Abstract: The present invention provides techniques for creation, operation, management, and access control of network-based storage services. Specific embodiments provide improved efficiency of the service management tasks used for designing, operating and accounting the robust and profitable network services, for example. In representative embodiments, techniques for constructing integrated network and storage services are provided. In a specific embodiment, the service comprises of three major service components: virtual private networks (VPN), application servers and storage area networks (SAN). Each of these service components has its own customer identification information, such as VPN identifier for VPN services, process identifier for application servers and logical unit number (LUN) for storage devices.

Abstract: Techniques for correlating different results of role grouping includes receiving two sets of grouping of nodes on a network, grouping of the nodes according to connection characteristics of the nodes in the groups, each of the sets having associated identifications and correlating associated identifications of one set with those of the other set so that the two groups have the same identifications, if the member hosts of each set of groups have nearly identical connection habits.

Abstract: For reducing Internet congestion caused by multiple flows of the same popular content transmitted to different destinations, a single flow of content is transmitted from the content hosting server to an Internet regional domain using a conventional exterior routing and in the regional domain, using an interior flow routing. Inside of regional domain, packet destination address is replaced by a flow number, which is used as a local and temporary alias of content. This enables recipient devices that have requested the same content and have been provided with the flow number to receive the same flow of packets and thus to prevent congestion and delays in content delivery that may be caused by multiple separate flows of the same content transmitted from the content hosting server to recipients at different recipients' addresses. The technology implementation is local to a singly administered regional system and does not require any change to the global Internet infrastructure.

Abstract: A technique for performing message communications while assigning a space and respective time periods or time points at present, in past and in future is disclosed. A space-time object intercepts a message. Alternatively, this object per se executes the processing for immediately transmitting a message to a target object under management with relevancy thereto, for retaining the message by a future time point assigned, or for preparing and sending a message for searching logs in the past, thereby to realize the space-time communications.

Abstract: The invention proposes a method for establishing sessions in a network comprising a user entity, a network control node and a plurality of network nodes storing subscriber specific information, the method comprising the steps of receiving a session establishing request at the network control node, forwarding a policy request message from the network control node to each network node of the plurality of network nodes storing subscriber specific information comprising policy information required for the session to be established, processing the policy request message to generate a policy decision message and sending the policy decision message to the network control node from each of the network nodes having received the policy request message, generating a single policy decision confirmation message based on the received policy decision messages in the network control node, and sending the single policy decision message to the user entity.

Abstract: Event data associated with state data corresponding to an instance of a process is collected by an interceptor associated with a server that performs an operation to modify the state data. The server performs a single transaction with the database to store both the modified state data and the associated event data, the transaction either succeeding or failing, whereby if the transaction succeeds, then both the state data and the event data are stored at the database, and if the transaction fails, then both the state data and the event data are not stored at the database. The event data stored at the database is then transmitted to a tracking service for conversion into a query-able format.

Abstract: Embodiments described herein are based on the principle that shells execute commands as units of characters. Accordingly, embodiments herein provide for a sending side with enough intelligence to isolate each command, examine it, perform some levels of validation, and deliver a structured representation of the command to the remote processor before doing any network operations. More specifically, embodiments herein provided for a mechanism of identifying a command and encapsulating the command into a single message (e.g., a SOAP, HTTPS, or other type message), which is then sent to a remote shell for processing as an entire unit. Accordingly, embodiments herein treat the command as a single unit, rather than as a character-oriented transmission.

Abstract: Embodiments described herein are based on the principle that shells execute commands as units of characters sent within a message. Accordingly, embodiments herein provide for establishing a remote processing session for commands by using a binding mechanism that binds a series of commands to a remote shell using a message rather than a binary stream of data. More specifically, embodiments herein provided for a mechanism of encapsulating both a command and a binding mechanism (e.g., a shell identifier and/or shell token) into a single message. Accordingly, the binding mechanism can be used throughout the lifetime of the session and allows for modeling the shell processor session (its lifetime) as a series of commands, rather than as a series of characters. In addition, note that because the binding mechanism for the shell sessions is sent within messages, the problems associated with binary or character-by-character establishment of current shell sessions are overcome.

Abstract: In a system for avoiding section collision for application server requests over a single database connection, the database server assigns query identifiers to each instance of the same cursor opened for the same processing level within an application, allowing multiple instances of the same cursor to be processed in parallel without section collision. The application server assigns a command source identifier to each statement sent over a single database connection to uniquely identify the application source of the statement. This applies for multiples of the same statement sent by different application sources within the same application, for a single statement containing multiple application sources, and for multiple statements from different applications multiplexed over a single database connection. These statements can be processed separately from and in parallel with the each other without section collision.

Abstract: A hardware Secure Processing Unit (SPU) is described that can perform both security functions and other information appliance functions using the same set of hardware resources. Because the additional hardware required to support security functions is a relatively small fraction of the overall device hardware, this type of SPU can be competitive with ordinary non-secure CPUs or microcontrollers that perform the same functions. A set of minimal initialization and management hardware and software is added to, e.g., a standard CPU/microcontroller. The additional hardware and/or software creates an SPU environment and performs the functions needed to virtualize the SPU's hardware resources so that they can be shared between security functions and other functions performed by the same CPU.

Abstract: Decision trees populated with classifier models are leveraged to provide enhanced spam detection utilizing separate email classifiers for each feature of an email. This provides a higher probability of spam detection through tailoring of each classifier model to facilitate in more accurately determining spam on a feature-by-feature basis. Classifiers can be constructed based on linear models such as, for example, logistic-regression models and/or support vector machines (SVM) and the like. The classifiers can also be constructed based on decision trees. “Compound features” based on internal and/or external nodes of a decision tree can be utilized to provide linear classifier models as well. Smoothing of the spam detection results can be achieved by utilizing classifier models from other nodes within the decision tree if training data is sparse. This forms a base model for branches of a decision tree that may not have received substantial training data.

Abstract: A system for enabling the use of valid authentication certificates when the public key and private keys of any of the certifying authority have expired. The enabling by the system includes obtaining a server certifying authority chain (SCAC) certificate by the server from the certifying authority, presenting the original valid authentication certificate along with the said server certifying authority chain certificate by the server to the browser during the SSL handshake, accepting the transaction by the browser after verification of the original authentication certificate using the expired public key of the certifying authority, and verifying the said SCAC certificate using the new public key of the said certifying authority.

Abstract: There is provided a communications network including a server forming part of a virtual private network, a plurality of client computers operative to request connection to the server and to be connected to the server when a request for connection is granted, thereby to be added to the virtual private network and a server response module, operative, in response to a connection request from at least one of the plurality of client computers which connection request cannot be processed by the server, to provide to the at least one of said plurality of client computers a server response indicating that the connection request should be retransmitted only after at least one criterion is met.

Abstract: A computer program product embodied in a computer-readable medium is configurable to accomplish execution of an application that is specified and encoded in a markup-based descriptor language. The product includes client runtime computer code configured to cause a client computer device to process the markup-based descriptor language to deploy an application to accomplish execution of the application. The client runtime computer code is further configured to process the markup-based descriptor language to selectively configure the client computer device to deploy the application so as to accomplish execution of the application by the client computer device stand-alone or by the client computer device in cooperation with a server to which the device is connectable via a network connection.

Abstract: A computer-implemented method can be used to support Uniform Resource Locator (URL) compression. Such a method can comprises the steps of receiving a Web request associated with an original URL from a client by a Web component; saving the original URL in a database; generating a compression key in a compressed URL; getting the original URL from the database using the compression key; and responding to the client.

Abstract: Techniques for delivering internal mail over the Internet without relying upon a domain name in an email address commonly known to include an @ sign are disclosed. An embodiment of the techniques is for a collaborative communication system or platform, where each of users in the collaborative communication platform is assigned an identifier. The identifier is used for delivering the internal mail so authored similarly to an email, except that the internal mail is delivered without relying upon an email address or the domain name therein. The identifier of a recipient cannot be used as an email address for someone other than any of the registered users to send an email message to the recipient.

Abstract: Embodiments of the invention include a method, apparatus and system for managing SAS zoning, using end device grouping. A SAS end device grouping management application is configured to group SAS end devices, such as SAS initiator devices and SAS target devices, into any number of zones or zone configurations. The end device grouping application uses these defined zones to create a minimal number of zone groups, e.g., by creating one zone group per defined zone and populating the zone group with the ZPSDS entry point phys of the end devices in the zone from which the zone group is based, and to configure the respective permissions of the created zone groups. The end device grouping application then compares all existing zone groups for common phys and removes them to a new zone group. The zone groups are compared and processed in this manner until no zone groups have common phys.

Abstract: A computer-implemented method for processing service requests in a distributed environment includes routing a type of service request to a first service provider in the distributed environment, the first service provider having a commitment level for handling the service request type, detecting a second service provider in the distributed environment capable of handing the service request type, determining a commitment level of the second service provider to handle the service request type, and responsive to the commitment level of the second provider exceeding the commitment level of the first provider, routing the service request type to the second service provider.

Abstract: The present invention pertains to specifying, analyzing and evaluating systems such as distributed content distribution networks. Systems and methods are provided to predict how new deployments and changes to existing architectures will impact the networks. A network design may prepare a “what-if” scenario and the impact of this scenario may be predicted. Various tools are provided to determine relevant network variables and collect data about such variables, to learn what dependencies may exist among relevant variables, to prepare an input distribution and to output a predicted impact for the what-if scenario. Thus, a system designer is able to see a predicted impact that a network change or new deployment will have without having to resort to back of the envelope calculation or costly field deployments.

Abstract: In an exemplary method, a content posting is received from an access device connected to a network. The content posting includes data representative of a content instance and a geographic location associated with the content instance. The content posting is stored. The content instance is selectively distributed to at least one other access device connected to the network based on the geographic location. In certain embodiments, the selective distribution includes determining that the other access device is located physically proximate to the geographic location and making the content instance accessible to the other access device in response to the determination. In certain embodiments, the method further comprises the access device creating the content instance, detecting the geographic location as a physical location of the access device, and associating the geographic location with the content instance.