Patent ID: 7908599
Filing Date: 2011-03-15
Classification: G06F

Abstract:
1. A method of executing object-oriented program code defined in a code base identified by a first code base identifier, the method comprising: during a class load of a class defined in the code base for the object-oriented program code, assigning a second code base identifier to the class that differs from the first code base identifier for the code base within which the class is defined; and using a security architecture that relies on code base-correlated policies, determining an access permission for an instance of the class by accessing a policy associated with the second code base identifier, wherein assigning the second code base identifier to the class grants a different access permission to the class than that granted to at least one other class defined in the code base and having assigned thereto a different code base identifier from the second code base identifier, and wherein assigning the second code base identifier to the class causes the security architecture to use the second code base identifier to access the policy as a code-based correlated policy correlated to the second code base identifier; wherein the object-oriented program code comprises a collection of JAVA classes disposed in a Java Archive file (JAR) and forming the code base disposed in the JAR file, wherein the class being loaded is one of the collection forming the code base disposed in the JAR file, wherein the JAR file includes the class loader for loading the class and the class being loaded is a first class and the policy is a first policy, the JAR file further including a code base identifier for at least one other class defined in the collection forming the code base disposed in the JAR file for identifying the JAR file, wherein the first policy is disposed in a policy file, the policy file further including a second policy defining an access permission for the at least one other class defined in the collection forming the code base disposed in the JAR file, and wherein the first policy defines an access permission for the first class that is more restrictive than the access permission defined by the second policy.