Sun Microsystems, Inc.

Oracle America, Inc.

Rinaldo S DiGiorgio

Stephen Uhler

Michael S Bender

Raymond E Maslinski

Colin Stevens

Diana Neiman

Anders Holm

Dan Hushon

James Constantine

A delegated environment manager for identifying and inventorying characteristics associated with user's delegated environments. The inventory of the characteristics associated with a particular delegated environment is stored for later retrieval. Upon receiving a request to recreate a previously stored delegated environment, the delegated environment manager retrieves the inventory of the characteristics associated with the requested delegated environment and compares that inventory of characteristics with an inventory of characteristics associated with a user's current delegated environment. Differences between the two inventories are identified and the delegated environment manager alters characteristics as necessary to recreate the previously stored delegated environment.

Dynamic persistent user management in delegated environments

A method and corresponding system for multicast provisioning of operating systems (OS) at reduced bandwidth. The method includes providing a computing device on a digital communications network. An OS image is stored in the computing device, with the image including data sets or chunks making up one or more phases of a system image. The method continues with associating a single multicast address with each of the data sets. The computing device broadcasts each of the data sets of the image along with the associated multicast address on the network as a repeating loop. The method includes sending a signal from the computing device to a set of nodes on the network to initiate a process for loading the stored image, and in response, operating the nodes to load a multicast installer that listens for the data sets and buffers received data packets in an image cache.

Reliable multicast operating system (OS) provisioning

A method and apparatus for providing a Web application framework is provided. The framework includes four main components which are used in combination to create Web servers of varying complexity depending on the needs of the end use. The framework includes a Server object, a Handler object, a Properties object, and a Request object. A Server object is created with an initial set of properties and calls a Hander object. The Handler object defines how URL requests are processed by the Web server. When a request appears at the server, the Request object obtains and formats the request for subsequent processing. The Handler object works with the Properties object to process the request. Multiple Handler objects may be chained together to create a Web application that can perform many operations without being restricted to traditional server designs.

Architecture for building web applications

The Smart Card URL Programming interface (UPI) builds a local web or card server around a card terminal and the inserted smart card. This server can also support secure object storage, which stores serialized, secure signed, compressed objects (or applications or data) for delivery to the card or for off-loading from the card. The secure object storage is also web addressable. The object storage program stores objects with the option of signing and/or encrypting and retrieves objects which may require cryptographic credentials. If a user desires to run applications on a card that exceeds the memory capacity of the card, information about the applications, including pointers and their digital signatures, is acquired and stored on the card by the card server. The card server manages the applications on a card and their movement on and off the card.

Adding secure external virtual memory to smart cards

Architectures that enable different types of security devices to operate interchangeably in very large network environments for authentication and metered access to services are described. The system relies on a lease-based access to the network services. The leasing model supports a smart card type payment for services allowing for payments to be automatically forwarded from the smart card type device to the service whenever a service is leased. To lease a service, the requesting service must first be authenticated using devices like cellular phones, smart cards, Personal Data Assistants, or similar devices that have processing and memory capabilities and in some instances, wireless communication capabilities. Services may enter or exit the environment at will. Devices and services in this environment have public certificates that are used for authentication. Services may customize access to its products to make them available only to desired services.

Method and apparatus for authentication and payment for devices participating in Jini communities

The present invention comprises a method and apparatus for securely providing billable multicast data. The invention describes a solution that provides an architecture for enabling different types of security devices to operate interchangeably in very large consumer networks, corporate networks, for authentication and metered access to services, as well as payment. An embodiment of the invention comprises a mechanism for ensuring that only authorized parties may obtain access to a particular data stream. For example, the present invention provides a way build a restricted-channel system. In a restricted-channel system, a multicast server transmits encrypted information that can be deciphered by authorized multicast client programs or multicast client programs operating under authorized conditions. Access to the multicast data is allowed when the data is appropriately decrypted or otherwise verified and/or the payment is obtained from a portable device such as a smart card.

Method and apparatus for securely providing billable multicast data

A distributed budgeting and accounting system is designed to operate with secure token devices. The secure token devices serve both as electronic currency purses and as secure vehicles for authorization. The distributed budgeting and accounting system allows a budget to be defined for an organization. The budget is implemented via the secure token devices by transferring electronic currency tokens representing portions of the budgets to secure token devices associated with different portions of the organization. The funds may be transferred down a hierarchical organization by transferring funds between respective pairs of secure token devices. Once the budget has been fully distributed, members of the organization may spend electronic currency tokens on their secure token devices to cover the cost of using resources. Each card holder of the secure token device may only spend up to the amount provided on the associated secure token device. Secure token devices may be provided for service providers so that these funds that are spent to cover the use of resources may be accumulated to it. Accumulated funds may be returned to a central bank. The distributed budgeting and accounting system is used to define an internal economy for the organization.

Distributed budgeting and accounting system with secure token device access

A secure token device, such as a smart card or an ibutton, provides a user with a vehicle for accessing services that are provided by an Internet Service Provider (ISP). The user places the secure token device in communication with a reader that is coupled to a computer system. The computer system includes a web browser for accessing the services provided by the ISP. The secure token device may perform an authentication protocol to authenticate itself to the ISP. The ISP may also be required to authenticate itself. The secure token device may hold an electronic currency token for payment of services rendered by the ISP. The secure token device may contain stored personal information about the user. The user may stipulate what portions of this personal information are provided to the ISP upon request. Contextual information regarding sessions with the ISP may also be stored on the secure token device and used to restore a context of a previous session during a subsequent session.

Secure token device access to services provided by an internet service provider (ISP)

A method and apparatus for providing modular I/O expansion. Apparatus are provided on a host computing device and an expansion unit to support multiple port types, and multiplexing apparatus are provided to support simultaneous I/O sessions between multiple applications on the host computing device and multiple I/O ports on the expansion unit over a single host I/O port. The expansion unit is equipped with one or more port interface modules that are each configured to support data transmission in accordance with one port type from a set of port types. Apparatus on the expansion unit perform multiplexing and demultiplexing of data transmitted between the host computing device and the port interface modules of the expansion unit. Port interface objects in the host computing device each support data transmission in accordance with one port type from the set of port types. A host multiplexor on the host computing device performs multiplexing and demultiplexing of data between the expansion unit and the port interface objects. A registry is maintained to map port interface objects to port interface modules.

Growing community of inventors

Easton, CT, United States of America

Rinaldo S DiGiorgio