Systems and methods for hosting variable schema data such as dynamic tables and columns in a fixed physical database schema. Standard objects, such as tables are provided for use by multiple tenants or organizations in a multi-tenant database system. Each organization may add or define custom fields for inclusion in a standard object. Custom fields for multiple tenants are stored in a single field within the object data structure, and this single field may contain different data types for each tenant. Indexing columns are also provided, wherein a tenant may designate a field for indexing. Data values for designated fields are copied to an index column, and each index column may include multiple data types. Each organization may also define custom objects including custom fields and indexing columns. Custom objects for multiple tenants are stored in a single custom object data structure. The primary key values for the single custom object table are globally unique, but also include an object-specific identifier which may be re-used among different entities.

Custom entities and fields in a multi-tenant database system

A network-based mobile workgroup system has considerably wider appeal and application than normal virtual private networks in that it provides seamless mobility across a number of access technologies at the same time as it offers a granular security separation down to workgroup level. The mobile workgroup system is an access management system for mobile users with VPN and firewall functionality inbuilt. The mobile user can access the mobile workgroup system over a set of access technologies and select server resources and correspondent nodes to access pending their workgroup membership approvals. All workgroup policy rules are defined in a mobile service manager and pushed down to one or more mobile service routers for policy enforcement. The mobile service router closest to the mobile client, and being part of the mobile virtual private network, performs regular authentication checks of the mobile client during service execution. At the same time it performs traffic filtering based on the mobile user's workgroup memberships. Together, these two components constitute an unprecedented security lock, effectively isolating a distributed workgroup into a mobile virtual private network.

Network-based mobile workgroup system

A system providing methods for a device to apply a security policy required for connection to a network is described. In response to receipt of a request from a device for connection to a particular network, a current policy to apply to said device for governing the connection to this particular network is determined from a plurality of available security policies available to the device. This current policy to apply to said device is generated by merging a plurality of security policies available for governing connections. After said current policy is applied to the device, the connection from the device to this particular network is allowed to proceed.

System and methodology for security policy arbitration

A system and methodology for policy enforcement during authentication of a client device for access to a network is described. A first authentication module establishes a session with a client device requesting network access for collecting information from the client device and determining whether to authenticate the client device for access to the network based, at least in part, upon the collected information. A second authentication module participates in the session with the client device for supplemental authentication of the client device for access to the network. The supplemental authentication of the client device is based, at least in part, upon the collected information and a policy required as a condition for network access.

System and Methodology for Policy Enforcement

Techniques for creating policies for use in policy-based management of quality of service treatments of network data traffic flows are described. Policies are defined based on information about types of flows generated by an application and quality of service functions that are available in the network. Application information is received that defines flows generated by an application, including points where the application generates the traffic flows. QoS information is received that defines one of more quality of service treatments that the network device may apply to data processed by the network device. Based on the information, processing policies that associate the flows with the QoS treatments are determined. Mappings of the application information to the QoS treatments, which may be used to generate the quality of service value when the application program generates flows, are created and stored. Thus, the policies are informed both by application expertise and network expertise.

Method and apparatus for creating policies for policy-based management of quality of service treatments of network data traffic flows

A system and method for a multiple manager to multiple server Internet Protocol (IP) locking application in a directory-enabled network. The IP locking application is a component of a network management application and runs on each server device. The IP locking application processes requests from a network management application on two user-defined TCP/IP port numbers. The first port is designated as the status port and can be accessed by multiple network management applications and/or multiple users to determine the identification of the network management application and/or user that has control of the second port which is designated as the lock port. The status port is used to determine whether or not the server directory is currently being updated by another network management application or user. The lock port is used to actually lock the server device by forming a connection to the port and passing the user and network management application identifiers of the lock requester. Since the lock port is a TCP/IP port, only one connection can be active at a given time. The lock is normally released by disconnecting from the port.

Multiple manager to multiple server IP locking mechanism in a directory-enabled network

A system, method and program product for defining a Virtual Private Network (VPN) by the sum of a plurality of policy segments. Each policy segment is composed of a policy segment name, a policy segment type, a VPN device list, a policy template, a quality of service template and a connection type. The policy segment type can include Internet Protocol Security (IPsec), Differential Services (DiffServ) or Reservation Protocol (RSVP). The group of devices in a policy segment are it specified in a device list which is a collection of other device lists and/or device interface profiles. The group of common policy components are specified in a policy template. Policy templates contain the condition and action references that are used to generate policies for the policy segment. The condition reference includes a validity period and a traffic profile. The action reference includes at least one of an IPsec action, a DiffServ action or an RSVP action. The device list, connection type, and policy template are combined to generate all of the policies for a policy segment.

System and method for generation VPN network policies

A system and method for DEN/LDAP client database access with backoff capability. A current tree of directory information maintained at an LDAP server is used by LDAP clients to retrieve policy configuration information. When an LDAP client wishes to update policy configuration information, a new tree is created by cloning the current or a previous tree or by building a new tree. When the LDAP client is finished updating the new tree, the path for using LDAP clients is set to the new tree and the clients are requested to read LDAP policy configuration information using the new path. If the new tree of policy configuration information is found to be unsuitable, the clients' path is reset to the original tree and the clients are requested to read LDAP information policies using the reset path.

System and method for DEN/LDAP client database access with a backoff capability

A method, apparatus, computer product and structure is presented for representing and managing large amounts of information concerning networks of elements. While being useful for communication networks, it can be also usefully deployed in the context of other networks such as distribution and transportation networks. The method uses a hierarchical construct called “catalog”—a set of elements (which could be “atomic” elements or catalogs themselves)—to organize information about physical or abstract entities relevant for modeling the network. A matrix construct whose rows and columns constitute such elements are used to model connections at different levels of abstraction. A common framework and representation provided using these two constructs is shown to be useful for visualization, administration, configuration, modeling, monitoring and manipulation of the network.

Representing, configuring, administering, monitoring, and/or modeling connections using catalogs and matrixes

A system and method for multi-vendor mediation for subscription services is presented. A mediation server assigns customized “plug-ins” to particular network access servers (NAS) that allow a service provider application to use a single interface to communicate with multiple types of NASs. Vendor specific details of NAS transaction processing are hidden in the customized plug-ins implementations in which a service provider application has no knowledge of such transaction processing information. The mediation server extracts a user identifier from a call request, and uses the user identifier to select a mediation handler plug-in. The mediation server then uses the mediation handler plug-in to communicate with a particular NAS. In addition, a RADIUS server uses a NAS identifier to assign a RADIUS handler plug-in to a NAS session, and uses the assigned RADIUS handler plug-in to communicate with the NAS.

Bret Elliott Harrison

Papers

Multiple manager to multiple server IP locking mechanism in a directory-enabled network

System and method for generation VPN network policies

System and method for DEN/LDAP client database access with a backoff capability

Representing, configuring, administering, monitoring, and/or modeling connections using catalogs and matrixes

System and method for multi-vendor mediation for subscription services