Abstract: To communicate a modular document from a first electronic device to a second electronic device, the first electronic device determines which one or more component documents of the modular document are already available at the second electronic device. The modular document is composed of plural component documents. The first electronic device sends to the second electronic device a subset of the plural component documents of the modular document, where the subset of the plural component documents is other than the one or more component documents already available at the second electronic device.

Abstract: A first instance of a modular document is received, where the modular document is composed of plural parts, and where the modular document contains a merge definition. A second instance of the modular document is received, where the second instance and the first instance of the modular document have been modified with respect to each other. The second instance is merged with the first instance, where any conflict between the second instance and the first instance is resolved according to the merge definition.

Abstract: To provide for cryptographic separation, embodiments of the invention employ containment mechanisms provided by trusted operating systems to ensure that plaintext data which must be encrypted in accordance with a security policy (or, in reverse, ciphertext data which is to be decrypted) is processed by a suitable encryption routine before being sent onwards for transmission, storage, or the like. Such containment mechanisms usually include mandatory system access control rules which specify to which system resources the output of a system resource (such as an application) may be supplied. By specifying a suitable set of such rules, mandatory encryption can be enforced at the operating system kernel level.

Abstract: A modular document is composed of plural parts, where at least a particular one of the parts is associated with an access right policy that restricts access to the particular part. In response to a request to access the modular document, it is determined based on the access right policy whether content of the particular part is accessible in an electronic device. In response to determining that the content of the particular part is inaccessible in the electronic device, an access mechanism associated with the particular part is accessed to determine an action to take with respect to the particular part when presenting the modular document.

Abstract: A modular document composed of plural component documents that are combined to allow presentation of the modular document is provided. The modular document contains references to the component documents. Version information is associated with at least one of the references to identify one of plural versions of a corresponding particular one of the component documents.

Abstract: A method of managing multiple resource identifiers in a machine readable document includes allocating one or more resource identifiers to a context. A context name is associated to the context and the context name and resource identifier are associated in the document.

Abstract: A modular document is composed of plural parts, where at least a particular one of the parts is associated with an access right policy that restricts access to the particular part. In response to a request to access the modular document, it is determined based on the access right policy whether content of the particular part is accessible in an electronic device. In response to determining that the content of the particular part is inaccessible in the electronic device, an access mechanism associated with the particular part is accessed to determine an action to take with respect to the particular part when presenting the modular document.

Abstract: A modular document composed of plural component documents that are combined to allow presentation of the modular document is provided. The modular document contains references to the component documents. Version information is associated with at least one of the references to identify one of plural versions of a corresponding particular one of the component documents.

Abstract: A first electronic device stores a modular document composed of plural component documents that are combined to allow presentation of the modular document. A surrogate of the modular document is sent to a second electronic device. A change of the surrogate made at the second electronic device is synchronized with the modular document, or a change of the modular document is synchronized with the surrogate at the second electronic device.

Abstract: To communicate a modular document from a first electronic device to a second electronic device, the first electronic device determines which one or more component documents of the modular document are already available at the second electronic device. The modular document is composed of plural component documents. The first electronic device sends to the second electronic device a subset of the plural component documents of the modular document, where the subset of the plural component documents is other than the one or more component documents already available at the second electronic device.

Abstract: A first instance of a modular document is received, where the modular document is composed of plural parts, and where the modular document contains a merge definition. A second instance of the modular document is received, where the second instance and the first instance of the modular document have been modified with respect to each other. The second instance is merged with the first instance, where any conflict between the second instance and the first instance is resolved according to the merge definition.

Abstract: A method for updating electronic documents includes associating at least one update program with the electronic document such that, in response to specific stimuli, the at least one update program is executed to operate on content of the electronic document.

Abstract: A method for rendering documents includes rendering a document using a rendering definition indicated within electronic data representing the document.

Abstract: A network gateway (1005) is described, wherein an object invocation (1020) containing an embedded object reference (1025), which points to a further object (1002), is modified on passing through the gateway. The gateway validates the object invocation and enacts a number of security tests thereon before forwarding it on. In preferred embodiments, the embedded object reference is replaced by an object reference (1035) to a gateway proxy specifically for the further object (1002). The replacement object reference (1035) also includes enough information that the original object reference (1025) can be recovered. The gateway proxy is generated on or after receipt of the invocation (1020). In the event the further object (1002), which was the subject of the object reference, is itself invoked, the invocation is directed to the gateway proxy, which in turn recovers the original object reference and forwards the invocation on to the further object (1002).

Abstract: A system for allowing a computer application or computer service to notify a user 10 that his certificate is within some specified interval before its expiry date utilizing information that is already contained in a standard digital certificate, together with current data information that is already known by the application 12 or service 16 to enforce expiry of the certificate when it occurs. No additional storage of information is required.

Abstract: A service-provider 600 including a physically and logically protected computing environment 401, and a user space 402 accepts a request 604 to provide a private virtual room for a particular purpose from a customer or multiple customers 606. At 702, it checks the legitimacy of the proposed purpose and seeks input about the criteria for filtering the participants. Providing the legitimacy of the proposed purposes are verified, at 703 the service-provider 600 sets up the private virtual room 608 which provides a secure environment within which participants can communicate electronically. At 704, the service-provider 600 receives requests from potential participants 610 to enter the virtual room 608, and its filters the participants 610 to ensure they meet previously-defined criteria.