Abstract: A method of providing endpoint security for a session on an untrusted computer accessing data on a networked server is disclosed. A virtual secure desktop is created on the untrusted computer that protects the user's applications running in the virtual secure desktop from malicious code and encrypts all data. Data to be written to the hard drive is stored in a secure vault. The secure vault is completely encrypted and erased at the end of the virtual secure desktop session. The virtual secure desktop may be created by creating a separate user session on the untrusted computer and linking the separate user session to the secure vault. Alternatively, the virtual secure desktop may be created by intercepting calls the Native API and redirecting requests from the virtual secure desktop session to the secure vault.

Abstract: A method is disclosed for dynamically creating encapsulation and decapsulation chains and segmenting the packet-forwarding plane. A distributed router may comprise multiple cards, each exposing a subset of the router's physical interfaces. Some physical interfaces may be configured to send/receive only certain types and destinations of data packets. Some cards might not expose any physical interfaces configured to send/receive a particular type and destination of packet, making encapsulation and/or decapsulation chains for virtual interfaces that process data packets of the particular type useless on those cards. Therefore, instead of always creating both encapsulation and decapsulation chains for a virtual interface on a card, an aspect of the method dynamically determines which of the encapsulation and decapsulation chains are useful for a virtual interface on that card, and creates only those chains that are useful on that card.

Abstract: A method, computer-readable medium, and machine are provided for boosting the performance of sort operations. A database server performs an operation on a set of data. The operation uses disk space such as a temporary tablespace. The disk space belongs to a disk group in which data is stored according to a level of redundancy. A determination is made as to whether the operation is a sort operation. If the operation is not a sort operation, then at least part of a result of the operation is stored on the disk space according to the level of redundancy specified for the disk group. If the operation is a sort operation, then only a single copy of the at least part of the result is stored without storing a redundant copy of the at least part of the result. Optionally, backup information sufficient to re-perform the sort operation may also be stored.

Abstract: A method and apparatus for using network traffic logs for search enhancement is disclosed. According to one embodiment, network usage is tracked by generating log files. These log files among other things indicate the frequency web pages are referenced and modified. These log files or information from these log files can then be used to improve document ranking, improve web crawling, determine tiers in a multi-tiered index, determine where to insert a document in a multi-tiered index, determine link weights, and update a search engine index.

Abstract: In an embodiment, a fast group key management re-registration is described. One computer-implemented method comprises, at a key server: receiving a registration request from a network element to join a group of network elements managed by the key server; generating and storing a group member registration state comprising information identifying the network element within the group of network elements; generating a token using information from the group member registration state, wherein the token identifies the network element within the group; deleting the group member registration state for the network element at the key server; generating an encrypted token by encrypting the token using a secret key that is local to the key server; sending the encrypted token to the network element; receiving the encrypted token along with a re-registration request from the network element to re-join the group of network elements; and re-registering the network element using the encrypted token.

Abstract: Techniques are provided for estimating the cardinality of a virtual result table that is produced by executing path-based table functions within a query, such as the XMLTABLE function. Some path-based table functions apply a path expression to input from a base table of XML documents to select rows to produce the result table. Path statistics are collected for the path expressions for the base table. The path statistics are used to estimate the cardinalities of the result table. The estimated cardinality of the result table is useful for estimating costs of query execution plans that are generated for the query.

Abstract: An approach for reconciling a data warehouse includes automatically identifying, based upon a change made to a definition of an object, one or more other objects in the data warehouse that are affected by the change made to the definition of the object. The object and the other objects may be any type or form of data, for example, database tables or routines, and the invention is not limited to any particular type of object. Dependency analysis is used to evaluate dependency data to identify the one or more other objects affected by the change made to the definition of the object. The dependency data specifies dependencies between the object and the one or more other objects. The dependency data may also specify dependencies between the one or more other objects. As described in more detail hereinafter, the dependency data used may vary depending upon a particular function to be performed.

Abstract: A system and method for enabling a second database instance to more quickly process a request to execute a database statement that has previously been executed by a first database instance is described. In one embodiment, the method involves sending the database statement from the first database instance to the second database instance, and generating by the second database instance one or more structures needed to prepare the statement for execution, such as a parse tree and an execution plan for the statement. If at some point in the future, the second database instance receives a request to execute the same statement, the above structures can be used for execution, thereby eliminating the need for one or more potentially time-consuming operations, such as generation of a parse tree or execution plan for the statement.

Abstract: Techniques and systems for automatically configuring devices to interact with “legacy” wireless access points (“WAPs”) are disclosed. According to one technique, a user programs a WPS-enabled WAP with the configuration information of a “legacy” WAP. This makes the WPS-enabled WAP “aware” of the “legacy” WAP. When any other user brings his device within discovery range of the WPS-enabled WAP, the WPS-enabled WAP sends, to that device, a list of the WAPs of which the WPS-enabled WAP is aware. The device's user selects one of the WAPs (e.g., a “legacy” WAP) from the list. The WPS-enabled WAP receives the user's selection and sends, to the device, the configuration information for the selected WAP. The user's device configures itself, using the configuration information, to interact with the selected WAP. Thereafter, the user's device can access a network through the selected WAP, even if the selected WAP is a “legacy” WAP.

Abstract: In processing a query on multidimensional data in a multidimensional schema, a multidimensional database server performs various processes to limit the amount of data that is extracted from the database and presented to a relational database server in response to the request. A subset of data is identified to extract from the multidimensional data, based on the query. In various embodiments, cell-filtering, measure-filtering, and column-filtering criteria identified from the query are used to filter the subset of data, in order to return a minimized set of multidimensional data values from the subset of data. Therefore, computational resources are conserved with respect to further processing by the relational database server in response to the query.

Abstract: A method for software change modeling for network devices provides dynamic (on the device) and static (computer) change modeling. The same source code and libraries are used for both modeling applications, allowing a user to see the impact of activating or deactivating specific software modules without affecting the actual node. A master node passes a node the identity of the software package(s) to be updated and the dependencies. The node notifies its running processes about the update. If any of the processes determine that the update will degrade or have a negative impact on the operation of the node, it returns a veto to the node which sends a list of the processes that are impacted along with the reasons why to the master node.

Abstract: An apparatus comprising three memory portions and logic for programming the memory portions is presented. The first memory portion comprises a plurality of first data structures, each which includes an IGP label and an adjacency identifier that identifies one of a plurality of outgoing interfaces in the network element. The second memory portion comprises a plurality of IGP load-halancing entries, each of which includes two or more reference values that point to two or more of the plurality of lirsi data structures. The third memory portion comprises a plurality of BGP load-balancing entries, each of which includes an index value and a pointer. The fourth memory portion comprises a plurality of second data structures, each of which includes a network address identifier and a unique value associated with two or more of the plurality of BGP load-balancing entries.

Abstract: A method and apparatus for displaying digital images on a display is provided. A set of items from a sequence of items is displayed. The sequence of items includes one or more undisplayed items that do not belong to the set of items. The set of items are displayed, in an arrangement that includes a plurality of lines, in an order that corresponds to the sequence. In response to user input that selects a particular item from the set of items, it is determined whether the number of lines, in the plurality of lines, that precede the line containing the particular item is less than a first predetermined threshold. If that is the case, a line of undisplayed items that precede the set of items is displayed, while a line of displayed items that follow the particular item is ceased to be displayed.

Abstract: Techniques are provided for efficiently transferring documents (or files) between a client device and a WS-enabled device. A document is divided into a plurality of distinct chunks. Each chunk is packaged in a separate SOAP message. Each SOAP message includes a document identifier and a data transmission serial number (DTSN). The DTSN uniquely identifies a particular chunk of the document relative to the other chunks of the document. After one or more chunks of the document are transferred, the size of one or more subsequent chunks is adjusted based on changes in the client device, the WS-enabled device, and/or the network connection. Thereafter, each of the one or more subsequent chunks of the document is either larger or smaller than the one or more chunks that were already transferred.

Abstract: Techniques are provided for processing a CREATE INDEX statement that avoids one or more locks on the underlying table. The processing of such a statement may be divided into a build phase and a cooperation phase. During the build phase, a journal table is created and published. A snapshot of the table is obtained after the last DML transaction (that was pending at the time the journal table was published) commits. The index is built based on the state of the table as of the snapshot. Any changes to the table while the index is built are recorded in the journal table. During the cooperation phase, the index is partially published. A subsequent DML statement determines whether any changes in the journal table affect the same data as the subsequent DML statement. If so, then those changes are applied to the index followed by the subsequent DML statement.

Abstract: An approach for reducing transport of messages between nodes of a multi-node system is presented wherein a message queue is associated with a queue service, and based on which node the message queue resides, one of the nodes is registered as hosting the associated queue service. In response to a client attempting to connect and requesting a particular queue service, the client is caused to connect to the node on which the queue service resides.

Abstract: An apparatus for VPN fast convergence in MPLS networks is disclosed. The apparatus comprises a first memory portion, a second memory portion, and a first logic for programming the memory portions. The first memory portion comprises a plurality of first data structures, where each of the plurality of first data structures includes an IGP label and an adjacency identifier that identifies one of a plurality of outgoing interfaces associated with the apparatus, where each IGP label indicates a Label Switched Path (LSP) through a network. The second memory portion comprises a plurality of second data structures, where each of the plurality of second data structures includes a network address identifier, a VPN label associated with the network address identifier, and a pointer that indicates one of the plurality of first data structures in the first memory portion, where each VPN label identifies a VPN that is reachable over the network.

Abstract: A method for simulating a system without a time invariant or periodically time-varying steady state is provided. The method limits the number of states included in a Markov chain model by discretizing the states based on Gaussian decomposition, utilizes a state exploration algorithm that discovers only recurrent states, and/or utilizes a state truncation algorithm that eliminates states with negligible stationary probabilities.

Abstract: A method of identifying potential phishing abuse images includes: producing a first color map that represents a subset of color values and pixel locations within a base image; producing a second color map that represents color values and pixel locations within a target image; selecting an alignment the first color map with the second color map such that at least some pixel locations of the first color map align with at least some pixel locations of the second color map; determining a measure of color value matching of aligned pixel locations for the selected alignment; and repeating the acts of selecting and determining until a prescribed threshold measure of color value matching is determined for at least one of the selected alignments or until an evaluation limit is reached.