A support is designed to receive an operation microscope. This support has a support column, movable around a rotation axis, with a first carrier arm and a second carrier arm which, with respect to the first carrier arm, can be moved around a first pivot axis and a second pivot axis. A cable connection is provided for producing a restoring force for the second carrier arm, and couples the second carrier arm to a counterweight for producing a restoring force around the second pivot axis. The counterweight is arranged in the region of the support column, to minimize inertial action accompanying a movement of the support around the rotation axis. A freewheel rotary joint is provided in the cable connection to suppress a feedback to the counterweight of a movement of the second carrier arm around the first pivot axis.

The invention relates to a support, in particular a support to receive a medical device, for example an operation microscope, with a first carrier arm and a second carrier arm, the second carrier arm being mounted on a first shaft and a second shaft for pivoting with respect to the first carrier arm, and coupling means are provided which couple the second carrier arm to a means for the production of a restoring force around at least one of the shafts.
Technical Field
Such a support is known from U.S. Pat. No. 5,494,034. A floor support is described there which includes a support column on which a carrier apparatus with a first and a second carrier arm is arranged. The first carrier arm is rotatably mounted on the support column. The second carrier arm is pivotably fastened to an end region of the first carrier arm and is movable with respect to two axes orthogonal to the first carrier arm. U.S. Pat. No. 5,494,034 furthermore discloses a ceiling support with a support column which is secured to a ceiling. A compensating weight is provided on this support column, and is received on a lever arm and with this can be rotated around the support column. This lever arm is coupled to a carrier arm device of first and second carrier arms by means of a toothed belt transmission. The first carrier arm of the carrier arm device is pivotably mounted on the support column. The second carrier arm is furthermore pivotably arranged on the first carrier arm. A medical device is mounted on the second carrier arm. The weight of the medical device received on the second carrier arm is fully compensated by means of the compensating weight.
A support for an operation microscope is described in EP 0 293 228 B1 in which a rod mechanism is provided for coupling the operation microscope and counterweights. By means of these counterweights it is possible to balance the support, and thus to move the operation microscope substantially free of weight forces.
A floor support with weight compensation to receive an operation microscope is known from WO 97/13997. This support has a support column on which a carrier arm device with first and second carrier arms is received. The first carrier arm is pivotably fastened to the support column. The second carrier arm is furthermore rotatably mounted on the first carrier arm. The operation microscope is received in an end region of the second carrier arm. Respective counterweights are provided on the first and second carrier arm to compensate the weight acting on the operation microscope. These counterweights balance the first and second carrier arms on the principle of a beam balance.


A Web browser (210) is configured to run in a middle compartment (206) of a Compartmented Mode Workstation (CMW) (200). The operation of the Web browser (210) is prevented from accessing or damaging other compartments of the CMW machine (200) as a result of mandatory access control (MAC), which is configured appropriately.

The present invention relates in general to computerised systems for down-loading, or xe2x80x98browsingxe2x80x99, information stored in computer-readable form. More particularly, although not exclusively, the invention relates to a browser system for browsing information that contains mobile code retrievable from the World Wide Web.
The World Wide Web (Web) may be thought of as a global village where computers (hosts) are the buildings, and the worldwide computer network known as the Internet forms the streets. The computers have addresses (IP Addresses) consisting of four numbers separated by periods. Many hosts also have nicknames known as domain names. A Web site typically consists of a UNIX or Microsoft Windows based Web server, which runs on a host and xe2x80x98servesxe2x80x99 software or content to other computers accessing the Web site. A Web site is not a single application, but a system that provides access to applications and data stored on the host, as well as inside an organisation. A user utilises a Web xe2x80x98browserxe2x80x99 running on a client computer to access the software or content on the Web server.
FIG. 1 illustrates a client computer 100 executing a Web browser program 105 that is employed by a user to communicate over the Internet 110, in a special language called HyperText Transfer Protocol (HTTP) 115, with a host computer 120 executing a Web server program 125 to obtain data. Hereafter, the term xe2x80x98Web browserxe2x80x99 may be used interchangeably to describe a Web browser program or the program in execution on a computer, depending on the context. In the diagram, and in following diagrams, solid connection lines represent physical connections between hardware and broken connection lines represent logical connections between software processes. The most basic Web transaction involves the transmission of Web pages, written in HyperText Markup Language (HTML) from the Web server 125 to the Web browser 105. Upon request by the user at the Web browser 105, the Web server 125 translates the HTML-based Web page into HTTP and sends it over the Internet 110 for display as a Web page on the requesting browser 105. The Web browser 105 receives the HTTP-encoded Web page, translates the HTTP back into HTML and displays the page.
The concept of xe2x80x98mobile codexe2x80x99 has been developed to extend the functionality of the Web. Mobile code is typically code associated with a Web page which, when downloaded from a Web server, automatically executes within the environment of the requesting Web browser. In a simple form, mobile code can be used to enhance the graphical appearance of a Web page by, for example, implementing simple animation. It is envisaged, however, that mobile code will be used to implement many different and far more complex functions in future. A good example of one use for mobile code is to download transactional clients, which support specialised user interfaces, to support data transfer between client and server applications.
Commonly, mobile code is written in the Java programming language as a Java applet. Mobile code may also be written in other languages, such as defined in the ActiveX model. Both Java applets and ActiveX control functions can be embedded into a standard Web page. Therefore, the simple operation of downloading a Web page can also download and activate associated mobile code.
While mobile code can greatly extend the functionality of the Web, the same extended functionality, by its nature, leads to serious security issues.
Mobile code, and Web browsers that run mobile code, are developed according to rigid security guidelines which are intended to prevent the possibility that malicious users can use mobile code to cause harm to the computing environment surrounding a Web browser. However, there are already many documented flaws in the security measures, which can lead to devastating results. Typically, the party downloading xe2x80x98roguexe2x80x99 mobile code would be unaware of the damaging effect thereof until it was too late.
Some serious mobile code attacks known take advantage of bugs in the mobile code processing environment of the Web browser, which allow the mobile code to gain control over the operating system of the computing platform. From this position, the mobile code could cause damage such as deleting all files on the computer, or even launching attacks on other, networked computing platforms.
Other serious mobile code attacks are known as xe2x80x98social engineeringxe2x80x99 attacks. These attacks rely on tricking an unwary user by, for example, sending the user a xe2x80x98patchxe2x80x99 for the Web browser, and suggesting that the patch is to remedy a security flaw in the Web browser. The patch, instead of being one that remedies a security flaw, actually overwrites good code with code that creates a security flaw. There are many other ways of tricking unwary users in this way.
Web browsers, which can run mobile code, such as Netscape Navigator(trademark), typically include the option to xe2x80x98disablexe2x80x99 mobile code processing, thereby preventing the potential for any damage, even if mobile code is downloaded. Of course, this radical measure, whilst being very effective, also removes any benefit which can be obtained from genuine, safe mobile code.
It would therefore be desirable to have a system in which mobile code can be executed safely, while at the same time not allowing rogue mobile code to cause any damage to any system.
In accordance with a first aspect, the present invention provides a browser system, comprising a browser process configured to receive from a remote data source a resource incorporating mobile code and to process the mobile code to generate graphical output data; and
an interface process configured to provide a communications channel between the browser process and a remote display system to facilitate transfer of the graphical output data to the remote display system.
The term browser is commonly associated with complex and sophisticated programs such as Netscape Navigator(trademark) or Internet Explorer(trademark). These programs are well known. However, herein, the term browser is used more broadly to include any program or system which, when running, is able to receive a requested resource, for example a Web page, from a source such as a Web server connected via a communications network to the browser. Further, a browser according to the present invention can even receive unsolicited resources as a result of, for example, some form of xe2x80x98pushxe2x80x99 technology, which distributes resources or messages to registered subscribers.
The invention has the advantage that mobile code is processed in a secure environment, so that the client, which is apart from the environment, remains relatively safe from attack. The client only receives data from the browser to visualise the output of the processing of the mobile code on the browser. The client is, therefore, in effect able to access mobile code, and see the result of the processing of the mobile code, without being subjected to any threat from rogue mobile code.
In a preferred embodiment of the present invention, the browser system comprises a secure operating system, for example one which enforces Mandatory Access Control (MAC), such that mobile code and the browser are unable to damage the system running the browser, let alone the client.
While the invention, in general, aims to protect user systems from rogue mobile code, and from vulnerable browsers running rogue mobile code, embodiments which employ secure operating systems, such as those providing MAC, can be configured to also provide a high level of protection to the computer platform that supports the browser running the mobile code. Such systems consequently can provide even more protection to users"" systems, by greatly reducing the risk of mobile code reaching users"" systems, or other parts of the network, by some other route.
Other aspects and features of the invention are described and claimed hereafter.

Abstract: The Web browser (210) communicates with Web servers (252) attached to the internet (240), the Internet being connected to an outside compartment of the CMW machine (210), via a trusted outside process (TPO) (214). TPO (214) has the privileges required to override MAC. The Web browser (210) communicates with a display server (232), which is attached to an inside compartment (204) of the CMW machine (210), via a trusted inside process (TPI) (204). TPI also has privileges to override MAC. The Web browser (210) can request and receive Web pages incorporating mobile code, and can process the mobile code safely within the middle compartment (206). As a result of processing the mobile code, the Web browser (210) sends only X-messages to the display server (232), in order that the display server can render the images resulting from the processed mobile code.


A method for secure conversion between two different random markings used for cryptographic functions, converts a first binary data word, masked by a binary mask word according to a first masking process, into a corresponding second binary data word, masked by said binary mask word according to a second masking process, the first and second binary data words and the binary mask word including corresponding pluralities of bits, wherein each of the pluralities of the bits includes a least significant bit, a first bit, and at least one i-th bit i≧2.

Cryptographic functions dealing with secret keys, such as, for example, block ciphers or message authentication codes, can be implemented either in software or in hardware on microelectronic data-processing devices such as, for example, Integrated Circuit (IC) chip cards (sometimes also referred to as "smart cards").
During the execution of a generic cryptographic function, sensitive data depending on the secret key(s) are processed, sent over the internal links of the IC, and stored in the internal memories of the data-processing device.
In the attempt to prevent unauthorized people from fraudulently getting knowledge of the cryptographic secret key(s) or other sensitive information by tampering, tamper-resistant IC chips are produced: in such IC chips, special physical countermeasures are specifically provided for, in order to protect the underlying IC against tampering, such as, for example, protective layers and various sensors, detectors, and filters.
However, even in tamper-resistant IC chips, sensitive information may leak out through various side channels, such as, for example, by measuring signal timings, power consumption, and radiated electromagnetic energy, as well as by monitoring the signals by microprobing.
This leakage of information poses a serious problem: a good cryptographic function generally satisfies the requirement that it should be computationally infeasible to reconstruct the secret key from the knowledge of input/output data, but one such requirement is normally not necessarily satisfied if intermediate sensitive data, generated during the execution of the cryptographic function, are revealed.
Recovering the secret key from intermediate sensitive data that may leak out through any possible side channel during the execution of the cryptographic function is the objective of various cryptanalytic attacks, which are referred to as side-channel attacks. Therefore, there is a need to protect intermediate sensitive data that are generated during the execution of the cryptographic function which, when leaking out, may enable unauthorized third parties fraudulently reconstructing the secret key.
The side-channel attacks do not change the functionality of the device that implements the cryptographic process, and are typically not invasive. Power analysis attacks (proposed for example in P. Kocher et al., "Differential power analysis," Advances in Cryptology—Crypto '99, Lecture Notes in Computer Science, vol. 1666, pp. 388-397, 1999) are very powerfill, as they do not require expensive resources; moreover, most implementations of cryptographic functions, especially in software, are vulnerable to such attacks, unless specific countermeasures are incorporated.
In particular, in the class of power analysis attacks, the so-called (first-order) Differential Power Analysis (DPA) attacks are especially practically important as they use a relatively simple statistical technique that is almost independent of the implementation of the cryptographic algorithm. They require measuring the power consumption of the cryptographic algorithm for a number of known inputs (or known outputs). Other, more sophisticated statistical analysis of power consumption curves may also be feasible.
The basis of power analysis attacks are elementary computations within the device used to implement the cryptographic function (the cryptographic device), computations which depend on the secret key information and on the known input and/or output information. If, in addition, the power consumption corresponding to these elementary computations depends on the values being computed, then the cryptographic device's power consumption curves contain information about the secret key, and such information may be extracted by statistical techniques, so as to reconstruct the secret key.
Software implementations of cryptographic functions, in which the operations are synchronized by the clock of the data processing unit, usually a microprocessor, running the algorithm that implements the cryptographic function, are especially vulnerable to power analysis attacks.
Hardware implementations of cryptographic functions are also potentially vulnerable to power analysis attacks, although a higher sampling frequency may be required for obtaining the power consumption curves.
A general algorithmic strategy to counteract power analysis attacks is to randomize the computations that depend on the secret key, by masking the original data with random masks, and by modifying the computations accordingly. This can be done for software or hardware implementations. An approach of this type, given in L. Goubin and J. Patarin, "DES and differential power analysis—The duplication method," Cryptographic Hardware and Embedded Systems—CHFS '99, Lecture Notes in Computer Science, vol. 1717, pp. 158-172, 1999, proposes a data splitting technique to protect implementations of DES and other block ciphers against DPA attacks, where the input message as well as all intermediate data are each split into two parts, so that the original data can be recovered by the bitwise XOR or some other appropriate operation. The nonlinear parts of the algorithm, such as the S-boxes, are implemented by appropriate lookup tables of increased size (in Read Only Memory—ROM).
US patent application No. US 2001/0053220 A1 contains a similar proposal, except that the data parts can also be bit-permuted. The nonlinear parts of the algorithm, such as the S-boxes, can be implemented as lookup tables being updated accordingly (in Random Access Memory—RAM).
The Applicant points out that data splitting technique is essentially equivalent to random masking technique investigated in T. Messerges, "Securing the AES finalists against power analysis attacks," Fast Software Encryption—FSE 2000, Lecture Notes in Computer Science, vol. 1978, pp. 150-164, 2001, except that in the latter, instead of performing duplicate computations on data shares, one performs a modified computation involving original data and random masks applied. All three mentioned approaches are primarily intended for software implementations.
An alternative way of dealing with power analysis attacks is making use of a special encoding of data that tends to balance the power consumption, for example, by representing the data through binary vectors with a fixed number of ones, such as the dual-rail encoding. In particular, US patent application No. US 2003/0140240 A1 describes a technique for protecting hardware implementations of cryptographic algorithms against power analysis attacks on the logic gate level, where the power consumption is balanced by encoding of all data by binary vectors with a fixed number of ones and by balancing the logic gate transitions.
In order to prevent the DPA attack on a microelectronic device implementing a cryptographic algorithm by means of a digital IC, it is sufficient to ensure that every elementary computation involving the secret information and performed by a logic gate is randomized. More precisely, the general condition to be satisfied is that the output value of each logic gate in the protected hardware design should have the same probability distribution for each given, fixed value of the secret key and input data. In other words, the output value of each logic gate in the digital IC that implements the cryptographic algorithm should be statistically independent of the secret key and input data. Here and throughout the present description this mathematical condition is referred to as the "secure computation condition", and is first explicitly proposed in J. Golić, "DeKaRT: A new paradigm for key-dependent reversible circuits," Cryptographic Hardware and Embedded Systems—CHES 2003, Lecture Notes in Computer Science, vol. 2779, pp. 98-112, 2003). The necessary uncertainty is provided by using purely random masks, preferably produced by a fast random number generator implemented in hardware, and integrated in the IC chip.
It is observed that a secure computation on the word level, in software, in general does not imply a secure computation on the bit level, in hardware, although the word-level security may provide more resistance to more sophisticated power analysis attacks such as, for example, the higher-order DPA attacks. In practice, the secure computation condition on the bit level is necessary for providing resistance to (the first-order) DPA attacks and is also likely to be sufficient, although individual logic gates do not achieve their final (random) values simultaneously and, in the transition stage, their output values may vary (randomly) and may depend on their previous inputs. This effect is also present in software implementations and, in fact, generally makes the power analysis of non-masked implementations more difficult, especially so for logic circuit implementations in hardware.
The masking operation that combines the data (input, output, and intermediate) with a random mask is typically adapted to the nature of the mathematical operations used in the cryptographic algorithm, because in this way the required modifications in the computations are minimized.
More precisely, let it be assumed that in some elementary computation in the cryptographic algorithm, x and y form the inputs to a logic gate, which combines together these inputs into an output z by using a group operation & according to: x & y=z (a group operation being, according to the group theory, an operation, defined on a set, that is associative, has an identity element and is such that every element of the set has an inverse element). Using any group operation for masking is sufficient to perfectly randomize the data; thus, let it be assumed that the inputs x and y are randomized by the same group operation & and by using the random masks rx and ry, respectively. Then, in view of:(x & rx)&(y & ry)=(x & y)&(rx & ry)=z &(rx & ry),the resulting output z is thus automatically randomized by the mask rz=rx & ry, so that the computation does not need not to be modified.
More generally, if z=ƒ(x,y), for a given function ƒ (not necessarily a group operation), and if it is desired to obtain a masked output z & rz from masked inputs x & rx and y & ry, then the function ƒ (and thus the computations) has to be modified into a new function h determined by h(x,y)=ƒ(x & rx, y & ry) & rz, and the problem is how to compute this function h securely.
Consequently, in the masked cryptographic algorithm, only the elementary computations different from the underlying group operation &, which is exploited for the masking process, have to be modified.
In general, the group operations on binary words most frequently used in cryptographic algorithms are the bitwise eXclusive OR (XOR) and the addition modulo an integer which is a power of 2. In view of the fact that the XOR of two binary values actually corresponds to their addition modulo 2, the bitwise XOR and the addition modulo 2n of two n-bit words x and y, are hencetoforth denoted as x+2y and x+ny, respectively.
The above-cited paper by J. Golic describes a general theoretical framework for the protection against DPA attacks by XOR random masking on the logic gate (i.e., hardware) level. A hardware technique, that is, a logic circuit for XOR random masking of a 2-input (MUltipleXer) MUX gate, with a control input selecting which one of the two data inputs is to be taken to the output, is proposed in U.S. Pat. No. 6,295,606 B1 and is meant to be used for masking lookup table implementations of Boolean functions to be used in cryptographic algorithms. However, the secure computation condition as defined above cannot be found in U.S. Pat. No. 6,295,606 B1. Another hardware technique for random masking of logic gates is proposed in German patent No. DE 10201449 C1, but the Applicant observes that the technique is flawed as it does not satisfy the secure computation condition defined above.
In many algorithms, the x+2y and x+ny operations, along with other Boolean and integer operations, are combined together for the cryptographic security. The best-known examples are the widely used cryptographic hash function SHA-1 (National Institute of Standards and Technology, FIPS Publication 180-1, Secure Hash Standard, 1994), the block cipher IDEA (X. Lai and J. Massey, "A proposal for a new block encryption standard," Advances in Cryptology—Eurocrypt '90, Lecture Notes in Computer Science, vol. 473, pp. 398-404, 1991), and the block cipher RC6 (R. L. Rivest et al., "The RC6 block cipher," v.1.1, August 1998, available at http://www.rsasecurity.com/rsalabs/rc6). The SHA-1 incorporates a secret key if it is used for message authentication, for example, in the so-called HMAC construction. In such algorithms, it is convenient to use both of the above-mentioned group operations (x+2y and x+ny) for random masking.
The random masking based on the addition modulo 2n is commonly called "arithmetic masking", whereas the random masking based on the addition modulo 2 (or bitwise XOR) is commonly called "Boolean masking".
Therefore, there is a need to convert between the two corresponding masks in a computationally secure way, that is, in a way secure against power analysis attacks such as DPA. Namely, given an n-bit data word x and an n-bit random masking word (random mask) r, the problem is to compute securely x+nr starting from x+2r, and vice versa.
Previously proposed solutions to the mask conversion problem are essentially software instead of hardware oriented, meaning that the elementary computations considered are based on words rather than individual bits. According to them it appears that the conversion from arithmetic masking to Boolean masking is inherently more difficult than the conversion from Boolean masking to arithmetic masking. More precisely, in L. Goubin, "A sound method for switching between Boolean and arithmetic masking," Cryptographic Hardware and Embedded Systems—CHES 2001, Lecture Notes in Computer Science, vol. 2162, pp. 3-15, 2001, two solutions are proposed: one for the conversion from Boolean to arithmetic masking, and the other for the conversion from arithmetic to Boolean masking. The first solution requires seven n-bit word operations and an auxiliary n-bit random masking word, namely, five bitwise XOR operations and two subtractions modulo 2n. The second solution is much less efficient and requires 5(n+1) n-bit word operations and an auxiliary n-bit random masking word. For comparison, note that the direct conversion of the masks can be achieved by one +2 and one +n n-bit word operation, but is not computationally secure.
Another software-oriented solution for the conversion from arithmetic masking to Boolean masking is proposed in J.-S. Coron and A. Tcbulkine, "A new algorithm for switching from arithmetic to Boolean masking," Cryptographic Hardware and Embedded Systems—CHES 2003, Lecture Notes in Computer Science, vol. 2779, pp. 89-97, 2003. The proposed solution requires certain precomputation and storage and some auxiliary random masking bits, but can be more efficient than the solution described above, depending on the processor word size.

Method and related device for hardware-oriented conversion between arithmetic and boolean random masking


A public graphic library coupled to a WAN offers access to a database of graphics, while another graphic library inside the firewall of an enterprise network provides graphics to users in an enterprise. Transferring graphics from the public graphic library to the enterprise graphic library enables enterprise users to access content residing on the public graphic library while the enterprise network is disconnected or otherwise isolated from the WAN. A remote library director in a drawing software program directs communication between a user computer and either the public graphic library or the enterprise graphic library. The configuration of this director specifies the library from which a user accesses graphics.

Computer programs are widely available for creating drawings and other documents with graphic content. These programs incorporate a variety of tools to aid a user in creating and manipulating graphics, such as icons, images, drawings, diagrams, clip art, artwork, pictures, symbols, line drawings, and similar visual content through a computer and its associated user interface ("UI"). In addition to creating graphics from scratch, a user may acquire a predefined graphic from a graphic database and subsequently customize its color, size, orientation, shape, or other feature.
Suppliers of graphics frequently supply graphic databases written onto one or more compact disk read-only memory ("CD-ROM") devices or similar optical medium. Configuring the graphics in the database in an industry-standard format facilitates compatibility with software programs from a wide range of vendors. Alternatively, a software vendor may supply a proprietary graphic database coupled to a drawing software package. The process of installing the drawing software onto a computer loads the graphic database onto the computer's hard drive so a user can quickly access the database's graphics.
In addition to providing a graphic database installed on a user's hard drive, a software vendor may provide access to a central graphic database over a wide-area network ("WAN"). For example, a vendor may offer access over the Internet, which is a WAN, to a public database of graphic content using a configuration that provides exclusive access to users of the vendor's software. A module in the software that is resident on the user's computer directs the software to communicate over the Internet with the vendor's site when the user requests graphic content. The vendor may regularly append and update the public database to enhance the value of the graphic database to its customers and to adapt to trends in the graphic preferences of users.
While conventional WAN-based public graphic databases are suited to graphic updates, the graphic file sizes can impede the speed with which a remote user accesses graphics from such a database. To address file transfer speed limitations, the communication link between the user and the remote database may include an application server page ("ASP") that functions as a database gateway and facilitates expeditious information transfer. The ASP accepts user search requests, communicates with a server to seek graphics that meet the search terms, and returns metadata to the user. If a user determines that a graphic is acceptable based on the metadata, the user may elect to download the full graphic file.
Although relaying metadata through ASPs promotes efficient transfer of graphics, such transfer is generally implemented over a WAN, such as the Internet. Data that is transferring across such a WAN encounters potential time delays associated with the physical expanse of the WAN, communication bottlenecks such as WAN access interfaces, and other communication impediments.
Another problem with typical WAN-based graphic databases is that all users do not have the Internet connectivity generally associated with accessing the database. Certain enterprises have internal computer networks that are disconnected, locked down, or otherwise isolated from the Internet or other WAN. Some users' connectivity may be intermittent, slow, or unreliable. Furthermore, a fault in the WAN communication link between the user and the WAN-based graphic can disrupt a user's database access.
In addition to having communication-related limitations, WAN-based graphic databases are usually public databases that offer the same content to all the users that they serve. The content is often optimized to maximize the number of graphic choices that are available to users. Such databases generally lack provisions to provide a user with custom graphics or graphic sets that are specifically tailored to meet the standardization requirements of a specific user or set of users. That is, conventional WAN-based databases are usually incompatible with the needs of enterprises that seek to provide their internal users with a standard, consistent graphic set.
To address these representative deficiencies in the graphic database art, what is needed is a capability for managing graphic databases that serves users that are disconnected or otherwise isolated from the Internet or other WAN. Further a capability is needed to provide enterprise-based users with graphic sets that are tailored to meet specific content needs of the enterprise. Such capabilities would benefit users that need graphic content for insertion into drawings and other documents.


A valve assembly is shown having a valving member situated generally in the path of flow of a fluid which varies in pressure and urges the valving member in generally the same direction as the flow of the fluid; a spring is shown resiliently resisting the movement of the valving member by the flow of fluid; as the valving member is urged in the direction of the flow of the fluid the valving member reduces the effective flow area of the valve assembly through which area the fluid is to flow; the valve assembly features low hysteresis, resistance to plugging by debris in system, is flow sensitive activating at higher pressure differential as flow is increased and it may incorporate a fail safe feature reopening in case of spring failure; flow noise attenuation is also a feature.

Heretofore, in fluid flow systems wherein it was desired to restrict the flow in a line, it was common practice by the prior art to employ a simple fixed area flow restrictor, where possible, for such reasons as reduction or elimination of moving parts, the ability for exact sizing, simplicity and comparatively low cost. However, this approach by the prior art, usually required undesirable compromises when in comparison substantially improved system efficiency would result if a practical, low-cost, variable size flow restriction were available.
For example, in automotive air conditioning systems, it has been common practice in the prior art to employ a fixed restriction, such as an orifice or capillary tube in the high-pressure liquid line (conduit) between the condenser and evaporator. The refrigerant flow is primarily dependent on the inlet pressure at the orifice and the amount of liquid subcooling or quality. Quality, here, is defined as the percentage of gas in the refrigerant at the orifice inlet. Since the orifice tube flow is sonic, or "choked", suction pressure generally is not a factor in determining flow during normal system operation. Increasing inlet pressure or subcooling increases flow while increasing gas at the inlet decreases flow. These characteristics make the fixed orifice tube or capillary tube self regulating and produces adequate performance in a wide range of conditions encountered in normal automotive air conditioner operation. However, since the introduction of this type of refrigerant flow control in automobiles in 1973, efforts have continued to develop a viable variable orifice valve in an effort to improve its performance during periods of idle and low speed vehicular engine operation. Current systems use an orifice tube 1.5 inches (3.81 cm.) long by 0.060 in. (1.524 mm.) to 0.072 in. (1.83 mm.) in diameter. This size generally provides good highway speed performance at reasonable compressor head pressures.
Using an orifice tube having a diameter in the range of 0.040 in. (1.016 mm.) to 0.050 in. (1.270 mm) at idle has been shown to increase air conditioner discharge air performance by 7.degree. F. while reducing compressor power requirements by 10.0% at certain high ambient conditions. This as compared to the larger size.
To fully understand why this occurs consider that the orifice tube is sized for reasonable head pressures at high speed high load engine conditions. At these conditions (100.degree. F. to 110.degree. F. ambient) compressor discharge pressure at vehicular highway speeds is on the order of 250.0 psig. Subcooling is in the range of 15.degree. F. and refrigerant flow is 10.0 lbs. per minute of R-12 (Dichlorodifluoro Methane) or R-134A (Tetrafluord Ethane). As the vehicle is then idled condenser airflow is decreased substantially and head pressure rises to the range of 350.0 psig. Because the compressor is pumping much less refrigerant (5.0 lbs. per minute) the orifice tube must only produce this flow to again balance. This is accomplished by the condenser not condensing all of the gas entering it from the compressor. This uncondensed gas enters the orifice inlet and, as discussed previously, reduces flow in this case to 5.0 lbs. per minute and the refrigeration cycle goes from an efficient subcooled cycle to an inefficient quality cycle. A thermostatic expansion valve cycle would be a saturated liquid cycle and much more efficient. It is an established fact that subcooling increases system capacity by approximately 1.0% per degree of subcooling at no increase in compressor flow requirements while quality significantly decreases performance. FIG. 80 illustrates this more explicitly.
In FIG. 80, note the gain in evaporator capacity for the subcooled cycle versus the loss for the quality cycle. This is per quantity of refrigerant circulated. A too large of orifice tube results in the less efficient quality cycle occurring at low speed and idle conditions in an automobile system.
By reducing orifice size at the idle condition liquid refrigerant will back up in the condenser and if backed up enough subcooling will result and the performance can exceed the TXV saturated cycle. (Thermostatic Expansion Valves, commonly called TXV valves, control the flow rate of liquid refrigerant entering the evaporator as a function of the temperature of the refrigerant gas leaving the compressor. Some vehicles still use this relatively expensive type of expansion device since it exhibits performance advantages at low speed and idle over the fixed area orifice tube.) The back-up must be designed so as not to exceed design head pressures as condensing surface is lost with this back-up. If this small orifice were then used at the high load high speed condition more refrigerant would be required in the system as more back up of liquid occurs until enough subcooling and head pressure are available to again flow enough to satisfy evaporator requirements. Unfortunately the head pressure rises into the range of 300.0 to 400.0 psi. substantially reducing compressor life. For these reasons it is imperative that a successful variable flow orifice not be engaged into the minimum flow area at high speed high load conditions.
If the refrigerant charge is not increased at small orifice-high speed-high load then the head pressure will rise significantly but not as high as the above but the evaporator will be starved. This results in high refrigerant superheat in and out of the compressor again reducing compressor life along with an increase in evaporator out air temperature. From the above it can be seen that a variable orifice would be very desirable for increased efficiency and performance.
Flow noise of the prior art fixed orifice tube has been and is a continuing problem in many automotive installations. Start-up, running and shut down noise is somewhat attenuated by use of a diffusion screen at the orifice tube outlet but is not satisfactory in many applications. This noise is principally a function of the quality of the refrigerant entering the expansion device.
Numerous patents have been issued relating to two stage or variable flow orifices which utilize pressure differential to actuate the device. U.S. Pat. Nos. 4,375,228 and 5,081,847 teach that a 175 lb differential between suction and head is a desirable trigger point (R-12). This differential is much too low in certain soak and cool down conditions and would result in the small orifice staying in at the high load-high speed condition. Also, the hysteresis of these designs is so great that once triggered the small orifice would stay in until the system pressures were almost equalized. Again, compressor life would be reduced due to the significantly higher pressures and gas temperatures.
Two other U.S. Pat. Nos. 4,951,478 and 5,170,638 use a sliding O-ring seal. The small size debris circulating in the system and the long shut down period possible in automotive air conditioning systems could lead to sticking of this seal. In fact tight tolerance slideable fits could lead to sticking due to dirt accumulation on these surfaces. The patents mentioned above use this type of fit. A sliding O-ring seal would also undesirably increase hysteresis and be susceptible to wear.
It is noteworthy that to date there is no commercially available variable flow orifice valve which is pressure actuated for refrigeration applications in spite of almost twenty-five years of developmental effort.
An object of the invention is to provide a variable flow orifice valve assembly which is effective and reliable in its operation and low cost to manufacture and designed as to be inserted into a fluid line or conduit.
Another object of the invention is the construction of a variable flow orifice valve assembly which will engage the minimum orifice size at sufficiently high pressure differential to preclude staying in at high speed high load conditions.
A further object of the invention is the construction of a variable flow orifice valve assembly which will have a middle range orifice size infinitely variable or constant between maximum and minimum sizes small enough to obtain significant performance gains at low speed and idle but large enough to not have adverse effects at high speed high load conditions.
Another object of the invention is the construction of a variable flow orifice valve assembly which will possess or exhibit very low actuating hysteresis (in the range of 0.0 to 20.0 psi.)
Another object of the invention is the construction of a variable flow orifice valve assembly which will engage the minimum orifice size at significantly higher pressure differential during high load high flow conditions as compared to idle and low speed low refrigerant flow conditions.
Another object of the invention is the construction of a variable flow orifice valve assembly which will have internal flow passages large enough to pass therethrough debris which may have been permitted to flow into such flow passages by said inlet screen.
A further object of the invention is the construction of a variable flow orifice valve assembly which will re-open to the maximum or larger than minimum orifice size in case of spring failure or abnormally high pressure differential.
Another object of the invention is to construct a variable flow orifice valve assembly which will be commercially acceptable for low noise.
A still further object of the invention is to construct a variable flow orifice valve assembly which will have the spring isolated from the majority of refrigerant flow to preclude undesirable spring vibration caused by such flow.


A winch mechanism is provided with an integrated inverter for providing AC electric power from a DC electric power source. The winch mechanism is also provided with a plug receptacle to allow standard AC electric devices to be plugged into the winch mechanism so that the appliance can be utilized remotely from other AC electric power sources. An additional jump start storage device can be provided on the winch for providing back-up jump start storage.

The statements in this section merely provide background information related to the present disclosure and may not constitute prior art.
Winches have been commonly mounted to a support bracket at the front bumper location of an automobile, and have been used to perform a variety of tasks, such as dragging a large object while the vehicle is stationary, or moving the vehicle itself by attaching the free end of the winch cable to a stationary object and reeling in the cable to pull the vehicle toward that object. These typical winches include a cable winding drum supported on each end and including an electric or hydraulic motor in combination with a speed reducing gear transmission for transmitting torque to the cable winding drum. The use of winches with off-road and utility vehicles has greatly enhanced the function of the vehicles. However, it is still desirable to further enhance the vehicle functionality, as well as the functionality of the winch.
The present invention provides a winch mechanism with an integrated inverter for providing AC electric power from a vehicle battery or other power source so as to enhance the functionality of the winch as it is used on a vehicle, or as is used in other industrial applications. The winch mechanism is provided with a plug receptacle on the housing thereof to allow AC powered electric devices to be plugged into the winch to allow operation of the AC electronic devices remotely from other AC electric power sources. The integrated inverter of the present invention takes advantage of the existing high amperage wiring of the winch and, therefore, has limited additional cost.
In addition, additional jump start storage can be provided via a secondary battery or capacitance device.
Further areas of applicability will become apparent from the description provided herein. It should be understood that the description and specific examples are intended for purposes of illustration only and are not intended to limit the scope of the present disclosure.

Winch having integrated inverter for providing AC power


A truss that, in one embodiment, includes alternating metal webs in non-critical portions of the truss is described. The truss includes two chords vertically spaced apart and parallel to each other, and a plurality of metal web members extending between the two chords and coupled to the vertical surfaces of the chords. The truss also includes at least two critical portions and at least one non-critical portion. The critical portions of the truss are configured so that the metal webs coupled to each side of the truss are aligned, and each metal web coupled to one side of the truss has a corresponding metal web coupled to the other side of the truss. The non-critical portions of the truss are configured so that the metal webs coupled to one side of the truss do not have a corresponding aligned metal web coupled to the opposite side of the truss. Rather, the metal webs are coupled to the chords in an alternating pattern where there is a metal web coupled to one side of the truss, then a space, then another metal web, and so on. The other side of the truss has a similar configuration, only offset, so that the spaces on each side of the truss align with a metal web on the opposite side of the truss.

Pre-manufactured wooden trusses greatly facilitate the construction of buildings and other structures. Known trusses are essentially planar structures with spans and heights far exceeding their thickness. One type of truss is the parallel chord type truss. Parallel chord trusses generally include a bottom chord, a top chord vertically spaced and parallel to the bottom chord, and webs extending between the top and bottom chords. The webs may be fabricated from wood and are typically coupled to the top and bottom chords by nailing plates having integrally formed teeth that are configured to be embedded into the surface of the chords and the webs. Alternatively, a parallel chord truss may include metal webs. The metal webs may be U-shaped, V-shaped, W-shaped, or S-shaped and are configured to attach to the vertical surface of the chords, typically with integrally formed teeth protruding from the web. Metal webs are attached to both sides of the truss along the entire length of the truss to provide strength and stability to the truss. A metal web attached to one side of the truss has a corresponding metal web attached to the other side of the truss that is in alignment with the first metal web. A truss with aligned metal webs on opposing sides of the truss provides openings or passage ways through the truss for electrical wires and plumbing pipes.
Parallel chord trusses may be used for floor joists and roof rafters in place of solid lumber 2.times.8, 2.times.10, or 2.times.12 joists. Trusses typically are stronger than solid lumber and permit greater spans and greater spacing between joists. The open web configuration of trusses eliminates the need for drilling passage holes for electrical and plumbing services. However, there is a need for being able to pass more, and/or larger items through the trusses, for example, heating and cooling ducts.
It would be desirable to provide trusses having more and/or larger openings to permit passing more services, such as plumbing pipes and heating and cooling ducts through the trusses while maintaining truss strength.


The first time a print program is activated, monitor calibration for calculating display characteristic of a display is executed (S10). Then the results of the monitor calibration operation are registered along with the present date (S20). The monitor calibration results and print information are outputted to a color printer (S30). The next and further times that the print program is activated, the number of days passed since the monitor calibration operation was last performed is calculated based on the previously registered date and on the present date (S40). Whether the calculated number of days exceeds a predetermined number of days is determined (S50). If so, then the monitor calibration operation is again performed (S60) and the calibration results and date are updated accordingly (S70).

1. Field of the Invention
The present invention relates to a printer system including a printer and a display connected to a personal computer.
2. Description of the Related Art
There has been known a printer system enabling editing and printing of color images using a personal computer. As shown in FIG. 7, the printer system includes a personal computer A connected to a color display B and a color printer C.
In order to obtain a desired color, a user uses the application program A0 to change an input value X applied to a display driver A1. When the color display B displays the color as desired by the user, the user starts printing operations using the color printer C. At this time, the input value X is outputted to the color printer A2 and printing of the desired color is performed based on the input value X.
It is desirable that a displayed color Yd displayed on the display B be the same as a printed color Yp printed by the printer C. However, the color display B normally has a display characteristic that is non-linear as shown in FIG. 8. Also, although colors displayed on the color display B have the color components of red (R), green (G), and blue (B), the colors printed by the color printer B have the color components of yellow (Y), magenta (M), cyan (C) and black (K). It is therefore difficult to match displayed colors with printed colors.
In order to match the colors displayed on the color display B with the color printed by the color printer C, it has been necessary to calculate the display characteristic of the display B and then correct the input value inputted to the color printer C accordingly.
However, the display characteristic of the display B changes with time. Therefore, if the input value is always corrected based on the same display characteristic, then as time passes the colors printed the color printer C will gradually appear different from colors displayed on the color display B.
Also, correction of the input value inputted to the color printer C can not be performed at all when the color display B is exchanged for a different type of display.

Printer system facilitating matching of brightness and color of displayed and printed images


A memory card having a plurality of different interfaces is disclosed. The memory card comprises a function module, a controller coupled to the function module for accessing, a first buffer coupled to the controller for sending a first control signal, and a second buffer coupled to the controller for sending a second control signal. The memory card activates one interface for detecting a first voltage level of the first buffer when the memory card is inserted into a first card reader, and the first buffer is activated to send the first control signal if the detection is positive. Alternatively, the memory card activates the other interface for detecting a second voltage level of the second buffer when the memory card is inserted into a second card reader, and the second buffer is activated to send the second control signal if the detection is positive.

1. Field of the Invention
The present invention relates to memory cards and, more particularly, to a memory card having a plurality of different interfaces.
2. Description of Related Art
Electronics technology has gone through a rapid, spectacular development leading to a blooming of a variety of portable electronic products such as notebook computers, palm computers, PDAs (Personal Digital Assistants) or the like. Such portable electronic products bring a great convenience to users. Also, an adapter such as a network card or modem card can be mounted for enhancing features of the product. Moreover, a memory card can be used to store data in the above products. Further, a memory card can be used to store data in a consumer electronic product such as digital camera, MP3 (MPEG Layer 3) player or the like.
Conventionally, two types of memory cards are being widely used. Namely, a SD (Secure Digital) card and a MS (Memory Stick) card. In addition to data storage, the SD card is able to provide data encryption and features 3 unique characteristics, i,e, high capacity, low power consumption, and write protection for preventing data deletion be accident. MS cards are developed by SONY corperation. The MS cards are widely employed in products produced by SONY corperation. The MS card also features advantages such as high capacity, low power consumption or the like.
As shown in FIG. 1, in a case of inserting a SD card 22 into a SD card reader 20, the SD card reader 20 performs a SD protocol to read data from the SD card 22. In another case of inserting a MS card 32 into a MS card reader 30, the MS card reader 30 performs a MS protocol to read data from the MS card 32. In addition, a demand of the quality of both the portable electronic products including memory cards, and the consumer electronic products has been increasing as they are available in an even faster pace. However, the various memory cards are not compatible with one another, it is impossible to read data via inserting one format memory card such as SD card 22 into another format card reader such as MS card reader 30. This is really inconvenient. Thus, the need for improvement still exists.

Memory card having a plurality of different interfaces


The present invention relates to an inkjet printer and methods for mounting ink cartridges. The cartridge has a case with an ink chamber and a first and second opening. The inkjet printer has a recording head, a buffer tank, and a mounting portion with an ink supply tube and an air intake tube. The method includes establishing fluid communication between an interior of the ink chamber and the ink supply tube via the first opening, and then establishing fluid communication between the interior of the ink chamber and the air intake tube via the second opening, where the pressure of the ink chamber interior is less than atmospheric pressure. The inkjet printer includes a buffer tank in communication with a recording head, a mounting portion having an ink supply tube and an air intake tube, and an ink cartridge including a case having a first and second opening.

1. Field of the Invention
The present invention relates generally to methods for mounting an ink cartridge to a mounting portion of an inkjet printer, and to inkjet printers.
2. Description of Related Art
In a known inkjet printer, a recording head is mounted on a carriage and an ink cartridge is configured to be removably mounted to the carriage. The carriage includes an ink supply needle communicating with the recording head, and an air intake needle communicating with the atmosphere. When the ink cartridge is mounted to the carriage, the ink supply needle and the air intake needle are in fluid communication with the interior of the ink cartridge, and the ink supply needle supplies ink from within the ink cartridge to the recording head.
In another known inkjet printer, a recording head and a tank are mounted on a carriage. When an ink cartridge is mounted to a mounting portion provided in the inkjet printer, ink within the ink cartridge is supplied to and temporarily stored within the ink tank, and from there, the ink is supplied to the recording head.
Nevertheless, when the pressure in the interior of an ink cartridge is greater than the outside atmospheric pressure, the pressure difference therebetween may cause ink to leak from the nozzles of a recording head. The ink may leak from the nozzles at the time when an ink cartridge is mounted to the mounting portion of an inkjet printer for the first time, or when a depleted ink cartridge is replaced with a new ink cartridge. Moreover, if the pressure in the interior of the ink cartridge is less than the outside atmospheric pressure, the pressure difference may cause air to flow into the recording head from the nozzles. The air flowing into the recording head may cause malfunctions in printer operation, such as printing failure.
Yet another known inkjet printer addresses this problem by providing fluid communication between the air intake needle and the interior of the ink cartridge, thereby equalizing the pressure in the interior of the ink cartridge with the atmospheric pressure before the ink supply needle is in fluid communication with the interior of the ink cartridge. Nevertheless, in this known inkjet printer, when an ink cartridge is mounted to a mounting portion of an inkjet printer for the first time, or when a depleted ink cartridge is replaced with a new ink cartridge, air may be trapped in an ink supply path between the ink cartridge and a portion of the printer, e.g., the recording head. The trapped air initially may enter the ink supply path when the ink cartridge is not mounted to the mounting portion.
In still another known inkjet printer, air also may be trapped between an ink supply tube of the mounting portion and a valve member of the ink cartridge when the ink supply tube contacts and applies a pressure to the valve member. The trapped air may cause malfunctions in printer operation, such as printer failure. Although the trapped air may be removed by drawing ink from the recording head through the nozzles, this procedure may waste a large amount of ink, thus decreasing ink cartridge life.
In a known ink cartridge and mounting portion, an air intake tube first penetrates through an air intake hole, and then an ink supply tube penetrates through an ink supply hole. Alternatively, an air intake tube penetrates through an air intake hole at the same time that an ink supply tube penetrates through an ink supply hole. In these cases, because the interior of ink chamber is depressurized, air enters the interior of the ink chamber rapidly through the air intake tube as the pressure of the interior of the ink chamber rises to meet the outside atmospheric pressure. As a result, air may remain trapped at an end of ink supply tube, or at a position adjacent to the end of ink supply tube.

Inkjet printers and methods for mounting ink cartridges to inkjet printers


A water purification apparatus, comprising a water pump, wherein the water pump inlet port receives water from an external source, a nonreturn valve in fluid communication with the water pump outlet port, and an ionizer chamber in fluid communication with the nonreturn valve output end, wherein the ionizer chamber doses a bacteriacide into water contained in the ionizer chamber. The apparatus also includes a filter, wherein the input end of the filter is in fluid communication with the output end of the ionizer chamber.

The steady growth of tourism in remote areas has placed an undesirable burden on government authorities to provide facilities in such areas for the benefit of tourists and vacationers. By way of example, one facility frequently required by visitors is clean drinking water. Unfortunately, most water treatment apparatii are large and can have a significant impact on the local environment, both from a physical perspective and an aesthetic perspective. Clearly, the provision of such facilities can decrease the appeal of the wilderness and the ability of tourists and other visitors to visit these sites. Additionally, there are many areas which are so little used and so remote that government authorities are unable to provide and maintain the necessary facilities. Such facilities would also be subject to destruction and/or damage, such as by natural occurrences, vandals, and the like.
It is relatively well known that Ag+ ions, also referred to as "colloidal silver", in measured doses are toxic to lower life forms such as bacteria, but are not toxic to humans. In fact there is evidence available that colloidal silver provides significant benefits to the functioning of the human body and offers particular benefits to the immune system. Various apparatii have been used for dosing water with silver ions to take advantage of the bactericide effects of silver. However, in general, such apparatii have been used only in reticulated water systems, for example, where town water is connected.

This patent is subject to a terminal disclaimer.

Water purification apparatus and method of using the same


The present invention is an electrical junction box comprising a walled enclosure having an articulating cover member. The articulating cover member has an opening and is configured to allow an electrical device such as switch to be coupled to the cover member and further reside within the electrical junction box when the cover member is articulated into a closed position. When the cover member is in an open position, an installer has access to the backside of the electrical device and to the inside of the junction box. The coupling to of the electrical device to the cover member allows for support and stability of the electrical device while installing the required electrical lines that run through the junction box to the electrical device.

The present invention generally relates to electrical junction boxes, covers therefore and device or plaster rings. More particularly, the present invention relates to an electrical junction box and an articulating or hinged cover that is configured for a universal fit across multiple different configurations of device or plaster rings. The electrical junction box of the present invention is adapted to permit efficient installation of an electrical device as well as providing serviceability access to the junction box without having to remove the already installed device or device ring.
Junction boxes are used to harness electrical wiring from a breaker and further relay that electrical wiring to electrical devices including but not limited to power outlets, switches, electrical fixtures, such as fan or lighting fixtures, thermostats, and smoke/CO detectors. Device rings, also known in the art as plaster or mud rings, are commercially available in a wide variety of configurations. In accordance with the present invention, the inventive junction box may or may not have an attached device ring for fixture mounting.
In a building or home, electrical wiring is typically run from a circuit breaker through conduit into one or more junction boxes, where an electrical device will be installed. The junction box is typically installed into the wall and either anchored to the drywall or nearby stud. The electrical device is then wired to the circuit breaker through the harnessed electrical wiring and then mounted either directly to the junction box or via a device ring designed to hold the electrical device in place. Once the electrical device is installed, depending on where the junction box is installed, a cosmetic cover may be further mounted to the junction box and device ring.
An installer may need to test the electrical device to see if it is wired properly at various stages before the installation of the electrical device is complete. For example, the installer may turn the circuit on after the electrical device is initially wired to ensure the proper connections were made. The installer will likely turn the circuit breaker off and mount the electrical device to the junction box or to the device ring and to the junction box, turn the circuit breaker back on, and test the electrical device again before installing cosmetic cover. If the wiring comes loose or is improperly installed during any of these steps, the installer is forced to go through the tedious and time consuming process of unmounting the electrical device or device ring, or both, rechecking the wiring, remounting the electrical device, and retesting the mounted electrical device. In some instances the covers and device rings for existing junction boxes are too tall and push against the drywall creating the undesirable appearance of drywall bulge.
The present invention addresses the issue of continually mounting and unmounting electrical devices during installation or repair by providing a junction box designed to allow an electrical device to be mounted in its final position while allowing the installer access to the necessary wiring.

Junction box with universal fitment articulating cover


Biosensors including resonant optical cavities. The resonant optical cavities are shaped so as to generate whispering gallery modes, which increase the quality factors of the cavities and facilitate the detection of analytes in a sample with enhanced sensitivity. The sizes of the resonant optical cavities facilitate their use in biosensors that include arrays of sensing zones. Accordingly, the resonant optical cavities may be used in high-density sensing arrays that can be read in real-time and in parallel. Thus, the resonant optical cavities are useful for detecting small concentrations of samples in real-time and with high throughput. Different embodiments of the biosensors are also disclosed, as are methods for using the biosensors.

Early and accurate diagnostics are crucial to the treatment of many medical disorders. High-throughput biosensing is an active and growing area of research for clinical applications in detecting antibodies, genes, drugs, peptides, cells, and other biological molecules of interest, as well as for sequencing DNA molecules.
Currently, the two major optical approaches to biosensing upon which research efforts are focused are the use of segmented evanescent waveguide biosensors and the use of the so-called "biochips", which basically include microfabricated substrates with capture biomolecules secured thereto.
Optical waveguides are often used in low sample concentration, high throughput immunoassays (IA) and molecular diagnostic assays (MDx). When a segmented waveguide is used, the waveguide is illuminated with one or more wavelengths of electromagnetic radiation (e.g., light) to facilitate a determination of presence, absence, or amount of one or more particular analytes of interest in a sample. Numerous optical techniques have been developed to employ the evanescent wave from optical waveguides in biosensing applications.
For example, the use of optical waveguides for high-throughput sensing can be achieved using either mass (Silzel et al., 1998) or fluorescence (Stimpson et al., 1995; Watkins et al., 1998; Plowman et al., 1999) sensing techniques. Both of these sensing techniques have been demonstrated as useful in waveguides for conducting immunoassays (Silzel et al., 1998; Wadkins et al., 1998; Plowman et al., 1999) and genetic screenings (Stimpson et al., 1995).
When an optical waveguide is used as a so-called "mass sensor", the presence of a captured analyte may be detected or measured by, first, measuring a baseline absorption or refractive index of a capture molecule on or adjacent a surface of the waveguide prior to exposing the capture molecule to a sample and, second, following exposure of the capture molecule to a sample, determining the difference in absorption or refractive index of the capture molecule and any analyte bound, or hybridized, thereto. With this mechanism, the measured signal changes upon hybridization of capture molecules with analytes in the sample. The signal change is in proportion to the mass that lies within the evanescent field of the waveguide.
Waveguide mass sensing techniques typically rely on surface plasmon resonance (SPR) 5, which has been used extensively in optical biosensing (Liedberg et al., 1987). A surface plasmon can exist at the interface between two media, one of which has a negative dielectric constant (Peyghambarian et al., 1993), such as a metal, and can be resonantly excited using a ruled optical grating or prism to obtain phase matching. The index perturbation of the analyte disturbs this resonance, with greater perturbation provided with larger molecular weight. These sensors have been used for immunoassay (Cullen et al., 1987; Morgan and Taylor, 1992) and molecular diagnostic assay (Watts et al., 1995; Nilsson et al., 1997; Bianchi et al., 1997), and are commercially available (see Malmqvist and Karlsson, 1992, for a review). Affinity sensitivities can be in the nM range (Morgan and Taylor, 1992) for large analyte molecular weight, and 50 μM (Karlsson and Stahlberg, 1995) for small analyte molecular weight, and a sensitivity per unit area of 20 fM/mm2 was measured using resonant mirrors (Watts et al., 1995). Nanoparticles coated with the analyte have also been used to increase mass, leading to a sensitivity of 0.1 pM (Kubitschko et al., 1997). Other waveguide mass sensors are based on light scatter (Stimpson et al., 1995), interferometry (Schneider et al., 1997), and waveguide absorption spectroscopy (Mendes and Saavedra, 1999).
When fluorescence sensing is employed, electromagnetic radiation may be used to create an evanescent wave within an optical waveguide that excites a fluorescent dye, which is also referred to as a fluorophore tag, or a similar tag bound, for example, to a molecule that competes with an analyte of interest for a binding site on a capture molecule immobilized on or adjacent to a surface of the waveguide. The fluorophore tag gives off emitted electromagnetic radiation, the intensity of which is indicative of the presence, absence, or amount of the analyte in the sample.
For optical waveguide sensors that employ fluorescence sensing techniques, the sensitivity depends on affinity strength between each analyte and its corresponding capture molecule, as well as upon the absorption coefficient and fluorescence quantum yield of the fluorophore tag. Fluorescence sensing techniques are generally more sensitive and more specific than mass sensing techniques.
Many of the approaches to fluorescence sensing techniques in optical waveguides are based on the use of optical fiber (Abel et al., 1996; Squillante, 1998), but work has also been performed with planar waveguides (Zhou et al., 1991; Herron et al., 1993; Plowman et al., 1996). Planar waveguide sensors have been used in immunoassay (Zhou et al., 1991; Herron et al., 1993) and molecular diagnostic assay (Plowman et al., 1996) studies, where the latter demonstrated low fM sensitivity.
Nanoparticles have been used as light scattering elements (Yguerabide and Yguerabide, 1991) or as an alternative to fluorophore tags.
When optical waveguides are used, the waveguide may include independent sensing zones on or adjacent to which different types of capture molecules are immobilized. All of the discrete sensing zones of a segmented waveguide can be interrogated in parallel by use of a charge-coupled device ("CCD") array, which can capture the full time dynamics of the affinity interaction. The array size is limited by the patterning of immobilized capture molecules (Silzel et al., 1998) and the sensitivity is limited by the number of captured analytes per sensitivity zone and by the sensing technique employed. Nonetheless, with new patterning techniques, the densities of sensing zones of optical waveguides are continuing to increase (Morgan et al., 1995; Stimpson et al., 1998).
In the state of the art, the sizes of the sensing zones of segmented waveguides are ever-decreasing. Accompanying the decrease in sizes of the sensing zones of segmented waveguides are proportional reductions in the sensitivities with which analytes can be detected by the waveguide. Accordingly, the system requirements of segmented waveguides are becoming ever more stringent.
Moreover, the use of a segmented waveguide is somewhat undesirable since the excitation radiation is not confined within the plane of the waveguide. Consequently, the electromagnetic radiation emitted from one sensing zone may interfere with the electromagnetic radiation emitted from one or more adjacent sensing zones, thereby reducing the optical efficiency of a segmented waveguide and, thus, the degree of confidence with which each analyte may be detected when the segmented waveguide is used. In order to reduce the interference between adjacent sensing zones of segmented waveguides to acceptable levels, the area of each sensing zone to which capture molecules are secured or to which a sample is introduced may be limited to less than 25% of the total area of the sensing zone. As a result, segmented waveguides are relatively insensitive.
A related approach to the optical waveguide is the so-called "biochip", of which the so-called "DNA chip" (Vo-Dinh et al., 1999; Hacia, 1999; Lipshutz et al., 1999) is an example. Biochips, which may be fabricated using self-assembled monolayer or similar patterning techniques, may have very large arrays of sensing zones (e.g., up to 100,000 or more sensing zones). A sample is applied to a biochip, one or more analytes of interest in the sample bind capture molecules on the biochip, and the presence, absence, or amount of each analyte or the hybridization characteristics of the capture substrate with a corresponding analyte is detected in much the same manner as that which is used when segmented waveguides are employed to detect analytes.
For example, fiber optic probes, scanning near-field microscopes, or confocal microscopes may be used to direct one or more wavelengths of electromagnetic radiation into each sensing zone of a biochip to excite fluorescent dyes within the sensing zone. The fiber optic probe or confocal microscope may then be used to detect the electromagnetic radiation emitted from fluorescent labels within each sensing zone. If a fiber optic prove or confocal microscope is used, the biochip may be raster-scanned, one sensing zone at a time. The sensing zones of a biochip can be closely spaced since the probe itself provides lateral optical confinement, which leads to the possibility of biochips with very high sensing zone densities. Such sequential detection is somewhat undesirable, however, because of the time required to scan a biochip with a dense array of sensing zones. Moreover, each hybridization reaction occurring on a biochip is typically analyzed when it reaches an endpoint, which may take hours. Further, different reactions may require different hybridization temperatures. As a result, it may be difficult to simultaneously effect a number of different hybridization reactions on a single biochip, which further increases the amount of time required to obtain results from raster-scanned biochips.
While parallel detection techniques may also be used to simultaneously analyze multiple sensing zones on biochips, parallel detection techniques may also be complicated by the different temperature dependences of different hybridization reactions to be conducted on a single biochip (Fotin et al., 1998). Again, it may be necessary to carry out reactions and to take measurements at a number of temperatures.
In response to these temperature dependence problems, assay techniques have been developed wherein the hybridization rates of different hybridization reactions occurring at different sensing zones of a biochip are simultaneously measured at one or more distinct temperatures or narrow temperature ranges (Jensen et al., 1997).
Another assay technique has been proposed includes effecting different chemical reactions on the surfaces of microspheres (Micheal et al., 1998). The microspheres are deposited into individual wells etched into the distal end of an imaging fiber bundle. Cavity effects of the wells are masked by incoherent illumination, but the use of a CCD to sense reactions on the surfaces of the microspheres may be used in parallel with the imaging fiber bundle.
Flat, or planar, cylindrical microcavities have been used in low-threshold lasers (McCall et al., 1992; Zhang et al., 1995; Baba, 1997) and optical spectral filters (Rafizadeh et al., 1997; Blom et al., 1997; Madsen and Jhao, 1998; Little et al., 1998). These cylindrical microcavities have been fabricated from a variety of materials, including semiconductor materials (e.g., silicon) and glass. Studies have shown that planar cylindrical microcavities with cavity diameters of 10.5 μm may have free spectral ranges (FSRs) of greater than 35 nm and cavity Q values of greater than 8000. Finite-difference time-domain (FDTD) studies (Li and Liu, 1996; Hagness et al., 1997) performed with such planar cylindrical microcavities suggest that FSRs exceeding 100 nm and cavity Q values of 104 or greater are possible with optimized designs. A theoretical study (Little and Chu, 1996) of cavity surface roughness supports these conclusions. Nonetheless, cylindrical microcavities have typically been illuminated from the planar ends thereof, which causes the illuminating electromagnetic radiation to travel throughout the volume of these cylindrical microcavities.
The inventors are not, however, aware of the use of biosensors that include resonant optical cavities that facilitate the use of whispering gallery modes to provide enhanced sensitivity and that have quality factors of at least about 104.

Resonant optical cavities for high-sensitivity high-throughput biological sensors and methods


A photonic antenna array includes: a plurality of tapered fiber ends; and a support plate. Each tapered fiber end of the plurality of tapered fiber ends corresponds to a respective fiber of a plurality of fibers. A portion of each of the plurality of fibers is run through the support plate. A fiber core diameter at a tapered end point of a respective tapered fiber end of the plurality of tapered fiber ends has a first diameter. A fiber core diameter at a non-tapered portion of the respective fiber corresponding to the respective tapered fiber end has a second diameter. The first diameter is smaller than the second diameter. The respective tapered fiber end is configured to provide a mode field diameter larger than a diameter of the non-tapered portion of the respective fiber corresponding to the respective tapered fiber end.

Conventional satellite communications utilize radiofrequency (RF) communications. However, the frequency ranges used for RF communications are becoming more and more crowded and are bandwidth-limited. Optical satellite communications using lasers are being explored, with some optical satellite communication systems having been tested. However, existing optical satellite communication systems suffer from many drawbacks, such as reliance upon heavy equipment, complicated and expensive system configurations, low telescope slew rate, low reliability, and/or inability to handle high power (e.g., in the kilowatt (kW) range or higher).
Optical systems are also used in directed energy applications, which are typically much higher power than communications applications (e.g., on the order of hundreds of kW versus low power on the order of ˜10 W for communications). Conventional directed energy systems suffer from many of the same drawbacks as conventional optical satellite communication systems.
In particular, conventional approaches to optical communication systems and directed energy systems typically either use a tiling approach (which suffers from low efficiency and output intensity) or a diffractive approach (which suffers from low reliability due to all of the system light being directed through single components).
Additionally, liquid crystal technology is also being explored, but liquid crystal approaches also have various drawbacks, such as low scalability.

Photonic antenna array with tapered fiber ends


Apparatus for analyzing and storing video data includes a video camera for generating video data and analysis circuitry for analyzing the video data generated by the video camera to detect a predetermined characteristic of the video data. The apparatus also includes first and second storage devices, and routes the analyzed video data to a selected one of the first and second storage devices in response to detection of the predetermined characteristic of the video data.

There have been proposed many techniques for filtering video image data in order to detect significant features of the image represented by the image data. Writings in this feature include the following: M. P. Cagigal, et al., "Object movement characterization from low-light-level images," Optical Engineering, Aug. 1994. vol. 33, no. 8, pp. 2810-2812; S. J. Nowlan, et al., "Filter selection model for motion segmentation and velocity integration," J. Opt. Soc. Am A, Dec. 1994, vol 11, no. 12, pp. 3177-3200; T. G. Allen, et al., "Multiscale approaches to moving target detection in image sequences," Optical Engineering, Jul. 1994, vol. 33, no. 7, pp. 2248-2254; M.-P. Dubuisson, et al., "Contour Extraction of Moving Objects in Complex Outdoor Scenes," International Journal of Computer Vision, 14, pp. 83-105 (1995); M. Bichsel, "Segmenting Simply Connected Moving Objects in a Static Scene," IEEE Transactions on Pattern Analysis and Machine Intelligence, Nov. 1994, vol. 16, no. 11, pp. 1138-1142; M. Irani, et al., "Computing Occluding and Transparent Motions," International Journal of Computer Vision, 12:1, pp. 5-16 (1994); I. J. Cox, "A Review of Statistical Data Association Techniques for Motion Correspondence," International Journal of Computer Vision, 10:1, pp. 53-66 (1993); D. Koller, et al., "Model-Based Object Tracking in Monocular Image Sequences of Road Traffic Scenes," International Journal of Computer Vision, 10:3, pp. 257-281 (1993); J. H. Lee, et al., "A VLSI Chip for motion estimation of HDTV Signals," IEEE Transactions on Consumer Electronics, May 1994, vol. 40, no. 2, pp. 154-160; T. Koivunen, "Motion detection of an interlaced video signal," IEEE Transactions on Consumer Electronics, Aug. 1994, vol. 40, no. 3, pp. 753-760; S.-I. Jang, et al., "A real-time identification method on motion and out-of-focus blur for a video camera," IEEE Transactions on Consumer Electronics, May 1994, vol. 40, no. 2, pp. 145-153. However, commercial applications of these proposed filtering techniques have been rare, and for the most part have been limited to analysis of static images, rather than attempting to acquire information by analyzing a dynamic stream of images.
A product which makes significant use of information obtained by analysis of a stream of video images is the OPTIMA II video surveillance multiplexer introduced by the assignee of the present application. The OPTIMA II multiplexer receives a respective stream of video image information from each of a plurality of cameras and forms a combined stream of images by time-division multiplexing of the images from the cameras. The combined stream is then output to a conventional video tape recorder for storage on tape. The OPTIMA II multiplexer applies motion detection filtering to the respective input streams and adaptively allocates the "time slots" in the output stream by allocating a larger number of slots to images from an input stream in which motion is detected. In this way, an input stream having a relatively large amount of information is allocated a relatively large portion of the system's storage capacity.
Other proposals to provide automatic response to detected features of video information have been directed primarily to detecting motion and to actuating an alarm condition when motion is detected. Such proposals are disclosed in U.S. Pat. Nos. 4,737,847 (Araki et al.); 4,160,998 (Kamin); 4,198,653 (Kamin); 3,988,533 (Mick et al.); 4,081,830 (Mick et al.); 3,743,768 (Copeland); and 4,249,207 (Harmon et al.).
It would be desirable to extend application of machine intelligence to detection of video information features, and automatic performance of functions, beyond those contemplated in the prior art.

Video information management system which provides intelligent responses to video data content features


Described herein is a method and apparatus for connecting packet telephony calls between secure networks and non-secure networks.

With the proliferation of computing devices it is often desirable to network such devices, i.e., communicatively couple such devices, through data networks to facilitate the exchange of information between such devices. In corporate data networks, however, there is often an interest in securing the information resident within a corporate network from intrusion and/or attacks from external third-parties, i.e., attacks through an Internet connection to the corporate intranet. Accordingly, filtering technology, which discriminates between data packets based on the header of each data packet, has been developed to control the passage of packet-based data traffic between networks. Before commercial firewalls became available, network administrators began formulating rules that could be statically applied to filter out unwanted and malicious traffic. However, such static packet filtering had many disadvantages, including allowing external clients to directly connect to internal hosts. An unfriendly user could take over a trusted external host and gain malicious access to the entire internal network with relative ease through the direct connection.
Dynamic packet filtering was developed to solve some of the problems of static packet filtering. Dynamic packet filters allow a temporary "window" in a firewall based on packet header information. The temporary window in the firewall is closed once a series of packets have reached their destination. Since the amount of time the window in the firewall is open is much shorter compared to a static packet filter, many types of attacks that work against a static packet filter are more difficult to deploy against a dynamic packet filter. However, dynamic packet filtering still allows the possibility of direct IP connections between an internal host and an external client.
One emerging application that is typically not supported by conventional corporate firewalls is colloquially referred to as Internet telephony, Internet Protocol (IP) telephony, or "packet telephony:" that is, telephony between networks using IP data packets. One example protocol for packet telephony is formally described in the International Telecommunication Union-Telecommunication Standardization Sector (ITU-T) standard entitled, "Draft H.323v4." As one example packet telephony standard, H.323 specifies the components, protocols, and procedures that provide telephony services, i.e., real-time audio, video, and data communications over packet networks, including IP-based networks. The protocols specified by H.323 are audio codecs; video codecs; subprotocols such as H.225 which defines a call setup sequence based on Q.931 operations including registration, admission, and status (RAS); H.245 control signaling; real-time transfer protocol (RTP); and real-time control protocol (RTCP). However, H.323 is independent of the packet network and the transport protocols over which it runs and does not specify them.
H.323 gateways for telephony traffic between IP networks are known. In this regard, such conventional gateways provide for the translation of protocols for call setup and release, media format conversion between different networks, and the transfer of information between H.323 and non-H.323 networks. In IP telephony, an H.323 gateway may connect an IP network and a circuit-switched network, such as an analog or digital public switched telephone network (PSTN) or an integrated services digital network (ISDN).
However, in the case of packet telephony between networks, it is a well-known problem that the security of a packet telephony exchange is not reliably provided by standard packet protocol firewalls and H.323 gateways. The telephony data packets may appear to the firewall or gateway to be unsolicited insofar as they are streamed from an IP address that has not been targeted by an intranet client and therefore the telephony exchange may be refused. Or, the telephony exchange may be allowed, resulting in a direct connection between a potentially malicious external entity and the intranet client. The potentially malicious external entity then has direct access to the intranet client, and often to the entire intranet.

Method and apparatus for connecting packet telephony calls between secure and non-secure networks


A method for establishing system resource prediction and resource management model through multi-layer correlations is provided. The method builds an estimation model by analyzing the relationship between a main application workload, resource usage of the main application, and resource usage of sub-application resources and prepares in advance the specific resources to meet future requirements. This multi-layer analysis, prediction, and management method is different from the prior arts, which only focus on single-level estimation and resource deployment. The present invention can utilize more interactive relationships at different layers to effectively perform predictions, thereby achieving the advantage of reducing hidden resource management costs when operating application services.

Today, enterprises deploy their applications in complex environments, such as cloud, local, and edge computing. However, because the architectures of the cloud, on-premise, or edge computing system are different, it will cause difficulties in resource management and maintenance. Information Technology (IT) system managers need to learn how to manage and maintain systems in different environments. When some applications are damaged, IT system managers spend more time on debugging due to complex system management and maintenance methods. It can be seen that complex system management and maintenance methods will increase the cost of system maintenance, for example, the cost of compatibility and integration of data that must be transferred between different systems, the cost of backup settings required by the data based on how the system is configured, the system maintenance costs caused by different security rule settings for various systems, and other hidden resources management costs. There are two management schemes, proactive management scheme, and reactive management scheme. The proactive management scheme is to predict what problems may occur in the system before the system has any issue and provide an early warning; the reactive management scheme is when the system has an issue, it starts to find a feasible solution. A proactive management scheme usually requires experienced IT system managers to judge the possible future situation based on the analysis on past experiences. However, for enterprises, IT system management managers who are proficient in different system architectures such as cloud, local and edge computing, and have extensive experience are not easy to find. Therefore, to solve the system problems as mentioned above caused by application damage, most enterprises often adopt a reactive management scheme, or only a simple proactive management scheme, such as implementing only daily data backup. For reactive management schemes, only when system problems occur, IT system managers start to study how to deal with system problems. However, for some extreme situations, such as the Enterprise Resource Planning (ERP) system, the amount of data processed by the system suddenly increases because the company's business is expanding too fast. The memory resources are insufficient to cope with the amount of data processed by the system, making the system unable to function correctly. If only a reactive management scheme or a simple proactive management scheme is used, the system must be suspended to restore data. The operating loss caused by the suspension of the system is huge and difficult to measure. Therefore, IT system managers in related industries have done their best to research and design effective proactive management schemes.
Further, the deployed applications can be divided into a main application and a sub-application under the main application according to their subordinate dependencies. Taking the aforementioned ERP system as an example, it usually includes sub-applications such as Hypertext Transfer Protocol (HTTP) server, messaging system, database system and search engine. Each sub-application can be directly installed and deployed on the nodes in the cluster and deployed as a Virtual Machine or Container, for example, using a Container management system such as Kubernetes to install on the nodes in the cluster. Each sub-application needs to communicate with other sub-applications. IT system managers usually manage the usable amounts of Central Processing Units (CPU), memories, etc. of the main application and sub-application through a monitoring management system. For example, if the memory resource of the main application is insufficient, IT system managers increase the memory resource of the entire system; if a sub-application has insufficient memory resource, IT system managers only adjust the settings of the sub-application to increase the usable amount of the memory resource for the sub-application. IT system managers can monitor each sub-application through the management interface settings of the monitoring management system to monitor and manage the information of each sub-application, and then monitor and manage the main application. It can collect data when the main application is running for judging or deciding to adjust related hardware to meet user needs. For example, add three HTTP server replicas to the HTTP server sub-application, reduce the memory of the database system sub-application 10G, and even add a node in response to a sudden large amount of demand, for instance, adding a unit of container to deploy the ERP system (main application). When the workload of the main application, namely, the amount of information requested by the user, changes with time, each sub-application's resources (such as CPU, memory, network workloads, etc.) will also change to meet the performance requirements of the main application. However, the common method of predicting the resource utilization of the main application is to predict the resource utilization of each sub-application separately and add them up to get the resource utilization of the main application. Such an approach will cause the system to generate extra-large amounts of calculating resources to be wasted in predicting. Therefore, to reduce the computing cost of predicting resources, most resource management schemes only display and collect real-time resource utilization and do simple analysis only for single sub-application. This makes many of the needs for resources in the future can only be judged by the experience of IT system managers. As a result, when errors occur, inexperienced IT system managers spend a lot of time debugging (tracking related logs) and finding the root cause. This is why the reactive management scheme causes high hidden costs.
In contrast to the reactive management scheme, some proactive management schemes have recently been proposed to solve the problems as mentioned above. Most proactive management schemes aim at the resource demand estimation and resource provision of single sub-application and will not be based on multi-level management such as workloads and resource usage amounts of main application, not to mention the need for resources from the influence of correlations of sub-applications. If the interactive relationship between each layer is analyzed from the foregoing multi-layered perspective, the prediction of demand on the time point in the future can be effectively carried out through the relationship between them to obtain the best system resource prediction and resource management, and reduce hidden costs. This is also the reason why the present invention initiated.

Method for establishing system resource prediction and resource management model through multi-layer correlations