Abstract: A method and apparatus is provided for dynamically generating data to dataset mappings and dataset to logical instance mappings and distributing these mappings to subscribers for the purpose of routing work. An advisory engine updates the mappings of data to data sets based at least in part on changing demands and patterns of access to data, and updates the mappings of datasets to logical instances based at least in part on anticipated capacity and change in conditions of the database servers. The subscribers receive and store the mapping information that maps the data to dataset identifiers, and dataset identifiers to logical database instances. The subscribers may also receive information that describes the current availability conditions of database instances, which are used to override the mapping of logical database instances to physical database instances. Subscribers may use the data to dataset mapping to map data identified from in an incoming database request to a dataset.

Abstract: A method and apparatus is provided for dynamically generating data to dataset mappings and dataset to logical instance mappings and distributing these mappings to subscribers for the purpose of routing work. An advisory engine updates the mappings of data to data sets based at least in part on changing demands and patterns of access to data, and updates the mappings of datasets to logical instances based at least in part on anticipated capacity and change in conditions of the database servers. The subscribers receive and store the mapping information that maps the data to dataset identifiers, and dataset identifiers to logical database instances. The subscribers may also receive information that describes the current availability conditions of database instances, which are used to override the mapping of logical database instances to physical database instances. Subscribers may use the data to dataset mapping to map data identified from in an incoming database request to a dataset.

Abstract: A method and apparatus is provided for dynamically generating data to dataset mappings and dataset to logical instance mappings and distributing these mappings to subscribers for the purpose of routing work. An advisory engine updates the mappings of data to data sets based at least in part on changing demands and patterns of access to data, and updates the mappings of datasets to logical instances based at least in part on anticipated capacity and change in conditions of the database servers. The subscribers receive and store the mapping information that maps the data to dataset identifiers, and dataset identifiers to logical database instances. The subscribers may also receive information that describes the current availability conditions of database instances, which are used to override the mapping of logical database instances to physical database instances. Subscribers may use the data to dataset mapping to map data identified from in an incoming database request to a dataset.

Abstract: A secure communication system wherein message decryption may be performed while off-line, or optionally while on-line. A sender encrypts a message based on the message key and sends it to the recipient. An envelope containing a message key is created by encrypting the message key based on a verifier, where the verifier is based on a secret of the recipient. The recipient is provided the envelope, along with the message or separately, from the sender or from another party, contemporaneous with receipt of the message or otherwise. The recipient can then open the envelope while off-line, based on their secret, and retrieve the message key from the envelope to decrypt the message. In the event the recipient cannot open the envelope, optional on-line access permits obtaining assistance that may include obtaining an alternate envelope that the recipient can open.

Abstract: A method and apparatus is provided for dynamically generating data to dataset mappings and dataset to logical instance mappings and distributing these mappings to subscribers for the purpose of routing work. An advisory engine updates the mappings of data to data sets based at least in part on changing demands and patterns of access to data, and updates the mappings of datasets to logical instances based at least in part on anticipated capacity and change in conditions of the database servers. The subscribers receive and store the mapping information that maps the data to dataset identifiers, and dataset identifiers to logical database instances. The subscribers may also receive information that describes the current availability conditions of database instances, which are used to override the mapping of logical database instances to physical database instances. Subscribers may use the data to dataset mapping to map data identified from in an incoming database request to a dataset.

Abstract: A secure communication system wherein message decryption may be performed while off-line, or optionally while on-line. A sender encrypts a message based on the message key and sends it to the recipient. An envelope containing a message key is created by encrypting the message key based on a verifier, where the verifier is based on a secret of the recipient. The recipient is provided the envelope, along with the message or separately, from the sender or from another party, contemporaneous with receipt of the message or otherwise. The recipient can then open the envelope while off-line, based on their secret, and retrieve the message key from the envelope to decrypt the message. In the event the recipient cannot open the envelope, optional on-line access permits obtaining assistance that may include obtaining an alternate envelope that the recipient can open.

Abstract: A secure communication system wherein message decryption may be performed while off-line, or optionally while on-line. A sender encrypts a message based on the message key and sends it to the recipient. An envelope containing a message key is created by encrypting the message key based on a verifier, where the verifier is based on a secret of the recipient. The recipient is provided the envelope, along with the message or separately, from the sender or from another party, contemporaneous with receipt of the message or otherwise. The recipient can then open the envelope while off-line, based on their secret, and retrieve the message key from the envelope to decrypt the message. In the event the recipient cannot open the envelope, optional on-line access permits obtaining assistance that may include obtaining an alternate envelope that the recipient can open.

Abstract: A system for communicating a message securely between a sender and a receiver. The sender provides a key server with a string specifying the receiver. The key server obtains a message key and a particular envelope encryption key corresponding with a particular envelope decryption key, encrypts the message key with the envelope encryption key (creating the envelope), and provides the envelope to the sender-client. The sender-client encrypts the message with the message key and provides it and the envelope to the receiver. The receiver-client receives these and asks an authentication server for the envelope decryption key. The authentication server obtains the envelope decryption key and provides it to the receiver. The receiver then decrypts the envelope with the envelope decryption key, to get the message key, and decrypts the message.

Abstract: A federated authentication service technology (10) for authenticating a subject (20) residing in a subject domain (12) on a network to a server application (38) residing in a server domain (18), wherein an authentication mechanism (32) residing in an authentication domain (16) affects the service provided by the server application (38). A client (22), which may be integrated non-human instances of the subject (20), authenticates the subject (20) and a protocol proxy (34) mediates with the authentication mechanism (32) to obtain a name assertion which the client can use to access the server application (38). When multiple authentication mechanisms (32) are available, an optional agent (24), mechanism resolution process (26) and mechanism repository (28), all residing in an agent domain (14), may be used to resolve to one suitable authentication mechanism (32).

Abstract: A federated authentication service technology (10) for authenticating a subject (20) residing in a subject domain (12) on a network to a server application (38) residing in a server domain (18), wherein an authentication mechanism (32) residing in an authentication domain (16) affects the service provided by the server application (38). A client (22), which may be integrated non-human instances of the subject (20), authenticates the subject (20) and a protocol proxy (34) mediates with the authentication mechanism (32) to obtain a name assertion which the client can use to access the server application (38). When multiple authentication mechanisms (32) are available, an optional agent (24), mechanism resolution process (26) and mechanism repository (28), all residing in an agent domain (14), may be used to resolve to one suitable authentication mechanism (32).