing on a client computer and a content server computer having a name file with at least one list specifying a type of access that is permissible between the content server computer and applets, the method comprising:
determining a home site name for the applet, the home site name corresponding to a host name of a computer from which the applet was downloaded to the client computer;
checking the name file for an association of a hostname entry with the at least one list in the name file, the hostname entry corresponding to the home site name for the applet, wherein checking the name file for the association comprises determining the at least one list in which the hostname entry is located and identifying the type of access that the at least one list specifies as permissible between the content server computer and the applet; and
making a decision to allow or deny permission for the applet to create the network connection with the content server computer based on the at least one list with which the hostname entry is associated.
18. The method of claim 17 , further comprising denying permission for the applet to create the network connection with the content server computer when the hostname entry is not associated with any list.
19. The method of claim 1 ,
wherein the at least one list comprises an except list and a second list; and
wherein, when the hostname is associated with the except list and the second list, making the decision comprises denying permission for the applet to create the network connection with the content server computer.