More efficient querying of a multi-tenant database using dynamic tuning of database indices. A layer of meta-data associates data items with tenants, e.g., via tags, and the meta-data is used to optimize searches by channeling processing resources during a query to only those pieces of data bearing the relevant tenant's unique tag.

Query optimization in a multi-tenant database system

Organizing permissions to authorize a subject to perform an action on an object in a cloud computing environment is described. A plurality of permissions associated with a cloud customer is created. A first set of permissions from the plurality of permissions is associated with one or more objects. Each of the first set of permissions describes an action performed on an object. A second set of permissions from the plurality of permissions is associated with one or more users. Each of the second set of permissions describes an action to be performed by one or more users.

Organizing Permission Associated with a Cloud Customer in a Virtual Computing Infrastructure

A cloud computing environment having a plurality of computing nodes is described. A seed device is connected to a network. From the seed device, a launching of a cloud computing management configuration is initiated. The seed device includes a repository of software. From the seed device, software is installed on one of the plurality of computing nodes to run a cloud computing management system. The software is loaded from one of the plurality of computing nodes onto each of the plurality of nodes. A computing node is selected from the plurality of computing nodes, to designate as a master node. Operations of the cloud computing management system is controlled from the master node.

Building a Cloud Computing Environment Using a Seed Device in a Virtual Computing Infrastructure

A computer implemented method and system for protecting information and resources in an online environment is provided. A process initialization monitor application monitors process initialization of a client application provided on a user's communication device. The client application identifies and authenticates one or more components operating on the communication device and one or more third party applications attempting to access the client application. The client application performs the authentication by performing a code integrity check integrated in the client application independent of the communication device, and grants access to the authenticated components and the authenticated third party applications. The client application protects information being processed, exchanged, stored, and displayed within the client application. The client application masks input information, encrypts a communication channel that transfers the input information, blocks attempts to monitor, intercept and manipulate information by unauthorized entities, and prevents access of certificates, resources, etc., by unauthorized entities.

Online Protection Of Information And Resources

A kernel-level security agent is described herein. The kernel-level security agent is configured to observe events, filter the observed events using configurable filters, route the filtered events to one or more event consumers, and utilize the one or more event consumers to take action based at least on one of the filtered events. In some implementations, the kernel-level security agent detects a first action associated with malicious code, gathers data about the malicious code, and in response to detecting subsequent action(s) of the malicious code, performs a preventative action. The kernel-level security agent may also deceive an adversary associated with malicious code. Further, the kernel-level security agent may utilize a model representing chains of execution activities and may take action based on those chains of execution activities.

Kernel-level security agent

In certain embodiments, a method for providing information rights management (IRM) includes receiving, from a user having an associated security access profile, a request to access an object. The object has a corresponding IRM wrapper stored with the object both when the object is stored in a document management system (DMS) database and external to the DMS database, the IRM wrapper including an IRM profile and one or more IRM permission sets. The object also has encrypted data. The method further includes determining whether the user is authorized to access the object based on a comparison of the security access profile of the user and the IRM profile of the IRM wrapper corresponding to the object and communicating to the user, in response to a determination that the user is authorized to access the object, a decryption key associated with object.

Information rights management

A method for providing secure document management includes receiving a document from a user having an associated security access profile and generating a security label to be stored as an attribute of the document. The security label includes a clearance component selected from an authorized subset of clearance components that are determined based on the security access profile associated with the user, and also includes one or more secondary security components selected from an authorized subset of secondary security components that are determined based on the clearance component of the security label and the security access profile associated with the user. The method includes storing the document in a document repository storing a plurality of documents each having an associated security label, and determining whether a third-party user is authorized to access the document based on a comparison of a security access profile of the third-party user and the security label associated with the document.

Secure Document Management

A method for providing secure document management includes receiving a document from a user having an associated security access profile and generating a security label to be stored as an attribute of the document. The security label includes a clearance component selected from an authorized subset of clearance components that are determined based on the security access profile associated with the user, and also includes one or more secondary security components selected from an authorized subset of secondary security components that are determined based on the clearance component of the security label and the security access profile associated with the user. The method includes storing the doctunent in a document repository storing a plurality of documents each having an associated security label, and determining whether a third-party user is authorized to access the doctunent based on a comparison of a security access profile of the third-party user and the security label associated with the document.

Wendy S. Bartlett

Papers

Information rights management

Secure Document Management

Secure document managment