Aspects include provision of a hair mesh structure that can be used for modeling, animating, simulating, and/or rendering hair and hair-like objects in the field of computer graphics. The hair mesh structure can use an ordered plurality of surface primitives, which can be represented by correspondence data, and mapping(s) of points on corresponding surface primitives. A plurality of paths can be generated based on the mappings. These paths can be used to generate hair-like geometry elements. Therefore, hair can be modeled, edited, and animated by editing surface primitives. This approach provides control of the hair shape and permits hair modeling using surface modeling processes, without direct editing of curves defining hairs themselves.

1. Field
The following relates generally to computer graphics and, more specifically, to modeling and animating hair and other hair-like geometry.
2. Related Art
Hair is an important visual component of virtual characters. For example, the shape of a virtual character's hair significantly affects the visual appearance of a character. Hair-like materials are prevalent in many computer graphics situations. Therefore, artists can be helped by being able to use tools for creating, visualizing and manipulating hair models for virtual characters, as well as other surfaces with hair-like characteristics, such as grasses, fur, and so on.
However, realistic hairstyles form complicated geometric structures that make them very difficult to model. A real human head generally contains more than a hundred thousand hair strands, each of which can be a complicated space curve (i.e., a curve in 3-D space). Therefore, modeling each and every hair strand individually is not feasible in practice.
Various approaches have been proposed to simplify hair modeling, at least some of which are introduced below, by way of introduction and background. However, such introduction is not an exhaustive treatment of these techniques, nor impliedly a comprehensive list of approaches that may have been proposed.
One way of hair modeling is through representing the hair model with only an outer surface using parametric surfaces of NURBS patches. This surface can be given a hair like appearance by a texture map of a hair image with a transparency channel. Alternatively, actual hair geometry can be generated along this flat surface. These methods can be improved by adding a thickness to the surface and generating hair strands within a thin shell around this surface. Since the hair model is represented by a flat surface, such methods can only generate hair strands near the outer surface of a hair model and the rest of the hair strands inside the hair volume are not produced with these approaches. Therefore, these methods are limited in terms of the hairstyles that they can properly represent and they generally considered unsuitable for producing realistic hair models.
Another hair modeling approach is to specify various characteristics of a hair model using texture maps on the surface on which the user aims to grow hairs. Multiple texture maps can be used to specify multiple characteristics of hairs growing out of a certain area. Such approaches are most useful for modeling fur and short hair. However, it is difficult to use texture maps for creating complex hairstyles, since the hair model can only be controlled indirectly by varying the colors of various texture maps, and they are considered unsuitable for modeling long hairstyles.
A common hair modeling technique is using wisps (or generalized cylinders). A wisp is essentially a curve in 3D with some thickness. Individual hair strands are generated along this wisp curve within a neighborhood defined by its thickness. The shapes of individual hair strands are often altered by procedural modeling techniques, such as a random variation or a noise function. A hair model can be created using multiple wisps placed within the hair volume. Wisps are most useful for modeling hairstyles with well-defined clusters each of which can be represented by a wisp. However, the resulting hair model appears like multiple clusters of hairs, which are often unrealistic for most hairstyles. Furthermore, modeling and editing a large collection of wisp curves that represent a complex and realistic hairstyle can be difficult and labor intensive. Even small changes to the overall shape of a hair model may require a large collection of wisps within the hair volume to be modified accordingly.
Another common hair modeling approach is interpolating a number of manually created guide hairs. Guide hairs represent a small subset of all hair strands of a hairstyle. The user explicitly models guide hairs and the rest of the hairs are generated by automatically interpolating the shapes of nearby guide hairs. An interpolation can eliminate or reduce undesired clustering produced by wisp-based techniques. After the interpolation, the shapes of individual hair strands are often modified using procedural techniques, which help to produce more natural hairstyles and controlled clustering. However, the modeling process of guide hairs is very similar to modeling wisps. Therefore, depending on the complexity of the hairstyle and the number of guide hairs required, defining the shapes of the guide hairs can be difficult and very laborious.
Another modeling approach for hair makes use of shell surfaces. In this approach hair strands are rooted on one shell surface and they all grow towards a second shell surface, which has a topology that is matched to the first shell surface. Multiple shell surfaces with matching topologies may be used for generating longer hairstyles or for providing more control over the shape of the hair model. Such approaches are quite restrictive in terms of the hair models they can represent and they are not suitable for modeling complex hairstyles. Furthermore, the fact that the user needs to model all shell surfaces explicitly makes these methods less favorable in practice.
To simplify hair modeling process, researches and developers have also tried using different physically based simulation techniques. Such methods include simulating the effect of gravity to find the rest poses of hair strands, simulating a real-world hair dressing session using haptic controls and physically based simulation, modeling hair as streamlines from a fluid dynamics simulation, and using 3D vector fields to shape hair strands or wisp curves. These methods can simplify the modeling process of the overall hair shape and various hairstyles can be generated using these methods. However, just like any other simulation method, controlling these techniques in a precise manner is not easy. With these techniques the shape of the overall hair model is defined indirectly by various parameters of the system and this indirect control makes it difficult to achieve the exact hair model desired by the user.
While at least some of the techniques described above may be able to generate a variety of hairstyles, they lack explicit control over the shape of the overall hair model, they are labor intensive and time consuming, and/or are not intuitive for artistic use. Therefore, there is a need for continued improvements in hair modeling methods and systems.


A method for the production of a cup-shaped article, in particular a blank of a screw cap for glass bottles or the like, from an enameled metal sheet, using two tools in a stepwise manner: 1) the blank is stamped from the metal sheet in a first tool by the relative motion between a cutting bell cooperating with a blank holder and a drawing block, and the blank is drawn around the drawing block, the width of a flange forming between the cutting bell and the blank holder being continuously reduced with a progressive degree of deformation until the flange reaches a defined width (R-r), and 2) the blank is deformed in a second tool such that the radially outwardly directed flange is deflected toward a profiling introduced in a wall of the blank.

Deep drawing is understood to mean the shaping of a sheet metal section (circular blank, plate blank) into a hollow body, or the shaping of a hollow body into a hollow body with a smaller circumference, with or without intentional modification of the sheet metal thickness. During shaping, segments of the blank must be folded up on the cylinder wall, with the parts inbetween being displaced, thus creating radial tensile and tangential compressive stresses. Bending occurs when the cutting bell runs over the blank. The blank holder impinged on by force is provided to prevent the radially outwardly projecting flange from buckling and forming folds under the influence of the tangential compressive stresses.
The caps provided for glass bottles are drawn from relatively thin metal sheets. These sheets, in particular when used in the food industry, are enameled and in many cases have commercial printing. A problem with the cap manufacture is that during shaping in the axially outer region of the cup the enameling cracks and forms fine colored filaments. The cracked enameling does not detract from the appearance, since the axial end of the blank is subsequently rolled in so that the cracked locations, which are also very fine, are not visible on the finished product. However, the colored filaments become lodged not only in the tools but also on the edge of the blank, and a cotton-like texture forms in the tools which must be regularly removed. In addition, the filaments that remain on the cup, in particular on the edge thereof, must be carefully removed so that during filling they do not come into contact with the filling material (foodstuffs), which would be unacceptable.
Caps for glass bottles are mass-produced articles which are manufactured in large quantities in a tool with high cycling times. The cycling times typically have values of approximately 300 min−1. To remove the filaments, the manufacturing unit containing the tool must be shut down and blown out or cleaned, thereby lengthening the production time and also increasing the manufacturing costs. The filaments must be blown out very carefully so that the operators of the unit are not subjected to health risks. In addition, the room in which the units are set up must be continually cleaned to remove the colored filaments.
Various methods having stepwise deformation have been developed in the prior art. DD 233 036 A3 discloses a method for deep-drawing sheet metal parts in which a first draw is followed by a second draw within the same press stroke in the same direction, the drawing force of the first draw being employed as a hold-down force by the second draw and being reduced with progressive drawing depth. The hold-down force is progressively reduced from the start of the second draw, and is entirely eliminated before the shaping in the second draw is completed.
In addition, a drawing method for a disk-like metal sheet is known from DE 692 06 748 T2 in which an annular holding element and/or the drawing tool, which have a residual flange region, are moved in such a way that the holding operation is terminated immediately before the drawing stage is completed. The flange region is then drawn while the back end of the flange region is released.
Both methods share the common feature that they are each carried out in a single tool, so that the shaped part remains in this tool during the stepwise deformation. In practical operation, in particular for high cycling times, release of the hold-down force cannot be reliably ensured. For example, for a pneumatically operated unit the response time for the control is too slow to maintain the high cycling time. For this reason, filament or tail formation cannot be ruled out, even during the second process step when the blank holder should not exert any force on the blank to be deformed.

Method for producing a cup-shaped object


An operational amplifier has two paths, a high frequency path and a low frequency path. In addition, it has three main sections of stages. A stage converts input voltage to an amplified output voltage, a stage converting an input voltage in to an output current and a final stage where the outputs of the two previous sections are supplied as inputs. Among them, the final stage acts as a voltage follower to a signal applied to its plus (+) input and as a transimpedance amplifier for a signal applied to its minus input (−). In this configuration, a path for low frequencies and a path for high frequencies are created in a single operational amplifier.

Operational amplifiers (Op-amps) are among the most widely used electronic devices today. It has a variety of functions and is used in many industries. In designing Op-amp, sizes of transistors in differential input stage have to be large in order to obtain good DC characteristics. As a result, frequency poles relating to parasitic capacitances of the transistors are formed at lower frequency. These lower poles impose limitation on bandwidth of the Op-amp. Therefore in designing high speed Op-amp, adding one more signal path in which there are no large transistors can be effective way. The present invention provides one method to design dual-path operational amplifier which is able to drive not only captive load but also resistive load.


In a rotating grate having a rotational-symmetrical shape having an axis of rotation which is inclined against a horizontal plane by more than 34°, and which encloses a combustion chamber for the combustion of slag-forming fuel, which is locked on a lower end and is open at an upper end and is defined by meridionally extending carrier arms that are hollow and are connected to a compression air source and are provided with blow openings directed into the combustion chamber, the combustion chamber has a spherical shape, or in the borderline case a cylindrical shape with a radially extending lower front side, the angle of inclination of the axis of rotation against the horizontal is between 36° and 46°, the carrier arms in the combustion chamber are flush with the remaining grate surface, and the inner contour of the combustion chamber encloses an angle of 90° with the axis of rotation in the area of the closed end. Thereby, an intense circulation of the combustible on the rotating grate is caused in operation, which avoids the formation of slag adhering to the grate.

Almost all solid fuels or combustibles include incombustible components, which after combustion remain as ash and which mostly have very high melting temperatures. If these components remain on a combustion grate in a more or less moved way for a prolonged prior of time under the effect of the flame temperature, eutectic reactions might occur between the components within the slag, wherein the melding temperature of the mixture of these components significantly drops. Softening or melt flow of the mixture takes place, thus the formation of adhesive or viscous slag with uncombusted parts often being included. If moreover the movement of the combustible on the grate is low, large slag lumps are formed that affect the operation of the rotating grate.
The movement conditions are essential to prevent such states. If the combustible is kept in constant and sufficient movement, the time during which two ash components are in contact is not sufficient for the relatively slow eutectic reactions, and slag and lumps cannot form. The combustion air supply and the local temperatures controlled thereby are also influential.
A suitable combustion air supply suffered so far at rotating grates, as it is for instance described in DE 2 046 337 A, DE 1 526 077 C and DE 1 751 457 A, since in these grates the combustion air is blown from below against a sphere-like grate. In such rotating grates it is not possible to convey a greater portion of the supplied air into the combustible. The grate rods and the combustible resting thereon block the air blow from below against the rotating grate. Thus, only a partial combustion in the lowermost layer of the combustible lying on the rotating grate takes place with the respective local excess temperatures and the flow of slag.
It was reported that in the case of practically designed constructions for instance in a manner as shown in DE 2 046 337 A, the slag flow in cooperation with the flames of the air burning below the rotating grate attacked the carrier structure of the grate and destroyed it within few weeks of operation. This was the reason for the fact that grate combustions did not become accepted.
A rotating combustion gate as defined in the opening portion of this specification is disclosed in EP 0 952 396 B1, this document showing a conical combustion grate or combustion cone comprising hollow, meridionally extending carrier arms for the purpose of supplying combustion air supplied from a compressed air source directly into the combustion chamber. However, the carrier arms project from the grate surface on the combustion chamber side, since they are supposed to cooperate in the agitation of the combustible. Moreover, it is relied on the separation effect that is produced in hollow conical bodies of this type and arrangement (axial inclination 35° to the horizontal) and which effects that the fine portion of the combustible separates from the agitated main mass of same and travels to the smaller diameter of the cone. This should intensify combustion.
This separation effect was actually produced in the known combustion cone and, thanks to the novel type of combustion air supply, the combustion results were very good. Unfortunately, the separated fine portion of the ash hardly moved at the small diameter of the rotating combustion cone, and thus the formation of slag took place. Furthermore, the sections of the carrier arms projecting into the combustion chamber obstructed a circulating movement of the combustible on its support.

Rotating grate for the combustion of slag producing fuel


Embodiments of the invention provide a control assembly and method of manufacturing a walk-behind mower having a transmission and an engine electrically connected to an operator presence switch. The control assembly can include a left drive lever and a right drive lever. The control assembly can also include a left control member and a right control member each coupled to the transmission. The control assembly can further include a left operator presence lever and a right operator presence lever coupled to the operator presence switch. The operator presence switch can allow the engine to operate when either the left operator presence lever is moved toward the left drive lever or the right operator presence lever is moved toward the right drive lever.

Walk-behind mowers generally include a handle and an operator presence bar that must be squeezed together with the handle in order to start and operate the mower. The operator presence bar often spans the horizontal width of the mower. In addition, typical walk-behind mowers include a separate speed control lever that must be accessed by one of the operator's hands while the operator continues to squeeze the operator presence bar against the handle with his or her other hand. If the operator accidentally releases the operator presence bar with one hand while using the other hand to reach the speed control lever, the engine of the mower will automatically shut down causing the operator the delay in having to re-start the engine.

Walk-behind mower control system and method


A probe includes an electrical element. The probe has reduced parasitic loading. A probe assembly with a plurality of probes is also disclosed.

The evaluation and debugging of high-speed digital circuits and systems often requires measurement and display of signal waveforms. Often, these measurements are made using test equipment such as a logic analyzer, an oscilloscope, or a spectrum analyzer. A portion of a signal from the circuit or system under test (often referred to as the target) is provided to the test equipment via a probe.
There are important considerations when designing a probe. For example, it is desirable for the probe to provide an accurate representation of the target signal to the test equipment. Moreover, it is desirable for the probe not to impact the target signal significantly.
The accuracy of the probe measurement is impacted by a number of factors. One factor is the inductive loading of the probe. Because inductance increases with signal frequency, at high frequencies a probe can have a high impedance. While a high probe impedance has minimal impact on the signal traveling along a target transmission line (target signal) and thus is substantially non-intrusive, there may not be sufficient signal power provided from the target to the test equipment for reliable analysis.
Another factor that can influence the accuracy of the probe measurement is capacitive loading by the probe. The capacitive loading of the target signal by the probe can cause deterioration of the target signal. For example, capacitive loading can decrease the rise time, the fall time, and the bandwidth of the target signal. Thus, the measured signal may not be an accurate representation of the target signal.
There is a need for a signal probe and probe assembly that overcomes at least the shortcomings described above.


Herein provided is a method and system for directional enhancement of a microphone array comprising at least two microphones by analysis of the phase angle of the coherence between at least two microphones. The method can further include communicating directional data with the microphone signal to a secondary device, and adjusting at least one parameter of the device in view of the directional data. Other embodiments are disclosed.

Increasing the signal to noise ratio (SNR) of audio systems is generally motivating by a desire to increase the speech intelligibility in a noisy environment, for purposes of voice communications and machine-control via automatic speech recognition.
A common system to increase SNR is using directional enhancement systems, such as the "beam-forming" systems. Beamforming or "spatial filtering" is a signal processing technique used in sensor arrays for directional signal transmission or reception. This is achieved by combining elements in a phased array in such a way that signals at particular angles experience constructive interference while others experience destructive interference.
The improvement compared with omnidirectional reception is known as the receive gain. For beamforming applications with multiple microphones, the receive gain, measured as an improvement in SNR, is about 3 dB for every additional microphone, i.e. 3 dB improvement for 2 microphones, 6 dB for 3 microphones etc. This improvement occurs only at sound frequencies where the wavelength is above the spacing of the microphones.
The beamforming approaches are directed to arrays where the microphones are spaced wide with respect to one another. There is also a need for a method and device for directional enhancement of sound using small microphone arrays.

Method and system for directional enhancement of sound using small microphone arrays


An assembly line system comprises a plurality of cassette-type tooling elements and a plurality of moveable base modules. The tooling elements and the base modules have complementary mounting structures for supporting detachable mounting of the tooling elements onto the base modules. A driving system drives each base module to a respective first position within a product assembly area for the assembling a first product, and drives each base module to a respective second position within the product assembly area for assembling a second product. When the first product is dimensionally different than the second product, the respective first position is different than the respective second position for at least one of the plurality of base modules.

An assembly line is a manufacturing process in which parts are added to a product in a sequential manner to create a finished product much faster than is possible using handcrafting-type methods. The automotive industry is one example of an industry that utilizes assembly line manufacturing processes. Briefly, different manufacturing steps are performed repeatedly at various stations, which typically are arranged along main assembly lines and sub-assembly lines. By way of a specific and non-limiting example, truck frame front modules and rear modules are assembled at respective stations of sub-assembly lines, and are assembled together subsequently at a marriage station of the main assembly line. Efficiency is achieved in an assembly line manufacturing process due to the division of labor and specialization that results from individuals performing the same task over and over, and due to the fact that many different steps of the assembly process can be performed simultaneously at different stations along the assembly line.
Today, industrial robots perform many of the tasks at the different stations of an assembly line manufacturing process, such as for instance welding, riveting, bolting, painting etc. In a typical automobile assembly line, each station is based on a dedicated tool including a base that is mounted to the floor. A plurality of tooling elements is mounted to the base, providing a predetermined arrangement of tooling elements for performing predetermined assembly steps of the assembly of a predetermined product. These bases have standard heights, widths, and mounting patterns and can be removed and replaced by other bases, having different tooling elements mounted thereto, when it is necessary to retool the assembly line in order to make a different product. Continuing with the truck frame assembly example, the tooling elements that are mounted to the base module may include fixtures for holding the individual frame components in a secure fashion while robots fasten the frame components together, such as by welding.
Of course, an assembly line is most efficient when it is used to produce only one type of product. In that case, every product that comes off the assembly line is identical, and there is no need to change the arrangement of the tooling elements that are employed in the assembly line. Accordingly, the amount of downtime of the assembly line is minimized.
Unfortunately, vehicle purchasers have varying requirements and preferences, and therefore it is not desirable for a manufacturer to offer just one type of vehicle. For instance, the Ford Motor Company offers a number of different truck families, including the F-150, F-250, F-350, F-450, and F-550. Within each family, a number of different length variants are also available, such as for instance the F-150 regular cab with a 6.5′ box, the F-150 regular cab with an 8′ box, the F-150 super cab with a 6.5′ box, the F-150 super cab with an 8′ box and the F-150 super crew. It would be impractical to build and operate a different assembly line facility for manufacturing each one of the above-mentioned truck variants. Rather, in view of the high capital costs that are associated with modern automotive assembly line facilities, it is necessary to use the same assembly line for manufacturing a plurality of length variations within a family of vehicles, or even for manufacturing entirely different families of vehicles.
Clearly, a problem may arise when the decision is made to stop production of one product, such as for instance the F-150 regular cab with a 6.5′ box, and begin production of a different product, such as for instance the F-150 regular cab with an 8′ box. In this specific and non-limiting example, the different length of the longitudinal frame rails and/or the different spacing between cross members in the two types of truck frames necessitates a different mounting arrangement of the tooling elements on the base modules. Further, different types of truck frames may require different processes, for instance joining by welding instead of, or in addition to, riveting.
Since the stations of a typical assembly line are based on dedicated tools, in order to assemble a different product it is necessary to remove and replace the bases and associated tooling elements of the assembly line with different bases having different associated tooling elements. Unfortunately, the process of switching the dedicated tools is currently done manually and results in substantial downtime, ranging from between typically half an hour to half a day, depending on the nature of the differences between the current product and the next product.
Prior attempts have been made to mitigate some of the problems that are encountered when assembly line production is switched from one product to another. For instance, in order to accommodate different vehicle frame lengths it is known to put part of a dedicated tool on pneumatically driven sliders, which are mounted onto a base. According to this approach, a fixed tool is provided with a limited amount of variability for accommodating different rear frame modules. When production is switched from one product to another, the sliders are driven to a predetermined location that depends upon the length of the new product. Unfortunately, idle stations are required when this solution is implemented since the sliders can be used to adapt the tool to accommodate only a limited amount of length variation.
It would be desirable to provide a method and a system that overcome at least some of the above-mentioned limitations of the prior art.


An exemplary method includes 1) retrieving a set of presentation elements from a remote server, the set of presentation elements including a graphical element, 2) retrieving metadata from the remote server, the metadata associated with the graphical element and including information specifying coordinates at which the graphical element is to be displayed and a distance for the graphical element to cover within a graphical user interface, 3) using the metadata to determine a distance to stretch the graphical element within the graphical user interface, 4) stretching the graphical element the determined distance starting from the specified coordinates, and 5) including the stretched graphical element within the graphical user interface. Corresponding methods and systems are also disclosed.

Graphical elements such as images and other items may be rendered in a graphical user interface (GUI) through a content processing device such as a set top box (STB). However, STBs generally include limited amounts of memory, storage, and processing power. Further, graphical elements are generally delivered to a content processing device through network connections that provide limited bandwidth. Requiring an application to repeatedly retrieve large amounts of data is often inefficient, providing poor user response times, among other problems. Because many content processing devices, e.g., STBS, have minimal memory resources, they have difficulty efficiently and in a user-friendly manner supporting applications with numerous resource-consuming graphical elements.

This patent is subject to a terminal disclaimer.

Flexible rendering of user interface elements


A pot for catching crabs or fish has a lockable door adapted for unloading crabs or fish from the pot and a locking mechanism operable for locking and unlocking the door. The crab or fish pot has a frame structure defining a shape of the pot; a number of mesh panels attached to the frame structure; and at least one entrance for crabs or fish to enter the pot.

Pots or traps for fish such as cod, or large crabs such as king crabs, are often large rectangular rigid frame structures. These pot structures typically have dimensions of about 2.1 m×2.4 m×0.86 m (about 7.0′×8.0′×34″) and have a weight of about 400 kg (about 880 lb). The outer frame structure is normally made of carbon steel which enables the pot to be heavy enough to sink to the bottom of the sea floor for fishing, as well as providing a strong enough structure to be able to hold the crabs and cod. When the pot is recovered from the sea floor after fishing and is filled with crabs or cod, the pot may weigh up to 500-1.000 kg (about 1100-2200 lb). Fishing for cod or large crabs such as king crabs take place in arctic environments as e.g. in Alaska, the Bering sea, the Barents Sea and northern part of Norway. The weather conditions may be hard and difficult with snow, icing conditions on the fishing vessel, strong winds and tough waves. The working conditions for the crew on deck may be very difficult and dangerous. The deck crew wear protective and warm garments including thick and warm glows. The pots are heavy to handle when they come on board after recovery from the sea floor. In order to be able to remove the crabs or fish from the pot after recovery of the pot, the pot is provided with a door on the side of the pot. The door is secured by using a rope and manually tying the rope to secure the door and untying the rope when the door is to be opened for emptying the pot for crabs or fish. A door secured with a rope is difficult and sometimes impossible to manually handle both when closing the door before launching the pot overboard and when opening the door for removal of crabs or fish after recovery from the sea floor.


A method of establishing a representation of an abstract network security policy is disclosed. The representation is established in the form of a decision tree that is constructed by assembling graphical symbols representing policy actions and policy conditions. A user modifies properties of the graphical symbols to create a logical representation of the policy. Concurrently, the logical representation is transformed into a textual script that represents the policy, and the script is displayed as the user works with the logical representation. When the policy representation is saved, the script is translated into machine instructions that govern the operation of a network gateway or firewall. The policy representation is named. The policy representation may be applied to other network devices or objects by moving an icon identifying the representation over an icon representing the network device. Policies, network objects, and network services are stored in the form of trees.

The present invention generally relates to managing data communication policies for network devices. The present invention relates more specifically to graphical management of data communication policies in a network management system.
Administrators of computer networks generally think of network security in terms of abstract security policies. The administrators design the security policies to protect their organization""s information resources against threats that may compromise the confidentiality, integrity, or availability of sensitive data. However, the way that people conceptualize security policies does not match the way that they must implement them using conventional, rule-based security policy models.
A computer network generally includes a number of devices, including switches and routers, connected so as to allow communication among the devices. The devices are often categorized into two classes: end stations such as work stations, desktop PCs, printers, servers, hosts, fax machines, and devices that primarily supply or consume information; and network devices such as switches and routers that primarily forward information between the other devices. In this context, the term xe2x80x9cadministratorsxe2x80x9d refers to the people who are in charge of interpreting an organization""s security policy as it applies to network usage. They are also responsible for writing and applying the security policy. The term xe2x80x9cusersxe2x80x9d refers to people working in the same organization as the administrators and who depend on the network to perform their jobs.
A network security policy defines rules for allowing or disallowing a specific type of network traffic by a specific user or group of users, or a specific end station or group of end stations, under specific conditions. Its purpose is to protect the organization""s information resources based on expectations of proper computer and network use. To adequately protect an organization""s information assets, an administrator must develop a comprehensive set of security policies that covers all types of network traffic for each user or object at the organization under each set of operational conditions.
The network devices enforce the security policies. The functions of network devices such as switches and routers include receiving packets of data, and determining whether to forward each packet to another device or location, or to refuse to forward a packet. The particular way that these functions operate is determined, in part, by control instructions stored in the network device.
Currently, security policies are generally prepared using an ordered list of rules. In past approaches, the network devices are designed to interact with operating systems having text-based, command-line interfaces. Because of these interfaces, administrators had to learn the command sets that controlled how the devices operated. The command sets were, and still are, cryptic and difficult to use. The command sets differ from one network device vendor to the next. Moreover, the relationship between different lines of a command set may cause problems; a previous rule may affect the execution of all later rules, or even prevent their use. These inter-relationships are difficult to remember or track.
For example, a router is programmed using a set of router rules that determine whether the router should forward or reject packets based upon the type of packet, originating network location, destination location, and other criteria. The following example presents a rule set used to program a router to allow traffic across it for an anonymous file transfer protocol (FTP) server that resides on a network object having an Internet Protocol (IP) address of 22.214.171.124:
recv/syn/dstport=ftp/dstaddr=22.214.171.124
!recv/syn/dstport=ftp
syn/dstport=1024-65535
This xe2x80x9crouter-based rule setxe2x80x9d approach suffers from the significant drawback that a collection of router rules rapidly becomes complex, difficult to understand, and hard to maintain. Sets of router rules resemble computer programs written in procedural programming languages. The rule sets can be difficult to manage or decipher regardless of the administrator""s level of expertise.
Indeed, one problem of the router rule-based approach is that it is too much like computer programming. There is exploding demand to construct and connect to networks, and such demand far exceeds the available supply of human networking experts who are familiar with router-based rule sets, or with command-line operating systems. Presently, human network administrators are not generally trained in computer programming. Thus, there is a need for a way to instruct a router in how to handle data passed through the router, without requiring a network administrator to know or understand a complex computer language.
Another type of network device is called a firewall. One type of firewall is known as a packet filter. Because packet filters perform functions very similar to the functions of routers, router-based command sets were used to develop the first generation of packet filtering firewalls. These command sets required that each network object protected by the firewall have an individual rule associated with it for each network service to which that network object was allowed access. In this context, a network object is any addressable entity in the network, such as an end station, subnet, or router.
Eventually, when other firewall mechanisms such as proxy services, dynamic packet filters, and circuit-level firewalls were developed, their designs incorporated similar router-based rule sets. Because these new architectures introduced additional security features and options, the command sets grew more complicated and became network-service specific. The following example is typical of a set of rules required to provide hosts having IP addresses of 192.10.1.* with access to FTP:
ftp-gw: denial-msg /usr/local/etc/ftp-deny.txt
ftp-gw: welcome-msg /usr/local/etc/ftp-welcome.txt
ftp-gw: help-msg /usr/local/etc/ftp-help.txt
ftp-gw: timeout 7200
ftp-gw: permit-hosts 192.10.1.* -log (retr stor)
Clearly, there is a need for mechanisms and methods to control network devices such as firewalls without the use of arcane, command-based router rule sets.
Some makers of firewalls have responded to the foregoing problems by providing firewall programming interfaces that have icons and property sheets. Each icon represents a specific rule type, such as the xe2x80x9cftp-gwxe2x80x9d rule in the example above. The property sheets organize the various options for a specific rule type, allowing the administrator to specify the settings for a particular instance of a rule. The icons are intended to make the command-line policy lists more xe2x80x9cuser friendly.xe2x80x9d
However, the icon interface approach does not deal with a number of fundamental problems of command-line rule lists. For example, the administrator must still program using vendor-specific command sets to set up each icon. The administrator is required to have knowledge of low-level network protocol elements and their relationship. Further, the administrator is required to have knowledge about each network object to which the administrator wants to apply a security policy.
In addition, there are several problems associated with managing and maintaining the representations of security policies generated by use of the icon interface. The representations are difficult to conceptualize and relate to an abstract security policy. It is difficult to verify that security policies are applied correctly and consistently to all network objects. It is difficult to define exceptions and changes to security policies. The past approaches do not generally distinguish between users and network objects, and do not permit security policies to be ported to other locations.
The past approaches also have the disadvantage of carrying out sequential processing that is associated with the ordered lists of rules that underlie the representation of a policy.
Another approach, used in prior network devices called firewalls, relies on database tables that describe how to handle data packets arriving from particular locations or services. The firewalls are instructed by preparing a set of instructions derived from the rows, columns, and logical relationships of the tables. Generally, the table-based languages are arcane and hard to use.
The cryptic command sets and low-level knowledge about networks and network protocols required to program rule-based security policies are complicated for administrators to learn. In developing and deploying rule-based security policies, administrators are often required to gain specific knowledge about how the security policies protect their specific networks. This network-specific knowledge about how security policies are deployed makes it difficult for administrators of complex networks to assign seemingly trivial tasks to less experienced staff, such as xe2x80x9cGo turn off the access to our FTP servers by the marketing department.xe2x80x9d While this added burden does create job security, it also undesirably drives up the cost of experienced network administrators.
Management of a large, complicated network made up of diverse devices is made easier by mechanisms that allow information about all policies for devices in the network to be viewed at a graphical workstation. It is highly desirable to obtain this information in an automated way at a workstation that uses a standard graphical user interface, without requiring a network administrator to know the icons or rules.
Network management systems address this general need. To monitor the status of a device in the network, a network management station transmits a message requesting information to a software program or agent running on the target device. In response, the agent sends a message back to the network management station. The communications are carried out according to an agreed-upon protocol, such as the Simple Network Management Protocol (SNMP). The communications can be done over the network (xe2x80x9cin-bandxe2x80x9d) or by directly contacting a device through means separate from the network in which the device is used (xe2x80x9cout of bandxe2x80x9d). In some configurations, the management station sends a request for information to a proxy rather than the actual device; the proxy then interacts with the device to decide what the response should be, and replies to the management station.
One approach is to provide a network management system that presents a graphical view of the arrangement and interconnections of network devices on the screen of a workstation. The network is represented as a set of miniature icons, each of which represents a network device, interconnected by lines that represent electrical connections. An example of such a system is the Cisco Works for Switched Internetworks (CWSI) product available from Cisco Systems, Inc., of Santa Clara, Calif. However, the geographic scope of a network can present other difficulties in using this type of network management tool. A network can connect multiple buildings of an office campus, or multiple facilities in different cities. Networks of this type often have thousands of devices. As a result, it is impractical to view a graphical representation of the entire network. Therefore, it is desirable to establish groups of devices in the network and to provide a view of only devices that are in each group.
Thus, there is a need for a method or mechanism to construct a network security policy without the use of a list of rules. In particular, there is a need for a way to construct a network security policy that is easily understood by a network administrator, that avoids the use of router-based rule sets, and in which an abstract security policy is easily correlated with a representation of the policy.
Further, there is a need for a way to create and manage network security policies having an improved graphical user interface.
There is also a need for a way to create and manage network security policies in a device-independent manner, so that the same creation mechanism can be used in connection with a network device made by any vendor.
There is also a need for a way to construct a representation of a network security policy in which the representation is easily correlated with the policy. There is a particular need for such a mechanism that does not require the administrator to have knowledge about low-level network protocol details and about the particular network protocols that are used by application programs.
Further, there is a need for a security policy management mechanism in which a policy can be defined once and applied to numerous network devices or objects. There is a particular need for such a mechanism in which policies can be ported from one network to another.
There is also a need for a mechanism in which changes or error corrections to one policy are automatically propagated to other instances of the policy and to all network objects to which the policy has been applied.
There is also a need for a policy management mechanism that can distinguish between users and network objects when policies are created and applied.
The foregoing needs, and other needs and objects that will become apparent from this document, are realized in the present invention, which comprises, in one aspect, a method of establishing a representation of a network security policy. The representation is established in the form of a decision tree that is constructed by assembling graphical symbols representing policy actions and policy conditions. A user modifies properties of the graphical symbols to create a logical representation of the policy. Concurrently, the logical representation is transformed into a textual script that represents the policy, and the script is displayed as the user works with the logical representation. When the policy representation is saved, the script is translated into machine instructions that govern the operation of a network gateway or firewall. The policy representation is named. The policy representation may be applied to other network devices or objects by moving an icon identifying the representation over an icon representing the network device. Policies, network objects, and network services are stored in the form of trees.
According to one aspect, the invention provides a method for controlling a network device that passes or rejects information messages, the method comprising the computer-implemented steps of defining a set of symbols that identify logical operations that can be carried out by the network device; defining an information communication policy for the network device by graphically interconnecting one or more of the symbols into a symbolic representation of the policy; and generating a set of instructions based on the symbolic representation of the policy, wherein the set of instructions causes the network device to selectively pass or reject messages according to the policy.
One feature of this aspect is that the step of defining the set of symbols includes the steps of displaying the set of symbols in a window of a user interface; receiving user input from a user input device coupled to the user interface, in which the user input defines how to manipulate the symbols to create the symbolic representation of the policy. Another feature is that the step of defining the information communication policy includes the steps of receiving editing commands for re-configuring the symbolic representation; re-configuring the one or more symbols into a revised symbolic representation of the policy based on the editing commands; and displaying the revised symbolic representation on the user interface. In a related feature, the step of re-configuring the one or more symbols includes the steps of automatically validating the editing commands according to one or more syntactic rules and based on the context of the editing commands.
In another feature, the step of generating the set of instructions comprises the steps of dynamically updating the set of instructions as the information communication policy is defined. A related feature is that the step of generating the set of instructions comprises the steps of dynamically updating the set of instructions as the symbolic representation is re-configured. Another related feature is that the step of generating the set of instructions comprises the steps of generating a source script that defines the policy in a scripting language; and displaying the source script in a window of the user interface.
According to another feature, the method further involves the steps of, after re-configuring the one or more symbols, highlighting a corresponding portion of the source script that is displayed in the window when one of the one or more symbols is selected by the user. A related feature further involves the steps of naming the source script; storing the source script in a database; and displaying, in a second window of the user interface, a list of one or more source scripts that are stored in the database.
According to another feature, the method further includes the steps of storing a decision tree comprising one or more nodes, in which the decision tree represents a logical flow of commands that are to be executed by the network device; and inserting a node into a decision tree, wherein the node is associated with a symbol that is added to the policy.
The invention encompasses other aspects and has many other features that will become apparent in the following description and from the appended claims.

Graphical network security policy management


An electromechanical actuation system for an aircraft passenger suite for allowing passenger-initiated adjustment of a passenger seat and related passenger accoutrements including a suite control unit configured to receive command signals from a user interface, and a first line replacement unit comprising a first integral electronic control unit and a second line replacement unit coupled to the first line replacement, wherein the first electronic control unit controls operation of the first line replacement unit and the second line replacement unit in response to command signals received from the suite control unit.

This application relates to electromechanical actuation systems for aircraft passenger suites, and related methods of operating such systems. In general, the systems and methods relate to passenger-initiated motions to passenger seats, and related comfort accessories and devices, collectively referred to as a passenger "suite". Such suites can be found in super first class sections of commercial transport aircraft, for example.
An electromechanical actuation system disclosed in this application can activate a privacy divider, suite lighting and various seat features, including seat back recline, leg rest extension and retraction, seat pan extension and retraction, seat forward/aft translation, armrest height adjustment, headrest height adjustment and lumbar inflation/deflation elements, principally of the type found in long haul, premium class seating. Each suite can include at least one Electronic Control Unit (ECU) for controlling the movement of the various system actuators and components in response to passenger commands provided through an appropriate user interface. Each ECU can be programmed with software that controls and coordinates the movement of individual actuators and other suite components in order to provide desired adjustments to the passenger's seat or other accoutrements within the associated suite. The software can operate intuitively and selectively actuate appropriate actuators to accomplish passenger intent within geometric constraints, including obstacle detection, for example.
One feature of the invention is that each suite can include at least one Line Replacement Unit ("LRU") having an integral ECU configured and programmed to control operation of other LRUs within the suite. A suite can include various types of LRUs, including but not limited to various electromechanical seat control actuators, suite lighting units, pumps, comfort actuators, vibrators, and the like. As used in this application, a LRU can be any electrical, electromechanical or electronic unit, such as a linear or rotary actuator, a controller, a pump, a light fixture, or the like. A suite's various LRUs can be interconnected in series by an appropriate communication link, commonly referred to as a point to point "daisy chain." One example of a communication link connecting the various LRUs is a CANBUS network, though other suitable communication links can also be used. The ECU of each suite can be integrated into any programmable electrical LRU that communicates and collects data to and from other programmable LRUs, communication boxes such as junction boxes, in-flight entertainment ("IFE") units, and the like. A selected LRU can act as the primary electronic controller for all LRUs within its associated passenger suite. In addition, one or more secondary LRUs can also include ECUs and can be programmed to take on or assume the role of primary controller in the event the original selected LRU malfunctions. This provides a degree of redundancy to the system that permits continued operation between service sites. Each ECU can be connected to a Suite Control Unit ("SCU") for managing operation of all of the LRUs within the ECU's associated suite.
Any secondary LRU within a passenger suite can be provided with an ECU and be programmed to take or assume the role of a primary controller in the event that the original selected LRU malfunctions or is removed from service.
The primary ECU and a plurality of seat LRUs can be associated with respective suites, and can be interconnected in series through a wire harness or a wireless communication system to the suites primary ECU.
The primary suite ECU can be chosen as being any seat device that has the capability of storing data and control/communication software for controlling operation of other peripheral LRUs within a passenger suite. The primary ECU typically includes an electromechanical assembly and an electronic processor, including memory and communication capability. Because of the interconnectivity between multiple LRUs, control of each LRU within a suite can be assigned to any number of LRUs that include programmed ECUs.

Electromechanical actuation system for aircraft passenger suites and method


A method for acquiring information of a battery cell (11) includes a step (S101) of acquiring information pertaining to performance recovery accompanying the suspension of charging/discharging of the battery cell (11). Control pertaining to the battery cell (11) and estimation of a state of the battery cell (11) can be appropriately performed according to a type of battery cell (11).

Conventionally, there is known a technique of suppressing swelling of an energy storage device by compressing the energy storage device (for example, see Patent Document 1). The energy storage apparatus described in Patent Document 1 suppresses the swelling of the energy storage device by compressing the energy storage device from the outside by a compression unit.

Method for acquiring information of energy storage device, method for controlling charging, state estimation method, life estimation method, energy storage system manufacturing method, and energy storage device management apparatus


A microwave circuit having a two-sided substrate on which a microwave lead-through is arranged in the form of a symmetrical lead-through structure, being provided by opposite metallizationless areas on the upperside and the underside of the substrate and comprising a lead-through conductor, coplanar width adaption segments and first and second line segments connected thereto, the ground of said segments comprising opposite metallization parts being inter-connected through via holes. In a sealed microwave circuit a seal lead-through comprises said lead-through structure and a microstrip line segment.

This invention is related to a microwave circuit comprising a two-sided substrate having a lead-through structure for interconnecting a first microstrip conductor segment on the upperside of the substrate with a second microstrip conductor segment on the underside of the substrate. The invention further relates to a sealed design of such a microwave circuit, in which the sealing is obtained by means of a metal lid which is arranged on the substrate. Furthermore the invention is related to a use of such a microwave circuit as a function module unit in a circuit arrangement which is built by modules.
Microwave signals are the designation of electrical signals in the frequency range 0.5-50 GHz. Microwave circuits for handling such microwave signals generally consist of a substrate of an insulating material, commonly aluminum oxide. By sputtering followed by plating of a pattern on the substrate transmission conductors, resistors and optionally capacitors may be built. Remaining components are soldered or glued onto the substrate.
A general problem in microwave circuits of the type in question is that the high signal frequencies involved demand electrical matching at existing interfaces in the circuit, meaning that channels in which signals are transmitted and meeting each other at said interfaces shall have identical impedances, customarily 50 Ohm. For example, interfaces of this kind appear between inherent circuit elements and between different conductor sections. Impedance differences at said interfaces give rise to partial reflection of the signal and a consequent loss of power. The loss of power increases with an increasing frequency. The signal power is expensive at the high frequency levels involved, specifically in applications requiring a high output power level. From this it follows that the quality demands on matching are very high.
The provision of good matching at all interfaces in a microwave circuit means very often that difficult problems must be solved by the circuit design. Specifically, this problem is prominent when using a two-sided substrate in which the signal path for external connection of the circuit includes a metal plated hole, a so called through-hole, passing the substrate and interconnecting microwave components on the upperside of the substrate with an external connection terminal on the underside of the substrate. Said through-hole introduces discontinuities in the impedance level of the signal path. The through-hole shows an increased characteristic impedance due to the fact that an adjoining groundplane is missing. This part of the transmission line corresponds to an inductive series connected element. Furthermore, the conductors which are connected to said hole cross over a groundplane free area immediately adjoining the through-hole, said conductors introducing further inductive series elements.
Prior art in this field teaches the introduction of a compensating capacitive parallel element adequately positioned along the transmission line in the neighborhood of said hole by decreasing the distance between conductor and ground, widening of the microstrip conductor over a short distance, or a parallel connection of a distributed or a concentrated capacitive element of adequate design.
This compensation technology means a consequent introduction of a lowpass filter structure having an upper frequency limit restricting the usefulness of the lead-through.
One example of this prior art in a microwave circuit of the kind mentioned in the introduction has been disclosed in U.S. Pat. No. 4,626,805.
The disclosed microwave circuit (24) comprises a two-sided substrate (26), carrying on the upperside the microwave components of the microwave circuit and the transmission line for interconnecting the same and external connection of the microwave circuit, the underside being provided with a ground plane, coplanar conductors and external connection terminals. The external connection is provided by means of a through-hole (40) in said substrate which interconnects the transmission line (36) with said coplanar transmission line (30). The external connection terminals have connection pins (19), normally provided by means of a so called lead-frame, being soldered to the underside of the substrate onto its groundplane. By means of a metal lid (25) the microwave circuit (24) may be sealed hermetically and shielded. The microwave circuit is intended for surface mounting on an underlying circuit board (10) which is provided with a transmission line (16) of a width which is adapted to said connecting pins as well as coplanar ground terminals combined therewith.
The circuit thus described shows the problems which have been indicated above because an inductive discontinuity is introduced by said through-hole due to the fact that said through-hole lacks a capacitive coupling to adjoining ground conductors/ground plane. Between the metallization around said through-hole and the adjoining ground plane on the underside of the circuit the ground plane a free area or gap (G) appears, being traversed by the transmission lines connected to said through-hole on the upperside and the underside of the substrate. The transmission line parts which are situated directly above said gap as well as said through-hole form inductive series elements in the transmission between upperside and underside. These inductive elements are compensated by empirically dimensioning the size of the gap on the underside, providing thereby an additional capacitance. Thereby a correction of the characteristic impedance is obtained within a limited frequency range.
One further embodiment has been disclosed in which a corresponding additional inductance is provided by said respective transmission lines, the same being compensated for by the additional capacitance of said gap as well as a widened segment of the upperside transmission line. The disclosed circuit designs are useful for frequencies up to 20 GHz and provide for acceptable power losses within this frequency range. For frequencies above 20 GHz the losses increase rapidly making thereby the circuit practically useless.
SE-9303142-5, which is owned by the Applicant, discloses one further example of this prior art. The microwave circuit disclosed therein comprises a conductor (10) on the upperside of the substrate, traversing a groundplane-less area around the metallization of the through-hole (7) on the underside of the substrate, introducing thereby an additional inductive impedance in correspondence with the circuit according to U.S. Pat. No. 4,626,805, which has been disclosed above. In this case, the compensation is obtained by means of a so called matching pattern which is connected to the groundplane and which is provided on the upperside primarily at said groundplane-less segment of the conductor adjoining the through-hole. By an adequate dimensioning of the gap between said matching pattern and the conductor a compensating additional capacitive impedance is obtained. This solution has the advantage of introducing said compensation at the mismatch source, that is at said segment of the conductor, which allows for a circuit which is useful for frequencies up to at least 26 GHz.
Another example of this prior art has been disclosed in U.S. Pat. No. 5,057,798, disclosing a transmission line from upperside to underside of a substrate, comprising a through-hole and waveguides connected thereto. Compensation means are provided in order to obtain an additional capacitance compensating the additional inductance of the through-hole. Two embodiments have been disclosed, firstly ground from a plurality of nearby through-holes (via-openings) to form a "coaxial structure", secondly, when microstrip waveguides are used, a specifically adapted design of the microstrip line end. The disclosed transmission line design is used for saving substrate area by arranging desirable parts of the transmission line on the underside of the substrate. The transmission line has the disadvantages which have been indicated above because the same include specifically designed compensating means.
Microwave circuits of the actual type as well have to fulfill the requirement of being useful within a wide frequency range, for example from 2 GHz up to 26 GHz, maintaining substantially identical performance in respect of power losses and stable signal level within the complete frequency range. The use of compensating elements according to prior art, contradicts the requirement on a wide frequency range because the undesirable, parasitic additional impedances will vary with the signal frequency in the same way as the additional impedances which are introduced by means of compensating measures, from which follows that the compensation will be optimized within limited frequency intervals.

Microwave circuit, capped microwave circuit and use thereof in a circuit arrangement


A computing device receives information from one or more agents, wherein the one or more agents monitor one or more resources in a cloud network. The computing device determines that the configuration of the one or more agents monitoring the one or more resources needs to be changed based on at least the information received from the one or more agents. The computing device changes the configuration of the one or more agents monitoring the one or more resources based on at least the information received from the one or more agents.

Cloud environments today are large and diverse, comprising many types of resources, e.g., servers, virtual servers, switches, storage, routers, etc. These resources need to be monitored and managed effectively. To that end, optimal placement, removal, and configuration of monitoring agents is crucial to proper maintenance and upkeep of resources within a cloud network. Monitoring agents are in widespread use to monitor infrastructure, software, packaged applications, etc., across a network. Typical monitoring agents are not plug-n-play products and in large-scale deployments, configuration and manageability of the agent itself becomes very difficult. For example, a large cloud network system may involve a plurality of resources, requiring an administrator with extensive knowledge of agents to manually configure and deploy agents to cloud resources. This strenuous process takes not only copious amounts of time, but also extensive knowledge of monitoring agent behavior, deployment, placement, and configuration based on the needs of those resources and specific capability of agents for the purpose.

Dynamic agent replacement within a cloud network

International Business Machines Corporation


An application implementing a high resolution monotonic system clock is provided. A kernel increments a value called a generation number. The generation number is used to determine what state the high and low resolution time values are in. The kernel next stores a low resolution time value. Then, if a time adjustment is occurring, the kernel updates the high resolution time value by updating the origin date. The kernel then increments the generation number a second time. The providing application receives a request for time from another application. The providing application determines a first value for the generation number and compares a low resolution time value and high resolution time value and determines the maximum value of the two. The providing application then gets a second value for the generation number and compares the second value of the generation number to the first value of the generation number. If the two values of the generation number are the same, the providing application returns the maximum value to the requesting application.

1. Field of the Invention
The present invention relates in general to a data processing system and, in particular, to a method, system, and computer program product for implementing a high resolution monotonic system clock.
2. Description of the Related Art
On computing systems with a high resolution time of day clock that is routinely adjusted to synchronize system time with a network standard time, applications can observe that time has moved backwards. This happens typically as a result of the normal operation of the network time protocol. On many computer systems, such as the AIX system, for example, the time adjustment must be made in discrete increments or decrements to a real time clock.
To minimize the visibility of such time corrections, systems generally break the required correction into a larger number of smaller sub-corrections. In this fashion, the time change is performed more gradually, but over a relatively long period of time. For example, on an AIX system, the situation of setting the time of day backwards is handled by setting the time of day back one millisecond every ten milliseconds until the system time has been corrected. For example, a two millisecond correction applied in this fashion becomes a discrete 1 millisecond correction performed at the next regularly scheduled timer tick, which occurs every ten milliseconds. Then, ten milliseconds after the first correction was made, at the time of the next timer tick, the second one millisecond correction is applied and the total correction is complete.
On systems without a high resolution clock, the time correction does not cause a problem. Such systems rely on being able to have regularly scheduled timer ticks, such as at ten millisecond intervals, and keep track of the time of day by simply adding ten milliseconds to a global time value at each tick. When time is being adjusted backwards, systems such as these simply add nine milliseconds to the global value at each tick until a total backwards time correction has been applied. Any program that references such a system timer can never observe time going backwards. It can only observe time going forward, albeit at varying rates, including standing still.
Once, however, a high resolution hardware clock is added, such as the timebase register on POWER/PC systems, for example, any program that observes the current time more frequently than every millisecond can easily observe when time has been adjusted backwards. Unfortunately, observing this occurrence frequently causes programs to fail.
One solution to this problem would be to provide a low resolution time value optionally to any application that requests it. The application will not see time going backwards anymore, but it will see time standing still for ten milliseconds at a time, and then jumping forward. This solution is not always practical.
Another solution is to arithmetically adjust the high resolution time value through an additional software layer which could accurately prorate the correction over an interval before the discrete correction is made to the hardware clock. However, there are numerous implementation difficulties with this solution, including the processing time necessary to do the sixty-four bit divides and multiplies that this requires, which are expensive operations when emulated on thirty-two bit hardware.

Implementing a high resolution monotonic system clock


A circuit board assembly system for manufacturing a prototype printed circuit board having a matrix formed in it. A base board having a connection matrix that matches the matrix of the printed circuit board is hinged to a frame having tracks for receiving the printed circuit board, so that the printed circuit board is locatable in a fixed position in relation to the printed circuit board with their respective matrices matching. Component leads may be inserted into the connection matrix through the printed circuit board to form a circuit, which may be tested. The base board may be pivoted away from the printed circuit board to allow the leads to be soldered. The printed circuit board may then be removed from the base board. A cover that is latchable onto the printed circuit board may be used to prevent components from being accidentally removed from the printed circuit board.

A printed circuit board is formed from a thin board of electrically non-conducting material in which is formed a partly connected and partly disconnected network or matrix of electrically conducting elements. To make a particular circuit on a printed circuit board, components must be placed on the board with electrical connections between them being made by the matrix. However, many electrical circuits are quite complex and require much testing and moving around of the circuit components. This means that the circuit board on which the original circuit is placed should allow the leads to be easily removed from the board and re-inserted into the board, while making good electrical connections when inserted into the board. For this reason, a breadboard is often used to prepare the initial circuit. The breadboard has a particular matrix of electrically connecting elements and this matrix is used to connect the components. Once the prototype circuit is made and proven to be functional, it must be converted to a prototype printed circuit board. This is accomplished largely as follows.
1. The layout of the circuit is copied onto paper. PA1 2. An experimenter's board of a suitable size is obtained. This board will have its own matrix of electrical connections that will not necessarily match the breadboard matrix. PA1 3. The circuit layout from the breadboard matrix is converted to a matrix suitable for the type of experimenter's board being used. PA1 4. All components are removed from the breadboard and placed on the experimenter's board according to the layout developed in step 3. PA1 5. All components and jumper wires are soldered in place on the experimenter's board, and traces cut.
At this stage a hard wired prototype now exists, and is ready to be tested. However due to the complexity of this process there is considerable room for errors to be made and it is typical that even an experienced technician will expect to have to spend substantial additional time retracing and debugging the board.

Apparatus and method for manufacturing printed circuit boards


A method, system, and program product for enabling administrative recovery of a user's lost/forgotten boot-up passwords without compromising the administrative/master password(s). A restricted-use password is dynamically generated from a first hash of a random number generated on a client system and a secret retrieved from a secure device associated with the client system. The restricted-use password operates as a master password but is not the administrative password of the client system. Once the password is generated, it is provided to the user/client system to enable user access to said client system and hardfile and reset of the user passwords.

1. Technical Field
The present invention relates generally to computer systems and more specifically to password security features of computer systems. Still more particularly, the present invention relates to enabling secure access to computer systems when power-up passwords are lost or forgotten.
2. Description of the Related Art
Computer systems that are operated within an administered network are often provided boot-up security password(s) to prevent access by persons other than the authorized user(s) and/or the administrator. The user-password is typically selected by the user during system setup, and this user-password is stored within a non-volatile memory component of the computer system. Entry of the user-password is required for the boot process initiated by the basic input/output system (BIOS) once the computer system has been powered-on or awakened from hibernation.
With traditional computer systems, passwords were typically stored in battery-backed CMOS RAM. Before users were allowed to access the computer system, they were required to enter a password. When a password is entered, the computer's boot-up routine compares the entered password to the password stored in CMOS RAM and if the two passwords matched, the user is allowed access to the computer system.
Limitations exist in the use of CMOS RAM to store passwords. For example, if a computer system is stolen, the security afforded by passwords stored in battery-backed CMOS RAM may be bypassed. An unauthorized user may open the box and remove the CMOS RAM battery in order to gain access to the system. When the CMOS RAM battery is removed, the storage area of the password is cleared (wiped out). Then, when the CMOS RAM battery is reinstalled, the system powers-up without a password, allowing an unauthorized user to access the computer system.
Thus, to avoid such breaches in security passwords, conventional computer systems are designed with the passwords stored in non-volatile memory. When stored in non-volatile memory, the password cannot be bypassed by removing the CMOS RAM battery. However, even this method has built-in limitations, as there is no way for legitimate users, who loses/forgets his/her password to access the computer system without using the administrative password. Occasionally, with both small and large networks, the administrator is unavailable at the time the user requires assistance with accessing the computer. Also, it is quire common for the administrator to have to provide the user with the administrative password to enable the user to override the request for the user password. This reduces or eliminates the efficiency of the administrator password.
In some network computer systems associated with a network/corporate framework that prevents unauthorized users from accessing certain local system and network features of the computer, administrative security features are placed on the machine by a system administrator. The administrator configures the computer system with a master/administrative password. The user is then given access to the computer and the opportunity to establish his/her own user password. In some instances, more than one user password is required, (e.g., one to gain access to the computer system and another to gain access to the hard file of the computer system).
Complex passwords are often difficult to remember. Even with simple passwords, however, it is not uncommon for the user to forget his/her boot-up password. Since the computer system cannot be accessed without entry of a correct password, the user is then forced to seek administrative assistance to access the computer system.
For most systems, administrative assistance is provided to the user via a known/available telephone number of the administration center (server and personnel). In some situations, a help center is provided to assist the user of the computer system with any problems encountered when operating the computer system, including boot-up password assistance.
One of the more common help center (administration) calls is from users who forget their Power on Passwords or hardfile passwords. The most common model for addressing this problem by remote administration, is for an administrator to tells the user over the phone the administrative ("admin") or hardfile master passwords. However, giving the administrative password to each user who calls in breaks the security model for administrative passwords, and thus proves to be ineffective across a network environment. A new administrative password would have to be set each time someone forgets his/her user password.
The present invention realizes that it would be desirable to have a method to securely recover a system without compromising other systems and/or administrative passwords in the network. A method and system that provides legitimate users with access to their computer system if they have forgotten or lost their password without compromising the administrative passwords would be a welcomed improvement. These and other benefits are provided by the disclosed invention.

Method and system for secure, one-time password override during password-protected system boot


A cold cathode field emission device is described. A key feature of its design is that groups of microtips share a single conductive disk with a reliable ballast resistor being interposed between each of these conductive disks and the cathode conductor. Additionally, a resistor, rather than a conductor, is used to connect the gate conductive disk to the gate electrode. The latter is arranged so as not to overlap with the cathode electrode. The cathode and gate conductive disks ensure that the ballast resistance associated with each microtip is essentially the same.

(1) Field of the Invention
The invention relates to cold cathode field emission devices and displays.
(2) Description of the Prior Art
Cold cathode electron emission devices are based on the phenomenon of high field emission wherein electrons can be emitted into a vacuum from a room temperature source if the local electric field at the surface in question is high enough. The creation of such high local electric fields does not necessarily require the application of very high voltage, provided the emitting surface has a sufficiently small radius of curvature.
The advent of semiconductor integrated circuit technology made possible the development and mass production of arrays of cold cathode emitters of this type. In most cases, cold cathode field emission displays comprise an array of very small conical emitters, each of which is connected to a source of negative voltage via a cathode conductor line or column. Another set of conductive lines (called gate lines) is located a short distance above the cathode lines at an angle (usually 90.degree.) to them, intersecting with them at the locations of the conical emitters or microtips, and connected to a source of relatively positive voltage.
The electrons that are emitted by the cold cathodes accelerate past openings in the gate lines and strike an electroluminescent panel that is located some distance above the gate lines. Thus, one or more microtips serves as a sub-pixel for the total display. The number of sub-pixels that will be combined to constitute a single pixel depends on the resolution of the display and on the operating current that is to be used. In general, even though the local electric field in the immediate vicinity of a microtip is in excess of 1 million volts/cm., the externally applied voltage is under a 100 volts. However, even a relatively low voltage of this order can obviously lead to catastrophic consequences, if short circuited.
The early prior art in this technology used external resistors, placed between the cathode or gate lines and the power supply, as ballast to limit the current in the event of a short circuit occurring somewhere within the display. While this approach protected the power supply, it could not discriminate between individual microtips or groups of microtips on a given cathode or gate line. Thus, in situations where one (or a small number) of the microtips is emitting more than its intended current, no limitation of its individual emission is possible. Such excessive emission can occur as a result of too small a radius of curvature for a particular microtip or the local presence of gas, particularly when a cold system is first turned on. Consequently the more recent art in this technology has taught ways of providing individual ballast resistors, either one per microtip or one per group of microtips.
A good example of the prior art is the approach taken by Meyer (U.S. Pat. No. 5,194,780 March 1993) as illustrated in FIG. 1. This shows, in plan view, a portion of a single cathode column which, instead of being a continuous sheet, has been formed into a mesh of lines 15 intersecting with lines 16. A resistive layer 17 has been interposed between the mesh and the substrate (not shown here). Microtips 12 have been formed on the resistive layer and located within the interstices of the mesh. A single gate line intersects the cathode line/mesh, and current from the mesh must first travel along resistive layer 17 before it reaches the microtips. A disadvantage of this approach is that the presence of the mesh limits the resolution of the display. Another disadvantage is that the ballast resistance value associated with any particular microtip can vary widely because of the geometry of this design.
A cross-sectional view of a somewhat larger portion of a Meyer style display is shown in FIG. 2. Buffer layer 21 sits atop substrate 22. Layer 27 is a resistive layer in which are embedded cathode columns 25. Gate lines 29 are separated from the cathode columns by dielectric layer 28 and are embedded in second resistive layer 23.
More recently, Kochanski (U.S. Pat. No. 5,283,500 Feb. 1, 1994) has described a variety of layout schemes which use a similar approach. Kochanski also teaches a method for ensuring that the ballast resistance associated with each of the various microtips is essentially the same. This is achieved by arranging the microtips in groups that are accessed by a symmetrical pattern of individual resistors, each of the same magnitude. Kochanski also uses a two impedance structure. The first impedance carries all the current associated with one or more intersecting regions. The second impedance is composed of a multiplicity of impedances each of which carries current from one or a few microtips at the given intersecting region(s). It is, however, not necessary to use this kind of two impedance structure.
From a cost standpoint the best design is that of Meyer. However, the problem remains that the value of the ballast resistance associated with any particular microtip can vary substantially from microtip to microtip. Recent studies have shown that the fraction of the microtips that are actually emitting in an arrangement similar to that described by Meyer is fewer than 9% and frequently is as low as 3%. This is believed to be due, at least in part, to this ballast non-uniformity problem. The present invention seeks to provide uniform ballast values while retaining the low cost features of the Meyer approach.
A pending application, ERSO-84-0029, unlike Kochanski's two impedance approach, has already addressed the problem by teaching that all the microtips in a given group are to be connected to an equipotential area which is, in turn, connected to a single ballast resistor. Two such devices are shown in schematic cross-section in FIG. 3. Microtips, such as 12, are in contact with equipotential area (conductive disk) 31 which lies on one end of resistor 32. Cathode columns 33 (running at right angles to the plane of the figure) lie on and connect to the other ends of resistors 32. Resistors, cathode columns, and equipotential areas are all covered by dielectric layer 34. Gate line 35 is deposited on top of layer 34 and openings, such as 36, are formed in it. Note that line 35 is conductive all the way from the openings 36 to the edge of the device. The openings extend through the dielectric layer down to the surface of equipotential area 31. A microtip 12 is centrally located inside each of the openings. A problem with this design is that although higher current densities are achieved because each microtip is associated with a ballast resistor of the same value, there is no resistor between the gate openings and the gate electrodes. Since, in FEDs, the gate current is much less than the cathode current, it is advantageous to have a resistor connected to the gate electrode. Moreover, in the same way that it is necessary that a uniform resistance value be associated with each microtip, it is also necessary that a uniform resistance value be associated with each gate. The present invention is directed towards including this feature in its design.

Industrial Technology Research Institute


An apparatus is provided for auditing protected health information of one or more patients. The apparatus includes at least one memory and at least one processor configured to detect a query to access information stored in a database including patient-related information. The processor is further configured to save the query in an event file. The processor is further configured to capture query-related information associated with the query and save the query-related information in the event file. The processor is further configured to determine that the query involves protected health information. The processor is further configured to transmit, in response to determining that the query involves protected health information, the query-related information to be used in a reporting table. Corresponding computer program products and methods are also provided.

At present, the American Recovery and Reinvestment Act (ARRA) requires health care systems to be able to audit access to protected health information (PHI) of patients. PHI includes any information about the health status, provision of health care, or payment for health care that can be linked to a specific individual. As such, access to protected health information of a patient such as, for example, the patient's name, birthdate, social security number, address, etc. is generally required to be audited or detected per the ARRA.
Current health care applications may include functionality for auditing access to protected health information by that particular health care application. However, the functionality is often closely tied to the application and, therefore, limited to actions taken within or using the corresponding application alone. In this regard, some items of protected health information may not be adequately audited in existing health care systems operating multiple health care applications having varied auditing capabilities.
Additionally, since existing approaches often only audit accessing of protected health information by a particular health care application in which the auditing functionality is embedded, the existing approaches may be unable to detect an instance in which a third party hacks into the health care system and accesses protected health information outside of one of these health care applications. As such, the existing solutions may be unaware that the third party accessed the protected health information.
In view of the foregoing drawbacks, it may be beneficial to provide a more efficient and reliable manner in which to audit access to protected health information.

Methods, apparatuses and computer program products for auditing protected health information


An accounting framework is provided for a communications system having a plurality of service providers, including cellular service providers and/or data network service providers, e.g., Internet service providers. Accounting units containing accounting information are exchanged between service providers to allow the service providers to charge for usage of services. The accounting units have a predetermined format to allow them to be exchanged between different service providers. Each accounting unit includes a plurality of fields, including a service type field, a usage of radio interface field, a usage of a visited or external network field, a usage of mobility management field, a quality of service field, a usage of a packet data protocol field, and other fields. Users may be charged for services based on these fields.

The invention relates to accounting methods and apparatus for communications networks, such as cellular networks and data networks.
With increased availability of data networks, such as the Internet and intranets, nodes coupled to the data networks can more easily communicate with each other. Popular forms of communications across data networks include electronic mail, file transfer, web browsing, and other exchanges of data. With improved network bandwidth, higher quality voice and/or video communications have also become possible.
Although data networks offer access to a wide array of communications options and information sources, such access is typically not available until the user is sitting at a terminal that is coupled to the data network, such as a terminal located in the home, office, or vehicle. To address this, proposals have been made for providing mobile, cellular computers that can connect to the data networks while moving from place to place. One protocol that has been proposed is the Mobile Internet Protocol (MIP), as described in Request for Comments 2002, entitled "IP Mobility Support," dated October 1996, and proposed by a working group within the Internet Engineering Task Force (IETF).
As a mobile node moves from location to location, the points of attachments of the mobile node to a data network may change, which may require a new IP address to be associated with the new point of attachment. A point of attachment may be defined as any wireless link between the mobile node and the data network within a given area. A wireless point of attachment may also be provided by a packet-based cellular system, such as a cellular digital packet data (CDPD) system, a general packet radio service (GPRS) system, an enhanced GPRS (EGPRS) system, an EGPRS Compact system, or other packet-based cellular systems.
The Mobile IP protocol allows the mobile node to use either one of two IP addresses, which include a home address that may be assigned "permanently" to a mobile node and remains unchanged regardless of where the node is attached to the data network. The mobile node may also be assigned a care-of address that changes at each new point of attachment. The care-of address includes the visited network's identity number and thus identifies the mobile node's point of attachment. Whenever the mobile node moves, it registers its new care-of address with its home agent located in its home network. To get a packet to a mobile node from its home network, the home agent delivers the packet from the home network to the care-of address. The home agent is a router on a mobile node's home network that delivers packets to roaming mobile nodes and maintains the current location for each mobile node. In a foreign network, which is any network other then the mobile node's home network, a foreign agent, which is a router on a mobile node's visited network, cooperates with the home agent to complete delivery of packets to the mobile node while it is away from the home network. When a mobile node moves away from its home network, it obtains a care-of address on the foreign network by soliciting or listening for special messages (referred to as agent advertisements).
In a traditional cellular network, a mobile user is typically charged for utilizing wireless services provided by a service provider. Typically, a user subscribes to a home service provider, which may have agreements in place with other service providers to allow the wireless user to roam between networks provided by the several service providers. Various types of accounting and billing mechanisms have been implemented to charge users for usage of services as they move between networks provided by different service providers. For example, an accounting architecture is defined by the CDPD standard, described in the CDPD System Specification, Release 1.1, dated January 1995, from the CDPD Forum, Inc. The CDPD protocol provides access to a packet-based network by providing a packet-based overlay to existing voice cellular systems. CDPD detects gaps between voice communications on cellular channels and directs packets of data to those channels. A service provider bills a subscriber for usage based on several parameters, including data packet counts, source and destination addresses, geographical location of the mobile node, and time of transmission. A primary service provider may have to share revenue collected from a subscriber with other service providers whose networks the subscriber may have used during the billing period.
However, conventional systems such as CDPD systems do not bill specifically for usage of packet-based data networks, such as the Internet or intranets, for various services. Such services may include electronic mail, file transfer, electronic commerce, real-time services (such as voice communications over data networks and multimedia conferencing), and other data network services. Further, a general predetermined format for describing accounting information is not available for different service providers to conveniently exchange accounting information. A need thus exists for a method and apparatus that is capable of charging for services utilized on packet-based data networks and that utilizes a uniform format for accounting information.

Accounting method and apparatus for communications network