Abstract: Data life cycle policies are developed by classifying data into data classes based upon predetermined data attributes. States are then specified in which the data classes may reside. Components are defined that support one or more of the states. Transfer agents support transferring data from one component to another component. A state transition diagram is prepared for each data class, including one or more conditions that are necessary for each transition between states. An algorithm is applied to the state transition diagram which generates policies that generate life cycle actions if the data or file belongs to the class, the present state of the data or file, and if the conditions for the transitions between the states for each data class have been met. The algorithm provides a method and system for developing data life cycle policies.

Abstract: Described is a method, a system, a computer program product and a service implemented at least partially through a data communications network to dynamically change the effect of an enforcement of a policy in a policy-managed system. The method, system, computer program product and service enabling the user to identify at least one policy as a dynamic policy and to specify at least one part of a policy statement of the dynamic policy to have a value that can be varied while the policy is active.

Abstract: In one aspect this invention provides a computer program embodied on a computer readable medium that is executed by at least one data processor of a policy management system. The computer program includes first computer program instructions for implementing a user interface and second computer program instructions for implementing a policy manager that is coupled to the user interface via a policy repository for introducing a new attribute, using the first computer program instructions, into a policy for a policy-managed system, without requiring a change to (e.g., without having to re-write or re-compile) the second computer program instructions.

Abstract: A system and method for a downladable just-in-time middleware called VEM that provides access to network services, including system services such as printing and local storage, to applications that run on Network Computers. The VEM configures the default client services and stores information about these services. When an application executing on the Network Computer wishes to use one of the services, it communicates with its local VEM. The VEM returns a hanlde to the appropriate service to complete the service request.

Abstract: A system and method for a downloadable just-in-time middleware called VEM that provides access to network services, including system services such as printing and local storage, to applications that run on Network Computers. The VEM configures the default client services and stores information about these services. When an application executing on the Network Computer wishes to use one of the services, it communicates with its local VEM. The VEM returns a handle to the appropriate service to complete the service request.

Abstract: An improved method and apparatus for dynamic execution of mobile agents. For example, a symbolic name for a component to be executed can be dynamically resolved using a component directory to determine an appropriate network host that the agent needs to visit. Preferably, the component directory can be queried by client or host machines, and updated by component hosts. Changes in a component's location and/or availability can also be captured at runtime and the agents dynamically routed to alternate component hosts. Still other features enable agents to flexibly accommodate the dynamics of the system. For example, if the attributes of a component are modified, or a component host becomes heavily loaded, agents can adapt to such changes by looking up an alternate host for the same component. Yet other features provide improved system manageability. For example, component hosts can freely update a component's location and/or attributes at any time.

Abstract: A method and apparatus for providing a network computer with secure remote swapping to avoid transmitting active memory resident entities (such as data structures, pages, and segments) containing sensitive data in the clear. When a memory resident entity is created, it is entered in a Table of Secure Entities (TSE) if it requires security. The memory manager of the network computer checks the TSE for an entity before swapping it out to a network server. If the entity is in the TSE, the memory manager encrypts the contents of the entity using the public key from the network computer's SmartCard device. When reloading the entity, the memory manager uses the private key from the SmartCard to decrypt the contents of the entity.

Abstract: A locking apparatus for a multicomputer system. The lock apparatus is a two level system wherein local lock managers grant locks on a resource only after they have acquired an appropriate token from a rock control server which is the owner of the resource. The lock control server is passive and has all the control information for a resource it owns. When a local lock manager needs a token in a specified mode for a particular resource, it acquires the token from the lock control server. If there are no conflicting tokens, then the rock control server grants the token. However, if there are conflicting tokens, then the lock control server responds with a list of the local lock managers with conflicting tokens. The requesting lock manager then requests each of the local lock managers with conflicting tokens to give it up and to acknowledge when it has done so. When the acknowledgements have been received, the local lock manager requests the lock control server to update its table and grant the requested token.