Abstract: Interface elements of a logic module are translated by renaming, adding dummy elements, and/or associating traps with dummy elements. Trusted parties are made aware of renamed interface elements and thereby allowed to properly communicate with logic module. Untrusted parties are kept unaware of the interface translation, with attempts to guess correct interface elements likely to fail, instead resulting in communication attempts with dummy elements and subsequent trapping of the untrusted parties.

Abstract: Multiple virtual processes are each associated with a unique virtual process identifier. For each virtual process, a separate initialization process is started, from which all other processes included in the virtual process originate. The initialization process is associated with the appropriate virtual process identifier. System calls that create new processes are intercepted, and created processes are associated with the virtual process identifier of the appropriate initialization process. Multiple virtual processes are provided on a single, physical computer system.

Abstract: A system and a method dynamically adjusts the quality of service guarantees for virtual servers based upon the resource demands experienced by the virtual servers. Virtual server resource denials are monitored to determine if a virtual server is overloaded based upon the resource denials. Virtual server resources are modified dynamically to respond to the changing resource requirements of each virtual server. Occasionally, a physical host housing a virtual server may not have additional resources to allocate to a virtual server requiring increased resources. In this instance, a virtual server hosted by the overloaded physical host is transferred to another physical host with sufficient resources.

Abstract: A method facilitates providing appropriate quality of service guarantees to a plurality of virtual hosts on a single physical host computer. A server application program and its child processes service communication requests made to the plurality of virtual hosts. Quality of service parameters associated with the virtual hosts are stored. Communication requests made to a specific one of the virtual hosts are detected. The quality of service parameters associated with the specific virtual host are obtained. Operating system resources are utilized to guarantee, to a child process of the server application program, a quality of service according to the obtained quality of service parameters associated with the virtual host. Communication between the virtual host and the client is allowed to proceed, the communication being managed by the child process.

Abstract: File access rates of processes are regulated according to file type. An association table stores entries associating processes to be regulated with specific access rates for various file types. System calls that access files are intercepted, and a system call wrapper executes. The system call wrapper determines the type of file that is being accessed by the process. The system call wrapper examines the association table in order to determine if the calling process is associated with an access rate for the file type being accessed. If so, the system call wrapper regulates access to the file according to the appropriate rate.

Abstract: Communications between network devices on a logical subnet are restricted between devices authorized to communicate with each other, even though other network devices may be present on the subnet. When a network device receives a request to provide it L2 address to a requesting network device, it responds with its L2 address only if the requesting device is authorized to request L2 address. Optionally, a network device only transmits requests for the L2 addresses of other devices if it authorized to do so. The information describing authorized devices maybe store as list of L2 and L3 addresses, which list may be loaded by each network device when starting up. Preferably, authorized devices include routers on the device's logical subnet, to allow the routers to communicate with, and route packets to, the network devices.

Abstract: An I/O multiplexing operation involving a cross-domain file descriptor set is intercepted. The cross-domain set is divided into a first subset corresponding to a first file type and a second subset corresponding to a second file type. System calls are initiated in parallel for performing separate I/O multiplexing operations on the first and second subsets of file descriptors. In response to one of the parallel system calls identifying at least one file descriptor ready for communication, the other parallel system call is unblocked. Sets of file descriptors identified as ready for communication by the parallel system calls are combined and returned to a calling process.

Abstract: File descriptors associated with specific file types are disambiguated from other file descriptors by maintaining and examining an indicator table containing indicators concerning file descriptors associated with a specific, desired file type. System calls that establish a descriptor of the specific, desired type are intercepted, and an indicator concerning the established file descriptor is added to the indicator table. To keep the indicator table current, system calls that make a copy of a file descriptor or that delete a file descriptor are intercepted. If a file descriptor associated with the desired type is copied or deleted, the indicator table is updated. Therefore, the indicator table preferably includes indicators concerning all file descriptors associated with files of the specific desired type. The indicator table is examined to determine whether or not a specific file descriptor is of the desired type.

Abstract: System calls are selectively intercepted by processes. Processes selected to intercept system calls are loaded by a modified loader program which creates an association between the process and a system call wrapper. Pointers in the interrupt vector table to system calls to be intercepted are replaced with pointers to an interception module in operating system address space. When system calls are made, the interception module executes and determines whether the process that made the system call is a selected process, associated with a system call wrapper. If the process is a selected process, the system call wrapper executes. If the process is not a selected process, the system call is made. In one embodiment, system call wrappers execute in the process address space of selected processes. In another embodiment, system call wrappers execute in user address space, but not in the process address space of any specific processes.

Abstract: The methods and systems of the invention enable connectionless-oriented server and client programs operating on processing systems to communicate with connection-oriented routines operating on different processing systems linked to connectionless or connection-oriented networks by establishing connections or communications virtual circuits between such programs. The connectionless-oriented server and client programs may be modified to communicate with a connection manager to establish a virtual circuit before initiating communications with the connection-oriented routines. The invention further utilizes encapsulators and decapsulators to enable communication programs to transfer data packets in a first format on an established virtual circuit over a network transmitting data in a second format.