Abstract: An Internet Box Office (IBO) system and technique vends digital content via a computer network, such as the Internet. The IBO system comprises a viewing system that cooperates with a Digital Rights Management system and various deployment enhancements within the Internet to provide an infrastructure that facilitates access to digital content in a manner that comports with copyright law and the control of intellectual property by the copyright owner. The IBO system enables a content copyright owner to retain control of its intellectual property while allowing a consumer to have transparent access to the copyright-protected content via the network. To that end, the IBO system operates to download and stage the copyrighted digital content on the viewing system of a consumer.

Abstract: Techniques are provided for dynamically establishing and managing authentication and trust relationships. An identity service acquires and evaluates contracts associated with relationships between principals. The contracts permit the identity service to assemble authentication information, aggregated attributes, and aggregated policies which will drive and define the various relationships. That assembled information is consumed by the principals during interactions with one another and constrains those interactions. In some embodiments, the constraints are dynamically modified during on-going interactions between the principals.

Abstract: A fluid-flow control system for a valve comprises a valve body and a bi directional main flow passage between a first and second fluid areas. The shuttle piston having a first face in direct communication with the second area and a second face in communication therewith through a bleed orifice. The second face is alternately exposed to the first fluid area through a backpressure passage and second orifice which alters the pressure differential across the shuttle piston. A second valve such as a solenoid operates to either close the second orifice wherein the shuttle piston is operable under differential pressure between the first and second pressure areas, or to close the second orifice wherein the shuttle piston is operable under differential pressure between the second pressure area and the backpressure passage. Filters at the fluid inlet and outlets protect the sealing components therein.

Abstract: Techniques for network application layer routing are provided. Requests for services are inspected at an application layer of a network. A priority for a requestor is obtained and in response to the priority the requests are routed to particular processing environments. Depending on the priority the processing environments may be high performing or low performing.

Abstract: Techniques for the remote authorization of secure operations are provided. A secure security system restricts access to a secure operation via an access key. An authorization acquisition service obtains the access key on request from the secure security system when an attempt is made to initiate the secure operation. The authorization acquisition service gains access the access key from a secure store via a secret. That is, the secret store is accessible via the secret. The secret is obtained directly or indirectly from a remote authorization principal over a network.

Abstract: In various embodiments of the invention, techniques are presented for providing multifactor authentication. A first set of credentials are received, which are associated with a first principal, and at least one identifier also associated with the first principal is obtained from a second principal. Next, the first principal's knowledge of the at least one identifier is verified and an authentication credential is generated for the first principal. The authentication credential permits the first principal to access the second principal.

Abstract: Techniques for federating and for attesting to online reputations are provided. A variety of reputation sources supply portions of reputation information about a principal. The portions are aggregated and optionally weighted to form a summary of reputation information. The summary is then represented as an attestation and optionally signed by the service providing the attestation.

Abstract: Policy enforcement via attestations is provided. A principal operates within an environment and assumes roles having certain access rights to resources and the principal takes actions while assuming those roles. The roles and actions are monitored and attestations are raised under the proper set of circumstances. The attestations trigger policy restrictions that are enforced against the principal. The policy restrictions circumscribe the access rights to the resources.

Abstract: Techniques for distributing content over a network via keys are provided. A key is associated with a particular destination or with a particular piece of content. A path management service derives and selectively communicates portions of a network path for moving the content to a destination on the basis of a value for a key. Any intermediate processing resource receives a next location within the path for forwarding the content from the path management service in response to presenting the key.

Abstract: Techniques for attesting to content received from an author (sender) are provided. A sender's content is represented by a message digest. The message digest is signed by an identity service. The signed message digest represents an attestation as to the authenticity of the content from the sender. The sender transmits the signed message digest and content in a message to a recipient. The recipient verifies the signature and message digest to authenticate the content from the sender.

Abstract: Techniques are provided for preserving and managing identities within an audit log. Initial entries into a log do not include an explicit and direct reference to an agent that performs a transaction; rather, the agent acquires a temporary transaction identity for the transaction and an indirect reference to the transaction identity is written to the log while the transaction is pending. Once the transaction completes a direct reference to the transaction identity is written to the log, the identity of agent remains transparent until the identity of the agent expires, if at all.

Abstract: Techniques for modeling and evaluating protocol interactions are provided. A service is monitored for its interactions with one or more protocols. The protocols are semantically defined and reference behaviors are derived therefrom in response to the interactions. The reference behaviors are then compared to runtime activities observed for the service with respect to the one or more protocols. If the activities deviate beyond a threshold, then the activities are flagged as suspect or deviant behaviors for the service.

Abstract: Techniques are provided for secure synchronization and sharing of secrets. A first principal acquires an encrypted access key to a secret store of a second principal. The first principal contacts an identity manager and supplies a decrypted version of the access key. One or more secrets of the second principal may be acquired or modified by the first principal while accessing the secret store.

Abstract: Codifying the “most prominent measurement points” of a document can be used to measure semantic distances given an area of study (e.g., white papers on some subject area). A semantic abstract is created for each document. The semantic abstract is a semantic measure of the subject or theme of the document providing a new and unique mechanism for characterizing content. The semantic abstract includes state vectors in the topological vector space, each state vector representing one lexeme or lexeme phrase about the document. The state vectors can be dominant phrase vectors in the topological vector space mapped from dominant phrases extracted from the document. The state vectors can also correspond to words in the document that are most significant to the document's meaning (the state vectors are called dominant vectors in this case). One semantic abstract can be directly compared with another semantic abstract, resulting in a numeric semantic distance between the semantic abstracts being compared.

Abstract: Semantic identities are provided. A semantic identity is created for an agent. The semantic identity is associated with one or more categories and the categories are associated with interests. The semantic identity mines a network for information that relates to the one or more categories or the interests and packages the information for the agent's subsequent review and consumption.

Abstract: A laparoscopic surgical instrument configured to be ergonomic and anthropometrically correct, the laparoscopic surgical instrument comprising: (a) an ergonomic handle configured to orient a hand of a surgeon in a functional position, the handle comprising a handle grip; (b) an actuating mechanism actuatable by a finger and supported by the handle, the actuating mechanism comprising an actuator shaft and a gearing assembly operable to displace the actuator shaft with a mechanical advantage upon actuation of a trigger by the surgeon; (c) a locking mechanism configured to lock the actuating mechanism in one of a plurality of positions, the locking mechanism comprising a release located in an anthropometrically correct position; and (d) a working shaft having a proximal end coupled to and operable with the actuator shaft, the working shaft having an elongate configuration and a distal working end configured to couple a surgical tool to be manipulated by the surgeon via the handle and the actuating mechanism to pe

Abstract: Techniques to pollute electronic profiling are provided. A cloned identity is created for a principal. Areas of interest are assigned to the cloned identity, where a number of the areas of interest are divergent from true interests of the principal. One or more actions are automatically processed in response to the assigned areas of interest. The actions appear to network eavesdroppers to be associated with the principal and not with the cloned identity.

Abstract: A directed set can be used to establish contexts for linguistic concepts: for example, to aid in answering a question, to refine a query, or even to determine what questions can be answered given certain knowledge. A directed set includes a plurality of elements and chains relating the concepts. One concept is identified as a maximal element. The chains connect the maximal element to each concept in the directed set, and more than one chain can connect the maximal element to any individual concept either directly or through one or more intermediate concepts. A subset of the chains is selected to form a basis for the directed set. Each concept in the directed set is measured to determine how concretely each chain in the basis represents it. These measurements for a single concept form a vector in Euclidean k-space. Distances between these vectors can be used to determine how closely related pairs of concepts are in the directed set.

Abstract: Starting with a dictionary including concepts and chains, a subset of the chains is selected as intentional stance basis chains (ISBCs). Concepts in the dictionary are chosen and mapped to state vectors using the ISBCs. The state vectors are assembled into a template, and an action and threshold distance are assigned to the template. When an impact summary is generated for a content source, the distance between the impact summary and the template is measured. If the distance is less than the threshold distance associated with the action for the template, the action is performed.

Abstract: Crafted identities are provided. A statement is provided to the principal for using a crafted identity. The statement includes an identifier that provides access to a resource when presented by the principal to the resource. The statement also includes one or more roles and permissions for the crafted identity when accessing the resource.