Policy algebra and compatibility model

    公开(公告)号:US20060230432A1

    公开(公告)日:2006-10-12

    申请号:US11102848

    申请日:2005-04-08

    IPC分类号: H04L9/00

    CPC分类号: G06F17/3089

    摘要: The present invention provide for an algebraic mapping of a policy expression from a compact to a normalized form, both in Boolean and set formulations. The policy algebra is defined in such a way that policy alternatives within the normalized expression will be the same across equivalent compact expressions—regardless of how the assertions are arbitrarily constrained or what operators are used to constrain such equivalent expressions. Moreover, the present invention also provides a model for identifying alternatives that are equivalent by comparing only the root element names or QName of each assertion within an alternative. In addition, embodiments as described herein can utilize the identification of equivalent alternatives in order to create an intersection policy expression to limit alternatives of admissible behavior to those in common across both endpoints.

    Querying for services using soap over UDP
    3.
    发明授权
    Querying for services using soap over UDP 有权
    使用soap over UDP查询服务

    公开(公告)号:US07453875B2

    公开(公告)日:2008-11-18

    申请号:US11087139

    申请日:2005-03-23

    摘要: A sending computer system can identify one or more available network resources at one or more network computers by sending a request for services using Simple Object Access Protocol (SOAP) over User Datagram Protocol (UDP). In particular, the sending computer system prepares a SOAP message that includes a request for available resources. The sending computer system then encapsulates the SOAP message into a user datagram, and sends the user datagram to one or more identifiable computer systems on the network. In one implementation, the sending computer system sends the user datagram to a multi-cast Uniform Resource Identifier (URI). The receiving computer system receives the message through UDP, unpacks the message, and responds to the SOAP message request. Accordingly, the sending computer system can query multiple computer systems in an efficient manner without necessarily incurring the overhead otherwise associated with connection-oriented communication.

    摘要翻译: 发送计算机系统可以通过使用通过用户数据报协议(UDP)的简单对象访问协议(SOAP)发送对服务的请求来识别一个或多个网络计算机上的一个或多个可用网络资源。 特别地,发送计算机系统准备包括对可用资源的请求的SOAP消息。 发送计算机系统然后将SOAP消息封装成用户数据报,并将用户数据报发送到网络上的一个或多个可识别的计算机系统。 在一个实现中,发送计算机系统将用户数据报发送到多播统一资源标识符(URI)。 接收计算机系统通过UDP接收消息,解包消息,并响应SOAP消息请求。 因此,发送计算机系统可以以有效的方式查询多个计算机系统,而不必引起另外与面向连接的通信相关的开销。

    Querying for services using soap over UDP
    5.
    发明申请
    Querying for services using soap over UDP 有权
    使用soap over UDP查询服务

    公开(公告)号:US20060215571A1

    公开(公告)日:2006-09-28

    申请号:US11087139

    申请日:2005-03-23

    IPC分类号: H04L1/00

    摘要: A sending computer system can identify one or more available network resources at one or more network computers by sending a request for services using SOAP over UDP. In particular, the sending computer system prepares a SOAP message that includes a request for available resources. The sending computer system then encapsulates the SOAP message into a user datagram, and sends the user datagram to one or more identifiable computer systems on the network. In one implementation, the sending computer system sends the user datagram to a multi-cast URI. The receiving computer system receives the message through UDP, unpacks the message, and responds to the SOAP message request. Accordingly, the sending computer system can query multiple computer systems in an efficient manner without necessarily incurring the overhead otherwise associated with connection-oriented communication.

    摘要翻译: 发送计算机系统可以通过使用SOAP over UDP发送对服务的请求来识别一个或多个网络计算机上的一个或多个可用网络资源。 特别地,发送计算机系统准备包括对可用资源的请求的SOAP消息。 发送计算机系统然后将SOAP消息封装成用户数据报,并将用户数据报发送到网络上的一个或多个可识别的计算机系统。 在一个实现中,发送计算机系统将用户数据报发送到多播URI。 接收计算机系统通过UDP接收消息,解包消息,并响应SOAP消息请求。 因此,发送计算机系统可以以有效的方式查询多个计算机系统,而不必引起另外与面向连接的通信相关的开销。

    Dispatching network connections in user-mode

    公开(公告)号:US20060173854A1

    公开(公告)日:2006-08-03

    申请号:US11049051

    申请日:2005-02-01

    IPC分类号: G06F17/30

    摘要: A listener operating in user-mode can dispatch control of a client connection to a listener without exposing system memory or other sensitive services or components. For example, a client component requests access to a network component through connection with a user-mode listener. Based on information contained in the client request, the listener passes a call to an application program interface, which returns a first set of data that includes user-mode contextual information. The listener passes this first set of data to the requested network component. Another call is made to an application program interface, which includes the first set of data, and a request for socket duplication. The application program interface returns control of the requested socket to the network component, such that the network component and the client component communicate directly through the requested socket in user-mode.

    Generic security claim processing model
    8.
    发明授权
    Generic security claim processing model 有权
    通用安全声明处理模式

    公开(公告)号:US07640573B2

    公开(公告)日:2009-12-29

    申请号:US10780274

    申请日:2004-02-16

    CPC分类号: G06F21/335

    摘要: A system for processing multiple types of security schemes includes a server having a claims engine that extracts claim(s) from security token(s) and maps extracted claims to other claims. The term claim as used in this context is a statement about a token's subject. The claims engine can extract claim(s) from one or more different types of security tokens corresponding to the multiple security schemes. These extracted claim(s) can then be selectively mapped to other claims using mapping information that is accessible to the server. The security decision can then be based on the extracted and/or derived claim(s) rather than tokens. This system can thereby support multiple security schemes and simplify the security process for the user.

    摘要翻译: 用于处理多种类型的安全方案的系统包括具有从安全令牌提取权利要求并将提取的权利要求映射到其他权利要求的权利要求引擎的服务器。 在这种情况下使用的这个术语是关于令牌主题的声明。 索赔引擎可以从对应于多个安全方案的一个或多个不同类型的安全令牌中提取索赔。 然后可以使用服务器可访问的映射信息将这些提取的权利要求选择性地映射到其他权利要求。 然后,安全性决定可以基于提取的和/或导出的权利要求而不是令牌。 因此,该系统可以支持多种安全方案,并简化用户的安全过程。

    Communication channel model
    9.
    发明申请
    Communication channel model 有权
    通信渠道模式

    公开(公告)号:US20060178152A1

    公开(公告)日:2006-08-10

    申请号:US11051238

    申请日:2005-02-04

    IPC分类号: H04Q7/20

    摘要: The present invention provides for a channel model capable of generating a runtime communication channel with pluggable modular channel components. These channel components implement one of a set of standard interfaces that allow processing details of communication semantics between components to be represented in a polymorphic way. A message and corresponding communication semantics are recursively passed through the channel components using the standard interface, thereby abstracting other modules and components from specific implementation details of how the communication semantics are performed. The message may then be sent to the next appropriate module for further processing, or the processing may be completed at that particular component or module. Note also that the message can also be de-multiplexed on the service side in a similar fashion as that described above.

    摘要翻译: 本发明提供一种能够生成具有可插拔模块化信道分量的运行时通信信道的信道模型。 这些通道组件实现了一组标准接口之一,允许处理以多态方式表示的组件之间的通信语义的细节。 消息和对应的通信语义通过使用标准接口的信道分量递归地传递,从而将其他模块和组件从如何执行通信语义的具体实现细节中抽象出来。 然后可以将消息发送到下一个适当的模块进一步处理,或者可以在该特定组件或模块处完成处理。 还要注意,消息也可以以与上述相似的方式在服务端解复用。

    Scoped access control metadata element
    10.
    发明申请
    Scoped access control metadata element 有权
    范围访问控制元数据元素

    公开(公告)号:US20050278390A1

    公开(公告)日:2005-12-15

    申请号:US11207034

    申请日:2005-08-19

    摘要: Methods, systems, and data structures for communicating object metadata are provided. A generic metadata container is presented that allows object metadata to be described in an extensible manner using protocol-neutral and platform-independent methodologies. A metadata scope refers to a dynamic universe of targets to which the included metadata statements correspond. Metadata properties provide a mechanism to describe the metadata itself, and metadata security can be used to ensure authentic metadata is sent and received. Mechanisms are also provided to allow refinement and replacement of metadata statements. The generic metadata container can be adapted to dynamically define access control rights to a range of objects by a range of users, including granted and denied access rights.

    摘要翻译: 提供了传达对象元数据的方法,系统和数据结构。 提出了一个通用的元数据容器,允许使用协议中立和平台无关的方法以可扩展的方式描述对象元数据。 元数据范围是指所包含的元数据语句对应的目标的动态范围。 元数据属性提供了一种描述元数据本身的机制,并且可以使用元数据安全性来确保发送和接收真实的元数据。 还提供了机制来允许细化和替换元数据语句。 通用元数据容器可以被适配成动态地定义一系列用户对一系列对象的访问控制权限,包括授权和被拒绝的访问权限。