Abstract: A method of enhancing security in a wireless mesh communication network operating in a process control environment and including a plurality of wireless network devices includes processing a join request from a wireless device wishing to join the wireless mesh communication network, providing a limited network functionality to the wireless device if the join request is granted, requesting a complete approval of the wireless device; and granting a full network functionality to the wireless device if the complete approval of the wireless device is received.

Abstract: A method of enhancing security in a wireless mesh communication network operating in a process control environment and including a plurality of wireless network devices includes processing a join request from a wireless device wishing to join the wireless mesh communication network, providing a limited network functionality to the wireless device if the join request is granted, requesting a complete approval of the wireless device; and granting a full network functionality to the wireless device if the complete approval of the wireless device is received.

Abstract: A duplex camera with common face and iris imaging optics locates an iris in a scene and images the iris without requiring multiple camera alignment or a rapid zoom capability. A wavelength selective mirror separates the light from an imaged scene into visible and infrared components. The visible component supplies a face image in which an iris location can be determined. Visible light optics and a visible light sensor array provide a scene image to an image processor that determines the iris location. Infrared optics and an infrared sensor produce an iris image centered on the iris location. Upon determining an iris location, a motorized stage can position the iris image in the infrared sensor. The common face and imaging optics allow the image sensors to be permanently aligned to one another.

Abstract: A method includes wirelessly receiving a message at a receiving node. The method also includes extracting a partial counter value from the message, where the partial counter value represents a subset of bits from a complete counter value of a transmitting node. The method further includes decrypting and authenticating the message based on the partial counter value. Decrypting and authenticating the message could include examining a bitmap to identify a bit value associated with the partial counter value, decrypting and authenticating the message if the identified bit value has a first value, and discarding the message if the identified bit value has a second value. Decrypting and authenticating the message could also include identifying at least one complete counter value at the receiving node based on the partial counter value and attempting to decrypt and authenticate the message using the at least one complete counter value.

Abstract: The present system having a secure wireless infrastructure with a key server acting as a key distribution center. The key server may be the core of the network, securely admitting new nodes or devices, deploying and updating keys and authorizing secure communications sessions. The system may also share secure keying information with a new device not already a member of a secure wireless network. The keying information may be used for authentication or encryption or both, and may be provided to the new device in a manner or mode which is not susceptible to exposure outside of the secure network. The keying information shared with the new device may be regarded as a birth key. Then the new device may send a birth key encrypted request to join the secure network via an exposed communication mode. The key server may respond with a birth key encrypted key encryption key.

Abstract: A method includes wirelessly receiving a message at a receiving node. The method also includes extracting a partial counter value from the message, where the partial counter value represents a subset of bits from a complete counter value of a transmitting node. The method further includes decrypting and authenticating the message based on the partial counter value. Decrypting and authenticating the message could include examining a bitmap to identify a bit value associated with the partial counter value, decrypting and authenticating the message if the identified bit value has a first value, and discarding the message if the identified bit value has a second value. Decrypting and authenticating the message could also include identifying at least one complete counter value at the receiving node based on the partial counter value and attempting to decrypt and authenticate the message using the at least one complete counter value.

Abstract: A method and system for eye-safe near infra-red (NIR) optical imaging illumination. An eye of an intended subject are imaged with visible light or NIR light at an unconditionally eye-safe illumination level and the maximum permissible eye-safe NIR illumination that can be applied to the eye is determined from the captured images. The eye of the intended subject can then be illuminated with at least one substantially maximal NIR light pulse having a pulse intensity and duration selected to provide the substantially maximum permissible eye-safe NIR illumination intensity at the eye. NIR light pulse illumination can be inhibited in response to detection of other subjects either within the vicinity of a volume extending between an NIR illuminator illuminating the eye and the intended subject. The likelihood that an intended subject has been recently illuminated can also be determined and statistical measures can be used to avoid re-illuminating subject unnecessarily.

Abstract: A method and system for eye-safe near infra-red (NIR) optical imaging illumination. An eye of an intended subject are imaged with visible light or NIR light at an unconditionally eye-safe illumination level and the maximum permissible eye-safe NIR illumination that can be applied to the eye is determined from the captured images. The eye of the intended subject can then be illuminated with at least one substantially maximal NIR light pulse having a pulse intensity and duration selected to provide the substantially maximum permissible eye-safe NIR illumination intensity at the eye. NIR light pulse illumination can be inhibited in response to detection of other subjects either within the vicinity of a volume extending between an NIR illuminator illuminating the eye and the intended subject. The likelihood that an intended subject has been recently illuminated can also be determined and statistical measures can be used to avoid re-illuminating subject unnecessarily.

Abstract: An initiating device in a wireless network transmits a data message to at least three responding devices. None, one, some, or all of the responding devices may successfully receive the data message. Any responding device that successfully receives the data message sends an acknowledgement to the initiating device, which may or may not receive the acknowledgement. The responding devices may use any suitable technique to determine an order in which the acknowledgements are communicated to the initiating device, such as by using an ordering of the network addresses of the responding devices. With adequate spatial and angular separation of the responding devices from the perspective of the initiating device, the likelihood of a lost (unsuccessfully received) data message in the wireless network can be reduced significantly. This may be useful, for example, in industrial process control systems used to control industrial processes.

Abstract: A duplex camera with common face and iris imaging optics locates an iris in a scene and images the iris without requiring multiple camera alignment or a rapid zoom capability. A wavelength selective mirror separates the light from an imaged scene into visible and infrared components. The visible component supplies a face image in which an iris location can be determined. Visible light optics and a visible light sensor array provide a scene image to an image processor that determines the iris location. Infrared optics and an infrared sensor produce an iris image centered on the iris location. Upon determining an iris location, a motorized stage can position the iris image in the infrared sensor. The common face and imaging optics allow the image sensors to be permanently aligned to one another.

Abstract: The present system having a secure wireless infrastructure with a key server acting as a key distribution center. The key server may be the core of the network, securely admitting new nodes or devices, deploying and updating keys and authorizing secure communications sessions. The system may also share secure keying information with a new device not already a member of a secure wireless network. The keying information may be used for authentication or encryption or both, and may be provided to the new device in a manner or mode which is not susceptible to exposure outside of the secure network. The keying information shared with the new device may be regarded as a birth key. Then the new device may send a birth key encrypted request to join the secure network via an exposed communication mode. The key server may respond with a birth key encrypted key encryption key.

Abstract: Power supply apparatus and method based on parasitic power extraction is disclosed. Power is extracted from signals that are inbound and/or outbound from an equipment. The extracted power is converted to dc voltages for a device associated with the equipment. The positive portions of the extracted power are combined in an additive manner to provide a first potentially time-varying signal and negative portions of the extracted power are also combined in an additive manner to provide a second potentially time-varying signal. The two potentially time-varying signals are also combined in an additive manner and divided into the desired number of dc voltages and magnitudes. An optional dc voltage power source is provided should the extracted power be inadequate to provide the dc voltages.

Abstract: Power supply apparatus and method based on parasitic power extraction is disclosed. Power is extracted from signals that are inbound and/or outbound from an equipment. The extracted power is converted to dc voltages for a device associated with the equipment. The positive portions of the extracted power are combined in an additive manner to provide a first potentially time-varying signal and negative portions of the extracted power are also combined in an additive manner to provide a second potentially time-varying signal. The two potentially time-varying signals are also combined in an additive manner and divided into the desired number of dc voltages and magnitudes. An optional dc voltage power source is provided should the extracted power be inadequate to provide the do voltages.

Abstract: A system and method of user installable devices that self-establish and maintain their own unique communications security system to provide secure communications in a control system, such as a supervisory control and data acquisition (SCADA) system with a wide area network (WAN) is disclosed. This security system provides source authentication, confidentiality, integrity protection, and replay protection.

Abstract: A communication system which includes a modem and a plurality of controllers has each controller connected to the modem by an interface apparatus, each controller and the modem complying with a predetermined protocol. The interface apparatus comprises a bus which provides a medium to transfer signals between the controllers and the modem. A first interface unit, which interfaces the modem to the bus, implements, a modem-associated multi-state state machine and responds to signals on the bus maintaining the predetermined protocol between the modem and the first interface unit. A plurality of second interface units interface a corresponding controller to the bus. Each second interface unit implements a controller-associated multi-state state machine which responds to signals on the bus and further responds to signals from the corresponding controller, each second interface unit maintaining the predetermined protocol between the second interface unit and the corresponding controller.

Abstract: A communication system which includes a modem and a plurality of controllers has each controller connected to the modem by an interface apparatus, each controller and the modem complying with a predetermined protocol. The interface apparatus comprises a first component, a bus, which provides a medium to transfer signals between the controllers and the modem. A second component provides an arbitration path between said controllers. A first interface unit, which interfaces the modem to the bus, implements a modem-associated multi-state state machine and responds to signals on the bus maintaining the predetermined protocol between the modem and the first interface unit. A plurality of second interface units interface a corresponding controller to the bus.

Abstract: A computer system includes a main memory and a cache memory arrangement, wherein a cache memory unit is associated with each of the several CPU's in the system. Each cache responds to the virtual address signals issued by the associated CPU, in parallel with a mapper unit which, in turn, converts the virtual address signals to physical address signals for addressing the main memory. The cache is subdivided into subunits each responding to a particular program of a multiprogram CPU. When any of the CPUs address a shared portion of the main memory, the mapper unit recognizes the address of the shared portion of the main memory and issues an inhibit signal to inhibit the operation of the cache memory unit to prevent data from the shared portion of the main memory from being stored in the cache.

Abstract: There is provided, in accordance with the present invention, apparatus comprising a shared random access memory in which is stored requests for access to data in a bulk memory unit. The data being stored in redundant storage areas and the requests stored in the RAM include the address of the redundant data. Means are provided for determining if that data request is already in progress through one of the redundant addresses. The first of the addresses accessed causes the others to be blocked to prevent multiple accessing of the same data. The checking and selection is accomplished by high speed logic circuitry.