Abstract: One embodiment of the present invention provides a system for controlling the spread of interests and content in a content centric network (CCN). During operation, the system maintains a routing policy for content data. The system also receives a packet associated with a piece of content or an interest for the content. Next, the system determines that the structured name included in the packet is within the namespace specified in the routing policy. The system further determines that the packet satisfies the condition in the routing policy. Subsequently, the system routes the packet based on in part the action corresponding to the condition as specified in the routing policy.

Abstract: One embodiment of the present invention provides a system for controlling the spread of interests and content in a content centric network (CCN). During operation, the system maintains a routing policy for content data. The system also receives a packet associated with a piece of content or an interest for the content. Next, the system determines that the structured name included in the packet is within the namespace specified in the routing policy. The system further determines that the packet satisfies the condition in the routing policy. Subsequently, the system routes the packet based on in part the action corresponding to the condition as specified in the routing policy.

Abstract: One embodiment of the present invention provides a system for controlling the spread of interests and content in a content centric network (CCN). During operation, the system maintains a routing policy for content data. The system also receives a packet associated with a piece of content or an interest for the content. Next, the system determines that the structured name included in the packet is within the namespace specified in the routing policy. The system further determines that the packet satisfies the condition in the routing policy. Subsequently, the system routes the packet based on in part the action corresponding to the condition as specified in the routing policy.

Abstract: A payment processing system receives a token from a user device. Based on the first token, the payment processing system establishes a second token that remains valid longer than the first token. The payment processing system then associates the second token with a user account identifier and establishes a rescue code for use in an offline user transactions. The payment processing system then communicates the second token and the rescue code to the user device. When the user engages in an offline transaction, the payment processing system receives the rescue code and the user account identifier from the merchant computing device. Based on the user account identifier received from the merchant computing devices, the payment processing system identifies the second token and verifies that the received rescue code matches the rescue code associated with the user account identifier. Based on the verification, the payment processing system authorizes the sales transaction.

Abstract: A system is provided to facilitate content dissemination. During operation, the system allows a user to add a tag to a first document, wherein the tag indicates an operation to be performed on a portion of the document. The system then processes the tag and performs the operation on the document portion based on the tag.

Abstract: One embodiment provides a system for facilitating document printing from a portable device. During operation, the system receives a document at a server. Next, the system generates a document optical code corresponding to the document. Subsequently, the system communicates the document optical code to the portable device, thereby allowing the portable device to display the document optical code to a scanning mechanism associated with a printer, Next, the system receives a request, indicating the optical code, from the printer. Subsequently, the system retrieves the document in response to the request, and sends the document to the printer.

Abstract: One embodiment provides a system to facilitate directed reading of a selected portion of an original document by a recipient. During operation, the system creates a transfer document based at least on the original document and the selected portion. The transfer document, when viewed by the recipient, enables the following operations: opening the transfer document to the selected portion without requiring manual navigation to the selected portion, highlighting the selected portion, obscuring a context surrounding the selected portion based at least on a distance metric from the selected portion, and directly navigating from one highlighted portion to another highlighted portion in the transfer document without requiring manual navigation within obscured contexts. After the system creates the transfer document, it sends the transfer document to the recipient.

Abstract: One embodiment provides a system for facilitating document printing from a portable device. During operation, the system receives at an email server an email which includes an attached document. Next, the system generates at the email server a document optical code associated with the document, wherein the document optical code can be scanned and recognized by a scanning mechanism associated with a printer. Subsequently, the system attaches the optical code as an additional attachment to the email, thereby allowing a portable device to print the attached document by displaying the optical code to the scanning mechanism associated with the printer.

Abstract: One embodiment provides a system for printing a document from a portable device. During operation, the system obtains the document to be printed. Next, the system obtains a document optical code that identifies the document. Subsequently, the system displays the document optical code on the portable device in such a way that the document optical code can be scanned and recognized by a scanner associated with the printer. Next, the system allows the printer to retrieve and print the document based at least on the document optical code.

Abstract: Apparatus and methods are provided for protecting network resources, particularly in association with automatic provisioning of new client devices. A global PKI (Public Key Infrastructure) scheme is rooted at a globally available server. Roots of PKIs for individual organizations also reside at this server or another globally available resource. To enable access to an organization's network, one or more authenticators are deployed, which may be co-located with access points or other network components. After a client device enabler (CDE) and an authenticator perform mutual authentication with certificates issued within the global PKI, the CDE is used to provision a new client device for the organization. After the client is provisioned, it and an authenticator use certificates issued within the per-organization PKI to allow the client access to the network.

Abstract: We present technology that allows layman computer users to simply create, provision, and maintain secured infrastructure—an instant PKI. This technology can be used in a wide variety of applications including wired and wireless networks, secure sensor networks (such as medical networks), emergency alert networks, as well as simply and automatically provisioning network devices whether secure or not.

Abstract: A token has a memory, an interface allow connection to a host, and a processor. The processor, in response to user input for configuring a remote access connection, executes a first set of processing instructions to establish a trusted connection with the server host, exchanges credentials over the trusted connection to establish a secure connection with the server host over an untrusted connection, and defines configuration information for accessing user selected data or services.

Abstract: One embodiment of the present invention provides a system for facilitating session migration. During operation, the system receives a communication packet from a client destined to a remote server. The system determines whether the communication packet belongs to a pre-existing communication session, and whether session state information associated with the session is available locally. In response to the communication packet belonging to a pre-existing communication session and the session state information being unavailable locally, the system constructs an interest requesting the session state information, disseminates the interest over a network, and receives the session state information.

Abstract: A method of providing secure communications over a network includes receiving, at a receiving computer, a public key of a sending computer, and a hash of a sending random number over a first communication channel, transmitting, from the receiving computer, a public key of the receiving computer and a receiving random number provided by the receiving computer over the first communication channel, and receiving, at the receiving computer, the sending random number provided by the sending computer over the first communication channel.

Abstract: One embodiment provides a system for printing a document from a portable device. During operation, the system receives a hyperlink associated with an email and a document to be printed. Next, the system obtains a document optical code that identifies the document computer-readable storage device. Subsequently, the system displays the optical code to a printing device, thereby allowing the printing device to obtain and print the document.

Abstract: One embodiment of the present invention provides a system for facilitating network service virtualization. During operation, the system receives a service request from a client, and initializes a communication session with the client. The system constructs an interest using session state information that can identify the client and/or a previous communication session. The interest comprises a hierarchically structured variable-length name. The system then broadcasts the interest to a number of servers. The system subsequently forwards to the client data received from a server which responds first to the interest.

Abstract: A system for facilitating voice calls over a content centric network (CCN) receives from a CCN user an expressed interest in receiving voice calls directed to the CCN user, wherein information in the CCN can be addressed, located, and disseminated by its content identifier and wherein data packets in the CCN are self-authenticating. Next, the system receives from a second network a packet for a voice call directed to the CCN user. The system then forwards to the CCN user the packet received from the second network with a CCN identifier corresponding to the interest expressed by the CCN user and forwards a packet from the CCN user for the voice call to the second network.

Abstract: A system is provided to facilitate tag-based organization of documents. During operation, the system receives an original user query. The system extends the query to include documents with an IN-tag and exclude documents with an OUT-tag. The system then performs a search based on the extended query to indicate a collection of documents which satisfy the extended query. The system further allows a user to add a document to the collection of documents or remove a document from the collection of documents. Next, the system modifies a tagging property of the document.

Abstract: One embodiment of the present invention provides a system for facilitating network service virtualization. During operation, the system receives a service request from a client, and initializes a communication session with the client. The system constructs an interest using session state information that can identify the client and/or a previous communication session. The interest comprises a hierarchically structured variable-length name. The system then broadcasts the interest to a number of servers. The system subsequently forwards to the client data received from a server which responds first to the interest.

Abstract: Apparatus and methods are provided for protecting network resources, particularly in association with automatic provisioning of new client devices. A global PKI (Public Key Infrastructure) scheme is rooted at a globally available server. Roots of PKIs for individual organizations also reside at this server or another globally available resource. To enable access to an organization's network, one or more authenticators are deployed, which may be co-located with access points or other network components. After a client device enabler (CDE) and an authenticator perform mutual authentication with certificates issued within the global PKI, the CDE is used to provision a new client device for the organization. After the client is provisioned, it and an authenticator use certificates issued within the per-organization PKI to allow the client access to the network.