Novell, Inc.

Oracle International Corporation

Symantec Corporation

Novell Intellectual Property Holdings, Inc.

Tammy Anita Green

Stephen R Carter

Scott Alan Isaacson

Lloyd Leon Burch

Haripriya Srinivasaraghavan

Jim Alan Nicolet

Douglas Garry Earl

Cameron Craig Morris

Roger R Schell

Ron Frederick

Daniel Gene Fritch

Srinivas Yerra

Zhanna A Tsitkova

Krists Krilovs

Eric Anderson

Dharmendra Mohan

Various techniques are described to authenticate the identity of a proxy in a client-proxy-server configuration. The configuration may have a client-side and a server-side SSL session. In the server-side session, if the proxy has access to the private keys of the client, the proxy may select a client certificate from a collection of client certificates and send the selected certificate to the server to satisfy a client authentication request of the server. If the proxy does not have access to the private keys, the proxy may instead send an emulated client certificate to the server. Further, the client certificate received from the client may be embedded within the emulated client certificate so as to allow the server to directly authenticate the client, in addition to the proxy. An emulated client certificate chain may be formed instead of an emulated client certificate. Similar techniques may be applied to the client-side session.

Exchange of digital certificates in a client-proxy-server network configuration

Techniques for trusted platform module (TPM) assisted data center management are provided. A data center registers TPM remote attestations for physical processing environments of physical devices within a data center. Each time a physical processing environment is established; a new TPM remote attestation is generated and validated against the registered TPM remote attestation. Additionally, during registration other identifying information is supplied to the physical processing environments that permit each physical processing environment to be authenticated, validated, and controlled via unique identities. Inter-data center communication is established for sharing virtual processing environments and administrative operations are authenticated within each of the data centers perform any administrative operation is permitted to process within a particular data center.

Trusted platform module (TPM) assisted data center management

Techniques for spontaneous resource management are provided. Information about resources is indexed and housed in a repository. The information is dynamically updated. Search queries are performed against the indexed information in the repository for purposes of forming dynamic groupings of the resources that are then managed as custom-defined and dynamic groups.

Spontaneous resource management

Techniques for non-unique identity establishment are presented. A plurality of biometric data associated with a user is acquired from a plurality of biometric devices. The intersection of the biometric data is registered or a vector for the biometric data is registered. This information is also registered along with answers to questions provided by the user. When a user attempts to subsequently access a secure resource of a network, the retained information is compared against user-supplied biometric data and in some cases where appropriate user-supplied answers to establish an identity of the user and to authenticate the user for access to the secure resource.

Techniques for non-unique identity establishment

Techniques for securing content in an untrusted environment are provided. Content is encrypted and stored with a content delivery service in an encrypted format. Encrypted versions of a content encryption/decryption key and a first key are also housed and distributed by the content delivery service. The first key is used to decrypt the encrypted version of the content encryption/decryption key. The content delivery service is unaware of the content encryption/decryption key and the first key; and the content held by the content delivery service is encrypted with the content encryption/decryption key. Principals securely share, create, manage, and retrieve the encrypted versions of the content encryption/decryption key and the first key from the content delivery service using secure communications. The encrypted content is obtainable via insecure communications from the content delivery service.

Techniques for securing content in an untrusted environment

Techniques for help desk management are provided. A user's experience with a resource is captured via a rating. The rating is recorded along with other metrics associated with a processing environment of the user and proactive action taken in response to configuration or performance problems with the user.

Techniques for help desk management

A validation service offers the ability to validate a telephone conference. The validation service can verify that a telephone number and a pass code can be used to access the telephone conference at the time the telephone conference is scheduled. The validation service can also inform users about changes to the scheduled telephone conference, and provide alternative telephone numbers that can be used to access the telephone conference.

Contextual phone number validation

Techniques for creating and using credentials for blinded intended audiences are provided. A principal desires access to a target service. An identity associated with the target service is hidden from an identity service via a random identifier. The identity service supplies an assertion with credentials and the random identifier. The principal sends the assertion and an access message, which also includes the random identifier to the target service. The target service compares the identifier included with the message to the identifier in the assertion and when a match occurs access is permitted to the target service, assuming other credentials associated with the assertion are satisfied as well.

Credentials for blinded intended audiences

Techniques for multiple biometric smart card authentication are provided. At least two biometric readings are obtained from a requesting user. Both biometric readings are verified before access to resources of a smart card are made available to the requesting user.

Multiple biometric smart card authentication

An attribution analysis and correlation system can include a content manager and a semantic correlation module. The content manager can receive a list identifying at least one contributor to be evaluated. The content manager can also mine at least one community for content pertaining to the contributor(s). The semantic correlation module can generate correlation results by performing a semantic analysis and correlation on the persistent content and attributions corresponding to the contributor(s).

Attribution analysis and correlation

An identity analysis and correlation service system can include a summary manager service for generating identity correlation summaries pertaining to a persona, wherein the generated identity correlation summaries are based on discovered content corresponding to the persona and analyzed content corresponding to the discovered content. The system can include a content search manager service for generating the discovered content based on search criteria and a semantic analysis service for generating the analyzed content. The system can also include a data store for storing the generated identity correlation summaries and a notification service for providing a notification based on the generated identity correlation summaries.

Identity analysis and correlation

A content analysis and correlation service system can include a summary manager service for generating content correlation summaries, wherein the generated content correlation summaries are based on discovered content and analyzed content based on the discovered content. The system can include a content search manager service for generating the discovered content based on search criteria and correlation criteria and a semantic analysis service for generating the analyzed content based on the discovered content. The system can also include a data store for storing the generated content correlation summaries and a notification service for providing notifications based on the generated content correlation summaries.

Content analysis and correlation

Techniques are provided for allocating resources over a network. A resource consumer requests access to a resource over a network. As part of that request, the resource consumer acquires information that permits it to securely communicate with a resource provider. The resource provider controls the resource and once satisfied with the security of a request from a resource consumer allocates the resource for access by the resource consumer.

Allocation of network resources

Methods and systems are provided which control access by a task to an information object in a computer system. The task is authenticated by an authentication procedure to act on behalf of a user. A computer-implemented method includes associating an authentication grade with the authentication procedure, identifying at least one clearance level previously assigned to the user by a clearance administrator, and identifying at least one classification level previously assigned to the information object by a classification administrator. The method then determines the access rights of the task with respect to the information object based at least on the authentication grade, the clearance level, and the classification level. Information about the user's connection to the system may also be considered. The results of the determination are distributed to promote consistent access; rights throughout the system.

Growing community of inventors

Pleasant Grove, UT, United States of America

Tammy Anita Green