Abstract: Private, personal, secret, or otherwise sensitive data is masked or redacted in response to receiving an event signal indicative of an occurrence, if any, of at least one of a number of defined events associated with the set of data. The data to mask is detected by matching it to one or more defined patterns and then validating it, in the case of the data being a financial account or credit card account number, by using a validation process, such as the Luhn algorithm. Among others, the defined event may be a transmission of the data between a host computer system and a terminal emulator, an entry of the data into a host screen, or an export of a set of host screen data to an external application by an end user computer system.

Abstract: An X display may be dynamically rerouted to a different graphics terminal, or to several graphics terminals, without disrupting X clients. The corresponding X server architecture includes a static, protocol router part which acts as an endpoint for client connections and which routes X protocol to one or more X server displays, and a dynamic X display part which maintains the state and contents of the display. An X display may maintain its state and display contents entirely in memory without any need for physical display or input devices, in which case it is termed a “headless X display” and provides a virtual X server display that appears to the host as if it were a user-interactive display. The architecture allows for any number of X displays to be attached to the protocol router for multi-user, fault tolerant or suspend/resume functionality.

Abstract: An applet is used to deliver a persistent caching mechanism. An initial package of the applet incorporates a lightweight caching mechanism into its root set of classes. The remainder of the applet are divided into functional modules that can be subsequently downloaded as needed. The initial applet and caching mechanism is packaged and signed in a package using tools and procedures native to each platform; and each functional module is packaged and signed in a generic, platform-independent fashion for verification and loading by any of the various platform-dependent initial applet packages. In this way, the same functional module portions of the applet (which may comprise the bulk of the applet) are cached and loaded in a platform-independent manner without requiring or relying on any caching mechanism built into a platform such as a web browser or other applet execution environment.

Abstract: Private, personal, secret, or otherwise sensitive data is masked or redacted in response to receiving an event signal indicative of an occurrence, if any, of at least one of a number of defined events associated with the set of data. The data to mask is detected by matching it to one or more defined patterns and then validating it, in the case of the data being a financial account or credit card account number, by using a validation process, such as the Luhn algorithm. Among others, the defined event may be a transmission of the data between a host computer system and a terminal emulator, an entry of the data into a host screen, or an export of a set of host screen data to an external application by an end user computer system.

Abstract: A management server acts as a repository for a plurality of user certificates corresponding to a plurality of users. When a user wishes to access a remote computer such as a secure-enabled host requiring a secure credential, his/her computer sends a request message to the management server. The management server may perform its own validity checking. In response to a request and conditioned on the management server authorizing access to a computing resource that requires an authorization credential, the management server delivers the requested credential and executable code, the authorization credential comprising information that enables access to the computing resource and the delivered executable code manages the lifecycle of the delivered authorization credential by allowing only temporary storage without caching of the delivered authorization credential.

Abstract: A system and method for a symbiotic computer application and system and method for generation and presentation of same. The symbiotic computer application allows end-user devices to access back-end data systems including legacy host data systems having legacy host applications and other alternative data systems not directly compatible with the end-user devices. In some embodiments, the symbiotic computer application is generated by a symbiotic computer application generator to include user interface forms and discrete associations, which relate the user interface forms to the back-end data systems. A symbiotic computer application presentation end-user system allows the end-user device to perform desired functions of the back-end data systems through programs and user interfaces configured for the end-user device.

Abstract: A management server manufactures a secure, tamper-resistant token for a particular user specifying the permissions and authorizations that user possesses. The token may be in the form of a digitally-signed message specifying, for example, a particular computer and associated port number that the user is permitted to access. The management server delivers the token to the user, preferably over a secure communications session. When challenged, the user presents the secure token to the security proxy server. The security proxy server examines the token to be sure it is authentic and has not be tampered with, and then extracts information contained in the token to determine the user's authorization to access a particular computer, particular port number and/or other resource.

Abstract: Lightweight LDAP Access Control for authorization and personalization integrates with a directory service for defining sessions for users and groups without requiring read access or modification to directory schemas. In one exemplary illustrative non-limiting implementation, authorization/personalization data is stored in a private data store outside of the LDAP directory (e.g., on a management or other server). When a user attempts to log on to the computer system, the LDAP directory is queried for a list of associated groups and/or organizational units in the normal way. To compute a resulting set of authorization/personalization rules applicable to the user, an entity (.e.g., the management or other server) traverses the organizational hierarchy of the directory groups/OU's, overriding the inherited attributes with explicitly associated ones. Integration with existing user/group/organization unit infrastructures is provided while avoiding the need to deploy additional user/group databases.

Abstract: Host systems can be accessed via industry standard query languages such as SQL by encapsulating the structure of the host application and allowing data to be retrieved or changed without knowledge of how the host application functions. Encapsulation and ability to use a standard database interface dramatically reduces the size, complexity and cost of developing clients.

Abstract: A computer implemented internal area access communication system is used for communication between internal applications originating internal communication and running in an internal transaction area on a host computer and external applications originating external communication and running outside of the internal transaction area. Included are an external communication module to convert external communication having formats noncompliant with the internal transaction area, a virtual host terminal to run on the host computer and to execute virtual terminal functions associated with language of the external communication that is noncompliant with the internal transaction area and associated with language compliant with the internal transaction area. Also included is an access state controller to route the external and the internal communication based upon the tracked state information for the internal applications.

Abstract: A computer implemented system controls transaction access of requester applications running on end-user computers having network protocol addresses, to internal applications and their associated transactions running in internal transaction areas of host computer systems. Related to each network protocol address, a requester database contains information related to each network protocol address including end-user identification, possible username and password and instructions, possible priority levels of select transactions, and authorized transactions. A listener listens for a connect request from one of the end-user computers. A validator, using the requester database, determines whether the end-user computer has a valid network protocol address.

Abstract: A system and method for secure duplex browser communication over disparate networks provides duplex communication between applications such as a browser program running on a client computer system and server applications running on a server computer system. Standard web-based protocols used with the duplex communication allow use of built-in browser program features such as related to security and navigation that would otherwise be specially provided. Given the request-response nature of many of the standard web-based protocols, use of standard web-based protocols for duplex communication has not been readily attainable in the past. A duplex transport system to provide the duplex communication includes a client component running on the client computer system and a server component running on the server computer system. The browser program controls one or more browser applications configured to run on the client computer system.

Abstract: A system and method for applet management utilizes a dubuild utility to form a core distribution unit and component split distribution units to separately package various features of an application to be downloaded on an as requested basis to a browser running on a client computer from a server computer. To start the application the core distribution unit embedded in a core Hypertext Markup Language (HTML) page is first downloaded from the server computer to the client computer and cached in a designated area of storage on the client computer according to HTML tags. The core distribution unit includes core user features, a background frame, and a component manager. The core user features include a menu supported by the background frame to provide selection of additional features provided by the component split distribution units.

Abstract: A method and system are provided for positioning characters within an arbitrarily sized graphics window in order to maximize the distribution of unused space. The method and system are particularly adapted for the redistribution of characters produced during a terminal emulation session with another computing system. Characters produced during the emulated session are adjusted to completely fill the graphics window, regardless of its size. A fill justification procedure distributes characters in areas within the graphics window that would otherwise appear as gutters or margins. A character spacing unit maintains correct character image proportions in the graphics window while not rigidly adhering to a uniform alignment of character rows and columns. A linear distribution procedure allows the character image to fill the graphics window completely with a natural appearance.

Abstract: A system and method for screen connector design, configuration, and runtime access. Embodiments modify a rudimentary host application screen recording prior to runtime to better identify host screens of a host application during runtime use. Embodiments of a screen connector runtime engine allow communication and access to a host application. Embodiments screen connector recordings are designed by embodiments of a screen connector designer, which allows for customization of the rudimentary application screen recordings based upon user input. Issues are addressed related to navigation between and identification of tables. Embodiments for screen task design allow for authoring of executable tasks.

Abstract: A Session Allocation Manager (“SAM”) manages multiple client connections to a limited number of host terminal sessions. The SAM also minimizes the latency involved in creating and terminating a host session. The SAM may reside on a server in the communication path between the client and the host session. Host data objects may use the SAM to associate a client connection to a host session. The SAM monitors the session activity and enforces inactivity timeouts. The SAM also attempts to reestablish a host session when it fails. In an environment having only a limited number of available terminal sessions, the SAM may control the session by creating a session window. A connection mechanism directed by the client may then request a session window from the SAM. If multiple clients ask for the same connection mechanism, the SAM may dedicate a particular session window to a particular type of connection mechanism.

Abstract: An improved method and system for initializing the logical units (LUs) in a Gateway between an SNA network having a mainframe host computer and another network. An activation procedure derives the Table of Boundary LUs on the mainframe host computer by noting the device logical unit numbers within the set of ‘Activate Logical Unit’ (ACTLU) SNA Request Units. If the mainframe host computer includes an LU in its Table of Boundary LUs, then the activation procedure creates a corresponding LU in the Gateway. The activation procedure also marks each of the created LUs in the Gateway as active. The newly created LUs are then added to the resource pool of LUs available to the network. Additional aspects include a method for assigning a logical unit type to an LU based upon whether a Bind request is received from the mainframe host computer within a certain amount of time after sending a positive sense code to the mainframe host computer.

Abstract: A method and system are provided for positioning characters within an arbitrarily sized graphics window in order to maximize the distribution of unused space. The method and system are particularly adapted for the redistribution of characters produced during a terminal emulation session with another computing system. Characters produced during the emulated session are adjusted to completely fill the graphics window, regardless of its size. A fill justification procedure distributes characters in areas within the graphics window that would otherwise appear as gutters or margins. A character spacing unit maintains correct character image proportions in the graphics window while not rigidly adhering to a uniform alignment of character rows and columns. A linear distribution procedure allows the character image to fill the graphics window completely with a natural appearance.

Abstract: An improved method and system for initializing the logical units (LUs) in a Gateway between an SNA network having a mainframe host computer and another network. An activation procedure derives the Table of Boundary LUs on the mainframe host computer by noting the device logical unit numbers within the set of ‘Activate Logical Unit’ (ACTLU) SNA Request Units. If the mainframe host computer includes an LU in its Table of Boundary LUs, then the activation procedure creates a corresponding LU in the Gateway. The activation procedure also marks each of the created LUs in the Gateway as active. The newly created LUs are then added to the resource pool of LUs available to the network. Additional aspects include a method for assigning a logical unit type to an LU based upon whether a Bind request is received from the mainframe host computer within a certain amount of time after sending a positive sense code to the mainframe host computer.

Abstract: An improved method and system for initializing the logical units (LUs) in a Gateway between an SNA network having a mainframe host computer and another network. An activation procedure derives the Table of Boundary LUs on the mainframe host computer by noting the device logical unit numbers within the set of ‘Activate Logical Unit’ (ACTLU) SNA Request Units. If the mainframe host computer includes an LU in its Table of Boundary LUs, then the activation procedure creates a corresponding LU in the Gateway. The activation procedure also marks each of the created LUs in the Gateway as active. The newly created LUs are then added to the resource pool of LUs available to the network.