Sun Microsystems, Inc.

Gary W Winiger

Kais Belgaied

Darren J Moffat

Nicolas G Droux

John E Zolnowsky

Paul Sangster

Bhargava K Yenduri

Mark C Powers

Bradford R Wetmore

Teodora Ngo

Joep J Vesseur

One embodiment of the present invention provides a system that facilitates specifying a repository containing authentication information to a plugin in a plugable authentication system. When the system receives a command that requires the repository to be accessed, the system populates a data structure with information including a specifier for the repository. The system passes this data structure into a plugin framework. This enables one or more plugins within the framework to access the specified repository.

Specifying a repository for an authentication token in a distributed computing system

A method for performing a cryptographic function including calling into an encryption framework to perform the cryptographic function, wherein calling into the encryption framework comprises sending a request to perform the cryptographic function from a kernel consumer, and processing the request and returning the result to the kernel consumer, wherein processing the request comprises determining whether the request is synchronous or asynchronous, and determining which cryptographic provider to use to perform the cryptographic function.

Kernel-level cryptographic kernel interface

A method and system for labeling data in a networked environment. The method and system comprise determining if a label should be added to a portion of data having an associated first header. If so, a second header is constructed containing a label. The second header is indicated in a reference in the first header. The label contains at least one attribute of the data. The second header is attached to the first header. The portion of data is then transmitted, along with the headers. In one embodiment, the second header may contain credential information related to the data portion.

Method and system for labeling data in a communications system

A data structure extension system for dynamically adding extensions to existing data structures without interfering with underlying code. The data structure extension system includes logic that allows a programmer to 'privately' extend fields of existing entries in data structures in the operating system's kernel without interfering with the functionality of the overall data structure for other applications. An extension pointer disposed in the data structure associates each entry of the data structures extended with a respective extension table. The extension table allows for the dynamic addition of non-intefering interfering fields to the data structures. Each extension table entry has corresponding data stored in an external storage unit.

System and method of using extensions in a data structure without interfering with applications unaware of the extensions

A multilevel security attribute passing system on a computer operating under a multilevel operating system engaged in stream communications and enabling contemporaneously opening a plurality of sockets having the same port number while meeting the requirements of a predetermined security policy. The security attributes of received data are copied into a credentials structure identified by a pointer in an attribute structure. The security of a data node configured for data stream communication is specified by storing the security attributes of transferred data into a selected data structure and then pointing to the selected data structure with intervening transmission and attribute structures.

Multilevel security attribute passing methods, apparatuses, and computer program products in a stream

A multilevel port system on a computer operating under a multilevel operating system to permit contemporaneously opening a plurality of sockets having the same port number while meeting the requirements of an appropriate security policy, thus allowing third party applications to run as if they were unimpeded by the security policy, and methods thereby. The computer system having an operating system adhering to an access control security mechanism. Such systems include government systems wherein a hierarchy of security classification levels are defined (e.g., top secret, secret, classified, unclassified), and commercial systems. Sensitivity labels pursuant to an access control security mechanism include at least hierarchical security classifications, and may include non-hierarchical categories or compartments which represent distinct areas of information in a system. A port is characterized by a port number and a sensitivity label thus permitting opening a plurality of ports having identical port numbers and unique sensitivity labels.

Growing community of inventors

Mountain View, CA, United States of America

Gary W Winiger