Abstract: Existing systems use interprocedural data flow to analyze the source code of an entire program thereby requiring significant resources. Instead forward and backward chase components reference data structures (e.g., state machines) that identify instructions within a intraprocedural data flow graph. Based on how states of the state machine correspond to instructions in the data flow, the state machines direct the data flow chase to other procedures in a call graph, to instructions indicated in a global reference list, to instructions indicated in a field reference list, to instructions indicated by a pointer dereference, or to another instruction in the present procedure. Then, the chase continues in the data flow graph of the procedure containing the instruction.

Abstract: Libraries and individual program components are provided with a common interface and a number of alternative implementations (e.g. hash table, tree, compressed) which can be selected. The component is instrumented to measure a cost of each of its alternative implementations, both independent of and in the context of the interaction of that component with other components of the computer program. Based on measured cost, the desired implementation is chosen for the component by an external controller that is generic to the computer program or by an application program that interfaces with the library or component.

Abstract: There is disclosed a method and system for configuring a data dependency graph (DDG) to handle instruction scheduling in computer architectures permitting dynamic by-pass execution, and for performing dynamic by-pass scheduling utilizing such a configured DDG. In accordance with an embodiment of the invention, a heuristic function is used to obtain a ranking of nodes in the DDG after setting delays at all identified by-pass pairs of nodes in the DDG to 0. From among a list of identified by-pass pairs of nodes, a node that is identified as being the least important to schedule early is marked as “bonded” to its successor, and the corresponding delay for that identified node is set to 0. Node rankings are re-computed and the bonded by-pass pair of nodes are scheduled in consecutive execution cycles with a delay of 0 to increase the likelihood that a by-pass can be successfully taken during run-time execution.

Abstract: A method and implementing computer system are provided in which selected information is embedded within computer program structures without requiring separate bit strings. In an exemplary embodiment, the embedded selected information includes an identification of a licensed user together with a serial number of the associated licensed program. That information is converted into a binary representation, and a transfer function is used to embed the binary representation into the structure of the licensed program. In the example, when a licensed program is compiled, linked and downloaded over an interconnection network, the order or sequence of the modules of the licensed program is arranged in a manner to correspond to the embedded selected information. The embedded information can then be extracted from the program by analysis of the organization of the modules comprising the program.

Abstract: The present invention is a solution that provides reliable and robust boot upgrade system and method. A power up boot process is performed in which a boot update application monitors for an indication of available update information and an update setup process is engaged in which an upgrade indication variable is set to a value indicating an upgrade is required and the upgrade indication variable continues to indicate an upgrade is required until an upgrade is successfully completed. An update reboot process is executed which retrieves updated information from a central management station and a boot loader routine reads an upgrade indication variable and repeatedly downloads the updated information until the upgrade indication variable indicates there is no pending update download required. The upgrade indication variable is changed to indicate no pending update download is required when a download is verified and authenticated.

Abstract: A code arrangement for facilitating the localization of an information source comprising a collector module for collecting information units to be localized from the information source and for causing a copy of the information units to be localized, a synchronization module for receiving the localized information units and comparing each to a current version of the information unit from the information source to determine if the information unit has changed and a dispersing module for storing the localized information unit if the information unit is unchanged. A related processor and method may include features similar to the elements of the code arrangement.

Abstract: Method for upgrading software in a network bridge that is part of a VLAN includes sending notification to other bridges of the VLAN that the bridge is scheduled for upgrading; suspending VLAN registration and membership information in the other bridges while upgrading the bridge; restoring a state of the updated bridge and sending notification to the other bridges that the upgrading has been completed. As a result of the notification, the other bridges do not expect additional messages from the upgrading bridge. The step of restoring a state of the bridge includes synchronizing a GVRP protocol running within the network to a current VLAN membership table. Apparatus includes a forwarding plane adapted to store VLAN membership information and a control plane adapted for issuing and executing instructions that control registration and de-registration of one or more ports of the bridge according to the VLAN membership information and the presented method.

Abstract: Methods and systems for network-based or Internet-based software delivery are described. In one embodiment, an application program or software platform resides on a client. The program or platform is configured so that it is extensible based on software extensions that are deliverable over a network such as the Internet. Various extensions can be developed by third party developers for incorporation into the program or platform. In the described embodiment, extension files that comprise a software extension are hosted on an Internet server. Additional files are also hosted on the Internet server and describe aspects of the software extension. These additional files include files that describe a logical attachment of the extension to the program or platform, as well as files that describe the location of the extension files. Extensions are incorporated on a client by navigating to a particular Internet site through which the extensions can be accessed.

Abstract: Systems and methods consistent with the present invention ensure software integrity by associating each software component to be included in a federation with a distinct unique identifier. A subset of the identifiers corresponding to any two software components should match for the federation to be accepted.

Abstract: Exemplary embodiments include a method, system, and storage medium for managing computer processing functions in a multi-processor computer environment that includes a standard logical processor and an assist logical processor, each of which share the same operating system instance within a logical partition. The method includes invoking a switch-to service by standard code. The standard code is running on a standard logical processor and is executing a task. The switch-to service checks to see if an assist logical processor is online, and it if finds one, the switch-to service updates an integrated assist field of a work element block associated with the task and assigns a queue to the work element block. The task is dispatched, in accordance with business rules identified in a system control block, on either of said assist logical processor or said standard logical processor.

Abstract: A method and system that prepares a task for being swapped out from processor utilization that is executing on a computer with multiple processors that each support multiple streams. The task has one or more teams of threads, where each team represents threads executing on a single processor. The task designates, for each stream that is executing a thread, one stream as a team master stream and one stream as a task master stream. For each team master stream, the task notifies the operating system that the team is ready to be swapped out when each other thread of the team has saved its state and has quit its stream. Finally, for the task master stream, the task notifies the operating system that the task is ready to be swapped when it has saved its state and each other team has notified that it is ready to be swapped out.

Abstract: A system and method for providing seamless communication with threads executing on an embedded computer. Using a DAT system, a programmer can test the communication interfaces of a thread via either a scripting program, any COM-compliant program, or a graphical test utility. The DAT system automatically formats a block of data that is transmitted between the embedded computer and a host computer and accounts for machine specific enumeration sizes, machine specific pointer sizes, machine specific structure alignment boundaries, machine specific integer sizes, and machine specific byte ordering.

Abstract: The kernel is a shared environment. Accordingly, many different kernel-mode drivers utilize services provided by the kernel. Furthermore, when shimming of drivers is necessary, it is desirable to support shim reuse amongst drivers with similar problems or issues, rather than generating a customized shim for each driver. To facilitate kernel-mode shimming and shim reuse, context information needs to be retrieved and maintained so that shims can identify particular driver calls and preserve driver specific linkage information. The present invention accomplishes the forgoing by employing an intermediate structure, a content component, between a client or driver call and a common shared shim to provide the shim with contextual information.

Abstract: A disk player is configured so that a steel plate-made clamper plate 3 is bridged between wall parts 2a of both sides of a cabinet and is fixed and a disk D on a tray 1 is clamped by a turntable 7 and a clamper 5 and the disk D is rotated by the turntable 7 and information recorded on the disk D is read by an optical pickup, spiral reinforcement portions 3c are formed by closely folding both side edges of the clamper plate 3 in a manner of winding at least two times.

Abstract: An optical disc drive includes an electro-conductive chassis, a tray, a bezel and an electro-conductive sheet. Wherein, the electro-conductive chassis has an opening portion. The tray is disposed inside the electro-conductive chassis for carrying an information storage medium and can move into and from the electro-conductive chassis, and the bezel is disposed at a front edge of the tray. In addition, the electro-conductive sheet is disposed between the front edge of the tray and the bezel, and substantively covers the opening portion of the electro-conductive chassis. As the tray stays inside the electro-conductive chassis, the electro-conductive sheet is in contact with the electro-conductive chassis. Consequently, the electro-conductive sheet is able to reduce the electromagnetic interference (EMI) generated during the operating of the optical disc drive. Further, the electromagnetic wave leakage damaging human health is also prevented.

Abstract: A disk 100 has an electronic circuit 10 for executing predetermined signal process and/or an electronic function part having a function of generating, writing or preserving some electronic data and at least one electrical conductive part 20 electrically connected to the electronic circuits and/or electronic function part. The disk 100 is to be set on the turntable 210, clamped by the clamp and driven for rotation for reading or writing data. The clamp has an electrical conductive part formed on locality corresponding to the electrical conductive part 20 of the disk 100.

Abstract: A method and apparatus for enabling the operators of television broadcasting systems or other content distribution systems to effectively alter the program viewing patterns of viewers or subscribers to direct viewership traffic to selected television programs or other content. In a recommendation based EPG system, the rating or recommendation assigned to a program is increased or decreased in accordance with the desire of the operator to increase or decrease viewership or in exchange for monetary or other consideration from content providers, advertisers or others. In one aspect, a boost value is applied to alter the recommended rating/ranking of program content, including selectively in a manner which may be substantially imperceptible to viewers. In another aspect, a sponsored program is assigned a premium position in a list of programs in exchange for receipt of monetary or other consideration.

Abstract: An entertainment head-end provides broadcast programming, video-on-demand services, and HTML-based interactive programming through a distribution network to client terminals in subscribers' homes. A number of different features are provided, including novel user interfaces, enhanced video-on-demand controls, a variety of interactive services (personalized news, jukebox, games, celebrity chat), and techniques that combine to provide user experiences evocative of conventional television.

Abstract: A system and related techniques detect and manage the set of rights associated with a componentized electronic document, including to separately protect and manage individual text, graphic, audio, video or other parts of a multimedia presentation. Unlike prior digital asset management platforms which could enforce encryption or other protection simply around the entire object, the invention permits individualized control over separate media components, to permit distribution for example of some parts, such as text passages, while preventing unauthorized access or copying of audio, photographic, video or other files or content. The electronic document may maintain a list of media components and the set of rights associated with each such component, and a content server or other source may apply key encryption or other safeguards to guide the delivery of the overall media object or its parts, for instance to view in a browser, print on a printer or otherwise access, manipulate or output the content.

Abstract: A system and method for effecting secure transactions over a computer network in a manner designed to foil identity theft perpetrated from an untrusted computer. A connection from a client computer to the network wherein the client computer provides a user interface for a user, a connection from a server computer to the network, and a connection from a portable secure computing device to the network provides for secure transmission of private confidential user information from the user to a server. The private information is transmitted directly from the secure computing device to the server over the secure connection without possibility of capture on the computer with which the user is interacting.

Abstract: Disclosed herein is an access privilege transferring method for safely transmitting privilege information about each object between subjects (users) over an object space in which service objects are scattered. User information and secret information of clients are shared between the clients and servers. A client that transfers privilege information generates privilege information weakened in its own contents of privilege. Further, the client applies a one-way function or an encryption function to a bit string obtained by joining the generated privilege information and the secret information to each other, thereby generating protected privilege information with which a third party who does not know the secret information is not capable of tampering. Utilizing the protected privilege information makes it possible to safely transfer access privileges.

Abstract: A mechanism is provided for signing on a user of a first domain into an affiliate application in a second domain. When the user needs access to the affiliate application, the request for access causes a ticket to be generated. The ticket identifies the user and is passed to an adapter. The adapter, which ultimately will perform the sign on in the affiliate application, redeems the ticket for the user's credentials (e.g., a valid userID/password combination for the affiliate application), and then presents the credentials to the affiliate application. A service is provided that issues tickets, redeems tickets, manages the registration and de-registration of affiliate applications, manages the correlation between a user and the user's credentials with an affiliate application, and manages encryption of stored records.

Abstract: The invention provides an arrangement for managing a network security application comprising a full management user interface for conducting management operations for the network security application, and a limited management user interface for conducting a limited number of management operations of the full management user interface for the network security application over a wireless remote connection.

Abstract: Communication using IPv6 is carried out, and conversion is given to a prefix of an IPv6 address in a firewall. A security channel for mutual authentication with an out-of-home apparatus or the like is carried out by the firewall, and only identification of an in-home apparatus is carried out on an in-home network by the firewall. A PC is connected to a PC in-home network different from the in-home network, and communication between the PC and the in-home apparatus is always carried out via the firewall.

Abstract: Various aspects of the invention provide a method, apparatus, and software for selecting interconnectivity rules for a computer network environment and visualization on a display of a data processing system interconnectivity rules in an auto provisioning environment, including: selecting a network environment specification having characteristics describing the environment, the characteristics including: number of network security tiers, firewalls, and other network constraints; displaying a graphical representation of the selected network environment, including security tiers, and proposed firewalls, to a user on the display; selecting network objects for the selected network environment, the network objects being selected from a group of objects including: operating systems and other software applications having predefined or configurable characteristics including interconnectivity rules, and firewall rules; populating the displayed network environment with the selected objects; determining network interconn

Abstract: Methods and structure of enabling secure communications between a customer computer system and a vendor support representative computer system despite firewall security on either or both systems. One embodiment provides for a collaboration center with a rendezvous service and an interaction service responsive to communications from the support representative or the customer. The rendezvous service initiates the communications between the customer and an appropriate support representative selected according to rendezvous rules provided by the vendor. Once selected, the support representative and customer systems interact by exchanging requests and responses through the interaction service using standard HTTP and Web protocols and interfaces. The communications utilize standard Web browser client programs on the respective computers and standard Web HTTP protocols that pass through typical firewall protection.

Abstract: Information appliance, computing device, or other processor or microprocessor based device or system provides security and anti-viral, anti-hacker, and anti-cyber terror features, and can automatically create multiple sequentially or concurrently and intermittently isolated and/or restricted computing environments to prevent viruses, malicious or other computer hacking, computer or device corruption and failure by using these computing environments in conjunction with restricted and controlled methods of moving and copying data, combined with a process that destroys malicious code located in computing environments and data stores.

Abstract: Post-infection virus protection through data restoration using mirrored data that has been obtained prior to the virus infection. A network appliance in a network mirrors the data of a number of computers in an ongoing manner. An anti-virus module of the network appliance scans data received from a computer to determine whether the computer is infected by a virus. If no virus is identified, the network appliance uses the received data to update a mirrored copy of the computer's data. If, however, the network appliance identifies a virus, the mirrored copy is not updated. Instead, the previous mirrored copy, which represents a pre-infection state of the data, is used to restore the infected computer to its pre-infection state. In this manner, a single copy of an anti-virus utility executed at the network appliance can protect an arbitrary number of computers, which do not require their own anti-virus software.

Abstract: Host computer systems automatically detect malicious code. The host computer systems automatically generate and send malicious code packets of the malicious code to a local analysis center (LAC) computer system. Based on the received malicious code packets, the LAC computer system provides a signature update to a network intrusion detection system. Further, the LAC computer system also automatically sends malicious code signatures of the malicious code to a global analysis center. In this manner, the spread of the malicious code is rapidly detected and prevented.

Abstract: A system, method and computer program product for scanning an executable file for malware presence, the method comprising: (a) detecting an attempt to execute a file on a computer; (b) identifying whether the file is known or unknown; (c) if the file is a known file, performing a signature malware check; (d) if the file is an unknown file, performing risk analysis and risk assessment for the file; (e) based on the risk analysis and the risk assessment, identifying which malware detection algorithms need to be used for the file, in addition to signature detection; (f) performing the malware detection algorithms on the file; and (g) if no malware is detected, permitting execution of the file. The risk analysis is based on file source, file origin, file path, file size, whether the file is digitally signed, whether the file is a download utility, whether the file is packed, whether the file was received from a CDROM.

Abstract: Embodiments of the present invention relate to systems and methods for static analysis of a software application. According to an embodiment, a system includes a program scanner coupled to an analysis engine. The program scanner is configured to identify one or more vulnerability patterns in a software program and to output an initial potential vulnerability list. The analysis engine is configured to apply one or more rules to a potential vulnerability to determine whether the potential vulnerability is a vulnerability.

Abstract: A pluggable architecture allows security and business logic plugins to be inserted into a security service hosted by a server, and to control access to one or more secured resources on that server, on another server within the security domain, or between security domains. The security service may act as a focal point for security enforcement, and access rights determination, and information used or determined within one login process can flow transparently and automatically to other login processes. Entitlements denote what a particular user may or may not do with a particular resource, in a particular context. Entitlements reflect not only the technical aspects of the secure environment (the permit or deny concept), but can be used to represent the business logic or functionality required by the server provider. In this way entitlements bridge the gap between a simple security platform, and a complex business policy platform.

Abstract: A method is disclosed for a recipient to receive rights management (RM) protected content. The protected content is encrypted and decryptable according to a content key (KD), where (KD) is found in a corresponding license. In the method, the protected content is received while connectively coupled to a network through which the protected content may be obtained, and it is recognized that the received protected content is in fact protected content. In response to receiving the protected content and recognizing same, the license for the protected content is obtained from an RM server while still connectively coupled to the network and in an automatic manner. Thus, the license is available to the recipient even when such recipient is not connectively coupled to the RM server by way of the network at a later time. In one particular embodiment of the present invention, the protected content is received within an email.