International Business Machines Corporation

Dah-Haur H Lin

Larry George Fichtner

Francis Daniel Lawlor

Garry Lee Child

Charles Rudolph Schmitt

Timothy John Guenthner

Nataraj Nagaratnam

Indrajit Poddar

Anthony Joseph Nadalin

Shaw-Ben Shi

German Sergio Goldszmidt

Michael Bradford Ault

Debora Jean Byrne

Woodrow Wyatt Arkeketa

Vijaylaxmi Chakravarty

Shengdong Chen

Ann Thuan Ho

John Andrew Dankovich

Embodiments of the present invention provide a method, system and computer program product for aggregating database and component logic authorization rules in a multi-tier application. In an embodiment of the invention, a method for aggregating database and component logic authorization rules in a multi-tier application system can include aggregating role-based authorization rules for both a persistence layer and a logic layer of a multi-tier application in a unified policy, distributing the unified policy to both the persistence layer and the logic layer of the multi-tier application, transforming the unified policy into respectively a set of role based permissions for the persistence layer and a set of role based permissions for the logic layer, and applying the set of role based permissions for the persistence layer in the persistence layer, and the set of role based permissions for the logic layer in the logic layer of the multi-tier application.

Database authorization rules and component logic authorization rules aggregation

A software system for controlling the unauthorized transfer of data from a data processing system to a network is provided. A file monitor module monitors requests made by a process to access a data file within the computer system, and cross-checks the data file name against a protected file list database. If the file is listed in the protected file list database, the process name is added to a process list for the data file. A process monitor module monitors all processes contained in the process list, and if a process in the process list transfers the data file to another process, the receiving process is added to the process list. An upload monitor module searches the process list for any process that requests a network data transfer. The upload monitor module holds the transfer request for any process listed within the process list, and displays a warning message to the system user indicating that a process having had access to protected data is requesting network access to upload a data file. The data file is permitted to be transferred to the network in response to a user authorization command or the transfer request is cancelled.

Enhanced data security through file access control of processes in a data processing system

A routing routine is used within a security access program in order to provide access to various heterogeneous directories and registries. Each user logs on with an indication of the domain of which they are a part. An access protocol for the given domain is loaded and used to authenticate the user's access rights.

Heterogenous domain-based routing mechanism for user authentication

A method, computer program product, and data processing system, with which a unified security policy may be implemented using existing application components with disparate security mechanisms and user registries is disclosed. The present invention provides a generic application programming interface (API) that forms a framework for creating registry adapters. Registry adapters allow a policy director (an item of software for imposing a sitewide security policy) to operate with new or unfamiliar registry types by acting as a drop-in translator for converting generic registry-access commands into operations specific to the particular registry in question.

User registry adapter framework

A method and system for sharing existing user and group registry information between heterogeneous application servers is provided. The method and system make use of an adapter that communicates with each registry associated with each application server through a registry communication mechanism. In a preferred embodiment, the present invention provides an additional application-specific database to protect application-specific data that is required for each application server's operation but is not part of an existing database registry. Both the application-specific databases and existing user and group definitions in a user and group registry form a new registry abstraction which is required for each application server. As a result, each application server automatically shares user and group definitions with the existing database server. Furthermore, both the database server and each application server maintain a centralized user and group management model across different application domains.

Method and system to integrate existing user and group definitions in a database server with heterogeneous application servers

A global sign-on mechanism (GSO) is implemented. The mechanism provides a GSO system and method for a networked data processing system within an open architecture framework. The system and method are constructed on a Lightweight Directory Access Protocol (LDAP) framework by defining a set of data structures, the GSO LDAP schema. GSO functionality is effected using protocol operations on the LDAP object and attribute instances as defined in accordance with the GSO schema.

Open architecture global sign-on apparatus and method therefor

A caching mechanism for a directory service having a backing store. According to the invention, directory search results are cached over a given data capture period, with the information then being used by a data analysis routine to generate a data access history for the user for a particular application. That history is then used to generate a recommended pre-fetch time, a filter key for the pre-fetch, and a preferred cache replacement policy (e.g., static or LRU). Based on that information, a control routine pre-fetches and populates the cache with information that is expected to be needed by the user as a result of that access history.

Intelligent pre-caching algorithm for a directory server based on user data access history

A method of routing in a computer network having a pool of servers capable of servicing requests for access to a set of server resource objects. The set of server resource objects are distributed in a non-homogeneous manner across the server pool. According to the method, each incoming client request for access to a specified server resource object is targeted to a router having an associated port space identifying a plurality of ports. Based on the port on which an incoming client request is received, the request is mapped to one of the server resource objects. The router then selects the &ldquo;best provider&rdquo; and redirects or forwards the request to that server. The routing and redirection is based upon the port for the incoming request.

Mapping web server objects to TCP/IP ports

A method of dynamically generating a Web page at a Web server in response to an HTTP request from a Web client in a computer network. The Web page has a hypertext reference identifying a linked page supported on each of a set of other servers in the computer network. In response to the request, a given one of the set of other servers is identified based on some given criteria, e.g., shortest access time, lightest current load, or the like. Information identifying a path to the identified other server is then inserted into the hypertext reference as the Web page (including the hypertext reference) is returned to the Web client in response to the request. Thus, if the hypertext reference is later activated by the user browsing the returned Web page, the linked page is preferentially served from the identified other server.

Growing community of inventors

Austin, TX, United States of America

Dah-Haur H Lin