Sun Microsystems, Inc.

Benjamin H Stoltz

James Gregory Hanko

Martin Patterson

Shriram Krishnan

Jayaraman Manni

Alan T Ruberg

J Duane Northcutt

Christoph L Schuba

Gerard A Wall

Michael S Bender

Michael F Speer

Yan Yu

Jason L Goldschmidt

Michael J Bundschuh

Christopher T La

An approach for provisioning network devices generally involves supplying boot data to network devices over a network so that the network devices can be booted up in an imaging mode or an application mode, depending upon the particular boot data supplied to the network device. When booted up in the imaging mode, imaging data can be downloaded and stored on network devices. When booted up in the application mode, the network devices execute one or more programs contained in the image data stored on the network devices. The first and second boot data may be in the form of boot loader scripts. Furthermore, the first and second boot data may be provided to the network device in the payload of a dynamic host configuration protocol (DHCP) reply. The DHCP reply may be generated and provided by a DHCP server to the network device in response to receiving a DHCP request from the network device. The approach may be implemented using a secure network environment.

Approach for provisioning network devices

A flow manager may receive packet flow rules from one or more network services and may generate a unified rule set according to the received packet flow rules. A flow manager may additionally split the unified rule set into subsets for enforcement by one or more flow enforcement devices and may install the rule subsets onto the flow enforcement devices. When splitting the unified rule set into subsets, a flow manager may analyze a network topology connecting the flow enforcement devices. A flow manager may also receive additional packet flow rules, integrate them into the unified rule set, update the rule subsets according to the additional rules, and install the updated subsets onto the flow enforcement devices.

Distributed flow enforcement

The present invention provides for token based signing of an unsigned binary which may be a stream of bits (e.g., 0's and 1's). The unsigned binary is signed using a secret key which resides in a token (e.g., a smart card), which makes the secret key available to the token holder. The unsigned binary is downloaded and verified for authenticity by the token coupled to a computing device. In one embodiment, the downloaded unsigned binary is encrypted. If the unsigned binary is authentic, it may be used to replace the prior firmware on that computing device.

Using token-based signing to install unsigned binaries

A method and apparatus for replicating an image from a source to a destination disk are provided. Specific embodiments may be optimized for single source to multiple destination replication requests, for example. In one embodiment, the present invention provides tools and techniques for synchronous data replication responsive to asynchronous same-source-to-different-destination replication requests.

Tool for disk image replication

The invention is a method and apparatus for synchronizing firmware associated with a first computer device and a second computer device, such as a server and a client computer. In accordance with one embodiment of the invention, the method comprises the steps of providing information regarding a characteristic of the firmware associated with the first and second devices, comparing the provided firmware information to determine if the firmware is synchronized, and associating new firmware with the second device to synchronize the firmware if the firmware is found to not be synchronized in the comparing step. In one or more embodiments of the invention, the firmware associated with the second device is not modified unless the integrity of the firmware to be installed on the second device is verified using a digital signature.

Method and apparatus for synchronizing firmware

Authentication and session management can be used with a system architecture that partitions functionality between a human interface device (HID) and a computational service provider such as a server. An authentication manager executing on a server interacts with the HID to validate the user when the user connects to the system via the HID. The authentication manager interacts with authentication modules. Each authentication module may be configured to authenticate a user based on a different authentication mechanism (e.g., using a smart card, using a login and password, using biometric data, etc.) and may be utilized in connection with one or more sessions. The authentication manager and authentication modules are also responsible for controlling access to services/sessions and may remove/revoke or augment such access. A session manager executing on a server manages services running on computers providing computational services (e.g., programs) on behalf of the user. The session manager notifies each service in a session that the user is attached to the system using a given desktop machine. A service can direct display output to the HID while the user is attached to the system. When a user detaches from the system, each of the service's executing for the user is notified via the authentication manager and the session manager. Upon notification that the user is detached from the system, a service continues to execute while stopping its display to the desktop machine.

Method and apparatus for remotely administered authentication and access control

A distributed settings control protocol. One or more embodiments of the invention provide the ability for an application running on a server across a network to modify various settings related to the terminals such as display resolution, audio output configuration (such as volume control or headphones v. speaker), and energy saver procedures. These abilities are provided by adhering to several protocol properties. One or more embodiments may include but are not limited to the following properties: (1) a terminal maintains knowledge regarding which applications are currently viewing or accessing the terminal; (2) applications/programs and servers know the state of terminal settings (referred to as idempotence and consistency); (3) to modify a setting a server provides the correct current setting to the terminal prior to the terminal completing a change (referred to as locking compliance), (4) the settings are mobile from one terminal to another; (5) the settings on each terminal are independent of other terminals to provide for differences between terminal models and hardware (referred to as model independence); and (6) a user, a third party agent, a manufacturer, or other entity is permitted to set any desired policy related to the settings (referred to as policy free). By adhering to the above properties, the protocol of one or more embodiments ensures that settings are maintained accurately and consistently across a network while permitting multiple entities to modify and configure the settings.

Distributed settings control protocol

A method and an apparatus for securely mixing and splitting multiple audio data streams and determining the order of processing the audio streams. A audio server and an audio device driver are in kernel space of a given computer system. In one embodiment, the computer system has a data flow checker and adjuster for checking the flow of data into data queues and a setup application for connecting the audio server and the audio device driver. The data flow checker and adjuster adjusts the flow of data by sending a message up or downstream instructing the up or downstream processes/devices to send more data or stop sending data depending on how full the data queues are.

Growing community of inventors

Mountain View, CA, United States of America

Benjamin H Stoltz