A computing environment with methods for monitoring access to an open network, such as a WAN or the Internet, is described. The system includes one or more clients, each operating applications or processes (e.g., Netscape Navigator™ or Microsoft Internet Explorer™ browser software) requiring Internet (or other open network) access (e.g., an Internet connection to one or more Web servers). Client-based monitoring and filtering of access is provided in conjunction with a centralized enforcement supervisor. The supervisor maintains access rules for the client-based filtering and verifies the existence and proper operation of the client-based filter application. Access rules which can be defined can specify criteria such as total time a user can be connected to the Internet (e.g., per day, week, month, or the like), time a user can interactively use the Internet (e.g., per day, week, month, or the like), a list of applications or application versions that a user can or cannot use in order to access the Internet, a list of URLs (or WAN addresses) that a user application can (or cannot) access, a list of protocols or protocol components (such as Java Script™) that a user application can or cannot use, and rules to determine what events should be logged (including how long are logs to be kept). By intercepting process loading and unloading and keeping a list of currently-active processes, each client process can be checked for various characteristics, including checking executable names, version numbers, executable file checksums, version header details, configuration settings, and the like. With this information, the system can determine if a particular process in question should have access to the Internet and what kind of access (i.e., protocols, Internet addresses, time limitations, and the like) is permissible for the given specific user.

System and methodology for managing internet access on a per application basis for client computers connected to the internet

A communication system providing telephony communication across combined circuit switched and packet switched networks, such as a telephone network and the Internet, which are connectable to terminals, such as telephones and computers, for selective communication therebetween. The communication system includes an authorization and account control object in the packet switched network, multiple gateways between the circuit switched and packet switched networks providing controlled connectivity between those networks, and an information retrieval object in the packet switched network, wherein the authorization and account control object maintains a substantially real time record of user accounts and usage, and the information and retrieval object provides substantially real time retrieval of selected information from the authorization and account control object. The retrieval object provides on demand to terminals which provide authentication for access to an identified account information regarding that account. The information regarding the account is substantially real time information including information with respect to communications in progress, which are chargeable to the account which has been authenticated. The authorization and account control object is preferably a unitary logical object having distributed instances thereof handling multitudinous accounts of widely separated terminals. The retrieval object provides isolation of the authorization and account control object permitting simultaneous multitasking by the authorization and account control object and the retrieval object respectively.

Network session management

A system and method for searching for documents within spaces in a distributed computing environment are provided. A client sends a lookup message to a space which stores documents. The lookup message may specify desired characteristics, such as a name or partial XML schema, of the stored documents. The documents may include XML service advertisements and XML device advertisements as well as general-purpose XML documents. A set of zero or more documents which match the lookup message are discovered. In one embodiment, the lookup message may include a desired name. If the lookup message includes both a desired name and a desired schema, the set of discovered documents may include both discovered documents having a name that matches the desired name and discovered documents having a schema that matches the desired schema. If the lookup message includes neither a desired name nor a desired schema, the set of discovered documents may include substantially all the documents stored in the space. After the matching documents are found, the space may send a lookup response message to the client. For each discovered document, the lookup response message may include a name and an advertisement. Each advertisement may include information which is usable by the client to obtain the respective discovered document or access the resource (e.g., a service) that the document advertises. The advertisements and messages may be expressed in a data representation language such as XML.

Mechanism and apparatus for using messages to look up documents stored in spaces in a distributed computing environment

A system providing methods for a device to apply a security policy required for connection to a network is described. In response to receipt of a request from a device for connection to a particular network, a current policy to apply to said device for governing the connection to this particular network is determined from a plurality of available security policies available to the device. This current policy to apply to said device is generated by merging a plurality of security policies available for governing connections. After said current policy is applied to the device, the connection from the device to this particular network is allowed to proceed.

System and methodology for security policy arbitration

A system and methodology for policy enforcement during authentication of a client device for access to a network is described. A first authentication module establishes a session with a client device requesting network access for collecting information from the client device and determining whether to authenticate the client device for access to the network based, at least in part, upon the collected information. A second authentication module participates in the session with the client device for supplemental authentication of the client device for access to the network. The supplemental authentication of the client device is based, at least in part, upon the collected information and a policy required as a condition for network access.

System and Methodology for Policy Enforcement

An object oriented distributed computing system is provided. Processing means call a location service within automatically generated stubs in response to a request for a service provided by a particular object. The location service is automatically called on behalf of the requester to locate the target object when the request is issued. Multiple Object Managers reflecting multiple Object Models are permitted in the system. Programmers and users do not need to know the Object Model adhered to by an Object Manager. A request to any object in the system is independent of the Object Model of the sought object's Object Manager. A generic interface enables new Object Managers reflecting new Object Models to be easily added to the system. Availability of the target object is independent of association of the target object with a process at the time the request was issued. Deactivation of processes is automatically accomplished in response to the system needing resources.

Object oriented distributed computing system processing request to other object model with code mapping by object managers located by manager of object managers

An object oriented distributed computing system (11) is provided. Processing means (15) call a location service (21) within automatically generated stubs in response to a request for a service provided by a particular object (13). The location service (21) is automatically called on behalf of the requester to locate the target object (13) when the request is issued. Multiple Object Managers (23) reflecting multiple Object Models are permitted in the system (11). Programmers and users do not need to know the Object Model adhered to by an Object Manager (23). A request to any object in the system (11) is independent of the Object Model of the sought object's Object Manager (23). A generic interface enables new Object Managers (23) reflecting new Object Models to be easily added to the system (11). Availability of the target object (13) is independent of association of the target object (13) with a process (39) at the time the request was issued. Deactivation of processes (39) is automatically accomplished in response to the system (11) needing resources.

Lamar D Smith

Papers

Object oriented distributed computing system processing request to other object model with code mapping by object managers located by manager of object managers

Object oriented distributed computing system

Objektorientiertes verteiltes Rechnersystem