초록 ▼

A Java applet sandbox, provided by restrictions originally set by the manufacturer of a Java enabled Internet browser, may be securely extended by introducing the notion of public and private client storage. In addition to the sandbox, users are given means of declaring a portion of the user machine

A Java applet sandbox, provided by restrictions originally set by the manufacturer of a Java enabled Internet browser, may be securely extended by introducing the notion of public and private client storage. In addition to the sandbox, users are given means of declaring a portion of the user machine's disk space as Public. The public disk space is accessible to executing applets and is installed in addition to the standard sandbox. The modality of access may be defined with various levels of restriction by the user within the security manager. Restriction levels of the Public space may range from clearing (from the Public space) any data left after the applet has terminated, to allowing an executable applet to be moved into the private area on the user's disk drive.

대표청구항 ▼

A Java applet sandbox, provided by restrictions originally set by the manufacturer of a Java enabled Internet browser, may be securely extended by introducing the notion of public and private client storage. In addition to the sandbox, users are given means of declaring a portion of the user machine

A Java applet sandbox, provided by restrictions originally set by the manufacturer of a Java enabled Internet browser, may be securely extended by introducing the notion of public and private client storage. In addition to the sandbox, users are given means of declaring a portion of the user machine's disk space as Public. The public disk space is accessible to executing applets and is installed in addition to the standard sandbox. The modality of access may be defined with various levels of restriction by the user within the security manager. Restriction levels of the Public space may range from clearing (from the Public space) any data left after the applet has terminated, to allowing an executable applet to be moved into the private area on the user's disk drive. to the authorized copy. 4. A method according to claim 3 further comprising the step of masking at least one data object of the copy of digital content prior to the step of comparing the plurality of data objects of the copy of digital content to respective data objects of the first and second versions of the digital content to determine the respective bit of the enforcement data associated with the copy of digital content such that the at least one masked object is not compared. 5. A method according to claim 1 wherein the method is performed responsive to a customer request and the enforcement data associates the digital content with the customer. 6. A method according to claim 5 further comprising the steps of: determining a customer identifier corresponding to the customer request and saving the customer identifier in an order database; and associating the enforcement data with the customer identifier and saving the enforcement data in the order database. 7. A method according to claim 2 further including the step of generating, for the plurality of data objects in each of the first and second versions of the digital content, respective identifying values, the identifying values being formed from the respective data objects such that the respective identifying values of corresponding objects are distinct; and storing each identifying value with its respective data object. 8. A method according to claim 7 wherein the identifying values are generated by applying a one-way hash function to the respective data objects. 9. A method of tracing a copy of digital content to an authorized copy, said authorized copy prepared according to the method of claim 7, said method of tracing comprising the steps of: generating respective identifying values for a plurality of data objects of the copy of digital content; comparing each respective identifying value of the copy of digital content to respective identifying values of the first and second version of the digital content to determine a respective bit of enforcement data associated with the copy of digital content, comparing respective bits of the enforcement data associated with the copy of digital content to the enforcement data associated with the authorized copy. 10. A method according to claim 7 wherein each of the identifying values is an n-bit binary value, where n is an integer, and the method further comprises the steps of: concatenating a plurality of the n-bit identifying values to form an m-bit value, where m is an integer greater than n; encoding the m-bit value to form an m-bit encoded value; and replacing each of the plurality of n-bit identifying values in the respective data objects with a respective n-bits of the encoded m-bit value. 11. A method of authenticating a copy of digital content, said copy prepared according to the method of claim 10, said method of authenticating comprising the steps of: concatenating n-bits from each of a plurality of data objects in the copy of digital content to form the encoded m-bit value; decoding the encoded m-bit value to form a decoded m-bit value; generating respective n-bit identifying values for each of a plurality of data objects of respective first and second versions of the digital content; concatenating the generated n-bit identifying values to form a generated m-bit value; and comparing the decoded m-bit value to the generated m-bit value to authenticate the copy of the digital content. 12. A method according to claim 11 wherein the identifying values are generated by applying a one-way hash function to each of the plurality of data objects of the first and second versions of the digital content and to each of the data objects of the copy of digital content. 13. A carrier containing instructions to cause a general-purpose computer to perform a method of authenticating a copy of digital content, said copy being prepared according to the method of claim 10, said method of authenticating