Abstract: An application as a service provided in a secure environment. A sandbox in a user's computing environment may be created. An application may be downloaded to the user's computing environment to run within the sandbox. Data sources associated with the user's computing environment may be searched and connectivity established with data registry of the data sources based on data description received with the application. The application may be run within the sandbox using the established connectivity. Metering may be performed to monitor usage of the application at the user's computing environment.

Abstract: An application as a service provided in a secure environment. A sandbox in a user's computing environment may be created. An application may be downloaded to the user's computing environment to run within the sandbox. Data sources associated with the user's computing environment may be searched and connectivity established with data registry of the data sources based on data description received with the application. The application may be run within the sandbox using the established connectivity. Metering may be performed to monitor usage of the application at the user's computing environment.

Abstract: A method of automatic security parameter renewal including determining if a security parameter satisfies a renewal condition and automatically updating the security parameter when the renewal condition is satisfied.

Abstract: Enabling remote debugging of virtual machines, in one aspect, may comprise attaching a debug virtual machine to a target virtual machine deployed in a virtualized environment. Interactions and/or access to the target virtual machine may be performed via the attached debug virtual machine. The debug virtual machine may be created and attached to the target virtual machine in response to receiving a request to debug the target machine, for example, from a remote user of the target virtual machine.

Abstract: A system and method for managing dynamically allocated resources assigned to a service includes providing a service to be used by a plurality of sites in a federation. Usage information associated with the service is communicated to each of the plurality of sites. A disposition of the service is determined based on local policies and the usage information received from other sites by a service owner. The disposition of the service is updated across a plurality of sites in accordance with messages sent by the service owner to reduce resource usage.

Abstract: A method for automated provisioning of computing resources in a distributed computing network includes obtaining a data structure representing a resource dependency characterization of an application to be implemented over the distributed computing network, wherein the data structure indicates a set of resources to be deployed, obtaining a template that represents a predefined network topology for supporting deployment of the set of resources, mapping the set of resources represented in the data structure to the template so as to satisfy a set of component requirements to generate a deployment map, and provisioning the set of resources on a plurality of computers based on the deployment map to implement the application over the distributed computing network.

Abstract: Techniques for security-aware admission control of requests in a distributed system. A method includes identifying a request dropped by a first application component in a distributed system, determining one or more actions to take with respect to the dropped request, said determining comprises identifying one or more policies of the first application component responsible for the dropped request and identifying one or more additional application components in the distributed system to be affected based on the identified one or more policies, and executing said one or more actions to control admission of one or more requests associated with the dropped request at the one or more additional application components.

Abstract: Managing a service is provided. Information is collected about use of a set of resources by the service. A request is received to verify information regarding a selected portion of a period of time during the use of the set of resources by the service. In response to receiving the request to verify the information regarding the selected portion of the period of time during the use of the set of resources by the service, a description of the use of the set of resources by the service during the selected portion of the period of time is generated using the collected information. A response to the request is created using the generated description of the use of the set of resources by the service during the selected portion of the period of time as proof of validity of the information.

Abstract: A system and method for managing dynamically allocated resources assigned to a service includes providing a service to be used by a plurality of sites in a federation. Usage information associated with the service is communicated to each of the plurality of sites. A disposition of the service is determined based on local policies and the usage information received from other sites by a service owner. The disposition of the service is updated across a plurality of sites in accordance with messages sent by the service owner to reduce resource usage.

Abstract: Managing a service is provided. Information is collected about use of a set of resources by the service. A request is received to verify information regarding a selected portion of a period of time during the use of the set of resources by the service. A description of the use of the set of resources by the service during the selected portion of the period of time is generated using the collected information in response to receiving the request to verify the information regarding the selected portion of the period of time during the use of the set of resources by the service. A response to the request is created using the generated description of the use of the set of resources by the service during the selected portion of the period of time as proof of validity of the information.

Abstract: A method, apparatus, and computer program product for managing a service is disclosed. A computer system collects information about the use of a set of resources by the service. Responsive to receiving a request to verify information about the use of the set of resources by the service, the computer system generates a description of the use of the set of resources by the service using the information collected. The computer system then creates a response to the request using the generated description of the use of the set of resources by the service as proof of the validity of the information.

Abstract: A method, apparatus, and computer program product for managing a service is disclosed. A computer system collects information about the use of a set of resources by the service. Responsive to receiving a request to verify information about the use of the set of resources by the service, the computer system generates a description of the use of the set of resources by the service using the information collected. The computer system then creates a response to the request using the generated description of the use of the set of resources by the service as proof of the validity of the information.

Abstract: Systems and articles of manufacture for security-aware admission control of requests in a distributed system include identifying a request dropped by a first application component in a distributed system, determining one or more actions to take with respect to the dropped request, said determining comprises identifying one or more policies of the first application component responsible for the dropped request and identifying one or more additional application components in the distributed system to be affected based on the identified one or more policies, and executing said one or more actions to control admission of one or more requests associated with the dropped request at the one or more additional application components.

Abstract: A method of automatic security parameter renewal including determining if a security parameter satisfies a renewal condition and automatically updating the security parameter when the renewal condition is satisfied.

Abstract: Enabling remote debugging of virtual machines, in one aspect, may comprise attaching a debug virtual machine to a target virtual machine deployed in a virtualized environment. Interactions and/or access to the target virtual machine may be performed via the attached debug virtual machine. The debug virtual machine may be created and attached to the target virtual machine in response to receiving a request to debug the target machine, for example, from a remote user of the target virtual machine.

Abstract: Systems and methods for protection from buffer overflow vulnerability due to placement new constructs in C++ are provided. A system for protecting from buffer overflow vulnerability due to placement new constructs, comprises a compiler which is capable of receiving a program including a placement new instruction, and runtime which is capable of receiving binary code from the compiler and determining whether the program includes the placement new instruction and whether the placement new instruction would lead to buffer overflow, wherein the runtime is linked to a library including methods for preventing the buffer overflow, and selects a method for preventing the buffer overflow if the runtime determines that the placement new instruction would lead to the buffer overflow.

Abstract: Systems and methods for protection from buffer overflow vulnerability due to placement new constructs in C++ are provided. A system for protecting from buffer overflow vulnerability due to placement new constructs, comprises a compiler which is capable of receiving a program including a placement new instruction, and runtime which is capable of receiving binary code from the compiler and determining whether the program includes the placement new instruction and whether the placement new instruction would lead to buffer overflow, wherein the runtime is linked to a library including methods for preventing the buffer overflow, and selects a method for preventing the buffer overflow if the runtime determines that the placement new instruction would lead to the buffer overflow.

Abstract: Systems and methods for protection from buffer overflow vulnerability due to placement new constructs in C++ are provided. A system for protecting from buffer overflow vulnerability due to placement new constructs, comprises a compiler which is capable of receiving a program including a placement new instruction, and runtime which is capable of receiving binary code from the compiler and determining whether the program includes the placement new instruction and whether the placement new instruction would lead to buffer overflow, wherein the runtime is linked to a library including methods for preventing the buffer overflow, and selects a method for preventing the buffer overflow if the runtime determines that the placement new instruction would lead to the buffer overflow.

Abstract: An embodiment of the invention directed to a method for provisioning a specified virtual machine from one or more selected images, sent over the network, includes the step of decomposing each of the selected VM images to provide a group of components, each component having specified information associated with it. The method further includes using a predetermined selection criterion to select components from the group for assembly into a specified VM image, and using the selected components of the specified VM image to provision the specified virtual machine at one or more locations.

Abstract: A method for customizing virtual machines includes retrieving a virtual machine image file from a library of virtual machine image files. A target virtual machine image file is created by making a copy of the retrieved virtual machine image file. A file size of the target virtual machine image file is increased. A partition size of a primary partition of the target virtual machine image file is increases. The target virtual machine image file is booted after the partition size of the primary partition thereof has been increased.