1. A base station apparatus comprising:
a determining unit that determines whether a direct link has been established between the base station apparatus and another base station apparatus, when a mobile device makes a request to switch a communication recipient from the base station apparatus to the other base station apparatus;
a link information acquiring unit that acquires, indirectly from the other base station apparatus, link information necessary for establishing the direct link to the other base station apparatus, when the determining unit determines that no direct link to the other base station apparatus has been established; and
a link requesting unit that requests the other base station apparatus to establish the direct link to the base station apparatus, based on the link information of the other base station apparatus acquired by the link information acquiring unit.
2. The base station apparatus according to claim 1, further comprising:
a counting unit that counts number of handovers made using the direct link to the other base station apparatus established in response to the request from the link requesting unit, or number of handovers made using an indirect link to the other base station apparatus, the handovers being made by a plurality of mobile devices each switching a communication recipient from the base station apparatus to the other base station apparatus; and
an indirect handover time determining unit that determines whether the number of handovers counted by the counting unit and made using the indirect link to the other base station apparatus exceeds a predetermined number, wherein
the link requesting unit requests the other base station apparatus to establish the direct link to the base station apparatus, when the indirect handover time determining unit determines that the number of handovers made using the indirect link to the other base station apparatus exceeds the predetermined number.
3. The base station apparatus according to claim 2, further comprising:
a direct handover time determining unit that determines whether the number of handovers counted by the counting unit and made using the direct link to the other base station apparatus exceeds a predetermined number; and
a link cancel requesting unit that requests the other base station apparatus to cancel a link to the base station apparatus, when the direct handover time determining unit determines that the number of handovers made using the direct link to the other base station apparatus does not exceed the predetermined number.
4. The base station apparatus according to claim 2, further comprising a link information storage unit that stores therein the link information of the other base station apparatus acquired by the link information acquiring unit, wherein
the link requesting unit requests the other base station apparatus to establish the direct link to the base station apparatus based on the link information of the other base station apparatus stored in the link information storage unit, when the indirect handover time determining unit determines that the number of handovers made using the indirect link to the other base station apparatus exceeds the predetermined number.
5. The base station apparatus according to claim 2, wherein the indirect handover time determining unit determines whether the number of handovers made using the indirect link to the other base station apparatus exceeds the predetermined number, when the counting unit finds an increase in counted handovers made using the indirect link to the other base station apparatus.
6. The base station apparatus according to claim 3, wherein the direct handover time determining unit determines whether the number of handovers made using the direct link to the other base station apparatus exceeds the predetermined number, when the counting unit finds an increase in counted handovers made using the direct link to the other base station apparatus.
7. A communication control method performed by a communication control system comprising a first base station apparatus with which a mobile device is in wireless communication; a second base station apparatus neighboring the first base station apparatus; and a control device connected to the first and the second base station apparatuses, the communication control method comprising:
determining whether a direct link has been established to the second base station apparatus, when the mobile device makes a request to switch a communication recipient from the first base station apparatus to the second base station apparatus;
acquiring, from the second base station apparatus through the control device, link information necessary for establishing the direct link to the second base station apparatus, when, in the determining, it is determined that no direct link to the second base station apparatus has been established; and
requesting the second base station apparatus to establish the direct link to the first base station apparatus, based on the link information of the second base station apparatus acquired in the acquiring.
8. An inter-station control method comprising:
determining whether a direct link has been established between a base station apparatus and another base station apparatus, when a mobile device makes a request to switch a communication recipient from the base station apparatus to the other base station apparatus;
acquiring, indirectly from the other base station apparatus, link information necessary for establishing the direct link to the other base station apparatus, when, in the determining, it is determined that no direct link to the other base station apparatus has been established; and
requesting the other base station apparatus to establish the direct link to the base station apparatus, based on the link information of the other base station apparatus acquired in the acquiring.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A system for maintaining security in a distributed computing environment, comprising:
a policy manager located on a server to maintain policy data files and distribute local security policies to a plurality of clients; and
a plurality of application guards, wherein each application guard is located at one of the plurality of clients to manage access by individual transactions to at least one application associated with the application guard, wherein the application guard controls access to the application based on a local security policy received from the policy manager,
wherein the application guard receives an authorization request including a subject, an object and a privilege and evaluates said request by matching the rules received from the policy manager to said subject, said object and said privilege in order to control access to said application associated with the application guard.
2. The system of claim 1 wherein:
the policy manager derives local security policies from a global security policy, the global security policy includes a plurality of rules applicable to all application guards in the system.
3. The system of claim 2 wherein:
the policy manager optimizes the global security policy into an optimized form, wherein the optimized form only distributes attributes relevant to a specific application guard.
4. The system of claim 1 wherein:
the policy manager computes any differences caused by a modification on the security policy and commit only the changed portion of the security policy to an appropriate application guards.
5. The system of claim 1 wherein:
the policy manager supports concurrent rule development by multiple users.
6. The system of claim 1 wherein:
the policy manager tracks and record authorization requests.
7. The system of claim 1 wherein:
the policy manager is associated with an application guard to allow only authorized administrator to access and operate the policy manager.
8. The system of claim 1 wherein:
the policy manager reviews and reconstructs policy rules to make sure the policy rules are syntactically and semantically correct to a predefined policy language.
9. The system of claim 1 wherein:
the policy manager determines which application guard needs to receive which policy rules.
10. The system of claim 1 wherein:
the application guard is integrated into the application associated with the application guard.
11. The system of claim 1 wherein:
the application guard evaluates the authorization request against a stored local security policy.
12. The system of claim 1 wherein:
the application guard is associated with plug-ins to allow for additional capabilities to process and evaluate the authorization request based on customized code.
13. The system of claim 1 wherein:
the application guard is implemented as a remote authorization service through a remote procedure call to another server.
14. The system of claim 1 wherein:
the application guard uses multiple authorization engines to add performance and reliability.
15. The system of claim 1, further comprising:
an enterprise policy database that allows a user to enter policy rules one at a time.
16. The system of claim 16, further comprising:
a policy loader to bulk load a existing set of policy rules into the enterprise policy database.
17. A system for maintaining security in a distributed computing environment, comprising:
a policy manager located on a server to maintain policy data files and distribute local security policies to a plurality of clients, wherein the policy manager operates to
derive local security policies from a global security policy, the global security policy includes a plurality of rules applicable to one or more of the plurality of clients;
organize the global security policy into an optimized form, wherein the optimized form only distributes attributes relevant to a specific client;
compute any differences caused by a modification on the global security policy and commit only the changed portion of the global security policy to a specific client;
18. A system for maintaining security in a distributed computing environment, comprising:
a plurality of application guards, wherein each application guard is located at one of a plurality of clients to manage access by individual transactions to at least one application associated with the application guard, wherein the application guard controls access to the application based on a local security policy received from a policy manager,
wherein the application guard receives an authorization request including a subject, an object and a privilege and evaluates said request by matching the rules received from the policy manager to said subject, said object and said privilege in order to control access to said application associated with the application guard.