Abstract: A user interface for building a componentized workflow model. Each step of the workflow is modeled as an activity that has metadata to describe design time aspects, compile time aspects, and runtime aspects of the workflow step. A user selects and arranges the activities to create the workflow via the user interface. The metadata associated with each of the activities in the workflow is collected to create a persistent representation of the workflow. Users extend the workflow model by authoring custom activities.

Abstract: The present invention extends to methods, systems, and computer program products for separating authorization identity from policy enforcement identity. Embodiments of the invention extend the consumption phase for protected information. Two identities, an authorization identity and a policy enforcement identity, are used for acquiring, issuing and enforcing usage license instead of one identity certificate. The authorization identity is used to evaluate against usage policy. The authorization identity is similar to identification information in an identity certificate. The policy enforcement identity is used to ensure the confidentiality of granted permissions and content key. The policy enforcement identity enforces a usage license on an authorization principal's (e.g., recipient's) machine. The policy enforcement identity's enforcement of a usage license is similar use of a cryptographic key in an identity certificate.

Abstract: A user interface for building a componentized workflow model. Each step of the workflow is modeled as an activity that has metadata to describe design time aspects, compile time aspects, and runtime aspects of the workflow step. A user selects and arranges the activities to create the workflow via the user interface. The metadata associated with each of the activities in the workflow is collected to create a persistent representation of the workflow. Users extend the workflow model by authoring custom activities.

Abstract: Enabling creation of control flow patterns in a workflow via continuations. Each continuation represents an activity execution context for an activity executing in the workflow by a workflow engine virtualizing a managed execution environment. Responsive to a request, the activity execution context is recreated via the continuation and the activity is executed within the recreated context.

Abstract: Systems for providing sign-up email addresses are disclosed herein. A user may set up a sign-up email address for receiving emails from a trusted, Internet-based enterprise. The user may set up a dedicated mailbox folder associated with the sign-up email address or enterprise. The email server may automatically direct emails coming from that enterprise into that folder. To “unsubscribe,” the user needs only to delete the folder or the sign-up address. Emails from the enterprise to the sign-up address may be highlighted in the user's main inbox. Thus, the user may be assured that any such email is truly from the enterprise, and not a phishing expedition or spam. Such systems also provide the user with effective tools to recognize phish or spam emails that appear to be from the trusted enterprise and not to act on them.

Abstract: A perimeter network may be utilized to filter electronic mail messages destined for an internal network. A computer may be utilized to monitor an electronic mail mailbox for changes to a safe recipients list and/or a blocked senders list. The computer may further be utilized to automatically copy the safe recipients list and/or the blocked senders list to a network directory in the internal network. The computer may further be utilized to automatically send the safe recipients list and/or the blocked senders list to a network directory in the perimeter network for utilization by one or more agents executing on a computer in the perimeter network. The one or more agents may be configured to utilize the safe recipients list and/or the blocked senders list to filter electronic mail messages received by the perimeter network which are destined for delivery to the internal network.

Abstract: A web-based client for creating and accessing protected content may be provided. Consistent with embodiments of the invention, a webmail client may be provided allowing a user to apply a restriction template to a document. The webmail client may be further operative to decrypt and display the document and enforce the restriction against a recipient.

Abstract: Transport pipeline decryption may be provided. Consistent with embodiments of the invention, a protected message may be received and decrypted. The decrypted message may be provided to pipeline agents, such as anti-virus, anti-spam, journaling, and/or policy enforcement agents. The message may then be re-encrypted and delivered.

Abstract: Business to business secure mail may be provided. Consistent with embodiments of the invention, a protected message may be received. The recipient may request a token from a trust broker, submit the token to an authorization server associated with the sender, receive a user license from the authorization server; and decrypt the protected message using the user license. The protected message may restrict actions that may be taken by the recipient, such as forwarding to other users.

Abstract: Asynchronous fault handling for a workflow. A state automaton for an activity in the workflow is defined. The state automaton includes at least an executing state, a faulting state, and a closed state and classifies an execution lifetime of the activity. The activity is defined to include work items and includes an execution hierarchy for the work items. Each work item includes an operation for executing a portion of the activity. Each work item is transitioned to the executing state. The included operation of transitioned work items is executed in the executing state. One or more of the transitioned work items are identified in response to the faulting event as a function of the execution hierarchy and the included operation. The faulting event is asynchronously handled by transitioning the one or more identified work items to the faulting state while executing the included operation of the remaining transitioned work items.

Abstract: Architecture for generating a temporary account (e.g., an email address) with a user-supplied friendly name and a secret used to the sign the temporary account. For example, when a user wishes to create a temporary email address to use with an online organization, a friendly name is provided and the system generates a temporary email address including the friendly name. A signing component signs the temporary email address with a secret. One or more of these secrets can be provisioned prior to the user's creation of a friendly name, which eliminates propagation delay. During use, only incoming email messages having the temporary email address signed with the secret are validated. When the user revokes the temporary email address, the secret is revoked and the revocation is propagated to network gateways, rejecting any email sent to that address.

Abstract: An email security system is described that allows users within different organizations to securely send email to one another. The email security system provides a federation server on the Internet or other unsecured network accessible by each of the organizations. Each organization provides identity information to the federation server. When a sender in one organization sends a message to a recipient in another organization, the federation server provides the sender's email server with a secure token for encrypting the message to provide secure delivery over the unsecured network.

Abstract: To provide for multi-language compilation, a protocol is established for compilers. Each of at least two compilers implements the protocol. A framework is developed which discovers compilers which have implemented the protocol. The framework allows multi-language compilation using and coordinating the compliant compilers. The framework is extensible. When a new protocol-compliant compiler is discovered, the language compiled by the new compiler can be compiled using the framework and the capabilities of the protocol-compliant compilers. Similarly, a multi-language extensible design tool may be created using protocol-compliant design tools.

Abstract: Representing a componentized workflow model via a declarative markup language. Each step of the workflow is modeled as an activity that has metadata to describe design time aspects, compile time aspects, and runtime aspects of the workflow step. A user selects and arranges the activities to create the workflow via user interfaces or application programming interfaces. The metadata associated with each of the activities in the workflow is collected to create a persistent representation of the workflow. Users extend the workflow model by authoring custom activities.

Abstract: Modifying a componentized workflow model during execution of the workflow. Each step of the workflow is modeled as an activity that has metadata to describe design time aspects, compile time aspects, and runtime aspects of the workflow step. A user selects and arranges the activities to create the workflow via user interfaces or application programming interfaces. Metadata is associated with each of the activities in the workflow. During execution of the workflow, the user modifies the metadata to affect execution of the workflow without recompiling the workflow.

Abstract: The present invention supports the design of a process using a drawing surface that specifies the process with underlying programmatic constructs. In response to a user's command, a construct corresponding to a shape is selected from a palette and inserted onto a design region that shows the specified process. The command is verified to be consistent with semantics of an associated process type. If so, a visual image of the specified process is updated. If not, an indicator is generated in a proximity of a relevant portion of the visual image in order to help the user resolve the inconsistency. The user is able to correct errors before generating computer-executable instructions from a high-level code emission. Computer-executable instructions are also generated from high-level code emission. A process engine is cognizant of the associated high-level lines of code and an infrastructure knowledge base while executing the computer-executable instructions.

Abstract: A method for confidential electronic communication between a sender workstation and a receiver workstation is provided, whereby privacy is guaranteed for the electronic communications transmitted over the public Internet. The method of confidential communication is equipped with message tracking and message receipt verification. The system for implementing the method includes a sender server that creates a session content encryption key along with a message envelope that includes a content encryption key encrypted message and a confidential mail token. The content encryption key is stored securely inside the sender organization's system which transmits the message envelope to an intended recipient. The intended recipient processes the message envelope in order to generate a message receipt verification, which is transmitted to the sender. The message receipt verification is processed by the sender server to verify that the message envelope reached the intended recipient.

Abstract: Building a componentized workflow model via an application programming interface. Each step of the workflow is modeled as an activity that has metadata to describe design time aspects, compile time aspects, and runtime aspects of the workflow step. A user selects and arranges the activities to create the workflow via the application programming interfaces. The metadata associated with each of the activities in the workflow is collected to create a persistent representation of the workflow. Users extend the workflow model by authoring custom activities. Users also compile the workflow via the application programming interface.

Abstract: The present invention enables a user to build user-interfaces and applications based on a policy that contains metadata. The user can build an application through the user-interface, in which the user-interface and the generated computer-executable instructions are consistent with the policy. A user-interface has a toolbox that indicates the discovered components and a design surface that displays applicable stages. The policy determines the stages, where each stage provides a grouping of components having related tasks. The user selects components from the toolbox so that the selected components are associated with the selected stages on the design surface. After the user has completed building an application, a representation of the application may be compiled in order to generate a set of computer-executable instructions. Moreover, the compiler is coupled to the policy so that the set of computer-executable instructions is consistent with the policy.

Abstract: Building a componentized workflow model. Each step of the workflow is modeled as an activity that has metadata to describe design time aspects, compile time aspects, and runtime aspects of the workflow step. A user selects and arranges the activities to create the workflow via user interfaces or application programming interfaces. The metadata associated with each of the activities in the workflow is collected to create a persistent representation of the workflow. Users extend the workflow model by authoring custom activities. The workflow may be compiled and executed.