Red Hat, Inc.

Sun Microsystems, Inc.

Other

Oracle America, Inc.

Peter Andrew Rowley

David Boreham

Steven William Parkinson

Mark Christopher Smith

Noriko Hosoi

Noriko Hosol

A computer system creates a view that has a class definition and one or more attributes of a directory to support graphical representation of the directory. A distributed processing system includes the directory and a number of nodes, one of the nodes being a service node. The directory includes entries that are associated with the nodes. The service node receives an attribute value that is associated with one of nodes. The service node determines from the class definition of the view that the received attribute value is associated with an attribute type that describes a new attribute value and creates an updated view without defining the received attribute value in the entries of the directory. The updated view includes the received attribute value.

Generating category-based views of a directory

Systems and methods for a smart card accessible over a personal area network (PAN). An example method may include: communicatively coupling a device to the PAN, storing a digital certificate that identifies a user, logging the user on to an additional device within the PAN, and providing an encryption service for the additional device, by: receiving a message to be encrypted, encrypting the message, sending the encrypted message to the additional device via the PAN, receiving an encrypted version of an additional message, decrypting the additional message using the private key associated with the user to produce an unencrypted version of the additional message, and sending the unencrypted version of the additional message to the additional device via the PAN.

Smart card accessible over a personal area network

A social networking site host includes, in a user's profile, information that has been attested to and verified by both the user and an independent verifier. The independent verifier is an accepted authority with direct knowledge of the information. Both the user and verifier attest to the information by digitally signing the information and including the digital signature with the information. The host or visitors to the social networking site can authenticate the information by using both digital signatures. By authenticating the information, visitors and users viewing information on the social networking site can assume that the information is trusted and accurate.

Providing independent verification of information in a public forum

Information to link two attributes in a database is stored, and when one of the attributes is updated, a new value for the second attribute is computed and stored. Related systems and applications are also described.

Linked lightweight directory access protocol (LDAP) attributes

Some embodiments of a smart card accessible over a personal area network have been presented. In one embodiment, an apparatus includes a wireless transceiver to communicatively couple to a personal area network (PAN) to receive an authentication request via the PAN from a device. The device may include a computer. The apparatus further includes a storage device to store a digital certificate that uniquely identifies a user. An authentication module in the apparatus may authenticate the user in response to an authentication request from the device using the digital certificate, wherein the user is allowed to access the computer upon authentication.

A distributed database server receives an operation request including a flag to cause recursive lock-and-propagate operation, acquires a local lock, tests the operation locally and propagates the recursive request to a peer database server. Specific implementations within a Lightweight Directory Access Protocol ('LDAP') server are described.

Recursive lock-and-propagate operation

A method and apparatus for maintaining logs for a Lightweight Directory Access Protocol (LDAP) directory server. The method includes receiving or detecting events or activities in the system to be logged. The events are transformed into LDAP entries and stored in an LDAP repository. The LDAP entries may then be searched and operated on using LDAP operations, thereby providing enhanced utility and functionality for log data using LDAP operations and an LDAP repository.

Database-based logs exposed via LDAP

Embodiments of the present invention provide a system and method of assigning unique identifiers in a multi-master directory service. In particular, each server in the system assigns numeric user identifiers in a linear fashion that compliments the series of user identifiers assigned by the other servers. In particular, a first server is selected and assigned a first starting number. Each subsequent server is then assigned their own starting series number by incrementing from the first starting number. Then, all servers are assigned an additive, which is an integer greater than or equal to the number of servers in the system. Each server then generates its own series of unique numeric identifiers based on its own starting series number and the additive.

Numeric identifier assignment in a networked computer environment

Some embodiments of a method and apparatus for protecting web pages against phishing have been presented. In one embodiment, a user interface control is created at a client machine. A user may submit a request to protect a web page via the user interface control. In response to the request, a web page protection module may protect the web page against phishing based on content of the web page. In some embodiments, the web page protection module may be integrated with a network access application, such as, for example, as a plug-in to a browser.

Web page protection against phishing

A method and apparatus for a dynamic service topology. One service is assigned to a virtual machine. The virtual machine is assigned to a physical machine on a network. The service of the virtual machine is transferable from the physical machine to another physical machine on the network by moving the virtual machine.

Dynamic service topology

A method and apparatus to prove user assertions. A client request to authenticate a user assertion pertaining to user personal data may be received. The requested authentication may be generated for the client, the authentication proving the user assertion without revealing other information about the user. The requested authentication may be sent to the client.

Identity management facilitating minimum disclosure of user data

A method and apparatus for managing groups in a directory server is described. In one embodiment, an addition of an identifier of a group to an entry in the directory server is received. A value of an attribute in the entry is updated with the identifier of the group. A content of the group is dynamically changed based on the addition of the identifier of the group to the entry in the directory server.

Dynamic management of groups

A computing device receives a request to perform a Lightweight Directory Access Protocol ('LDAP') database operation and propagates the request to perform the LDAP database operation to a peer server to test the LDAP database operation at the peer server. The computing device executes an action on a distributed LDAP database based on a result of testing the LDAP database operation at the peer server.

Multi-master attribute uniqueness

A method and apparatus for authenticating a client is described. In one embodiment, an identity provider server authenticates the client that is redirected from a relying party server. The identity provider server authenticates the client without receiving a replayable credential from the client. Upon authentication of the client, the identity provider server transmits a token of authentication to the client.

Secure authentication in browser redirection authentication schemes

A method and apparatus for maintaining referential integrity in a plurality of directory servers is described. In one embodiment, a first directory server receives a request to operate on an entry in the first directory server. The request is serially repeated in at least one other directory server if the operation on the entry in the first directory server is not valid. The at least one other directory server communicates indirectly with the first directly server.

Growing community of inventors

Ben Lomond, CA, United States of America

Peter Andrew Rowley