Abstract: A method and mechanism to enforce reduced access via restricted access tokens. Restricted access tokens are based on an existing token, and have less access than that existing token. A process is associated with a restricted token, and when the restricted process attempts to perform an action on a resource, a security mechanism compares the access token information with security information associated with the resource to grant or deny access. Application programs may have restriction information stored in association therewith, such that when launched, a restricted token is created for that application based on the restriction information thereby automatically reducing that application's access. Applications may be divided into different access levels such as privileged and non-privileged portions, thereby automatically restricting the actions a user can perform via that application.

Abstract: A method and system for improved motion compensation between a previous frame of video information and a new frame. Each block of pixels in a block-based compression scheme uses four vectors, three from proximate blocks, to determine motion-induced changes to its pixels. The vectors are interpolated for each pixel based on the location of the pixel in the block with respect to the vectors. The address of each pixel in the frame block of the previous frame is altered based on the resultant vector determined therefor, whereby a color value for the new pixel is obtained from the altered address. Sharp contrasts at the edges between blocks are eliminated due to the gradual blending obtained by using vectors of the adjacent blocks to determine a pixel's color.

Abstract: A method and system for enumerating a trie of states of nodes. A node near the middle of a state of alphabetically ordered nodes is selected as a skip node and moved to the logical beginning of the state. The skip node is provided with a pointer to a jump node that is at the skip node's former position, and the node immediately to the left of the node's former position is marked as a soft terminal node. As a result of the alphabetic ordering, the segment of nodes before the jump node are alphabetically before the skip node, while the segment of nodes after the jump node are alphabetically after the skip node. The segments of the state may be recursively split into further segments via further skip nodes, jump nodes and soft terminal nodes, and, once the segments are split as desired, the nodes within the segment may be sorted.

Abstract: An improved trie compression method that compresses by merging partially identical subtrees. States of the trie are selected, and the nodes of those states examined find nodes that are identical to one another. The most frequently occurring identical node is selected as a substate, and the states are separated into a first group of states that have the substate node therein and a second group of states that do not. The nodes in the first group of states are reordered such that the substate is at the end thereof. Then, the substate of each state is merged into a single node, replaced by a pointer from each state. Compression is performed recursively by choosing a new substate for the remaining nodes of the first group, and for subsequently separated groups, until no further identical nodes are available for merging.

Abstract: A method and system for configuring computers to connect to networks using network connection objects. For each connection to a network, configuration information for connecting to that network is maintained within a connection object. Such configuration information may include device, protocol, and other computer and network property information along with binding information therefor. Connection objects may be stored as files or the like independent of a running network configuration, and be applied to the running configuration to change the network configuration. Also included is a process to reconcile networking components identified in a connection object with those available on a given system.

Abstract: A method and mechanism for handling user input. Messages corresponding to the user input are placed in a message queue. An input handler differentiates between messages in the queue, such as handwritten character strokes, which are to be handled in real time, and ordered messages, such as characters, cursor movement and editing commands, which are to be handled in a synchronized order of input. The input handler handles each ordered message only after completion of any previous ordered message, while real time messages are handled regardless of the completion status of the ordered messages. In this manner, handwritten character strokes are immediately written to the display area. Ordered messages, which may correspond to handwritten characters having a recognition delay time associated therewith, are handled in the same order as input by the user regardless of any recognition delay time.

Abstract: A restrict ed access token is created from an existing token, and provides less access than that token. A restricted token may be created by changing an attribute of one or more security identifiers allowing access in the parent token to a setting that denies access in the restricted token and/or removing one or more privileges from the restricted token relative to the parent token. A restricted access token also may be created by adding restricted security identifiers thereto. Once created, a process associates another process with the restricted token to launch the other process in a restricted context that is a subset of its own rights and privileges. A kernel-mode security mechanism determines whether the restricted process has access to a resource by first comparing user-based security identifiers in the restricted token and the intended type of action against a list of identifiers and actions associated with the resource.

Abstract: A method and system for selecting a set of systems (nodes) for a server cluster from at least two non-communicating sets of systems. A persistent storage device with cluster configuration information therein is provided as a quorum resource. Using an arbitration process, only one system exclusively reserves the quorum resource. The set with the system therein having the exclusive reservation of the quorum device is selected as the cluster. The arbitration process provides a challenge-defense protocol whereby a system can obtain the reservation of the quorum device when the system that has the reservation fails.

Abstract: A system and method for virtually eliminating a potential security risk inherent with the caching of network content. Random subdirectory names are generated for cache directories, while continuing to generate user-friendly file names. Security is achieved since malicious sites cannot guess the cache location, which if guessed along with the filename, could cause a user connected to the site to inadvertently execute malicious content downloaded by the site to the cache. In addition to generating random subdirectory names, the system and method provide enhanced performance by balancing the number of files among the cache directories, and by limiting the number of files in any cache directory by creating additional cache directories as needed.

Abstract: A method and system for data entry of handwritten text into a computer program that is not designed to accept handwritten text is provided. In preferred embodiments, the computer program is designed to operate in a windowing environment. A data entry program receives handwritten data, recognizes the data, and sends the recognized data to the computer program. The computer program processes the recognized data as if it had been entered from the keyboard. According to the present invention, the data entry program overlaps the window of the computer program with an invisible window. To the user, it looks as if the computer program is accepting handwritten data directly.

Abstract: A method and system of encoding and decoding image data in images having less than 128 distinct colors. Eight bit data bytes representing the color of each pixel data are re-indexed for each pixel to seven or less bits, and a sub-palette stores the relationship between the re-indexed colors and the original eight-bit color values. The remaining bits in the byte store run lengths of pixels that have contiguous colors. Further data compression is achieved by grouping pixels into rows, eliminating any duplicate rows and identifying the pixel data by a series of row pointers. Still further compression is accomplished by dropping representations of transparent pixels from the end of rows and representing a number of transparent pixels at the beginning of rows with a single byte. The compressed data is efficiently decoded using the row pointers to expedite vertical clipping of the image and adjusting horizontal clipping for leading and trailing transparent pixels.

Abstract: A system and method of integrating the physical and virtual namespaces of a site into a single hierarchical representation thereof that reflects the hierarchical arrangement of the site as perceived by the client. A dynamic namespace integration mechanism is implemented as a part of a site management service to look up and integrate hierarchically organized directory information maintained in a registry (e.g., metabase) for both physical and virtual directories. The administrator is then given a view of the site that corresponds to the view of the client browsing the site. The administrator may interface with a user interface displaying the integrated namespace to manage the properties under a site's directories. The hierarchical relationships between the physical and virtual directories enable the administrator to set properties on parent nodes that are inheritable by child nodes, simplifying management tasks.

Abstract: A system and method for encryption and decryption of files. The system and method operate in conjunction with the file system to transparently encrypt and decrypt files in using a public key-private key pair encryption scheme. When a user puts a file in an encrypted directory or encrypts a file, all data writes to the disk for that file are encrypted with a random file encryption key generated from a random number and encrypted with the public key of a user and the public key of at least one recovery agent. The encrypted key information is stored with the file, whereby the user or a recovery agent can decrypt the file data using the private key thereof. When a proper private key is used, encrypted reads from the disk are decrypted transparently by the file system and returned to the user.

Abstract: A method and system for transparently failing over a computer name with a legacy application running in a server cluster. When the application is set for failing over in the cluster, the cluster software locates a virtual computer name on which the application is dependent, and associates the virtual name with the application. When the application runs and requests its computer name from the system, the system looks for the virtual computer name, and, if detected, the system returns the virtual computer name to the application as the computer name. The virtual computer name thus moves with the application regardless of the machine on which it is running in the cluster. When the application is not set for failing over in the cluster, the system instead returns the actual machine name.

Abstract: A method and system for sharing a communications port by running a communications program that only occupies the communications port when a user action indicates that the communications port is needed. The communications port is released when it is determined that the user no longer needs it, however the communications program continues to run. The communications program is implemented in a shell extension that separates its functionality into two states, a resident state that is essentially available at all times but does not occupy the communications port, and an exclusive state that intelligently occupies the communications port when needed. When a user intuitively opens a folder related to device communication, the communications program enters the exclusive state, and returns to the resident state when the folder is closed, thereby freeing the communications port for use by other programs.

Abstract: A method and system for teaching a language and evaluating language comprehension in a digitally synthesized, interactive three-dimensional graphical representation of an environment. Within the environment, the user is given opportunities to practice language skills by interacting with digital videos of people. As the user walks through the environment and encounters various people therein, the people set forth challenges in the form of scripted questions and tasks that require the user to comprehend the language in order to correctly respond. A speech recognition engine interprets verbal responses of the user, thereby further simulating a real-world environment. A set of one or more scripts controls various aspects of the environment while testing and evaluating the user's comprehension of the language.

Abstract: A method and system for reducing the number of conditional requests for network content to a server by maintaining state for selected URIs in a local cache indicative of a confidence level that the files are unchanged. When a request for content is received that corresponds to such a URI in the cache, a synchronization time is determined based on a confidence level for that URI. If the synchronization time is achieved, a conditional request is sent to the server, otherwise the URI data is returned from the cache to respond to the request. Synchronization intervals for such files may be increased as the likelihood that the item is unmodified increases. URIs may need to be of a certain content type and required to pass a confidence test before being selected for automatic synchronization.

Abstract: A method and mechanism for interprocess communication between a thread of a client application and a thread of a server application. The mechanism includes a server listening thread and a client listening thread. The client thread sends a request to a server listening thread, and the server listening thread places the request in a message queue associated with the server thread. The request is received at the server thread and dispatched to a remote procedure for processing. Reply data received back from the remote procedure is sent to the client listening thread. The client listening thread notifies the client thread when the reply is received and gives the reply to the client thread.