Lucent Technologies Inc.

At+t Corp.

Tizor Systems, Inc.

Ibm International Group Bv

Narain H Gehani

Vinod Anupam

Michael Rabinovich

Pratyush Moghe

Alex Kononov

Kenneth R Rodemann

Viswanath Kadambari

William D Roome

Rakesh Agrawal

Alexandros Biliris

Peter Thomas Smith

Musiri Srivathsan Sriram

Jagannathan Srinivasan

Shaul Dar

Richard James Trapp

The present invention provides a policy specification framework to enable an enterprise to specify a given insider attack using a holistic view of a given data access, as well as the means to specify and implement one or more intrusion mitigation methods in response to the detection of such an attack. The policy specification provides for the use of 'anomaly' and 'signature' attributes that capture sophisticated behavioral characteristics of illegitimate data access. When the attack occurs, a previously-defined administrator (or system-defined) mitigation response (e.g., verification, disconnect, de-provision, or the like) is then implemented.

Enterprise information asset protection through insider attack specification, monitoring and mitigation

This disclosure provides a policy specification framework to enable an enterprise to specify a given insider attack using a holistic view of a given data access, as well as the means to specify and implement one or more intrusion mitigation methods in response to the detection of such an attack. The policy specification provides for the use of 'anomaly' and 'signature' attributes that capture sophisticated behavioral characteristics of illegitimate data access. When the attack occurs, a previously-defined administrator (or system-defined) mitigation response (e.g., verification, disconnect, de-provision, or the like) is then implemented.

Policy specification framework for insider intrusions

The present invention provides a policy specification framework to enable an enterprise to specify a given insider attack using a holistic view of a given data access, as well as the means to specify and implement one or more intrusion mitigation methods in response to the detection of such an attack. The policy specification provides for the use of 'anomaly' and 'signature' attributes that capture sophisticated behavioral characteristics of illegitimate data access. When the attack occurs, a previously-defined administrator (or system-defined) mitigation response (e.g., verification, disconnect, deprovision, or the like) is then implemented.

A method of interactively sharing information between at least two devices in a computer network, each device having a respective browser associated therewith for handling the information, includes retrieving information from an information source in the network for storage in response to receipt of a retrieval request from a first browser associated with a first device. The method further includes sending the stored information to at least a second browser of at least a second device in response to receipt of a similar request therefrom, the second device receiving the request from the first device, such that the devices can share the information retrieved from the information source in response to the single request made to the source. Preferably, a surrogate is established in at least the first device for informing the second device of the request made such that the browser of the second device can make the similar request. Also, the information available from the information source in the computer network may include dynamically changing (i.e., stateful) content.

Methods and apparatus for enabling shared web-based interaction in stateful servers

Computer users may utilize different web browsers to access a server system on the World Wide Web (WWW) to create or join a collaborative session. One or more controllers connect the users or collaborators in a session in the server system. This is realized by establishing a so-called &ldquo;shared Web-top&rdquo;, i.e., a work space, in which different in-document applications can be run and can be interactively, collaboratively shared by a plurality of users. Specifically, this is realized by employing a surrogate that includes a polling loop which periodically checks a shared document structure for changes in prescribed properties, and transmits the detected changes to surrogates of other users, i.e., at least one other collaborator, via a communication channel. To this end, a prospective user of the shared Web-top accesses a system, which transmits mobile code to the user's computer to create a surrogate thereon. The surrogates created for the users of the shared Web-top are connected by at least one controller in the system and individually serve as an interface between the controller and the respective browsers on the users computers. Advantageously, through our unique use of the polling loop in the surrogate, functionality is realized in which, as one user inputs data into a shared document, for example, into one or more forms in a document, the same data appears in the other user's browser, via the detected changes in prescribed properties of the one or more forms being transmitted over the communication channel to the users' computers and, therein, to their surrogates.

Apparatus and method for sharing information in simultaneously viewed documents on a communication system

Computer users may utilize different web browsers to access a server system on the World Wide Web (WWW) to create or join a collaborative browsing session. One or more controllers connect the users or collaborators in a session in the server system. This is realized by establishing a so-called &ldquo;shared Web-top&rdquo;, i.e., a work space, in which different in-document applications can be run and can be interactively, collaboratively shared by a plurality of users. Specifically, this is realized in one embodiment by employing event handlers in the WEB documents that are activated whenever there is a change in the values of prescribed properties of a document. The event handlers notify a so-called surrogate of the changes in the prescribed properties of the document, i.e., that values in elements of a form have changed, and transmit the detected changes to surrogates of other users, i.e., at least one other collaborator, via a communication channel. To this end, a prospective user of the shared Web-top accesses a system that transmits mobile code to the user's computer to create a surrogate thereon. The surrogates created for the users of the shared Web-top are connected by at least one controller in the system and individually serve as an interface between the controller and the respective browsers on the users computers. Alternatively, the surrogate can insert event handlers into the document that communicate with the surrogate, identifying which form elements they apply to and transmit the changed value(s) to other users. The surrogates of the other users then appropriately update the corresponding form elements to reflect the changes.

An arrangement for realizing asymmetric collaboration utilizes a &ldquo;shared Web-top&rdquo;, i.e., a work space, in which different in-document applications can run and be shared. Specifically, in one embodiment of the invention employed in asymmetric collaboration, documents to be collaborated on at different users' terminals are logically identical but structurally different. Indeed, one of the collaborators, for example, a customer service agent, may have access to information that should not be made available to others of the collaborators. This asymmetric collaboration is realized by assigning a unique logical name to each information entity. Then, changes in the entity captured by some detection technique, for example, the use of document polling or event handlers, are propagated along with the name of the entity to the collaborators, where they are processed only if the relevant named entity exists. If the entity exists the logical name of the entity is mapped into its physical name which, therefore, allows asymmetric collaboration. Consequently, the name-based technique allows the collaborators, e.g., customer and agent, to share changes in the logically common portions of documents, which are structurally different.

Method and apparatus for sharing asymmetric information and services in simultaneously viewed documents on a communication system

A method and apparatus for maintaining consistency in databases among data processors of a computer network involves an improved epidemic protocol involving the generation of database version vectors for database replicas. Overhead of the protocol grows linearly with the number of data items being copied during an update propagation, not with the number of data items as in typical epidemic protocols. Since this number is less than the total number of data items in the database, the present protocol promises significant reduction in overhead. A log record is generated including at least the name of the updated data item. The log record has an associated time stamp for the updated data item name in one embodiment or an associated version vector value in another. In the event of out-of-bound copying, an auxiliary log record is maintained.

Maintaining consistency of database replicas

In a communications arrangement, a computer user accesses a server system to seek customer service over the World Wide Web (WWW). The server system assigns a customer service agent (CSA) to communicate with the user to realize the customer service. In a customer service session, the user and CSA may collaboratively browse hypertext markup language (HTML) documents at different uniform resource locators (URLs) to obtain relevant information. However, in accordance with the invention, the version of each document presented to the user may be different from that presented to the CSA. In particular, the CSA version contains proprietary information which is excluded from the user version.

Technique for obtaining information and services over a communication

Computer users may utilize different web browsers to access a server system on the World Wide Web (WWW) to create or join a collaborative browsing session. The users or collaborators in a session are connected by one or more controllers in the server system. When a collaborator creates or joins a session, mobile code is transmitted from the system to the collaborator's computer to create a surrogate thereon, which monitors the collaborator's interaction with a web browser on the computer. The controllers communicate with all the surrogates of the collaborators to coordinate the collaborative browsing effort. When one of the surrogates detects a change by a collaborator of a uniform resource locator (URL), the new URL is communicated through the controllers to the surrogates of all other collaborators in the session. As such, the collaborators are able to move from one URL to another to browse information in a synchronous manner. In addition, the collaborators can interactively communicate with one another in real time through the respective surrogates during the session.

Technique for obtaining and exchanging information on world wide web

A personal information manager computer program for storing names, addresses, telephone numbers and the like for personal and business contacts includes a capability for delivering geographic information in response to user requests. The personal information manager provides a display which includes one or more fields for entering or selecting contact information. The display also includes a number of buttons for requesting different types of geographic information, such as maps, directions, weather and yellow pages information. When the user clicks on one of the buttons, the personal information manager utilizes an address or other location identifier associated with the contact name to format a request to a geographic information server. The server uses the location identifier to retrieve the appropriate geographic information for that location, and sends the information to the personal information manager for display.

Geo-enabled personal information manager

Using a server system in accordance with the invention, a user and his/her companions can share information on the World Wide Web (WWW). The server system allocates a memory space for storing information particular to the user. This user memory space is associated with the user's login identification (ID) provided to the server system during the user login. Web information obtained by the user from the server system, or a representation of such information, is stored in the user memory space. In sharing the web information, the user's companions need to log onto the server system separately using the user's login ID. The server system then provides the companions with the web information based on the information currently stored in the memory space associated with the user's login ID provided by the companions.

Technique for sharing information on world wide web

Technique for obtaining and exchanging information on wolrd wide web

A token-based protocol used to prevent conflicts between copies of the same data items residing in different servers of a replicated distributed system is provided. The servers in the system with database replicas are provided with token pointers that are each associated with a token. Token pointers are used to track the current possessor of the token. Whenever a server receives or transfers a token, its corresponding token pointer is updated to reflect which server possesses the token. The use of token pointers advantageously eliminates the need for global cooperation by the servers to regenerate a lost token.

Preventing conflicts in distributed systems

A replication protocol which includes associating a database version vector with each copy of the database in the system is provided. Each database version vector keeps track of the total number of updates to any data items in its respective database replica and from which server those updates were originally performed. During replication between two replicas, the database version vectors of the replicas are compared to efficiently determine if update replication is necessary. If the database version vectors are not identical, the server possessing the more recent version of the data items propagates those data items to the server whose replica is older using conventional update propagation techniques. Identical database version vectors indicate that update propagation is not necessary. As such, the protocol avoids examining every data item in the database in order to determine the necessity of update propagation, which is required in conventional replication protocols.

Growing community of inventors

Summit, NJ, United States of America

Narain H Gehani