Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for storing data according to permissions. In general, one aspect of the subject matter described in this specification can be embodied in methods that include the actions of identifying a version of a data item to be stored; determining permissions associated with the version of the data item; and storing the version of the data item at a storage location that is based on the determined permissions.

Abstract: A method for enforcing computer-based file system security, the method comprising generating a content-based file system from files in a physical file system, and enforcing a user access right to any aspect of the content-based file system, where the user access right derives from a user access right to a file in the physical file system.

Abstract: In accordance with embodiments, there are provided mechanisms and methods for conditionally allowing an application of an entity access to data of another entity in an on-demand database service. These mechanisms and methods for conditionally allowing an application of an entity access to data of another entity in an on-demand database service can enable embodiments to limit such access to the data, as desired. Furthermore, embodiments of such mechanisms and methods may provide additional security when sharing data among different subscribers to an on-demand database service.

Abstract: An approach is provided for managing access rights of users to information spaces using signatures stored in a memory tag. A signature manager caused reading of a memory tag to initiate a request, from a device, for an initial access to an information space. The request includes an authorization signature associated with the device. The signature manager determines a level of access to the information space by comparing the authorization signature against a lattice of signature primitives associated with the information space. The signature manager then modifies the authorization signature based on the determination and stores the modified authorization signature for validation of subsequent access to the information space by the device.

Abstract: A method for automatic folder ownership assignment, including ascertaining which first folders, among a first multiplicity of folders, have at least one of modify and write permissions to non-IT administration entities, adding the first folders to a list of candidates for ownership assignment, defining a second multiplicity of folders which is a subset of the first multiplicity of folders and not including the first folders and descendents and ancestors thereof, ascertaining which second folders among the second multiplicity of folders, have permissions to non-IT administration entities, adding the second folders to the candidates, defining a third multiplicity of folders, which is a subset of the second multiplicity of folders and not including the second folders and descendents and ancestors thereof, ascertaining which third folders among the third multiplicity of folders are topmost folders, adding the third folders to the candidates, and recommending possible assignment of ownership of the candidates.

Abstract: An online sales/automatic rebate and coupon redemption system provides online customers automatic retrieval and redemption of all applicable rebates and coupons during purchase. Purchase orders from customers are selectively fulfilled and products are shipped to the customers either by the system for online sales with automatic rebate and coupon redemption or by other merchant or manufacturer environments. The system purchases from merchants using applicable coupons and rebates and then sells the products to the customers, passing the savings to them. The system makes it possible to automatically retrieve coupons and rebates for items in a shopping cart during the activity of an online purchase at an electronic mall or an online merchant site. The system provides coupons to potential customers via email, based on customer profile, geographical information, etc. Manufacturers and merchants can update coupon value and content based on ongoing sales and volume of customer activity.

Abstract: A module provides an interface between a multi-tenant database and a non-tenant-specific application instance such that the application instance sends data access commands to the module as if it is communicating with a single-tenant database. The module translates the non-tenant-specific data access command from the non-tenant-aware application into a multi-tenant data access command, as needed, without needing to alter the non-tenant specific application instance in any way. In this manner, a single-tenant application could be used by multiple tenants in a multi-tenant environment.

Abstract: A method of provisioning organization users in a multi-tenant database system includes receiving a request via a single sign-on protocol from an organization user to create a new multi-tenant database user account for access to the multi-tenant database system. The method retrieves rules that specify how to derive user permissions for access to the multi-tenant database system from stored user attributes of the organization user. The method continues with applying the rules to the stored user attributes to determine permissions for the users to access particular objects in the multi-tenant database system, and creating the new user account with the determined user permissions for access to the multi-tenant database system.

Abstract: A method or data processing system readable medium can be used for communications between a user and a network site. In one embodiment, the user may request personalization information including personalization rule(s) from the network site. The user can generate personalization logic based on the personalization information. In this manner, the user has better control over his or her personal information. The server computer at the network site may benefit because it does not have to generate the personalization logic for the user. Accordingly, the server computer at the network site may be able to accommodate more users or can respond to them faster.

Abstract: An IP server sends e-mail to a mobile device MS. This e-mail includes an application specifier that specifies startup of a Java application stored in mobile device MS and a data specifier that includes data used in operations executed by mobile device MS in accordance with a Java application. On the other hand, the ADF for the Java application stored in mobile device MS includes trusted source data containing a plurality of e-mail addresses that indicate trusted origins. Mobile device MS compares the e-mail transmission origin address with the trusted source data. Mobile device MS, only in the case where the transmission origin address of the received e-mail is included in the trusted source data, starts up a Java application based on an application specifier included in said e-mail, and uses data included in said data specifier in operations executed by that Java application.

Abstract: Methods and systems for providing current email addresses or contact information to members within a social network are described. In one described method, an email program application requests an email address for a member within a social network. Using profile information associated with the member, the email address is provided to the email program application which sent the request. The email address is then entered into the send-to parameter field of an email message. In another described method, contact information associated with a first member of a social can be provided to a second member of the social network. The contact information is provided if the relationship between the first and second members is an authorized relationship. The contact information associated with the first member can be used to update the contact information for the first member in an electronic address book associated with the second member.

Abstract: An online sales/automatic rebate and coupon redemption system provides online customers automatic retrieval and redemption of all applicable rebates and coupons during purchase. Purchase orders from customers are selectively fulfilled and products are shipped to the customers either by the system for online sales with automatic rebate and coupon redemption or by other merchant or manufacturer environments. The system purchases from merchants using applicable coupons and rebates and then sells the products to the customers, passing the savings to them. The system makes it possible to automatically retrieve coupons and rebates for items in a shopping cart during the activity of an online purchase at an electronic mall or an online merchant site. The system provides coupons to potential customers via email, based on customer profile, geographical information, etc. Manufacturers and merchants can update coupon value and content based on ongoing sales and volume of customer activity.

Abstract: An online sales/automatic rebate and coupon redemption system provides online customers automatic retrieval and redemption of all applicable rebates and coupons during purchase. Purchase orders from customers are selectively fulfilled and products are shipped to the customers either by the system for online sales with automatic rebate and coupon redemption or by other merchant or manufacturer environments. The system purchases from merchants using applicable coupons and rebates and then sells the products to the customers, passing the savings to them. The system makes it possible to automatically retrieve coupons and rebates for items in a shopping cart during the activity of an online purchase at an electronic mall or an online merchant site. The system provides coupons to potential customers via email, based on customer profile, geographical information, etc. Manufacturers and merchants can update coupon value and content based on ongoing sales and volume of customer activity.

Abstract: An online sales/automatic rebate and coupon redemption system provides online customers automatic retrieval and redemption of all applicable rebates and coupons during purchase. Purchase orders from customers are selectively fulfilled and products are shipped to the customers either by the system for online sales with automatic rebate and coupon redemption or by other merchant or manufacturer environments. The system purchases from merchants using applicable coupons and rebates and then sells the products to the customers, passing the savings to them. The system makes it possible to automatically retrieve coupons and rebates for items in a shopping cart during the activity of an online purchase at an electronic mall or an online merchant site. The system provides coupons to potential customers via email, based on customer profile, geographical information, etc. Manufacturers and merchants can update coupon value and content based on ongoing sales and volume of customer activity.

Abstract: A system and method for receiving a request for a container document, determining whether the request is for a container document associated with a user group, determining whether a requestor of the request is associated with a level of status within the user group among a plurality of levels of status within the user group, determining the level of status of the requestor based on a determination that the requestor is associated with a level of status within the user group, requesting configuration information based on a determination that the container document is associated with a user group and the level of status, receiving the configuration information, and serving the container document using the configuration information.

Abstract: A sales system supports sales between a plurality of buyers and a plurality of sellers in a communication network. A sales server has a seller interface used by both a first seller and a second seller respectively via a first seller's computer and a second seller's computer to register availability for sale of a first product and a second product. The sales server, based upon received buyer input from an identified buyer via a buyer computer that includes buyer orders for the first product and the second product dispenses a first sales order to the first seller's computer for the first product and a second sales order to the second seller's computer for the second product. The sales server provides instructions to the first seller's computer for fulfillment of the first sales order and to the second sales computer for the fulfillment of the second sales order.

Abstract: Promoting a candidate content item included in a plurality of content items is disclosed. A plurality of user reputation scores is received. For the candidate content item in the plurality of candidate content items, a content reputation score is determined based at least in part on a portion of the received user reputation scores. A determination of whether to promote the candidate content item is made based at least in part on the content reputation score. The candidate content item is promoted if it is determined that the candidate content item should be promoted.

Abstract: Promoting a candidate content item included in a plurality of content items is disclosed. A plurality of user reputation scores is received. For the candidate content item in the plurality of candidate content items, a content reputation score is determined based at least in part on a portion of the received user reputation scores. A determination of whether to promote the candidate content item is made based at least in part on the content reputation score and a dynamically adjusted threshold. The candidate content item is promoted if it is determined that the candidate content item should be promoted.

Abstract: A document management system includes a memory and a controller. The memory stores access privilege information configured to define, for each display style of a document element displayed in an electronic document, privileges of users or user groups regarding access to a document element having a display style. In response to a request from a user to perform an operation on a document element in an electronic document, the controller controls whether the operation is executed or not on the document element, using the access privilege information stored in the memory, in accordance with a privilege among privileges of the users or user groups for a display style of the document element, the privilege being a privilege of the user or a user group to which the user belongs.

Abstract: A database structure that may be used for semistructured databases assigns each node of a database to a collection. For each collection, create rights, retrieve rights, associate rights and dissassociate rights are provided to one or more users, the rights being assigned in common for all nodes of the collection. Users can only carry out the task if they have the appropriate rights. In this way, a flexible database security structure is provided that can deliver appropriate security for different elements of a semistructured database.

Abstract: Computer based systems, methods, software and databases are presented in which correlations between web item preferences and pangenetic (genetic and epigenetic) attributes of individuals are used for pangenetic based web item recommendation in which a user can request and receive personalized online recommendations of web items that are based on the user's pangenetic makeup. Data masking can be used to maintain privacy of sensitive portions of the pangenetic data.

Abstract: A security mediator, comprising an input configured to receive a user information request; an automated index, stored in a memory, configured to store information for determining which of a plurality of remote databases stores information responsive to the request; an automated security rule base, stored in a memory, containing rules applicable to information responsive to the request stored in the plurality of remote databases; a communication port configured to communicate to a plurality of remote databases which store information responsive to the request: security information, a query corresponding to the request and associated rules applicable to the information responsive to the request at the respective remote database; and at least one processor being configured to apply at least one security rule responsive to the query of the automated security rule base, and index information derived from a plurality of the remote databases, in a manner which permits application of the rules and which restricts ins

Abstract: The present invention is directed to a system, method and server to assist account issuers in managing risk, fraud and unauthorized use. A system, method and server for use in pushing advanced warning alerts to issuers based on consumer data element level triggering events and fraud and unauthorized use reports is disclosed. The ability to the push the alerts to issuers with a permissible purpose for receiving the information in the alerts provides a real-time, online and cost effective way of providing issuers with valuable risk management tools.

Abstract: According to one embodiment, a database system includes first, second and third storing units, and an image generating unit. The first storing unit stores a first data table that describes plural first data records respectively including information concerning plural information fields. The second storing unit stores a second data table that describes second data records each including plural kinds of attribute information respectively representing display attributes concerning the information fields. The third storing unit stores, concerning the information, display definition data that describes plural kinds of attribute information respectively representing display attributes set independently of the display attributes represented by the attribute information.

Abstract: According to one embodiment, a database system includes a first and second storage unit, a reading unit, and a generating unit. The first storage unit stores a first data table in which first data records, each including information about information fields, are described. The second storage unit stores a second data table in which second data records including pieces of attribute information, each representing a display attribute about the information field included in the first data record, are described. The reading unit reads out the first and second data records from the first and second storage units in accordance with the fact that displaying the information included in the first data table is requested. The generating unit generates an image for displaying the information included in the read first data record in accordance with the display attribute represented by the attribute information included in the read second data.

Abstract: An improved human user computer interface system, wherein a user characteristic or set of characteristics, such as demographic profile or societal “role”, is employed to define a scope or domain of operation. The operation itself may be a database search, to interactively define a taxonomic context for the operation, a business negotiation, or other activity. After retrieval of results, a scoring or ranking may be applied according to user define criteria, which are, for example, commensurate with the relevance to the context, but may be, for example, by date, source, or other secondary criteria. A user profile is preferably stored in a computer accessible form, and may be used to provide a history of use, persistent customization, collaborative filtering and demographic information for the user.

Abstract: A system for selecting and recording data, comprising: a local storage unit for storing a subset of media content items and other content; a content selection unit to display a catalog of the media content items and other content, to allow a customer to browse, search, and select a media content item and other content from the catalog of media content items and other content, to retrieve the selected media content item and other content from the local storage unit if the selected media content item and other content is found in the subset, and otherwise to retrieve the selected media content item from a remote storage unit, the content selection unit configured to cache the retrieved media content item and other content in the local storage unit for a period of time based on the popularity of the retrieved media content item; a financial transaction unit to determine the cost of the retrieved media content item and other content and display the cost for review and payment by the customer; and an authoring sys

Abstract: A technique authenticates a user of a massively multiplayer online role playing game (MMORPG). The technique involves establishing a user database containing user information describing the MMORPG user based on a set of first transmissions received from a game provider of the MMORPG. The technique further involves (i) receiving a second transmission from the game provider, the second transmission including an authentication request to authenticate the MMORPG user, and (ii) providing a response transmission to the game provider in response to the second transmission. The response transmission includes an authentication result based on an adaptive authentication operation involving the user database. The authentication result controls whether the game provider provides the MMORPG user with current access to the MMORPG.

Abstract: Methods and systems for facilitating the propagation of personal data include a Personal Data Propagation Environment (“PDP environment”) that facilitates the propagation of personal data items between secure personal data stores and various consumers of the personal data items. One PDP environment includes a personal data manager and a personal data subscriber. The personal data manager manages personal data items on a secure data store associated with a user computing device. The personal data manager provides access to personal data items stored on the secure data store in accordance with a personal data subscription associated with the personal data subscriber.

Abstract: A system and associated method for improving efficiency and data security of a relational database management system (RDBMS). Access path security is configured for respective users of the RDBMS, having either access-by-key or access-by-scan value. The access-by-key access path security requires an end user to specify a search key in a query as configured for the end user to service the query. Only few users with administrative capacity are configured with the access-by-scan access path security, which permits servicing queries in conventional ways without screening queries by scanning database. The RDBMS calculates the most efficient access path for the query received from the end user, and retrieves data requested by the query only when the calculated access path is permitted by the access path security for the end user.

Abstract: A system, computer-readable medium, and method for automatically determining if an applicant is qualified to perform a task are provided. In the method, an application including applicant identifier information identifying an applicant is received by a computing device. The applicant identifier information is extracted from the received application. A query to a database including the extracted applicant identifier information is created and sent to a database system using a network. The database system stores data associated with the extracted applicant identifier information. A response to the query is received from the database system using the network. The response includes data associated with the applicant's qualification to perform a task. Whether or not the applicant is qualified to perform the task is determined by comparing the data associated with the applicant's qualification to a predetermined qualification criterion.

Abstract: A method and system memory to store a logical process model defining a logically structured series of process activities in a process, and Service Level Agreement (SLA) profile information defining a pre-defined plurality of SLA profiles which are potentially applicable to respective process instances. Each SLA profile comprises at least one performance metric with respect to the process and/or at least one of the process activities. A rules engine queries case data with respect to a particular process instance, and automatically determines an applicable SLA profile based on the case data. The applicable SLA profile is then applied to the particular process instance, and may be altered during performance of the process instance in response to case data changes.

Abstract: A computer-implemented method of implementing information security. The method can include receiving a user input comprising a first user identifier and at least a second user identifier, determining whether the first user identifier corresponds to at least one of a plurality of existing user profiles, and determining whether the second user identifier corresponds to at least one of the plurality of existing user profiles. When it is determined that the first user identifier does not correspond to at least one of the plurality of existing user profiles, but that the second user identifier does correspond to at least one of the plurality of existing user profiles, the method can include selecting the user profile to which the second user identifier corresponds, automatically generating a unique user identifier, and associating the unique user identifier with the selected user profile.

Abstract: Embodiments of the invention related to access control to sensitive data records, and in particular need-to-know information access using quantified risk. In one aspect of the invention access control includes retrieving a list of accesses to data by a plurality of users for a certain purpose during a specified period of time. The access patterns are derived based on said accesses and the derived access patterns are stored. A risk score is computed, for each of the plurality of users based on each of the plurality of users' need to access the data for said certain purpose, and the risk scores are stored. An aggregated total risk score for each of the plurality of users is created based on each respective user's computed risk score in a specified number of recent periods of time. A risk tolerance threshold is determined based on the aggregated total risk score for each of the plurality of users.

Abstract: Systems and methods consistent with the invention may include providing an instance of business process management suite in a sandbox of a web browser. The instance of the business process management suite may be based on an archive received from a web server. The business process management suite may be controlled using a graphical user interface in a browser. Providing a business process management suite may further include creating an instance of a database management system in the sandbox. The instance of the database management system may further store its data in the local memory of a client device.

Abstract: Aspects of the invention relate to sharing content stored on an object addressable storage (OAS) system among a plurality of users of the OAS system and authenticating users to an OAS system. In some embodiments, a user may store content units on the OAS system and control access by other users to these content units. In some embodiments, when a user grants one or more other users access to a content unit stored on the OAS system, the OAS system may send a notification of grant of access to the other user(s).

Abstract: A method and system for registering and activating content are described. Ownership of instances of content is registered in a registry of accounts associated with various users. Responsive to a user selecting an instance of content from a content distributor, the user's account is updated by adding therein an identifier uniquely associated therewith. Responsive to the user requesting access to an instance of content, the identity of the user is authenticated. The request conveys a unique identifier of the instance of content and a key for activating the content. The content activating key is compared with the registry to identify the user's ownership level in the instance of content. Upon associating the user identity with the user's ownership level, the instance of content is activated to allow the user to access the instance of content according to the corresponding ownership level.

Abstract: Systems and methods for pre-configuring a media device or other information handling system so as to be authorized to gain access to one or more destination networks. Pre-configuring the device includes determining what admission requirements the destination network providers require for access and then generating and providing to the media device a network admission coupon that includes the required information. In some embodiments this may be accomplished by a service center, which removes the need for additional authentication steps to be performed by the media device or the destination network providers.

Abstract: A method and system for automated document registration. The method and system provide an automatic document registration system that creates a secure transformed electronic document with an unalterable time and date stamp. Multiple third-parties are provided an ability to view a given original document in secure transformed electronic document format and each original individual document is provided with a unique set of approved third-party viewer/receivers/auditors via a virtual matrixed file system.

Abstract: Embodiments are directed to facilitating data transfer using an anonymous directory and to providing attribute-based data access to identified users. In an embodiment, a computer system instantiates an anonymous directory that stores data in various client-specific directories for different clients. The anonymous directory is configured to provide data access according to access controls defined and managed by the client. The computer system receives a data request from a user that identifies the user and specifies a portion of data that is to be returned to the user. The computer system determines which of the client's data is to be returned to the user based on the client's specified access controls. The access controls grant access to specified data in some of the client-specific directories, based on the user's identity. The computer system then provides the determined data to the user.

Abstract: A computer system for identifying an individual using a biometric characteristic of the individual includes a biometric sensor for generating a first code, and a controller including a memory for storing the first code and a dynamic binary code conversion algorithm. When the controller receives a sensor code from the biometric sensor, it compares the sensor code with the first code stored in the memory, and if the identity between the sensor code and the first code is verified, the controller generates a first binary code by means of the dynamic binary code conversion algorithm and outputs the first binary code from which the computer system generates a second binary code by means of the dynamic binary code conversion algorithm. The computer system then verifies the identity of the individual if the second binary code matches the first binary code.

Abstract: An access control list, indicating contents of user operatable authorization, is set in an electronic file or folder stored in a document management server. The server receives from MFP a registering electronic file, location information of the electronic file and destination information including a notification destination user to which registration is notified. If no notification destination user is registered in ACL, the server transmits the notification of registration and the electronic file to PC of the notification destination user and receives a notification of electronic file reception from PC. The server sends the user in ACL a notification of notification destination user's reception of electronic file.

Abstract: In accordance with embodiments, there are provided mechanisms and methods for creating, exporting, viewing and testing, and importing custom applications in a multitenant database environment. These mechanisms and methods can enable embodiments to provide a vehicle for sharing applications across organizational boundaries. The ability to share applications across organizational boundaries can enable tenants in a multi-tenant database system, for example, to easily and efficiently import and export, and thus share, applications with other tenants in the multi-tenant environment.

Abstract: A method and system for providing an automated security access policy in a document management system are described. The security policies are applied based on metadata rules. Once a document is added to the document managements system, the metadata rules are evaluated using the metadata of the document. Based on the results of the evaluation security access policies are applied to the document.

Abstract: Methods, systems, and apparatus, including computer program products, for personalized term importance evaluation in natural language queries are disclosed. The personalized term importance evaluation utilizes a personalized profile tree constructed using search history associated with a user. The personalized profile tree is a hierarchy of nodes representing categories of information that the user has previously searched or selected from search results. When a search query is received from the user, each term and phrase in the search query is compared against the nodes in the personalized profile tree, and an importance score is given to the search term or phrase based on the depth of a matching node in the tree, and a child count for the matching node. An alternative query can be generated from a subset of the search terms that have respective importance scores exceeding a predetermined threshold.

Abstract: A critical parameter/requirements management process model for managing a development program for a product and an associated product structure-driven critical parameter/requirements management tool and environment is provided. In one embodiment, the process includes a product structure classification scheme, a parameter/requirements classification scheme, a parameter/requirements process and maturity model, and in-process and requirements conformance views. In one embodiment, the tool includes a user interface layer, a business layer, a data layer, and a database. The user interface layer may include a product structure feature group, an add/edit/link feature group, a manage maturity feature group, and a manage conformance feature group. The tool may be implemented as a web server accessible to user workstations operating as thin clients.

Abstract: A module provides an interface between a multi-tenant database and a non-tenant-specific application instance such that the application instance sends data access commands to the module as if it is communicating with a single-tenant database. The module translates the non-tenant-specific data access command from the non-tenant-aware application into a multi-tenant data access command, as needed, without needing to alter the non-tenant specific application instance in any way. In this manner, a single-tenant application could be used by multiple tenants in a multi-tenant environment.

Abstract: This description provides tools and techniques for Web-enabled database access tools. These tools may provide systems that include database access tools that provide at least one level of abstraction between external databases and users of the access tools. The systems may also include one or more internal databases maintained by the tool, with the internal database storing respective login information associated with the users. The login information may enable the users to access the tool without providing direct access to the external databases.

Abstract: Various embodiments of the invention may provide a method for operating a REST web service operable to search one or more data sources. In some embodiments, the invention may comprise receiving a query directed to a first data source, wherein the first data source defines at least one characteristic of at least one first data object returned by the query. Some embodiments of the invention may comprise querying the first data source. Various embodiments of the invention may comprise receiving at least one first data object from the first data source in response to querying the first data source. In some embodiments, the invention may comprise retrieving linked relationships between the at least one first data object and one or more second data objects from a second data source. Some embodiments of the invention may comprise querying the second data source for information on the one or more second data objects.

Abstract: The invention provides an information processing apparatus and a system environment setting method thereof capable of changing over profiles flexibly and preventing failure to return to the original profile if the time zone desired to change over the profiles of the information processing apparatus is irregular or if the schedule is suddenly changed.