Abstract: Approaches for securely authenticating untrusted operating environments. A software module intercepts a message which requires a first operating environment to authenticate itself to a service or resource provider. The software module executes outside of the first operating environment. The first operating environment lacks access to an authentication mechanism necessary to successfully authenticate to the service or resource provider. The software module notifies a second operating environment of the message. The second operating environment determines that the first operating environment should be permitted to authenticate to the service or resource provider. The second operating environment obtains authentication data generated using the authentication mechanism. The second operating environment provides the authentication data to the first operating environment to allow the first operating environment to authenticate itself to the service or resource provider.

Abstract: The methods and systems described herein provide for securing sensitive information using a hypervisor-trusted client, in a computing device executing a hypervisor hosting a control virtual machine and a non-trusted virtual machine. A user of a non-trusted virtual machine requests to establish a connection to a remote computing device. Responsive to the request, a control virtual machine launches a client agent. A graphics manager executed by the processor of the computing device assigns a secure section of a memory of a graphics processing unit of the computing device to the client agent. The graphics manager renders graphical data generated by the client agent to the secure section of the graphics processing unit memory.

Abstract: Approaches for processing network requests based upon the perceived trustworthiness of the network. A software component renders a judgment, based on a policy that weighs one or more factors, about whether a network accessible to a device should be trusted. If the software component renders a judgment that the network should be trusted, then a network resource identified on a white list of trusted resources is allowed to be retrieved within a host operating system or in a first virtual machine. Conversely, if the software component renders a judgment that the network should not be trusted, then the network resource identified on the white list of trusted resources is prevented from be retrieved within the host operating system or the first virtual machine, and may instead be retrieved within a second virtual machine, which has a more restrictive set of access privileges than the first virtual machine.

Abstract: Methods and systems for establishing a cloud bridge between two virtual storage resources and for transmitting data from one first virtual storage resource to the other virtual storage resource. The system can include a first virtual storage resource or cloud, and a storage delivery management service that executes on a computer and within the first virtual storage resource. The storage delivery management service can receive user credentials of a user that identify a storage adapter. Upon receiving the user credentials, the storage delivery management service can invoke the storage adapter which executes an interface that identifies a second virtual storage resource and includes an interface translation file.

Abstract: Methods and systems for establishing a cloud bridge between two virtual storage resources and for transmitting data from one first virtual storage resource to the other virtual storage resource. The system can include a first virtual storage resource or cloud, and a storage delivery management service that executes on a computer and within the first virtual storage resource. The storage delivery management service can receive user credentials of a user that identify a storage adapter. Upon receiving the user credentials, the storage delivery management service can invoke the storage adapter which executes an interface that identifies a second virtual storage resource and includes an interface translation file.

Abstract: A method for facilitating distributed authentication includes the step of requesting, by a user of a client machine residing in a first domain, access to a resource residing in a second domain. The client machine authenticates the user to an intermediate machine. The intermediate machine impersonates the client machine. The intermediate machine impersonating the client machine requests access to the second domain from a domain controller residing in the second domain. The domain controller authorizes the requested access, responsive to a determination that the impersonated client machine is trusted for delegation. The domain controller transmits to an application server residing in the second domain, authentication data associated with the impersonated client machine. The application server transmits, to the intermediate machine, a launch ticket uniquely identifying a logon token. The client machine provides, to the application server, the launch ticket to access the resource residing in the second domain.

Abstract: Methods and systems for establishing a cloud bridge between two virtual storage resources and for transmitting data from one first virtual storage resource to the other virtual storage resource. The system can include a first virtual storage resource or cloud, and a storage delivery management service that executes on a computer and within the first virtual storage resource. The storage delivery management service can receive user credentials of a user that identify a storage adapter. Upon receiving the user credentials, the storage delivery management service can invoke the storage adapter which executes an interface that identifies a second virtual storage resource and includes an interface translation file.

Abstract: A method for facilitating distributed authentication includes the step of requesting, by a user of a client machine residing in a first domain, access to a resource residing in a second domain. The client machine authenticates the user to an intermediate machine. The intermediate machine impersonates the client machine. The intermediate machine impersonating the client machine requests access to the second domain from a domain controller residing in the second domain. The domain controller authorizes the requested access, responsive to a determination that the impersonated client machine is trusted for delegation. The domain controller transmits to an application server residing in the second domain, authentication data associated with the impersonated client machine. The application server transmits, to the intermediate machine, a launch ticket uniquely identifying a logon token. The client machine provides, to the application server, the launch ticket to access the resource residing in the second domain.

Abstract: The invention relates to a method and apparatus for regenerating portions of the page that have changed and transmitting only those portions to the client for display. Executing only the necessary parts of the page generation code and transmitting only changes to the client improves the efficiency of using the resources of the network communication channel, the client node and the server node. Performing these operations only when required, when the data has changed, improves the efficiency of use even further. The invention also takes advantage of any portions of the page that are already on the client by reusing them and thus eliminates the need to regenerate or transmit those reusable portions. In one aspect, the invention relates to a method for incorporating a partial page into a transmitted page displayed on a client.

Abstract: A method for facilitating distributed authentication includes the step of requesting, by a user of a client machine residing in a first domain, access to a resource residing in a second domain. The client machine authenticates the user to an intermediate machine. The intermediate machine impersonates the client machine. The intermediate machine impersonating the client machine requests access to the second domain from a domain controller residing in the second domain. The domain controller authorizes the requested access, responsive to a determination that the impersonated client machine is trusted for delegation. The domain controller transmits to an application server residing in the second domain, authentication data associated with the impersonated client machine. The application server transmits, to the intermediate machine, a launch ticket uniquely identifying a logon token. The client machine provides, to the application server, the launch ticket to access the resource residing in the second domain.

Abstract: The methods and systems described herein provide for securing sensitive information using a hypervisor-trusted client, in a computing device executing a hypervisor hosting a control virtual machine and a non-trusted virtual machine. A user of a non-trusted virtual machine requests to establish a connection to a remote computing device. Responsive to the request, a control virtual machine launches a client agent. A graphics manager executed by the processor of the computing device assigns a secure section of a memory of a graphics processing unit of the computing device to the client agent. The graphics manager renders graphical data generated by the client agent to the secure section of the graphics processing unit memory.

Abstract: Methods and systems for establishing a cloud bridge between two virtual storage resources and for transmitting data from one first virtual storage resource to the other virtual storage resource. The system can include a first virtual storage resource or cloud, and a storage delivery management service that executes on a computer and within the first virtual storage resource. The storage delivery management service can receive user credentials of a user that identify a storage adapter. Upon receiving the user credentials, the storage delivery management service can invoke the storage adapter which executes an interface that identifies a second virtual storage resource and includes an interface translation file.

Abstract: The invention relates to a method and apparatus for regenerating portions of the page that have changed and transmitting only those portions to the client for display. Executing only the necessary parts of the page generation code and transmitting only changes to the client improves the efficiency of using the resources of the network communication channel, the client node and the server node. Performing these operations only when required, when the data has changed, improves the efficiency of use even further. The invention also takes advantage of any portions of the page that are already on the client by reusing them and thus eliminates the need to regenerate or transmit those reusable portions. In one aspect, the invention relates to a method for incorporating a partial page into a transmitted page displayed on a client.

Abstract: The invention relates to a method and apparatus for regenerating portions of the page that have changed and transmitting only those portions to the client for display. Executing only the necessary parts of the page generation code and transmitting only changes to the client improves the efficiency of using the resources of the network communication channel, the client node and the server node. Performing these operations only when required, when the data has changed, improves the efficiency of use even further. The invention also takes advantage of any portions of the page that are already on the client by reusing them and thus eliminates the need to regenerate or transmit those reusable portions. In one aspect, the invention relates to a method for incorporating a partial page into a transmitted page displayed on a client.

Abstract: A method for facilitating distributed authentication includes the step of requesting, by a user of a client machine residing in a first domain, access to a resource residing in a second domain. The client machine authenticates the user to an intermediate machine. The intermediate machine impersonates the client machine. The intermediate machine impersonating the client machine requests access to the second domain from a domain controller residing in the second domain. The domain controller authorizes the requested access, responsive to a determination that the impersonated client machine is trusted for delegation. The domain controller transmits to an application server residing in the second domain, authentication data associated with the impersonated client machine. The application server transmits, to the intermediate machine, a launch ticket uniquely identifying a logon token. The client machine provides, to the application server, the launch ticket to access the resource residing in the second domain.

Abstract: The invention relates to a method and apparatus for regenerating portions of the page that have changed and transmitting only those portions to the client for display. In one aspect, the invention relates to a method for partial page regeneration of a transmitted page by a server. The method includes receiving page generation code that generates a page, transmitting the page to a client for display, associating a portion of the transmitted page with a fragment of the page generation code, and executing the associated fragment of the code to regenerate the portion of the transmitted page. In one embodiment, the method includes transmitting the regenerated page portion to the client for incorporation into the transmitted page.

Abstract: A system and method for synchronizing a user interface element displayed on a client and a software application component executing on a web server are described. The synchronizing of a user interface element and a software application component includes representing a user interface element as a user interface element component having a characteristic and providing a wiring descriptor relating the characteristic of the user interface element component with a characteristic of a software application component. The wiring descriptor associates the user interface element component with the software application component and synchronizes the characteristic of the user interface element component with the characteristic of the software application component.