77 results about "Directory service" patented technology

The invention relates to the technical field of large models, in particular to a large model distributed reasoning acceleration method based on multi-modal feature fusion and dynamic weight optimization, and the method comprises the following steps: S1, carrying out real-time semantic analysis through a reasoning context analysis module embedded in a load balancer to obtain semantic features; s2, calculating a cache adaptation degree according to the semantic features; s3, querying a global cache directory service to obtain a matched node list, and making a decision by using a multi-fusion decision algorithm in combination with various parameters of cache adaptation condition, node load condition and network quality; and S4, deploying a global cache directory service in the load balancing layer according to the decision, maintaining a local cache pool at each computing node, and synchronizing the cache metadata to the global cache directory service in real time. The method solves the problems that when a conventional load balancing strategy is adopted for multi-node deployment, waste of computing resources is easily caused, the overall energy consumption of the system is increased, and the request processing speed is reduced.

Endpoints in a network execute a sensor module that intercepts responses from a directory service to a source on the endpoint. The sensor module determines if the source is sanctioned, such as by referencing a sanctioned list of applications. If the source is not sanctioned, then a simulated response can be provided to the source that references a decoy server.

A system and method for privilege assurance protection of computer networks that remedies the deficiencies of the current directory service structure. The system uses a software agent to collect and store snapshots of all network resources on a computer network by identifying network domains, searching the directory service of each domain for network resources, and periodically querying the network resources for changes. The software agent communicates with a backend server which provides searching, querying, storage, administrative and other functionality to the agent via remote procedure calls.

Managing access to stored objects includes receiving, by a storage OS in a computing system, an access key identifier (ID) and access key associated with a user of an object storage service (OSS); determining, by a directory service, whether the user is a member of a group authorized to access a storage object in at least one of a network accessible storage (NAS) volume and an OSS bucket, based at least in part on the access key ID; in response to the user being a group member, attempting to authenticate the user by the storage OS with the directory service based at least on the access key ID and the access key; and in response to the user being authenticated by the directory service, allowing, by the storage OS, access by the user to the storage object stored in at least one of the NAS volume and the OSS bucket.

In one embodiment, a method includes receiving a first request to access one or more resources in the first network layer. The method may include acquiring first identity information of a first user account specified in the first request. The method may include performing multi-factor authentication of the first user account using the first identity information. In response to authenticating the first user account using the first identity information, the method may include acquiring multiple shares of pre-configured first hidden data from a distributed ledger in the first network layer. The method may include determining a first password from the multiple shares of pre-configured first hidden data and, using the first password, authenticating the first user account to access the one or more resources in the first network layer.

The invention provides a universal method for realizing multi-condition and search based on LDAP, and belongs to the technical field of data retrieval of directory service and identity management. A user defines query conditions including attributes, values and logical relationships through a configuration file, a visual interface or an interface; the system parses the query condition model into a query condition model supporting nested combination of AND, OR and NOT by using a parser, and performs legality check and error prompt; and then a generator dynamically generates a filtering statement conforming to the LDAP grammar specification according to the model, and query is executed through an LDAP client. In order to improve the performance, common condition caching and high-frequency statement pre-compiling optimization are introduced, and an asynchronous query mode is supported. And the query result is returned in the form of structured data, and is matched with a display interface to support screening, sorting and exporting, so that the flexibility and maintainability of multi-condition query are improved.

Provided herein are systems, methods, and computer-storage media for managing data object access in a catalog service account. The method includes detecting, at a catalog service account, by a catalog manager (CM), a user request to access a data object. The user request includes identification information of the user and a principal role associated with the user. The CM retrieves one or more catalog roles from a first catalog of the catalog service account. The one or more catalog roles correspond to the principal role. The CM determines a set of hierarchical data objects based on the user request. The set of hierarchical data objects comprise the data object. The CM performs a determination of whether access privileges of the set of hierarchical data objects and access privileges of the one or more catalog roles allow access to the data object. The CM grants access to the data object based on the determination.

Approaches in accordance with various embodiments allow for zero-touch enrollment of devices with respective manager systems. In at least one embodiment, a device at startup can contact a central directory service (CDS) for information about an associated manager. The CDS can authenticate the device using device information included in the request, and can send a challenge token to the device in response. The challenge token can include information for the manager, protected with multiple layers of security that should only be able to be decrypted by the authenticated device. The device can decrypt this challenge token to determine the manager information, and can convert this challenge token to a bearer token. The device can then send a request to the determined manager that includes the bearer token, which the manager can use to authenticate the device. The manager can then send the device appropriate configuration information.

Systems and methods provide for integrating a wallet client with federated directory services are disclosed herein. By integrating merchant services, such as directory services with a wallet service provider, wallet clients on mobile devices can have access to all merchant listings without having to manually add each directory service. The system disclosed herein integrates Chamber of Commerce directory service listings with the wallet client, such that when a request for a merchant directory service is received from a device associated with the wallet client, the request is forwarded to a federated directory service wallet system interface operated by a Chamber of Commerce site. Supply chain data that matches the request, and location information that is included in the request, is then fetched from the federated directory service wallet system interface and forwarded to the device that sent the request.

The invention relates to the technical field of information security, and discloses a multi-system single sign-on security management method and system, a storage medium and equipment, and the method comprises the steps: building a deep integration architecture between a directory service and an identity management server, and achieving the bidirectional synchronization of user attributes and security policies; a unified multi-factor authentication process and a security defense strategy are configured in the identity management server; by implementing password expiration risk assessment, multi-channel reminding and password self-service modification service, intelligent password life cycle active management is realized; intelligent account locking and self-adaptive unlocking based on multiple factors are implemented, and differentiated locking duration is dynamically calculated and executed; a cross-system unified session management and cooperative control mechanism is established, session anomaly real-time detection and scoring are performed through multi-dimensional feature fusion, one-point logout of global failure is realized, cross-system unified authentication, active security protection and cooperative management and control are realized, and the security and operation and maintenance efficiency of enterprise identity management are remarkably improved.

A system and method for analyzing directory service environment attack path choke points for an enterprise may continuously collect data about the attack paths and provide alerts.

A method for managing data protection includes obtaining, by a backup server, a restoration request for a virtual machine (VM) that includes an active directory (AD) application, and wherein the AD application comprises a set of AD objects and a directory service for managing the set of AD objects, parsing a VM backup corresponding to the VM, stored in a backup storage system, to identify an AD application backup of the AD application using metadata stored in an index and search microservice of the backup server, mounting, using an AD recovery microservice, backups of the set of AD objects of the AD application backup to the production environment, and providing browse and restoration services to the production environment based on the mounting of the AD objects and using the AD recovery microservice.

Application-manager software authenticates a user of a client device over a channel. The authentication operation is performed using a directory service. The application-manager software presents a plurality of applications in a GUI displayed by the client device. The plurality of applications depends on the authentication, the client device, and the channel. And the plurality of applications includes a thin application and a software-as-a-service (SaaS) application. The application-manager software receives a selection as to an application from the user. If the selection is for the SaaS application, the application-manager software provisions the SaaS application. The provision includes automatically logging the user onto an account with a provider of the SaaS application using a single sign-on and connecting the user to the account so that the user can interact with the SaaS application. If the selection is for the thin application, the application manager software launches the thin application.

The application discloses a trusted business card calling system and method, comprising: an electronic authentication module, which is used for issuing a digital certificate for an enterprise or an institution with a first user; a business card issuing module, which is used for editing and exporting a vCard format file of the first user's business card information, and signing the business card of the first user's vCard format file by using a private key of the digital certificate to obtain a trusted business card, and publishing the trusted business card to a directory server for a calling terminal to download; the calling terminal and the called terminal; the directory server, which is used for authenticating other system structures, and providing specified access rights for the calling terminal and the called terminal, and is used for the calling terminal to download the trusted business card and the called terminal to verify the trusted business card; the calling terminal downloads the trusted business card of the first user from the directory server, and transmits the trusted business card to the called terminal for display. The application has the advantages of independent issuing by the enterprise or the institution, guaranteeing the authenticity of work role information, relatively low implementation cost, better compatibility with existing systems and applications, and the like.

The present disclosure includes systems and methods for a security policy framework. Various embodiments include responsive to receiving a trigger, fetching one or more policies from a policy catalog service; compiling the one or more policies into a query, wherein the one or more policies can be compiled into a plurality of different query languages; executing the query over customer data, the customer data being located in one or more data sources; and persisting results of the query.

A system and method for routing digital messages via authentication networks are provided. The method may include, at a first directory server, maintaining a routing data structure with routing information. The routing information may include first and second destination endpoint identifiers. The method may include updating a first source endpoint with configuration to transmit messages to a first destination endpoint and messages to a second destination endpoint, associated with respective endpoint identifiers. The method may include, in response to receiving a first message associated with a first destination endpoint identifier, routing the first message to a first destination endpoint and, in response to receiving a second message associated with a second destination endpoint identifier, routing the second message to a destination interface of a hosted system. The system may include a first directory server and a hosted system for performing the method.

Systems and methods are provided for facilitating network interactions based on user biometrics. One example computer-implemented method includes receiving, from a directory server, a biometric service provider (BSP) assertion having a signature computed using a private key of a BSP, where the BSP assertion includes a biometric ID of a user, and verifying the signature of the BSP assertion using a public key specific to the BSP previously shared with the computing device. The method also includes returning a verification result to the directory server, receiving an access token based on the verification result, and then receiving an authentication creation request from a device specific to the user, which includes the access token. The method further includes determining that the access token is unexpired, providing a challenge to the device, and receiving, from the device, a signed challenge response.

Methods, systems, and computer program products for implementing an administrative unit management process. An object membership request that includes a membership access change for an object for one or more administrative units of a plurality of administrative units is received at a management service from a client device. Membership evaluation information associated with the object is obtained from a directory service for the plurality of administrative units. A membership change action is determined based on the membership evaluation information. Instructions are provided to at least one administrative unit of the plurality of administrative units to implement the membership change action. A membership change notification is sent to the client device.

Secure directory services are disclosed. A cryptographic hash of a foreign identifier associated with a potential user is received. A determination is made that the received cryptographic hash of the foreign identifier matches a representation of a stored entry. In response to the determination, a transmission of a representation of a native identifier associated with the stored entry is transmitted to the sender of the cryptographic hash of the foreign identifier.

The invention provides a real-time online visualization method and device for multi-resolution grid data, and belongs to the technical field of data processing and visualizing.The method comprises the steps that firstly, grid data are merged into sequence columns in the Z direction to form a multi-resolution stacked grid model, the multi-resolution stacked grid model is stored in an HDF5 file according to resolution levels, and parallel I / O is achieved in combination with MinIO distributed object storage; secondly, a Z-Order index and directory server strategy is designed, and the data scheduling and transmission efficiency is improved; a browser end adopts a virtual quadtree structure to organize data, and realizes multi-thread real-time data receiving in combination with WebWorker and WebSocket, so that the blockage of a main thread is avoided; finally, the LOD level is dynamically selected based on the viewpoint distance, and efficient volume rendering is achieved through a GPU texture array and LOD InfoTexture. According to the method, online real-time updating is supported, the loading delay is remarkably reduced, and the visual frame rate is improved.

Methods and systems are described which obtain a service token at an edge device. Embodiments obtain a device certificate from an authentication service based on a private key which is associated with a public key. The public key is further associated with a device identifier for the edge device at a directory service. Embodiments send a request for a service token to an authentication service from a directory service based on the private key where the directory service has identified the public key for the edge device. Other embodiments extract the device identifier from the device certificate and send a request for a service token to the directory service, where the request includes the device certificate and the device identifier. Embodiments receive the service token from the directory service and use the service token to access a service.

The application discloses a cross-domain sharing system and method for earth data resources, an earth data resource directory service, structural analysis of earth data resources of different sources and different types, extraction of core meta information of the earth data resources, establishment of a unified earth data resource model, instantiation of the earth data resource model, correlation and integration of earth resource data in each domain and the whole domain, construction of an earth data resource directory, establishment of a unique data identifier by using data types, spatial ranges, spatial levels and time ranges; a cross-domain resource acquisition module dynamically positions the earth data resources under the premise of balancing resources and efficiency, realizes efficient acquisition of the earth data resources across domains based on reverse proxy technology, restricts cross-domain acquisition behaviors of users from two aspects of permission hierarchical control and risk behavior limitation, intercepts user acquisition beyond the permission definition, and implements acquisition limitation for acquisition behaviors with potential risks; and a mixed backup mechanism of the earth data resources comprehensively considers acquisition efficiency and security factors in the backup process of the earth data resources, and provides mixed earth data resource division strategies and copy migration strategies. The application improves resource utilization efficiency by establishing a cross-region coordination mechanism, and promotes deep sharing of the earth data resources.

This invention provides a method and apparatus for real-time online visualization of multi-resolution grid data, belonging to the field of data processing and visualization technology. First, the grid data is merged into hierarchical columns along the Z-axis to form a multi-resolution stacked grid model, which is then stored in HDF5 files according to resolution levels. Parallel I / O is achieved using MinIO distributed object storage. Second, a Z-Order index and directory server strategy are designed to improve data scheduling and transmission efficiency. On the browser side, a virtual quadtree structure is used to organize the data, and WebWorker and WebSocket are used to achieve multi-threaded real-time data reception, avoiding main thread blocking. Finally, the LOD level is dynamically selected based on the viewpoint distance, and efficient volume rendering is achieved using GPU texture arrays and LODInfoTexture. This method supports online real-time updates, significantly reduces loading latency, and improves the visualization frame rate.

The invention discloses a mixed directory management method and system for a trusted data space in the automobile industry, and aims to solve the contradiction between sovereignty protection and query efficiency of pure centralized and pure federated directory architecture. The method is based on a hybrid architecture of participating nodes, centralized directory services and data consumers, and through metadata acquisition preprocessing and automatic grading, public layer metadata is desensitized and differentially synchronized to a central directory; and completing query request verification and standardization in combination with DID identity authentication, intelligently selecting a query path by a routing engine according to multi-dimensional cost, executing distributed fine-grained authorization on business / sensitive layer metadata, and finally aggregating multi-source result feedback. Experiments prove that the query efficiency of the method is improved by 1-2 orders of magnitude compared with a pure federation mode, the synchronization bandwidth is reduced by 97% compared with a pure centralization mode, the balance of efficient global discovery and strict sovereign protection of data resources in the automobile industry is realized, and the method adapts to large-scale collaboration scenes such as supply chain collaboration.

Systems and methods are provided for facilitating network interactions based on user biometrics. One example computer-implemented method includes receiving, from a directory server, a biometric service provider (BSP) assertion having a signature computed using a private key of a BSP, where the BSP assertion includes a biometric ID of a user, and verifying the signature of the BSP assertion using a public key specific to the BSP previously shared with the computing device. The method also includes returning a verification result to the directory server, receiving an access token based on the verification result, and then receiving an authentication creation request from a device specific to the user, which includes the access token. The method further includes determining that the access token is unexpired, providing a challenge to the device, and receiving, from the device, a signed challenge response.

A method includes receiving, by a service operating in a provider network comprising a plurality of tenants, a request from a user device of one or more user devices in a user VPC of a first tenant of the plurality of tenants, wherein the request includes service identity information and authentication information. The method also includes providing, by the service, the request to an intermediary service operating in the provider network, wherein the intermediary service associates the service identity information with information maintained by the intermediary service associated with the tenants, and authenticating, by the intermediary service and with a domain controller, the request based on the authentication information. The method further includes, after the request is successfully authenticated, generating, by a private certificate authority (PCA) in a service VPC separate from the user VPC, a certificate based on the request, and providing the certificate to the user device.

The invention discloses a data directory management system and method based on metadata driving, and the system comprises a metadata collection module which is used for automatically collecting the metadata information of structured and unstructured data from a plurality of business data sources, and a metadata analysis and classification module which is used for analyzing the collected metadata and classifying the metadata information of the structured and unstructured data. The metadata analysis module is used for analyzing metadata and classifying the analyzed metadata according to a predefined classification rule, the data directory generation module is used for automatically constructing and updating a multi-level data directory structure according to the classified metadata, and the directory service interface module is used for providing a standardized data directory retrieval and access interface. Through automatic metadata acquisition and real-time processing, the problems of update lag and poor consistency caused by manual maintenance are solved, intelligent data classification and dynamic directory construction are realized by means of a configurable rule engine, the intelligibility and management flexibility of data assets are improved, and through a unified service interface and refined authority control, the method is simple and convenient to operate and high in practicability.

A system and method of establishing a resource provider as a trusted list entry is disclosed. The method includes receiving, by a directory server computer, an indication from a user that a resource provider is trusted. The directory server computer is programmed to provide a first level of authentication. The method then includes storing data representing the indication from the user that the resource provider is trusted in a database. The method then includes receiving, from the user, an authentication request message to interact at the resource provider computer and determining that the data representing the indication from the user that the resource provider is trusted is present. In response to the determination, the method includes providing a second level of authentication to the user before the user is allowed to complete the interaction. The second level of authentication is lower than the first level.

A computer system receives a request from a device to join a device social network supported by an enterprise device social media cloud. The request comprises a user packet that includes a network social name, enterprise credentials of the device, and device information metadata. The computer system validates the user packet. When the validation is successful, the computer system calls a directory service to create a directory service user entry corresponding to the device in the directory service. When the creation of the directory service user entry is successful, the computer system creates a device social network user corresponding to the device in the enterprise device social media cloud.

A metadata management method and device of an AI data lake, a medium, and an electronic device, relating to the technical field of computers, the method comprising: in response to a first operation request for first metadata, parsing the first operation request to obtain first request information; a preset directory structure comprising at least a tenant domain, a directory domain, and an object domain nested in stages; in response to logical addressing information pointing to a first directory service of the plurality of metadata directory services, routing the first operation request to a first connector corresponding to the first directory service, the connectors corresponding to different metadata directory services having mutually isolated runtime environments, or the connectors corresponding to different types of metadata directory services having mutually isolated runtime environments; and executing the first operation on the first metadata in the first directory service through the first connector to obtain an execution result. Thus, tenant-level isolation and fine-grained access control of metadata are achieved, and dependency conflicts between different connectors are avoided.