Abstract: A method for quarantining a node from other nodes in a network is described. A node is scanned to obtain a health posture of the node by determining if the node is compliant with one or more requirements. A current policy in accordance with the obtained health posture of the node is obtained. A previous policy is removed. If the node is determined to be non-compliant, a key that is unique to the non-compliant node is selected. The current policy is applied.

Abstract: A method for managing a computer over a network is disclosed. The method may be implemented by a resident agent on the network. A connection between the resident agent and a sending application may be opened. Application data may be received from the sending application by the resident agent. A header may be received from the sending application by the resident agent. Whether a data package should be sent directly to a receiving application or whether the data package should be sent through a gateway may be determined. If it is determined that the data package should be sent directly to a receiving application, the data package may be sent directly to the receiving application. If it is determined that the data package should be sent through the gateway, the data package may be sent through the gateway.

Abstract: An exemplary method involves receiving a request to process a file comprising computer instructions. The file may be a script, a source code file, a binary file, etc. The method also involves identifying a digital signature embedded in comments within the file. The method also involves attempting to validate the digital signature. If the digital signature is validated, the file is processed. If the digital signature is not validated, the file is not processed. The file may include multiple digital signatures. When this occurs, the file may be processed only if all of the multiple digital signatures are validated. Alternatively, the file may be processed if any of the multiple digital signatures are validated.

Abstract: A method for discovering agents operative on devices configured in a network by broadcasting discovery messages having a common format and containing data to the network devices and receiving reply messages having the same common format and containing data from the agents, and permitting new types of data within the messages without changing the common format.

Abstract: A client/server authentication system is disclosed. The system includes a filter, a plug-in, and an extension. The filter monitors sessions between a client and a server for proper authentication. The plug-in is coupled to the client and the server. The plug-in generates public and private key pairs, and receives and stores certificates. The extension is coupled to the filter. The extension generates script commands to cause the client and the server to perform required steps indicated by the filter.

Abstract: A client/server authentication system is disclosed. The system includes a filter, a plug-in, and an extension. The filter monitors sessions between a client and a server for proper authentication. The plug-in is coupled to the client and the server. The plug-in generates public and private key pairs, and receives and stores certificates. The extension is coupled to the filter. The extension generates script commands to cause the client and the server to perform required steps indicated by the filter.

Abstract: Embodiments of application based bandwidth limiting proxy servers are described.

Abstract: In one embodiment, methods and apparatus for an operator of a console to authenticate to a system of heterogeneous computers by logging in only once to a representative computer or “core”. After logging in, the operator acquires a session certificate (e.g., an X.509-based certificate), allowing the operator to prove identity and group membership information to other nodes on a network. The core, before signing session certificates, embeds data in an extended data area of the certificates. The extended data includes the operator's username and groups to which the operator belongs, and possibly other information such operator context (or domain). The username, group membership, and other extended data is based on the namespace of the core computer, and other devices on the network need not belong to that namespace or even use the same network operating system.

Abstract: A real time blocking hook enables foolproof monitoring of various global functions such as file open. In this way, a scanning functionality may be implemented which prevents execution of the file before scanning is complete. The address of the open routines may be obtained using a DLL. Advantageously, an intertask send message is utilized to communicate between the DLL, the client and the monitoring function since the ability of other functions to bypass the intertask send message is substantially eliminated.

Abstract: A method of detecting a proxy server includes storing a first copy of a connection table from an Internet Web browser and initiating a request for a Uniform Resource Locator through the Web browser. The method further includes storing a second copy of the connection table from the Internet Web browser while a connection is open and comparing the first copy and the second copy of the connection table.

Abstract: A method of remotely controlling a computer includes receiving connection requests from a viewer computer and an agent computer, and adding the identities of the viewer computer and agent computer connections to a connection table. The viewer computer requests the agent computer connection in order to control the agent computer. The method further includes establishing a communication channel between the viewer computer and the agent computer.

Abstract: Local application proxy (LAP) arrangements.

Abstract: A method for discovering agents operative on devices configured in a network by broadcasting discovery messages having a common format and containing data to the network devices and receiving reply messages having the same common format and containing data from the agents, and permitting new types of data within the messages without changing the common format.

Abstract: Embodiments of application based bandwidth limiting proxy servers are described.

Abstract: A network management service for facilitating the management of networked devices by network management applications (a.k.a., agents) is described. In a first embodiment, the network management service for facilitating the management of networked devices by network management applications (a.k.a., agents) comprises an agent discovery service for discovering and registering remote management agents, and a file transfer service operative to send information to and receive information from remote systems.