US20040163087A1 - Computer program code and method for delivering external data to a process running on a virtual machine - Google Patents

Computer program code and method for delivering external data to a process running on a virtual machine Download PDF

Info

Publication number
US20040163087A1
US20040163087A1 US10369268 US36926803A US2004163087A1 US 20040163087 A1 US20040163087 A1 US 20040163087A1 US 10369268 US10369268 US 10369268 US 36926803 A US36926803 A US 36926803A US 2004163087 A1 US2004163087 A1 US 2004163087A1
Authority
US
Grant status
Application
Patent type
Prior art keywords
virtual machine
process
applet
data
user interface
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US10369268
Inventor
Carl Sandland
Matthew Herscovitch
Timothy Dingwall
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
PROTOCOM DEVELOPMENT SYSTEMS PTY Ltd
Original Assignee
PROTOCOM DEVELOPMENT SYSTEMS PTY Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44Arrangements for executing specific programs
    • G06F9/451Execution arrangements for user interfaces
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/41User authentication where a single sign-on provides access to a plurality of computers
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44Arrangements for executing specific programs
    • G06F9/455Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533Hypervisors; Virtual machine monitors
    • G06F9/45537Provision of facilities of other operating environments, e.g. WINE
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network
    • H04L63/0815Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network providing single-sign-on or federations

Abstract

A method and system for delivering external data to a process running on a virtual machine, said virtual machine running on an operating system. The method includes the steps of executing instructions on the virtual machine that obtain state data related to the process; querying the virtual machine to obtain component data related to the state data; and manipulating the component data to deliver the external data to the process. In one example, the system provides a single sign-on application that passes user credentials to a Java applet running on a Java virtual machine.

Description

    BACKGROUND OF THE INVENTION
  • 1. Field of the Invention [0001]
  • The present invention relates to computer program code and a method for communicating with a process running on a virtual machine. By way of illustrative example of a preferred embodiment of the present invention reference will be made to a single sign-on application that passes user credentials to a Java applet running on a Java Virtual Machine. It is to be understood however that the present invention is applicable for communicating with a process running on a virtual machine in contexts other than single sign on applications. [0002]
  • It is also to be understood that the term “process” it to be understood as having a broad meaning encompassing any executable computer code or data, whether compiled or interpreted, including but not limited to threads, procedures, scripts and programs. [0003]
  • 2. Discussion of the Related Art [0004]
  • When computers were first deployed, such as in a work environment, there was generally a single computer, (such as mainframe or minicomputer) shared by a number of users, who accessed the computer via “dumb” terminals. A user would authenticate their identity when logging in by entering a user name and password into their terminal and thereby gaining access to the resources (ie. programs and data) of the computer. Since there was only a single computer, the authentication process only had to be performed once per user session. [0005]
  • With the establishment of local area networks linking PCs and/or workstations, minicomputers and mainframes, users often had to authenticate themselves to their own workstation to gain initial access to the network, and then separately to each network node on which a required resource resided. However, the maximum number of nodes on local area networks was fairly constrained, meaning that the number of different log-in names and passwords that a user needed to know was manageable. [0006]
  • Most local area networks are now connected to wide area networks and principally the Internet. With Internet connectivity users have access to effectively limitless resources residing on globally dispersed network nodes. For example, as illustrated in FIG. 1, a user workstation [0007] 100, such as a PC, is connected to a network 102. Typically the workstation 100 is connected to a local area network (LAN). In turn, the LAN is connected via an Internet Service Provider (ISP) (not shown) to a router (not shown) that provides access to the Internet. The LAN may also be connected via the telephone system to other LANs to form extranets. The network 102 illustrated in FIG. 1, refers to LANs (including extranets), wide area networks and the Internet.
  • Network connectivity allows user access to resources residing on an Application Server [0008] 104 that runs applications for the user and delivers output to the user workstation 100. Applications may also run directly on the user workstation and have access to file servers 106, print servers 108 and email servers 110 residing on the LAN or on other networks including the Internet.
  • The user workstation [0009] 100 also has access to resources on a mainframe/Unix Host 112 that are accessed via terminal emulator software, using a protocol such as TN 3270, running on the user workstation. Network connectivity also allows access to any number of services 114 available on the World Wide Web, such as internet banking, online auctions, online retailers, commercial databases (such as Lexis or Dialog) and web mail
  • Potentially, a user may have to authenticate themselves each time they wish to access a particular resource, meaning that a large volume of authentication credentials (such as user names, and passwords) needs to be remembered. Additionally, for security purposes, many services require that a password be changed on a regular basis, thus adding to the confusion and difficulty in managing authentication credentials. [0010]
  • In an attempt to better manage authentication of user credentials Single Sign On (SSO) systems have been developed. SSO allows automation of the authentication process, whereby users authenticate themselves once, with the SSO system then managing subsequent authentications if and when required. In some cases, SSO is provided by an authentication server [0011] 116, accessible to the user work station 100 over the network 102. Alternatively, the SSO system can run directly on the user workstation 100 or on both the workstation 100 and server 116. A database (such as an X.500 based Directory) of authentication credentials 118 is accessible to the SSO system. For security purposes the authentication credentials are stored in encrypted form.
  • An overview of an SSO system is given by reference to FIG. 2. Generally, the SSO system runs as a background process on the user workstation [0012] 100 in step 202. At step 204, data that is indicative of the state of a user interface (hereinafter referred to as “user interface state data”) presented on the user workstation is examined to detect whether there is a log-in opportunity. This step is typically implemented via services provided by the operating system as understood by those skilled in the art. For example the Windows operating system provides application programming interfaces (API's) that allow an application to be notified of various user interface events. This mechanism, known as “Windows hooking”, allows the application to determine when a window is created, what the window contains and properties of the window such as its title, position and others. After detecting a log-in opportunity at step 206, the SSO system determines the particular resource related to the log-in opportunity (such as application, mainframe, web service etc) and retrieves the relevant authentication credentials from the database 118. These credentials are then applied at step 210 to the user interface object, such as by entering the user name and password to thereby complete the authentication process. The user is thus relieved from having to remember and enter the correct user name and password to access a particular resource.
  • The resources accessed by the SSO system may exist on the user workstation [0013] 100 as an application program, as is illustrated in FIG. 3. In this case, an application program 300 (for example a terminal emulator or email client) uses operating system 302 services such as a user interface 304 to perform its tasks. The SSO system 200 is also an application program that, as noted above, uses operating system services to authenticate the user to particular resources.
  • However, some resources do not exist as an application program running directly on the operating system [0014] 302, but rather as a process running on a virtual machine 304. A virtual machine can be described as a software simulated machine providing the operational equivalent of a real machine that does not exist as a physical entity per se. A virtual machine 304 takes instructions from a process 306 and converts them to instructions that are recognisable by the operating system 302 and hardware 308 on which the virtual machine 304 runs.
  • For example, as illustrated in FIG. 4 a web browser [0015] 310 such as Microsoft Internet Explorer exists as an application program running on an operating system 302 (such as Microsoft Windows), which in turn is running on particular hardware 308 (such as an Intel processor with memory and peripherals). The web browser 310 implements a virtual machine 304 on which processes may be run. In particular, a Java applet 306 delivered as part of a web page to the web browser 310 over the internet 102, exists as a process that runs on the virtual machine 304 (for example the JVM developed by Sun Microsystems).
  • The Java applet uses services provided by the virtual machine, to instructions recognisable by the operating system [0016] 302 and hardware 308 implementing the virtual machine 304. The Java programming language was developed by Sun Microsystems and has been successful due to its cross platform portability, in that a single Java program may be written for any platform that implements the JVM. Thus, the same applet may be written for and run on a platform employing, for example, the Microsoft, Unix, Linux or Macintosh operating system or indeed any platform that implements a JVM.
  • Numerous web based services provide authentication prompts, such as requests for user names and passwords via a Java applet that is downloaded to the user's browser and runs on a virtual machine. An effective SSO system would allow authentication to any resource, irrespective of how the resource exists on a user workstation [0017] 100. Whilst current SSO systems allow accurate authentication to a resource existing as an application program, they are less successful where the resource exists as a process running on a virtual machine. Thus SSO systems could be improved to allow authentication into a virtual machine. Also, it would be advantageous to communicate with processes running on virtual machines for other purposes.
  • SUMMARY OF THE INVENTION
  • 1. Object of the Invention [0018]
  • The present invention aims to provide an alternative to known software products and methods of the type referred to above. More particularly, the invention aims to provide a computer software product and method that allows communication with a process running on a virtual machine. [0019]
  • 2. Disclosure of the Invention According to a first aspect of the present invention there is provided a method for delivering external data to a process running on a virtual machine, said virtual machine running on an operating system, the method including the steps of: [0020]
  • executing instructions on the virtual machine that obtain state data related to the process; [0021]
  • querying the virtual machine to obtain component data related to the state data; and [0022]
  • manipulating the component data to deliver the external data to the process. [0023]
  • Typically the process implements a user interface and the state data is user interface state data. The user interface is generally a graphical user interface (GUI) and the user interface state data preferably indicates the creation of a top level window in the GUI. [0024]
  • Optionally the instructions utilise an applications program interface (API) running on the virtual machine to obtain the state data. It has been found that an accessibility API is a suitable API and that the state data may be obtained by using an accessibility API to hook the virtual machine process. [0025]
  • The process may for example be an applet or an application. [0026]
  • Prior to the querying step, the method may include the optional steps of calling a second process that executes outside the virtual machine and obtaining attribute data relating to the state data from the second process. [0027]
  • The attribute data may include any one or more of: [0028]
  • a location indicator specifying a directory containing a main Class file of the applet, [0029]
  • a name of the main Class file, [0030]
  • a unique identifier allocated by the operating system to a parent window of the applet, and [0031]
  • a time value representing the time when GUI objects created by the applet were loaded and displayed. [0032]
  • Preferably the attribute data is forwarded for use by the instructions executing on the virtual machine and may be forwarded in a UDP packet. [0033]
  • The instructions executing on the virtual machine may be additionally operative to: [0034]
  • determine the unique identifier allocated by the operating system to a parent window of the applet; and [0035]
  • confirm that the unique identifier determined by the virtual machine instructions matches the unique identifier allocated externally by the operating system. [0036]
  • The external data is preferably delivered to the parent window identified by the unique identifier. [0037]
  • The external data could, for example be a login script for entering authentication credentials into the process. [0038]
  • According to a second aspect of the present invention there is provided computer program code for carrying out the method of the first aspect of the invention. [0039]
  • According to a third aspect of the present invention there is provided a Single Sign On System including: [0040]
  • a computer terminal; [0041]
  • an operating system installed on said computer terminal; [0042]
  • a virtual machine running on the operating system; [0043]
  • a server communicatively coupled to the computer terminal; [0044]
  • a Java applet stored at the server, the applet including instructions that when executed on a virtual machine define a user interface [0045]
  • a browser installed on said computer terminal operative to download the Java applet from the server and run the Java applet on the virtual machine; [0046]
  • a database of authentication credentials accessible to the computer terminal; and [0047]
  • instructions executable on the virtual machine operative to: [0048]
  • obtain user interface state data from the Java applet; [0049]
  • query the virtual machine to obtain component data related to the user interface state data; and [0050]
  • manipulate the component data so as to deliver authentication credentials to the Java applet. [0051]
  • The software product method and system of the present invention allows communication with a process running on a virtual machine and can be used to implement an SSO system. In addition the present invention could be utilised in any situation where communication with virtual machine processes is required, such as for testing software code written to be executed on a virtual machine.[0052]
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • A preferred embodiment of the present invention will now be described with reference to the following drawings, in which like reference numbers denote the same element throughout and wherein: [0053]
  • FIG. 1 is a block diagram illustrating the resources available to a user workstation via network connectivity as occurs in the prior art; [0054]
  • FIG. 2 is a flow chart illustrating the operation of an SSO system as occurs in the prior art; [0055]
  • FIG. 3 is a block diagram illustrating an application program running on an operating system and a Java applet running on a Virtual Machine inside a Web Browser; [0056]
  • FIG. 4 is a block diagram illustrating the components of the software product of the present invention; [0057]
  • FIG. 5 is a flow chart illustrating a high level view of the process carried out by the software product of the present invention; [0058]
  • FIG. 6 is flow chart illustrating the process carried out by the SSO Hook in receiving user interface state data and calling the other components of the software product; [0059]
  • FIG. 7 is a flow chart illustrating the process carried out by the Browser Helper Object after being called by the SSO Hook; [0060]
  • FIG. 8 is a flow chart illustrating the process carried out by the SSO Hook after receiving a discovery packet from the Browser Helper Object; [0061]
  • FIG. 9 is a flowchart illustrating the process carried out by the SSO Hook in passing a login script to a Window opened by the Java Applet running on the virtual machine; [0062]
  • FIG. 10 is a flow chart illustrating the process carried out by the JNI DLL after being called by the SSO Hook.[0063]
  • DESCRIPTION OF THE PREFERRED EMBODIMENTS
  • Turning to FIG. 4, there is illustrated the user workstation [0064] 100, which is a PC having conventional hardware 308, on which an Operating System 302, such as Microsoft
  • Windows is running. Two application programs, being a web browser [0065] 310 and an SSO system 200 are running on the Operating System 302. A virtual machine 304 such as the JVM is implemented within the web browser 310 that allows a Java applet 306, downloaded from the Internet with a web page 410 to run on the user workstation. The applet 310 is written in the Java programming language and uses services provided by the virtual machine to perform its tasks and actually runs on the virtual machine 304 as a thread inside the browser process 302. The program instructions of the applet will be converted by the virtual machine 304 into instructions that can be executed by the operating system 302. The conversion process, however, is hidden from the applet 306 that needs only to call services that are provided by the virtual machine. In turn, the operating system 302 implements the necessary routines from the hardware 308 to execute the converted instructions.
  • The task of the applet [0066] 306 in this example is to request the entry of a user name and password from the user of the workstation 100, to allow the user access to resources provided at the web server from which the web page 410 was obtained. To accomplish this task, a user interface object such as a window with text entry boxes to receive a user name and password must be created in a graphical user interface. Application programs running on the operating system 302 utilise APIs 412 provided by the operating system 302 to create such objects. In the case of Microsoft's 32 bit Windows Operating Systems the relevant APIs are known as “Win32” and application programs that rely on these APIs are known as Win32 applications. Also, as was noted above, the operating system 302 may also provide APIs that allow an application program to be notified of user interface events, such as the creation of a window in the graphical user interface (GUI).
  • However, in recent Java graphical user interface (GUI) frameworks only the browser [0067] 310 window that contains the top level Java window (“the applet frame window”) is a Win32 window, with other user interface objects appearing to the operating system as a privately managed screen area. Thus where a window, other than an applet frame window, is created by the Java applet 306 running inside the virtual machine 304, data that is indicative of the state of a user interface (the “user interface state data”), except for title of the Window, is not accessible to application programs, including the SSO system 200. It is for this reason that current SSO systems are not suited to authenticating users to services that exist as processes running on a virtual machine.
  • To provide access to this user interface state data, an Accessibility API [0068] 402 also runs on the virtual machine 304. An example of an Accessibility API that is suitable for implementing the present invention is the Java Accessibility API that was designed by Sun Microsystems to allow third party applications and in particular those used by the disabled (for example Braille readers, speech synthesisers, image enlargers etc) to interact with Java applets. It has been surprisingly found that an Accessibility API provides access to crucial user interface state data that can be used by the SSO system 200 to pass data from a process running outside the virtual machine (“external data”) into the applet.
  • The present invention works best with versions [0069] 6 and above of Microsoft's Internet Explorer having the Javasoft Runtime Environment (“JRE”) plugin with Accessibility API installed. Accessibility should be appropriately enabled through the awt.properties and Accessibility.properties files residing on the appropriate JRE.
  • An SSO Hook [0070] 400, written in the Java programming language, also runs on the virtual machine 304 with the applet 306 and the Accessibility API 402. The SSO Hook 400 can be registered with the Accessibility API 402 to obtain state data relevant to the applet 306. Additionally the SSO Hook 400 also includes instructions for forwarding external data from the SSO System 200, to the applet 306 by manipulating the state data obtained from the Accessibility API 402.
  • Also running on the virtual machine [0071] 304 is a Java Native Interface (“JNI”) Component the functionality of which is detailed below.
  • Outside the virtual machine is a Win[0072] 32 Component Object Model (“COM”) component known as a Browser Helper Object (BHO) 406, again having functionality that is detailed further below.
  • A high level view of the operation of the components of the invention described in FIG. 4 is given by reference to FIG. 5. At step [0073] 500, the SSO System 200 causes the SSO Hook 400 to execute on the virtual machine 304 as a background process. User Interface State Data is then received at step 504 and examined by the SSO Hook 400. At step 504 a test is carried out to determine whether the User Interface State Data defines a login opportunity related to the Java applet 306, running on the virtual machine 304. In the event that a login opportunity is defined the relevant authentication credentials are retrieved from the database 118 at step 506. These credentials are then applied to the Java applet in step 508 to effect the authentication.
  • The initial stage of the process commences when the SSO Hook [0074] 400 executes on the virtual machine 304 and this stage is illustrated in more detail by reference to FIG. 6. At step 600, the SSO Hook 400 uses the Accessibility API to determine if there is any relevant user interface state data from the Java applet 306 running on the virtual machine 304. Specifically, the Accessibility API will notify the SSO Hook whenever a top level window (being the main window in the window hierarchy for the applet) is created by a Java applet. Although the creation of a top level Window is often discoverable using the standard Win32 hooking mechanisms only the title of the window is available to an application. This is not the case where an Accessibility API is used. Upon notification by the Accessibility API the SSO Hook 400 examines various attributes of the top level window discovered by the Accessibility API including but not limited to its title, class, child windows and controls.
  • In the case of a Java Application Program, as opposed to an applet, it has been found that sufficient component data can be obtained from the state data to enable sign on data to be passed to the Application Program at this point. Where the process is an applet, further steps need to be taken, as is further described below. [0075]
  • A test is performed at step [0076] 602 to determine whether the user interface state data received from the Accessibility API 402 indicates that a top level window has been created by the applet. In the event that such a window has been created a job is created on an internal queue and a thread is triggered for that job at step 604. The BHO 406 is then called at step 606, followed by the JNI component 407 at step 608. Subsequent to calling these components the SSO Hook 400 waits at step 610 to receive attribute data from the BHO 406 and the JNI component 407. After receiving the attribute data at step 612 the SSO Hook 400 is ready to pass external data to the Java applet 306.
  • As just noted, the BHO [0077] 406 is called by the SSO Hook 400 after the SSO Hook 400 has detected the opening of a top level window by the applet 306. The processes carried out by the BHO 406 are described in more detail by reference to FIG. 7. The BHO 406 checks at step 700 whether a new job has been placed on the queue by the SSO Hook 400. For each new job the BHO 406 obtains attribute data about the relevant applet at step 702. The BHO hooks into the browser 304 running the virtual machine 304 to obtain the discovery information. The practice of hooking was discussed above and uses an interface supplied by the Microsoft Corporation that is documented in the Microsoft Developer Network Manuals, the contents of which are hereby incorporated by reference.
  • The attribute data such hooked from the browser [0078] 302 includes firstly a full URL that completely specifies the directory containing the main Class file of the applet 306. A correct URL of the applet is required to know which credentials from the database 118 to apply to the applet 306.
  • Secondly, the attribute data includes the “Codebase” attribute of the applet which is the name of the main Class file located in the directory identified by the URL. Actual execution of the applet [0079] 306 on the virtual machine 304 begins with the main Class file.
  • Thirdly, the attribute data includes a unique identifier, allocated by the operating system [0080] 302 of the frame window of the browser 304 housing the applet 306 which is also the parent window of the applet 306. In the case of a Windows Operating System this identifier is a variable of type HWND and is also know as a “window handle”. This data is particularly important where there is more than one browser running at once as it ensure that the user credentials from the database are forwarded to the correct window.
  • Fourthly, the attribute data includes the exact time when the GUI objects created by the applet [0081] 306 were loaded and been displayed.
  • A unique port number is calculated for the applet at step [0082] 704. The calculation of the unique port number relies on the fact that each of the applet 306, BHO 400 and SSO Hook are all identified by the same operating system 302 process number. The port number is then used for communications between the BHO and SSO Hook. A Transmission Control Protocol (TCP) packet is formed at step 706 that contains the attribute data obtained at step 702. The attribute data is forwarded at step 708 to the port number created at step 704.
  • The TCP packet is forwarded back inside the virtual machine for use by the SSO Hook [0083] 400 as described by reference to FIG. 8. After receiving the TCP packet (“the discovery packet”) from the BHO 406 at step 800, the SSO Hook 400 parses the discovery packet at step 802 to extract the attribute data contained within the discovery packet, of the window or other GUI elements related to the Java applet 306. As noted above, one of the items of attribute data is the window handle of the browser window that houses the top level Java window of the applet 306. Since there could be more than one browser 310 running of the operating system 302 at any one time, the SSO Hook 400 needs to ensure that the correct credentials from the database 112 are being forwarded to the window. Hence at step 804 the SSO Hook also determines the handle of the browser 310 window housing the top level Java Window. The SSO Hook utilised the JNI Component 407 to make this determination as is further described below.
  • The window handle determined by the SSO Hook [0084] 400 is then matched at step 804 against the window handle forwarded to the SSO Hook in the discovery packet. In the event of a match, the SSO Hook 400 will know that the window identified by the handle is the correct window to receive the authentication credentials. Thus at step 806 the SSO Hook 400 dispatches the discovery packet, containing the attribute data to with window identified by the handle at step 804. As noted above, with reference to FIG. 6, the SSO Hook 400 maintains an internal queue of jobs that represent discovered applets and it is to one of these pending jobs to which attribute data is forwarded.
  • The SSO Hook [0085] 400 utilises the JNI Component 407 to independently determine the handle of the browser 310 window that is hosting the Java applet. This process is now explained with reference to FIG. 10. At step 900 the JNI Component 407 receives the window handle from the SSO Hook 400. At step 902 a Java “Window” type is mapped into the window handle. This step enables the JNI Component 407 to determine whether the window handle forwarded by the SSO Hook 400 relates to the same window that hosts the top level Java window of the applet. At step 904, the window handle is then forwarded back to the SSO Hook 400.
  • After the attribute data is dispatched to the applet [0086] 306, the SSO Hook 400 and the JNI Component 407 are able to pass the authentication credentials to the applet 306 and thereby affect sign on to the resource. This process is described by reference to FIGS. 10. The SSO Hook at step 1000 obtains a component tree from the attribute data. The component tree is obtained by querying the Virtual Machine 304 in a manner familiar to those skilled in the art. At step 1002 the component tree is manipulated by the SSO System Scripting Engine 408. Manipulation of the component tree of a graphical user interface window by an SSO Scripting Engine actually carries out the sign and thus enables access to the relevant resource. It is again a process familiar to those skilled in the art and will not be further detailed here.
  • Several benefits arise from the computer program code and method of the present invention in comparison to the programs and methods of the prior art. Principally, the computer program code and method allow Single Sign On systems to be used to access resources provided processes running on a virtual machine. Additionally, the computer program code and method allow communication with processes running on a virtual machine for other purposes, for example for testing virtual machine processes. [0087]
  • It will be realised that the present invention has been described by reference to a preferred embodiment and that any alterations and modification that are apparent to those skilled in the art are included within the spirit and scope of the invention as defined solely by the claims appended hereto. [0088]

Claims (17)

    We claim:
  1. 1. A method for delivering external data to a process running on a virtual machine, said virtual machine running on an operating system, the method including the steps of:
    executing instructions on the virtual machine that obtain state data related to the process;
    querying the virtual machine to obtain component data related to the state data; and
    manipulating the component data to deliver the external data to the process.
  2. 2. A method according to claim 1 wherein the process implements a user interface and the state data is user interface state data.
  3. 3. A method according to claim 2 wherein the user interface is a graphical user interface (GUI) and the user interface state data indicates the creation of a top level window in the GUI.
  4. 4. A method according to claim 1 wherein the instructions utilise an application programming interface (API) running on the virtual machine to obtain the state data.
  5. 5. A method according to claim 4 wherein the API is an accessibility API and the state data is obtained by hooking the virtual machine process using that API.
  6. 6. A method according to claim 3 wherein the process is a Java applet.
  7. 7. A method according to claim 6 including, prior to the querying step, the step of calling a second process that executes outside the virtual machine and obtaining attribute data relating to the state data from the second process.
  8. 8. A method according to claim 7 wherein the attribute data includes any one or more of:
    a location indicator specifying a directory containing a main Class file of the applet,
    a name of the main Class file,
    a unique identifier allocated by the operating system to a parent window of the applet, and
    a time value representing the time when GUI objects created by the applet were loaded and displayed.
  9. 9. A method according to claim 8 further including instructions for forwarding the attribute data for use by the instructions executing on the virtual machine.
  10. 10. A method according to claim 9 wherein the attribute data is forwarded in a UDP packet.
  11. 11. A method according to claim 9 wherein the instructions executing on the virtual machine are additionally operative to:
    determine the unique identifier allocated by the operating system to a parent window of the applet; and
    confirm that the unique identifier determined by the virtual machine instructions matches the unique identifier allocated externally by the operating system.
  12. 12. A method according to claim 11 wherein the external data is delivered to the parent window identified by the unique identifier.
  13. 13. A method according to claim 2 wherein the external data is a login script for entering authentication credentials into the process.
  14. 14. Computer program code for carrying out the method of claim 1.
  15. 15. Computer program code for carrying out the method of claim 12.
  16. 16. A Single Sign On system for use on a computer terminal having an operating system installed thereon and a virtual machine running on the operating system, and wherein a server is communicatively coupled to the computer terminal; said system including:
    a Java applet stored at the server, the applet including instructions for execution on a virtual machine to define a user interface;
    a browser installed on said computer terminal operative to download the Java applet from the server and run the Java applet on the virtual machine;
    a database of authentication credentials accessible to the computer terminal; and
    instructions executable on the virtual machine, which instructions are operative to:
    obtain user interface state data from the Java applet;
    query the virtual machine to obtain component data related to the user interface state data; and
    manipulate the component data so as to deliver authentication credentials to the Java applet.
  17. 17. A Single Sign On System according to claim 16 wherein the Java applet includes instructions for presenting an object in the user interface that prompts a user of the terminal to authenticate themselves to a resource provided by the server, the virtual machine instructions automatically delivering the authentication credentials to the object to effect the authentication.
US10369268 2003-02-14 2003-02-14 Computer program code and method for delivering external data to a process running on a virtual machine Abandoned US20040163087A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US10369268 US20040163087A1 (en) 2003-02-14 2003-02-14 Computer program code and method for delivering external data to a process running on a virtual machine

Applications Claiming Priority (6)

Application Number Priority Date Filing Date Title
US10369268 US20040163087A1 (en) 2003-02-14 2003-02-14 Computer program code and method for delivering external data to a process running on a virtual machine
AU2004200465A AU2004200465B2 (en) 2003-02-14 2004-02-10 Computer program code and method for delivering external data to a process running on a virtual machine
US11005895 US8695019B2 (en) 2003-02-14 2004-12-07 System and method for delivering external data to a process running on a virtual machine
US12498130 US8191086B2 (en) 2003-02-14 2009-07-06 Computer program code and method for delivering external data to a process running on a virtual machine
US13456647 US8966481B2 (en) 2003-02-14 2012-04-26 Computer program code and method for delivering external data to a process running on a virtual machine
US14182465 US20140325618A1 (en) 2003-02-14 2014-02-18 System and method for delivering external data to a process running on a virtual machine

Related Child Applications (2)

Application Number Title Priority Date Filing Date
US11005895 Continuation-In-Part US8695019B2 (en) 2003-02-14 2004-12-07 System and method for delivering external data to a process running on a virtual machine
US12498130 Continuation US8191086B2 (en) 2003-02-14 2009-07-06 Computer program code and method for delivering external data to a process running on a virtual machine

Publications (1)

Publication Number Publication Date
US20040163087A1 true true US20040163087A1 (en) 2004-08-19

Family

ID=32850305

Family Applications (3)

Application Number Title Priority Date Filing Date
US10369268 Abandoned US20040163087A1 (en) 2003-02-14 2003-02-14 Computer program code and method for delivering external data to a process running on a virtual machine
US12498130 Active 2023-09-23 US8191086B2 (en) 2003-02-14 2009-07-06 Computer program code and method for delivering external data to a process running on a virtual machine
US13456647 Active 2023-11-25 US8966481B2 (en) 2003-02-14 2012-04-26 Computer program code and method for delivering external data to a process running on a virtual machine

Family Applications After (2)

Application Number Title Priority Date Filing Date
US12498130 Active 2023-09-23 US8191086B2 (en) 2003-02-14 2009-07-06 Computer program code and method for delivering external data to a process running on a virtual machine
US13456647 Active 2023-11-25 US8966481B2 (en) 2003-02-14 2012-04-26 Computer program code and method for delivering external data to a process running on a virtual machine

Country Status (1)

Country Link
US (3) US20040163087A1 (en)

Cited By (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050005243A1 (en) * 2003-02-28 2005-01-06 Olander Daryl B. Method for utilizing look and feel in a graphical user interface
US20060206930A1 (en) * 2005-03-08 2006-09-14 Golan Parashi Method and system for rendering single sign on
WO2007149671A2 (en) * 2006-06-23 2007-12-27 Sentillion, Inc. Remote network access via virtual machine
US20070300221A1 (en) * 2006-06-23 2007-12-27 Sentillion, Inc. Accessing a Printer Resource Provided by a Real Computer From Within a Virtual Machine
US20100017889A1 (en) * 2008-07-17 2010-01-21 Symantec Corporation Control of Website Usage Via Online Storage of Restricted Authentication Credentials
US7716686B1 (en) * 2006-02-14 2010-05-11 Mcafee, Inc. System, method and computer program product for interface hooking
US8326449B2 (en) 2007-04-05 2012-12-04 Microsoft Corporation Augmenting a virtual machine hosting environment from within a virtual machine
US20130042295A1 (en) * 2011-08-10 2013-02-14 Charles C. Kelly Method and apparatus for providing a secure virtual environment on a mobile device
US8505017B1 (en) * 2004-09-15 2013-08-06 Oracle America, Inc. Method and system to protect multiple applications in an application server
US20130247139A1 (en) * 2004-10-01 2013-09-19 Salesforce.Com, Inc. Application identity design
CN103718161A (en) * 2011-07-26 2014-04-09 苹果公司 Web application architecture
US8762943B1 (en) * 2004-09-20 2014-06-24 The Mathworks, Inc. Runtime component hosting
CN104168304A (en) * 2013-05-16 2014-11-26 三星Sds株式会社 System and method for single-sign-on in virtual desktop infrastructure environment
US20150067683A1 (en) * 2004-12-17 2015-03-05 Intel Corporation Virtual environment manager
WO2016000425A1 (en) * 2014-07-02 2016-01-07 百度在线网络技术(北京)有限公司 Method and server for logging in to third-party site

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8812975B2 (en) * 2009-09-30 2014-08-19 Adobe Systems Incorporated Managing windows through policies
US8831993B2 (en) 2010-03-19 2014-09-09 Novell, Inc. Techniques for sharing virtual machine (VM) resources
US9443078B2 (en) * 2010-04-20 2016-09-13 International Business Machines Corporation Secure access to a virtual machine
CN103281187B (en) * 2013-05-17 2016-12-28 北京网秦天下科技有限公司 Secure authentication methods, devices and systems
CN104092679B (en) * 2014-07-02 2017-10-03 百度在线网络技术(北京)有限公司 The method for logging site and third-party servers
CN104883353A (en) * 2015-03-31 2015-09-02 深圳市深信服电子科技有限公司 Terminal single sign-on configuration and authentication method and system, and application service system

Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5935251A (en) * 1997-12-22 1999-08-10 Hewlett Packard Company Method and apparatus expedited log-on to an application program
US6327695B1 (en) * 1998-03-31 2001-12-04 Philips Electronics North America Corporation Automated design of on-chip capacitive structures for suppressing inductive noise
US6332192B1 (en) * 1997-05-13 2001-12-18 Passlogix, Inc. Generalized user identification and authentication system
US20020055968A1 (en) * 2000-07-13 2002-05-09 Clayton Wishoff Distributed application interface and authentication process
US6476833B1 (en) * 1999-03-30 2002-11-05 Koninklijke Philips Electronics N.V. Method and apparatus for controlling browser functionality in the context of an application
US20020184406A1 (en) * 2001-05-29 2002-12-05 International Business Machines Corporation Method and system for handling window-based graphical events
US20030005299A1 (en) * 2001-06-29 2003-01-02 International Business Machines Corporation User authorization management system using a meta-password and method for same
US20030159071A1 (en) * 2002-02-21 2003-08-21 International Business Machines Corporation Electronic password wallet
US20040061714A1 (en) * 2002-09-30 2004-04-01 Microsoft Corporation Logical element tree and method
US6718364B2 (en) * 1999-08-10 2004-04-06 Sun Microsystems, Inc. Method and apparatus for expedited file downloads in an applet environment
US6766454B1 (en) * 1997-04-08 2004-07-20 Visto Corporation System and method for using an authentication applet to identify and authenticate a user in a computer network
US20040249938A1 (en) * 2000-06-28 2004-12-09 Bunch Clinton D. System and method for monitoring access to a network by a computer
US7137141B1 (en) * 2000-08-16 2006-11-14 International Business Machines Corporation Single sign-on to an underlying operating system application

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5717950A (en) * 1994-01-11 1998-02-10 Hitachi, Ltd. Input/output device information management system for multi-computer system
FR2797963B1 (en) * 1999-08-23 2002-11-29 Trusted Logic Management Protocol, PROCESS verification and processing of a downloaded program fragment and corresponding systems
US7523191B1 (en) * 2000-06-02 2009-04-21 Yahoo! Inc. System and method for monitoring user interaction with web pages
US7530099B2 (en) * 2001-09-27 2009-05-05 International Business Machines Corporation Method and system for a single-sign-on mechanism within application service provider (ASP) aggregation

Patent Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6766454B1 (en) * 1997-04-08 2004-07-20 Visto Corporation System and method for using an authentication applet to identify and authenticate a user in a computer network
US6332192B1 (en) * 1997-05-13 2001-12-18 Passlogix, Inc. Generalized user identification and authentication system
US5935251A (en) * 1997-12-22 1999-08-10 Hewlett Packard Company Method and apparatus expedited log-on to an application program
US6327695B1 (en) * 1998-03-31 2001-12-04 Philips Electronics North America Corporation Automated design of on-chip capacitive structures for suppressing inductive noise
US6476833B1 (en) * 1999-03-30 2002-11-05 Koninklijke Philips Electronics N.V. Method and apparatus for controlling browser functionality in the context of an application
US6718364B2 (en) * 1999-08-10 2004-04-06 Sun Microsystems, Inc. Method and apparatus for expedited file downloads in an applet environment
US20040249938A1 (en) * 2000-06-28 2004-12-09 Bunch Clinton D. System and method for monitoring access to a network by a computer
US20020055968A1 (en) * 2000-07-13 2002-05-09 Clayton Wishoff Distributed application interface and authentication process
US7137141B1 (en) * 2000-08-16 2006-11-14 International Business Machines Corporation Single sign-on to an underlying operating system application
US20020184406A1 (en) * 2001-05-29 2002-12-05 International Business Machines Corporation Method and system for handling window-based graphical events
US20030005299A1 (en) * 2001-06-29 2003-01-02 International Business Machines Corporation User authorization management system using a meta-password and method for same
US20030159071A1 (en) * 2002-02-21 2003-08-21 International Business Machines Corporation Electronic password wallet
US20040061714A1 (en) * 2002-09-30 2004-04-01 Microsoft Corporation Logical element tree and method

Cited By (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7853884B2 (en) * 2003-02-28 2010-12-14 Oracle International Corporation Control-based graphical user interface framework
US20050108258A1 (en) * 2003-02-28 2005-05-19 Olander Daryl B. Control-based graphical user interface framework
US20050108034A1 (en) * 2003-02-28 2005-05-19 Scott Musson Method for portlet instance support in a graphical user interface
US20050005243A1 (en) * 2003-02-28 2005-01-06 Olander Daryl B. Method for utilizing look and feel in a graphical user interface
US8225234B2 (en) 2003-02-28 2012-07-17 Oracle International Corporation Method for utilizing look and feel in a graphical user interface
US7934163B2 (en) 2003-02-28 2011-04-26 Oracle International Corporation Method for portlet instance support in a graphical user interface
US8505017B1 (en) * 2004-09-15 2013-08-06 Oracle America, Inc. Method and system to protect multiple applications in an application server
US8762943B1 (en) * 2004-09-20 2014-06-24 The Mathworks, Inc. Runtime component hosting
US20130247139A1 (en) * 2004-10-01 2013-09-19 Salesforce.Com, Inc. Application identity design
US8949963B2 (en) * 2004-10-01 2015-02-03 Salesforce, Inc. Application identity design
US9450946B2 (en) 2004-10-01 2016-09-20 Salesforce.Com, Inc. Secure identity federation for non-federated systems
US9800586B2 (en) 2004-10-01 2017-10-24 Salesforce.Com, Inc. Secure identity federation for non-federated systems
US20150067683A1 (en) * 2004-12-17 2015-03-05 Intel Corporation Virtual environment manager
US10019273B2 (en) * 2004-12-17 2018-07-10 Intel Corporation Virtual environment manager
US20150074663A1 (en) * 2004-12-17 2015-03-12 Intel Corporation Virtual environment manager
US20060206930A1 (en) * 2005-03-08 2006-09-14 Golan Parashi Method and system for rendering single sign on
US7716686B1 (en) * 2006-02-14 2010-05-11 Mcafee, Inc. System, method and computer program product for interface hooking
US9213513B2 (en) 2006-06-23 2015-12-15 Microsoft Technology Licensing, Llc Maintaining synchronization of virtual machine image differences across server and host computers
WO2007149671A2 (en) * 2006-06-23 2007-12-27 Sentillion, Inc. Remote network access via virtual machine
US20070300221A1 (en) * 2006-06-23 2007-12-27 Sentillion, Inc. Accessing a Printer Resource Provided by a Real Computer From Within a Virtual Machine
WO2007149671A3 (en) * 2006-06-23 2008-08-28 Sentillion Inc Remote network access via virtual machine
US9392078B2 (en) 2006-06-23 2016-07-12 Microsoft Technology Licensing, Llc Remote network access via virtual machine
US8326449B2 (en) 2007-04-05 2012-12-04 Microsoft Corporation Augmenting a virtual machine hosting environment from within a virtual machine
US20100017889A1 (en) * 2008-07-17 2010-01-21 Symantec Corporation Control of Website Usage Via Online Storage of Restricted Authentication Credentials
CN103718161A (en) * 2011-07-26 2014-04-09 苹果公司 Web application architecture
US8949929B2 (en) * 2011-08-10 2015-02-03 Qualcomm Incorporated Method and apparatus for providing a secure virtual environment on a mobile device
US20130042295A1 (en) * 2011-08-10 2013-02-14 Charles C. Kelly Method and apparatus for providing a secure virtual environment on a mobile device
CN104168304A (en) * 2013-05-16 2014-11-26 三星Sds株式会社 System and method for single-sign-on in virtual desktop infrastructure environment
WO2016000425A1 (en) * 2014-07-02 2016-01-07 百度在线网络技术(北京)有限公司 Method and server for logging in to third-party site

Also Published As

Publication number Publication date Type
US20130061308A1 (en) 2013-03-07 application
US8966481B2 (en) 2015-02-24 grant
US20100037307A1 (en) 2010-02-11 application
US8191086B2 (en) 2012-05-29 grant

Similar Documents

Publication Publication Date Title
US6112228A (en) Client inherited functionally derived from a proxy topology where each proxy is independently configured
US6510236B1 (en) Authentication framework for managing authentication requests from multiple authentication devices
US7039724B1 (en) Programmable command-line interface API for managing operation of a network device
US6067579A (en) Method for reducing message translation and traffic through intermediate applications and systems in an internet application
US6826716B2 (en) Test programs for enterprise web applications
US5671414A (en) Method and apparatus for providing simple secure management of remote servers
US6347398B1 (en) Automatic software downloading from a computer network
US6341352B1 (en) Method for changing a security policy during processing of a transaction request
US7213060B2 (en) Web based creation of printer instances on a workstation
US6049877A (en) Systems, methods and computer program products for authorizing common gateway interface application requests
US5922044A (en) System and method for providing information to applets in a virtual machine
US5768504A (en) Method and apparatus for a system wide logan in a distributed computing environment
US7079839B1 (en) Method and system for push launching applications with context on a mobile device
US6182129B1 (en) Apparatus, methods and computer program products for managing sessions with host-based application using session vectors
US6490626B1 (en) Browser system
US6125384A (en) Computer apparatus and method for communicating between software applications and computers on the world-wide web
US6961937B2 (en) Registry service for use in a distributed processing framework system and methods for implementing the same
US20050198196A1 (en) Federating legacy/remote content into a central network console
US20050080897A1 (en) Remote management utility
US6185606B1 (en) Adaptive messaging method, system and computer program product
US20030154401A1 (en) Methods and apparatus for facilitating security in a network
US7779091B2 (en) Method and system for providing virtualized application workspaces
US5872915A (en) Computer apparatus and method for providing security checking for software applications accessed via the World-Wide Web
US6182131B1 (en) Data processing system, method, and program product for automating account creation in a network
US20070168997A1 (en) Debugging of remote application software on a local computer

Legal Events

Date Code Title Description
AS Assignment

Owner name: PROTOCOM DEVELOPMENT SYSTEMS PTY. LTD., AUSTRALIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:DINGWALL, TIMOTHY BRIAN;HERSCOVITCH, MATHEW PATRICK;SANDLAND, CARL;REEL/FRAME:015668/0127;SIGNING DATES FROM 20040608 TO 20040806