Abstract: A method for reducing the risk of unexpected or unintended actions during a Remote Desktop Protocol (RDP) or SSH (Secure Shell) session by automatically detecting anomalies using vaulted credentials. The method includes initiating a RDP/SSH session on a server and taking screenshots of the session. The screenshots are sent to a system that uses a computer vision algorithm to transcribe the screen information into a text-based transcription of the session. The text-based transcription of the session recording is then provided to a pre-trained LLM which is prompted to look for anomalies using in-context learning. The detected anomalies are presented to a system administrator or sent as alerts to the system administrator.

Abstract: A method for improving the testability of any system using a GPT model to generate text or other content. The method operates by receiving user requests from the GPT model and a test GPT model and generating answers to the user requests from the GPT model and the test GPT model. After the answers are generated, comparing the generated answers using a GPT model to perform such comparing, then generating metadata from the comparing. Using the generated metadata, score the GPT model and the test GPT model. Then repeat the receiving, generation, comparing and scoring a number of times using different user requests. After repeating the number of times, determine whether the score of the test GPT model is higher than the score of the GPT model. If the test GPT model has a higher score than the GPT model, replace the GPT model with the test GPT model.

Abstract: A system and method for providing secure access to an organization's internal resources by an application running on an external network. An agent accepts queries from the application which are passed to a relay with a dynamic filter. The relay establishes a secure connection with a connector through the organization's firewall and passes requests from the application to an authentication service running on the internal network to confirm that a user of the application is authorized and issue an authentication ticket which is returned to the application. The application then sends a request to access a specific internal resource based on the authentication ticket, which is passed to a ticket granting service running on the internal network, to verify that said user is authorized to access the specific internal resource, and, if so, issue a service ticket to grant access the application for that resource.

Abstract: A system and method for providing secure access to an organization's internal resources by an application running on an external network. An agent accepts queries from the application which are passed to a relay with a dynamic filter. The relay establishes a secure connection with a connector through the organization's firewall and passes requests from the application to an authentication service running on the internal network to confirm that a user of the application is authorized and issue an authentication ticket which is returned to the application. The application then sends a request to access a specific internal resource based on the authentication ticket, which is passed to a ticket granting service running on the internal network, to verify that said user is authorized to access the specific internal resource, and, if so, issue a service ticket to grant access the application for that resource.

Abstract: A system and method for providing secure access to an organization's internal resources by an application running on an external network. An agent accepts queries from the application which are passed to a relay with a dynamic filter. The relay establishes a secure connection with a connector through the organization's firewall and passes requests from the application to an authentication service running on the internal network to confirm that a user of the application is authorized and issue an authentication ticket which is returned to the application. The application then sends a request to access a specific internal resource based on the authentication ticket, which is passed to a ticket granting service running on the internal network, to verify that said user is authorized to access the specific internal resource, and, if so, issue a service ticket to grant access the application for that resource.

Abstract: The invention relates to a method of replacing a processing engine in which a first processing engine (25) is replaced with a second processing engine (28) if the first output (26) of the first processing engine (25) and the second output (29) of the second processing engine (28) are determined to be sufficiently similar. The second processing engine (28) is nm in a simulation mode. The first processing engine (25) is run in a production mode or in a simulation mode. Both processing engines use the same data set (21) as input.

Abstract: The invention relates to a method of opening a data object, e.g. a web page, that involves detecting an instruction to open the data object, e.g. by using network packet inspection, determining a unique identifier of the data object, looking up a recommended application, e.g. a certain web browser, for the data object in a mapping (21) from data object identifier (23) to application identifier (25), and opening the data object with the recommended application.

Abstract: In a computer implemented method or system, users are enabled to associate usage rights with at least a first entity and a second entity. The first entity and second entity are selected from different ones of the module, a processing circuitry and the one or more files. Execution of the module is only enabled when the associated usage rights allow both use of the first entity by the second entity and use of the second entity by the first entity, i.e. mutual usage rights for at least two entities exist. Execution of the module is disabled when the associated usage rights prevent at least one of use of the first entity by the second entity and use of the second entity by the first entity.

Abstract: A method for providing rules for a plurality of processes from a user mode to a kernel mode of a computer is disclosed. The method includes providing to the kernel mode a policy for at least a first process of the plurality of processes, the policy indicating at least when and/or how notifications are to be provided from the kernel mode to the user mode upon detection in the kernel mode of launching of the first process. The method further includes selecting, from the rules stored in the user mode, rules related to the launching of the first process, in response to receiving from the kernel mode a first notification in accordance with the policy, and providing the selected rules related to the launching of the first process from the user mode to at least one of the one or more filter drivers in the kernel mode.

Abstract: In a computing environment comprising multiple desktop windows displayed to a user of a client computer, a method to manage client application windows associated with applications configured to run on the client computer is provided. The method includes detecting user input regarding movement of a client application window from a client desktop window to a remote desktop window, removing a task bar icon associated with the client application window from a task bar displayed in the client desktop window, instructing the remote computer to generate a drone of the client application window in the remote desktop window and to display the task bar icon associated with the client application window in a task bar of the remote desktop window, and displaying the client application window always on top of all other windows. The method may further include applying appropriate clipping region to the client application window.

Abstract: In a computer implemented method or system, users are enabled to associate usage rights with at least a first entity and a second entity. The first entity and second entity are selected from different ones of the module, a processing circuitry and the one or more files. Execution of the module is only enabled when the associated usage rights allow both use of the first entity by the second entity and use of the second entity by the first entity, i.e. mutual usage rights for at least two entities exist. Execution of the module is disabled when the associated usage rights prevent at least one of use of the first entity by the second entity and use of the second entity by the first entity.

Abstract: The invention relates to a system and method of tracking and communicating computing states of a first computer device for registering said computing states by a second computer device. The first computer device is connected to the second computer device and configured for assuming a plurality of successive computing states. Jobs are assigned to a different set of jobs each time a state transition has been detected. New sets are defined only when a state transition has been detected and typically not when a snapshot is made resulting in saving storage space.

Abstract: A method for providing rules for a plurality of processes from a user mode to a kernel mode of a computer is disclosed. The method includes providing to the kernel mode a policy for at least a first process of the plurality of processes, the policy indicating at least when and/or how notifications are to be provided from the kernel mode to the user mode upon detection in the kernel mode of launching of the first process. The method further includes selecting, from the rules stored in the user mode, rules related to the launching of the first process, in response to receiving from the kernel mode a first notification in accordance with the policy, and providing the selected rules related to the launching of the first process from the user mode to at least one of the one or more filter drivers in the kernel mode.

Abstract: In a computing environment comprising multiple desktop windows displayed to a user of a client computer, a method to manage client application windows associated with applications configured to run on the client computer is provided. The method includes detecting user input regarding movement of a client application window from a client desktop window to a remote desktop window, removing a task bar icon associated with the client application window from a task bar displayed in the client desktop window, instructing the remote computer to generate a drone of the client application window in the remote desktop window and to display the task bar icon associated with the client application window in a task bar of the remote desktop window, and displaying the client application window always on top of all other windows. The method may further include applying appropriate clipping region to the client application window.

Abstract: In a networked computing environment, a method for providing, by a server, access to graphical data associated with at least an application configured to run on a client computer includes receiving, at the server, information on a first icon associated with the application configured to run on the client computer and providing, by the server, to the client computer, a screen displaying a plurality of icons, the plurality of icons including at least the first icon and a second icon associated with an application configured to run on the server.

Abstract: The invention relates to a system and method of tracking and communicating computing states of a first computer device for registering said computing states by a second computer device. The first computer device is connected to the second computer device and configured for assuming a plurality of successive computing states. Jobs are assigned to a different set of jobs each time a state transition has been detected. New sets are defined only when a state transition has been detected and typically not when a snapshot is made resulting in saving storage space.

Abstract: The invention relates to a method and system for determining one or more valid entitlements for one or more persons or roles to one or more resources of an organization. Person classification data, role classification data, role constraint data and/or entitlement constraint data are supplied to an inference engine that provides an inference result set defining valid entitlements of a person or role to one or more resources.

Abstract: A server-based computing system includes at least one server (1) and at least one client computer (5), connected to the server (1) through a network (2). The server (1) includes apparatus for providing the client computer (5) with a user interface. The client computer (5) includes an input device (8) for providing input to an application through the user interface and a display device (7) for presenting output from an application through the user interface. The server (1) includes apparatus for running the application and the client computer (5) includes apparatus for locally running at least one further application. The system includes apparatus for controlling the locally run applications through the user interface provided by the server (1).

Abstract: The invention relates to a method of providing access to one or more resources accessible via a remote computer. The resources are assigned to a remote security context. Access to at least one of said remote resources within the remote security context is controlled by access rules that are valid for said at least one of said remote resources, on receipt of a terminal services request for a terminal session from a local computer. A user of said local computer has already been authenticated in a local security context by local authentication information. The local computer runs a local agent and contains identification information in addition to the local authentication information.

Abstract: A method for setting priority levels in a multiprogramming computer system (1) with priority scheduling, in which threads (15, 16, 17) of execution of each process (13, 14) have a standard priority level, comprises measuring relative use of one or more processors (2) in the system (1) by the threads (15, 16, 17) of execution of a process (13, 14). The priority levels of one or more threads (15, 16, 17) of execution are lowered if their measured relative use exceeds a certain escalation threshold for the duration of an escalation time period (DT1).