Abstract: Implementations of the present invention relate in part to optimizations to peer-to-peer communication systems. For example, one implementation relates to use of a smart transceiver that creates, caches, and manages communication channels dynamically between peers. Another implementation relates to use of a central tracking object that can be used to efficiently register and distribute peer messages among the various peers. In one implementation, the central tracking object is shared amongst peers in the group. Still another implementation relates to associating peer groups with namespaces, and for including peer groups of one namespace within still other peer groups of different namespaces. These and other aspects of the invention can also be used to ensure delivery intent of a given peer message is preserved, and to ensure that optimal numbers of messages are communicated to any given peer at any given time.

Abstract: Methods and systems for providing a virtual network are disclosed. At least one layer of abstraction is created between network service applications and conventional network protocols by inserting an adaptive dispatcher between applications and network transport services on each machine in a network. The message protocol in the virtual network is extensible, allowing application programs to create new headers within any message as needed. The adaptive dispatcher contains handlers that route and dispatch messages within the virtual network based on arbitrary content within each message, including any combination of headers and/or data content. Each device on the virtual network has a virtual address to which messages are directed, allowing devices to move within the network without reconfiguring routing tables.

Abstract: A configuration management system creates (602) each configuration by assigning a configuration identifier to each configuration. In addition, relational information is computed (706) that indicates the relationships between the configuration and any configurations upon which it is based. The system then tracks (604) changes to files of the configuration by storing information associating each new file version with the configuration identifier. The system also tracks (1210) changes to file properties. A configuration is then reconstructed (608) as of a desired date, by identifying (2104, 2106) the file versions and properties associated with that configuration as of the desired date. A determination is made (2110) whether a user that has requested the file versions has access privileges by first checking a security cache (2600) for the user privileges information. If the information is not on the cache, it is computed from a security table (2800) and stored on the cache.

Abstract: Profile controls for profiling a distributed application are included in messages that are also used by the distributed application to transport data. A profile initiator causes profile controls to be inserted in the header portion of a message that is being transported across a distributed system. The profile initiator may insert profile controls directly or may cause a message router that receives the message to merge profile controls into the message. The message router may receive profile controls from the profile initiator or from computer-readable media that are maintained at the message router. The message, which now includes distributed application data and profile controls, is routed to a message recipient. The message recipient accesses the message to identify profile actions that are to be performed at the message recipient. The message recipient performs at least one of the identified profile actions.

Abstract: Methods, systems, and data structures for communicating object metadata are provided. A generic metadata container is presented that allows object metadata to be described in an extensible manner using protocol-neutral and platform-independent methodologies. A metadata scope refers to a dynamic universe of targets to which the included metadata statements correspond. Metadata properties provide a mechanism to describe the metadata itself, and metadata security can be used to ensure authentic metadata is sent and received. Mechanisms are also provided to allow refinement and replacement of metadata statements. Communication of metadata is expedited using hash digests to confirm metadata versions, and by piggybacking policy metadata requests and responses on other substantive data communication messages, thereby dynamically altering future communications.

Abstract: A network site often provides multiple offerings, each having their own context. The complete context for one of the offerings is stored. That complete context represents a root node in a hierarchical tree of context nodes, each node representing the context information for one or more of the offerings. Each node in the tree includes a reference to its parent node, and then a description of incremental changes to the context information as compared to the context information from the parent node. Accordingly, the context information for a particular node in the tree may be obtained by combining the complete context for the root node offering with incremental changes described in other nodes in the ancestral chain that leads from the particular offering to the root offering.

Abstract: Methods, systems, and data structures for communicating object metadata are provided. A generic metadata container is presented that allows object metadata to be described in an extensible manner using protocol-neutral and platform-independent methodologies. A metadata scope refers to a dynamic universe of targets to which the included metadata statements correspond. Metadata properties provide a mechanism to describe the metadata itself, and metadata security can be used to ensure authentic metadata is sent and received. Mechanisms are also provided to allow refinement and replacement of metadata statements. Communication of metadata is expedited using hash digests to confirm metadata versions, and by piggybacking policy metadata requests and responses on other substantive data communication messages, thereby dynamically altering future communications.

Abstract: A system and method for performing client-server transactions includes an application interface, located at a client, which manages connections between the client and a server. The application interface receives a request from an application program, opens a connection with the server, sends a message that includes the request over the connection, and holds the connection open for at least a timeout period. If the application interface receives another request destined for the server during the timeout period, it sends another message with the new request over the open connection. If the application interface receives one or more requests that are part of a transaction, the application interface assigns a transaction identifier to the transaction. The transaction identifier and a sequence indicator are included in each message with each request.

Abstract: A client issues a first electronic request to access a service at a server. The server receives the request and identifies a type of challenge form among a number of different types of challenges (e.g., represented by a number of different XML schemas). The server issues a challenge, in accordance with the identified type of challenge, to the client. The challenge can include state information that indicates to the server when an appropriate response to the challenge is received. The client receives the challenge and formulates a response (including the state information) to the challenge in accordance with the identified type of challenge. The client issues a second electronic request, which includes the formulated response. The server receives the response and determines, based on the response, if the second electronic request is to be processed.

Abstract: A method and system are provided for managing a security threat in a distributed system. A distributed element of the system detects and reports suspicious activity to a threat management agent. The threat management agent determines whether an attack is taking place and deploys a countermeasure to the attack when the attack is determined to be taking place. Another method and system are also provided for managing a security threat in a distributed system. A threat management agent reviews reported suspicious activity including suspicious activity reported from at least one distributed element of the system, determines, based on the reports, whether a pattern characteristic of an attack occurred, and predicts when a next attack is likely to occur. Deployment of a countermeasure to the predicted next attack is directed in a time window based on when the next attack is predicted to occur.

Abstract: Most search engines include user interfaces and query languages which are tailored for use with specific file types. Thus, a user interface for searching one type file can be quite different than an interface for searching another file type. Disparate user interfaces are troublesome since users must continually reorient themselves as they switch from interface to interface to initiate searches for different file types. Additionally, many of these user interfaces use different query languages and structures, which are not generally adaptive to new file types and query language features. Accordingly, the present inventors developed an adaptively configurable user interface to facilitate a common user experience across two or more databases and an extensible common query structure to allow expansion of a query language to meet the demands of new file types.

Abstract: In an integrated development environment, there is a tight coupling between a design surface providing a visual representation of the various physical and logical entities in a software model and the underlying code structures that support the entities. The model can include varying combinations of a component model, a high level design whiteboard, or a physical model. Every object defined within the design surface is capable of being mapped directly to an underlying code structure. The model is a graphical representation of the actual code, thus providing two way updating, i.e., the model is updated when the programmer changes the code and vice versa.

Abstract: A originating computing system sends an electronic message to a destination computing system via a routing path that includes one or more intermediary message processing computing systems. The originating computing system includes information in the electronic message that designates constraints related to resources or time use to delivery the message. For example, the constraints may include the number of hops, the amount of raw time, or the amount of processor time needed to delivery the message. If along the routing path, any of the intermediary computing systems detects that any of the constraints have been exceeded, then delivery of the electronic message may be abandoned. Any of the intermediary message processing computing systems may also specify constraints related to the resources or time used to delivery the electronic message.

Abstract: Sending potentially sensitive information with privacy expectations. A method may be practiced, for example, in a computing environment. The method includes sending potentially sensitive information. Privacy expectation information is also sent specifying how the potentially sensitive information should be protected. The information and privacy expectation information may be included in an issued token, such that the privacy expectations can be later conveyed in a token exchange.

Abstract: Shared Federation Metadata. A data structures may be implemented in a networked computing environment including federation. A federation includes two or more organizations coupled in a fashion such that authentication and authorization statements span the organizations in accordance with a pre-defined policy. A computer readable medium may include a data structure. The data structure includes fields including at least one or more grouping of metadata about a first federation or about an organization within the first federation. At least one of the one or more groupings of metadata about the first federation or about an organization within the first federation are included in the data structure by a reference to a block of federation metadata, the block of federation metadata is used for at least one other federation or organization.

Abstract: Obtaining tokens with alternate personally identifying information. A method may be practiced, for example, in a networked computing environment including a client and a token issuer. The token issuer provides security tokens to the client that the client can use for accessing functionality of services in the networked computing environment. The method includes sending a security token request to a token issuer. The security token request specifies alternate personally identifying information for an entity. The method further includes receiving a security token from the security token issuer. The security token includes the alternate personally identifying information.

Abstract: A message processor accesses an electronic message. The message processor identifies from within the electronic message any schema-based time markers including time related message data associated with the message processor. The message processor determines if a schema-based time marker within the electronic message should be modified. This can include signing a portion of time related message data to indicate to a subsequent message processor that the time related message data can be trusted. The message processor routes the message (either directly or through one or more intermediary message processors) to a destination message processor. The destination message process receives the message and processes the electronic message according to time related message data included in the message. This can include trusting the portion time related data that was singed by the message processor.

Abstract: Communicating and requesting specialized policy information. A message is sent by a client to a service which provides the services requested by the message or a specialized processor that evaluates messages. The message is evaluated for compliance with a policy particular to the message. If the message does not comply with a policy particular to the message, policy information is sent, where the policy information indicates the correct policy particular to the message. In one embodiment, if the message complies with a policy particular to the message, policy information is sent, where the policy information indicates that the message complies with a policy particular to the message.

Abstract: Multiple peer groups for performing computing, communication, and/or storage tasks. A method may be performed for example, in a computing environment including one or more agents networked together. The method includes providing data to the agents using two or more distinct peer groups. The peer groups include members from among the agents. The method further includes performing at each of the peer groups operations on the data. Each peer group is configured to perform a specific operation. The method also includes coordinating the operations at each of the peer groups such that a common computing, communication and/or storage task is accomplished by aggregating the operations at each of the peer groups.

Abstract: Providing reference tokens. A method includes receiving a request for a token. In response to the request for a token and in place of a token, one or more rich pointers are sent referencing one or more tokens. The rich pointers point to locations where one or more actual tokens can be retrieved. When only a single pointer is sent, the pointer is a reference other than an HTTP URL.