Abstract: A system and method for sending, resolving, and receiving queries for information on the status of network resources. A peer computing system may include one or more resolver nodes on a network for resolving queries for a resource to particular resource instances. The resolver nodes may receive query messages from peer nodes on the network. Each query message may request information about a resource implemented by one or more peer nodes on the network. The query messages may be formatted in accordance with a peer resolver protocol. The resolver node may determine a particular instance of the resource hosted on a particular peer node to receive the query. The resolver node may use a variety of criteria to determine a particular resource instance. The resolver node may forward the query message to the determined resource instance.

Abstract: A system and method for providing advertisements in a peer-to-peer networking environment is described. In one embodiment, the peer-to-peer protocols may use advertisements to describe and publish the existence of peer resources. An advertisement may be defined as a structured, language neutral metadata structure that names, describes, and publishes the existence of a peer-to-peer platform resource, such as a peer, a peer group, a pipe, or a service. In one embodiment, user-defined advertisement subtypes (for example, using XML schemas) may be formed from these basic types. A peer in a peer-to-peer network may publish a resource advertisement to make the resource corresponding to the advertisement available to other peers on the network. Peers may discover published advertisements by broadcasting discovery query messages. Other peers may respond to discovery query messages by sending response messages that may include advertisements.

Abstract: A system and method for allowing peers to exchange messages with other peers independently of their network location in a peer-to-peer environment. Messages may be transparently routed, potentially traversing partitions (e.g. firewalls and NATs), and using different protocols to reach the destination peers. In one embodiment, any peer node may serve as a relay peer that allows peers inside a partition to have a presence outside the partition and provides a mechanism for peers outside partitions to discover and communicate with peers inside the partitions. In one embodiment, a relay peer may maintain information on routes to other peers and assist in relaying messages to other peers. In one embodiment, any peer may query a relay peer for route information. In one embodiment, messages may include routing information as part of their payloads.

Abstract: A system regulates access to resources requested by an operation executing on a computer. The operation invokes a plurality of methods that operate upon code during execution. The system includes a policy file, a call stack, and an execution unit. The policy file stores permissions for each of the resources. The permissions authorize particular types of access to the resource based on a source of the code and an executor of the code. The call stack stores representations of the methods and executors in an order of invocation by the operation. The execution unit grants access to the resource when the types of access authorized by the permissions of all of the methods and executors on the call stack encompass the access requested by the operation.

Abstract: A method and system are provided for determining whether a principal (e.g. a thread) may access a particular resource. According to one aspect of the invention, the access authorization determination takes into account the sources of the code on the call stack of the principal at the time the access is desired. Because the source of the code on the call stack will vary over time, so will the access rights of the principal. Thus, when a request for an action is made by a thread, a determination is made of whether the action is authorized based on permissions associated with routines in a calling hierarchy associated with the thread. The determination of whether a request is authorized is based on a determination of whether at least one permission associated with each routine encompasses the permission required to perform the requested action. Support for “privileged” routines is also provided.

Abstract: A system regulates access to resources requested by an operation executing on a computer. The operation invokes a plurality of methods that operate upon code during execution. The system includes a policy file, a call stack, and an execution unit. The policy file stores permissions for each of the resources. The permissions authorize particular types of access to the resource based on a source of the code and an executor of the code. The call stack stores representations of the methods and executors in an order of invocation by the operation. The execution unit grants access to the resource when the types of access authorized by the permissions of all of the methods and executors on the call stack encompass the access requested by the operation.

Abstract: A method and apparatus are provided for maintaining and enforcing security rules using protection domains. As new code arrives at a computer, a determination is assigned to a protection domain based on the source from which the code is received. The protection domain establishes the permissions that apply to the code. In embodiments where the code to be executed by the computer belongs to object classes, an association is established between the protection domains and the classes of objects. When an object requests an action, a determination is made as to whether the action is permitted based on the class to which the object belongs and the association between classes and protection domains.

Abstract: A method and apparatus for establishing and maintaining complex security rules is provided. The security rules are established through the use of "permission" classes that take advantage of the power and simplicity various features of object oriented programming, including the ability to inherit attributes and methods. For example, a permission super class is established that defines an interface to a validation method. A permission subclass may then be created which provides an implementation of the validation method. When invoked, the validation method indicates whether a given permission represented by one object belonging to a permission class encompasses the permission represented by another object belonging to a permission class. Classes are also provided for grouping permissions into sets, and for establishing protection domains for classes of objects.

Abstract: A method and apparatus for providing security in a computer system is provided. When code associated with an object class must be loaded, a search for the code is performed, inspecting locations in predetermined sequence, where the sequence ensures that untrusted code can not be loaded in place of trusted code. The sequence of locations may include locations specified by a user as well as locations specified by a default pathway. If the class is found and the class has not been loaded, the class is loaded and a set of permissions is associated with the class based on a predetermined mapping of code sources to permissions.

Abstract: A refrigerator having a middle fresh food compartment and a relatively large bottom freezer compartment arranged below the fresh food compartment and a relatively small freezer compartment arranged above the fresh food compartment. The bottom freezer compartment preferably supports a drawer including a frame and a removable bin. Cool air can be supplied to the compartments of the refrigerator by employing a two fan control system such that no electromechanical baffles are required. Alternatively, cool air can be directed to the compartments of the refrigerator by use of a baffle which requires only a single electromechanical device to control air flow into three different compartments. The baffle includes a main rotary damper which can be positioned to provide proportional amounts of chilled air to the three separate compartments based on the degree of cooling required.

Abstract: A refrigerator having a middle fresh food compartment and a relatively large bottom freezer compartment arranged below the fresh food compartment and a relatively small freezer compartment arranged above the fresh food compartment. The bottom freezer compartment preferably supports a drawer including a frame and a removable bin. Cool air can be supplied to the compartments of the refrigerator by employing a two fan control system such that no electro-mechanical baffles are required. Alternatively, cool air can be directed to the compartments of the refrigerator by use of a baffle which requires only a single electro-mechanical device to control air flow into three different compartments. The baffle includes a main rotary damper which can be positioned to provide proportional amounts of chilled air to the three separate compartments based on the degree of cooling required.

Abstract: Resonant tunneling semiconductor devices are disclosed useful for transport functions such as switching or amplification, and also for electro-optical conversions. In the structure of these devices, a central potential well is formed of an opposite conductivity type of semiconductor material to two semiconductor layers outside resonant tunneling barriers on each side of the central potential well, such that electrons in the well can tunnel to and from the outside semiconductor layers. The central potential well serves as the base of a three terminal device in transport applications, and as the light responsive portion for electro-optical applications. In one disclosed embodiment, the device is constructed in five layers of the most commonly used gallium-aliminum-arsenide compounds, an n GaAlAs, undoped GaAlAs, p GaAlAs, undoped GaAlAs, and n GaAlAs.