Other

Salesforce Com, Inc.

Salesforce, Inc.

Guardian Data Storage, LLC

Intellectual Ventures I LLC

Hal Scott Hildebrand

Klimenty Vainstein

Yingwu Zhao

Prithvi Krishnan Padmanabhan

Denis Jacques Paul Garcia

Alex S Warshavsky

Samarpan Jain

Senthilvasan Supramaniam

Soumen Bandyopadhyay

Alexey Syomichev

Lawrence Eugenio McAlpin

Jay Hurst

Chang-Ping Lee

Michael Frederick Kenrich

Igor Pesenson

Emin Eliot Gerba

David William Spragg

A request to identify a data value may be received via a network at a designated one of a plurality of identity nodes. A query that includes the data value may be transmitted to an identity service associated with the designated identity node. A response message from the identity service may include one or more designated network identifiers corresponding with the data value. The designated identity node may communicate with the plurality of identity nodes to identify a plurality of network identifiers corresponding with the data value. A trust ledger may be updated to include a correspondence between a selected one of the network identifiers and the data value.

Zero-knowledge identity verification in a distributed computing system

A method for enabling event consumption is described. Upon receipt of a request for events associated with a first initial topic, a determination that the request includes a request for historical events is performed. Responsive to determining that one or more rules apply to the request for historical events, a determination of a first path from the first initial topic to a first aggregate topic is performed based on the one or more rules. The first path is different from a second path from the first initial topic to a second aggregate topic that is defined according to a current multiplexed framework definition. The current multiplexed framework definition is used for storing new events associated with the first initial topic in a second multiplexed event recordation system at a time that follows the time of receipt of the request. A first set of historical events is retrieved based on the first path.

Method and apparatus for a mechanism for event replay when a reroute of recordation of the event occurred in a multiplexed event recordation system

For each data value associated with a data object, a respective object value identification query message that includes the data value may be sent to each of a plurality of identity nodes via a network. For each of the data values, a respective object value identification response message that includes a respective network identifier corresponding with the respective data value may be received. A local identifier may be determined based on the object value identification response messages, and a response query message including the local identifier may be transmitted.

A method and apparatus for a mechanism of disaster recovery and instance refresh in an event recordation system are described. A first request for events associated with a first topic is received. A first set of events associated with the first topic are retrieved from a primary event recordation system. Each event from the first set of events includes a first commit identifier indicating the order with which each event is stored in the primary event recordation system. For each event from the first set of events a first replay identifier is determined based on the first commit identifier and a first value of a low commit identifier. The first replay identifier is exposed to event consumers for identifying the event. In response to the first request each event from the first set of events is transmitted with the replay identifier.

Method and apparatus for a mechanism of disaster recovery and instance refresh in an event recordation system

A processor can cause a first communication, to a user device, of a first item based on an eventing system being in a first mode, a configuration to cause the eventing system to cause, without a request from the user device, a communication of an item to the user device in response to an entry of the item into a memory. After the first communication, the processor can cause the eventing system to be in a second mode, a configuration to cause the eventing system to refrain from communications of items to the user device. The processor can receive, from the user device, a signal to cause the eventing system to switch from the second mode to the first mode. After receiving the signal, a second item can be entered into the information memory. The processor can cause a second communication, to the user device, of the second item.

Hybrid eventing system

The technology disclosed relates to discovering a previously unknown attribute of stream processing systems according to which client offsets or client subscription queries for a streaming data store rapidly converge to a dynamic tip of a data stream that includes the most recent messages or events. In particular, it relates to grouping clients into bins to reduce a number of queries to the streaming data store by several orders of magnitude when servicing tens, hundreds, thousands or millions of clients. The bin count is further reduced by coalescing bins that have overlapping offsets. It also relates to establishing separate caches only for the current tips of data streams and serving the bins from the caches instead of the backend data store using group queries. Further, the caches are periodically updated to include the most recent messages or events appended to the dynamic tips of the data streams.

Efficient access scheduling for super scaled stream processing systems

Method and Apparatus for access secured electronic data are disclosed. According to one aspect, an off-line access mechanism in a client machine is activated to facilitate those users on the go to access secured electronic data. When a user decides to be away from a network premises or on a business trip, an off-line access request may be generated by the off-line access mechanism and forwarded to a server. In response, the server may grant the off-line access request to the user as well as the client machine from which the user will access the secured electronic data off-line. Depending on implementation, the AC may provide amended or tentative access rules, access privileges or user keys that will automatically expire when a predetermined time ends or become invalid the next time the client machine is connected to the server.

Method and apparatus for accessing secured electronic data off-line

A system and method for providing access management to secured items through use of a plurality of server machines associated with different locations are disclosed. According to one embodiment, a local server can be dynamically reconfigured depending on a user's current location. Upon detecting that a user has moved to a new location, the local server for the new location can be reconfigured to add support for the user, while simultaneously, the local server for the previous location is reconfigured to remove support for the user. As a result, security is enhanced while the access management can be efficiently carried out to ensure that only one access from the user is permitted at any time across an entire organization, regardless of how many locations the organization has or what access privileges the user may be granted.

System and method for providing multi-location access management to secured items

With files secured by encryption techniques, keys are often required to gain access to the secured files. Techniques for providing and using multiple levels of keystores for securing the keys are disclosed. The keystores store keys that are needed by users in order to access secured files. The different levels of keystores offer compromises between security and flexibility/ease of use.

System and method for providing different levels of key security for controlling access to secured items

A system and method for providing access management to secured items through use of a plurality of server machines associated with different locations are disclosed. According to one embodiment, a local server can be dynamically reconfigured depending on a user's current location. Typically, a local server services only those users that are local to the local server. When a user moves from one location to another location, upon detecting a new location of the user who has moved from a previous location, the local server for the new location can be reconfigured to add support for the user, while at the same time, the local server for the previous location is reconfigured to remove support for the user. As a result, security is enhanced while the access management can be efficiently carried out to ensure that only one access from the user is permitted at any time across an entire organization, regardless of how many locations the organization has or what access privileges the user may be granted.

Improved system and approaches for decentralized key generation are disclosed. The keys that can be generated include both public keys and private keys. The public keys are arbitrary strings that embed or encode access restrictions. The access restrictions are used to enforce access control policies. The public keys are used to encrypt some or all portions of files. The private keys can be generated to decrypt the portions of the files that have been encrypted with the public keys. By generating keys in a decentralized manner, not only are key distribution burdens substantially eliminated but also off-line access to encrypted files is facilitated.

Security system for generating keys from access rules in a decentralized manner and methods therefor

Improved system and approaches for centralized storage of access restrictions which are associated with public keys are disclosed. The access restrictions serve to limit access to files secured by a security system. According to one aspect of the present invention, identifiers, or encoded versions thereof, are used as public keys to identify particular access restrictions. The identifiers to the access restrictions are used in a decentralized manner for public keys, while the access restrictions themselves are maintained in a centralized manner. As compared to the access restrictions, the public keys based on identifiers tend to be smaller and more uniform in size. The centralized storage of the access restrictions also facilitates subsequent changes to access restrictions for previously secured files. The improved system and approaches is particularly suitable in an enterprise environment.

Security system using indirect key generation from access rules and methods therefor

A system and method for providing distributed access control are disclosed. A number of local servers are employed to operate largely on behalf of a central server responsible for centralized access control management. Such a distributed fashion ensures the dependability, reliability and scalability of the access control management undertaking by the central server. According to one embodiment, a distributed access control system that restricts access to secured items can include at least a central server having a server module that provides overall access control, and a plurality of local servers. Each of the local servers can include a local module that provides local access control. The access control, performed by the central server or the local servers, operates to permit or deny access requests to the secured items by requestors.

Growing community of inventors

Moss Beach, CA, United States of America

Hal Scott Hildebrand