Abstract: A method for recognizing an identity and a gesture based on radar signals includes: reading a radar echo signal reflected by various gestures of a tester and received by a radar sensor; frequency-mixing the radar echo signal with a radar transmission signal; after filtering and centralizing a frequency-mixed signal, training and obtaining a neural network capable of identity verification and a neural network capable of gesture recognition; in a real-time detection process, verifying an identity of a user; and if the identity is verified, determining that a gesture of the user is valid; verifying the gesture of the user and executing a corresponding operation according to correspondence between the gesture of the user and an operation. It can be determined by the method whether the gesture belongs to the corresponding user and whether the operation corresponding to the gesture is performed according to the determined result.

Abstract: An “AR Privacy API” provides an API that allows applications and web browsers to use various content rendering abstractions to protect user privacy in a wide range of web-based immersive augmented reality (AR) scenarios. The AR Privacy API extends the traditional concept of “web pages” to immersive “web rooms” wherein any desired combination of existing or new 2D and 3D content is rendered within a user's room or other space. Advantageously, the AR Privacy API and associated rendering abstractions are useable by a wide variety of applications and web content for enhancing the user's room or other space with web-based immersive AR content. Further, the AR Privacy API is implemented using any existing or new web page coding platform, including, but not limited to HTML, XML, CSS, JavaScript, etc., thereby enabling existing web content and coding techniques to be smoothly integrated into a wide range of web room AR scenarios.

Abstract: An “AR Privacy API” provides an API that allows applications and web browsers to use various content rendering abstractions to protect user privacy in a wide range of web-based immersive augmented reality (AR) scenarios. The AR Privacy API extends the traditional concept of “web pages” to immersive “web rooms” wherein any desired combination of existing or new 2D and 3D content is rendered within a user's room or other space. Advantageously, the AR Privacy API and associated rendering abstractions are useable by a wide variety of applications and web content for enhancing the user's room or other space with web-based immersive AR content. Further, the AR Privacy API is implemented using any existing or new web page coding platform, including, but not limited to HTML, XML, CSS, JavaScript, etc., thereby enabling existing web content and coding techniques to be smoothly integrated into a wide range of web room AR scenarios.

Abstract: A system described herein includes a receiver component that receives third party code for execution in a host environment, wherein the third party code corresponds to a dynamic programming language, and wherein the third party code has at least one object reference to a first object that is used by the third party code. A detouring component automatically replaces the first object referenced by the third party code with a proxy object such that the third party code at runtime calls the proxy object instead of the first object.

Abstract: Methods and systems for preventing permission re-delegation among applications are disclosed herein. The method includes accepting a message requesting access to a user-controlled resource from a requester application at a deputy application and reducing a first permissions list of the deputy application to a second permissions list. The second permissions list includes an overlap of permissions between the deputy application and the requester application. Moreover, the method also includes sending the message from the deputy application to a computing system via an application programming interface (API), wherein the computing system is configured to reject the message if the second permissions list of the deputy application does not permit access to the user-controlled resource.

Abstract: A system described herein includes a receiver component that receives third party code for execution in a host environment, wherein the third party code corresponds to a dynamic programming language, and wherein the third party code has at least one object reference to a first object that is used by the third party code. A detouring component automatically replaces the first object referenced by the third party code with a proxy object such that the third party code at runtime calls the proxy object instead of the first object.

Abstract: A system described herein includes a receiver component that receives third party code for execution in a host environment, wherein the third party code corresponds to a dynamic programming language, and wherein the third party code has at least one object reference to a first object that is used by the third party code. A detouring component automatically replaces the first object referenced by the third party code with a proxy object such that the third party code at runtime calls the proxy object instead of the first object.

Abstract: Methods and systems for preventing permission re-delegation among applications are disclosed herein. The method includes accepting a message requesting access to a user-controlled resource from a requester application at a deputy application and reducing a first permissions list of the deputy application to a second permissions list. The second permissions list includes an overlap of permissions between the deputy application and the requester application. Moreover, the method also includes sending the message from the deputy application to a computing system via an application programming interface (API), wherein the computing system is configured to reject the message if the second permissions list of the deputy application does not permit access to the user-controlled resource.

Abstract: Techniques for providing resource sharing in a multi-principal browser are described. Resource sharing includes managing a resource for web entity by determining how to divide the resource to share among two or more web entities based at least in part on a Document Object Model (DOM)-recursive resource allocation policy or an application-specified resource allocation policy. A web entity includes a principal instance contending for the resource. The process identifies resource allocation mechanisms from each resource type based at least in part on the DOM-recursive sharing policy or the application-specified resource allocation policy along with the resource type.

Abstract: A secure cross-domain communication system and method for facilitating secure communication between a website having a web mashup and websites having content that is to be placed on the web mashup. Embodiments of the system and method set the document domain variable of the mashup website and the websites to facilitate the secure communication. Mediator frames are used as an intermediary between a top frame (containing the web mashup) and untrusted frames (containing the website content to be included in the mashup). The type of setup technique used is dependent on the number of websites being used in the mashup. Once the secure communication is established, data exchange between the top frame and the untrusted frame is dependent on the types of services that that the browser supports.

Abstract: A system and method for distributing streaming content data from a server to multiple clients enables the server to handle transient surges of requests by having the clients cooperate with the server and other clients to distribute content, thereby alleviating the load on the server. The server divides the streaming content into multiple sub-streams (e.g., by using multiple description coding), and constructs multiple distribution trees with itself at the root and each client as a node in each of the trees. Each sub-stream is transmitted down a corresponding one of the distribution trees. Clients that receive sub-streams from its parent nodes in the distribution trees in turn forward the sub-streams to their child nodes in the trees.

Abstract: A system described herein includes a receiver component that receives third party code for execution in a host environment, wherein the third party code corresponds to a dynamic programming language, and wherein the third party code has at least one object reference to a first object that is used by the third party code. A detouring component automatically replaces the first object referenced by the third party code with a proxy object such that the third party code at runtime calls the proxy object instead of the first object.

Abstract: In an exemplary method implementation, a method includes: designating a neighborhood administrator; receiving notification of a delinquent router from the designated neighborhood administrator; and excluding the delinquent router responsive to the notification. In an exemplary mesh router implementation, a mesh router is capable of establishing a wireless mesh network with other mesh routers, the mesh router is further capable of designating a neighborhood administrator mesh router; and the mesh router is adapted to exclude another mesh router that is associated with a particular certificate when the particular certificate has been identified as delinquent by the designated neighborhood administrator. mesh router.

Abstract: A secure cross-domain communication system and method for facilitating secure communication between a website having a web mashup and websites having content that is to be placed on the web mashup. Embodiments of the system and method set the document domain variable of the mashup website and the websites to facilitate the secure communication. Mediator frames are used as an intermediary between a top frame (containing the web mashup) and untrusted frames (containing the website content to be included in the mashup). The type of setup technique used is dependent on the number of websites being used in the mashup. Once the secure communication is established, data exchange between the top frame and the untrusted frame is dependent on the types of services that that the browser supports.

Abstract: An exemplary router performs actions including: receiving at least one certificate from an end device, the at least one certificate issued by another router; ascertaining if the other router is a member of a predetermined neighborhood; determining if the at least one certificate is valid; and if the other router is ascertained to be a member of the predetermined neighborhood and the at least one certificate is determined to be valid, recognizing the end device as privileged. An exemplary mesh router is capable of establishing a wireless mesh network with other mesh routers, the mesh router is further capable of designating a neighborhood administrator mesh router; and the mesh router is adapted to grant privileged status to a particular end device associated with a particular certificate issued by a particular mesh router when the particular mesh router is a member of a neighborhood of the designated neighborhood administrator mesh router.

Abstract: A technique is disclosed that can efficiently control congestion, while supporting heterogeneity for streaming data among multiple computers in a network. A plurality of nodes is divided into a plurality of distribution trees within a computer network, wherein the data is divided into a plurality of prioritized layers. When a node experiences packet loss, the location of the congestion is inferred. If the congestion is at or near the outgoing link, outgoing traffic is shed to alleviate the congestion by shedding child node(s) receiving descriptions in the least important layer of data that the child node(s) are receiving. Similarly, if the congestion is at or near the incoming link, incoming traffic is shed by shedding parent nodes that are sending descriptions in the least important layer of data that the node is receiving. Nodes with available bandwidth are further instructed to subscribe to additional descriptions.

Abstract: Disclosed is a routing and bandwidth allocation system that maximizes network throughput while maintaining global fairness in the sharing of network resources. From gathered global network information (such as inter-node communications patterns and network topology), routing tables and bandwidth allocation policies are computed for routers. In some embodiments, the computations involve applying multi-commodity flow methods to provide a “max-fair” allocation of network resources. While in some embodiments each router collects global network information and then locally produces its own routing and bandwidth allocation tables, it can be simpler and cheaper in terms of both computation and security for a centralized, trusted control unit to perform the calculations and then to distribute the results to the routers. The computed bandwidth policies can leave some bandwidth unallocated to handle unexpected surges in demand.

Abstract: A method and system for identifying a configuration parameter of a “sick” computer system that is at fault for causing an undesired behavior based on analysis of configuration parameters from other computer systems is provided. In one embodiment, a troubleshooting system collects “suspect” values for “suspect” configuration parameters used by a “sick” application when the undesired behavior was exhibited by the sick computer system. The troubleshooting system then compares the suspect values to sample values of the suspect configuration parameters retrieved from sample computer systems. The troubleshooting system uses that comparison to identify one or more suspect configuration parameters that are likely at fault for causing the application to exhibit the undesired behavior.

Abstract: A method and system for aggregating configuration information from friend devices is provided. The aggregation system attempts to foil attacks on the privacy of data contributed to a request by aggregating data from a cluster of friend devices in such a way that it is difficult for a device in the cluster and an attacking device outside the cluster to determine the contribution of an individual device to the data. The aggregation system of an initiator device may also determine the cardinality of a parameter so that the corresponding parameter vector can have a size large enough to support the number of possible values. The aggregation system determines the cardinality by counting nonzero hash values of the actual values that are provided by the devices.

Abstract: A method and system for collecting data from devices using a homomorphic encryption of the data is provided. A collection system of a device adds contributions to homomorphically encrypted data and forwards the requests to another device. When the device receives a reply to the request, it uncombines its contribution to the homomorphic encryption of the data. The device then forwards the reply to the previous device. The initiator device ultimately removes its contribution to the encryption and identifies the data.