Novell, Inc.

Emc Corporation

DeeAnne Barker Higley

Stephen R Carter

Douglas Garry Earl

Dale Robert Olds

Kelly Ervin Sonderegger

Nadeem Ahmad Nazeer

Russell T Young

John Michael Robertson

Daniel T Ferguson

Arn D Perkins

Douglas R Phillips

Farrell Lynn Brough

Joseph Andrew Mellmer

Jeffrey Neil Sabin

Michael C McDonald

Robert Michael Sheridan

Kevin W Kingdon

Randal Earl Childers

Brian Lee Jarvis

Renea Berry Campbell

Bruce Warner Thorne

Robert Carey Ireland

A basic architecture for managing digital identity information in a network such as the World Wide Web is provided. A user of the architecture can organize his or her information into one or more profiles which reflect the nature of different relationships between the user and other entities, and grant or deny each entity access to a given profile. Various enhancements which may be provided through the architecture are also described, including tools for filtering email, controlling access to user web pages, locating other users and making one's own location known, browsing or mailing anonymously, filling in web forms automatically with information already provided once by hand, logging in automatically, securely logging in to multiple sites with a single password and doing so from any machine on the network, and other enhancements.

Managing digital identity information

Managing access to digital identity information

Distributed Reference Links (&ldquo;DRLs&rdquo;) for managing the referential integrity between objects in a distributed directory server system are described. In a preferred embodiment, DRLs specify a set of attributes, precedents, and algorithms that define how a resource can notify other resource managers of a change in the identity information of one of its objects. Using DRLs, before an external reference to an object is created, a &ldquo;UsedBy&rdquo; attribute identifying the partition that will include contain the external reference is added to any R/W replica of the object prior to the creation of the external reference object.

Distributed reference links for a distributed directory server system

A method for a source to obtain the rights of a target object is disclosed. The source first obtains the rights of a source object, which rights include authorization to access a target object and to modify authentication data of the target object. Next, the source object generates new authentication data. After accessing the target object using the rights of the source object, the source modifies the authentication data of the target object to include the new authentication data. Using the new authentication data, the source obtains the rights of the target object, whereby the source becomes a proxy for the target object. As a proxy, the source uses the rights of the target object. Alternative processes for proxy authentication, as well as apparatus for proxy authentication, are also disclosed.

Method and apparatus for proxy authentication

A method and apparatus for providing access control to objects in a distributed network directory employing static resolution to resolve object attributes. A first object has a Security Equals attribute and a second object has an Equivalent To Me attribute. Upon receiving a request for the first object to access the second object, authorization of such access is verified by checking if the two attributes are synchronized. The attributes are synchronized when the Security Equals attribute of the first object includes the second object, and the Equivalent To Me attribute of the second object includes the first object. A method of synchronizing the two attributes is also disclosed.

Method and apparatus to secure distributed digital directory object

A method of providing authoritative access control to computer networks that employs a distributed network directory using a static means of resolving object attributes is disclosed. The method employs the existing directories and an authentication procedure for each server. A first object that is under the physical control of the administrator of one partition of the distributed network directory requests access to a second object that is under the physical control of the administrator of another partition of the distributed network directory. The directory verifies that the access control list of the first object includes the second object. The access control list of the second object is then checked to verify that it includes a reference to the first object as an object that is permitted access to the second object. As a result, access is only granted in response to requests from objects that appear in the access control list of the second object. A method of synchronizing the access control lists based upon an authoritative access control list is also disclosed.

Method and apparatus to secure digital directory object changes

Growing community of inventors

Provo, UT, United States of America

DeeAnne Barker Higley