Abstract: Various embodiments include a resource control system. The resource control system can receive consumption demand requests to access one or more electronic resources. The resource control system can assign license entitlements, each with varying quantity, to consumption demand requests to enable access to the electronic resources. An ambiguity resolution engine can make license entitlement assignments to consumption demand requests when a set of license entitlements can cover a target electronic resource specified by the consumption demand requests. The ambiguity resolution engine can rank license entitlements based on ratios of their resource costs and the consumption demand requests based on their electronic resource usage efficiency. The ambiguity resolution engine can assign the license entitlements by comparing the rankings of the license entitlements and the rankings of the consumption demand requests.

Abstract: Various of the disclosed embodiments concern computer systems, methods, and programs for extracting information from an asset tag that can be used to monitor the corresponding asset. An operator, e.g. employee of an enterprise, logs into an application executed by a mobile device that includes a camera. A tag template can then be manually selected by the operator or automatically selected by the application. The tag template is used during scanning to locate and identify machine-readable elements, human-readable elements, structural elements, or some combination thereof. Once the application registers a successful scan of the asset tag, the operator can review and confirm the information was extracted correctly. Generally, the extracted information is transmitted to an asset management system, which creates a database entry that allows the asset to be continually monitored by the enterprise, e.g. each time the asset tag is subsequently scanned.

Abstract: A token contains licensing information for software stored on another computer. The token connects to the computer wirelessly, and transmits the licensing information, preferably automatically. While the token is connected to the computer, at least one factor in a multi-factor authentication scheme is satisfied for licensed use of the software. When the token disconnects from the computer either at will, or by exceeding the range of the wireless connection, the software on the computer becomes unlicensed and then can no longer execute.

Abstract: Several embodiments include a policy-bound token distribution system. The system can include a back-office server that issues policy-bound tokens to local main distribution servers. A local main distribution server can distribute a policy-bound token to a digital environment to authorize an operator to take advantage of a protected resource. The system can rely on a backup server to distribute the policy-bound tokens whenever the distribution service of the local main distribution server is unavailable. To prevent run-time leakage from the backup server, the backup server can synchronize its distribution state with the local main distribution server and the back-office server. The distribution state can include distribution transaction records between the backup server and client devices. Throughout the system, each distribution transaction record can be assigned unique transaction ID to prevent multiple accounting of the same distribution transaction record from different servers.

Abstract: A token contains licensing information for software stored on another computer. The token connects to the computer wirelessly, and transmits the licensing information, preferably automatically. While the token is connected to the computer, at least one factor in a multi-factor authentication scheme is satisfied for licensed use of the software. When the token disconnects from the computer either at will, or by exceeding the range of the wireless connection, the software on the computer becomes unlicensed and then can no longer execute.

Abstract: Hostile attacks against a computer program are prevented when the program is executed in a computing environment that is controlled by the attacker. A preposition is run in a secure computing environment instead of the original call site, i.e. the IF antecedent, which has a TRUE consequence and a FALSE consequence are run in a secure computing environment. Embodiments of the invention also allow an insecure call site to detect modifications by a hostile attacker surreptitiously. In embodiments of the invention, a script is generated by a script generator from the IF antecedent and TRUE and FALSE consequence source code, for example relative to a call site. The original source code is modified to call the script engine, rather than the preposition. At run-time a script engine executes this script.

Abstract: Several embodiments enable management of a bulk package of licenses at a distribution server. The distribution server can store a fulfillment record of a set of licenses. The fulfillment record can indicate distribution statuses of the licenses. The distribution server can also maintain a distribution hierarchy for the set of licenses in the distribution server. The distribution hierarchy can identify one or more other distribution servers that transferred the set of licenses from a root of trust for the licenses to the distribution server and one or more end-user devices or distribution servers that received or fulfilled at least one of the licenses from that the distribution server. When the distribution server distributes a subset of the licenses to a target computing device, the distribution server can update both the fulfillment record and the distribution hierarchy.

Abstract: Exposure of sensitive tenant information is minimized in a multi-tenant/multi-user environment. A unique encryption key is provided for each tenant. The tenant encryption key is never stored in the clear and each copy of the tenant encryption key is protected by a user derived password. A secure folder is created for each tenant and encrypted by the tenant encryption key. Secure folders are mounted only on-demand, i.e. when an authenticated request is received for that tenant. The secure folders are mounted only for specific durations only. Otherwise, they are un-mounted. When a secure folder is mounted, any read/write operation to the secure folder is encrypted/decrypted on-the-fly. When the secure folder is un-mounted, all file contents in the secure folder, and the secure folder itself, are not visible in the file system and no application can browse to the secure folder without the tenant encryption key.

Abstract: Some embodiments include a method of scheduling batch processing of a batch processing system based on subscriber usage patterns. The method includes steps of recording a last job commencement event for a subscriber when the batch processing system starts processing a batch process for the subscriber; recording a last usage event for the subscriber when the subscriber uses the batch processing system; in an event that a time period elapsed since the last usage event for the subscriber is less than a time period elapsed since the last job commencement event for the subscriber, placing a next batch process of the subscriber into a recently used queue; identifying the next batch process of the subscriber as the oldest batch process from the recently used queue; and start processing the identified batch process for the subscriber.

Abstract: Some embodiments include a method of preventing software licensing exploitation in a virtual environment. The method includes: retrieving, by a first instance of a licensed application running on an original virtual machine as permitted by an original software license, an original unique identifier from a virtual device in the original virtual machine; creating, by a hypervisor of the virtual environment, a cloned virtual machine instance as a copy of the original virtual machine; retrieving, by a second instance of the licensed application running on the cloned virtual machine instance, a new unique identifier from a virtual device in the cloned virtual machine instance; and determining, by the second instance of the licensed application running on the cloned virtual machine instance, that the original software license does not apply to the cloned virtual machine instance because the new unique identifier is different from the original unique identifier.

Abstract: The present invention provides a storage management system and method for managing access between a plurality of processes and a common store. According to the invention, each individual process comprises data processing means, a cache for the temporary storage of data generated by the data processing means, and a control unit for managing the transferral of data between the cache and a common store. The control unit comprises a manager for monitoring the availability of storage locations in the store to receive and store data and for allocating data to available storage locations, an interface for transferring the allocated data to the available storage locations, and a locking arrangement for locking the store during data transfer in order to ensure exclusive access and thereby preserve data integrity.

Abstract: In embedded licensing from multiple license sources, a hardware device sends a capability request when a new licensed capability or modification to an existing licensed capability is desired. The hardware device transmits a first capability request to a first server and receives a first capability response from the first server. The hardware device then transmits a second capability request to a second server and receives a second capability response from the second server. When the first server and the second server are the same, regenerative licensing is activated by the hardware device, and an authorized capabilities list of the second capability response replaces an authorized capabilities list of the first capability response. When the first server and the second server are distinct, cumulative licensing is activated by the hardware device, and an authorized capabilities list of the second capability response is added to an authorized capabilities list of the first capability response.

Abstract: A technique adds virtual file anchoring functionality to a platform by mounting a virtual file system (“system”) to store an anchor file. Binary code to create and run the system is embedded into a trusted application's binary code. Thus, whenever the trusted application executes, the embedded code ensures the system is validated and started or restarted as required. To interrogate the existence of the anchor, it can be read like any other file. To modify the status of the anchor, the name of the associated file is decorated such that instead of modifying the file, foo, the trusted application modifies a pseudo-file, foo#decoration. The decoration varies for each modification operation. To generate the decoration, the algorithm takes as input a time component, e.g. in the form of the last accessed time field of the parent directory where the secure file anchors files reside, and the name of the anchor.

Abstract: A method and system for automated clock wind-back recovery are disclosed. According to one embodiment, a computer-implemented method comprises requesting a license to access an application and storing a time anchor, the time anchor comprising a recent system time observation. Clock modification is detected, wherein detecting clock modification comprises comparing a license expiration date to a current system time. The time anchor is compared to a trusted time authority value, the trusted time authority value comprising the current system time and a tolerance. The time anchor is updated, clock modification is corrected, and access to the application is retrieved.

Abstract: Various of the disclosed embodiments disclose systems and methods for assessing usage of a resource, such as hardware, software, or firmware, in a computer system. For example, some embodiments contemplate a model in which an enterprise application derives its license cost based upon the actual business value provided by the licensed resource to the enterprise. If an enterprise has purchased software that it uses very heavily, then the license cost may increase. Conversely, if the enterprise uses the software rarely, then the license cost may decrease. This usage granularity may allow an enterprise executive to purchase a software license without fear that the software will be inefficiently utilized. A licensor may similarly use the system to charge more accurate fees.

Abstract: Some embodiments include a method of generating an event-based device ID based on an operating environment of a computing device. The method includes binding an event-based identifier and an events profile ID to a policy-related record that is associated with an externally controlled policy. The binding ensures that the policy is applied to the operating environment identified by the event-based identifier. The method includes generating the device ID based on event logs of the computing device.

Abstract: Technology is disclosed for generating a virtual appliance (“vApp”) for an application using an existing installation manifest of the application. The installation manifest can be part of a traditional installation package that is used to install the application on a computer system. The installation manifest contains configuration information for installing the application using the installation package. A vApp builder analyzes the installation manifest to identify and/or determine various configuration information of the application that may be required to generate the vApp. The configuration information can include information regarding the application components of the application, packages/dependencies on which the execution of the application components depend, an operating system on which the application components and/or their packages execute. The vApp builder generates the vApp using the information obtained from the installation manifest.

Abstract: Various of the disclosed embodiments provide systems and methods to compensate for certain event log errors. For example, when a system fails to record the occurrence of several events (a file closing, a file modification, a network socket opening, etc.) the disclosed embodiments may identify the discrepancy and provide a synthesized event sequence suitable to fulfill the purposes of the event log. In this manner, for example, a client may still be accurately billed for their use of a licensed software or system, even if their usage was punctuated with occasional failures to record their activity.

Abstract: A method and system implementing software licensing management under machine virtualization are disclosed. According to one embodiment, a system comprises a virtual platform running on a physical machine; a binding agent running on a host operating system of the virtual platform; a license enforcement module running on a virtual machine instance of the virtual platform. The license enforcement module is in communication with the binding agent. The binding agent enforces a mutex lock to ensure that only a specified number of license enforcement modules are running on the physical machine.

Abstract: Some embodiments include a method of using different keys from an embedded key generator for each update of a trusted storage to mitigate common user-based exploits (clone, restore, tamper) of the trusted storage. The method includes: retrieving a key generator certificate from the key generator; requesting the key generator to generate a key associated with a key authenticator and to return a key handle associated with the key; generating a request to the key generator, the request including the key handle, the key authenticator, and a record to be maintained in the trusted storage; and in response to receiving an encrypted record from the key generator, storing the encrypted record associated with the first key handle and an authenticator generation formula in the trusted storage in a computing device, wherein the encrypted record is encrypted via the above key.