Novell, Inc.

Apple Inc.

Other

Microsoft Technology Licensing, LLC

Novell Intellectual Property Holdings, Inc.

Andrew A Hodgkinson

Daniel S Sanders

James Gerald Sermersheim

Duane Fredrick Buss

Patrick R Felsted

Thomas E Doman

James Mark Norman

Scott W Pathakis

James R Davis, Iii

W Brent Bradshaw

Brian L Jensen

Dale Robert Olds

Jeffrey S Pinkston

Alan Thomas Gavin Jowett

Lance Vernon Crandall

Stephen R Carter

Lloyd Leon Burch

Russell T Young

Steven S McLain

Matthew Ryan

Tom Doman

Brian Hawkins

A method of and system for utilizing an access token to authenticate a client device for accessing a resource server include generating a session key for a communication session between the device and a resource server, deriving a nonce from the session key, and transmitting a request to an identity platform for authenticating the device to access the resource server, where the request includes the nonce. Upon confirmation of authentication, the method and system may include receiving an access token from the identity platform, the access token including information that confirms authentication of the device, and transmitting the access token to the resource server to enable access to the resource server, where the access token includes the nonce.

Method and system of securing VPN communications

A computer implemented method may include identifying a base information card stored on a client, determining whether an overlay information card is to be applied to the identified base information card, and selecting the overlay information card. The method may also include generating a final information card by applying the selected overlay information card to the identified base information card.

Information card overlay

A computer-implemented method can include selecting an information card from a group of identified information cards, selecting a persona from a group of identified personae that are associated with the selected information card, and generating a Request for Security Token (RST) based on the selected information card and the selected persona.

Multiple persona information cards

A client includes a card selector, and receives a security policy from a relying party. If the client does not have an information card that can satisfy the security policy, the client can define a virtual information card, either from the security policy or by augmenting an existing information card. The client can also use a local security policy that controls how and when a virtual information card is defined. The virtual information card can then be used to generate a security token to satisfy the security policy.

System and method for virtual information cards

The user can associate metadata with information cards. The metadata can include, among other possibilities, string names, icons, user policies, containers, and hierarchies. The metadata is stored by the computer system. The metadata can then be used to filter the set of information cards that can satisfy a security policy from a relying party.

Credential categorization

A selector daemon can run in the background of a computer. Applications that are capable of processing information cards directly, without requiring the use of a card selector, can request the selector daemon to list information cards that satisfy security policy. Upon receiving such a request, selector daemon can determine the information cards available on the computer that satisfy the security policy, and can identify these information cards to the requesting application. The applications can then use the identified information cards in any manner desired, without having to use a card selector: for example, by requesting a security token based on one of the information cards directly from an identity provider.

System and method for application-integrated information card selection

A string matching system is described herein that provides for very fast and efficient pattern matching against large sets of certain types of pattern strings. If a set of pattern strings is comprised of strings that can be logically divided into segments, these pattern strings can be stored efficiently in a tree-like data structure, segment by segment, storing pattern-match syntax segments separately from literal string segments. After segmentation, individual match candidate strings are compared, segment by segment, against elements in the tree. The system uses a data structure that is conceptually a combination of a tree and a hash table. Using a hash table to implement the branching elements at each level in the tree contributes to quick matching speed at each level. By consistently separating strings into segments, the system can also share storage locations for like elements in the data structure.

Efficient string pattern matching for large pattern sets

A user defines an audit policy. The audit policy identifies one or more triggers that, when related information is included in a security token, trigger the performance of the audit. The audit can include notifying the user in some manner that the trigger occurred. The audit can require in-line confirmation of the audit, so that the security token is not transmitted until the user confirms the audit.

Policy-based auditing of identity credential disclosure by a secure token service

A user engages in a transaction with a relying party. The relying party requests identity information from the user in a security policy and identifies transaction elements for an on-line business transaction. Typically, the security policy and transaction elements are transmitted together; the security policy can be as little as a request to conduct the on-line business transaction. The user identifies an information card that satisfies the security policy. The computer system requests a security token from the identity provider managing the information card, which can include requesting a transaction receipt for the transaction elements. The computer system then returns the security token (and the transaction receipt) to the relying party, to complete the transaction.

Performing a business transaction without disclosing sensitive identity information to a relying party

An accessor function interfaces among a client, a relying party, and an identity provider. The identity provider can 'manage' personal (i.e., self-asserted) information cards on behalf of a user, making the personal information cards available on clients on which the personal information cards are not installed. The client can be an untrusted client, vulnerable to attacks such as key logging, screen capture, and memory interrogation. The accessor function can also asked as a proxy for the relying party in terms of invoking and using the information cards system, for use with legacy relying parties.

Remotable information cards

An information card overlay system can include a base card having multiple claims, an overlay card storing an overlay claim, and an overlay module that can be used to apply the overlay card to the base card. A computer-implemented method can include selecting a base card having multiple claims, selecting an overlay card storing an overlay claim, and applying the overlay card to the base card.

When a user connects a pluggable card store to a machine, the machine plugs a pluggable card provider into a card provider registry. The pluggable card store can be an object portable to the user, or can be a remote store available via some connection, such as an FTP connection. The user can then use the information cards stored on the pluggable card store in a transaction.

Framework and technology to enable the portability of information cards

A system and method is presented for database restoration in a distributed data system. The distributed data system has a first database on a first server which needs restoration. The first database is first restored with a predetermined full backup file, the full backup file being made at a first predetermined time. The first database is then restored with one or more incremental backup files, the incremental backup files being made since the first predetermined time and having the most recent backup file made at a second predetermined time. A transaction log documenting data transactions since the second predetermined time is then examined. One or more transactions listed in the transaction log after the second predetermined time are then executed since they are not included in the incremental backup files. To verify whether the restored first database has completed its restoration, a transitive vector of the first database is compared with a transitive vector of a second database on a second server of the distributed database system, wherein the second database and the restored first database are expected to be the same.

Growing community of inventors

Pleasant Grove, UT, United States of America

Andrew A Hodgkinson