公开(公告)号：US07698305B2

公开(公告)日：2010-04-13

申请号：US11566170

申请日：2006-12-01

申请人： Chad Verbowski ,  Juhan Lee ,  Xiaogang Liu ,  Roussi Roussev ,  Yi-Min Wang

发明人： Chad Verbowski ,  Juhan Lee ,  Xiaogang Liu ,  Roussi Roussev ,  Yi-Min Wang

IPC分类号： G06F17/30

CPC分类号： G06F21/552 ,  G06F11/3644 ,  G06F21/57 ,  G06F2221/2101

摘要： Systems and methods for implementing system management which are based on reviewing of the interactions between one or more programs and the persistent state they tend to represent. The system provides for detection of modifications that occur within a system, verifying whether the modifications are approved or not and generating notifications on detecting unknown modifications.

摘要翻译： 基于对一个或多个程序之间的相互作用的审查以及他们倾向于表示的持续状态来实现系统管理的系统和方法。 该系统提供对系统内发生的修改的检测，验证修改是否被批准，并且在检测未知修改时产生通知。

公开(公告)号：US20080201337A1

公开(公告)日：2008-08-21

申请号：US12044760

申请日：2008-03-07

申请人： Chun Yuan ,  Jiahe Helen Wang ,  Yi-Min Wang ,  Zheng Zhang

发明人： Chun Yuan ,  Jiahe Helen Wang ,  Yi-Min Wang ,  Zheng Zhang

IPC分类号： G06F17/30

CPC分类号： H04L41/0853

摘要： A method and system for retrieving data from devices in a way that seeks to preserve privacy and ensure the integrity of the retrieved data is provided. A retrieval system is implemented on a network of devices that communicate with each other via a secure communications link. Each device is directly connected to one or more “friend” devices that it trusts. The retrieval system operates by forwarding a request for data from one friend device to another friend device. Each friend device may optionally add data to the request until all the requested data is added. The request with the retrieved data is returned to the device that initiated the request.

摘要翻译： 提供了以寻求保护隐私并确保检索的数据的完整性的方式从设备检索数据的方法和系统。 在通过安全通信链路彼此通信的设备网络上实现检索系统。 每个设备直接连接到它信任的一个或多个“朋友”设备。 检索系统通过将数据的请求从一个朋友设备转发到另一个朋友设备来操作。 每个朋友设备可以选择性地向请求中添加数据，直到添加所有请求的数据。 具有检索到的数据的请求将返回给发起请求的设备。

公开(公告)号：US20080133972A1

公开(公告)日：2008-06-05

申请号：US11566170

申请日：2006-12-01

申请人： Chad Verbowski ,  Juhan Lee ,  Xiaogang Liu ,  Roussi Roussev ,  Yi-Min Wang

发明人： Chad Verbowski ,  Juhan Lee ,  Xiaogang Liu ,  Roussi Roussev ,  Yi-Min Wang

IPC分类号： G06F11/30 ,  G06F12/16

CPC分类号： G06F21/552 ,  G06F11/3644 ,  G06F21/57 ,  G06F2221/2101

摘要： Systems and methods for implementing system management which are based on reviewing of the interactions between one or more programs and the persistent state they tend to represent. The system provides for detection of modifications that occur within a system, verifying whether the modifications are approved or not and generating notifications on detecting unknown modifications.

摘要翻译： 基于对一个或多个程序之间的相互作用的审查以及他们倾向于表示的持续状态来实现系统管理的系统和方法。 该系统提供对系统内发生的修改的检测，验证修改是否被批准，并且在检测未知修改时产生通知。

公开(公告)号：US20080127341A1

公开(公告)日：2008-05-29

申请号：US11772085

申请日：2007-06-29

申请人： Shuo Chen ,  Jiahe Helen Wang ,  Yi-Min Wang

发明人： Shuo Chen ,  Jiahe Helen Wang ,  Yi-Min Wang

IPC分类号： H04L9/32 ,  G06F3/00

CPC分类号： G06F11/3608 ,  G06F21/577 ,  G06F21/83

摘要： To achieve end-to-end security, traditional machine-to-machine security measures are insufficient if the integrity of the graphical user interface (GUI) is compromised. GUI logic flaws are a category of software vulnerabilities that result from logic flaws in GUI implementation. The invention described here is a technology for uncovering these flaws using a systematic reasoning approach. Major steps in the technology include: (1) mapping a visual invariant to a program invariant; (2) formally modeling the program logic, the user actions and the execution context, and systematically exploring the possibilities of violations of the program invariant; (3) finding real spoofing attacks based on the exploration.

摘要翻译： 为了实现端到端的安全性，如果图形用户界面（GUI）的完整性受到损害，则传统的机器对机器的安全措施是不够的。 GUI逻辑缺陷是由GUI实现中的逻辑缺陷引起的一类软件漏洞。 这里描述的发明是使用系统推理方法揭露这些缺陷的技术。 该技术的主要步骤包括：（1）将视觉不变量映射到程序不变; （2）对程序逻辑，用户动作和执行上下文进行正式建模，并系统地探索违反程序不变的可能性; （3）根据探索找到真正的欺骗攻击。

公开(公告)号：US07082553B1

公开(公告)日：2006-07-25

申请号：US09137907

申请日：1998-08-21

申请人： Yi-Min Wang

发明人： Yi-Min Wang

IPC分类号： G06F11/00

CPC分类号： G06F11/1479 ,  G06F11/1438 ,  G06F11/1487 ,  G06F11/1489 ,  G06F11/2023

摘要： A method and system for improving reliability and availability in distributed computer applications. The method and system may be used in the context of primary-backup, failover recovery. The method involves software-fault tolerance using technique of structured storage; referral components; and wrappers. The method and system exploit the platform and operating system independence of component object models to allow the dynamic linkage of different component objects, the objects being resident on different inter-linked machines, based on the application requirements at any given point in time.

摘要翻译： 一种用于提高分布式计算机应用程序的可靠性和可用性的方法和系统。 方法和系统可以在主备份，故障转移恢复的上下文中使用。 该方法涉及使用结构化存储技术的软件容错; 转介组件; 和包装纸。 该方法和系统利用组件对象模型的平台和操作系统独立性，根据任何给定时间点的应用需求，允许不同组件对象的动态链接，对象驻留在不同的互联机器上。

公开(公告)号：US20060059091A1

公开(公告)日：2006-03-16

申请号：US11263673

申请日：2005-10-31

申请人： Yi-Min Wang ,  Qixiang Sun ,  Daniel Simon ,  Wilfred Russell ,  Lili Qiu ,  Venkata Padmanabhan

发明人： Yi-Min Wang ,  Qixiang Sun ,  Daniel Simon ,  Wilfred Russell ,  Lili Qiu ,  Venkata Padmanabhan

IPC分类号： H04L9/00

CPC分类号： H04L63/0407 ,  G06F2221/2107 ,  G06F2221/2119 ,  G06Q20/10 ,  G06Q20/102 ,  G06Q20/1085 ,  G06Q20/40 ,  H04L63/1408

摘要： A system and method is provided for evaluating the effectiveness of data encryption for hiding the identity of the source of Web traffic. A signature is constructed from encrypted Web traffic for a Web page sent by a target Web site, and the signature is compared with archived traffic signatures obtained by accessing various Web pages of interest in advance. If the signature of the detected encrypted Web traffic matches a stored traffic signature beyond a pre-set statistical threshold, a positive match is found, and the source of the traffic is identified. Countermeasures for reducing the reliability of source identification based on traffic signature matching are provided.

公开(公告)号：US20050172120A1

公开(公告)日：2005-08-04

申请号：US11072143

申请日：2005-03-04

申请人： Yi-Min Wang ,  Qixiang Sun ,  Daniel Simon ,  Wilfred Russell

发明人： Yi-Min Wang ,  Qixiang Sun ,  Daniel Simon ,  Wilfred Russell

IPC分类号： H04L29/06 ,  H04L29/08 ,  H04L9/00

CPC分类号： H04L63/0442 ,  G06Q20/3821 ,  H04L29/06 ,  H04L63/062 ,  H04L67/02 ,  H04L67/327 ,  H04L69/329

摘要： A system and method is provided for handling network communications between a client and a target server on the Internet to protect the privacy and anonymity of the client. For a session between the client and the target server, a routing control server sets up a routing chain using a plurality of Web servers randomly selected from a pool of participating Web servers as routers for routing messages between the client and the target server. To prevent traffic analysis, an “onion encryption” scheme is applied to the messages as they are forwarded along the routing chain. A payment service cooperating with the routing control server allows a user to pay for the privacy protection service without revealing her real identity.

摘要翻译： 提供了一种用于处理因特网上的客户机和目标服务器之间的网络通信以保护客户端的隐私和匿名性的系统和方法。 对于客户端和目标服务器之间的会话，路由控制服务器使用从参与的Web服务器池中随机选择的多个Web服务器设置路由链，作为用于在客户端和目标服务器之间路由消息的路由器。 为了防止流量分析，当消息沿着路由链转发时，“洋葱加密”方案被应用于消息。 与路由控制服务器协作的支付服务器允许用户支付隐私保护服务，而不暴露她的真实身份。

公开(公告)号：US06470389B1

公开(公告)日：2002-10-22

申请号：US08818989

申请日：1997-03-14

申请人： Pi-Yu Chung ,  Om P. Damani ,  Yennun Huang ,  Chandra M. Kintala ,  Yi-Min Wang

发明人： Pi-Yu Chung ,  Om P. Damani ,  Yennun Huang ,  Chandra M. Kintala ,  Yi-Min Wang

IPC分类号： G06F1516

CPC分类号： H04L29/06 ,  G06F2209/462 ,  H04L29/12047 ,  H04L29/12292 ,  H04L29/12783 ,  H04L61/15 ,  H04L61/2069 ,  H04L61/35 ,  H04L67/1002 ,  H04L67/1023 ,  H04L67/1034 ,  H04L67/42 ,  H04L69/16

摘要： Methods and apparatus for hosting a network service on a cluster of servers, each including a primary and a secondary Internet Protocol (IP) address. A common cluster address is assigned as the secondary address to each of the servers in the cluster. The cluster address may be assigned in UNIX-based servers using an ifconfig alias option, and may be a ghost IP address that is not used as a primary address by any server in the cluster. Client requests directed to the cluster address are dispatched such that only one of the servers of the cluster responds to a given client request. The dispatching may use a routing-based technique, in which all client requests directed to the cluster address are routed to a dispatcher connected to the local network of the server cluster. The dispatcher then applies a hash function to the client IP address in order to select one of the servers to process the request. The dispatching may alternatively use a broadcast-based technique, in which a router broadcasts client requests having the cluster address to all of the servers of the cluster over a local network. The servers then each provide a filtering routine, which may involve comparing a server identifier with a hash value generated from a client address, in order to ensure that only one server responds to each request broadcast by the router.

摘要翻译： 在服务器集群上托管网络服务的方法和装置，每个服务器包括主要和辅助因特网协议（IP）地址。 将通用群集地址分配给群集中的每个服务器的辅助地址。 可以使用ifconfig别名选项在基于UNIX的服务器中分配群集地址，并且可能是群集中的任何服务器未被用作主地址的ghost IP地址。 调度定向到集群地址的客户端请求，使得只有一个集群的服务器响应给定的客户端请求。 调度可以使用基于路由的技术，其中指向集群地址的所有客户端请求被路由到连接到服务器集群的本地网络的分派器。 调度员然后将哈希函数应用于客户端IP地址，以便选择其中一个服务器来处理该请求。 调度可以替代地使用基于广播的技术，其中路由器通过本地网络向群集的所有服务器广播具有簇地址的客户端请求。 然后，服务器每个提供过滤例程，其可以涉及将服务器标识符与从客户端地址生成的散列值进行比较，以便确保只有一个服务器响应路由器广播的每个请求。

公开(公告)号：US6044475A

公开(公告)日：2000-03-28

申请号：US981297

申请日：1998-03-03

申请人： Pi-Yu Chung ,  Yennun Huang ,  Chandra Kintala ,  Kiem-Phong Vo ,  Yi-Min Wang

发明人： Pi-Yu Chung ,  Yennun Huang ,  Chandra Kintala ,  Kiem-Phong Vo ,  Yi-Min Wang

IPC分类号： G06F11/14

CPC分类号： G06F11/1438

摘要： A checkpoint and restoration system is disclosed to provide checkpoint and restoration techniques for user application processes which save the process state, including the volatile state and desired portions of the persistent state, during normal execution, and thereafter restore the saved state. A lazy checkpoint technique is disclosed which delays the taking of the persistent state checkpoint until an inconsistency between the checkpointed volatile state and a portion of the persistent state is about to occur. The disclosed checkpoint and restoration system allows a user or a user application process to specify selected portions of the persistent state to be excluded from a checkpoint. A selected portion of the pre-restoring process state, such as a return value argument, may be protected before restoring the user application process to a checkpointed state, so that the pre-restoration values of the protected state are retained following restoration of the checkpoint. The retained return value allows one or more segments of restoration code to be executed following a restoration and a normal execution mode to be distinguished from a restoration mode.

摘要翻译： PCT No.PCT / US95 / 07660 Sec。 371日期1998年3月3日 102（e）1998年3月3日PCT提交1995年6月16日PCT公布。 出版物WO97 / 00477 日期1997年1月3日公开了一种检查点和恢复系统，用于为正常执行期间保存处理状态（包括易失性状态和持久状态的期望部分）的用户应用进程提供检查点和恢复技术，然后恢复保存状态 。 公开了一种延迟的检查点技术，其延迟持续状态检查点的获取，直到检查点的易失性状态和持续状态的一部分之间的不一致将要发生。 所公开的检查点和恢复系统允许用户或用户应用进程指定要从检查点排除的持久状态的所选部分。 在将用户应用进程恢复到检查点状态之前，可以保护预恢复过程状态的所选部分（诸如返回值参数），使得在恢复检查点之后保留保护状态的恢复前值 。 保留的返回值允许在恢复之后执行恢复代码的一个或多个段，并且将正常执行模式与恢复模式区分开。

公开(公告)号：US5664088A

公开(公告)日：1997-09-02

申请号：US565038

申请日：1995-11-30

申请人： Alexander Borisovitch Romanovsky ,  Yi-Min Wang

发明人： Alexander Borisovitch Romanovsky ,  Yi-Min Wang

IPC分类号： G06F11/14 ,  G06F11/16

CPC分类号： G06F11/1438 ,  G06F11/1479

摘要： A method for deadlock recovery in a shared resource multiprocess message passing computer system. The processes executing in the computer system perform periodic local checkpoints and communicate via inter-process messages. Upon detection of a deadlock in the computer system, inter-process rollback dependency is analyzed in order to choose a resource to reclaim. The choice of a resource to reclaim is made such that a resource manager which manages the resource can be rolled back so as to reclaim the resource, and such that an application process which is waiting for the resource is not rolled back past the point at which deadlock was detected. Thus, upon system restart, the reclaimed resource can be provided to the waiting process, and the waiting process can execute past the deadlock point. In one embodiment, the recovery line is determined by selecting appropriate checkpoints from a resource manager process and an application process, and determining the most recent consistent global checkpoint which contains the selected checkpoints.

摘要翻译： 一种用于共享资源多进程消息传递计算机系统中的死锁恢复的方法。 在计算机系统中执行的进程执行周期性本地检查点并通过进程间消息进行通信。 在检测到计算机系统中的死锁时，分析了进程间回滚依赖关系，以便选择资源进行回收。 进行回收资源的选择使得可以回滚管理资源的资源管理器以回收资源，并且使得正在等待资源的应用进程不会回滚到超过所述资源的点， 检测到死锁。 因此，在系统重新启动时，可以将回收资源提供给等待进程，等待进程可以执行超过死锁点。 在一个实施例中，通过从资源管理器进程和应用进程选择合适的检查点，并且确定包含所选择的检查点的最新的一致的全局检查点来确定恢复线。