Abstract: In a method for selecting a remote application service from a plurality of remote application services containing a requested electronic resource, a computer receives a request for an electronic resource. The computer sends a request for a geographic location of each node in the plurality of nodes containing the electronic resource. The computer determines a distance between the geographic location of each node in the plurality of nodes and the geographic location of the origin of the request for the electronic resource, respectively. The computer selects a remote application service based at least partially on the distance between the geographic location of each node and the geographic location of the origin of the request for the electronic resource.

Abstract: Systems, methods and computer-readable media provide for identifying a physical machine corresponding to a virtual machine. A system assigns a data center machine identifier to a physical computing device in a data center, along with a physical location for the physical computing system. In response to creating a virtual machine on the physical computing device, the system creates a mapping from a virtual machine identifier for the virtual machine to the data center machine identifier for the physical computing system.

Abstract: An authentication and authorization plug-in model for a cloud computing environment enables cloud customers to retain control over their enterprise information when their applications are deployed in the cloud. The cloud service provider provides a pluggable interface for customer security modules. When a customer deploys an application, the cloud environment administrator allocates a resource group (e.g., processors, storage, and memory) for the customer's application and data. The customer registers its own authentication and authorization security module with the cloud security service, and that security module is then used to control what persons or entities can access information associated with the deployed application.

Abstract: A method and system that enables cross-border compliance with export restrictions of particular computer technology, including software loaded on a computing device. The computing device is loaded with software, and has a country location device, such as a low-end GPS device. The country location device (country locator) stores the present geographic location of the device in a location register. When the computing device is turned on or the software is activated for operation on the computing device, a security utility of the software compares the value in the register against a list of pre-established locations that are export-restricted. When the value matches (or falls within a range) of one of pre-established locations, the features of the software that are export restricted are automatically disabled.

Abstract: An approach is provided that allows an administrator to set a new password at a wireless access point, such as a traditional WAP or a wireless router. The wireless access point creates a message that includes the new password. The message is encrypted using the old password that was previously set for the wireless network. The encrypted message is wirelessly transmitted from the wireless access point to the active client devices (those clients currently accessing the wireless network). The clients decrypt the message using the old password that was previously provided to the clients. The clients retrieve the new password from the message. The clients construct a new message that is encrypted using the new password. The new message is wirelessly transmitted from the clients to the wireless access device and serves as an acknowledgement.

Abstract: Access is controlled to managed resources in a stateless web server architecture including a stateless web server computing platform; a resource locator map portion of the stateless web server computing platform providing a unique resource locator code representing each managed resource in a stateless web server architecture, wherein the managed resource is assigned to a plurality of application program components; a set of servlet filters disposed in a portion of the stateless web server computing platform, each servlet filter associated with one of the application program components; a resource locator matcher portion of the stateless web server computing platform, responsive to a user request to a unique resource locator, matching a pattern in the user request to one or more of the application program components using a corresponding servlet filter; and a request dispatcher portion of the stateless web server computing platform sending the user request to the matched application program component, wherein

Abstract: Methods and systems are provided for dynamically altering the capabilities of a software application in response to a request from a user to perform an action in the application. Based on the user's security role, the software application is reconfigured by either granting access to the user to an existing component of the application, or if no suitable component is available, adding an external vendor component to the software application which is suitable for performing the requested action.

Abstract: Objects on application servers are distributed to one or more application servers; a user is allowed to declare in a list which objects residing on each application server are to be protected; the list is read by an interceptor; responsive to exportation of a Common Object Request Broker Architecture (“CORBA”) compliant Interoperable Object Reference (“IOR”) for a listed object, the interceptor associates one or more application server security flags with interfaces to the listed objects by tagging components of the IOR with one or more security flags; and one or more security operations are performed by an application server according to the security flags tagged to the IOR when a client accesses an application server-stored object, the security operations including an operation besides establishing secure communications between the client process and the server-stored object.

Abstract: Run-as credentials delegation using identity assertion is presented. A server receives a request from a client that includes the client's user identifier and password. The server authenticates the client and stores the client's user identifier without the corresponding password in a client credential storage area. The server determines if a run-as command is specified to communicate with a downstream server. If a run-as command is specified, the server retrieves a corresponding run-as identity which identifies whether a client credential type, a server credential type, or a specific identifier credential type should be used in the run-as command. The server retrieves an identified credential corresponding to the identified credential type, and sends the identified credential in an identity assertion token to a downstream server.

Abstract: A computer implemented method, apparatus, and computer usable program code for interactive mail management of physical mail. Physical mail is received in a mailbox. An identifier is read in response to receiving the physical mail in the mailbox. The physical mail contains the identifier. Information contained in the identifier is sent to the mail recipient. The mail recipient is able to identify instructions for communicating with a sender associated with the physical mail based on the information from the identifier.

Abstract: A Web browser provides a customized display of phone and fax numbers within a Web page according to user settings. A special phone or fax tag within the Web page file identifies an alphanumeric telephone number within the display (for example, 1-888-IBM-HELP). The telephone number data within the tagged field is converted into a preferred format, as specified at the customization settings page of the Web browser (for example, all numeric 1-888-426-4357). The conversion is preferably displayed upon user indication or activation such as placement of a cursor in proximity to the area occupied by the telephone number within the Web page. A mouse click or keyboard command causes an action within the computer system, as specified within the customization page for the Web browser. For example, by clicking on the telephone number, it is loaded into another software application to connect a telephone call or to send a fax to the telephone number.

Abstract: Methods, systems, and media are disclosed for determining access rights to a resource managed by an application. One embodiment includes receiving a request by the application, wherein the request comprises an action a user seeks to perform on the resource. Further, the embodiment includes locating, based on the request, the resource in a structure having groupings of resources, wherein the groupings include a grouping having the resource. Typically the groupings comprise files having mappings of resources to assigned groups, and each group has an associated authorization table mapping roles or policies to users. Further still, the embodiment includes reading an authorization table associated with the grouping having the resource, and determining whether to grant the access rights for performing the action on the resource.

Abstract: Delivering time sensitive email including creating an email message for time-sensitive delivery to a multiplicity of addressees' mailboxes on email servers, including inserting in the email message a data element identifying the message as a message for time-sensitive delivery; assigning delivery time constraints to the message; delivering the message, in accordance with the time constraints and for temporary storage outside the mailboxes, to email servers having addressees' mailboxes; and instructing the servers to place the message in all addressees' mailboxes at approximately the same time.

Abstract: Run-as credentials delegation using identity assertion is presented. A server receives a request from a client that includes the client's user identifier and password. The server authenticates the client and stores the client's user identifier without the corresponding password in a client credential storage area. The server determines if a run-as command is specified to communicate with a downstream server. If a run-as command is specified, the server retrieves a corresponding run-as identity which identifies whether a client credential type, a server credential type, or a specific identifier credential type should be used in the run-as command. The server retrieves an identified credential corresponding to the identified credential type, and sends the identified credential in an identity assertion token to a downstream server.

Abstract: A method, computer program product, and apparatus for receiving a postal mail item. The postal mail item is received. The postal mail item contains a radio frequency identifier identifying the sender of the postal mail item. Responsive to receiving the postal mail item in the mailbox, the radio frequency identifier of the postal mail item is scanned with a scanner to identify the sender of the postal mail item. A determination is made whether the sender of the postal mail item is in a junk mail list. The junk mail list includes a list of senders accessible to a processor in the scanner.

Abstract: Objects on application servers may be defined into classes which receive different levels of security protection, such as definition of user objects and administrative objects. Domain-wide security may be enforced on administrative objects, which user object security may be configured separately for each application server in a domain. In a CORBA architecture, IOR's for shared objects which are to be secured on a domain-wide basis, such as administrative objects, are provided with tagged components during IOR creation and exporting to a name server. Later, when the IOR is used by a client, the client invokes necessary security measures such as authentication, authorization and transport protection according to the tagged components.

Abstract: Objects on application servers may be defined into classes which receive different levels of security protection, such as definition of user objects and administrative objects. Domain-wide security may be enforced on administrative objects, which user object security may be configured separately for each application server in a domain. In a CORBA architecture, IOR's for shared objects which are to be secured on a domain-wide basis, such as administrative objects, are provided with tagged components during IOR creation and exporting to a name server. Later, when the IOR is used by a client, the client invokes necessary security measures such as authentication, authorization and transport protection according to the tagged components.

Abstract: Methods, systems, and media are disclosed for determining access rights to a resource managed by an application. One embodiment includes receiving a request by the application, wherein the request comprises an action a user seeks to perform on the resource, and locating, based on the request, the resource in both a containment relationship graph and in a structure having groupings of resources, wherein the groupings comprise a grouping having the resource. Further, the embodiment includes traversing a vertex of the containment relationship graph, wherein the vertex comprises a generational resource of the resource, and reading an authorization table associated with a grouping having the generational resource in the groupings. Further still, the embodiment includes determining whether to grant the access rights for performing the action on the resource.

Abstract: Run-as credentials delegation using identity assertion is presented. A server receives a request from a client that includes the client's user identifier and password. The server authenticates the client and stores the client's user identifier without the corresponding password in a client credential storage area. The server determines if a run-as command is specified to communicate with a downstream server. If a run-as command is specified, the server retrieves a corresponding run-as identity which identifies whether a client credential type, a server credential type, or a specific identifier credential type should be used in the run-as command. The server retrieves an identified credential corresponding to the identified credential type, and sends the identified credential in an identity assertion token to a downstream server.

Abstract: A system and method for using a declarative approach to enforce instance based security in a distributed environment is presented. The invention described herein includes security logic in declarative specifications that, in turn, decouples the security logic from distributed object administration logic. An access manager identifies access requirements by combining object name property keys included in a distributed object with property key specifications included in a declarative specification. In turn, the access manager compares a caller's access attributes with the access requirements to determine whether to create a distributed object instance and allow the caller to invoke a method on the distributed object instance. The access requirements may also include role specifications and method parameter specifications.