An execution architecture, a development architecture and an operations architecture for a netcentric computing system. The execution architecture contains common, run-time services required when an application executes in the netcentric computing system. The development architecture is the production environment for one or several systems development projects as well as for maintenance efforts. The purpose of the development environment is to support the tasks involved in the analysis, design, construction, and maintenance of business systems, as well as the associated management processes. It is important to note that the environment should adequately support all the development tasks, not just the code/compile/test/debug cycle. The operations architecture is a combination of tools and support services required to keep a production system up and running efficiently.

Architectures for netcentric computing systems

A system and method for maintaining security in a distributed computing environment comprises a policy manager located on a server for managing and distributing a security policy, and an application guard located on a client for managing access to securable components as specified by the security policy. In the preferred embodiment, a global policy specifies access privileges of the user to securable components. The policy manager may then preferably distribute a local client policy based on the global policy to the client. An application guard located on the client then manages access to the securable components as specified by the local policy.

System and method for maintaining security in a distributed computer network

Systems and methods are described for performing policy-managed, peer-to-peer service orchestration in a manner that supports the formation of self-organizing service networks that enable rich media experiences. In one embodiment, services are distributed across peer-to-peer communicating nodes, and each node provides message routing and orchestration using a message pump and workflow collator. Distributed policy management of service interfaces helps to provide trust and security, supporting commercial exchange of value. Peer-to-peer messaging and workflow collation allow services to be dynamically created from a heterogeneous set of primitive services. The shared resources are services of many different types, using different service interface bindings beyond those typically supported in a web service deployments built on UDDI, SOAP, and WSDL. In a preferred embodiment, a media services framework is provided that enables nodes to find one another, interact, exchange value, and cooperate across tiers of networks from WANs to PANs.

Interoperable systems and methods for peer-to-peer service orchestration

Methods and apparatus for delivery of packetized content (e.g., video, audio, data, etc.) over a content delivery network. In one embodiment, the content is packetized using an Internet Protocol (IP), and delivered by a service provider over both managed and unmanaged networks to subscribers of the provider, so as to provide delivery at any time, at any location, and via any designated user device. The delivered content may originate from the service provider, third-party content sources (e.g., networks or studios), the subscriber(s) themselves, or other sources including the Internet. Use of a common control and service functions within the network afford the ability to integrate or blend services together, thereby affording the service provider and subscriber new service and economic opportunities. Content delivery sessions may also be migrated from one device to another. A network-based user interface infrastructure, and gateway-based client-side architecture, are also disclosed.

Methods and apparatus for packetized content delivery over a content delivery network

A scalable access filter that is used together with others like it in a virtual private network to control access by users at clients in the network to information resources provided by servers in the network. Each access filter use a local copy of an access control data base to determine whether an access request made by a user. Changes made by administrators in the local copies are propagated to all of the other local copies. Each user belongs to one or more user groups and each information resource belongs to one or more information sets. Access is permitted or denied according to of access policies which define access in terms of the user groups and information sets. The rights of administrators are similarly determined by administrative policies. Access is further permitted only if the trust levels of a mode of identification of the user and of the path in the network by which the access is made are sufficient for the sensitivity level of the information resource. If necessary, the access filter automatically encrypts the request with an encryption method whose trust level is sufficient. The first access filter in the path performs the access check and encrypts and authenticates the request; the other access filters in the path do not repeat the access check.

Distributed administration of access to information

A SYSTEM, METHOD AND ARTICLE OF MANUFACTURE FOR CONTROLLING ACCESS TO OBJECTS IN AN INFORMATION HANDLING SYSTEM EMPLOYING OBJECT ORIENTED TECHNOLOGY, INCLUDES ONE OR MORE PROCESSORS , A MEMORY SYSTEM, ONE OR MORE I/O CONTROLLERS EACH CONTROLLING ONE OR MORE I/O DEVICES, A BUS CONNECTING THE PROCESSORS, THE MEMORY SYSTEM AND THE I/O CONTROLLERS, AN OPERATING SYSTEM CONTROLLING OPERATION OF THE PROCESSORS, THE MEMORY SYSTEM AND THE I/O CONTROLLERS, AND AN OBJECT ORIENTED CONTROL MEANS WHICH INCLUDES A BEFOREAFTER METACLASS HAVING A CONTROL ELEMENT WHICH IS USED TO CONTROL ACCESS TO OBJECTS A SECURE METACLASS IS DEFINED TO BE A SUBCLASS OF THE BEFOREAFTER METACLASS THE SECURE METACLASS OVERRIDES THE BEFORE METHOD TO PERFORM AUTHORIZATION CHECKING PRIOR TO METHOD DISPATCHING

System, method and article of manufacture for access control on method invocation on a protected object in an object oriented system

Identification and access control for an end user mobile device (600) in a disconnected mode environment is provided. The mobile device is provided with a 'long term' token, which is obtained from an identity provider (602) coupled to the network. The token may be valid for a given time period. During that time period, the mobile device can enter a disconnected mode but still obtain a mobile device-aided function (e.g., access to a resource) by presenting for authentication the long term token. Upon a given occurrence (e.g., loss of or theft of the mobile device) the long term token is canceled to restrict unauthorized further use of the mobile device in disconnected mode.

Identification and access control of mobile devices in a disconnected mode environment

The "amr" (Authentication Methods References) claim is defined and
registered in the IANA "JSON Web Token Claims" registry, but no
standard Authentication Method Reference values are currently defined.
This specification establishes a registry for Authentication Method
Reference values and defines an initial set of Authentication Method
Reference values.

Anthony Nadalin

Papers

System, method and article of manufacture for access control on method invocation on a protected object in an object oriented system

Identification and access control of mobile devices in a disconnected mode environment

Authentication Method Reference Values