Abstract: According to one embodiment, an encryption/decryption execution environment encrypts and decrypts data of an application program while consuming an encryption key unit. A key exchange node accumulates an encryption key shared with a communication counterpart. A key accumulation amount monitoring function unit included in a key exchange node monitors an accumulation amount of the encryption key. A key accumulation amount notification function unit included in an application execution environment notifies a user of the application program or the application program of an accumulation amount of the encryption key acquired by the key accumulation amount monitoring function unit.

Abstract: A first calculator calculates, for each combination of the physical machines, a network distance representing magnitude of load during communication between one of a plurality of physical machines and another physical machine. An acquisition unit acquires communication permission information representing that a newly operated virtual machine is permitted to communicate with which virtual machine among a plurality of virtual machine already operated in any one of the plurality of physical machines. A second calculator calculates, for each of the plurality of physical machines, a network cost representing magnitude of load of the network system during communication between the communication-permitted virtual machine and a new virtual machine, when one of the plurality of physical machines operates the new virtual machine on the basis of the network distance and the communication permission information.

Abstract: A first calculator calculates, for each combination of the physical machines, a network distance representing magnitude of load during communication between one of a plurality of physical machines and another physical machine. An acquisition unit acquires communication permission information representing that a newly operated virtual machine is permitted to communicate with which virtual machine among a plurality of virtual machine already operated in any one of the plurality of physical machines. A second calculator calculates, for each of the plurality of physical machines, a network cost representing magnitude of load of the network system during communication between the communication-permitted virtual machine and a new virtual machine, when one of the plurality of physical machines operates the new virtual machine on the basis of the network distance and the communication permission information.

Abstract: A user private key is stored in a database of the user terminal. A user public key and user information are stored in the user management DB. The encryption/decryption unit encrypts an authority private key specific to a first authority given to a user, by using a user public key associated with user information to indicate a user. The secret sharing unit shares in secret an authority private key into two or more shared authority private keys. The encryption/decryption unit encrypts the shared authority private keys, by using an authority public key specific to each of second authorities to manage the first authority in a shared manner. The authority management DB stores the encrypted authority private key and authority public key in association with the first authority, and stores the encrypted shared authority private keys in association with the second authorities.

Abstract: In a secret information management system, a secret information management apparatus comprises a secret distribution unit which secretly distributes a data key k using a (k, n) threshold secret sharing scheme and creates n distributed keys B1, B2, . . . , Bn in the decryption of data D input from a user terminal, an encryption unit which creates n encrypted distributed keys EP1(B1), EP2(B2), . . . , EPn(Bn) using n distributed manager public keys P1, P2, . . . , Pn, and an encrypted data storage unit which stores encrypted data EK(D), an encrypted data key EPx(K) and the n encrypted distributed keys in association with each other.

Abstract: A server computer protection apparatus protects a server computer against DoS attacks, but allows access to the server. The server computer protection apparatus comprises a unit configured to calculate the load state of the server computer on the basis of the number of data requests made upon the server computer, and the number of data responses of the server responsive to the data requests, and for changing the rate of data requests to be transferred to the server, in accordance with the load state.

Abstract: A user private key is stored in a database of the user terminal. A user public key and user information are stored in the user management DB. The encryption/decryption unit encrypts an authority private key specific to a first authority given to a user, by using a user public key associated with user information to indicate a user. The secret sharing unit shares in secret an authority private key into two or more shared authority private keys. The encryption/decryption unit encrypts the shared authority private keys, by using an authority public key specific to each of second authorities to manage the first authority in a shared manner. The authority management DB stores the encrypted authority private key and authority public key in association with the first authority, and stores the encrypted shared authority private keys in association with the second authorities.

Abstract: A server computer protection apparatus for protecting a server computer by allowing only proper access from one or more client computers to reach the server computer. An access request receiving unit receives, in place of the server computer, access requests sent from the client computers. Each received access request is checked by an access request checking unit to determine whether the received access request is proper or not. An access request transfer unit transfers to the server computer only the access request that is determined as proper, while preventing other access requests that are determined as improper from transferring to the server computer.

Abstract: A threshold value outputting section has a server response measurement sub-section, a time-out counting sub-section, a suspension counting sub-section, and a threshold value counting sub-section, to variably set dynamically a threshold value of the number of times of the data request based on a condition of data requests suspended in the data request transmission section, a condition of a response sent from a server computer, etc. and then output this threshold value.

Abstract: A server computer protection apparatus protects a server computer against DoS attacks, but allows access to the server. The server computer protection apparatus comprises a unit configured to calculate the load state of the server computer on the basis of the number of data requests made upon the server computer, and the number of data responses of the server responsive to the data requests, and for changing the rate of data requests to be transferred to the server, in accordance with the load state.

Abstract: In a secret information management system, a secret information management apparatus comprises a secret distribution unit which secretly distributes a data key k using a (k, n) threshold secret sharing scheme and creates n distributed keys B1, B2, . . . , Bn in the decryption of data D input from a user terminal, an encryption unit which creates n encrypted distributed keys EP1(B1), EP2(B2) . . . , EPn(Bn) using n distributed manager public keys P1, P2, . . . Pn, and an encrypted data storage unit which stores encrypted data EK(D), an encrypted data key EPx(K) and the n encrypted distributed keys in association with each other.

Abstract: A packet sending mechanism which has received a packet from a packet identifier adding mechanism sends the packet on the basis of preset information and determines whether the packet is related to an illicit access.

Abstract: A server computer protection apparatus protects a server computer against DoS attacks, but allows access to the server. The server computer protection apparatus comprises a unit configured to calculate the load state of the server computer on the basis of the number of data requests made upon the server computer, and the number of data responses of the server responsive to the data requests, and for changing the rate of data requests to be transferred to the server, in accordance with the load state.

Abstract: A threshold value outputting section has a server response measurement sub-section, a time-out counting sub-section, a suspension counting sub-section, and a threshold value counting sub-section, to variably set dynamically a threshold value of the number of times of the data request based on a condition of data requests suspended in the data request transmission section, a condition of a response sent from a server computer, etc. and then output this threshold value.

Abstract: A server computer protection apparatus for protecting a server computer by allowing only proper access from one or more client computers to reach the server computer. An access request receiving unit receives, in place of the server computer, access requests sent from the client computers. Each received access request is checked by an access request checking unit to determine whether the received access request is proper or not. An access request transfer unit transfers to the server computer only the access request that is determined as proper, while preventing other access requests that are determined as improper from transferring to the server computer.

Abstract: In a packet transfer apparatus with a function of preventing transfer of malicious packets, a segment determination unit determines a transmitting destination network segment of a packet which has not been discarded as an malicious packet in a packet analysis unit with reference to a routing table. A MAC address rewrite unit rewrites a MAC address of the received packet to a MAC address of a device such as a server on a transmitting destination network segment. A packet transmission unit transmits the packet whose MAC address has been rewritten to a connecting destination network segment.

Abstract: A packet sending mechanism which has received a packet from a packet identifier adding mechanism sends the packet on the basis of preset information and determines whether the packet is related to an illicit access.

Abstract: An optical scanning apparatus comprises a light source provided with a plurality of light emitting portions different in emission wavelength on a single stem, a deflector for deflecting a plurality of beams from the light source an optical system for converging the plurality of beams deflected by the deflector, and a wavelength separation device for separating the plurality of beams from the optical system from each other. The optical scanning apparatus may be applicable to a laser beam printer by combining it with a photosensitive member to which the plurality of beams separated by the wavelength separation device are guided.

Abstract: A plural-beam scanning optical apparatus comprises a light source having a plurality of light emitting portions, a first optical system for converting a plurality of divergent light beams from the light source into parallel light beams, a light deflector for deflecting the plurality of light beams from the first optical system, a stop disposed between the first optical system and the light deflector, and a second optical system for condensing the plurality of light beams deflected by the light deflector on a scanned surface. The plurality of light emitting portions are arranged in a direction oblique with respect to the main scanning direction of the light beams on the scanned surface. The apparatus satisfies the following condition:d/2.multidot.(n-1).multidot.L/f<0.

Abstract: An image recording apparatus comprises a beam generating unit for generating a light beam modulated in accordance with input image signal, a beam deflecting unit for scanning a recording medium using the light beam generated by the beam generating unit, the beam deflecting unit comprising a rotating polygon mirror having a plurality of reflecting surfaces. The apparatus can be operated in a mode for forming an image using all the reflecting surfaces of the rotating polygon mirror and in a mode for forming an image using predetermined reflecting surfaces of a plurality of reflecting surfaces of the rotating polygon mirror. The apparatus thus permits the dot density to be changed to a plurality of values with a simple structure so that image information can be recorded with high definition on the surface of a recording medium.