Sun Microsystems, Inc.

David M Brownell

Peter Vanderbilt

Swee Boon Lim

Peter B Kessler

Dwight F Hare

Arthur A Van Hoff

Alan Michael Snyder

Mark W Hapner

Pavani Naishadh Diwanji

Robert B Hagmann

Rafael Bracho

Maurice Balick

Kenneth M Cavanaugh, Iii

Anthony W Menges

Rod J McChesney

Michael L Powell

Alain Demour

Neguine Navab

A method and apparatus for managing network access to internal hosts protected by a firewall is provided. A user on an external host logs in into a firewall. Once the user has been authenticated to the firewall, a session is established for the user, and tunnel configuration is transmitted to the user's process on the external host. The tunnel configuration data indicates the configuration of at least one tunnel for connecting to at least one internal host protected by the firewall. When creating a socket for connecting to the internal host, the socket is configured based on the tunnel configuration data. Tunnel objects and tunnel socket objects may be specially configured to establish a connection in a way that takes advantage of the power and simplicity of the inheritance feature of object oriented software. Various tunnel classes are provided to configure tunnels in a variety of mariners.

Authenticated firewall tunneling framework

A number of methods, apparatus, and data structures are disclosed for managing computer processes. In one aspect, a daemon process which manages server processes includes an active server table and a locator service. The locator service can look up and register server processes in the active server table. Furthermore, the locator service can start up server processes. In some embodiments, the locator service includes a look-up object and a server process registration object which perform the tasks of the locator service. In other embodiments, methods for managing server process such as starting and registering the server processes are taught. In one specific method, a daemon process performs a variety of steps in response to receiving a look-up call for a target object. These steps include obtaining a server identifier for the target object, determining the state of a server process, and returning addressing information corresponding to the server process under which the target object will activate. In related method aspects the daemon process will start the server process if it isn't running and/or wait until the server process is running to return the addressing information. In a separate method aspect, a server process self-starts; receiving an object reference for a desired target object, receiving a server process identification number, creating a communications port for itself, forming addressing information for itself, obtaining an object reference for a server process registration object, and registering itself by calling the server process registration object to invoke a register new process operation.

Methods and apparatus for managing computer processes

A method and apparatus for managing network access to internal hosts protected by a firewall is provided. A user on an external host logs in into a firewall. Once the user has been authenticated to the firewall, a session is established for the user, and tunnel configuration is transmitted to the user's process on the external host. The tunnel configuration data indicates the configuration of at least one tunnel for connecting to at least one internal host protected by the firewall. When creating a socket for connecting to the internal host, the socket is configured based on the tunnel configuration data. Tunnel objects and tunnel socket objects may be specially configured to establish a connection in a way that takes advantage of the power and simplicity of the inheritance feature of object oriented software. Various tunnel classes are provided to configure tunnels in a variety of manners.

A variety of methods and apparatus for managing deactivation and deletion of objects and server processes are taught. According to some embodiments of the present invention, a thread of execution termed the reaper thread systematically cycles through a computer process deactivating and/or deleting objects based upon a variety of criteria. One suitable criterion for object deactivation is based upon the amount of time lapsed since a client has requested services of the object. According to the timeout criterion, the reaper thread determines the period of time since the last client requested services from the object, compares this to a timeout value which may be defined by any suitable entity, and proceeds with deactivation and/or deletion accordingly. Object deletion may have a separate criterion or be specifically requested by a client. A deletion flag may be set to indicate that object deletion is requested. When an object has deactivated, the reaper thread further determines if the deletion flag for this object is set, and, if so, further proceeds to perform an object deletion operation. In some embodiments, the reaper thread is further responsible to shutdown the server process under which the reaper thread is executing. As is well known to those skilled in the art of object oriented programming, a thread of execution is essentially a sequential flow of the point of execution through a computer process. One suitable criterion for server process shutdown would be related to the server process activity.

Methods and apparatus for managing objects and processes in a distributed object operating environment

Data structures, methods, and devices for facilitating servant invocation in a distributed client-server based object oriented operating system are disclosed. In one aspect of the invention, descriptor data structures, which contain a typecode indicator, a marshaling function identifier, and an unmarshaling function identifier, are used to enable modules of application code to be shared between different objects, thereby facilitating servant invocation by increasing the amount of commonized code in the operating system. In another aspect of the invention, a server invocation object is used in the execution of a method call. In still another aspect of the invention, a commonized code base is used to process typecode interpreted and compiled calls to a server process.

Transport independent invocation and servant interfaces that permit both typecode interpreted and compiled marshaling

A method and apparatus for managing connections between objects in a distributed object system includes a method and apparatus for terminating connections between objects. In one aspect, the method for terminating a connection, a connection end message is sent from a server to a client indicating to the client that the server will no longer accept requests before the connection is terminated. Preferably a connection end code is included with the connection end message. In another aspect, the invention includes a method for making connections between objects are formed by intelligently closing existing connections that meet the criteria of being established and across which no unfulfilled requests or unforwarded replies are pending. If several connections meet these criteria, the oldest unused connection is terminated. The methods and apparatus described provide for the creation and termination of connections efficiently and robustly by allowing the controlled shut down of connections between clients and servers without invoking an error state.

Method and apparatus for managing connections for communication among objects in a distributed object system

Transport independent invocation and servant interfaces that permit both

Methods and apparatus for managing objects and processes in a

A variety of methods, apparatus, and data structures for managing transient and persistent distributed objects are disclosed. Objects for use as object references are described, both for transient and persistent objects. In one aspect of the invention, a data structure that is intended for use as an object reference for a transient object is disclosed having a set of endpoint addresses, an incarnation number, and an object key. These elements serve to uniquely identify and locate the transient object. In another aspect of the invention, an object that is intended for use as an object reference for a persistent object is disclosed having a host computer name, a locator identification, an object key, and a subobject identifier. The first three elements serve as an indirection to the persistent object and the third element is for use by the persistent object. These data structures enable a distributed object operating environment which integrates both transient and persistent objects. A variety of methods utilizing one or more of the elements of the abovementioned object references to provide a system resource efficient interaction between a client requesting service from a server object. One particular method selects the fastest transport mode between the client and the server object. Another specific method teaches reading addressing information directly from local cache memory. If the addressing information is not available in cache memory, the information is first found and then stored in cache memory thereby perpetuating the efficiency of the invention.

Methods, apparatus and data structures for managing objects

A method of checking the type of an object located on a remote computer in a distributed object environment computing system is disclosed. Initially, a type checking method to determine whether a remotely located object is of a specified type is invoked. In the invocation, a target interface identifier is included as an argument. A determination is then made as to whether the target interface identifier is equal to or a base for an apparent interface identifier held by a proxy object located on the first computer. If the target interface identifier is determined to be equal to or a base for the apparent interface identifier, an affirmative indication to that effect is returned to the client process. If not, then the target interface identifier is then compared to a real interface identifier. In many embodiments, a call to the server host will have to be made in order to determine the real interface identifier. In some embodiments, a local cache memory can also be provided to store the results of such inquiries. The target interface identifier is then compared to the real interface identifier and a determination is made as to whether the target interface identifier is equal to or a base for the real interface identifier. The result is then returned to the client process. A method of checking the type of an object and additionally returning an output proxy object is also disclosed. The output proxy object may be the original input proxy object that has been widened to the class associated with the target interface identifier, or may be a newly created proxy object that is of the same kind as the input proxy and of the same type as the target interface identifier.

Growing community of inventors

Palo Alto, CA, United States of America

David M Brownell