A water heater includes one or a plurality of heat pumps that heat tap water or return water from a hot water supply part, a circulation line that supplies hot water heated in the heat pumps to the hot water supply part, and introduces the return water from the hot water supply part to the heat pumps, an incoming water pipe that joins to between the hot water supply part in the circulation line and the heat pumps and supplies the tap water, a circulation pump that returns the return water to the heat pumps and circulates the return water through the circulation line, and a control unit that controls operation or stop of the circulation pump according to driving operation time or elapsed stop time by linking a combustion process of the heat pumps.

1. Field of the Invention
The present invention relates to a water heater in which a circulation line is provided in a water heating part for circulating hot water, and in which operation of a heat pump and a circulation pump is controlled according to temperature of the circulated hot water, elapsed time, etc.
2. Description of the Related Art
Conventionally, there is a water heater in which a pump is individually disposed in a hot water supply pipe and hot water is circulated therein. Thus, hot water of desired temperature is available instantaneously. In a case of such circulation, the pump is turned ON/OFF by a switch including a temperature sensor so as to supply hot water at prescribed setting temperature, for example, the switch is provided with a thermostat or a timer.
A controller for pump control is on the market. This controller detects temperature on a pipe or water temperature in the pipe by, for example, being attached to the pipe and stops combustion in a heat pump.
If the above controller is not disposed in the structure of circulating hot water, the endurance of a water heater may be decreased because, for example, a pump operates continuously.
It is known as such a water heater in which hot water is circulated in a circulation line that a circulation pump and a heater are provided in a circulation line and operation of the circulation pump and the heater is stopped according to the rise in temperature of the circulated hot water (for example, Japanese Laid-open Utility Model Publication No. 63-123915).
It is also known that a sensor detecting the minimum temperature is provided in a circuit and when detected temperature goes down to the freezing temperature, a pump and heating means are operated (for example, Japanese Laid-open Patent Publication No. 63-207948.)
Components other than a heat pump, such as a tank and a temperature detector, or a controller that controls these components are required to be disposed for making an instantaneous water heating unit so that heated hot water is available instantaneously as soon as a hot water supply operation is performed. This disposition complicates the structure of a water heater.
When the outside air is low temperature, hot water is circulated in a circulation line so as not to freeze the circulation line. There is a problem that the structure of a water heater is complicated because individual control means is provided for a planned circulation process.
Concerning such problems, there is no disclosure or suggestion thereof in Japanese Laid-open Utility Model Publication No. 63-123915 and Japanese Laid-open Patent Publication No. 63-207948, and no disclosure or suggestion about the structure etc. for solving them is presented.

Water heater and control method therefor


A routing control system comprising a system controller and master and slave routing servers, wherein the master routing server includes a plurality of logical controllers, each of which performs routing control for each of the user networks, the system controller monitors a load state of the master routing server and migrates at least one of the plurality of logical controllers from the master routing server to the slave routing server when the load state has satisfied a predetermined condition, so that the slave routing server inherits routing control for a particular user network associated with the migrated logical controller.

(1) Field of the Invention
The present invention relates to a routing control system and, more particularly, to a routing control system that is suitable for a Layer 3 Virtual Private Network (L3VPN) accommodating a plurality of customer or user networks.
(2) Description of Related Art
An IP network system is composed of a plurality of communication nodes such as routers and switches. Each communication node is provided with a packet transport function unit for switching packets among a plurality of line interfaces and a control function unit connected to the packet transport function unit. Each communication node updates its route information table maintained thereon by communicating route information with the other communication nodes, using a distributive routing protocol such as OSPF (Open Shortest Path First), BGP (Broader Gateway Protocol), or the like.
For a network system in which a distributive routing protocol is applied, the reliability of the control function unit of each communication node influences the stability of the entire network. For example, if a malfunction occurs in one of the communication nodes due to a coding error in a control program or a shortage of memory capacity, this malfunction has an impact on routing control across the entire network system and may give rise to disrupted communication on a particular route according to circumstances.
For such a distributive routing based network, a network control scheme called C/U (Control plane/User plane) separation is under study. This network control scheme separates the routing function from the IP packet transport function of routers in an IP network. An example of the C/U separation scheme is provision of a server called a route server for intensively handling route control in the IP network. The route server collectively calculates route information for every communication node in the network when a link status changes in the IP network and distributes optimum route information to each communication node. According to this control scheme, it is possible to reduce the necessary time for route optimization, by notifying link status changes from each node to the route server so that the route server intensively controls routes in the network.
Meanwhile, communication carriers provide various types of private communication networks (VPNs: Virtual Private Networks) as wide area connection services instead of traditional dedicated line services. In such a VPN service, because a plurality of customers can share network resources provided by a carrier, each carrier can offer communication services to a larger number of customers at a lower price with reduced infrastructure investment cost.
One of the VPN services provided by a carrier is an L3 (Layer 3) VPN service that provides virtual IP networks to multiple customers. The L3VPN service can be implemented in several ways and a representative one is a peer-to-peer communication system using MPLS/BGP (Multi-Protocol Label Switching/Broader Gateway Protocol), e.g., described in "BGP/MPLS VPNs" RFC2547, Internet Engineering Task Force (IETF), March 1999 (Non-Patent Document 1). As other implementations, for example, an overlay type using IPsec, a separation type employing virtual routers, etc. are known.
In order to improve communication reliability in the VPN services, a technique to recover the communication by path switching when a route failure occurs is known, for example, as disclosed in Japanese Unexamined Patent Publication No. 2006-135686 (Patent Document 1). By adopting the path switching technique, in the case where disconnection of a communication line or a fault in a communication node occurs, communication over the VPN via the faulty line or faulty node can be recovered.
In one of the L3VPN services, a routing control interface at a network edge is prescribed so that the carrier network can be seen as a single router from each user network (customer network). In this case, each of the routers in the user networks can communicate route information with a routing system located in the carrier network in accordance with a routing protocol such as OSPF or RIP. According to this architecture, each user can reduce management cost because all route information for the VPN provided by the carrier and a plurality of access points connected to the VPN can be managed by a single routing protocol.
In a case where a carrier builds a routing system for L3VPN service by employing the above-mentioned route server, in order to improve the reliability of communication service and the performance of system management, and opens the routing protocol interface of the route server to the respective routers in the user networks, the route server (routing system) has to be provided with the following functions of:
(1) collecting routing control packets from each router in the user networks;
(2) VPN route information management for managing route information for each user network;
(3) VPN routing control for calculating route information for each user network; and
(4) route information distribution for converting route information for each user network into route information in the carrier network and reflecting the route information to each router in the user networks.
In a case where a plurality of user networks are connected to a single network, e.g., an L3VPN service network provided by the carrier and routing control for the user networks is performed by a route server, the carrier has to operate the routing system (route server) so that route setup requests issued from the user networks do not interfere with each other. However, when a plurality of user networks are connected to the L3VPN service network, the load of the routing system increases on account of various factors.
If a new customer joins in the L3VPN service, for example, the load of the routing system increases because of an increase in the number of networks to be controlled. Further, if a loop has occurred in an Ethernet (registered trademark) serving as a user network due to incorrect cable connection, for example, there is a risk that a storm of routing control packets (routing requests) transmitted from routers in the user network may occur. In this case, a burst of routing control packets not foreseen by the routing protocol will be transmitted into the routing system (route server), thereby causing a surge in the processing load on the route server.
Failure having occurred in one of the routers in the user networks and bugs involved in routing control software running on the router may result in a burst of routing control packets. In a communication network in which a routing protocol such as OSPF or RIP is applied, when reception of keep-alive packets from a neighboring router ceases, each router recalculates a route according to the routing protocol and advertises updated route information to other routers in the network. In this case, if a failed router performs routing control in a sequence different from the other routers, there is a possibility of no convergence of route calculation in the network. Transmission of a burst of routing control packets from a user network by a malicious user also causes a surge in the load on the route server.

Routing control system for L3VPN service network


A semiconductor laser array emits n light beams at intervals r. An optical system having a lateral magnification .beta. in the beam arrangement direction forms spots of the n light beams on the photoreceptor. A polygon scanner deflects the n light beams to a direction perpendicular to the beam arrangement direction, to scan the photoreceptor simultaneously with the n light beams. The integer n is selected to be a value not less than 3, and an interlacing period I, which is defined as I=.beta.r/p where p is an interval of adjacent scanning lines on the photoreceptor, is selected to be an integer in the range of 2.ltoreq.I.ltoreq.(n-1) and prime to n.

The present invention relates to recording apparatuses, such as a digital copier and a laser beam printer, in which an image is written using a light beam. More specifically, the invention relates to a recording apparatus which employs a light source unit having a plurality of light sources, such as a multi-beam semiconductor laser array, and which scans a scanning surface with a plurality of light beams simultaneously to record information.
In a laser beam printer, for example, a laser beam emitted from a semiconductor laser is incident on a rotary multi-face mirror (i.e., polygon scanner), and a beam reflected from the polygon scanner is then incident on a charged surface of a photoreceptor which is moving at a constant speed. The rotation of the polygon scanner causes the laser beam to move in a direction perpendicular to the moving direction of the photoreceptor. Since the laser beam is modulated in accordance with an image to be output, a corresponding electrostatic latent image is formed on the photoreceptor surface. The electrostatic latent image is developed to become a visible toner image.
Such a laser beam printer is required to have a narrow interval of adjacent scanning lines, to provide high-resolution output images. Further, the scanning speed should be sufficiently high to produce images at a high speed. In attaining the high resolution and the high output speed, the most serious problem is a limited rotational speed of the polygon scanner.
To solve this problem, the "multi-beam scanning" has been proposed in which a scanning surface is scanned with a plurality of laser beams simultaneously. In this scanning method, a plurality of laser beam spots should be placed sufficiently close to each other on the scanning surface in a direction (hereinafter called "sub-scanning direction") perpendicular to a scanning direction (hereinafter called "main scanning direction") of the polygon scanner. To this end, various efforts have been made to manufacture a plurality of semiconductor lasers arranged sufficiently close to each other. Semiconductor laser arrays having laser intervals as small as 10 .mu.m have already been produced experimentally. (For example, refer to Japanese Patent Application Unexamined Publication No. Hei. 2-39583, and R. L. Thornton et al., "Properties of closely spaced independently addressable lasers fabricated by impurity-induced disordering", Appl. Phys. Lett., 56(17), pp. 1623-1625, 1990.)
However, even with a plurality of semiconductor lasers arranged close to each other at intervals as small as 10 .mu.m, there still exists some gap in the sub-scanning direction, i.e, between adjacent scanning lines. To solve this problem, it has been proposed to eliminate such gaps in the sub-scanning direction by the interlaced scanning (Japanese Patent Application Examined Publication No. Hei. 1-45065, and K. Minoura et al., "A study on laser scanning systems using a monolithic arrayed laser diode", SPIE Vol. 1079, pp. 462-474, 1989). Further, the present assignee has developed a multi-beam scanning optical system in which such gaps are eliminated by interlaced scanning using an array of semiconductor lasers arranged at intervals of 10 .mu.m (Japanese Patent Application Unexamined Publication No. Hei. 3-248114).
FIG. 6 shows an example of the interlaced scanning, which uses two laser beams L.sub.1 and L.sub.2. In this figure, d.sub.x represents a laser beam spot diameter defined electrophotographically (hereinafter referred to as "electrophotographic spot diameter"). The electrophotographic spot diameter does not mean a diameter of a beam spot itself on a scanning surface A, but a diameter of a spot that appears after development of an electrostatic latent image formed by laser light exposure of the scanning surface A which is a charged photoreceptor. A center-to-center interval r.sub.3 between two spots B.sub.1 and B.sub.2 on the scanning surface A of the respective laser beams L.sub.1 and L.sub.2 is 3d.sub.x.
In the example of FIG. 6, sub-scanning of a distance 2d.sub.x is performed for each main scanning. The second scanning line is scanned with the laser beam L.sub.2 in the first main scanning. Then, in the second main scanning, the first scanning line and the fourth scanning lines are scanned with the laser beams L.sub.1 and L.sub.2, respectively. Thereafter, the scanning operation is continued in this manner so as to avoid formation of any gaps in the sub-scanning direction. That is, although a gap is formed in certain main scanning, it is scanned in the next scanning, so that no gaps remain after completion of the scanning operation.
In the interlaced scanning, it is required that the following three conditions be satisfied to avoid generation of doubly scanned lines and non-scanned lines.
1) If there exist n laser beams, the sub-scanning distance for each main scanning should be nd.sub.x.
2) The interval r.sub.3 between the two laser beams on the scanning surface should be an integer multiple of the electrophotographic spot diameter.
3) A scanning line which has already been scanned in certain main scanning should not be scanned in another main scanning.
As is disclosed in the above paper by K. Minoura et al., the third condition is satisfied when following equation (1) holds: EQU p=.beta.r/(mn+1) (1)
where n represents the number of laser light sources, r the interval of the laser light sources, .beta. the lateral magnification in the sub-scanning direction of an image forming optical system, p the scanning pitch, and m an integer not less than zero. If m=0, equation (1) represents the non-interlaced case in which adjacent spots are closely arranged in the sub-scanning direction. It is noted that in the above paper by K. Minoura et al. characters M and p.sub.0 are used instead of M and r in equation (1), respectively.
The scanning pitch p, i.e., a minimum interval between scanning lines, is also shown in FIG. 6. In order to perform a scanning operation by a single laser beam without leaving gaps on the scanning surface, it is generally required that the scanning pitch p be equal to the electrophotographic spot diameter d.sub.2.
The interval .beta.r of the beam spots of the multi-beam laser array is expressed as .beta.r=Ip, where I is a positive integer and is called "interlacing period".
In general, the spot diameter of a laser beam is defined by a diameter having the two ends where the light amplitude is 1/e (1/e.sup.2 in terms of power) of that at the center. The spot diameter according to this definition is called "optical spot diameter" and represented by d.sub.0.
FIG. 7 shows a relationship between the optical spot diameter d.sub.0 and the electrophotographic spot diameter d.sub.x, in which the light intensity on the axis of a laser beam is normalized to 1. A ratio k of the optical spot diameter d.sub.0 to the electrophotographic spot diameter d.sub.x, i.e., k=d.sub.0 /d.sub.x, is called "spot diameter correction coefficient". The actual value of k varies depending on the electrophotographic process employed. In the inversion development process, in which toner is stuck to portions exposed to light, it is desirable that k be in the range of 1.4 to 1.6. On the other hand, in the case of the normal development process, in which toner is stuck to portions not exposed to light, it is desirable that k be in the range of 1.5 to 1.8 (T. Tanaka, "Study of Gradation Reproduction in Laser Xerography", 6th Conference of Chromatic Engineering, pp. 77-80, 1989).
In the above-described interlaced scanning, it may be conceivable that the interval of the spots formed on the scanning surface can be set as large as desired by properly selecting the integer m. However, practically, if the spot interval is too large, the scanning device is required to have extremely high mechanical accuracy. This is explained below.
Where a scanning surface is scanned by a single light beam as shown in FIG. 9, if it is required that an error of the scanning pitch p between spots B be within a limit .DELTA.p, an allowable error factor .delta..sub.0, i.e., a ratio of a sub-scanning speed error .DELTA.v to a sub-scanning speed v is expressed as: EQU .delta..sub.0 .DELTA.v/v=.DELTA.p/p.
In the case of FIG. 10, in which n=4 and m=1, an allowable error factor .delta..sub.4,1 is calculated as: .delta..sub.4,1 .DELTA.p/16p=.delta..sub.0 /16. Therefore, the required accuracy is higher than the case of FIG. 9 by more than one order. This tendency becomes more remarkable with increases of the number n of light sources and the integer m.
While the allowable error of the sub-scanning speed is described above, similar problems in connection with accuracy occur in the lateral magnification of the optical system and in the interval between the light sources.
Apparently, it is desirable, to solve the above problems, that the interval between the spots on the scanning surface be as small as possible. In equation (1) described above, the spot interval is smallest when m=0, but this is not an interlaced scanning case. Therefore, we should consider the case of m=1 in equation (1), which will provide the smallest spot interval among the interlaced scanning cases. When m=1, the interval .beta.r between the adjacent spots on the scanning surface is expressed as (n+1)p and increases with the number n of the light sources.
Considering the above, the allowable error factor .delta..sub.n,m for the number n of the light sources and the integer m has the following relationship: EQU .delta..sub.n,m .gtoreq..delta..sub.n,1 .delta..sub.0 /n.sup.2.(2)
This is schematically illustrated in FIG. 8. When m =1, since each spot interval is (n+1)p, the two most distant spots have an interval of (n.sub.2 -1)p. A last spot B of the first scanning should be adjacent, in the sub-scanning direction, to a head spot C of the n-th scanning.
Another problem arises when it is intended to expand the spot interval on the scanning surface. That is, in performing a plural times of scanning to scan the area between the two scanning lines of the adjacent beams, capacity of high-speed memories necessary for electrically controlling the interlaced scanning is increased with the number of lines to be skipped.

Interlaced multi-beam scanning type recording apparatus


A thermal cut-off resistor that has an elongated thermal cut-off fuse; a wire-shaped resistor that is tightly coiled around the fuse, said resistor being physically connected to the fuse so that the fuse and the resistor are in an electrical series arrangement; and an electrically-insulated heat-resistant casing that contains the fuse and resistor therein and enables the fuse and the resistor to be secured and electrically connected to respective electrical contacts formed on a printed circuit board, the profile of the casing being approximately the width of the fuse.

A telephone network consists of transmission systems that carry electrical information signals between two or more points; telephone sets that permit subscribers to transmit and receive the signals; and one or more switching systems that temporarily connect one transmission line to another line and, thus link two telephone sets. Since certain types of signals are better suited to certain types of transmission media because of bandwidth requirements, loss limits, etc., the characteristics of the type of signal traffic (e.g., voice, data, and video, in either analog, digital or hybrid form) dictate the physical configuration of the transmission systems used by the network. Consequently, a telephone network may be made up of a variety of transmission systems, each consisting of a transmission medium and its supporting structures, such as, telephone pole lines, underground conduit systems, buried systems, etc. Common transmission media include optical fibers and coaxial cable. The most prevalent type of transmission medium used in present telephone networks, however, is metallic paired cable. Metallic paired cable is composed of copper or aluminum conductors which are coated with an insulated material and which are twisted together into cables of various sizes, depending on the number of paired cables desired. The cables are further contained in a protective sheath that provides environmental protection.
The use of metallic paired cable for signal transmission is accompanied by high attenuation of the signals from one point to another. Attenuation is reduced in transmission systems using metallic paired cable to carry analog signals by the placement of lumped inductances, known as load coils, along the transmission lines. In transmission systems using metallic paired cable to carry digital signals, such as T1 carrier systems, attenuation is eliminated by the use of devices known as repeaters that receive digital signals, amplify or reshape the signals and then retransmit the modified signals. A repeater is commonly constructed of various discrete electrical components, such as integrated circuit chips, diodes, clocks, etc., that are assembled and mounted on a printed circuit board. The repeater printed circuit board is packaged in a casing and installed in the transmission system to connect or terminate a transmission line. As a practical matter, a group or bank of repeaters are usually installed so as to connect into a corresponding bank of transmission lines. In such case, the casing for each individual repeater printed circuit board is not utilized and the printed circuit boards are placed side by side next to one another within a respective printed circuit board rack or cabinet.
Each component in a transmission system using metallic paired cable is at risk when certain fault conditions, such as power cross (i.e., the contacting of a telephone transmission line with an electrical power line), exist on any transmission line or cable. If a fault condition is not isolated from the circuitry of the components in the system, the fault condition may cause damage, such as fire, overheating, mechanical failure, etc. To isolate such fault conditions from the circuitry in a repeater, a thermal cut-off resistor is placed in the current path of the repeater circuitry to interrupt the high current flow resulting from a fault condition. In operation, high fault current passes through a resistive element of the cut-off resistor and the heat generated by the resistive element causes a fuse element to open within the current path. As a result, the high fault current is interrupted and the circuitry of the repeater is isolated and protected from the fault current.
A drawback of existing thermal cut-off resistors, however, is the mechanical design. In particular, existing thermal cut-off resistors are designed and manufactured as a component having a discrete resistor and a separate discrete fuse, both molded into an insulated casing and with one element placed atop the other element therein. This "vertical" design results in a high profile, or height relative to the printed circuit board surface, for the cut-off resistor which becomes a problem in newly designed repeaters that take advantage of the miniaturization of other board components and in new repeater applications that require close circuit board to circuit board spacing. Although the discrete elements can be miniaturized in order to reduce the profile, there is a limit as to how small the elements can become without adversely affecting the functional characteristics of the elements. Another alternative to achieve a lower profile for an existing cut-off resistor is to arrange the two elements in a horizontal rather than a vertical configuration relative to the printed circuit board surface. Disadvantageously, such a modification exacts a trade-off, namely, the horizontal arrangement increases the "footprint" of the cut-off resistor on the circuit board (i.e., the area of board surface taken up by the cut-off resistor mounted thereon) and, thus, fails to conserve valuable board space, which is a standard design goal for printed circuit board components.
The mechanical design of existing thermal cut-off resistors also affects the efficiency of their operation. In particular, the shapes of the resistor and the fuse, and the spatial relationship with one another, causes the heat radiated by the resistor to be dispersed and not specifically directed towards the separate fuse. As a result, the fuse receives only a portion of the radiated heat and responds more slowly to a fault condition. In addition, the fuse does not receive the radiated heat quickly or uniformly along its body. This sluggishness in the heat transfer and heat response of an existing cut-off resistor leads to an imprecise and inefficient operation and can be particularly damaging to the repeater circuitry in the event of a severe or sudden fault condition.
As is evident, the mechanical and operational drawbacks of existing thermal cut-off resistors are not limited to repeaters, but are equally applicable to any device having a printed circuit board and any printed circuit board application.
Consequently, there is a need for a thermal cut-off resistor that has a lower profile than currently available. Further, there is a need to have such a low profile thermal cut-off resistor without increasing the footprint of the cut-off resistor on a printed circuit board. Further, there is a need to have such a low profile thermal cut-off resistor without affecting the functional characteristics. Moreover, there is a need to have a thermal cut-off resistor that has an increased responsiveness to fault conditions. There is also a need to have such a thermal cut-off resistor that can withstand repeated lightning or simulated lightning transients.


A method for identifying a control path of a controlled system, and more particularly to a method for identifying a control path in the presence of deterministic perturbations is described. At least one deterministic perturbation correcting signal is determined in a first identification process, and the perturbation correcting signal is stored in the form of a function. A control path of the controlled system is identified in a second identification process by adding to the controlled system the at least one stored deterministic perturbation correcting signal with a negative feedback. The method can be used with machine tools, production machines and/or robots which demand a high control accuracy and/or a high-quality control characteristic. In particular, perturbation effects due to slot latching in motors, in particular linear motors, can be minimized.

The present invention relates to a method for identifying a control path of a controlled system, and more particularly to a method for identifying a control path in the presence of deterministic perturbations.
A high-quality identification of a controlled system form an important basis for optimizing a closed-loop control circuit. A controlled system is typically identified by applying a suitable stimulus signal at the input of the controlled system and measuring the path response at the output of the controlled system. The controlled system can be described by a transfer function which can be identified by measuring the path response to the stimulus signal.
The transfer function can be determined either in the time domain by observing the time evolution of the stimulus signal and the path response or, as is commonly done in this technical field, in the frequency domain.
For identifying the controlled system in the frequency domain, both the stimulus signal and the path response are transformed into the frequency domain through a Fourier transform. The transfer function of the controlled system in the frequency domain is obtained in the form of a complex transfer function by dividing the Fourier-transformed path response by the Fourier-transformed stimulus signal.
The frequency response of the magnitude and/or the phase of the complex transfer function of the controlled system can then be determined from the complex transfer function of the controlled system.
In practical applications, perturbations and/or perturbation signals make often make it difficult to reliably identify a path of the controlled system that is to be controlled. A distinction can be made between two types of perturbations that can occur, which can be referred to as stochastic perturbations and deterministic perturbations.
The impact of stochastic perturbation signals on the identification of the controlled system can be lessened by performing a sufficiently large number of averages and/or by low-pass filtering and/or by analyzing the correlation of one or several perturbation signals. However, these measures operate only in a limited fashion with deterministic perturbation signals, or do not work at all.
Errors in the identification of controlled systems in the presence of deterministic perturbation signals have so far been unavoidable and had to be tolerated, since the above-mentioned methods were inadequate to significantly reduce these errors. As a result, the controlled system could not be reliably identified in the frequency range where the deterministic perturbation signals occur.
The European patent publication EP 0 211 374 A1 describes a device for compensating the effect of gravity on an element of a machine-tool or a robot that can be raised and lowered by an electric motor, and a method for operating such a device. The patent application describes optimizing a controller setting by applying a perturbation signal.
It would therefore be desirable and advantageous to provide an easy-to-use and cost-effective method for identifying a control path of a controlled system, which obviates prior art shortcomings and is able to specifically identify a control path in the presence of deterministic perturbations.

Method for identifying a control path of a controlled system


A window covering comprises a flexible panel having a top edge and a bottom edge. At least one lift cord is provided for raising and lowering the bottom edge. Each lift cord is connected to one end of a stiffener at a first point and the opposite end of the stiffener is connected to approximately the bottom edge of the flexible panel. The stiffener prevents the folding of the flexible panel between the bottom edge and the first point. The top edge may be connected to a head rail and the bottom edge may be connected to a bottom rail. A motor may be located adjacent the top rail where the lift cord is connected to the motor.

The invention relates generally to cordless window coverings and more particularly to cordless window coverings having relatively soft, flexible panels.
Window coverings having flexible panels such as woven wood shades, natural shades, Roman shades, hobbled shades, looped shades, and the like are known. Likewise, cordless window coverings are also known. Cordless window coverings typically comprise a spring motor connected to the top or bottom of the window covering. The spring motor offsets the weight of the shade panel to hold the shade panel in any vertical position. To operate the window covering, a user pushes up or pulls down on the bottom rail (or top rail in the case of a top down shade) of the shade panel to raise or lower the shade. The spring motor assists in the raising of the shade panel and holds the shade panel in the desired position. Typically, the shade panels in cordless window coverings are comprised of cellular shades.


A UV-emitting phosphor blend is provided which comprises a mixture of at least two UVA-emitting phosphors selected from SrB4O7:Eu, YPO4:Ce, and BaSi2O5:Pb wherein the sum of the weight percentages of the phosphors in the mixture equals 100%. The phosphor blend may additionally contain an amount of a UVB-emitting phosphor in an amount from 0 to 12 wt. % of the mixture. Tanning lamps containing these blends exhibit increases in initial UVA output and UVA maintenance.

Tanning lamps are similar to conventional mercury-vapor fluorescent lamps in construction except that they contain one or more phosphors which emit radiation in the ultraviolet (UV) region of the electromagnetic spectrum in order to induce a tanning response in human skin. The UV emission from tanning lamps is classified into two regions, UVA and UVB. The U.S. Food & Drug Administration (FDA) defines the UVA region as being from 320–400 nm and the UVB region as being from 260–320 nm. (See, Performance Standards for Light-Emitting Products: Sunlamp Products and Ultraviolet Lamps intended for use in Sunlamp Products, 21 C.F.R. 1040.20) The majority of the UV flux of tanning lamps is emitted in the UVA region with the balance in the UVB region. This is intended to generally mimic the relative proportions of UVA and UVB in natural sunlight. Both UVA and UVB have a role in the tanning process. When human skin is exposed to UV light, the melanocytes in the skin's epidermis release extra melanin, a protein pigment responsible for tanning. While UVB radiation is more efficient than UVA in stimulating the production of melanin, UVA radiation is much more efficient than UVB in oxidizing the melanin to produce the brown color which is characteristic of suntans.
The typical UV-emitting phosphor employed in tanning lamps is a single-component lead-activated barium disilicate, BaSi2O5:Pb. The BaSi2O5:Pb phosphor intrinsically has low maintenance due to its affinity for mercury. Hence, when this phosphor is used in a mercury-vapor fluorescent lamp, the phosphor surface is usually protected by a coating, typically aluminum oxide, as described in U.S. Pat. Nos. 4,585,673, 4,710,674, 4,825,124 and 5,523,018. The alumina coating provides a barrier layer between the phosphor and the mercury-vapor and improves long term-UV maintenance.
Reflector tanning lamps (RTLs) are a special class of tanning lamps wherein the UV flux is focused by a reflector which causes the flux to be emitted over a narrower segment of the circumference, for example 140°, instead of through the entire 360° circumference of the lamp. Two key performance parameters of tanning lamps, and RTLs in particular, are the initial UVA output of the lamp and the UVA maintenance. The initial UVA output of the lamp (0 hours) will be herein referred to as the 0 h UVA output. The UVA maintenance measures the ability of the lamp to maintain its initial UVA output over a period of time, usually the first 100 hours of operation, and is expressed as a percentage of the initial output. As used herein, the 100 h UVA maintenance is defined as the ratio of the UVA output of the lamp after 100 hours of operation to its initial UVA output times 100% ((100 h UVA output/0 UVA output)×100%). For commercial applications, it is very desirable to have both a high 0 h UVA output and a high 100 h UVA maintenance. Unfortunately, current commercial RTLs either have a high 0 h UVA output (≧8600 μW/cm2) or a high 100 h UVA maintenance (≧87%) but not both attributes simultaneously. In other words, RTLs that have a high 100 h UVA maintenance (≧87%) have a 0 h UVA output that is much less than 8600 μW/cm2. Conversely, RTLs that have a high UVA output (≧8600 μW/cm2) have a 100 h UVA maintenance that is much less than 87%. The inverse relationship between 0 h UVA output and 100 h UVA maintenance for commercial reflector tanning lamps is shown in FIG. 1.
Therefore, it would be an advantage over the present state of the art to have tanning lamps, and RTLs in particular, that exhibit higher 0 h UVA outputs at high 100 h UVA maintenances.

This patent is subject to a terminal disclaimer.

UV-emitting phosphor blend and tanning lamp containing same


An electrostatic image developing toner includes toner particles that contain a binder resin and a coloring agent. The binder resin includes an amorphous resin and a crystalline polyester resin. The toner satisfies Relations (1) and (2). ΔH1 is the amount of heat absorption based on a melting peak of the crystalline polyester resin in a first heating step from room temperature to 150° C. ΔH2 is the amount of heat absorption based on a melting peak of the crystalline polyester resin in a second heating step from 0° C. to 150° C. ΔH(theo.) is a value of fusion enthalpy calculated from a mass ratio of a structural unit derived from a linear aliphatic monomer contained in the binder resin based on a group contribution method.0.2≦ΔH1/ΔH(theo.)≦0.5  Relation (1):0.1≦ΔH2/ΔH(theo.)≦0.3  Relation (2):

1. Field of the Invention
The present invention relates to an electrostatic image developing toner used for electrophotographic image forming.
2. Description of Related Art
It has been required that electrostatic image developing toners used for electrophotographic image forming (hereinafter also simply referred to as "toners") can be fixed with decreased heat energy in order to increase the printing speed and to reduce the energy consumption of image forming apparatuses. For this reason, further improved low-temperature fixability has been required for toners. For example, in one of such toners known in the art, a crystalline polyester resin having a sharp-melting property is introduced to the toner as a binding resin so as to decrease the glass transition point or the melt viscosity of the binder resin.
Specifically, for example, it is known to use a binder resin that is a mixture of an amorphous resin and a crystalline polyester resin having high miscibility with the amorphous resin. Such combined use of a crystalline polyester resin can improve the low-temperature fixability since the crystalline polyester resin serves as a plasticizer in heat fixing.
Further, another toner known in the art contains crystalline polyester resin in the toner particles as a crystal domain. The low-temperature fixability is obtained by applying heat energy that raises the temperature to a value higher than the melting point of the crystalline polyester resin in heat fixing and thereby melting and dissolving the crystal domain with an amorphous resin (e.g. see JP 4729950B and JP 4742936B).
However, problems with such toners are low heat-resistant storage stability of the toners and low image storage stability of a fixed image obtained by heat fixing, which are due to plasticization caused by mutual dissolution between the amorphous resin and the crystalline polyester resin.
Further, another problem is that when the amorphous resin and the crystalline polyester resin do not exhibit sufficient affinity to each other, the toner particles are more crushable, for example, by stirring in a developing unit.


System and method for enabling arbitrary components to control communications without having or requiring prior knowledge of each other. The system includes a first component that creates controller objects and provides the objects to other components. The controller objects include instructions which when executed by the other components enable the components to generate user interfaces for controlling the first component. Further, the controller objects are encrypted and are used to authenticate the senders or receivers of the objects.

Different components, such as machines or applications and file systems operating on machines, cannot communicate unless they are explicitly programmed to understand each other. Domain-specific protocols have been developed that enable components to communicate with each other using a common language to partially deal with this difficulty. Even when components use the same domain-specific protocols, however, they are still limited in the types of communications they can engage in. For instance, components typically employ mechanisms for providing feedback or allowing clients to control some aspect of the component's behavior during interactions with the component. Examples include device control panels, directory/file selection windows or progress bar windows.
Unfortunately, these mechanisms are either inherent to the components themselves or are part of a pre-installed application. In either case, the specific instructions for these mechanisms must be known in advance by a component. This limits the ability for components to interact with each other in an ad hoc manner unless they are explicitly programmed to understand each other's mechanisms and speak the same domain-specific protocols. On the other hand, allowing clients unfettered access to interfaces that could be utilized to control some aspect of the component's behavior would create security risks, especially where sensitive information is involved.

System and method for securely controlling communications


A data sharing method for use in a computer system provided with a first computer, a second computer and a data storage subsystem for connection with the first and second computers is disclosed. The data storage subsystem has a plurality of memory units and a control unit for controlling the plurality of memory units. The control unit forms a paired state of a first memory unit storing data for use by the first computer and a second memory unit, the paired state being so controlled as to match the contents of the first memory unit and those of the second memory unit. When data used by the first computer are to be used by the second computer, the control unit releases the paired state between the first memory unit and the second memory unit to stop updating of the first memory unit to be reflected in the second memory unit. After that, the control unit re-maps a third memory unit used by the second computer and the second memory unit with each other, and so performs control that the access by the second computer to the third memory unit be made to the second memory unit.

This invention relates to a system for sharing data among storage systems in data processing systems or the like, and more particularly to a method of sharing data in a computer system which has a data storage subsystem with a plurality of interfaces.
"Downsizing" or causing an open system such as a personal computer (PC) or a workstation to carry out operations which were handled by a mainframe, has become an extensively adopted practice in recent years. Because a large quantity of information from past operations is stored in a mainframe, however, there is a demand for accessing that accumulated information from a small computer such as a PC.
The supplement Mainframe '98 (p. 214) to Nikkei Computer, a magazine published by Nikkei BP, carries an article on a case of composite configuration of a mainframe and an open system for a computer system used in corporate offices. In the computer system the article describes, the mainframe processes sales information, and the resulting accumulated data are collected and transferred once a day to a computer on the open system side via a network. This allows the user to refer to the data on the computer on the open system side. This arrangement enables data on core operations handled by the mainframe to be accessed from the open system. During such an access in this system, the current operation handled by the mainframe is suspended, and all the data are copied via the network. The greater the quantity of data handled, the longer the time required for copying. This results in heavier loads on host computer and the network, which may cause interruption in operations.
One solution to this problem is accessing a single disk unit (volume) by a plurality of host computers. Japanese Published Unexamined Patent Application No. 9-258908 discloses a disk apparatus having a plurality of interfaces and a method by which such a disk apparatus is accessed by host computers connected to the plurality of interfaces. According to this technique, copying of data between systems is dispensed with, and the load on host computer can be reduced accordingly.

Computer system and data sharing method between computers


The compounds of the invention are a 2'-deoxy-5-fluorouridine derivative represented by the formula ##STR1## wherein one of R.sub.1 and R.sub.2 is a hydrogen atom or a group easily hydrolyzable in vivo, the other is a benzyl group which may optionally have at least one halogen atom or trifluoromethyl group as a substituent on the phenyl ring, and R.sub.3 is a lower alkyl group, and a pharmaceutically acceptable salt thereof.. The compounds of the invention can be suitably used as an antitumor agent.

It is known that 240 -deoxy-5-fluorouridine (FdUrd) significantly inhibits the growth of tumor cells in in vitro tests. But when tested in vivo, FdUrd can not produce a satisfactory therapeutic effect under the influence of pyrimidine nucleoside phosphorylase acting as a decomposition enzyme. For this reason, FdUrd has not been widely used as a anti-cancer agent. Yet, FdUrd has been used for curing specific organic cancers although solely by a continuous administration method (Cancer 57 492-498 (1986), J. Urol. 139 259-262 (1988)). This suggests the possibility that FdUrd might be used as a clinically potent anti-cancer agent if the effective concentration of FdUrd in blood can be retained for a prolonged period. The production of various FdUrd derivatives has been attempted to improve said property (Japanese Unexamined Patent Publications Nos. 113797/1981, 109722/1982, 99499/1983 and 238797/1986). The compounds disclosed in the publications enable effective concentration of FdUrd in blood for a long period. But it was found that the compounds cause side effects such as diarrhea because of the increase of FdUrd concentration in blood beyond its effective concentration in blood, failing to produce a satisfactory clinical effect.
More recently, FdUrd derivatives were reportedly prepared with particular attention directed to the ability of FdUrd to sustain its low concentration in blood (Japanese Unexamined Patent Publications Nos. 106593/1986, 104093/1989 and 199992/1989). The compounds disclosed in the publications achieve an improvement in continuously releasing FdUrd into blood, but sustain the effective concentration of FdUrd in blood to a lesser extent than a continuous administration method because of a low conversion ratio from the compound to FdUrd, failing to give the desired therapeutic index.

2'-Deoxy-5-fluorouridine derivatives, a process for their preparation, antitumor agents containing same and methods for using said agents


The present invention provides systems and methods to allow those offering products and services, for example, via web pages, to collect accurate preferences and requirements with a minimum of effort required from a potential customer. Product information containing priority indicators is presented to a user while the user is viewing product information. By selecting a priority indicator, he user may indicate that he is interested in specific product features associated with each priority indicator. This information may then be used to construct detailed product information, quotations, demonstrations, or other material. Thus, accurate, valuable, and useful customer data may be collected without imposing on potential customers to invest a great deal of effort.

The present invention relates to systems and methods for determining a user's requirements and preferred features with respect to a product or set of products. Specifically, it relates to methods and systems for gathering this information with a minimum of effort required from the user.
Those offering high-value services and products face a problem of determining user needs and preferences. For example, a user looking to purchase software in a complex field such as customer relations management or resource management may wish to evaluate several software packages. The software packages may have a multitude of possible features and optional components, making it time-consuming for the user to determine which features, options, and benefits would most effectively meet his needs.
It is therefore difficult for one offering products or product information to determine which products or services most interest the customer, and which product features and options are required or desired. Surveys and indirect information-gathering techniques, such as inferring customer preferences from a set of web sites visited by the user, are used to gather such information. These information-gathering techniques are either unreliable (in the case of information inferred from customer actions) or burdensome on customers (in the case of surveys and similar methods). Data obtained from, e.g., surveys and request forms is also often inaccurate, since the customer is responding to questions asked out of context. For example, a customer who indicates that he places a low value on the product feature "frequent software upgrades" may not completely understand why one would want frequent updates, and therefore rank it lower than if he understood the relevant benefits. Including such information in the survey process will generally increase the time burden on users, making it less likely that they will be willing to complete the process. Similarly, asking for a complete customer profile from every visitor to a website, for example, is not feasible. Therefore a system is needed that allows for those offering products or services to easily associate product features, options, and benefits with relevant information, and provide a simple way for customers to indicate their preferences and requirements with a minimum of effort.

Methods and system for determining the user's interests


A light-triggered tattoo process. A strong absorber of light energy and tattoo material are sandwiched under pressure between a skin region and a transparent window. Short pulses of light, at frequencies strongly absorbed by the strong absorber, illuminates the strong absorber through the window creating micro-explosions in the strong absorber that drive particles of the tattoo material into the skin region producing a tattoo.

Humans have been applying tattoos to the skin for over 8000 years. The inks and dyes used were historically derived from substances found in nature and comprise a heterogeneous suspension of pigmented particles and other impurities. A well-known example is India ink, a suspension of carbon particles in a liquid.
Tattoos are typically produced by applying, with tattoo needles, tattoo ink into the dermis, where the ink remains permanently. This technique introduces the pigment suspension through the skin by an alternating pressure-suction action caused by the elasticity of the skin in combination with the up-and-down movement of the tattoo needles. Water and/or other carriers for the pigment introduced into the skin diffuse through the tissues and are absorbed. The insoluble pigment particles remain in the dermis where they were initially placed, for the most part. Inks used for tattooing resist elimination by virtue of their inertness and the relatively large size of the insoluble pigment particles. A tattoo produced in this manner will partially fade over time but will generally remain present throughout the life of the tattooed person.
Tattoos are used for a variety of reasons, primarily for ornamentation of the skin. While tattoos have traditionally been applied as designs for the skin, they are also used for permanent cosmetics, such as eyeliner and lip color often by people who cannot apply makeup, such as those suffering from arthritis or Parkinson's disease. Additionally, for breast reconstruction after mastectomy, it is desirable to reconstruct the nipple and areola area with darker flesh tone tattooing in order to produce a natural-looking breast. Moreover, tattooing has been used to treat hypo- and hyper-pigmentation caused by vitiligo, skin grafts, port-wine stains, and other dermatologic conditions.
Quite often people have a change of heart after being tattooed. For example, a person may desire to remove or change the design of a decorative tattoo, such as the name of an old girl friend after the tattooed persons marries someone else. Alternatively, an individual with cosmetic tattooing, such as eyeliners, eyebrows, or lip coloring, may wish to change the color or area tattooed as fashion changes. In addition, following breast reconstruction, the geometry of the breast may change over time, leading to a tattooed nipple changing from an aesthetically pleasing position to an unpleasant one.
Unfortunately, there is currently no simple and completely successful way to remove tattoos. Removal by surgical excision, dermabrasion, requires invasive procedures associated with potential complications, such as infections, and usually results in conspicuous scarring. Removal by laser therapy is the most common technique and is usually limited to eliminating only from 50–70% of the tattoo pigment, resulting in a residual smudge. Laser removal requires multiple treatment sessions (usually five to twenty) with expensive equipment for maximal elimination. Thus, the overall cost of laser removal is generally prohibitively expensive for many people. Additionally, most tattooing inks are made of pigments which have a wide range of particle size. If the pigment particles are small, they may diffuse through the tissues, causing "bleeding" of the color, "blurring" of the lines of the tattoo, or partial fading of the tattoo.
Prior art temporary substitutes for tattoos are unsatisfactory because they tend to be very short-lived. If only the surface of the skin is colored, such as by painting on the skin, the ornamentation is easily removed by wetting or rubbing the skin or by the natural sloughing of epidermis every three to four weeks. While this technique produces only temporary skin ornamentation, it would be desirable to have the option to color the skin to last longer than a few hours, days, or weeks.
The epidermis, 39 in FIG. 1 and FIG. 1A of the human skin comprises several distinct layers of skin tissue. The deepest layer is the stratum basale layer which consists of columnar cells. The next layer up is the stratum spinosum composed of polyhedral cells. Cells pushed up from the stratum spinosum are flattened and synthesize keratohyalin granules to form the stratum granulosum layer. As these cells move outward they lose their nuclei and the keratohyalin granules fuse and mingle with tonofibrils. This forms a clear layer called the stratum lucidum. The cells of the stratum lucidum are closely packed. As the cells move up from the stratum lucidum they become compressed into many layers of opaque squamas. These flattened cells have become completely filled with keratin and have lost all other internal structure, including nuclei. These squamas constitute the outer layer of the epidermis, the stratum corneum. At the bottom of the stratum corneum the cells are closely compacted and adhere to one another strongly, but higher in the stratum they become loosely packed and eventually flake away at the surface. Also shown in FIG. 1 is hair stem 33 sebaceous gland 38, hair duct 31, nerve ending 34, veins and arteries 36 and 37, sweat gland 35 and pupilla 32.
It is known that graphite vaporizes at about 3,600.degrees. C. It is known that graphite is a strong absorber of infrared light and that infrared light such as the 1.06 micron laser beam produced by the Nd:YAG laser will penetrate several millimeters through human skin. It is also known that short pulses of light energy absorbed by a strongly absorbing material can result in shock waves creating mechanical forces.
What is needed is a better method for applying tattoo quickly and without needles and pain.


A processor comprising: an instruction processing pipeline, configured to receive a sequence of instructions for execution, said sequence comprising at least one instruction including a flow control instruction which terminates the sequence; a hash generator, configured to generate a hash associated with execution of the sequence of instructions; a memory configured to securely receive a reference signature corresponding to a hash of a verified corresponding sequence of instructions; verification logic configured to determine a correspondence between the hash and the reference signature; and authorization logic configured to selectively produce a signal, in dependence on a degree of correspondence of the hash with the reference signature.

Current computer systems are highly vulnerable to cyber attack. The number of attacks and the financial losses due to those attacks have risen exponentially. Despite significant investments, the situation continues to worsen; novel attacks appear with high frequency and employ increasingly sophisticated techniques. There are very few fundamental sources of the vulnerabilities exploited by cyber attackers. These attacks stem from the fact that current computer systems cannot enforce the intended semantics of their computations. In particular, they fail to systematically enforce: Memory safety, Type safety, The distinction between code and data, and Constraints on information flow and access. These properties are not systematically enforced today because they are not: Systematically captured during the design process; Formally analyzed or verified during design and implementation; Captured or enforced by common system programming languages (e.g., the C programming language); and Represented explicitly within the runtime environment of the system and therefore cannot be enforced dynamically by either hardware or software techniques.
Current system software is large and complex. Hardware architectures provide mechanisms to protect the kernel from user code, but at the same time grant to the kernel unlimited privileges (at best, a few levels of increased privilege). Consequently, a single penetration into the kernel gives the attacker unlimited access. Since the cost of switching into kernel mode is high, there is a tendency for system programmers to move increasing amounts of functionality into the kernel, making it even less trustworthy and exposing an even larger attack surface. Likewise, programming flaws can result in unintended access to kernel or increased privilege level system access.
Current computer systems lack the means to recover from attacks either by finding alternative methods for achieving their goals or by repairing the resources corrupted by the attack. They also typically lack the ability to diagnose the underlying problem and to fix the vulnerabilities that enabled the attack. Once a machine is corrupted, manual repairs by specialized personnel are required while the forensic information necessary to affect the repair is typically lacking. A particular issue is that, once a system is corrupted, it cannot be subsequently trusted, and therefore a remediation facility is difficult to implement. Finally, today's computer systems are nearly identical to one another, do not change appreciably over time, and share common vulnerabilities. A single network-based attack can therefore spread rapidly and affect a very large number of computers.
A central requirement for implementing trusted computing platforms is to validate whether a program executing on a potentially untrusted host is really the program the user thinks it is. If the host platform and its software environment are potentially compromised, the application may be compromised either through static replacement of the binaries or though linking—either statically or dynamically—the application dynamically to untrusted library functions or through dynamic code substitution at run time. What makes the validation problem particularly difficult is the compromises that occur at run time. One way to validate the execution is to verify that the results produced by the execution on a data set are essentially the same results that are produced when a validated, reference copy of the program is run on a trusted host and produces the same result with the same input data set. Such a validation is practically infeasible, as the execution of the validated program obviates the need for execution on the original, potentially untrusted host. Another approach will be to continuously monitor changes/updates to the various software components and to only permit changes that have been certified as legitimate. Unfortunately, this approach results in a fairly closed system that takes out the convenience of timely, automatic or semi-automatic updates and introduces a potential administration headache. Existing approaches to validating the execution of a program include the use of hardware support in the form of the Trusted Platform Module (TPM), the use of control flow signatures at run time, with control flow signatures derived from the contents of both register and memory locations as well as the contents of hardware instrumentation registers.
The art has proposed various means for addressing this problem. For example, software testing techniques based on control flow signatures. However, these are slow, and encryption makes this problem worse. Without encryption, the scheme suffers from an intrinsic vulnerability. Another technique employs hardware-support for debugging and validation of executed code. See, US 2008/0215920, expressly incorporated herein by reference, and discussed in more detail below. Software techniques are available for authenticating executions. These may have limited coverage, and may incur delay and increased overhead. Hybrid techniques, such as a combination of software techniques and TPM hardware to certify code before execution is also possible, but this may fail to detect run-time compromises.
Today's computing systems consist of a large number of hardware and software components. Assuming that the hardware components are certified by the vendors, the software components are the major sources of vulnerability. These software components start with the operating systems and related services, library components, utilities and the applications themselves. Any one of these software components can be compromised and can act directly or indirectly as sources of attacks that can change the execution characteristics of a user's program at run time. Examples of such compromises include the alteration of transfer vectors at run time, to transfer control to unintended functions, alteration of the binaries of the application itself ("code injection") at run-time, call(s) to compromised system functions, and so on. The net result of any of these techniques is that the user's program does not correctly perform its intended functions, even though the users are completely oblivious to that fact. To detect such compromises, it is necessary to validate the execution of the entire program at run time, including the validation of library functions, kernel functions and utilities. Such validations ultimately lead to a trusted computing environment, where a system is composed of components that can be potentially compromised and where any compromise can be detected in a timely fashion to prevent any adverse impact of any form.
"Trusted Platform Module" is the name of a published specification detailing a secure cryptoprocessor that can store cryptographic keys that protect information, as well as the general name of implementations of that specification, often called the "TPM chip". The TPM specification is the work of the Trusted Computing Group. The current version of the TPM specification is 1.2 Revision 103, published on Jul. 9, 2007.
The Trusted Platform Module offers facilities for the secure generation of cryptographic keys, and limitation of their use, in addition to a hardware pseudo-random number generator. It also includes capabilities such as remote attestation and sealed storage. "Remote attestation" creates a nearly unforgeable hash key summary of the hardware and software configuration. The extent of the summary of the software is decided by the program encrypting the data. This allows a third party to verify that the software has not been changed. "Binding" encrypts data using the TPM endorsement key, a unique RSA key burned into the chip during its production, or another trusted key descended from it.[3] "Sealing" encrypts data similar to binding, but in addition specifies a state in which the TPM must be in order for the data to be decrypted (unsealed).
A Trusted Platform Module can be used to authenticate hardware devices. Since each TPM chip has a unique and secret RSA key burned in as it is produced, it is capable of performing platform authentication. For example, it can be used to verify that a system seeking access is the expected system.
The Trusted Platform Module is typically part of the supporting chipset for a processor system, and thus its use typically delays execution of instructions by the processor until verification is completed. Likewise, verification occurs with respect to instructions before they are cached by the processor. Thus, while the TMP provides secure data processing, it does not address insecurities in moving instructions to the processor, and is susceptible to instruction injection type attaches, and likewise introduces significant latencies.
Generally, pushing the security down to the hardware level in conjunction with software provides more protection than a software-only solution that is more easily compromised by an attacker. However even where a TPM is used, a key is still vulnerable while a software application that has obtained it from the TPM is using it to perform encryption/decryption operations, as has been illustrated in the case of a cold boot attack.
The "Cerium" technology (Chen and Morris, "Certifying Program Execution with Secure Processors", Proceedings of the 9th conference on Hot Topics in Operating Systems, USENIX, Volume 9, Pages: 133-138, 2003), expressly incorporated herein by reference, proposes a secure processor technology which validates cache line signature before commencement of processing. It provides a separate security co-processor, which is not integrated into main processing pipeline. Cerium computes signatures of the system software as it boots up, and the software at each stage self checks its integrity against a reference signature stored in the co-processor's non-volatile memory. Each stage also authenticates the software for the next stage. Cerium assumes the existence and use of a cache where operating system and trusted code can be kept. See, also, Cliff Wang, Malware Detection, Advances in information security, Mihai Christodorescu, Somesh Jha, Douglas Maughan, Dawn Song, Cliff Wang, Editors, Springer, 2006.
Boneh et al., "Hardware Support for Tamper-Resistant and Copy-Resistant Software", Technical Report: CS-TN-00-97, (Stanford University, 2000), expressly incorporated herein by reference, provides a description of a hardware prototype which supports software-only taper resistant computing, with an atomic decrypt-and-execute operation.
U.S. Pat. No. 7,730,312, expressly incorporated herein by reference, provides a tamper resistant module certification authority. Software applications may be securely loaded onto a tamper resistant module (TRM) and securely deleted from the TRM. A method for determining, based at least upon an encrypted personalization data block, whether a TRM is part of a qualified set of TRM's to accept loading of an application is also provided. Thereafter, the method provides for loading the application onto the TRM only after the first step determines that the TRM is qualified to accept the loading of the application. A method is also provided for determining, based at least upon an encrypted personalization data block, whether a TRM is part of a qualified set of TRM's to accept deleting of an application. Thereafter, the method provides for deleting the application from the TRM only when the first step determines that the TRM is qualified to accept the deleting of the application.
U.S. Pat. No. 7,590,869, expressly incorporated herein by reference, provides an on-chip multi-core type tamper resistant microprocessor, which has a feature that, on the microprocessor package which has a plurality of instruction execution cores on an identical package and an ciphering processing function that can use a plurality of ciphering keys in correspondence to programs under a multi-task program execution environment, a key table for storing ciphering keys and the ciphering processing function are concentrated on a single location on the package, such that it is possible to provide a tamper resistant microprocessor in the multi-processor configuration that can realize the improved processing performance by hardware of a given size compared with the case of providing the key table and the ciphering processing function distributedly.
U.S. Pat. No. 7,739,517, expressly incorporated herein by reference, provides a secure hardware device which compares code image with a known good code image, using a co-processor separate from the processor, which halts execution of code until it is verified. Reference code or its signature is stored in secure, separate storage, but is not itself encrypted. The separate co-processor is not integrated into main processing pipeline to avoid significant delays.
U.S. Pat. No. 7,734,921, expressly incorporated herein by reference, provides a system and method for guaranteeing software integrity via combined hardware and software authentication. The system enables individual user devices to authenticate and validate a digital message sent by a distribution center, without requiring transmissions to the distribution center. The center transmits the message with an appended modulus that is the product of two specially selected primes. The transmission also includes an appended authentication value that is based on an original message hash value, a new message hash value, and the modulus. The new message hash value is designed to be the center's public RSA key; a corresponding private RSA key is also computed. Individual user devices combine a digital signet, a public modulus, preferably unique hardware-based numbers, and an original message hash to compute a unique integrity value K. Subsequent messages are similarly processed to determine new integrity values K′, which equal K if and only if new messages originated from the center and have not been corrupted.
U.S. Pat. No. 7,725,703, expressly incorporated herein by reference, provides Systems and methods for securely booting a computer with a trusted processing module (TPM). In a computer with a TPM, an expected hash value of a boot component may be placed into a platform configuration register (PCR), which allows a TPM to unseal a secret. The secret may then be used to decrypt the boot component. The hash of the decrypted boot component may then be calculated and the result can be placed in a PCR. The PCRs may then be compared. If they do not, access to the an important secret for system operation can be revoked. Also, a first secret may be accessible only when a first plurality of PCR values are extant, while a second secret is accessible only after one or more of the first plurality of PCR values has been replaced with a new value, thereby necessarily revoking further access to the first secret in order to grant access to the second secret.
U.S. Pat. No. 7,694,139, expressly incorporated herein by reference, provides a TPM for securing executable content. A software development system (SDS) executes on a computer having a TPM, and digitally signs software. The platform includes protected areas that store data and cannot be accessed by unauthorized modules. A code signing module executing in a protected area obtains a private/public key pair and a corresponding digital certificate. The SDS is configured to automatically and transparently utilize the code signing module to sign software produced by the system. End-user systems receive the certificate with the software and can use it to verify the signature. This verification will fail if a parasitic virus or other malicious code has altered the software.
U.S. Pat. No. 7,603,707, expressly incorporated herein by reference, provides a Tamper-aware virtual TPM, in which respective threads comprising a virtual TPM thread and a security-patrol threads are executed on a host processor. The host processor may be a multi-threaded processor having multiple logical processors, and the respective threads are executed on different logical processors. While the virtual TPM thread is used to perform various TPM functions, the security-patrol thread monitors for physical attacks on the processor by implementing various numerical calculation loops, wherein an erroneous calculation is indicative of a physical attack. In response to detection of such an attack, various actions can be taken in view of one or more predefined security policies, such as logging the event, shutting down the platform and/or informing a remote management entity.
U.S. Pat. No. 7,571,312, expressly incorporated herein by reference, provides methods and apparatus for generating endorsement credentials for software-based security coprocessors. A virtual manufacturer authority is launched in a protected portion of a processing system. A key for the virtual manufacturer authority is created. The key is protected by a security coprocessor of the processing system, such as a TPM. Also, the key is bound to a current state of the virtual manufacturer authority. A virtual security coprocessor is created in the processing system. A delegation request is transmitted from the processing system to an external processing system, such as a certificate authority (CA). After transmission of the delegation request, the key is used to attest to trustworthiness of the virtual security coprocessor.
U.S. Pat. No. 7,490,352, expressly incorporated herein by reference, provides systems and methods for verifying trust or integrity of executable files. The system determines that an executable file is being introduced into a path of execution, and then automatically evaluates it in view of multiple malware checks to detect if the executable file represents a type of malware. The multiple malware checks are integrated into an operating system trust verification process along the path of execution.
U.S. Pat. No. 7,490,250, expressly incorporated herein by reference, provides a system and method for detecting a tamper event in a trusted computing environment. The computer system has an embedded security system (ESS), a trusted operating system. A tamper signal is received and locked in the ESS. The trusted operating system is capable of detecting the tamper signal in the ESS.
U.S. Pat. No. 7,444,601, expressly incorporated herein by reference, provides a trusted computing platform, in which a trusted hardware device is added to the motherboard, and is configured to acquire an integrity metric, for example a hash of the BIOS memory of the computing platform. The trusted hardware device is tamper-resistant, difficult to forge and inaccessible to other functions of the platform. The hash can be used to convince users that that the operation of the platform (hardware or software) has not been subverted in some way, and is safe to interact with in local or remote applications. The main processing unit of the computing platform is directed to address the trusted hardware device, in advance of the BIOS memory, after release from 'reset'. The trusted hardware device is configured to receive memory read signals from the main processing unit and, in response, return instructions, in the native language of the main processing unit, that instruct the main processing unit to establish the hash and return the value to be stored by the trusted hardware device. Since the hash is calculated in advance of any other system operations, this is a relatively strong method of verifying the integrity of the system. Once the hash has been returned, the final instruction calls the BIOS program and the system boot procedure continues as normal. Whenever a user wishes to interact with the computing platform, he first requests the integrity metric, which he compares with an authentic integrity metric that was measured by a trusted party. If the metrics are the same, the platform is verified and interactions can continue. Otherwise, interaction halts on the basis that the operation of the platform may have been subverted.
U.S. Pat. No. 6,938,164, expressly incorporated herein by reference, provides a system and method for allowing code to be securely initialized in a computer. A memory controller prevents CPUs and other I/O bus masters from accessing memory during a code (for example, trusted core) initialization process. The memory controller resets CPUs in the computer and allows a CPU to begin accessing memory at a particular location (identified to the CPU by the memory controller). Once an initialization process has been executed by that CPU, the code is operational and any other CPUs are allowed to access memory (after being reset), as are any other bus masters (subject to any controls imposed by the initiated code).
U.S. Pat. No. 6,070,239, expressly incorporated herein by reference, provides a system and method for executing verifiable programs with facility for using non-verifiable programs from trusted sources. The system has a class loader that prohibits the loading and execution of non-verifiable programs unless (A) the non-verifiable program resides in a trusted repository of such programs, or (B) the non-verifiable program is indirectly verifiable by way of a digital signature on the non-verifiable program that proves the program was produced by a trusted source. Verifiable architecture neutral programs are Java bytecode programs whose integrity is verified using a Java bytecode program verifier. The non-verifiable programs are generally architecture specific compiled programs generated with the assistance of a compiler. Each architecture specific program typically includes two signatures, including one by the compiling party and one by the compiler. Each digital signature includes a signing party identifier and an encrypted message. The encrypted message includes a message generated by a predefined procedure, and is encrypted using a private encryption key associated with the signing party. A digital signature verifier used by the class loader includes logic for processing each digital signature by obtaining a public key associated with the signing party, decrypting the encrypted message of the digital signature with that public key so as generate a decrypted message, generating a test message by executing the predefined procedure on the architecture specific program associated with the digital signature, comparing the test message with the decrypted message, and issuing a failure signal if the decrypted message digest and test message digest do not match.
U.S. Pat. No. 5,944,821, expressly incorporated herein by reference, provides a secure software registration and integrity assessment in a computer system. The method provides secure registration and integrity assessment of software in a computer system. A secure hash table is created containing a list of secure programs that the user wants to validate prior to execution. The table contains a secure hash value (i.e., a value generated by modification detection code) for each of these programs as originally installed on the computer system. This hash table is stored in protected memory that can only be accessed when the computer system is in system management mode. Following an attempt to execute a secured program, a system management interrupt is generated. An SMI handler then generates a current hash value for the program to be executed. In the event that the current hash value matches the stored hash value, the integrity of the program is guaranteed and it is loaded into memory and executed. If the two values do not match, the user is alerted to the discrepancy and may be given the option to update or override the stored hash value by entering an administrative password.
U.S. 2008/0215920, expressly incorporated herein by reference, provides a processor which generates a signature value indicating a sequence of executed instructions, and the signature value is compared to signature values calculated for two or more possible sequences of executed instructions to determine which instruction sequence was executed. The signature is generated via a signature generator during program execution, and is provided external to the processor via a signature message. There is, in this system, no encryption of a stored signature, nor use of a secret key. The trace message storage unit is operable to store instruction pointer trace messages and executed instruction signature messages. The trace message storage unit is also operable to store messages in at least one of an on-chip or an off-chip trace memory. The executed instruction signature unit is operable to generate a cache line content signature. The signature may be generated via a signature generator during program execution, and provided external to the processor via a signature message such as by using a trace memory or buffer and a tool scan port.
FIG. 1 of U.S. Patent Application 2008/0215920 (prior art) is a block diagram of a computer system, as may be used to practice various embodiments of the invention. A computer system 100 is in some embodiments a general-purpose computer, such as the personal computer that has become a common tool in business and in homes. In other embodiments, the computer 100 is a special purpose computer system, such as an industrial process control computer, a car computer, a communication device, or a home entertainment device. The computer comprises a processor 101, which is operable to execute software instructions to perform various functions. The memory 102 and processor 101 in further embodiments include a smaller, faster cache memory which is used to store data that is recently used, or that is believed likely to be used in the near future. The software instructions and other data are stored in a memory 102 when the computer is in operation, and the memory is coupled to the processor by a bus 103. When the computer starts, data stored in nonvolatile storage such as a hard disk drive 104 or in other nonvolatile storage such as flash memory is loaded into the memory 102 for the processor's use.
In many general purpose computers, an operating system is loaded from the hard disk drive 104 into memory and is executed in the processor when the computer first starts, providing a computer user with an interface to the computer so that other programs can be run and other tasks performed. The operating system and other executing software are typically stored in nonvolatile storage when the computer is turned off, but are loaded into memory before the program instructions can be executed. Because memory 102 is significantly more expensive than most practical forms of nonvolatile storage, the hard disk drive or other nonvolatile storage in a computerized system often stores much more program data than can be loaded into the memory 102 at any given time. The result is that only some of the program data stored in nonvolatile memory for an executing program, operating system, or for other programs stored in nonvolatile memory can be loaded into memory at any one time. This often results in swapping pieces of program code into and out of memory 102 from the nonvolatile storage 104 during program execution, to make efficient use of the limited memory that is available.
Many modern computer systems use methods such as virtual memory addresses that are mapped to physical memory addresses and paged memory to manage the limited available physical memory 102. Virtual memory allows use of a larger number of memory address locations than are actually available in a physical memory 102, and relies on a memory management method to map virtual addresses to physical memory addresses as well as to ensure that the needed data is loaded into the physical memory. Needed data is swapped into and out of physical memory as needed by loading memory in pages, which are simply large segments of addressable memory that are moved together as a group. Memory management units within the processor or chipset architecture can also change the contents of memory or cache during program execution, such as where new data is needed in memory or is predicted to be needed and the memory or cache is already full.
An executing program may complete execution of all the needed program instructions in a particular page loaded into memory, and proceed to execute more instructions stored in another page. In a typical example, the previously executing page is swapped out of memory and the page containing the newly needed program code is loaded into memory in its place, enabling the processor to continue to execute program instructions from memory. This not only complicates memory management, but complicates debugging executing software as the program code stored in any particular physical memory location might be from any number of different pages with different virtual addresses. Further, program code loaded into memory need not be stored in the same physical memory location every time, and the actual physical address into which a program instruction is stored is not necessarily unique.
US 2009/0217050, expressly incorporated herein by reference, provides systems and methods to optimize signature verification time for a cryptographic cache. Time is reduced by eliminating at least some of the duplicative application of cryptographic primitives. In some embodiments, systems and methods for signature verification comprise obtaining a signature which was previously generated using an asymmetrical cryptographic scheme, and determining whether an identical signature has previously been stored in a signature cache. If an identical signature has been previously stored in the signature cache, retrieving previously generated results corresponding to the previously stored identical signature, the results a consequence of application of cryptographic primitives of the asymmetrical cryptographic scheme corresponding to the identical signature. The results are forwarded to a signature verifier. In at least some embodiments, at least one of these functions occurs in a secure execution environment. Examples of a secure execution environment, without limitation, include an ARM TRUSTZONE® architecture, a trusted platform module (TPM), Texas Instruments' M-SHIELD™ security technology, etc. Secure execution environment comprises signature cache and at least a portion of security logic. Security logic in turn comprises signature look-up, calculator, hash function and signature verifier, although it should be readily apparent that more or different functions and modules may form part of security for some embodiments. The device obtains the signature (and message) from unsecure environment and promptly presents them to security logic for vetting. Embodiments employ signature look-up to check signature cache to determine whether the specific signature has been presented before. If the specific signature has indeed been previously presented, signature look-up retrieves the corresponding results of the previous utilization of cryptographic primitives corresponding to the relevant digital signature scheme being employed, which results were previously stored at the identified location in signature cache, and forwards the results to signature verifier. Among those results is the hash value of the previous message that is part of the previous signature. Signature verifier calls hash function to perform a hash on newly obtained message, and compares the hash value of the newly obtained message with the hash value retrieved from signature cache. If there is a match, the signature is verified and the message is forwarded for further processing, e.g., uploading into NVM or RAM as the case may be, etc. Thus, execution is commenced after verification.
Vivek Haldar, Deepak Chandra and Michael Franz, "Semantic Remote Attestation—A Virtual Machine directed approach to Trusted Computing", USENIX Virtual Machine Research and Technology Symposium, May 2004, provides a method for using language-based virtual machines which enables the remote attestation of complex, dynamic, and high-level program properties, in a platform-independent way.
Joshua N. Edmison, "Hardware Architectures for Software Security", Ph.D Thesis, Virginia Polytechnic Institute and State University (2006), proposes that substantial, hardware-based software protection can be achieved, without trusting software or redesigning the processor, by augmenting existing processors with security management hardware placed outside of the processor boundary. Benefits of this approach include the ability to add security features to nearly any processor, update security features without redesigning the processor, and provide maximum transparency to the software development and distribution processes.
Bryan Parno Jonathan M. McCune Adrian Perrig, "Bootstrapping Trust in Commodity Computers", IEEE Symposium on Security and Privacy, May 2010, provides a method for providing information about a computer's state, as part of an investigation of trustworthy computing.
A cryptographic hash function is a deterministic procedure that takes an arbitrary block of data and returns a fixed-size bit string, the (cryptographic) hash value, such that an accidental or intentional change to the data will change the hash value. The data to be encoded is often called the "message", and the hash value is sometimes called the message digest or simply digest. The ideal cryptographic hash function has four main or significant properties: it is easy to compute the hash value for any given message, it is infeasible to find a message that has a given hash, (and thus there is an asymmetry between encoding and decoding), it is infeasible to modify a message without changing its hash, and, it is infeasible to find two different messages with the same hash. Cryptographic hash functions have many information security applications, notably in digital signatures, message authentication codes (MACs), and other forms of authentication. They can also be used as ordinary hash functions, to index data in hash tables, for fingerprinting, to detect duplicate data or uniquely identify files, and as checksums to detect accidental data corruption. Indeed, in information security contexts, cryptographic hash values are sometimes called (digital) fingerprints, checksums, or just hash values, even though all these terms stand for functions with rather different properties and purposes.
In cryptography, MD5 (Message-Digest algorithm 5) is a widely used cryptographic hash function with a 128-bit hash value. Specified in RFC 1321 (expressly incorporated herein by reference), MD5 has been employed in a wide variety of security applications, and is also commonly used to check the integrity of files. However, it has been shown that MD5 is not collision resistant; as such, MD5 is not suitable for applications like SSL certificates or digital signatures that rely on this property. An MD5 hash is typically expressed as a 32-digit hexadecimal number. The SHA-2 family of hash functions may also be used, which have a higher level or security.
Most cryptographic hash functions are designed to take a string of any length as input and produce a fixed-length hash value. A cryptographic hash function is ideally able to withstand cryptanalytic attack. As a minimum, it should have the following properties: Preimage resistance: Given a hash h, it should be hard to find any message m such that h=hash(m). This concept is related to that of a one-way function. Functions that lack this property are vulnerable to preimage attacks. Second preimage resistance: Given an input m1 it should be hard to find another input m2, where m1≠m2, such that hash(m1)=hash(m2). This property is sometimes referred to as weak collision resistance, and functions that lack this property are vulnerable to second preimage attacks. Collision resistance: It should be hard to find two different messages m1 and m2 such that hash(m1)=hash(m2). Such a pair is called a cryptographic hash collision, a property which is sometimes referred to as strong collision resistance. It requires a hash value at least twice as long as that required for preimage-resistance, otherwise collisions may be found by a so-called birthday attack. These properties imply that a malicious adversary cannot replace or modify the input data without changing its digest. Thus, if two strings have the same digest, one can be very confident that they are identical.
Ideally, one may wish for even stronger conditions. It should be impossible for an adversary to find two messages with substantially similar digests; or to infer any useful information about the data, given only its digest. Therefore, a cryptographic hash function should behave as much as possible like a random function while still being deterministic and efficiently computable. Checksum algorithms, such as CRC32 and other cyclic redundancy checks, are designed to meet much weaker requirements, and are generally unsuitable as cryptographic hash functions. See, en.wikipedia.org/wiki/Cryptographic_hash_function.
An important application of secure hashes is verification of message integrity. Determining whether any changes have been made to a message or file, for example, can be accomplished by comparing message digests calculated before, and after, transmission (or any other event). For this reason, most digital signature algorithms only confirm the authenticity of a hashed digest of the message to be "signed". Verifying the authenticity of a hashed digest of the message is considered proof that the message itself is authentic. One of the main applications of a hash function is to allow the fast look-up of a data in a hash table.

System and method for validating program execution at run-time using control flow signatures

The Research Foundation for The State University of New York