Sun Microsystems, Inc.

Paul A Fronberg

Vipin Samar

William A Shannon

Tajen R Wu

Donald R Stephenson

Methods and systems thereof for providing security of information in a computer system are described. The information is received in the user space defined according to the operating system executed by the computer system. An encode system call is used to copy the information to the kernel space defined according to the operating system. The information may also be encrypted in response to the encode system call. The information can then be cleared from user space. A decode system call causes the information to be returned to user space. If the information is encrypted, the information is also decoded in response to the decode system call. As a result, the amount of time that the information is accessible outside of kernel space is reduced.

Methods for improved security of software applications

A system and method provide transparent access from any system entry service to multiple account management services, and particularly to multiple authentication services on a computer system, supporting unified login and logout. Transparency between system entry services and account management services, including authentication, password, account, and session services, is provided by an application programming interface and a configuration file. The configuration file stores associations between system entry services, and selected account management services, and allows an individual system entry service to be associated with multiple different ones of a given type of account management service, such as authentication services. The application programming interface determines dynamically in response to a request by a system entry service for an account management operation, such as authentication of a user, which account management service is associated with the system entry service by reading the configuration file and queuing pathnames stored therein of the account management services associated with the system entry service currently connecting user to the system. The application programming interface then invokes the queued pathnames for the desired operation. Multiple login is provided by encrypting authentication tokens used by the authentication services associated with a given system entry service with a primary authentication token of one of the authentication services, and subsequently decrypting the encrypted tokens as needed to authenticate the user. With unified login, the user need only provide the primary authentication token. Unified logout is provided by locating and destroying credentials of the user created by the multiple authentication services in response to a request of the valid user to logout.

Growing community of inventors

Redwood City, CA, United States of America

Paul A Fronberg