Abstract: An applet is used to deliver a persistent caching mechanism. An initial package of the applet incorporates a lightweight caching mechanism into its root set of classes. The remainder of the applet are divided into functional modules that can be subsequently downloaded as needed. The initial applet and caching mechanism is packaged and signed in a package using tools and procedures native to each platform; and each functional module is packaged and signed in a generic, platform-independent fashion for verification and loading by any of the various platform-dependent initial applet packages. In this way, the same functional module portions of the applet (which may comprise the bulk of the applet) are cached and loaded in a platform-independent manner without requiring or relying on any caching mechanism built into a platform such as a web browser or other applet execution environment.

Abstract: An applet is used to deliver a persistent caching mechanism. An initial package of the applet incorporates a lightweight caching mechanism into its root set of classes. The remainder of the applet are divided into functional modules that can be subsequently downloaded as needed. The initial applet and caching mechanism is packaged and signed in a package using tools and procedures native to each platform; and each functional module is packaged and signed in a generic, platform-independent fashion for verification and loading by any of the various platform-dependent initial applet packages. In this way, the same functional module portions of the applet (which may comprise the bulk of the applet) are cached and loaded in a platform-independent manner without requiring or relying on any caching mechanism built into a platform such as a web browser or other applet execution environment.

Abstract: A connection is established between a server and a web browser having access to a first, trusted public key. The server downloads a digitally signed archive to the browser, the archive including a second public key. The browser verifies the digitally signed archive using the first public key, and stores the second public key in response to the verification. The browser then uses the stored second public key to authenticate the server and establish a secure connection with the server. The second public key and its chain of trust need not be known by the browser beforehand, and the archive may include program fragments that store the key in an area where the browser (or an applet running under the browser) can access and use it. The archive may also include a program fragment that performs certificate validation for the client—enabling the client to handle certificate types it does not know about.

Abstract: The technology herein can be used to dynamically deploy secure credentials including but not limited to digital certificates in a secure manner to provide higher levels of security and control than in some other previous arrangements. In one exemplary non-limiting illustrative arrangement, a management server acts as a repository for a plurality of user certificates corresponding to a plurality of users. When a user wishes to access a remote computer such as a secure-enabled host requiring a secure credential, her computer sends a request message to the management server. The management server may perform its own validity checking (e.g., based on password protection, directory information including user authorization, or a variety of other techniques).

Abstract: Lightweight LDAP Access Control for authorization and personalization integrates with a directory service for defining sessions for users and groups without requiring read access or modification to directory schemas. In one exemplary illustrative non-limiting implementation, authorization/personalization data is stored in a private data store outside of the LDAP directory (e.g., on a management or other server). When a user attempts to log on to the computer system, the LDAP directory is queried for a list of associated groups and/or organizational units in the normal way. To compute a resulting set of authorization/personalization rules applicable to the user, an entity (e.g., the management or other server) traverses the organizational hierarchy of the directory groups/OU's, overriding the inherited attributes with explicitly associated ones. Integration with existing user/group/organization unit infrastructures is provided while avoiding the need to deploy additional user/group databases.

Abstract: A method and apparatus for controlling operation of remote networked devices, such as computers, in compliance with licensed restrictions is provided. In one embodiment, licenses are assigned to users in the order of application requests that are made. When a request is made and no licenses are available, an analysis is performed to determined whether licenses may be swapped in such a fashion so as to free up a license for the requested application. In another embodiment, whenever a new request is made, an analysis performed by considering the needs of users. Information needed to perform the analysis is stored in the database which is updated when a new program launch occurs.