Systems, methods and software that enable multiple servers to verify a password, without providing any single server, client or network attacker with the ability to validate guesses for the password off-line is disclosed. Password security is maintained in a very simple model, requiring no previously secured or server-authenticated channel between the client and any servers. Data may be protected by a small password, and no other keys, remains secret even against an enemy that compromises any, but not all, of two or more cooperating authenticating servers.

The present invention relates generally to computer security, and more particularly, to systems, methods and software that provide for remote password authentication using multiple servers.
Password-based authentication is the foundation of most personal authentication systems. Even when supplemented with carry-around tokens, smart-cards, and biometrics, the simple memorized password typically remains an essential core factor for establishing human identity in computer transactions. Low-grade passwords, the kind that people can easily memorize, are a particularly tough problem for many otherwise secure systems. To accommodate low-grade passwords, zero-knowledge password protocols were developed to eliminate network threats. However, a remaining problem is how to prevent attack on password verification data when that data becomes available to an enemy.
In a typical password system, a server maintains verification data for the password, which may be a copy of the password itself. In UNIX systems, for extra security, the verification data is an iterated one-way function of the password, which is typically stored in a file. This file is often further protected so that unprivileged users and programs do not have access to it. The classic UNIX password attack is where an attacker somehow has access to the file of password verification data, and runs a password-cracking tool against it to determine or "crack" as many passwords as possible. Password cracking is simply the application of the one-way function to a list of candidate passwords. When the output of the one-way function matches the verification data, the attacker knows he has guessed the correct password. Such attacks may be optimized to try the most common or likely passwords first, so as to be able to crack as many passwords as possible in a given period of time.
A goal is to reduce the threat of server-based attack on a password as much as possible in a password-based client/server authentication system, with the simplest possible security model—that is, using as few assumptions as possible. The goal is to prevent disclosure of the password even in the face of total unconstrained attacks on a server. In the present model, it is presumed that the attacker has the ability to alter a server's software, access all data available to that server, and control the use of that server while it authenticates legitimate and unsuspecting users.
To achieve this goal, it is clear that one needs to use more than one machine. In any single machine system, one who can access the user's password verification data, or can access any password-encrypted data, has sufficient information to perform an unconstrained off-line brute-force attack by simulating the actions of the user. The problem is specifically how to split password verification data among two or more servers, so as to eliminate this risk. No single server should have the ability to mount an off-line brute force attack.
Public-key cryptography is now becoming recognized as a crucial tool for secure personal electronic transactions. Personal digital signatures are expected to have widespread applications. However, a big problem is in how to protect and manage the user's private key. Leaving it on the client machine, perhaps weakly encrypted with the password, is an undesirable security risk. It seems foolish to leave persistent password-crackable data on client machines where the security is all-too-often notoriously difficult to manage. Furthermore, in a model where a number of users can share a single machine, it becomes impractical to require local storage of user credentials.
One class of user authentication solutions for so-called "roaming" users keeps the user's private credential stored on a remote server, and uses password-based authentication to retrieve these credentials. Strong zero-knowledge password (ZKP) protocols address many of the threats in these solutions, by eliminating network-based brute-force attacks, while at the same time eliminating the dependency on other stored keys and certificates on the client machine. ZKP protocols are essential for the multi-server case as well.
Two models for multi-server secure roaming systems are discussed: a strong model and a weaker model. In both models the attacker is presumed to be able gain access to copies of password-verification data, and has the ability to perform computations over a reasonably long period of time. (Reasonably long means unconstrained, but within the limits of computational feasibility. An arbitrarily long computation would be able to crack arbitrarily large public keys. As in most cryptographic methods, it is presumed that some practical upper-bound can be established for the time and power available to potential attackers, and that corresponding safe minimum reasonable sizes for keys may be determined.)
In the weaker model the attacker is presumed to have access to copies of the server's persistent data, but is unable to interfere with the operation of a running server.
In the strong model, a method must maintain security of the password even in the face of total active compromise of up to all but one of the authentication servers. The attacker is presumed to be able to modify server software and access all information available to a server while authenticating valid users. The strong model is simpler, and is thus preferred. It is also stronger than earlier models for similar systems that presumed the existence of prior secure channels.
In all of these models, each server may defend itself from unconstrained on-line attack by enforcing limits on the number of allowable invalid access attempts. These limits may be enforced in a number of usual ways. A preferred embodiment of the present invention also includes a feature that helps servers to better account for legitimate mistakes made in password entry.
The goal of a roaming system is to permit mobile users to securely access and use their private keys to perform public-key cryptographic operations. Mobility is referred to in a broad sense and encompasses acts of using personal workstation, and other people's workstations, without having to store keys there, using public kiosk terminals, as well as using modem handheld wireless network devices. It is desired to provide users password-authenticated access to private keys from anywhere, while minimizing opportunities for an enemy to steal or crack the password and thereby obtain these keys.
Smartcards have promised to solve the private key storage problem for roaming users, but this solution requires deployment of cards and installation of card readers. The tendency for people to sacrifice security for convenience has proved to be a barrier to widespread use of solutions requiring extra hardware. This is one motivation for software-based roaming protocols.
As used herein, a roaming protocol refers to a secure password-based protocol for remote retrieval of a private key from one or more credentials servers. Using just an easily memorized password, and no other stored user credentials, the user authenticates to a credentials server and retrieves her private key for temporary use on any acceptable client machine. The client uses the key for one or more transactions, and then afterwards, erases the key and any local password-related data.
As used herein, a client machine operating on behalf of a specific user is referred to as Alice and the credentials servers are generally referred to as Bob, or individually as Bi, using gender-specific pronouns for the female client and her male servers.
The concept of "roaming" systems is closely related to credentials servers. The SPX LEAF system disclosed by J. Tardo and K. Alagappan in "SPX: Global Authentication Using Public Key Certificates", Proc. 1991 IEEE Computer Society Symposium on Security and Privacy, 1991, pp. 232–244 presents a roaming protocol that uses a server-authenticated channel to transmit a password to a credentials server for verification, and performs subsequent retrieval and decryption of the user's private key. The credentials server protects itself by limiting guessing attacks that it can detect, and the protocol prevents unobtrusive guessing of the password off-line.
When a credentials (authentication) server can determine whether a password guess is correct, it can prevent or delay further exchanges after a preset failure threshold.
Password-only protocols are another important related field. The EKE protocols disclosed by S. Bellovin and M. Merritt in "Encrypted Key Exchange: Password-based protocols secure against dictionary attacks", Proceedings of the IEEE Symposium on Research in Security and Privacy, May 1992 introduced the concept of a secure password-only protocol, by safely authenticating a password over an insecure network with no prior act of server authentication required. A series of other methods with similar goals were developed, including "secret public key" methods disclosed by L. Gong, T. M. A. Lomas, R. M. Needham, and J. H. Saltzer in "Protecting Poorly Chosen Secrets from Guessing Attacks", IEEE Journal on Selected Areas in Communications, vol. 11, no. 5, June 1993, pp. 648–656 and by L. Gong in "Increasing Availability and Security of an Authentication Service", IEEE Journal on Selected Areas in Communications, vol. 11, no. 5, June 1993, pp. 657–662, the SPEKE method discussed by D. Jablon in "Strong password-only authenticated key exchange", ACM Computer Communications Review, vol. 26, no. 5, October 1996, pp. 5–26, http://www.IntegritySciences.com/links.html\#Jab96, the OKE method described by S. Lucks in "Open Key Exchange: How to Defeat Dictionary Attacks Without Encrypting Public Keys", The Security Protocol Workshop '97, Ecole Normale Superieure, April 7–9, 1997, the SRP-3 method described by T. Wu in "The Secure Remote Password Protocol," Proceedings of 1998 Network and Distributed System Security Symposium, Internet Society, January 1998, pp. 97–111. and others, with a growing body of theoretical work in the password-only model such as are disclosed by S. Halevi and H. Krawczyk in "Public-key cryptography and password protocols", Proceedings of the Fifth ACM Conference on Computer and Communications Security, 1998, M. K. Boyarsky in "Public-Key Cryptography and Password Protocols: The Multi-User Case", Proc. 6th ACM Conference on Computer and Communications Security, Nov. 1–4, 1999, Singapore, V. Boyko, P. MacKenzie and S. Patel in "Provably Secure Password Authenticated Key Exchange Using Diffie-Hellman", Advances in Cryptology—EUROCRYPT 2000, Lecture Notes in Computer Science, vol. 1807, Springer-Verlag, May 2000, and M. Bellare, D. Pointcheval and P. Rogaway in "Authenticated Key Exchange Secure Against Dictionary Attack", Advances in Cryptology—EUROCRYPT 2000, Lecture Notes in Computer Science, vol. 1807, pp. 139–155, Springer-Verlag, May 2000. Most of these papers stress the point that passwords and related memorized secrets must be conservatively presumed to be either crackable by brute-force or, at best, to be of indeterminate entropy, and this warrants extra measures to protect users.
The SPEKE method developed by the assignee of the present invention is an authenticated form of the well-known Diffie-Hellman (DH) exponential key exchange, where the base of the exchange is determined by a password. In a commonly used form of SPEKE, the password provides for mutual authentication of the derived Diffie-Hellman session key. Variations of SPEKE have also been described in pending U.S. patent application Ser. No. 08/823,961, and in a paper by D. Jablon entitled "Extended Password Protocols Immune to Dictionary Attack", Proceedings of the Sixth Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WET-ICE '97) Enterprise Security Workshop, IEEE Computer Society, Jun. 18–20, 1997, pp. 248–255, and in a paper by R. Perlman and C. Kaufman, "Secure Password-Based Protocol for Downloading a Private Key", Proceedings of 1999 Network and Distributed System Security Symposium, Internet Society, Feb. 3–5 1999.
A SPEKE-enabled system that uses split keys among multiple machines, herein referred to as SK1, was presented by D. Jablon on Jan. 21, 1999 at a talk entitled "Secret Public Keys and Passwords" at the 1999 RSA Data Security Conference 99, with slides published at <http//www.IntegritySciences.com/rsa99/index.html>. In this system, Alice's private key U is split into three shares, a password-derived share P, and two large shares X and Y. The shares are combined using the ⊕ function (bitwise exclusive-or) with U=P ⊕X⊕Y. The SK1 enrollment and key retrieval processes are summarized below.
In SK1 enrollment, Alice selects the three shares {P,X,Y }, combines two of the shares to create a secret private key S (where S=P⊕X), memorizes P, and stores X on her machine. Then, using a form of the B-SPEKE protocol, of which several other forms are described in the June, 1997 Jablon paper, she constructs a verifier {g,V} corresponding to the password-derived values {P,S } as follows: g=hash(S) using a cryptographic hash function, and V=P using exponentiation in an appropriate group. She then sends {g,V,Y} to Bob, who stores them as her secrets.
In SK1 key retrieval, Alice (at some later time) obtains her private key U from Bob. Alice uses the B-SPEKE protocol to prove her knowledge of P and S to Bob, and to negotiate an authenticated session key K with Bob. After Bob verifies Alice, using his knowledge of {g,V}, he sends her Y symmetrically encrypted under K. Alice then decrypts to retrieve Y and re-constructs U. A brute force attack on the password-derived value P in this system requires the attacker to have access to both shares X and Y, which are stored on two different machines.
A:S = P ⊕ XA:g = hash(S)A→B:A, QA = g2 RAB→A:QB = g2 RBA:K1 = QBRAA:K2 = QBPB:K1 = QBRAB:K1 = V2 RBA→B:hash(hash( K1, K2 ))B→A:encrypt(K, Y)A:U = P ⊕ X ⊕ YTo enable a brute force attack on P in SK1, the attacker needs access to both X and Y.
The roaming model and password-only methods were combined in the Perlman and Kaufman paper to create protocols based on both EKE and SPEKE. These authors showed that simple forms of password-only methods were sufficient for secure roaming access to credentials. Other roaming protocols are discussed in the Gong, Lomas, Needham, and Saltzer papers, the Wu paper, the S. Halevi and H. Krawczyk paper "Public-key cryptography and password protocols", Proceedings of the Fifth ACM Conference on Computer and Communications Security, 1998, and the P. MacKenzie and R. Swaminathan paper "Secure Network Authentication with Password Identification", submission to IEEE P1363 working group, http://grouper.ieee.org/groups/1363/, Jul. 30, 1999, all of which are designed to stop off-line guessing attacks on network messages, to provide strong software-based protection when client-storage of keys is impractical.
Modified Diffie-Hellman is a method described by Eric Hughes in a paper entitled "An encrypted Key Transmission Protocol", presented at a session of CRYPTO '94, August 1994, and in a book entitled "Applied Cryptography Second Edition" by B. Schneier, published by John Wiley & Sons, 1996, at page 515. In ordinary Diffie-Hellman, both client and server know a fixed g, and jointly negotiate K=gxy. However, in modified Diffie-Hellman, the client (Alice) sends gx, receives gxy, and retrieves K=gy from a server. Her secret exponent x is used as a blinding factor. The key is retrieved by raising the server's value to the power of x inverted, as in K:=(gxy)1/x. Unlike the ordinary Diffie-Hellman method, a static value for K can be precomputed, even before the server receives the client's (Alice's) gx.
A form of SPEKE that is based on Modified Diffie-Hellman, herein referred to as Modified SPEKE, is described in U.S. patent application Ser. No. 08/823,961. In Modified SPEKE, Alice derives a key K that is based on her knowledge of P, a value derived from her password, and a random value y known to Bob. Alice raises the password to a secret random power x, and sends the resulting value (QA) to Bob. Bob raises QA to the power y, and returns the result (QA) to Alice. Alice computes K by raising QB to the power of the inverse of x, with the result that K=Py.
AliceBobQA := Px→←QB := QAyK := QB(1/x)
It is recommended that P be a cryptographic hash function of the password, such as SHA1 or MD5, that results in a generator of a suitable large finite group. Further details may be found in U.S. patent application Ser. No. 08/823,961 and in the other papers on SPEKE.
To distribute the risk of stolen verification data, the data can be split among multiple machines. Care must be taken in the design of a network protocol that uses multiple machines to avoid exposing new avenues of attack on the password-derived data.
Another approach to a system that protects dictionary attacks is a technique called cryptographic camouflage (herein referred to as CC), as discussed by D. Hoover & B. Kausik in "Software Smart Cards via Cryptographic Camoflauge", Proceedings of 1999 IEEE Symposium on Security and Privacy. The CC system was introduced to reduce the vulnerability of client-stored private keys, in contrast with the present goal to reduce the vulnerability of server-stored verification data.
At least one CC system has been modified to support roaming users, which provides a two-server roaming solution. Before the two-server roaming version is discussed, the basic CC system will be discussed, which includes a user, a client machine, and a CC authentication server (CCAS).
CC uses public key techniques in a way that apparently violates some of the principles of public key technology, but with a set of restrictions designed to achieve the goals discussed in the Hoover and Kausik paper. The terminology "CC private key" and "CC public key" are used to designate two components of the system.
Note that the use of "private" and "public" in the terms "CC private key" and "CC public key" have a special meaning that is not consistent with the ordinary use of the terms "private key" and "public key". In particular, the CC model presumes that the CC public key is not publicly known.
The CC private key is stored on the client, but in a way that is hidden with a small personal identification number (PIN). It uses a special construction that makes decryption of the stored private key with any possible PIN equally plausible. (This issue is discussed later when considering human-chosen versus machine-generated PINs, an enemy's partial knowledge of PINs, and related threats.)
Only trusted parties must know the CC public key. If a CC-encrypted private key is stolen, possession of the CC public key gives the thief the ability to mount a dictionary attack on the PIN. To meet the security goals, the CC public key must be known only to the CCAS. In practice, the client may store the CC public key in a form encrypted under the CCAS public key, such that only the CCAS can read it. The client sends this encrypted package to the CCAS whenever it authenticates to the CCAS.
Similarly, any digital signatures that were signed with a user's CC private key must be visible only to the CCAS. Thus, messages are first signed with the CC private key, and then sealed with the CCAS public key.
Note that Hoover and Kausik state a more liberal restriction, that any messages encrypted under the CC private key containing verifiable plaintext must be known only by the CCAS. It is noted that in practice it is exceedingly difficult to create useful messages that are free from verifiable plaintext. The presumption that plaintext is not verifiable leaves open questions about the security of the system that depends on the ingenuity of the attacker to create a suitable verification method. Open questions such as these are not acceptable in the present model, hence a tighter statement of this restriction is used. Following is a summary of the CC system:
In CC enrollment, the client chooses PIN P, private key EC, and corresponding public key DC. There are also further restrictions that CC imposes on the construction of EC and DC, that need not concern us here. The client stores:                CC(P, EC ) the camouflaged private key        DS the public key of the CCAS        DS(DC) the client public key sealed for the CCAS
In CC authentication, the user enters P, and the client retrieves EC from CC(P, EC). The client sends to the CCAS:                DS(EC(message) ), and        DS(DC).
The CCAS unseals both EC(message) and DC, and verifies the client's signature to authenticate the message.
One might presume that DC is accompanied by a suitable set of certificates that attest to the validity of the key for the purposes of the CCAS. Yet, given that DC must be remain a secret shared by the client and the CCAS, this would seem to preclude ordinary methods for certifying DC using third-party certificate authorities. Together these restrictions on the CC private key and CC public key make it clear that these are unsuitable for use in any true public key system.
In CC, the PIN is effectively divided into two shares,                CC(P,EC) which is known only to the client, and        DC which is known only to the server.
In general, all further messages signed under EC or sealed under DC must also be sealed under DS. In accordance with the present invention, this can be transformed into a two-server roaming solution.
The CC system handles password entry errors in a special way, with a feature that detects typographical errors in password entry on the client. The client compares a small amount of the hashed password against a locally stored reference data on the client. However, this mechanism has a significant cost, in that it leaks a few bits of information about the password to an enemy that gets access to the stored client data. The consequence is that passwords in the CC system must be somewhat larger or more complex, and thus harder to memorize, for a given level of security against on-line guessing attacks. The CC error handling feature was designed with the premise that people can work a little harder to ease the computing burden on the system, in that early detection of errors on the client prevents unnecessary work on the server. An alternative philosophy is that computers should be used to save people from having to work. Systems should work hard to tolerate user mistakes, without penalizing the user, and still maintain the highest possible barrier against password guessing attack. A system for optimally handling innocent mistakes in password entry is included in a preferred embodiment of the present invention.
Roaming solutions have been designed and deployed by a number of companies that provide public key infrastructure (PKI), for the purpose of authenticating "roaming" users, principally where smart-cards are unavailable. In such systems users securely retrieve stored user profiles (typically containing user private key) from a remote credentials server discussed by J. Kerstetter, "Entrust, VeriSign clear path to PKI", PC Week, Jun. 14, 1999, available at <http://www.integritysciences.com/PKI50.html>. Other work on credentials servers use variants of EKE and SPEKE as described in the Perlman and Kaufman paper.
The cryptographic camouflage system described above presumes a single CC server, and presumes user key information is stored on the client. One can transform this into a two-server roaming solution, which is referred to as CC Roaming, by moving the client stored data to a CC roaming server (CCRS) and giving the CCRS an additional verification data for a second user password.
The user authenticates to the CCRS using a password, and an appropriate password-authentication protocol that results in the ability for the CCRS to securely return information to the client. Preferably, this would use a verifier-based or so-called "extended" zero-knowledge password protocol. However, alternative constructions are possible, including sending the clear-text password through a server-authenticated SSL (secure socket layer) or TLS channel to the CCRS for verification. SSL is discussed by A. Frier, P. Karlton, and P. Kocher in "The SSL 3.0 Protocol", Netscape Communications Corp., Nov. 18, 1996, and TLS is discussed by T. Dierks and C. Allen in "The TLS Protocol Version 1.0", IETF RFC 2246, http://www.ietf.org/rfc/rfc2246.txt, Internet Activities Board, January 1999. As discussed above, for full security, the CCAS PIN and the CCRS password must be chosen to as completely independent values. If they are related values, an attack on the password may lead to disclosure of the PIN.
In essence, CC Roaming is a two-password system, with one password for the CCRS, and another (the PIN) for the CCAS. One obvious limitation of CC Roaming is that the first server gets the opportunity to mount a brute-force attack on the first password. Two other related issues are the efficiency of using client entropy, and the independence of the PIN and password.
When using CC Roaming with password-thru-SSL to authenticate to the CCRS, there are added risks both from server-spoofing attacks, as discussed by E. Felton, D. Balfanz, D. Dean and D. Wallach in "Web Spoofing: An Internet Con Game", 20th National Information Systems Security Conference, Oct. 7–10, 1997, Baltimore, Md., and at http://www.cs.princenton.edu/sip/pub/spoofing.html, and from related password/PIN attacks described below. In all of these cases, it is possible to lose some of the benefits of the two-server approach if just one of them gets attacked. Using a zero-knowledge password-proof to authenticate to the CCRS can eliminate the server-spoofing attacks, and make related PIN/password attacks much more difficult.
The CC roaming system makes inefficient use of the entropy inherent in user passwords, which must be considered to be a valuable and scarce resource. Recall that a primary goal of password methods is to minimize the amount (number of significant bits) of information that a user must remember to achieve a given level of security. The CC Roaming system wastes these bits and introduces several points of vulnerability. First, Hoover and Kausik suggests using some bits of the PIN to pre-qualify the PIN before running the protocol. They do this by additionally storing a specially constructed small hash of the PIN in the client. An attacker can use the hashed PIN to reduce the space of candidate PIN's. Considering the already reduced size of the PIN, this is may be dangerous. If user-chosen PINs are allowed, this may reduce the space of valid PINs to a dangerous level.
A CC Roaming system may also be sensitive to the relationship between two passwords, the AS PIN and the RS passwords, which artificially divides the entropy of the user's secrets. Hoover and Kausik make it clear that the camouflaged AS PIN must not be used for any other purposes. Yet, if the user accidentally incorporates the AS PIN in the RS password, or if there is some correspondence between these secrets that might be known to an attacker, the underlying CC system in CC Roaming becomes vulnerable to attack.
A related password/PIN attack is possible when the user chooses them as the same values, or as distinct values with an obvious or perhaps subtle-but-discernable relationship. There is also a risk for a user with truly independent PIN and password who mistakenly types one in place of the other.
If one considers broad-based attacks on multiple users, one can reduce the target space by first cracking the users with weak RS passwords, and then focus the effort on the set of cracked RS users to crack their corresponding AS PINs. This leakage of information about the RS password can reduces the overall work for a potential attacker. In contrast, if the same RS passwords and AS PINs are combined, an ideal two-server system (which will be described) has a cracking work factor that depends on both the passwords and the PINs, requiring a much larger overall work factor.
The artificial partitioning of the secret into two factors for the CC Roaming system thus introduces new vulnerabilities and weakens the model. In the description of the preferred embodiments, simpler alternatives to CC and CC Roaming are described that are more powerful, less complex, and at least equally protective of the user's memorized secrets.
All single-server roaming solutions have inherent limitations. In all of the above roaming methods, a single credentials server maintains data that could be used to verify information about a user password. If it is presumed that hashed-passwords can be broken by brute-force, the password-verifying server essentially represents a single point of failure for this sensitive user data. Systems that address this problem will now be discussed.
Multi-server roaming represents a further advance. While single server systems prevent guessing attacks from the client and the network, they do not stop guessing based on password-verification data that might be stolen from the server. Multi-server roaming systems can prevent such attacks to an amazing degree. At the cost of using n related credentials servers to authenticate, multi-server systems extend the scope of protection to the credentials server database. In these systems, an enemy can take full control of up to n−1 servers, and monitor the operation of these servers during successful credential retrieval with valid users, and still not be able to verify a single guess for anyone's password, without being detected by the remaining uncompromised server.
In June 2000, VeriSign issued a press release entitled "VeriSign Introduces New Technology to Enable Network-Based Authentication, Digital Signatures and Data Privacy" in May 2000, and published a web page located at http://www.verisign.com/rsc/wp/roaming/index.html that described, at a high level, a multi-server roaming feature. A paper by W. Ford and B. Kaliski entitled "Server-Assisted Generation of a Strong Secret from a Password" was presented at the IEEE Ninth International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises in Gaithersburg Md., on Jun. 14, 2000. A revised version of this paper was published in the proceedings in September 2000 (W. Ford and B. Kaliski, "Server-Assisted Generation of a Strong Secret from a Password", Proceedings of 9th International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises, IEEE, September, 2000). These papers describe methods that use multiple servers to frustrate server-based password cracking attacks. It is noted that the methods detailed in the Jun. 14, 2000 Ford & Kaliski paper rely on a prior server-authenticated channel. This dependency on a prior secure channel for password security introduces an unnecessary and potentially risky security assumptions. The removal of this dependency is one of the advantages of the present invention.
One of the methods disclosed in the Jun. 14, 2000 paper uses the Modified SPEKE protocol, as described above, which is used in a preferred embodiment of the present invention. In the various methods described in the Jun. 14, 2000 paper, two or more servers share the burden of keeping the password verification data secret. Each server stores a secret, for the user. A client obtains the password from the user and interacts with each server in a two-step process. First the client obtains an amplified key based on the password from each server, and then creates a "master" key that is used to authenticate to each of the servers. (Note that the term "amplified key" (which comes from the Bellovin and Merritt, paper) is used herein instead of the "hardened key" terminology of Ford and Kaliski.) Each amplified key represents one share of the user's master key. The client uses any standard technique, such as the use of a hash function, to combine the amplified key shares to create the master key.
To obtain each amplified key, Ford and Kaliski suggest two basic methods. One is the Modified SPEKE method described above, and the other is a variant that uses blind RSA digital signatures in the style described by D. Chaum in "Security without Identification: Transaction Systems to Make Big Brother Obsolete", Communications of the ACM, 28 (1985), 1030–1044. These methods are compared below.
The servers keep track of invalid access attempts, and, according to Ford and Kaliski, if there are "significantly more" steps of password amplification than there are successful authentications, the server takes action to limit or lockout further requests. The system however does not distinguish between mistakes made by a valid user, and other events that might better reflect a true attack on the password. As such, their system for dealing with unsuccessful attempts here doesn't optimally handle common human errors. Unsuccessful amplifications due to simple typographical errors or other corrected mistakes should not be counted as other unsuccessful attempts. The present invention provides a better way to deal with these cases.
The methods in the Jun. 14, 2000 paper further rely on previously secured server-authenticated channels to the servers. This reliance on prior authentication creates an unnecessarily complex security model, and thus has added risks of attack. These risks may be incompatible with the goal of eliminating single points of failure.
RSA blind public-key signatures are used in one of the password amplification methods described the Jun. 14, 2000 paper. This technique accomplishes the same effect as the Modified SPEKE method—both amplifying a password into a large key based on a random component known to another party. However, the RSA method introduces added complexity. Details of the RSA blinding method are not included in the Ford and Kaliski papers, but a method based on their reference to Chaum-blinding appears to work as follows.
Instead of a single value y, the server maintains for each user the values {n, e, y}. None of these values are derived from the password. The value n is equal to p·q, where p and q are prime numbers suitable for an RSA modulus, e is the RSA public key and y is the corresponding private key, such that e=1/d mod (p−1)(q−1). Essentially, the amplified key is KB, which is an RSA signature on the password. The use of x makes this a blind public-key signature scheme as described in the Chaum paper, where the blinding factor x prevents the server from knowing the data (P) that it is signing.
In the Jun. 14, 2000 paper it is proposed that SSL be used to authenticate the channel to insure the authenticity of KB for the client. The paper also notes an advantage of Modified SPEKE over RSA blinding, in that the RSA blinding client has no good (i.e. efficient) way to validate the values of n and e, other than by pre-authenticating the server.
Ford and Kaliski further present a "special case" protocol, where a "password hardening server" is used to amplify a password into a key K1 that is used to authenticate to a (conventional) credentials server. The value of K1 is completely determined by the password hardening server's response and the password. Any attacker who controls the first exchange must be unable to determine whether the K1 value computed by the user is equal to candidate K1′ values that he constructs based on his guesses for P′. So the attacker must never see K1. Similarly, if a message encrypted with K1 contained verifiable plaintext, the attacker could validate guesses from that as well. To counter this threat, the authors suggest that the credentials server communication channel be integrity protected. The Jun. 14, 2000 paper does not specify an explicit method, but it suggests the use of SSL. (Note that their September, 2000 paper does discuss how to avoid the need for a pre-secured channel.) If it is presumed that a common set of root certificates in the client can validate both servers, one or more single points of failure are introduced into the system. There is a single point of failure at each location where a private key resides for the root or any subordinate certificate authority. This is significant, as a primary goal of this model is to eliminate single points of failure.
The aforementioned attack can be achieved by compromising any single system that has a key to create a valid-looking certificate chain for the two servers in question. Furthermore, as described above, an attack on the SSL/web browser model of security can trick the user into using "valid" SSL connections to malicious servers, or into not using SSL at all.
Dependency on prior server authentication is a serious limitation. In a consumer environment, such as a public kiosk, or a private desktop that can connect to a wide variety of servers in different domains, the user must locate and connect to the appropriate server. The dependency on users to securely connect to the appropriate server, to maintain security of the password, introduces problems. Ford and Kaliski discuss how the client can use SSL to create a secure server-authenticated channel. This implies that the client must (somehow) validate the identity of the server to maintain password security. It also implies, in typical implementations, that the client stores server-specific state information to authenticate the communication channel to the server. To establish a secure channel to the server, an SSL solution typically requires having a pre-installed root key for one or more certificate authorities that are installed in the client. It also requires access to a chain of certificates that have been constructed that associate the root key with the public key of the named server. The client must include certificate validation software and policy enforcement to validate a certificate of the appropriate server (or servers) selected by the user. Ultimately, the user must insure that the server name binding is correct. This may require significant action and attention by the user. A reliance on SSL, especially as used in the browser model, is unnecessarily risky. The user can be tricked into using "valid" SSL connections to malicious servers, or tricked into not using SSL at all. This process is subject to several types of failure that might be attributed to "human error". The problem is believed to be an overall system design error based on unrealistic expectations of the human participant.
The dependency on a prior server-authenticated channel for password security is unnecessary. Preferred alternative methods of the present invention work in a simpler model that is better adapted to normal human behavior in an environment of multiple roaming users and multiple servers.
The preferred security model is similar to that in the Jun. 14, 2000 paper, in that both use multiple servers. However, in the preferred model of the present invention, it is not presumed that a pre-authenticated secure channel exists between the client and servers. The preferred model frees users from having to carefully validate the identity of the server in order to maintain security of the password. In this model the user is free to locate the server, casually, through any insecure mechanism, such as those commonly used on the Internet. These methods include manually typed (or mistyped) URLs, insecure DNS protocols, untrustworthy search engines, "clicking" on items in a collections gathered by an unknown source. All of these methods and more provide a robust multitude of ways to establish a connection to the right server, but none of these have to guarantee against the chance of connecting to an imposter. The worst threat posed in this simple model is one of denial of service—which is a threat that is always present anyway in the more complex model. The added benefit of the preferred model is that the password is never exposed, even when the client is connected to an imposter, by whatever means.
Most of the prior art handles erroneous password entry very simply. In the Jun. 14, 2000 paper, it is suggested that each server can keep track of the number of "password hardening" steps, and to reconcile this with the number of successful authentications. If there are "significantly more" hardenings than authentications, then the account would be locked out. This is typical for password-based systems. However, it is noted that unsuccessful logins may be quite common. Passwords are frequently mistyped, and users may often enter the wrong choice of multiple passwords, before finally getting it right. If a long-term fixed limit is place on such mistakes, valid clumsy users might be locked out. On the other hand, if the system tolerates a three-to-one attempt-to-success ratio, an occasional guessing attack by an enemy over the long term might remain undetected.
To address this error handling problem, the concept of "forgiveness" is introduced in the present invention. A system should be forgiving, and not account for transient mistakes by a valid user in the same way as invalid access attempts by unknown users. This problem is addressed in preferred embodiments of the present invention.
It is therefore an objective of the present invention is to reduce the threat of server-based attack as much as possible in a simple security model in a password-based client/server authentication system. It is also an objective of the present invention to provide for remote user authentication using multiple servers. It is also an objective of the present invention to authenticate from a client to a server using just a small password. It is also an objective of the present invention to provide for authentication that does not require stored keys or certificates on a client machine. It is also an objective of the present invention to use multiple servers for fault-tolerance. It is also an objective of the present invention to provide for remote password authentication that is secure even with total active compromise of any individual server. It is also an objective of the present invention to better handle common human errors in password entry.

Systems, methods and software for remote password authentication using multiple servers


A splitter card having integral test access devices. The splitter card allows test access to be readily provided at any location where splitter cards are typically mounted (e.g., a splitter chassis).

Telecommunications systems for transmitting voice and data to and from subscribers (i.e., residences and businesses) are known. An exemplary telecommunications system 10 is schematically shown in FIG. 1. The system 10 includes a Main Distribution Frame 12 (MDF) for connecting digital subscriber lines 13 (DSLs) to internal lines 14 within a telephone server's central office 15. The central office 15 frequently includes a DSLAM 18 (Digital Subscriber Line Access Multiplexer) and a voice switch 19. The DSLAM 18 transmits data to and receives data from a communications network/backbone 21. The voice switch 19 transmits voice signals to and receives voice signals from a communications network/backbone 23. The networks 21 and 23 can be dedicated lines that are part of the same network. POTS splitter devices 16 (i.e., Plain Old Telephone Service splitter devices) are used at the central office 15 to combine data signals from the DSLAM 18 with voice signals from the voice switch 19. By combining the signals, the signals can be simultaneously routed to a subscriber 25 through a single DSL 13. Signals transmitted from subscribers 25 to the central office 15 are also routed through the POTS splitter devices 16. At the POTS splitter devices 16, the signals are split and directed to the DSLAM 18 and the voice switch 19. Typically, the splitter devices 16 include low pass filters for removing the data content from any signals transmitted from the splitter devices 16 to the voice switch 19. Since DSLAMs 18 frequently include high pass filters for removing the voice band, the splitter devices 16 usually do not include filters for filtering the voice content from the signals transmitted to the DSLAM 18.
For most telecommunications systems, it is desirable to maximize the splitter densities. To maximize splitter densities, multiple splitters can be mounted on a printed circuit board to form a splitter card. To further maximize splitter densities, multiple splitter cards can be mounted within the same chassis.
It is desirable to be able to easily test the communication lines of a telecommunications system to identify errors and to determine whether existing lines are ADSL compatible (i.e., a process known as loop qualification). What is needed is a test access device that provides ready test access to communication lines.

This patent is subject to a terminal disclaimer.


A motor vehicle differential gear has at least one housing part as a first gear part, and a crown wheel as a second gear part. The first and second gear parts are connected via respective first connection surfaces running in the axial direction by a press fit, and via respective second connection surfaces running at an angle to the axial direction, forming a welding seam. One of the gear parts is formed from a steel and the other gear part from a cast iron material, as well as such a differential gear in which the second connection surfaces connect directly to the first connection surfaces.

Exemplary embodiments of the invention relate to a differential gear for a motor vehicle.
U.S. Pat. No. 8,015,899 B2 discloses a differential gear for a motor vehicle, the differential gear comprises a housing part as a first gear part, as well as a crown wheel as a second gear part. The housing part and crown wheel are connected to each other via respective first connection surfaces running in the axial direction, by means of a press fit. Furthermore, the housing part and the crown wheel are connected to each other via respective second connection surfaces running at an angle to the axial direction, forming a welding seem that runs at an angle to the axial direction. This known differential gear has high production costs.
Exemplary embodiments of the present invention provide a differential gear that is more cost-efficient to produce.
To carry out a more cost-efficient production of the differential gear, it is provided in the first aspect of the invention, that one of the gear parts is formed from a steel and the other gear part from a cast iron material. In particular due to the use of the cast iron material, the material or production costs of the differential gear can be kept particularly low.
A further advantage of the differential gear according to the invention is that, due to the angled arrangement of the second connection surfaces, advantageous accessibility for a welding process is created, such that the gear parts can be welded to one other in a time-and cost-efficient manner. Due to the angled arrangement of the second connection surfaces, the welding process can also be moved or led at an angle to the axial direction, whereby collisions with one of the gear parts, in particular with the crown wheel, can be avoided in a simple manner.
A further advantage of the angled arrangement is that the welding seam can be checked by means of uninterrupted testing, in particular by means of ultrasound testing, in a simple and therefore cost-efficient manner. This is, in particular, advantageous compared to welding seams running in the axial direction, which are not able to be checked or only able to be checked at very high expense.
Furthermore, due to the angled arrangement of the second connection surfaces, and thus due to the angled arrangement of the welding seam, an at least fundamentally optimal load distribution can be achieved during the operation of the differential gear. Due to the angled arrangement of the second connection surfaces and thus the welding seam in combination with the press fit, at least fundamentally only pressure loads, in particular, compressive stresses, are transferred via the welding seam. Particularly in comparison to tensile loads, in particular tensile stresses, pressure loads only represent light loads for the welding seam, such that the differential gear also has high robustness and a high certainty of fulfilling its function.
A further aspect that keeps the production costs for the differential gear according to the invention low is that no screw connections are provided to connect the gear parts. The differential gear according to the invention can thus be produced with only a low material requirement, as no screw connections must be provided. Furthermore, this keeps the construction space requirement of the differential gear according to the invention low, whereby packaging problems can be solved and or avoided. The differential gear according to the invention is both applicable for a drive train of a commercial vehicle and of a passenger vehicle.
In an advantageous embodiment, the cast iron material is a grey cast iron. In other words, the other gear part is formed from the grey cast iron. This keeps the production costs of the differential gear according to the invention particularly low. Furthermore, the gear part formed from the grey cast iron has particularly advantageous mechanical properties.
In a particularly advantageous embodiment of the invention, the crown wheel is formed from the steel, in particular case-hardening steel, and the housing part from the cast iron material, in particular grey cast iron. The crown wheel thus has high robustness against high loads, such that particularly high torques can also be transferred onto the crown wheel. The housing part, which is less loaded compared to the crown wheel, is formed from the more cost-efficient cast iron material that has advantageous mechanical properties.
If the second connection surfaces connect directly to the first connection surfaces, then this is advantageous insofar as the crown wheel and the housing part (the gear parts) are produced with only a low material requirement and thus in a particularly cost-efficient manner. Furthermore, the differential gear has only a very low construction space requirement. In other words, in this embodiment, no spacing is provided between the first and second connection surfaces, for example via a respective, at least fundamentally radial wall. Rather, the first connection surfaces pass directly into the second connection surfaces.
For the depiction of a particularly cost-efficient production of the differential gear, it is advantageously provided that the welding seam, via which the gear parts are connected to one another, is formed as the welding seam known from German patent document DE 10 2008 027 167 A1. The gear parts therein are the mechanical components of the arrangement known from German patent document DE 10 2008 027 167 A1 of two mechanical components. During welding of the gear parts, a specific structure in the welding seam is inserted in a targeted manner. The welding of the gear parts can therein occur without the use of additional welding material. This keeps the production costs of the differential gear according to the invention particularly low.
Alternatively, it can be provided that a welding filler material with a proportion of nickel is used during welding of the gear parts. Thus, in particular, a particularly cheap metallurgic connection can be implemented between the gear parts.
The gear parts of the differential gear according to the invention are preferably welded to one another by means of a laser welding method. Thus, the gear parts can be connected to one another in a particularly time and cost-efficient manner, which keeps the production costs of the entire differential gear at a particularly low level.
In the second aspect of the invention, the second connection surfaces are connected directly to the first connection surfaces. In other words, the second connection surfaces, running at an angle, pass directly into the first connection surfaces running in the axial direction, or vice versa. The connection surfaces are thus not at a distance from one another, such that the differential gear can be produced with only a very low material requirement and has only a very low weight as well as a low construction space requirement. Advantageous embodiments of the first aspect of the invention are to be considered as advantageous embodiments of the second aspect of the invention and vice versa.
In a further advantageous embodiment of the invention, at least one further housing part is provided as a third gear part. The further housing part is, therein, connected to the first housing part via respective third connection surfaces running in the axial direction, by means of a press fit, and via respective fourth connection surfaces running at an angle to the axial direction, forming a further welding seam.
As has already been described for the second connection surfaces, the angled arrangement of the fourth connection surfaces have the advantage of particularly simple accessibility for production of the welding seam, such that the gear parts are to be connected to one another in a time and cost-efficient manner. Furthermore, the further welding seam can be checked in a simple manner by means of uninterrupted testing, for example for inclusions or similar malformations.
The combination of the further welding seam with the further press fit has the advantage that only pressure loads are transferred via the further welding seam, such that the differential gear has a high certainty of fulfilling its function and a long life span.
The differential gear according to the invention also enables the advantageous and cost-efficient representation of a modular system. Such a modular system comprises a plurality of crown wheels that are differentiated from one another as first gear parts, a plurality of first housing parts that are differentiated from one another as second gear parts and, if necessary, a plurality of further housing parts that are differentiated from one another as third gear parts. Due to the corresponding, advantageous connections of the gear parts to one another via the press fits and the welding seams, a respective differential can be produced from the respective gear parts in a time and cost-efficient manner. Thus, the modular system enables a production of various differentials according to need, which are adapted to respective use purposes, for example to use in a road vehicle, in a construction vehicle or similar.
In a further advantageous embodiment, the further housing part is formed from steel. Thus, it can withstand high operation demands.
For the implementation of only a low construction space requirement, the fourth connection surfaces are connected directly to the third connection surfaces. The further housing part and the first housing part can thus also be produced with only a very low material requirement and thus cost-efficiently.
In a further advantageous embodiment, the fourth connection surfaces enclose an angle with the axial direction in a range of 25° to 65° inclusive. Advantageously, the fourth connection surfaces enclose an angle with the axial direction of at least fundamentally 60°. Thus, a particularly advantageous accessibility to the fourth connection surfaces is created, such that the first housing part and the further housing part can be connected to each other in a time and cost-efficient manner.
In a further embodiment of the invention, the second connection surfaces enclose an angle with the axial direction in a range of 25° to 65° inclusive. Preferably, the angle between the second connection surfaces and the axial direction amounts to at least fundamentally 60°. Thus, as a consequence thereof, there is very good accessibility to the second connection surfaces, such that the crown wheel can be connected to the first housing part in a time and cost-efficient manner.
Further advantages, features and details of the invention result from the description below of preferred exemplary embodiments, as well as by means of the drawing. The features and combinations of features named above in the description as well as the features and combinations of features named in the description of figures and/or shown solely in the figures are not only applicable in the respective specified combinations, but also in other combinations or stand-alone, without leaving the scope of the invention.


A method is disclosed for controlling a desired chemical dosage to a stream of cellulosic pulp heated by the addition of steam wherein the pulp flow rate is determined indirectly by measuring the pulp temperature after steam addition and calculating the pulp flow rate by heat balance. Changes in pulp flow rate are reflected by changes in pulp temperature at known steam addition rates, and the chemical flow rate is adjusted accordingly to maintain constant chemical dosage. The method is particularly useful in controlling oxygen dosage in oxygen delignification and bleaching processes.

The dosage of treating chemicals in the bleaching or delignification of cellulosic pulp is difficult to control accurately because the flow rate of pulp in most continuous pulp treating processes varies with time, and the direct measurement of pulp flow rate is difficult because the pulp contains two or three phases (fibers, liquor, and optionally dispersed gas) and often is not completely homogeneous. Known methods of pulp flow measurement are often applied at a location in a pulp treating sequence removed from the location of chemical addition, and because of lag times and pulp inventories a pulp flow rate measured at one location is not representative of the flow rate at another location in the process. Inaccurate dosage of chemicals is undesirable for several reasons. Overdosage wastes treating chemicals and may affect downstream process steps adversely, and also may result in poor pulp properties; underdosage results in incompletely treated pulp; and cyclic underdosing and overdosing yields a nonhomogeneous pulp product.
In oxygen delignification and bleaching processes, the flow of oxygen to the pulp-oxygen mixing device prior to the reactor is generally set in excess of the actual requirement and controlled according to a pulp flow signal and pulp consistency measurement. Pulp properties such as Kappa number, brightness, and viscosity are determined periodically by laboratory analyses, and these results may be used judgmentally to adjust the oxygen dosage. Online Kappa number analyzers are available and have found some use for feedback or feedforward control of oxygen dosage. In the feedback mode, online Kappa number measurement can be used for oxygen flow control independent of pulp flow rate. However, a sampling/analysis time of at least five minutes is required for this type of analyzer, and this lag time can adversely affect control performance. In addition, the Kappa number is measured on treated pulp discharged from a reactor which may have a residence time of up to one hour, which also increases control lag time. When online Kappa number measurement is used in the feedforward mode, pulp flow rate measurement is required, and the difficulties associated with pulp flow rate measurement adversely affect this control mode. Online Kappa number analyzers are expensive and maintenance-intensive.
The measurement of residual oxygen gas in the reactor offgas is an alternative method of determining and controlling oxygen dosage. In this method, the flow rate of the offgas is irregular and difficult to measure; instead, the residual oxygen concentration is measured, and the amount of excess oxygen is determined indirectly by knowing the quantity of air entrained in the pulp or by adding an inert tracer gas such as helium to the oxygen before dosing the pulp. This determination of excess oxygen is then used to adjust the oxygen flow rate to maintain oxygen dosage at the desired level. This method is useful for approximate correction of oxygen dosage at specific time intervals, but is not suited for continuous online control of oxygen dosage because the excess oxygen is determined at the reactor outlet, which introduces a large lag time into the control system as earlier discussed.
None of these previous methods for controlling chemical dosage, particularly oxygen dosage, to cellulosic pulp is completely satisfactory. There is no known online method for determining the amount of oxygen in a pulp immediately after oxygen addition prior to the reactor, which would eliminate the lag time associated with determining excess oxygen in the reactor discharge. In addition, methods for accurate, direct measurement of pulp flow rate do not exist. The method of the present invention, as defined in the following specification and claims, allows the online control of chemical dosage, particularly oxygen dosage, to a pulp without the need for direct pulp flow rate measurement.

Control of chemical dosage to a pulp slurry


Processes to shut down a fuel cell system are described. In one implementation (400), fuel (H2) and oxidizer (air) flow is halted and the system's anode region (305) is sealed. A load (215) is then engaged across the system's fuel cell stack (205) so as to deplete much of the fuel in the stack's sealed anode region (305). The stack (205) is monitored to determine when the load should be disengaged. (215). Once the load is disengaged, fluid communication between the system's anode and cathode regions is established. The vacuum created in the anode region (305) as a consequence of consuming H2 therein, pulls nitrogen enriched gas from the cathode region (310) into the anode region (305). When substantially all of the H2 has been depleted from the anode region (305), no pressure difference exists between the anode and cathode regions and fluid communication between the two is severed.

Fuel cells are electrochemical devices that convert chemical energy in fuels into electrical energy directly. In a typical operating cell, fuel is fed continuously to the anode (the negative electrode) and an oxidant is fed continuously to the cathode (positive electrode). Electrochemical reactions take place at the electrodes (i.e., the anode and cathode) to produce an ionic current through an electrolyte separating the electrodes, while driving a complementary electric current through a load to perform work (e.g., drive an electric motor or power a light). Though fuel cells could, in principle, utilize any number of fuels and oxidants, most fuel cells under development today use gaseous hydrogen as the anode reactant (aka, fuel) and gaseous oxygen, in the form of air, as the cathode reactant (aka, oxidant).
To obtain the necessary voltage and current needed for an application, individual fuel cells may be electrically coupled to form a "stack," where the stack acts as a single element that delivers power to a load. The phrase "balance of plant" refers to those components that provide feedstream supply and conditioning, thermal management, electric power conditioning and other ancillary and interface functions. Together, fuel cell stacks and the balance of plant make up a fuel cell system.
Referring to FIG. 1A, fuel cell 100 (shown in a top-down view) is configured to include anode inlet 105, anode outlet 110, cathode inlet 115, cathode outlet 120, coolant inlet 125 and coolant outlet 130. Referring to FIG. 1B, as noted above fuel cells (e.g., fuel cell 100) may be stacked to create fuel cell stack 135, wherein each cell's anode, cathode and coolant passages are aligned.
One operational issue unique to fuel cell systems concerns system start-up and shut-down operations. Unlike internal combustion power plants, fuel cell electrodes may be damaged if exposed to improper gases and/or gas mixtures. For example, an anode's exposure to air can be very damaging to the cell if not done properly. Similarly, shut-down operations that generate mixtures of gasses (e.g., hydrogen-air solutions) may detrimentally affect the fuel cell system during subsequent start-up operations.

Shutdown operations for a sealed anode fuel cell system


A first set of classifiers are trained to predict categories using attributes of cases. A second set of a classifiers are also trained to predict the categories using the attributes of the cases. In addition, the second set of classifiers use the predictions from at least one of the classifiers in the first set to make predictions.

In recent years, machine learning applications, which typically include computer applications learning from a set of examples to perform a recognition task, have becoming increasingly popular. A task typically performed by these types of machine learning applications is classification, such as automatically classifying documents under one or more topic categories. This technology is used in filtering, routing and filing information, such as news articles or web pages, into topical directories or e-mail inboxes. For example, the text documents may be represented using a fixed set of attributes, each representing the number of times a particular key word appears in the document. Using an induction algorithm, also referred to as a classifier learning algorithm, that examines the input training set, the computer 'learns' or generates a classifier, which is able to classify a new document under one or more categories. In other words, the machine learns to predict whether a text document input into the machine, usually in the form of a vector of predetermined attributes describing the text document, belongs to a category. When a classifier is trained, classifier parameters for classifying documents are determined by examining a training set of documents that have been assigned labels indicating to which category each training example belongs. After the classifier is trained, the classifier's goal is to predict to which category a case provided to the classifier for classification belongs.
Known classification techniques treat each classification task independently. However, in many practical situations the same document must be classified with respect to multiple sets of categories. For example, A(A1, A2) and B(B1,B2) represent two different classification tasks, each having a pair of categories. For example, the task A may be to classify whether cases are in a 'surfing' category (A1) or not (A2), and the task B may represent the 'Hawaii' category (B1) or not (B2).
The existing literature on machine learning mainly treats each of the classifications for the examples described above as separate and independent classification problems. This would be fine if there were ample training data for each of the categories. Unfortunately, in practice there may be many documents to learn from that are labeled for classification task A, but few for classification task B. This generally results in either poor prediction accuracy for task B, or spending additional time and resources to obtain more training data to improve the learned classifier for task B.

Hewlett-Packard Development Company, L.P.


An apparatus for monitoring a height of liquid in a liquid storage tank is provided, the apparatus includes a first rotatable element rotatable in response to a change of a liquid level in a liquid storage tank and including a first magnetic component having a first magnetic field, and a second rotatable element rotatable in response to the rotation of the first rotatable element and including a second magnetic component having a second magnetic field. The apparatus further includes a sensor assembly which includes a first sensor component located within range of the first magnetic field and structured to be effective in providing a first signal indicative of a position of the first magnetic component, and a second sensor component located within range of the second magnetic field and structured to be effective in providing a second signal indicative of a position of the second magnetic component. The apparatus further includes a data transmitter/microprocessor assembly in electronic communication with the sensor assembly and structured to be effective in receiving the first and second signals from the first and second sensor components, respectively, and processing said first and second signals into data representing a height of liquid in a liquid storage tank.

The present invention generally relates to apparatus and systems for determining or monitoring the height or level of a liquid in a vessel, for example and without limitation, a storage tank. More particularly, the invention relates to apparatus and systems which obtain and process, for example, translate, signals into the absolute height or level of liquid over at least a portion of the total height of liquid-containing vessel, such as a liquid storage tank.
The height of liquid in a storage tank has been conventionally determined using a float-type mechanical gage. The float, which moves up and down in response to changes in liquid height, is attached to a gage shaft which rotates in response to the movement of the float. Thus, by calibrating the rotational position of the gage shaft with various heights or levels of liquid, the liquid height or level at any given time can be determined or monitored by observing the rotational position of the gage shaft.
In many situations, liquid heights in a great many tanks, e.g., 50 to 100 or more tanks, need to be determined or monitored at the same time. Therefore, it is desirable to provide a system for obtaining liquid height information with respect to each of a plurality of individual storage tanks so that such information can be transmitted to a central receiving or monitoring station.
Various shaft position monitoring systems have been suggested in the prior art. Examples, without limitation of such systems are disclosed in the following U.S. Pat. Nos. 4,137,451; 4,086,580; 4,037,219; 3,959,628; 3,875,406; 3,842,268; 3,808,431; 3,525,094; and 3,328,591.
Devices that have been highly useful and effective in providing accurate measurement of height of liquids in multiple storage tanks are described in Jannotta, U.S. Pat. No. 4,342,996. Such devices, for example, sold by L&J Engineering, Inc., under the trademark L&J Engineering, MCG 2000F, employ light signal sources and coded, rotatable discs which provide different light patterns which are detected by light signal detectors. The detected patterns of light signals are translatable into the height of a liquid in a liquid storage tank. Thus, such a device is used in conjunction with a storage tank which is equipped with a height (or level) gage including a gage shaft which is rotatable in response to changes in the height (or level) of the liquid in the tank. The device includes an instrument shaft which is capable of being associated with the gage so as to be rotatable in response to rotation of the gage shaft.
There is a need for new systems and apparatus for monitoring or determining the height or level of a liquid in liquid-containing vessels, such as a liquid storage tank.

Apparatus for monitoring height of liquid in storage tank


A reinforcement member 30 integratedly includes a top surface 31, a rear surface 32, a first side 33, and a second side 34. The top surface 31 has an air deflector attaching portion 35. An air deflector arranged on top of a roof panel 2 is attachable to the air deflector attaching portion 35. The second side 34 includes a base 40 and a seatbelt anchor attaching portion 41. The base 40 is formed in approximately the same plane as the first side 33. The seatbelt anchor attaching portion 41 extends inward from the base 40 along the vehicle width and is in contact with a rear pillar inner section. A seatbelt anchor arranged on the inner side of the rear pillar inner section is attachable to the air deflector attaching portion 41.

A structure provided with a seatbelt anchor reinforcing board for attaching a seatbelt anchor and reinforcing an attaching portion thereof in a closed space between a side panel outer section and a rear pillar inner section is disclosed in Japanese Unexamined Utility Model Publication No. Hei 6-67217.    [Patent Document 1] Japanese Unexamined Utility Model Publication No. Hei 6-67217


Disclosed are methods and apparatus for providing endless transformation of the polarization of light. A polarization splitter splits light having an input polarization into beams having substantially orthogonal polarizations. The beams are provided as substantially copolarized to a pair of optical waveguides which are selectively optically coupled. Electrodes apply selected electric fields to the optical waveguides for providing transformation of the input polarization to a selected output polarization. The outputs of the optical waveguides are provided as substantially orthogonally polarized to a combiner for providing a beam of output light having the selected output polarization.

This invention relates to methods and apparatus for the control of the phase and magnitude of light, and more particularly, to an endless polarization transformer for transforming the state of polarization (SOP) of light.
In a typical optical communication system, an optical transmitter generates an optical beam and modulates the beam with an electrical signal representative of the information to be transmitted by the communication system. An optical fiber propagates the modulated optical beam to a receiver that demodulates the optical beam to recover the electrical signal. Fiber amplifiers, disposed at appropriate intervals in the fiber optic link between the transmitter and the receiver, maintain the strength of the modulated optical beam. The low loss, light weight, small size, flexibility and high intrinsic bandwidth of optical fiber make optical communication systems highly desirable for the communication of both of digital and analog signals. Examples of optical communication systems include cable TV (CATV) systems, telephone and other cross-country or cross-continent communication systems, and other microwave and RF systems, such as phased array antenna systems used by the military. DWDM (Dense Wavelength Division Multiplexing) systems are also becoming increasingly popular, as they increase the bandwidth of existing optical fibers by transmitting multiple beams, each of a different wavelength and representing a different channel for the communication of information, over the optical fiber.
One important concern with optical communication systems is control of the polarization of the light beam (referred to herein as the state of polarization, or SOP) received by the various optical components in the optical communication system. Polarization is property of light relating to the direction in space of the vibrations of the electromagnetic fields of which light is composed. For example, the electric field of the light can vibrate along either or along both of two orthogonal axes of a coordinate system, where the orthogonal axes of the coordinate system define a plane that is perpendicular to a third axis along which the light propagates. For example, assume that a light beam is propagating along the z axis. The electric field can vibrate solely along the direction of the x axis, can vibrate solely along the direction of the y axis, or can vibrate along both axes, in which case the SOP of the light is determined by the superposition of the orthogonal polarization components, i.e., of the vibrations along the y axis and along the x axis. The superposition can result in the electric field vector tracing out particular shapes in the x-y plane, such as a circle or an ellipse. The shape and the direction in which it is traced (counterclockwise or clockwise) are determined by the relative phase and magnitude of the orthogonal polarization components of the light beam, and correpsond to a particular SOP.
Transmitters and receivers, as well as other components often present in an optical communication system, such as modulators and photonic switches, add-drop multiplexors, etc., are typically designed to operate with light having a particular SOP. However, as is well known to those of ordinary skill in the art, the SOP of a light beam often changes as the beam propagates in the optical communication system. These changes can be random over time. Thus although the transmitter may transmit the proper SOP that would result, if unchanged, in efficient operation of the other components in the optical communication system, the SOP changes as the beam propagates, and the performance of one or more of the components, and hence of the overall optical communication system, can suffer. The use of polarization maintaining optical fiber can reduce the problem of changes of the SOP, but such optical fiber is expensive, does not typically totally eliminate changes of the SOP, and hence is typically only used in short lengths to interconnect adjacent components.
Polarization transformers are known in the art. A polarization transformer can receive the light beam prior to delivery of the beam to the receiver or other optical component and transform the SOP of the beam to the SOP that the receiver or other component is designed to process. For example, it is known in the art that any input SOP can be transformed into any desired output SOP by a cascade of two quarter-wave plates and a half-wave plate. The half-wave plate is placed in between the quarter-wave plates, and each plate is disposed at a selected angle, where the angles can be, and often are, selected to be different. Varying the selected angles varies the SOP to which the input polarization of the beam is transformed.
Mechanical polarization transformers that use a cascade of quarter-wave and half-wave plates are available. However, such mechanical devices are inherently slow, bulky, complex, and not readily miniaturized. Polarization transformers are often combined with devices that track the input or output SOP and a controller for automatically controlling the transformer such that the varying input SOP is continuously transformed to the desired output SOP, which usually should not vary over time.
Another device known in the art is a xe2x80x9cfiber squeezerxe2x80x9d polarization transformer. However, this device is also mechanical and can require the use of complicated xe2x80x9cresetxe2x80x9d algorithms. xe2x80x9cResetxe2x80x9d is a known phenomenon wherein a polarization transformer is controlled by a parameter that can only vary over a finite range. As the tracking and controlling described above progresses, the control parameter can approach one of its limits, and must be reset to a value within the control parameter range to continue to properly transform the SOP. During the reset the transformed polarization varies from the desired output SOP, and this can result in the loss of signal, and hence information received by the receiver or other component while the transformer is reset. Such loss is considered unacceptable in many applications. A polarization transformer that does not require a reset is known in the art as an xe2x80x9cendlessxe2x80x9d polarization transformer, and is more desirable. The quarter-wave and half-wave transformer cascade discussed above is one example of an endless polarization transformer, because the waveplates can be endlessly rotated without reaching a limit.
Other optical apparatus useful for endless polarization transformation are disclosed in U.S. Pat. Nos. 5,212,743; 5,359,678; and 5,361,270, issued May 18, 1993, Oct. 25, 1994, and Nov. 1, 1994, respectively, and all of which include Heismann as an inventor. These patents are referred to herein as the xe2x80x9cHeismann patents,xe2x80x9d and all are herein incorporated by reference. A polarization transformer using the apparatus disclosed in the Heismann patents uses cascaded electrode sections and a titanium indiffused optical waveguide realized on z-propagating lithium niobate. The cascaded electrode sections apply electric fields to the optical waveguide for inducing a selected phase shift between, and a selected relative amplitude between, the orthogonal components of the polarization of the light propagated by the optical waveguide. (In such a waveguide, the orthogonal components of polarization of the light are often referred to as the TM mode and the TE mode. Transfer of power between the orthogonal polarization components is referred to as mode conversion, and changing the relative phase of the orthogonal polarization components referred to as mode phase shifting.) The voltages are placed on the electrodes to produce electric fields that vary, via the electrooptic effect of the electrooptic lithium niobate substrate, the above conversion and phase shift such that the overall SOP determined by the superposition of the TE and TM modes is the desired output SOP.
The devices disclosed in the Heismann patents are often constructed and operated as the electronic analogs of the quarter-wave plate, half-wave plate, quarter-wave plate mechanical device described above, without, however, the limitations on the speed of operation. Although the devices are useful, readily miniaturized and represent an advance in the art, rather high voltages can be required on the electrodes to produce the necessary electric fields. Producing and controlling such voltages can increase the complexity and expense of optical communication systems. Furthermore, the loss introduced by the apparatus is different for each of the orthogonal polarization components, which can result in the transformed SOP differing from the desired polarization.
Liquid crystal polarization transformers and guided wave polarization transformers are also known in the art, but can suffer from the one of more of the disadvantages noted above in reference to other types of transformers, such as being too slow for many applications.
Additional information on known polarization transformers can be found in xe2x80x9cPolarization-State Control Schemes for Heterodyne or Homodyne Optical Fiber Communications,xe2x80x9d Takanori Okoshi, Journal of Lightwave Technology, Vol. LT-3, No. 6, December 1985, pages 1232-1237, herein incorporated by reference.
Accordingly, it is an object of the present invention to address one or more of the foregoing deficiencies and disadvantages of the prior art.
It is another object of the invention to provide improved methods and apparatus for the control of the relative phase and magnitude of light beams, such as can be useful in applications such as the transformation of the polarization of light.
Other objects will be apparent to those of ordinary skill in the art in light of the following disclosure, including the claims.
In one aspect, the invention provides an optical apparatus for transforming the polarization of light from an input polarization to a selected output polarization. The optical apparatus includes a pair of electrooptic optical waveguides, each electrooptical waveguide of the pair having an input and an output, and the pair having at least one coupled section. A plurality of electrodes are provided for exposing the optical waveguides of said pair to selected electric fields. The apparatus also includes one or both of an input beam splitter and a beam combiner.
The input beam splitter includes an input and two outputs. The input receives light having the input polarization and splits the light into two outputs. Each of the outputs is in optical communication with a different input of the optical waveguides of the pair and this optical communication is achieved so as to provide substantially copolarized light to the electrooptic optical waveguides of the pair.
The optical combiner includes first and second combiner inputs and a combiner output. Each of the inputs is in optical communication with a different output of the optical waveguides of said the of optical waveguides, and this optical communication is achieved such that the inputs receive light from the pair of optical waveguides as substantially orthogonally polarized.
In operation, selective application of voltages to the electrodes produces the electric fields such that the light having the input polarization and entering either one of the inputs of the electrooptical optical waveguide pair or, if the beam splitter is present, the input of the beam splitter, is transformed to light having the selected polarization and emanating from one the outputs of one of the electrooptic optical waveguides, or when present, the output of the beam combiner.
The optical apparatus can include a time delay element for providing a selected time delay between the light signal emanating from the two optical waveguides. The time delay element interposed between one of the waveguides and one of the inputs to the combiner. The time delay can be added for compensating for polarization mode dispersion. Also, the invention can include a linearizing element disposed upstream of the beam splitter such that the input polarization of the light received by the beam splitter is always a linear polarization. A polarization rotator can be disposed between one of the outputs of the electrooptic optical waveguides of the pair and one of the inputs of the combiner for achieving the optical communication between the combiner and the pair of optical waveguides such that the light received by the inputs of the combiner is substantially orthogonally polarized.
The beam splitter can be a polarizing beam splitter, where the outputs thereof provide substantially orthogonal components of the light entering the input of the beam splitter. A polarization rotator is disposed between one of the outputs of the beam splitter and one of the inputs of the electrooptic optical waveguides of the pair for achieving the optical communication with the optical waveguides such that the light provided to the optical waveguide is substantially copolarized.
The plurality of electrodes can include a plurality of sections of coplanar electrodes, where each section includes an inner electrode spaced from a pair of outer electrodes by a pair of gaps. For each coplanar electrode section a selected length of each optical waveguide of the pair is disposed proximate a different gap of the pair of gaps for being exposed to electric field lines extending between those electrodes spaced so as to form the different gap. The at least one coupled section can include a plurality of coupled sections of the pair of optical waveguides, the coupled sections being alternately interposed with the sections of coplanar electrodes.
The at least one coupling section can include the optical waveguides of the pair being disposed within a selected distance of each other for a selected coupling length along each of the optical waveguides. The at least one coupling section can also include a junction between the optical waveguides of the pair of optical waveguides.
The optical apparatus of the invention can also include a SOP element for providing a feedback signal responsive to the output polarization and a controller responsive to the feedback signal and in electric communication with the electrodes for selectively applying voltage to the electrodes responsive to the feedback signal.
In yet another aspect, the invention provides an optical apparatus for selectively controlling the polarization of light. The apparatus includes at least first and second transformer sections. Each of the transformer sections includes the following: an electrooptic substrate material; a pair of optical waveguides disposed with the electrooptic substrate material; and at least one section of coplanar electrode structure disposed with the electrooptic substrate material, where the coplanar electrode section includes an inner electrode spaced from a pair of outer electrodes by a pair of gaps such that a first length of each optical waveguide of the pair is disposed proximate a different gap of the pair of gaps for being exposed to electric fields developed proximate the different gap. The optical waveguides of the pair are selectively optically coupled for selectively transferring light energy therebetween.
In addition, the pairs of optical waveguides of the transformer sections are in optical communication to form first and second optical waveguides each having an input end and an output end downstream of the input end. The optical apparatus also includes a polarization splitter having an input and two outputs, the outputs for providing substantially orthogonally polarized components of the light entering the input of the polarization splitter, one of the outputs in optical communication with the input of the first optical waveguide and the other of the outputs in optical communication with the input of the second optical waveguide, the optical communication being achieved such that the light received by the first and second optical waveguides is substantially copolarized. Also included is an optical combiner having first and second combiner inputs and a combiner output. One of the combiner inputs in optical communication with the output of the first optical waveguide and the other the combiner inputs in optical communication with the output of the second optical waveguide. Selective application of voltages between the inner electrodes and the outer electrodes of the transformer sections can selectively transform light of a predetermined polarization entering the input of the input polarization splitter into output light, emanating from the output of the optical combiner, having a selected polarization.
In another aspect, there is provided according to the invention an optical apparatus for selective control of the phase and magnitude of light, where the optical apparatus includes an electrooptic substrate and an elongate, substantially planar electrode section disposed with the electrooptic substrate, and first and second optical waveguides disposed with the substrate for propagating first and second optical beams, respectively. The electrode section includes an inner electrode disposed between first and second outer electrodes spaced from the inner electrode to form first and second gaps therewith, respectively. A first length of the first optical waveguide is disposed proximate the first gap so as to be exposed to electric field lines extending between the inner and first electrodes and a length of the second optical waveguide is disposed proximate the second gap so as to be exposed to electric field lines extending between the inner and second outer electrodes. The first optical waveguide has an input and an output, and the second optical waveguide has an input and an output.
The lengths of the first and second optical waveguides are further disposed for providing a selected optical coupling therebetween, whereby voltages of the same polarity applied to the outer electrodes relative to the inner electrode primarily affects one of the phase difference between the first and second beams and energy transfer between the first and second beams and voltages of opposite polarity applied to the first and second electrodes relative to the inner electrode primarily affects the other of the phase difference and the energy transfer.
In yet a further aspect, according to the invention there is provided an optical apparatus for selective control of the phase and magnitude of light. The optical apparatus includes an electrooptic substrate, first and second optical waveguides disposed with the substrate for transmitting first and second optical beams, respectively, where each optical waveguide of the pair has an input and an output downstream of the input end, and a plurality of first and second section types alternately interposed. The first section type includes an elongated coplanar electrode section disposed with the electrooptic substrate, the coplanar electrode section including an inner electrode spaced from a pair of outer electrodes by a pair of gaps wherein a selected length of each optical waveguide of the pair is disposed proximate a different gap of the pair of gaps for being exposed to electric fields extending between those electrodes spaced so as to form the different gap. The second section type includes a selected length of the pair of optical waveguides wherein the optical waveguides are spaced from each other so as to provide a selected optical coupling therebetween along the selected length. The plurality of first and second section types includes at least two sections of the first type and two sections of the second type. In operation, a first selected voltage applied between the inner and outer electrodes of one of the first type sections can vary the relative phase between the first and second beams and a second selected voltage applied between the inner electrode and outer electrodes of another of the first type sections can vary the relative magnitude of the first and second beams.
The invention also includes methods practiced in accordance with the teachings herein.
In one aspect, the invention provides a method of transforming the polarization of light from a predetermined polarization to a selected polarization, where the method includes the following steps: splitting an input beam of the light of the predetermined polarization into first and second beams; providing first and second electrooptic optical waveguides, selected lengths of the optical waveguides being optically coupled; providing the first and second beams, respectively, to the first and second electrooptic optical waveguides, each having a respective output, the step of providing including providing the first and second beams to the optical waveguides as substantially copolarized; selecting first and second electric fields to apply, respectively, to the first and second electrooptic optical waveguides; applying the first and second selected electric fields, respectively, to the first and second electrooptic optical waveguides; and combining the first and second beams downstream of the outputs of the first and second electrooptic optical waveguides to form an output beam having the selected polarization. The step of selecting the first and second electric fields includes selecting the fields such that the beams, when combined, form the output beam having the selected polarization.
In another aspect, the invention provides a method of transforming the polarization of light from a predetermined polarization to a selected polarization, where the method includes the following steps: splitting an input beam of the light of the predetermined polarization into first and second beams having substantially orthogonal polarizations; copolarizing the beams; adjusting at least one of the relative phase and the magnitude of the two copolarized beams; orthogonally polarizing the beams; and combining the two beams to form an output beam having the selected polarization, wherein the step of adjusting includes adjusting the at least one of the relative phase and the magnitude of the beams such that the beams, when orthogonally polarized and combined, form the output beam having the selected polarization.
Note that if the light having the predetermined polarization is known to be substantially linearly polarized, or if the some loss of power can be tolerated, the step of splitting the beam need not always be performed. For example, in yet a further aspect of the invention, there is provided a method of transforming input light having a predetermined polarization to output light having a selected polarization, where the method includes the following steps: providing a pair of optical waveguides including at least one coupled section, each optical waveguide of said pair having an input and an output; providing the input light to at least one of the inputs of the pair of electrooptic optical waveguides; varying the index of refraction of at least one section of at least one of waveguides of the pair; rotating the polarization of the light emanating from the output of one of the optical waveguides such the rotated polarization is orthogonal to the polarization of light emanating from the output of the other electrooptic optical waveguide of the pair; and combining the light having the rotated polarization with the light emanating from the output of the other electrooptic optical waveguide to form output light. The step of varying the index of refraction includes varying the index such that the input light having the predetermined polarization is transformed to the output light having the selected polarization. If desired, the input light can be linearized prior to providing the input light to one or both of the optical waveguides of the pair of optical waveguides. When the step of providing a pair of optical waveguides includes providing a pair of electrooptical waveguides, the input light tends to be linearized as it propagates along the electrooptic optical waveguide, if the waveguide propagates predominantly the one of the TM or TE modes, and not the other of the TM and TE modes.
If it is desired to provide output light having a substantially linear polarization, it is not always necessary to perform the step of combining the light from the outputs of the optical waveguides. For example, according to yet an additional aspect of the invention, there is provided a method of transforming input light having a predetermined polarization to output light having a selected polarization, where the method includes the following steps: splitting the input light into two orthogonally polarized beams; rotating the polarization of the light of one of the beams such that the light of the beams is copolarized; providing a pair of optical waveguides including at least one coupled section, each optical waveguide of said pair having an input and an output; providing each of the beams to different input of said optical waveguides of the pair of optical waveguides; and varying the index of refraction of at least one section of at least one of waveguides of the pair such that the light meaning from one of the outputs of the electrooptical waveguides of the pair has the selected polarization.
The steps of providing the pair of optical waveguides recited above can include providing a pair of electrooptic optical waveguides, and the steps of varying the index of refraction of at least one section of at least one of the waveguides can include applying a selected electric field to one or both of the optical waveguides for varying the index of refraction via the electrooptic effect.

Method and apparatus for providing transformation of the polarization of light

Uniphase Telecommunciations Products, Inc.