Abstract: A method and system are directed towards enabling content security in a distributed environment. The system includes a data store for content associated with an application that may be tagged as exclusively memory resident at a client. The content may also be encrypted and digitally signed. When an authenticated client requests the content, it is provided at a constrained rate that enables a portion of the content to start execution on the client before the application associated with the content is completely downloaded. Additional portions of the content are provided to the client when the additional portions are required for execution by the application.

Abstract: A method and system for controlling bandwidth used to communicate between at least one client and a server. A history is accessed that includes information about communications between the at least one client and a server during a period of time. The history is employed to determine a send time at which a message could be sent without exceeding a bandwidth threshold. The bandwidth threshold indicates an upper limit for an amount of bandwidth allowed during a period of time to communicate between the at least one client and the server. A data structure is then modified to delay sending the message until at least the send time.

Abstract: A method and system are directed towards enabling authentication in a distributed environment. The method employs a hashed salted password associated with a user in part to pre-authenticate the user. If the user is pre-authenticated, a ticket is transmitted to a client. The ticket includes a cryptographic digest of a concatenation of the local and remote addresses that is exclusive or'ed with a timestamp to generate a modified authenticator. The modified authenticator is directed at binding the timestamp to the client to minimize reuse of an authenticator. A packet that includes the authenticator is sent to a server. The server is configured to determine another remote and local IP address associated with the packet. Employing the remote and local addresses, the server extracts the timestamp from the modified authenticator. If the timestamp is within a pre-determined time window, the user may be authenticated.

Abstract: A method and system for effectively communicating file properties and directory structures within a distributed file system is provided. A manifest that includes properties relating to all of the files used in an application is created. The manifest is distributed to a client before the client has received all of the files or properties associated with an application. The manifest is stored on the client and is used to determine properties and locations of files used within the application. A distributed file system layer is used to receive file and property requests from the application; determine the location of the requested file, or the property using the manifest, and retrieve the property or file using the manifest. A tool may be used to generate the manifest manually or automatically. File system calls within an application may be replaced with calls that use the distributed file system layer.

Abstract: A method and system are directed towards balancing loads on an authentication system. The system employs a first authentication server that is configured to authenticate a user. The system includes a master authentication server. When the master authentication server determines that a load on it has reached a pre-determined value, a data store associated with the master authentication server is partitioned between authentication servers that assume a master authentication server role for its partition of the data store. In one embodiment, each new master authentication server is further enabled to partition its respective partition of the data store, if their respective loads reach the pre-determined value.

Abstract: A method and system are directed towards enabling content security in a distributed environment. The system includes a data store for content associated with an application that may be tagged as exclusively memory resident at a client. The content may also be encrypted and digitally signed. When an authenticated client requests the content, it is provided at a constrained rate that enables a portion of the content to start execution on the client before the application associated with the content is completely downloaded. Additional portions of the content are provided to the client when the additional portions are required for execution by the application.

Abstract: A method and system for versioning of applications is provided. A version of an application may be updated or rolled back transparently to the client. A list of resources in a current version of an application is created and compared to the list of resources in a new version. When a resource is not included in the current version but is included in the new version, a notation is made to include the resource in the new version. When an extra resource is in the current version but not in the new version, a notation is made to purge the resource so that it is not included in the new version. These notations may be created in a purge list used by the client to request the resources needed to change versions. No interaction is needed by the client to change versions.

Abstract: A method and system for preloading data is provided. Resources are preloaded on a client before they are needed by an application. Application hints and static resources lists may be used to indicate resources are needed. The application may begin execution before receiving all of the resources associated with the application. Preloading may be done during execution of an application, or when the application is not executing. Preloading allows an application to run smoothly without consuming more resources than are needed by an application. A prediction graph may be generated that is used in predicting the resources that are likely to be needed by the application. An analyzer may also be used to simulate the system and adjust parameters used in creating the prediction graph.

Abstract: A method and system for versioning of applications is provided. A version of an application may be updated or rolled back transparently to the client. A list of resources in a current version of an application is created and compared to the list of resources in a new version. When a resource is not included in the current version but is included in the new version, a notation is made to include the resource in the new version. When an extra resource is in the current version but not in the new version, a notation is made to purge the resource so that it is not included in the new version. These notations may be created in a purge list used by the client to request the resources needed to change versions. No interaction is needed by the client to change versions.

Abstract: A method and system for granting access to system and content is provided. A key is provided that allows access by a client computer to content that includes a plurality of resources. A server is accessed and the key is provided to the server. Based on the key, access is granted to the content. A program on the client computer requests a resource of the plurality of resources. If the resource is located locally, the resource is provided to the program. Otherwise, the resource is downloaded from the content server and stored locally. A data structure is modified to indicate that the resource is stored locally and the resource is provided to the program.

Abstract: A method and system for controlling bandwidth used to communicate between at least one client and a server. A history is accessed that includes information about communications between the at least one client and a server during a period of time. The history is employed to determine a send time at which a message could be sent without exceeding a bandwidth threshold. The bandwidth threshold indicates an upper limit for an amount of bandwidth allowed during a period of time to communicate between the at least one client and the server. A data structure is then modified to delay sending the message until at least the send time.

Abstract: A method and system for effectively communicating file properties and directory structures within a distributed file system is provided. A manifest that includes properties relating to all of the files used in an application is created. The manifest is distributed to a client before the client has received all of the files or properties associated with an application. The manifest is stored on the client and is used to determine properties and locations of files used within the application. A distributed file system layer is used to receive file and property requests from the application; determine the location of the requested file, or the property using the manifest, and retrieve the property or file using the manifest. A tool may be used to generate the manifest manually or automatically. File system calls within an application may be replaced with calls that use the distributed file system layer.

Abstract: A method and system are directed towards enabling content security in a distributed environment. The system includes a data store for content associated with an application that may be tagged as exclusively memory resident at a client. The content may also be encrypted and digitally signed. When an authenticated client requests the content, it is provided at a constrained rate that enables a portion of the content to start execution on the client before the application associated with the content is completely downloaded. Additional portions of the content are provided to the client when the additional portions are required for execution by the application.

Abstract: A method and system are directed towards enabling authentication in a distributed environment. The method employs a hashed salted password associated with a user in part to pre-authenticate the user. If the user is pre-authenticated, a ticket is transmitted to a client. The ticket includes a cryptographic digest of a concatenation of the local and remote addresses that is exclusive or'ed with a timestamp to generate a modified authenticator. The modified authenticator is directed at binding the timestamp to the client to minimize reuse of an authenticator. A packet that includes the authenticator is sent to a server. The server is configured to determine another remote and local IP address associated with the packet. Employing the remote and local addresses, the server extracts the timestamp from the modified authenticator. If the timestamp is within a pre-determined time window, the user may be authenticated.

Abstract: A method and system are directed towards balancing loads on an authentication system. The system employs a first authentication server that is configured to authenticate a user. The system includes a master authentication server. When the master authentication server determines that a load on it has reached a predetermined value, a data store associated with the master authentication server is partitioned between authentication servers that assume a master authentication server role for its partition of the data store. In one embodiment, each new master authentication server is further enabled to partition its respective partition of the data store, if their respective loads reach the pre-determined value.