Abstract: A memory management system and method for a memory system of a mobile device includes initializing memory blocks of the memory system, obtaining a peak utilization rate and an average fragmentation rate of each memory block, adjusting configuration of each memory block P1 having a maximum peak utilization rate and each memory block P2 having a minimum peak utilization rate if a preset statistical count has been reached. The method further includes adjusting a size of each memory block P3 whose peak utilization rate is greater than a preset peak utilization rate and the average fragmentation rate is a maximum, or adjusting a size of each memory block P4 whose size is less than the size of a memory block P3, and merging residual parts generated by the adjustment to form one or more memory blocks P1.

Abstract: System, method, and computer program product for monitoring resources capable of being assigned to different partitions of a data processing system from a free resources pool of the data processing system. A free resources event log is associated with the free resources pool for maintaining a log of events for each resource that is in the free resources pool. When a resource is assigned to a partition from the free resources pool, a log of events for the assigned resource is transferred from the free resources event log to an event log associated with the partition.

Abstract: Disclosed herein are a flash file system and an address translation method. The flash file system includes a file system, a Flash Translation Layer (FTL), and flash memory. The FTL receives Local Block Addresses (LBAs) from the file system, and translates the LBAs into Physical Block Address (PBAs. The flash memory receives the resulting PBAs. The FTL includes a memory block in which a multi-stage clustered hash table for mapping the LBAs to the PBAs is stored, and performs the address translation using the clustered hash table.

Abstract: Page tables in the last level of a hierarchical page table system are scanned for candidate page tables. Candidate page tables are converted to large pages, having a page table entry in a level before the last level of the hierarchical page table system adjusted to be associated with the newly created large page. Upon receiving a notification that a large page is to be converted into a page table, a new page table is created. Each entry in the new page table is associated with a small segment of memory in the large page and an entry in a page table one level before the last level in a hierarchical page table system is adjusted to be associated with the new page table.

Abstract: A system to facilitate virtual page translation. An embodiment of the system includes a processing device, a front end unit, and address translation logic. The processing device is configured to process data of a current block of data. The front end unit is coupled to the processing device. The front end unit is configured to access the current block of data in an electronic memory device and to send the current block of data to the processor for processing. The address translation logic is coupled to the front end unit and the electronic memory device. The address translation logic is configured to pre-fetch a virtual address translation for a predicted virtual address based on a virtual address of the current block of data. Embodiments of the system increase address translation performance of computer systems including graphic rendering operations.

Abstract: A processor, integrated with re-configurable logic and memory elements, is disclosed which is to be used as part of a shared memory, multiprocessor computer system. The invention utilizes the re-configurable elements to construct persistent finite state machines based on information decoded by the invention from sequences of CISC or RISC type processor machine instructions residing in memory. The invention implements the same algorithm represented by the sequence of encoded instructions, but executes the algorithm consuming significantly fewer clock cycles than would be consumed by the processor originally targeted to execute the sequence of encoded instructions.

Abstract: A data processor apparatus comprises a plurality of data receiving means each for receiving data from a data source; a computational element coupleable to each of said data receiving means for performing an operation on said data; and a controller for controlling the flow of data from each data receiving means to the computational element.

Abstract: Disclosed is an SIMD-type microprocessor comprising a processor element group, plural processor elements with an operation part and a register file being arranged therein and a processor element control signal generator configured to output a processor element control signal controlling an operation of the processor element, wherein a feed part configured to feed a processor element control signal output from the processor element control signal generator to the processor element is provided at a center of the processor element group.

Abstract: Reducing pipeline stall between a compute unit and address unit in a processor can be accomplished by computing results in a compute unit in response to instructions of an algorithm; storing in a local random access memory array in a compute unit predetermined sets of functions, related to the computed results for predetermined sets of instructions of the algorithm; and providing within the compute unit direct mapping of computed results to related function.

Abstract: Some embodiments present a method of performing a variable shift operation. This method can be used by a microprocessor that does not allow variable shift operation for certain operand sizes. The method simulates a shift instruction that shifts an operand by a shift count. The method identifies a first shift command and a second shift command. The method computes a mask value. The mask value depends on whether the shift count is less than half of the operand size or greater than or equal to half of the operand size. The method uses the mask value to cause one of the first shift command and the second shift command to produce no shift. In some embodiments, the method allows for the shift count to be specified in bytes or in bits.

Abstract: A method of operation within an integrated-circuit processing device having a plurality of execution lanes. Upon receiving an instruction to exchange data between the execution lanes, respective requests from the execution lanes are examined to determine a set of the execution lanes that may send data to one or more others of the execution lanes during a first interval. Each execution lane within the set of the execution lanes is signaled to indicate that the execution lane may send data to the one or others of the execution lanes.

Abstract: A processor comprising fetch logic adapted to fetch instructions from memory and decode logic coupled to the fetch logic and adapted to decode the fetched instructions. If a bit in the decode logic is in a first state, a particular fetched instruction is skipped and a group of one or more instructions is executed in lieu of the particular fetched instruction. If the bit is in a second state, both the group and the particular fetched instruction are executed.

Abstract: An emulator allows subject code written for a subject processor having subject processor registers and condition code flags to run in a non-compatible computing environment. The emulator identifies and records parameters of instructions in the subject code that affect status of the subject condition code flags. Then, when an instruction in the subject code is encountered, such as a branch or jump, that uses the flag status to make a decision, the flag status is resolved from the recorded instruction parameters. Advantageously, emulation overhead is substantially reduced.

Abstract: The disclosure is directed to systems, apparatus, and methods for layered execution pre-boot configuration. In one example, a system includes a local computer, a base operating system, a layered execution environment, and a layered environment manager. The system may further include an environment update service and one or more layered environment data store(s). The system may, before booting the base operating system and layered execution environment, perform such modification operations as applying an operating system patch, applying a program patch, changing a layer activation property, disabling a program, replacing a program, changing a configuration file, and installing a driver.

Abstract: An integrated circuit comprising: a processor; a plurality of external pins operatively coupled to the processor; and a permanently written memory operatively coupled to the processor, the memory having a plurality of regions each storing one or more respective boot properties for booting the processor. The processor is programmed to select one of the regions in dependence on an indication received via one or more of the external pins, to retrieve the one or more respective boot properties from the selected region, and to boot using the one or more retrieved boot properties.

Abstract: Aspects of the invention provide a method and system for coding information in a communication channel. More particularly, aspects of the invention provide an method and system for synchronous running encryption and/or encoding and corresponding decryption and decoding in a communication channel or link. Aspects of the method may include encoding and/or encrypting a first data using a first or second encoding table and/or a first or second encryption table. The method may indicate which one of the first or second encoding tables or which one of the first or second encryption tables were utilized for encoding and/or encrypting the said first data. The encoded and/or encrypted first data may subsequently be transferred downstream and decoded by synchronous decoder/decryptor using a corresponding decoding and/or decryption table.

Abstract: Authentication system and method are provided. The authentication system includes: a server configured to provide at least two security levels and configured to transmit one of at least two security modules corresponding to the security level of a user terminal, via communications network, to the user terminal based, at least in part, upon an environment of the user terminal; and an authentication server communicatively linked with the server and configured to perform a user authentication in response to a user authentication request from the user terminal. Accordingly, various hackings can be prevented and the user authentication can be accomplished with user's convenience and security.

Abstract: In one embodiment, the systems and methods utilizes an enciphered permit identification number, called a session certificate, to reference the policy attribute values and session key that are stored in a secured, online reference monitor (SRM). The session key is used to encipher confidential communications, such as voice and audio communications over the Internet (VoIP), between computers. Each computer uses a unique key with a cryptographic transaction protocol for authentication and key agreement (PAKE) to securely communicate with the SRM. A sender computer uses PAKE to get a session certificate and a session key from the SRM. It sends the session certificate to a receiver computer. The receiver computer sends the session certificate to the SRM and gets back the session key. The sender computer encrypts its VoIP message with the session key and transmits it to the receiver computer. The receiver computer decrypts the VoIP message.

Abstract: One embodiment of the present invention provides a system that uses digital certificates to facilitate enforcing licensing terms for applications that manipulate documents. During operation, the system obtains a credential, wherein the credential includes a private key and a digital certificate containing a corresponding public key. This digital certificate also contains a profile specifying allowed operations which can be performed on documents signed with the credential. Next, the system digitally signs a document using the credential, so that the resulting signed document is signed with the private key and includes a copy of the digital certificate with the profile specifying the allowed operations. The certificate issuer can subsequently revoke the digital certificate (which effectively revokes the license) if teens of a license agreement associated with the digital certificate are violated.

Abstract: In the setup phase, the certification authority (CA 120) generates validation proof data structures for greater time than the maximum validity period of any digital certificate. Therefore, new certificates can be added to the existing data structures after the setup phase.

Abstract: A system for processing encrypted SSL sessions includes a web application, a secure sockets layer socket, a TCP/IP stack network layer device. The secure sockets layer socket is coupled between the web application and the TCP/IP stack network layer device. The system also includes an Ethernet device. The TCP/IP stack network layer device is coupled to the Ethernet device. The system also includes a SSL kernel, a kernel SSL interface coupled between the kernel SSL module and the TCP/IP stack network layer device and a crypto subsystem coupled to the kernel SSL module. A method for processing encrypted SSL sessions is also described.

Abstract: A solution is proposed for populating a policy file in a Java environment automatically. For this purpose, there is provided a wrapper for a security manager in charge of controlling any access to protected resources. A generic Java application is run in a test environment. Whenever a specific operation must be executed on a secured resource, the Java application submits a corresponding permission request to the wrapper. The wrapper forwards the permission request to the security manager, which verifies whether the required permission is available in the policy file. The wrapper logs any denied permission. In any case, the wrapper always grants the required permission to the Java application, so that its operation can continue without any problem. At the end of the running of the Java application, the logged missing permissions are added to the policy file.

Abstract: Authorizing information flows between devices of a data processing system is provided. In one illustrative embodiment, an information flow request is received from a first device to authorize an information flow from the first device to a second device. The information flow request includes an identifier of the second device. Based on an identifier of the first device and the second device, security information identifying an authorization level of the first device and second device is retrieved. A sensitivity of an information object that is to be transferred in the information flow is determined and the information flow is authorized or denied based only on the sensitivity of the information object and the authorization level of the first and second devices irregardless of the particular action being performed on the information object as part of the information flow.

Abstract: A system is described in which similar session objects are managed within session domains. In addition, in one embodiment, a persistence storage interface is employed which maps each session domain to a table within a relational database or other persistent storage implementation.

Abstract: A method for authenticating a user of certain service provided by a system through a first communication channel, in one aspect including receiving an access request from a first terminal of the user through the first communication channel; receiving an address or number of a second terminal of the user through the first communication channel; transferring data including an identification code, to the second terminal of the user through a second communication channel; receiving a user confirmation response, including the user identification code, from the second terminal of the user through the second communication channel; determining whether the identification code transferred to the second terminal is identical to the user identification code received from the second terminal; generating an authentication code if it is determined that both the user identification codes are identical to each other; transferring the user authentication code to the first terminal of the user through the first communication ch

Abstract: A method of granting access to resources includes the step of receiving a request from a node to access a resource. A scanning agent is generated to gather information about the node. A key is generated and embedded in the scanning agent. The scanning agent is transmitted to the node and gathers information regarding the node. The scanning agent encrypts the gathered information using the at least one generated key. The encrypted gathered information is received from the scanning agent and decrypted.

Abstract: The present invention is directed to an architecture and mechanism for securely backing up files and directories on a local machine onto untrusted servers over an insecure network.

Abstract: A method and apparatus for communication via a computer network (102) including registering a plurality of users (206, 222, 224) with a trusted body (110, 210). The trusted body (110, 210) verifies the identity of each user (206, 222, 224) and generates a random identifier (216) for each user (206, 222, 224). A plurality of users (206, 222, 224) can enter into a dialogue with the other users by means of messages sent over the computer network (102) via the trusted body (110, 210). A user (206, 222, 224) remains anonymous through use of its random identifier (216) until such time as the user (206, 222, 224) reveals its true identity. Due to the registration of the users (206, 222, 224) with the trusted body (110, 210) a means of non-repudiation of the dialogue by the users (206, 222, 224) is provided.

Abstract: A method of creating and using a software application module includes coding, by a developer, a software application module for extending a functionality of a main software application. The software application module is adapted to interface with the main software application using an application programming interface (API). The method further includes compiling the software application module to produce an executable software application module, determining if the developer is authorized to use the API, and embedding a watermark in the executable software application module if it is determined that the developer is authorized to use the API. The method still further includes executing the main software application, reading the watermark from a executable software application module, verifying if the watermark is correct, and executing the software application module if the watermark is verified as correct.

Abstract: A system and method for data storage and removal includes providing databases and providing encryption keys. Each database is associated with a database time period and each encryption key is associated with an encryption time period. Data items are received and each data item is encrypted using the encryption key associated with the encryption time period that corresponds to a time associated with the data item. Each encrypted data item is stored in the database associated with the database time period that corresponds to the time associated with the data item. Each encryption key is deactivated at a predetermined time after the associated encryption time period ends. Each database is made irretrievable upon a determination that all of the encryption keys associated with the data items stored in that database have been deactivated.

Abstract: A method for authentication of elements of a group, especially for authentication of sensor nodes in a preferably wireless sensor network is disclosed. The group has one specific element—leading element—with which each of the group elements can exchange information and wherein the authentication of the group elements takes place with regard to the leading element. The leading element sends an authentication request to the group elements wherein the authentication request is the same for all the group elements. The group elements each send authentication responses—based on the authentication request—to the leading element, with the authentication responses being different for each group element.

Abstract: A system for secure communication is provided. A random value generator is configured to generate a random value. A message validation code generator is coupled to the random value generator and configured to generate a message validation code based on a predetermined key, a message, and the random value. A one-time pad generator is coupled to the random number generator and configured to generate a one-time pad based on the random value and the predetermined key. And a masked message generator is coupled to the one-time pad generator and configured to generate a masked message based on the one-time pad and the message. A protected message envelope generator is coupled to the random value generator, the message validation code generator, and the masked message generator, and is configured to generate a protected message envelope based on the random value, the message validation code, and the masked message.

Abstract: The system and method uses user generated questions and answers of multiple levels for added protection from adversaries. There are a first set of question(s) and answer(s) corresponding to the first set of questions as well as a second set of plurality of questions and answers corresponding to the second set of plurality of questions. The second set of plurality of answers is concatenated to form a single pass phrase. To enter the pass phrase at a client workstation, a user is presented with a plurality of entries for entering the second set of plurality of answers and an option to request a second set of plurality of questions. If the correct first set of answer(s) is entered immediately or entered after the first set of question(s) is displayed, the second set of plurality of questions is displayed.

Abstract: A method and system to authenticate users with a one time password by using a visual communication channel. The method and system may include using a device to capture a sequence of images being displayed and decrypt an encrypted one time password contained in the sequence of images.

Abstract: The present invention provides a password recovery system that re-supplies a password to only the legitimate user of the password. The password recovery system includes a memory card with CPU and a mobile phone. When a password needs to be recovered, a phone call is made, to the mobile phone, from a telephone connected to a phone line whose phone number is registered in advance into the memory card with CPU. The mobile phone then obtains the telephone number of the phone line via a caller's telephone number notifying service. It is judged whether the obtained telephone number and the registered phone number are the same, and when they are the same, the password stored in the memory card with CPU will be re-supplied so that the user can recover it.

Abstract: A system controlling online access to a study course verifies the identity of an individual taking a study course over a global computer network from a first computer at a node of the network. The first computer has a biometric identification program and communicates over the network with a second computer that is at a network node other than a node of the first computer. The second computer includes study program material. The first computer operates a biometric reader, which obtains a first set of biometric data from the individual and a second set of biometric data from the individual while access is granted to course material. The biometric identification program compares the first set of data with the second set of data to make a verification of the identity of the individual and communicates the verification to the second computer.

Abstract: A system and method for authenticating suspect code includes steps of: receiving the suspect code for a first instance of a trusted platform module; loading the suspect code into a trusted platform module device operatively associated with a processor, wherein the suspect code is loaded outside of a shielded location within the trusted platform module device; retrieving a validation public key from a table and storing it in a register in the trusted platform module device, the validation public key indexed by the suspect code; and retrieving a hash algorithm from the table, the hash algorithm indexed by the suspect code. The hash algorithm is run to derive a first hash value; then, using the validation public key, the second hash value is decrypted to derive a second decrypted hash value. The two hash values are compared; and upon determining a match, the suspect code is loaded into the shielded location of the processor for execution by the processor.

Abstract: Video data exploitation by alteration of data is prevented. An extractor 111 extracts valid video data in data 110 and predetermined data in the data. An inserter 114 inserts an arithmetic operation result of the predetermined data by an arithmetic operation unit 113 into the valid video data encrypted by an encryptor 112. An output of the inserter 114 is supplied to an extractor 144 through a transmission path 120. The encrypted valid video data and arithmetic operation resultant data of the arithmetic operation unit 113 are extracted. An arithmetic operation unit 143 executes the same arithmetic operation as that of the arithmetic operation unit 113 to data corresponding to the data used in the arithmetic operation unit 113 from the valid video data decrypted by a decryptor 141 and extracted by an extractor 144. A comparator 145 compares an output of the arithmetic operation unit 143 with an arithmetic operation result extracted from data 140.

Abstract: The invention relates to a method of generating a pseudonym, the method including accessing an input value and calculating a pseudonym by applying a cryptographic one-way function to the input value, where the cryptographic one-way function is an injective function. In alternative embodiments, the cryptographic one-way function is an embedding and/or randomizing function.

Abstract: The aim of the invention is to provide a means of encrypting company-related data which also ensures that the data can be reproduced if the key is lost. To this end, the invention provides a method or an information processing system in which a key for a symmetrical encryption method is allocated to a user (4) for encrypting the data. Allocation information associating the key with the predetermined data to be encrypted and/or the user (4) is stored and can only be accessed by an authorised third party. If necessary, the key used for the particular data can be determined and the encrypted data reproduced, i.e. rendered readable, by this authorized third party. The allocation information, associating a particular key with an element identifying the predetermined data or a user identifier, can be stored in the information processing system in a predetermined manner or be created following a request for the allocation of a key.

Abstract: In the case where a target device stores: m keys {Ka1, . . . , Kam} (m is a natural number) in a manner that the Kai (i is a natural number satisfying 1?i?m) is encrypted with the Ka (i?1); and n keys {Kb1, . . . , Kbn} (n is a natural number) in a manner that the Kbj (j is a natural number satisfying 1?j?n) is encrypted with the Kb (j?1), a confidential information processing unit is caused to perform a processing of re-encrypting the encrypted key Enc (Kai, Ka (i?1)), which has been encrypted with the Ka (i?1), by using the Kb (j?1) and outputting as an encrypted key Enc (Kai, Kb (j?1)).

Abstract: A remote connection system capable of generating a wake-up command and method thereof include a remote connector with a power supply input receiver capable of being connected to a power source and further capable of receiving a power supply for the purpose of powering the remote connector. The remote connector further includes a plurality of input ports allowing the coupling of a connector thereto and providing for the transmission of information thereacross. The remote connector further includes a wireless receiver capable of wirelessly receiving a wireless command and a transmitter capable of generating the wake-up command in response to the wireless command. The remote connector further includes a remote device capable of receiving a user input command, generating the wireless command and thereupon wirelessly transmitting the command to the wireless receiver of the remote connector.

Abstract: A system including plural storage devices provides a technique for controlling storage devices in which files are located by a file system, and turning on or off the storage devices based on prediction of the start or end of access to the files. A program that manages power to the storage devices and data access to the storage devices via the files includes means or functions for allocating a storage device as an area in which a file is located, for selecting a storage device in which a file is located, for predicting that access to a file is started for commanding turning on power to a storage device based on the prediction that access to a file is started, for predicting that access to a file terminates, and for commanding turning off power to a storage device based on the prediction that access to a file terminates.

Abstract: By supplying auxiliary power to a blade's optional components, instead of polling the blade for the power requirements of a fully configured module, each installed component can be individually polled and the values summed to produce a more accurate value representing the actual power needs of a blade system prior to booting.

Abstract: To provide a storage system capable of minimizing a performance deterioration, saving power consumption, and realizing a high reliability. A storage system according to the present invention includes a computer, a storage apparatus 1 connected with the computer, and a storage management apparatus connected to the storage apparatus, the storage apparatus including a hard disk unit to control a data write operation and a data read operation between the computer and the hard disk unit, and control on/off states of power supply of the hard disk unit on a group basis, and the system management apparatus collecting running information about the computer and computer execution job information for each computer, and determining an on/off time of the power supply of the hard disk unit on the group basis to record the collected information and the on/off time of the power supply on the group basis.

Abstract: An electronic apparatus with power saving functionality is disclosed. The electronic apparatus has a first signal processing circuit and a second signal processing circuit. The first signal processing circuit includes a receiver logic for processing at least a satellite signal generated from a global navigation satellite system (GNSS) to obtain resultant data; and a power saving determination logic for monitoring an operation status of the receiver logic and generating a first control signal according to the operation status. The second signal processing circuit includes a processing logic for receiving the resultant data from the receiver logic for further signal processing; and a power saving trigger logic for controlling the processing logic to enter a power saving mode from a normal mode when receiving the first control signal from the power saving control logic.

Abstract: An information recording/reproducing device, wherein a power management mechanism for a serial ATA interface connecting between an optical disk drive and a host computer has a steady-state power mode (PHYRDY) and a power-saving mode (Partial state, Slumber state) to keep power consumption lower than the steady-state power mode, while a power management mechanism built into the optical disk drive has a steady-state power mode (active state) and a power-saving mode (inactive mode) to keep power consumption lower than the steady-state power mode. The optical disk drive controls transition of the power consumption modes of the power management mechanism for a serial ATA interface in accordance with current power consumption mode of its internal power management mechanism.

Abstract: In one embodiment, the present invention includes a method for providing power state change information from a plurality of cores of a processor package to a predictor at a periodic interval and generating a prediction to indicate a predicted operation level of the cores during a next operating period. Other embodiments are described and claimed.

Abstract: An integrated circuit comprising a plurality of processing cores, characterised by comprising electrically controllable switches for controlling the supply of power to one or more of the processing cores, a memory for saving state data from at least one of the processing cores and a controller adapted to control the supply of power to one or more of the processing cores such that processing cores can be de-powered.

Abstract: A multifunctional device shifts the states of plural reception units from a state that the device operates in a power saving state to a state that the device operates in an operating state, according to which of the plural reception units a reception request of data is input to. The multifunctional device can shorten a time from the reception of the reception request of the data to the reception unit to a start of a data process of the data.