Abstract: A method, computer program product, and computer system for receiving, at a first node of a plurality of nodes in a distributed architecture, a request for at least one of a device and a service based upon, at least in part, an attribute of at least one of the device and the service. A query to resolve the request may be forwarded to a plurality of nodes in the distributed architecture. A probability of at least a portion of nodes of the plurality of nodes to resolve the query may be determined based upon, at least in part, a search routing mechanism. The request may be forwarded to a second node of at least the portion of nodes of the plurality of nodes based upon, at least in part, the second node having a higher probability to resolve the query than a third node of at least the portion of nodes of the plurality of nodes.

Abstract: A system and a method for a transient gateway, including a storage device storing a set of data, and a gateway engine coupled to the storage device accessing and updating the set of data, the gateway engine configured to share bandwidth and resources, across a plurality of organizations. The transient gateway organizes the set of data to act as a broker amongst the plurality of organizations. The transient gateway is configured to provide resources as a monetized commodity. The transient gateway provides protocols handling capabilities of its connected devices of one organization to another organization from among the plurality of organizations.

Abstract: A method, computer program product, and computer system for receiving, at a first node of a plurality of nodes in a distributed architecture, a request for at least one of a device and a service based upon, at least in part, an attribute of at least one of the device and the service. A query to resolve the request may be forwarded to a plurality of nodes in the distributed architecture. A probability of at least a portion of nodes of the plurality of nodes to resolve the query may be determined based upon, at least in part, a search routing mechanism. The request may be forwarded to a second node of at least the portion of nodes of the plurality of nodes based upon, at least in part, the second node having a higher probability to resolve the query than a third node of at least the portion of nodes of the plurality of nodes.

Abstract: A method, computer program product, and computer system for creating a dynamic directory of objects. A request to modify a dynamic directory of a plurality of objects is received. Each of the plurality of objects is associated with one or more attribute-value pairs. One or more first object attribute-value pairs is determined for a first object. The dynamic directory is searched for the one or more first object attribute-value pairs. A first attribute-value pair is identified from the one or more first object attribute-value pairs. The first attribute-value pair is different than the one or more attribute-value pairs associated with the plurality of objects. The dynamic directory is modified based on the first attribute-value pair. Modifying the dynamic directory includes at least one of adding the first object to the dynamic directory, deleting the first object from the dynamic directory, and modifying an attribute-value pair of the first object.

Abstract: Methods, systems, and computer program products for securing deployments using command analytics are provided herein. A computer-implemented method includes collecting command sequences sent from one or more applications to one or more of a distributed group of multiple devices within a network; detecting one or more invalid command sequences and/or one or more out-of-sequence command sequences among the collected command sequences, wherein said detecting comprises comparing the collected command sequences against a repository of historical data of valid command sequences pertaining to the distributed group of multiple devices within the network; generating an alert upon a determination that one of the collected command sequences does not match an entry in the repository; and performing one or more remedial actions based on the generated alert.

Abstract: A method, computer program product, and computer system for receiving, at a first node of a plurality of nodes in a distributed architecture, a request for at least one of a device and a service based upon, at least in part, an attribute of at least one of the device and the service. A query to resolve the request may be forwarded to a plurality of nodes in the distributed architecture. A probability of at least a portion of nodes of the plurality of nodes to resolve the query may be determined based upon, at least in part, a search routing mechanism. The request may be forwarded to a second node of at least the portion of nodes of the plurality of nodes based upon, at least in part, the second node having a higher probability to resolve the query than a third node of at least the portion of nodes of the plurality of nodes.

Abstract: A method, process, and associated systems for policy-based development and runtime control of mobile applications. Security objects that describe or enforce security policies are embedded into the source code of an enhanced application while the application is being developed. When a user attempts to launch the enhanced application on a mobile device, the security objects are updated to match a latest valid version of the objects stored on an enterprise server. The security objects may be further updated at other times. Global security policies, which affect the entire enterprise and which may deny the application permission to launch, are enforced by a global security policy stored within one of the updated security objects. If the application does run, application-specific security policies contained in the updated security objects modify application behavior at runtime in order to enforce application-specific security policies.

Abstract: Methods, systems, and computer program products for securing deployments using command analytics are provided herein. A computer-implemented method includes collecting command sequences sent from one or more applications to one or more of a distributed group of multiple devices within a network; detecting one or more invalid command sequences and/or one or more out-of-sequence command sequences among the collected command sequences, wherein said detecting comprises comparing the collected command sequences against a repository of historical data of valid command sequences pertaining to the distributed group of multiple devices within the network; generating an alert upon a deteimination that one of the collected command sequences does not match an entry in the repository; and performing one or more remedial actions based on the generated alert.

Abstract: In an approach for creating a machine-to-machine device model based on ontological relationship, one or more computer processors determine a plurality of characteristics of one or more machine-to-machine devices within a machine-to-machine communication environment. The one or more computer processors determine one or more ontological relationships between the one or more machine-to-machine devices and the plurality of characteristics of the one or more machine-to-machine devices. The one or more computer processors create a semantic device model, based, at least in part, on the one or more ontological relationships between the one or more machine-to-machine devices and the plurality of characteristics of the one or more machine-to-machine devices.

Abstract: In an approach for creating a machine-to-machine device model based on ontological relationship, one or more computer processors determine a plurality of characteristics of one or more machine-to-machine devices within a machine-to-machine communication environment. The one or more computer processors determine one or more ontological relationships between the one or more machine-to-machine devices and the plurality of characteristics of the one or more machine-to-machine devices. The one or more computer processors create a semantic device model, based, at least in part, on the one or more ontological relationships between the one or more machine-to-machine devices and the plurality of characteristics of the one or more machine-to-machine devices.

Abstract: A method, system and computer program product for controlling enterprise data on mobile devices. Data on a mobile device is tagged as being associated with either enterprise data or with personal data. Upon identifying the storage location of the tagged data and the identifier of the application that generated the tagged data, the tag, the storage location of the tagged data and the identifier of the application are stored in an index. A mobile agent residing on the mobile device may be directed by a mobile device management server of the enterprise to perform various actions (e.g., deleting, encrypting, backing-up) on the enterprise data using the index. In this manner, the enterprise has the ability to control their applications and data that resides on employees' mobile devices to ensure that such data is not lost or used in a manner that is contrary to the wishes of the employer.

Abstract: A method, system and computer program product for controlling enterprise data on mobile devices. Data on a mobile device is tagged as being associated with either enterprise data or with personal data. Upon identifying the storage location of the tagged data and the identifier of the application that generated the tagged data, the tag, the storage location of the tagged data and the identifier of the application are stored in an index. A mobile agent residing on the mobile device may be directed by a mobile device management server of the enterprise to perform various actions (e.g., deleting, encrypting, backing-up) on the enterprise data using the index. In this manner, the enterprise has the ability to control their applications and data that resides on employees' mobile devices to ensure that such data is not lost or used in a manner that is contrary to the wishes of the employer.

Abstract: A method, computer program product, and computer system for creating a dynamic directory of objects. A request to modify a dynamic directory of a plurality of objects is received. Each of the plurality of objects is associated with one or more attribute-value pairs. One or more first object attribute-value pairs is determined for a first object. The dynamic directory is searched for the one or more first object attribute-value pairs. A first attribute-value pair is identified from the one or more first object attribute-value pairs. The first attribute-value pair is different than the one or more attribute-value pairs associated with the plurality of objects. The dynamic directory is modified based on the first attribute-value pair. Modifying the dynamic directory includes at least one of adding the first object to the dynamic directory, deleting the first object from the dynamic directory, and modifying an attribute-value pair of the first object.

Abstract: Methods, systems, and computer program products for providing restricted access to given devices by constructing abstract devices are provided herein. A method includes generating a virtual device based on one or more physical devices; mapping multiple device actions of the one or more physical devices to multiple device actions of the virtual device exposed by the virtual device; incorporating (i) discretionary access control techniques, (ii) policy-based access control techniques, and (iii) a physical device-level partial ordering of actions to determine a resolution in response to a set of multiple user access requests for two or more of the multiple device actions of the virtual device; and executing the two or more device actions of the virtual device on the virtual device for one or more given users in accordance with said resolution by coordinating the execution of two or more corresponding device actions of the one or more physical devices on the one or more physical devices based on said mapping.

Abstract: Methods, systems, and computer program products for providing restricted access to given devices by constructing abstract devices are provided herein. A method includes generating a virtual device based on one or more physical devices; mapping multiple device actions of the one or more physical devices to multiple device actions of the virtual device exposed by the virtual device; incorporating (i) discretionary access control techniques, (ii) policy-based access control techniques, and (iii) a physical device-level partial ordering of actions to determine a resolution in response to a set of multiple user access requests for two or more of the multiple device actions of the virtual device; and executing the two or more device actions of the virtual device on the virtual device for one or more given users in accordance with said resolution by coordinating the execution of two or more corresponding device actions of the one or more physical devices on the one or more physical devices based on said mapping.

Abstract: A system is provided for securing data on a mobile device that supports both enterprise and personal applications. According to the technique, information flows and data accesses are tracked on the device at run-time to enable access control decisions to be performed based on a policy, such as an enterprise privacy policy that has been distributed to the device from an enterprise server. The policy may be updated by events at the device as well as at the enterprise server.

Abstract: In an approach for creating a machine-to-machine device model based on ontological relationship, one or more computer processors determine a plurality of characteristics of one or more machine-to-machine devices within a machine-to-machine communication environment. The one or more computer processors determine one or more ontological relationships between the one or more machine-to-machine devices and the plurality of characteristics of the one or more machine-to-machine devices. The one or more computer processors create a semantic device model, based, at least in part, on the one or more ontological relationships between the one or more machine-to-machine devices and the plurality of characteristics of the one or more machine-to-machine devices.

Abstract: In an approach for creating a machine-to-machine device model based on ontological relationship, one or more computer processors determine a plurality of characteristics of one or more machine-to-machine devices within a machine-to-machine communication environment. The one or more computer processors determine one or more ontological relationships between the one or more machine-to-machine devices and the plurality of characteristics of the one or more machine-to-machine devices. The one or more computer processors create a semantic device model, based, at least in part, on the one or more ontological relationships between the one or more machine-to-machine devices and the plurality of characteristics of the one or more machine-to-machine devices.

Abstract: A method, process, and associated systems for policy-based development and runtime control of mobile applications. Security objects that describe or enforce security policies are embedded into the source code of an enhanced application while the application is being developed. When a user attempts to launch the enhanced application on a mobile device, the security objects are updated to match a latest valid version of the objects stored on an enterprise server. The security objects may be further updated at other times. Global security policies, which affect the entire enterprise and which may deny the application permission to launch, are enforced by a global security policy stored within one of the updated security objects. If the application does run, application-specific security policies contained in the updated security objects modify application behavior at runtime in order to enforce application-specific security policies.

Abstract: A method, process, and associated systems for policy-based development and runtime control of mobile applications. Security objects that describe or enforce security policies are embedded into the source code of an enhanced application while the application is being developed. When a user attempts to launch the enhanced application on a mobile device, the security objects are updated to match a latest valid version of the objects stored on an enterprise server. The security objects may be further updated at other times. Global security policies, which affect the entire enterprise and which may deny the application permission to launch, are enforced by a global security policy stored within one of the updated security objects. If the application does run, application-specific security policies contained in the updated security objects modify application behavior at runtime in order to enforce application-specific security policies.