`Bull et al.
`
`US006065118A
`Patent Number:
`11
`(45) Date of Patent:
`
`6,065,118
`*May 16, 2000
`
`54 MOBILE CODE ISOLATION CAGE
`75 Inventors: John Albert Bull, Northants; David
`John Otway, Cambridge, both of
`United Kingdom
`73 Assignee: Citrix Systems, Inc., Fort Lauderdale,
`Fla.
`
`*
`
`Notice:
`
`This patent issued on a continued pros-
`ecution application filed under 37 CFR
`1.53(d), and is subject to the twenty year
`patent term provisions of 35 U.S.C.
`154(a)(2).
`
`21 Appl. No.: 08/718,874
`22 Filed:
`Sep. 24, 1996
`30
`Foreign Application Priority Data
`Aug. 9, 1996 GB United Kingdom ................... 96.16783
`51
`Int. Cl." .............................. G06F 11/30; H04L 9/00;
`HO4L 9/32
`52 U.S. Cl. ................................ 713/200; 713/201; 380/4
`58 Field of Search ............................... 395/186, 187.01
`395/188.01, 704; 380/4, 23, 25; 713/200
`2O1 202. 70921s 233 324 225 23.
`250
`
`56)
`
`References Cited
`
`U.S. PATENT DOCUMENTS
`5,412,717 5/1995 Fischer ........................................ so
`5,668.999 9/1997 Gosling ................................... 30s/704
`FOREIGN PATENT DOCUMENTS
`O 658 848 A2 10/1994 European Pat. Off. ........ GO6F 12/14
`2 136 171 9/1984 United Kingdom .............. G11C 8/OO
`
`WO 97/12321 4/1997 WIPO ............................. GO6F 11/OO
`OTHER PUBLICATIONS
`Jan Vitek et al., “Mobile Object Systems Towards the
`Programmable Internet”, Second International Workshop,
`MOS'96, pp. 177-199.
`Drew Dean et al., “Java Security: From HotJava to Netscape
`and Beyond”, Department of Computer Science, Princeton
`Uni
`itv, Princet
`N J
`Jun. 5, 1996
`GES y, Princeton, New Jersey, Jun. 5,
`, pp
`Marshall D. Abrams et al., “Trusted System Concepts”,
`Computers & Security, vol. 14, No. 1, 1995. pp. 45-56.
`Francois Rouaix, “A Web navigator with applets in Caml”,
`Computer Networks and ISDN Systems, 1996, pp.
`1365-1371.
`Primary Examiner-Dieu-Minh T. Le
`Attorney, Agent, or Firm Testa, Hurwitz & Thibeault, LLP
`57
`ABSTRACT
`The present invention reduces the risk of damage to data or
`programs in an end user computer System programmed to
`operate in response to an imported data Stream containing
`one or more mobile program components from an external
`Source. The incoming data Stream is Screened to identify
`mobile program components of that data Stream. Some of
`the mobile program components are passed to a program
`execution location isolated from the end user System prior to
`being executed to operate in a desired manner. The execu
`tion location has an interface with the external Source of the
`data stream and an interface with the end user System. The
`operation of the interface between the execution location
`and the end user system is programmed so that only data
`which has been interacted on by the program component
`within the execution location in a Specified and controlled
`manner can be passed to and from the end user System.
`
`14 Claims, 4 Drawing Sheets
`
`WEBSRWER
`
`JAWAAPPLETS
`
`HTMLPAGES
`
`FIREWALL
`
`JAWA
`AppE
`
`JAWA
`LIBR'S
`
`AUDIT
`LBR'S
`
`SECURITY MEMBRANE
`
`JAWA WM
`
`AUDIT EVENT
`TRIGGER
`
`ACCESS
`CONTROL
`
`AppE loader
`
`CLIBRARY
`
`GUDRWER
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`DWERT
`APPLETS
`TO CAGE
`
`LOAD
`GUI
`
`NFORM
`FIREWA
`
`FIREWALL
`
`ENDUSER
`PLATFORM
`
`GUPLUG IN
`
`BROWSER
`
`w
`
`ROPOSED STRUCTURE
`
`
`
`
`
`Juniper Ex. 1015-p. 1
`Juniper v Finjan
`
`
`
`U.S. Patent
`
`May 16, 2000
`
`Sheet 1 of 4
`
`6,065,118
`
`
`
`
`
`
`
`
`
`WEB
`SERVER
`
`
`
`PUBLIC
`NETWORK
`
`
`
`FIREWALL
`
`
`
`-
`
`PRIVATE
`NETWORK
`
`
`
`
`
`BROWSER
`
`CURRENT STRUCTURE
`
`FIG. 1
`
`Juniper Ex. 1015-p. 2
`Juniper v Finjan
`
`
`
`U.S. Patent
`
`May 16, 2000
`
`Sheet 2 of 4
`
`6,065,118
`
`
`
`HTML PAGES
`
`JAVA APPLETS
`
`WEBSERVER
`
`FIREWALL
`
`END USER
`PLATFORM
`
`OTHER
`APPLICATION
`SOFTWARE
`
`JAVA APPLET
`
`UAVA VRTUAL MACHINE
`
`BROWSER
`
`CURRENT STRUCTURE
`
`FIG 2
`
`Juniper Ex. 1015-p. 3
`Juniper v Finjan
`
`
`
`U.S. Patent
`
`May 16, 2000
`
`Sheet 3 of 4
`
`6,065,118
`
`WEB
`SERVER
`
`PUBLIC
`NETWORK
`
`OUTER
`FIREWALL
`
`CAGE
`
`CAGE
`
`WEB
`PROXY
`
`NNER
`FIREWALL
`
`PRIVATE
`NETWORK
`
`BROWSER
`
`PROPOSED STRUCTURE
`
`FIG. 3
`
`Juniper Ex. 1015-p. 4
`Juniper v Finjan
`
`
`
`U.S. Patent
`
`May 16, 2000
`
`Sheet 4 of 4
`
`6,065,118
`
`WEB SERVER
`
`JAVA. APPLETS
`
`HTML PAGES
`
`
`
`
`
`
`
`
`
`
`
`
`
`FIREWALL
`
`
`
`N
`
`APPLET
`
`SECURITY MEMBRANE
`
`
`
`
`
`
`
`APPLET LOADER
`
`
`
`AUDIT EVENT
`TRIGGER
`
`C LIBRARY
`
`
`
`ACCESS
`CONTROL
`
`
`
`
`
`GU DRIVER
`
`DIVERT
`APPLETS
`TO CAGE
`
`LOAD
`GUI
`
`INFORM
`FIREWALL
`
`FIREWALL
`
`END USER
`PLATFORM
`
`GUPLUG IN
`
`BROWSER
`
`PROPOSED STRUCTURE
`FIG. 4
`
`Juniper Ex. 1015-p. 5
`Juniper v Finjan
`
`
`
`1
`MOBILE CODE SOLATION CAGE
`
`The present invention relates to a method and apparatus,
`notably to a method for reducing the risk of corruption or
`damage to data or programs held in an end user network of
`computer Systems by mobile program components imported
`into that System from an external Source and to a computer
`System programmed or modified to operate using the method
`of the invention.
`
`BACKGROUND TO THE INVENTION
`The user of a Stand alone or networked computer System,
`both hereinafter collectively called an end user System, often
`has a need to import data or whole programs or parts of
`programs, hereinafter collectively and individually called
`program components, from an external Source to enable the
`end user System to operate in a desired manner. The term
`program component is used herein to denote material which
`is interpreted by a computer System to operate the System in
`a specific manner, whereas data is the information material
`upon which the computer System acts under the direction of
`the program components.
`Users, particularly banks and other financial institutions,
`need to be able to inspect incoming program components
`and data to ensure that they will not corrupt or otherwise
`adversely affect the data and operating programs held in
`their Systems. This is particularly important where there area
`number of computer Systems operating within a network and
`in which the network or computer Systems within that
`network have a number of points at which access to external
`data and program Sources can be made.
`Where the system is a closed network and the data or
`program components are provided from other units within
`the same network, the user can Satisfy himself that the data
`and program components do not contain material which
`could adversely interact with the data and programs held on
`his particular unit of the network. Such satisfaction will
`typically involve the inspection of the computer listings
`upon which the program is based to ensure that there are no
`errors or adverse components within the program. However,
`where the program or program component being imported is
`large and complex, Such inspection and verification becomes
`excessively time consuming and expensive and therefore
`impractical.
`Where the end user network or stand alone system is to
`receive data or program components from a Source which is
`external to the network, for example from the Internet or an
`external data base, the risk of deliberate or accidental
`introduction of program components which can adversely
`interact with the data or programs already held in that end
`user System is increased. Since the external data Source may
`be operating under one or more large and complex
`programs, which are themselves under continual updating
`and revision, it is effectively impossible to inspect each
`program and every modification of the program to ascertain
`that the end user System will not import adversely acting
`material.
`There are a number of forms of program components
`which can cause corruption or damage to data or programs
`held in an end user System and/or can cause other deleterious
`effects when imported into the end user System. Such
`program components include those which are deliberately
`designed to corrupt the data or operating programs of the end
`user System; those which collect confidential data from the
`end user System and transmit that data to an external location
`without the end user being aware that Such unauthorised
`
`15
`
`25
`
`35
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`6,065,118
`
`2
`transmission or theft of data is taking place, and programs
`which deny the user full and proper use of the end user
`System, for example by introducing repeating closed loop
`operations which consume the computing capacity of the
`end user System or deny access to areas of the end user
`System. Such program components are known as viruses,
`Zappers, hostile Applets, Trojan Horses and Service deniers
`and will be generically denoted as viruses hereinafter. A
`widespread concern is the deliberate distribution of such
`Virus programs or program components into an end user
`System where they are executed and adversely interact with
`or cause disruption to the proper operation of the System.
`Whilst an end user can repeatedly inspect data and programs
`within a closed network to detect Such viruses, the end user
`cannot inspect the external data or program Source for Such
`Viruses and must accept the risk that any import of data or
`program components from an external Source may import
`Viruses into his System.
`In order to reduce the risk of importing material from an
`external Source which could adversely interact with an end
`user System, it is commonplace to Screen all incoming data
`and programs or program components to identify the Source
`of that material. Only material from Specified Sources is
`permitted access into the end user System. The end user can
`Satisfy himself that Such Sources provide known quality of
`data and/or programs which have been inspected.
`Alternatively, the user can base his confidence in the Source
`of material on its reputation for accuracy in compiling
`programs and for reducing the presence of possible
`adversely acting program components in any program com
`ponents it makes available to end users. Such Screens are
`known in the computer field as firewalls and act uni
`directionally on a communications hardware level to allow
`incoming material to pass if it comes from a Specified
`communication address or to destroy incoming material if it
`does not come from a specified Source.
`However, a firewall prevents access by the operator of an
`end user System to data and programs which are from
`non-specified Sources. This restricts the freedom of the user
`to acceSS alternative Sources until they have been inspected
`and authorised. Furthermore, where the external Source is
`operating under a large or complex program, Such inspection
`is not practical and any authorization of access to that
`external Source may destroy the integrity of the end user
`System.
`These problems are aggravated where there are many
`points in the end user System from which external Sources of
`data and programs can be accessed. It has been proposed to
`limit the number of Such access points in an end user System
`and to ensure that all incoming material is fully Screened at
`the permitted access points. However, this can lead to
`excessive bottle necks in the operation of the System and
`delays in accessing the external Source from any given end
`user computer System in a network.
`It is also common place to provide one or more virus
`detection programs within an end user System. These operate
`by recognising characteristic patterns in the virus program
`and destroying the virus program before it is executed within
`the end user System. The detection program may also
`recognise Specific Sites in an operating program to which a
`Virus may attach and remain dormant until eXecuted and thus
`detect when a virus is present by a change in Such a site.
`However, this requires the detection program to recognise
`Specific features or patterns and requires that the virus be
`imported into the end user system before it can be identified
`and neutralised. Furthermore, where the virus is one which
`is not recognised by the Virus detection program, for
`
`Juniper Ex. 1015-p. 6
`Juniper v Finjan
`
`
`
`3
`example because it is a new virus or a mutation of an
`existing one, the virus may not be detected and may be
`executed within the end user System.
`In many applications it is desirable to include program
`components within a stream of data from an external Source
`to enable the end user system to handle that data effectively.
`For example, many data Sources written in the JAVA lan
`guage utilise mobile program components, or Applets, in the
`data Stream transmitted to an end user System to enable the
`end user System to handle data more effectively, for example
`to create images upon the end user System Video Screen from
`data already held at the end user System. This avoids the
`need to transmit the data for each image from the external
`Source and thus Speeds up the operation of the end user
`System.
`Such program components are termed mobile Since they
`are intended to be imported into the end user System and to
`be executed within that System and to interact in a beneficial
`manner with the data and program components held at the
`end user System. It is therefore necessary that they should be
`accepted by the end user System. They therefore pass
`through any firewall and are not rejected or destroyed by a
`Virus detection program. It has been proposed to sign and
`Seal Such program components cryptographically So as to
`identify the program component as coming from an autho
`rised Source, for example one where the components have
`been individually inspected. However, this requires the end
`user to place complete trust in the integrity and competence
`of the organisation cryptographically signing and Sealing the
`program components they export.
`Where the program or program component imported from
`the external Source is large and complex and/or is constantly
`being updated, as is the case with network browser
`programs, it is not possible to provide a high level of
`confidence in Such programs or program components. This
`may present an acceptable risk to the operator of the end user
`System when balanced against the advantages that the use of
`Such program components gives.
`However, it is possible that Such mobile program
`components, whilst Satisfying the authentification or iden
`tified Source criteria, can be interpreted incorrectly in the end
`user System and/or can deliberately or accidentally interact
`adversely with the data and/or program components already
`held by the end user system. This raises a problem for the
`end user operator. On the one hand, the importation of the
`mobile program components is desirable for the proper
`operation of the end user System; but they can cause cor
`ruption of data and damage to the operating and other
`programs held by the end user System. The conventional
`firewall or virus detection programs cannot protect the end
`user System without preventing proper operation of the
`System.
`The problem of deliberate or accidental errant interaction
`of desirable mobile program components from an external
`Source has been recognised as a major problem by the
`computer industry, but no effective Solution has yet been
`proposed.
`We have now devised a method and apparatus by which
`an end user System can be protected from the errant effects
`of Such otherwise desirable mobile program components
`imported from an external Source.
`SUMMARY OF THE INVENTION
`Accordingly, the present invention provides an end user
`computer System programmed to operate in response to an
`imported data Stream containing one or more mobile pro
`gram components from an external Source, characterised in
`that:
`
`1O
`
`15
`
`25
`
`35
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`6,065,118
`
`4
`a. the incoming data Stream is Screened to identify mobile
`program components of that data Stream;
`b. Some or all of the mobile program components are
`passed to one or more program execution locations
`selectively isolated from or within the end user system
`prior to being executed to operate in a desired manner;
`c. the execution location is one in which one or more
`program components are retained and which has one or
`more interfaces with the external Source of the data
`Stream and one or more interfaces with the end user
`System whereby program component(s) within the
`execution location can be executed within the execu
`tion location to interact with the external Source of data
`and/or the data and/or a program held by the end user
`System; and
`d. the operation of the interface(s) between the execution
`location and the end user System are programmed So
`that only data which has been interacted on by the
`program component(s) within the execution location in
`a specified and controlled manner and/or program
`components which operate in a Specified manner can be
`passed to and from the end user System.
`In the present invention the execution location will be
`located upon the same physical Site as part or all of the end
`user System, for example associated with an acceSS gateway
`to the end user System, which may itself be located remotely
`from the downstream remainder of the end user System.
`However, the execution location need not be located within
`the end user System itself, but can be located as a protective
`isolation Screen between the external Source of the data and
`program components and the downstream end user System.
`For convenience, the term within the end user system will be
`used herein to denote the case where the execution location
`is provided within one or more of the computer units of the
`end user System; and the term external to the end user System
`will be used to denote a computer unit or other means which,
`whilst located on the same geographic Site as the end user
`System, is isolated from the end user System and in which
`program components can be executed in Selective isolation
`from the end user System.
`By providing the execution location, incoming mobile
`program components are contained Selectively isolated from
`or within the end user System. Although the program com
`ponents may operate errantly within the execution location,
`they are only permitted to interact with the end user System
`in a specified and controlled manner. Since the program
`operating the execution location can be comparatively Small,
`the end user can inspect the program listing for that program
`to ensure that it fulfils the desired criteria. The operator can
`thus have a high level of confidence that only data which has
`been processed in a specified desired manner or a program
`component which operates in a desired manner can be
`transmitted from the execution location to the end user
`System. The operating program can also prevent the passage
`of program components to the end user System from the
`execution location, thus minimising the risk of Viruses or
`undesirable program components from entering the end user
`System. In addition, the execution location can operate to
`limit access of a program component from the execution
`location to specified resources within the end user System,
`for example to limit access time to the central processor to
`minimise the effect of a Services denial virus, to limit the
`bandwidth of the communications access, to limit access to
`certain disc blocks in the hard disc memory.
`The program operating the execution location can be
`Selectively written So as to permit transmission or reception
`of data only to or from Specific Sources within the end user
`
`Juniper Ex. 1015-p. 7
`Juniper v Finjan
`
`
`
`S
`System and/or a specific external Source, So that imported
`program components executed in the execution location
`cannot access certain areas of the data base in the end user
`System. For example, an execution location could be pro
`grammed only to operate on purchase ledger data, another
`could be programmed to operate only on perSonnel data. It
`may therefore be necessary to provide a Series of execution
`locations, each designed to operate in an individual manner
`on Specified data Sources and destinations. This will enable
`the operating program for each execution location to be
`Smaller and more specific and hence easier to inspect and
`verify.
`For convenience, the invention will be described herein
`after in terms of an execution location programmed to
`operate with a single external Source or destination of data
`external to the end user System and to transmit or receive
`data to or from a single destination within the end user
`system. However, it will be appreciated that the invention
`can be applied to execution locations operating with a
`plurality of external and/or end user Sources and destinations
`in any combination.
`The execution location is Selectively isolated from or
`within the end user System, that is the execution location can
`only receive and transmit data and/or program components
`in a Selective and controlled manner via the interfaces with
`the external Source and the end user System. Thus, the
`execution location will typically require a level of intelli
`gence and data Storage So that it can accept and Store the
`incoming mobile program components from the external
`Source and can then execute those program components
`under the control of an operating program already held
`within the execution location to interact with data from the
`external Source and/or from the end user System. If desired,
`the operating program required for the eXecution location
`can be held within the end user System to minimise corrup
`tion from external Sources, and is transmitted to the execu
`tion location as part of the Start up procedure of the end user
`System. AS explained below, Several operating programs
`may be available to the execution location depending upon
`the type of data it is to handle and the type of operation to
`be carried out on that data. The end user or System admin
`istrator may be provided with means, for example specific
`keyboard operations, which load the appropriate operating
`program to the execution location where a Selection has to
`be made between various alternatives.
`The requisite processing and data Storage functions for the
`execution location can be provided by one of the computer
`units within the end user System network or as an isolated
`portion of one of the computer units, So that the execution
`location is located within the end user System. However,
`with current computer architecture it may not be possible to
`provide a sufficiently isolated environment in which the
`program components are executed. It is therefore preferred
`to provide the execution location as a Separate physical unit
`selectively isolated from the end user system with which it
`is to interact and to provide limited access routes between
`the execution unit and the end user System which are
`operated under the control of the program operating the
`execution location unit. Typically, the execution unit will be
`a conventional computer having its own processor and
`memory capability.
`For convenience, the invention will be described herein
`after in terms of a separate computer acting as an execution
`location which is physically Separate from the end user
`System, but which is configured as if it were a data import
`access point to the end user System network.
`Whilst the execution location will preferably transmit
`only data to and from the rest of the end user System, it may
`
`15
`
`25
`
`35
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`6,065,118
`
`6
`be programmed to permit transmission of program compo
`nents to the end user System. Since Such program units will
`have been Subjected to inspection within the execution
`location by a program which the end user has inspected or
`in which he has a high level of confidence, the risk that Such
`transmitted program components will operate errantly
`within the end user System is minimised. The execution
`location can thus be used to inspect and Verify incoming
`program components which it is desired to download into
`the end user System and can be used to intercept Virus
`programs before they reach the end user System. However,
`it may be that the end user is confident that Specified
`program components are acceptable, in which case they may
`not need to be inspected within the execution location but
`may be passed directly to the end user System. However, it
`will usually be preferred to pass all computer components
`within an incoming data Stream to the execution location.
`For convenience, the invention will be described herein
`after in terms of the transmission Solely of data to the end
`user System.
`AS Stated above, the execution location transferS data
`between the execution location and the end user System only
`if it complies to predetermined criteria So that the execution
`location regulates the exchange of data to and from the end
`user System and the execution location. The operating pro
`gram required to achieve this and to identify program
`components in the data Stream from the external Source can
`be written using conventional programming techniques hav
`ing regard to the Source and destination within the end user
`System required for the initial data and the resultant pro
`cessed data.
`AS Stated above, a Single execution location can be used
`to achieve a specified operation upon specified data.
`However, it is within the Scope of the present invention to
`provide an execution location which can operate upon
`Several categories of information and/or with data from
`Several Sources and/or destinations of information. This may
`require Separate operating programs for the execution loca
`tion to run concurrently or consecutively. Alternatively,
`Separate execution locations can be provided, each to
`achieve a specific operation upon Specific data. It will also
`be appreciated that one or more execution locations can be
`provided at each point at which the end user System accesses
`an external data Source and that each Such access point can
`have an execution location which is to operate in a specific
`manner upon Specific data. The operator of the end user
`System can thus identify the function and potential Sources
`to be accessed at each acceSS point by Selection of the
`operating program under which the execution location at
`that acceSS point operates. This will further regulate the
`importation of material from external Sources to the end user
`System. It is also within the Scope of the present invention
`to create Zones within a System into which access from other
`Zones of the same System or network is regulated by
`providing execution locations of the invention at the acceSS
`points between the Zones of the System.
`Whilst the execution location of the invention may pro
`vide the Sole regulation of importation of material into an
`end user System from an external Source, it is preferred to
`locate the execution location between two firewalls which
`inhibit transmission of undesirable program components
`and/or data from the external Source and/or the end user
`system. Such firewalls can be of conventional form and
`Serve to reduce the load imposed upon the execution loca
`tion by providing primary control of the flow of material to
`and from the end user System.
`The invention is of especial application to data Sources
`operating under JAVA technology which utilises mobile
`
`Juniper Ex. 1015-p. 8
`Juniper v Finjan
`
`
`
`7
`program components or Applets which are executed by the
`end user System to customise the application program under
`which data is to be processed to Suit the end user System and
`to Set up the end user System for the receipt of data from the
`external Source. However, the invention is applicable to the
`interception and Storage in the execution location of pro
`gram components from other technologies and computer
`languages. AS indicated above, the execution location can
`also be used to intercept viruses before they reach the end
`user System. Where a program component within an execu
`tion location has operated in an undesirable manner, the
`results of that errant operation are retained within the
`execution location and are not allowed to be transmitted to
`the end user System or the external Source. The detection of
`an errant operation within the execution location can cause
`the execution location to close down and re-initialise So as
`to delete and re-instate all data and program components
`within the execution location. If desired, the program com
`ponent causing the errant operation can be identified for
`audit purposes to identify the Source of the program com
`ponent So that the end user can investigate the integrity of
`the Source and take appropriate action regarding importation
`of further data from that Source. The deletion of material
`from the execution location and re-initialisation or other
`Subsequent operations can be carried out using conventional
`programming techniques.
`The invention has been described above in terms of an end
`user System receiving data from an external System which is
`accessed by a number of other users, that is a public acceSS
`System or Service provider. However, the invention can also
`be applied to the public access Service provider So as to
`protect the public acceSS data base from corruption by
`importation of undesirable program components, for
`example viruses. In this case, the execution location is
`provided at Some or all of the access points to the Service
`provider in a similar manner to that described above for the
`end user System.
`The invention thus also provides a method for operating
`an end user computer System which comprises importing to
`the System a data Stream containing one or more mobile
`program components which it is desired to execute on the
`computer System from an external Source, which method
`comprises:
`a. Screening the incoming data Stream to identify mobile
`program components of that data Stream;
`b. passing Some or all of the mobile program components
`to one or more program execution locations Selectively
`isolated from or within the end user System;
`c. executing the mobile program component within the
`execution location So as to interact with data from the
`end user System and/or from the external Source;
`d. passing program components which operate in a speci
`fied manner and/or the interacted data or the resultant
`data from Such interaction to the end user System via an
`interface which permits the transmission of data and/or
`program components which correspond to specified
`criteria to or from Specified locations in the end user
`System and/or in the external Source.
`DESCRIPTION OF THE DRAWINGS
`The foregoing and other objects, features and advantages
`of the present invention, as well as the invention itself, will
`be more fully understood from the following description of
`preferred embodiments, when read together with the accom
`panying drawings, in which:
`FIG. 1 is a block diagram of a computer network depict
`ing the interconnection of an end user System to a public
`network, as known in the prior art.
`
`8
`FIG. 2 is a block diagram of a computer network depict
`ing transmission of the mobile program components acroSS
`the computer network, as known in the prior art.
`FIG. 3 is a block diagram of a computer network depict
`ing the interconnection of an end user System to a public
`network, according to the invention.
`FIG. 4 is a block diagram of a computer network depict
`ing transmission of the mobile program components acroSS
`the computer network, according to the invention.
`
`DESCRIPTION OF THE PRESENT SYSTEM
`
`FIG. 1 shows a current System for importing data and/or
`program components from an external Source, for example
`data from a Web Server, and comprises a Single computer
`unit or a plurality of computer units in an end user computer
`system interconnected by a private network, and the Web
`Server connected to the public network. The end user uses a
`browser or other program held on the end user System to
`identify the data and/or program components which are to be
`imported from the Web server. The browser program may be
`held on any or all of the computer units in the end user
`network. In order to reduce the risk of importing undesirable
`material, the acceSS point to the end user System is provided
`with a firewall which only allows the passage of data and
`program components from the public network which come
`from or go to specified addresses in the public network. The
`browser and/or firewall may also refuse to import program
`components or data that has not been cryptographically
`signed and Sealed by a known and/or trusted Source. It is also
`customary to hold a virus detection program on the end user
`System whi