An architecture and methodology for designing, deploying, and managing a distributed application onto a distributed computing system is described.

Architecture for distributed computing system and automated design, deployment, and management of distributed applications

In a first exemplary media implementation, one or more processor-accessible media include processor-executable instructions that, when executed, direct a system to perform actions that include: accumulating host status information at multiple hosts; and sending the accumulated host status information from the multiple hosts In a second exemplary media implementation, one or more processor-accessible media include processor-executable instructions that, when executed, direct a system to perform actions that include: receiving host status information from multiple hosts; and making load balancing decisions responsive to the received host status information In a third exemplary media implementation, one or more processor-accessible media include processor-executable instructions that, when executed, direct a system to perform actions that include: determining health and load information on a per application basis; and selecting an application from among multiple applications responsive to the health and load information

Network load balancing with host status information

In a first exemplary implementation, one or more processor-accessible media include processor-executable instructions that, when executed, direct a system to perform actions including: receiving host status information from multiple hosts; and making load balancing decisions responsive to the received host status information. In a second exemplary implementation, a system includes: session tracking infrastructure that is adapted to acquire session information; and load balancing infrastructure that is adapted to utilize the session information when routing connection requests to multiple hosts. In a third exemplary implementation, one or more processor-accessible media include processor-executable instructions that, when executed, direct a system to perform actions including: acquiring session information for multiple session contexts from one or more applications that established the multiple session contexts; and routing network traffic to the one or more applications responsive to the acquired session information.

Network load balancing with session information

The invention provides a method, apparatus, computer readable medium and signal which allows the usage of devices containing PKl private keys such as PKI- enabled smart cards or USB sticks to authenticate users and to sign transactions. The authenticity of the user and/or the message is verified. Furthermore the operation (authentication and/or signing) occurs without the need for an application to have some kind of a direct or indirect digital connection with the device containing the private key. In other words a digital connection that would allow an application to submit data to the card for signing by the card's private key and that would allow retrieving the entire resulting signature from the card is not required. In addition the operation occurs without the need for the PKI-enabled device containing the private key (e.g. a PKI smart card or USB stick) to either support symmetric cryptographic operations or to have been personalized with some secret or confidential data element that can be read by a suitable reader.

Remote authentication and transaction signatures

In an exemplary media implementation, one or more processor-accessible media include processor-executable instructions that, when executed, enable a system to facilitate actions including: operating network load balancing infrastructure in a first configuration; scaling out the network load balancing infrastructure; and operating the scaled-out network load balancing infrastructure in a second configuration. In another exemplary media implementation, one or more processor-accessible media include processor-executable instructions that, when executed, enable a system to be configured such that different percentages of system resources may be allocated to different network-load-balancing functions. In yet another exemplary media implementation, one or more processor-accessible media include processor-executable instructions for network load balancing that, when executed, enable a system to gradually increase a percentage of total computing resources that is devoted to the network load balancing. Other implementations are described herein.

Flexible network load balancing

A token device that generates and displays one-time passwords and couples to a computer for inputting or receiving data for generating and outputting one-time passwords and performing other functions is provided. The token includes an interface for coupling to a computer. The token may also be coupled to any network that the computer may be connected to, when coupled to the computer. Data and information may be transmitted between the computer and token, and between the network and token, via the computer and interface. The data and information may include one-time password seeding, file transfer, authentication, configuration and programming of the token. The token must be seeded to generate and display one-time passwords. An original, or seed, value is loaded into the token. One-time passwords are subsequently generated or calculated, or both, from the seed value. Seeding of the token involving a counter, time, or time-related functions, may allow synchronization of the token with such functions. The token may support different authentication methods.

Token device that generates and displays one-time passwords and that couples to a computer for inputting or receiving data for generating and outputting one-time passwords and other functions

A method and apparatus for dynamically generating data encryption keys for encrypting data files and for decrypting encrypted data files via a key exchange method is provided. A dynamically generated an encryption key is generated for each encryption event, so that the key cannot be produced or reproduced. A key exchange component of the invention ensures that only an intended recipient has the means to decrypt a file encrypted with the dynamically generated symmetric encryption keys.

Method and Apparatus for Dynamic Generation of Symmetric Encryption Keys and Exchange of Dynamic Symmetric Key Infrastructure

A system and method of data encryption and decryption for controlling access to a data storage device such as a hard disk drive or optical drive is provided. The invented method utilizes data encryption and decryption techniques, combined with a token device, to control access to data stored on the data storage device.

Method and system for controlling access to data stored on a data storage device

A system and method for controlling access to multiple public networks and for controlling access to multiple private networks is provided. Authentication is used with unique public shared secrets and unique private shared secrets to control access to the networks. The invention includes a user device for communicating with at least a public network and/or a private network. The device may be capable of accessing multiple networks through one or more private networks with multiple access control servers. The user device must provide a correct response to each access control server, before access to the network may be granted. The device generates a one-time password, or response, to gain access to a controlled network server. The response generated by the device is matched to a response generated by an access control server that may have generated a challenge that prompted the response. If the two responses match, the device is authenticated and a user of the device is granted access to the network server.

System and method for controlling access to multiple public networks and for controlling access to multiple private networks

A system and method for strong access control to a network is provided. An access control server and authentication device are provided for controlling access to a network. The access controlled by the access control server may include network protocols, network resources, and electronic devices that may be coupled to the network. Network resources may include data stored on the network. The access control server may grant access to the network to a user based upon a correct response received from an authentication device assigned to the user. The user may be able to access only selected data that may be determined by an access level assigned to the authentication device. Upon authentication, the authentication device must remain active to maintain a network session. The authentication device becomes inactive when it is deactivated, uncoupled from the network, or in any mode in which the device cannot produce a response to the access control server. The network session ends when it is determined that the authentication device is inactive.

Henry Hon

Papers

Token device that generates and displays one-time passwords and that couples to a computer for inputting or receiving data for generating and outputting one-time passwords and other functions

Method and Apparatus for Dynamic Generation of Symmetric Encryption Keys and Exchange of Dynamic Symmetric Key Infrastructure

Method and system for controlling access to data stored on a data storage device

System and method for controlling access to multiple public networks and for controlling access to multiple private networks

System and method for strong access control to a network