System and Method for Specifying Access to Resources in a Mobile Code System

Abstract

Mobile code, such as an applet, is permitted to create a network connection with a content server on a network, without restricting the applet only to connections from the computer from which it was downloaded. This is achieved in accordance with the principles of the present invention by using network restriction software in the execution engine or runtime system under which the applet executes. When the applet attempts to create a network connection to a content server, the network restriction software checks a name file on the content server for the presence of an entry whose name corresponds to the name of the computer from which the applet was downloaded. If such an entry is present, then the network restriction software permits the network connection between the applet and the content server to be created. If not, the applet may not create a network connection with the content server.

1 - 15 . (canceled) 
   
   
       16 . A method of creating a network connection between an applet executing on a client computer and a content server, the method comprising:
 determining a home site name for a computer from which the applet was downloaded to the client computer;   checking for an association of a hostname entry with at least one list in a file produced by the content server, the hostname entry corresponding to the home site name, the at least one list specifying a type of access that is permissible between the content server and applets, and wherein checking for the association comprises:
 determining the at least one list with which the hostname entry is associated, and 
 identifying the type of access that the at least one list specifies as permissible between the content server and the applet; and 
   making a decision to allow or deny permission for the applet to create a network connection with the content server based on the at least one list with which the hostname entry is associated.   
   
   
       17 . The method of  claim 16 ,
 wherein an execution engine executes the applet on the client computer, and   wherein checking for an association comprises using network restriction software in the execution engine to check for the association of the hostname entry with the at least one list.   
   
   
       18 . The method of  claim 16 ,
 wherein the at least one list is an allow list,   wherein, when the hostname entry is associated with the allow list, making the decision comprises allowing permission for the applet to create the network connection with the content server, and   wherein, when the hostname is not associated with the allow list, making the decision comprises denying permission for the applet to create the network connection with the content server.   
   
   
       19 . The method of  claim 16 , wherein the hostname entry is specified using a wildcard. 
   
   
       20 . The method of  claim 16 ,
 wherein the at least one list is an except list, and   wherein, when the hostname entry is associated with the except list, making the decision comprises denying permission for the applet to create the network connection with the content server.   
   
   
       21 . The method of  claim 16 ,
 wherein the at least one list comprises an allow all entry indicating permission to allow all accesses to the content server, and   wherein making the decision comprises allowing permission for any applets downloaded from any host computer to create the network connection with the content server.   
   
   
       22 . The method of  claim 16 , further comprising using the hostname entry to determine a type of network connection that is permitted between the applet and the content server. 
   
   
       23 . The method of  claim 16 , further comprising performing an address check by:
 determining an address list for the content server;   determining an address list for the computer from which the applet was downloaded; and   denying permission for the applet to create the network connection with the content server when the address list for the content server is not a subset of the address list for the computer from which the applet was downloaded.   
   
   
       24 . The method of  claim 23 , wherein performing the address check further comprises denying permission for the applet to create the network connection with the content server when the home site name for the applet is in a selected form, and an address specified by the selected form is not identical to an address for the content server. 
   
   
       25 . The method of  claim 16 , further comprising denying permission for the applet to create the network connection with the content server when the hostname entry is not associated with any list. 
   
   
       26 . The method of  claim 16 ,
 wherein the at least one list comprises an except list and a second list, and   wherein, when the hostname is associated with the except list, making the decision comprises denying permission for the applet to create the network connection with the content server.   
   
   
       27 . The method of  claim 26 , wherein the second list comprises an allow list for allowing permission for the applet to create the network connection with the content server. 
   
   
       28 . The method of  claim 16 ,
 wherein the at least one list comprises an except list for denying permission for the applet to create the network connection with the content server and an allow all entry indicating permission to allow all accesses in the file, and   wherein, when the hostname is associated with the allow all entry, making the decision comprises allowing permission for an applet downloaded from any host computer to create the network connection with the content server.   
   
   
       29 . The method of  claim 16 ,
 wherein the at least one list comprises an except list and a second list; and   wherein, when the hostname is associated with the except list and the second list, making the decision comprises denying permission for the applet to create the network connection with the content server.   
   
   
       30 . A method for determining permissions to create a network connection between an applet executing on a client computer and a content server, the method comprising:
 determining a home site name for a computer from which the applet was downloaded to the client computer;   checking for an association of a hostname entry with at least one list in a file produced by the content server, the hostname entry corresponding to the home site name, the at least one list specifying a type of access that is permissible between the content server and applets, and wherein checking for the association comprises:
 determining the at least one list with which the hostname entry is associated, and 
 identifying the type of access that the at least one list specifies as permissible between the content server and the applet; and 
   making a decision to allow or deny permission for the applet to create the network connection with the content server based on the at least one list with which the hostname entry is associated.   
   
   
       31 . The method of  claim 30 , further comprising denying permission for the applet to create the network connection with the content server when the hostname entry is not associated with any list. 
   
   
       32 . A computer-readable storage medium containing instructions for performing a method for creating a network connection between an applet executing on a client computer and a content server, the method comprising:
 determining a home site name for a computer from which the applet was downloaded to the client computer;   checking for an association of a hostname entry with at least one list in a file produced by the content server, the hostname entry corresponding to the home site name, the at least one list specifying a type of access that is permissible between the content server and applets, and wherein checking for the association comprises:
 determining the at least one list with which the hostname entry is associated, and 
 identifying the type of access that the at least one list specifies as permissible between the content server and the applet; and 
   making a decision to allow or deny permission for the applet to create the network connection with the content server based on the at least one list with which the hostname entry is associated.   
   
   
       33 . A computer system for creating a network connection comprising:
 a client computer executing an applet;   a content server having a file having at least one list specifying a type of access that is permissible between the content server and applets; and   a processor configured for:
 executing the applet on the client computer and determining a home site name for a computer from which the applet was downloaded; 
 checking for an association of a hostname entry with at least one list in a file produced by the content server, the hostname entry corresponding to the home site name, the at least one list specifying a type of access that is permissible between the content server and applets, and wherein checking for the association comprises: 
 determining the at least one list with which the hostname entry is associated, and 
 identifying the type of access that the at least one list specifies as permissible between the content server and the applet; and 
   making a decision to allow or deny permission for the applet to create the network connection with the content server based on the at least one list with which the hostname entry is associated.   
   
   
       34 . The computer system of  claim 33 , wherein the processor is configured to deny permission for the applet to create the network connection with the content server when the hostname entry is not associated with any list. 
   
   
       35 . A computer system for creating a network connection between an applet executing on a client computer and a content server, the computer system comprising:
 means for determining a home site name for a computer from which the applet was downloaded to the client computer;   means for checking for an association of a hostname entry with at least one list in a file produced by the content server, the hostname entry corresponding to the home site name, the at least one list specifying a type of access that is permissible between the content server and applets, and wherein checking for the association comprises:
 determining the at least one list with which the hostname entry is associated, and 
 identifying the type of access that the at least one list specifies as permissible between the content server and the applet; and 
   means for making a decision to allow or deny permission for the applet to create the network connection with the content server based on the at least one list with which the hostname entry is associated.   
   
   
       36 . A computer system determining permissions to create a network connection between an applet executing on a client computer and a content server, the computer system comprising:
 means for determining a home site name for a computer from which the applet was downloaded to the client computer;   means for checking for an association of a hostname entry with at least one list in a file produced by the content server, the hostname entry corresponding to the home site name, the at least one list specifying a type of access that is permissible between the content server and applets, and wherein checking for the association comprises:
 determining the at least one list with which the hostname entry is associated, and 
 identifying the type of access that the at least one list specifies as permissible between the content server and the applet; and 
   means for making a decision to allow or deny permission for the applet to create the network connection with the content server based on the at least one list with which the hostname entry is associated.   
   
   
       37 . The computer system of  claim 36 , further comprising means for denying permission for the applet to create the network connection with the content server when the hostname entry is not associated with any list.