Abstract: A trusted process for use with a hierarchical directory service such as LDAP for enabling different security systems to store and retrieve unique identifiers that are shared or common to the entire directory. The trusted process allows LDAP users to store and to retrieve unique identifiers on LDAP using standard LDAP interfaces. It also allows security systems to share unique identifier information. The trusted process generates or verifies a unique identifier, guarantees the uniqueness of a unique identifier within the entire directory (rather than just within a single security system), and guarantees that any unique identifier returned to an LDAP user is a trusted unique identifier.

Abstract: A persistent object service (POS) that interfaces to a set of one or more relational database management systems. A persistent object is mapped to one or more tables in a relational database based on the object's attribute types and the object's relationships with other objects. If the object inherits from another object, the mapping creates multiple tables, a top level table for base attributes, and a set of one or more child tables that contain extended attributes of the inherited objects. A routine for storing an object converts persistent object operations to a sequence of SQL statements for storing the object in the relational database.

Abstract: An architecture for extending the Java security model to allow a user or administrator to explicitly deny permissions. By itself, the Java 2 security model does not allow additions to the collections of policy permissions after they have been loaded from the Java policy file. The inventive architecture allows Java applets and applications to dynamically prompt the user to deny a permission that does not exist in the Java policy file. If the user denies the permission, the present invention denies the permission for the ProtectionDomain to which the class asking for the permission belongs. Attributes for the denied permission may be set during runtime and saved across browser sessions.

Abstract: A method for processing custom tags in a document object model (DOM) representation irrespective of the case in which the tags are authored. In an illustrative embodiment, a document object model (DOM) tree is processed to identify custom tags. Upon encountering a custom tag, an appropriate tag handler (e.g., a Java object, an XSL stylesheet, or the like) is invoked. According to the invention, a tag recognition routine is used for recognizing and handling case-insensitive custom tags. As a servlet engine is examining a tag name, if the name does not match one of the registered tags, the routine converts the name to neutral case. If the tag recognition routine recognizes the name as one of the case-insensitive tags, it converts the attributes to the appropriate case, and hands the resulting element off to a correct tag handler for processing.

Abstract: A method, system, apparatus, and computer program product is presented for improving the execution performance of an application in a data processing system. Instrumentation code is inserted into an application in which the instrumentation code generates trace data for method entry events and method exit events when the instrumented application is executed. The trace output data that is generated by the instrumentation code is then analyzed to detect patterns which indicate an inefficient coding construct in the application. The source code for the inefficient coding construct in the application associated with the detected pattern may be modified according to indications provided to an application developer. For example, a specific inefficient coding construct may be an inefficient use of a cross-language boundary, such as the interface between Java code and native code, in which data is inefficiently transferred across the interface through a local array in the native code.

Abstract: A large distributed enterprise includes computing resources that are organized into one or more managed regions, each region being managed by a server machine servicing one or more gateway machines, with each gateway machine servicing a plurality of endpoint machines. A distributed system management framework is supported on the gateway machines and the one or more endpoint machines to carry out system management tasks. To enhance scalability, the endpoint machines support a low cost, low maintenance client component of the system management framework, and a corresponding server component is supported on each of the gateway machines. On an as-needed basis, appropriate executable code and system management data is delivered from a gateway to one or more endpoint machines to facilitate execution of a system management task for the managed region.

Abstract: A method, system, and computer program product is presented for minimizing overhead that may be incurred by executing specialized code, such as debug code or instrumentation code for monitoring the performance of the application, that is present within an application. The application executes on a data processing system having a processor containing predicate registers. The application is compiled in a manner in which the processor instructions for the specialized code are predicated using a set of one or more predicate registers that are dedicated or reserved by software convention for predicating the specialized code. In other words, for a given application, compilers and other sources of machine instructions do not generate any predicated processor instructions, other than processor instructions for the specialized code, which use the reserved predicate registers. When the application executes, neither the operating system nor other applications use the reserved predicate registers.

Abstract: A low-overhead performance measurement of an application executing in a data processing system is provided in order to generate per-thread performance information in a multithreaded environment. While a first set of events is being monitored for a particular thread as a first metric, events that may indirectly cause inaccuracies in the first metric, such as thread switches, are also monitored as a second metric. The presence of a positive value for the second metric is then used to determine that the first metric is inaccurate or unreliable, after which the first metric may be discarded; otherwise, the first metric is considered accurate. For example, the first metric may then be considered a thread-relative metric as it has been observed during a time period in which no thread switch events or interrupt events would have caused the first metric to become inaccurate during the execution of a particular thread.

Abstract: A method and system for augmenting conventional search engine results with peer-to-peer search results. Rather than relying solely on an index search in a database that has only indexed a minor portion of the entire World Wide Web, a server-based, peer-to-peer search is initiated in conjunction with the index search. The results from both search processes can be combined so that the user receives an augmented search result with more information than a search result from either process by itself. The entities that are involved in the search can also establish financially rewarding relationships. The server operator agrees to share a percentage of its revenue with peer-to-peer nodes as an incentive to join its registered set of root nodes and expand its peer-to-peer connections. The identified sources of information that provided the search hits can be used by the operator of the search engine in a compensation transaction.

Abstract: A method for processing digital audio data is presented. A control signal for a CD-changer unit is received and interpreted by a digital audio unit that stores digital audio data/files and that determines a CD-changer unit operation that would be performed by the CD-changer unit in response to the CD-changer unit receiving the control signal. The digital audio unit then emulates the CD-changer unit operation. The CD-changer unit to be emulated by the digital audio unit can be selected. The digital audio data stored by the digital audio unit can be organized as virtual CD-ROMs. By emulating the operations of multiple types of CD-changer units, a single digital audio unit can be inserted in many different digital audio systems, thereby extending the functionality of a digital audio system to include storage of softcopy digital audio files that may be accessed through controls and commands for a CD-changer unit.

Abstract: A method and apparatus is presented for controlling spin lock instrumentation for a spin lock in a system with a cache. A lock flag represents a busy state for the spin lock; a first instrumentation flag is a global variable representing an enablement state for the spin lock instrumentation. A second instrumentation flag, stored within the same cache line as the lock flag, is also maintained as an updateable indication of the first instrumentation flag. Prior to each acquirement of the spin lock, the second instrumentation flag is checked for an indication that spin lock instrumentation is enabled. Although a reading of the lock flag may generate a cache miss, the lock flag is necessarily checked upon attempting to acquire the lock; the check of the second instrumentation flag cannot generate a superfluous cache miss because the second instrumentation flag is in the same cache line as the lock flag.

Abstract: A method, a system, an apparatus, and a computer program product for automatically processing a facsimile document at a receiving device is presented. The receiving device stores a set of facsimile processing rules for automatically processing facsimile documents. The receiving device receives and stores a facsimile document and associated caller ID data from an originating device during a facsimile transmission. The receiving device then compares an originating phone number in the caller ID data against phone numbers in the set of facsimile processing rules. Each facsimile processing rule comprises one or more phone numbers and facsimile processing rule parameter data. In response to matching the originating phone number with a phone number in a facsimile processing rule, a modified facsimile document is then generated such that the modified facsimile document includes information associated with facsimile processing rule parameter data in the matching facsimile processing rule.

Abstract: A method of enabling a proxy to participate in a secure communication between a client and a set of servers. The method begins by establishing a first secure session between the client and the proxy. Upon verifying the first secure session, the method continues by establishing a second secure session between the client and the proxy. In the second secure session, the client requests the proxy to act as a conduit to a first server. Thereafter, the client and the first server negotiate a first session master secret. Using the first secure session, this first session master secret is then provided by the client to the proxy to enable the proxy to participate in secure communications between the client and the first server. After receiving the first session master secret, the proxy generates cryptographic information that enables it to provide a given service (e.g., transcoding) on the client's behalf and without the first server's knowledge or participation.

Abstract: A method of balancing loads during data distribution in a managed network environment wherein at least one gateway machine services a plurality of endpoints. System management tasks include data distributions, which are normally initiated at the gateway and distributed to all managed endpoints. Load balancing is achieved by setting a load parameter for each subnet of each network path between the gateway machine and an endpoint machine serviced thereby. The load parameter is selectable and identifies an amount of network bandwidth that may be used by a particular data distribution over the segment. Prior to initiating a distribution, the effective load that a given subnet will “see” when the operation begins is then calculated. If that effective load for any subnet exceeds that subnet's respective load parameter, the data distribution rate is altered for the overall network path. This technique effectively balances network loads and makes more efficient use of resources.

Abstract: A directory schema for directory applications or platforms that store common attributes in a distributed directory. According to the schema, a given attribute is stored in a directory together with a signature that identifies given information, e.g., the purpose and version of the attribute. Thus, when an attribute is migrated to a new value, e.g., upon the release of a new application version, the directory schema need not be extended. Rather, the attribute may be maintained in the schema is the same location as was used with an earlier application version.

Abstract: A method of outputting a document on a rendering engine in a client in a computer network. The document comprises a markup language data stream having a plurality of references to external resources required by the document. In operation, the document is first retrieved to the client. As the document is received, the rendering engine parses the markup language data stream for a list of external resources. If the list of external resources is present in the markup language data stream, the engine selectively prefetches at least one external resource as the document is output by the rendering engine.

Abstract: A method of enabling an HTTP server plug-in to pass an unmangled environment variable into a CGI process begins by configuring the HTTP server to initially override a CGI service method. When the server processes an HTTP request, the server plug-in, which is called prior to the CGI service method and is running in a process of the HTTP server, inserts a “name value” pair prepended with a marker in a request header parameter block of the HTTP server. Then, the CGI service override method executes the server's original (i.e. native) CGI service method, causing it to run an encapsulation program in the CGI process. This program scans the environment of the CGI process for any string prepended with a given HTTP code (e.g., the string “HTTP_”) and the marker. If it finds any such string, the program strips the given HTTP code and the marker from a remainder of the string and resets the environment variable into the CGI process in an “unmangled” form.

Abstract: A method for reuse of image data in a distributed computer network is operative at a web server in response to a request from a client browser for a web page. At the web server, a determination is made regarding whether the web page includes a given object reference. If so, a template defining a composite image is retrieved. The template identifies at least one image object to be retrieved from another location, typically from a host remote to the web server. Once the image object is retrieved, a given transform is applied to the image object to generate a transformed image object. The given transform, for example, is selected from a group of transforms such as: scaling, mirroring, cutting, cropping, inverting, flipping, reversing, rotating, color shifting, and combinations of the above. Thereafter, the transformed image object is mapped into the composite image according to the template. After the composite image is created, it is served within the web page originally requested by the client.

Abstract: A caching mechanism for a directory service having a backing store. According to the invention, directory search results are cached over a given data capture period, with the information then being used by a data analysis routine to generate a data access history for the user for a particular application. That history is then used to generate a recommended pre-fetch time, a filter key for the pre-fetch, and a preferred cache replacement policy (e.g., static or LRU). Based on that information, a control routine pre-fetches and populates the cache with information that is expected to be needed by the user as a result of that access history.

Abstract: Directory limits in a file system are initialized or refreshed in a streamlined manner during file system maintenance. In particular, when a check and repair utility performs full check and repair processing on a file system volume, a determination is made regarding whether there is an outstanding request to either prime or refresh the volume. In addition, if directory limits are currently enabled for the file system volume, an implied refresh request is noted. In either case, the request is satisfied in parallel with the check and repair processing. If no volume check and repair is necessary, then mount processing primes or refreshes the volume in a conventional manner.