Abstract: Provided is a method, system, and program for managing access to resources. Encryption keys are exchanged among a first entity, second entity, third entity, and a fourth entity. Each entity has one relationship with one other entity and the encryption keys are exchanged pursuant to the relationships. Electronic messages are encrypted with the encryption keys concerning digital enrollments to provide to the first entity. The digital enrollment is associated with at least one digital ticket that authorizes access to a resource managed by the fourth entity. Presentation of the digital enrollment causes the presentation of one digital ticket associated with the digital enrollment to authorize the first entity to access the resource.

Abstract: A system and method are provided for determining a relationship between first and second data elements by using a relationship element. The first and second data elements are each protected elements being bound to first and second indices for providing referential integrity. The relationship is determined by reading the relationship element in response to a request and the second element is identified based on information read from the relationship element. The relationship element is in a different data collection than at least one of the first and second elements. This structure provides a robust and flexible means to create and maintain relationships between existing documents stored in various electronic libraries, while minimizing changes to exiting system software and requiring no change to application software.

Abstract: A method and system are provided for controlling a client's access to a protected element, in which the protected element is contained in a protected resource which includes a data manager. The invention provides efficient access control for existing data elements while requiring only minimal changes to existing software components. In response to a request for access to the protected element the data manager sends an authorization checking request to a protecting resource. The protecting resource, which is in a distributed arrangement with the protected resource, determines, based on an access control element which can be associated with one or more protected elements, whether the client has permission to be provided the requested access to the protected element. It then sends an access control message (e.g. YES/NO) to the data manager based on the determination, and optionally send explanatory information if access is denied. Access to the protected element is provided or denied based on that message.

Abstract: Library service protocols are provided for moving large data objects into an out of a data image library with attention to security, authentication, and consistency of related images stored in different machines. The protocol consists of particular message sequences, special tokens within messages, and out-of-sequence database changes.