International Business Machines Corporation

Harold D Dykeman

Michael Baentsch

Michael Charles Osborne

Peter Buhler

Thomas D Weigold

Reto Josef Hermann

Thorsten Kramp

Michael Peter Kuyper-Hammond

Willibald A Doeringer

Tamas Visegrady

Soumitra Sarkar

Kathryn Heninger Britton

Diane Phylis Pozefsky

Olivier Gallay

Allan K Edwards

Olle L Sundstroem

Roger D Turner

Jacint Szabo

Johny Mathew

Claude Basso

Jeffrey Haskell Derby

Philippe Damon

Ken Van Vu

Paolo Scotton

James P Gray

Andrea Giovannini

Thomas R Locher

Thomas Eirich

Francesco Fusco

Joshua S Auerbach

Frank Hoering

Chiara Marchiori

John H Wilson

Raymond F Bird

Diego Alejandro Ortiz-Yepes

Haldon J Sandick

Matthias Kaiserswerth

Liang Li

Tein-Yaw David Chung

Adam Ivankay

Yue T Yeung

Kevin Thandiackal

Winston W Chung

Tein-Yaw D Chung

Ivan Girardi

Mario Zusag

Winston W-K Chung

The present disclosure relates to a method for query expansion. The method comprises: a) receiving a current query having at least one search term; b) inputting the at least one search term of the current query to a set of one or more query expansion modules, wherein the query expansion modules are configured to predict expansion terms of input terms; c) receiving from the set of expansion modules candidate expansion terms of the search term; d) modifying the current query using at least part of the candidate expansion terms, resulting in a modified query having at least one modified search term, The method further comprises repeating steps b) to d) using the modified query as the current query, the repeating being performed until a predefined stopping criterion is fulfilled.

Query expansion in information retrieval systems

A security device () is provided for facilitating management of secret data items such as cryptographic keys which are used by a remote server () to authenticate operations of the server (). The device () has a user interface (), control logic () and a computer interface () for connecting the device () to a local user computer () for communication with the remote server () via a data communications network (). The control logic is adapted to establish via the user computer () a mutually-authenticated connection for encrypted end-to-end communications between the device () and server (). In a backup operation, the secret data items are received from the server () via this connection. The control logic interacts with the user via the user interface () to obtain user authorization to backup secret data items and, in response, stores the secret data items in memory (). To restore secret data items to the server, the control logic interacts with the user via the user interface () to obtain user authorization to restore secret data items and, in response, sends the secret data items to the server () via said connection.

Management of secret data items used for server authentication

A method, a secure device and a computer program product for securely managing files. The method includes providing a secure device, where the secure device is protected by design against malicious software or malware and adapted to establish a connection to a server via a host, the host connected to the server through a telecommunication network, upon receiving a request for using a file stored on the secure device, processing the request at the secure device according to an updated use permission associated to the file, where the updated use permission is obtained by instructing at the secure device to establish a connection between the secure device and the server via the host and updating at the device the use permission associated to the file, according to permission data sent from the server through the established connection.

Method, secure device, system and computer program product for securely managing files

A method, a secure device, a system and a computer program product for securely managing user access to a file system. The method includes providing a secure device, where the secure device is protected by design against malicious software or malware and adapted to establish a connection to a server through a telecommunication network establishing a connection between the secure device and the server, receiving at the secure device, through the established connection, data pertaining to a file system identifying files which are at least partly stored outside the secure device, exposing at the secure device the file system to a user, based on the data received from the server, the file system navigable by the user.

Method, secure device, system and computer program product for securely managing user access to a file system

A method for allocating energy to a plurality of devices, wherein each device is configured to consume, store and/or supply energy, the method includes the steps of: assigning each device to a group of devices; assigning an aggregation node device to each group of devices; for a selection of devices transmitting local power cost functions of the devices and/or power usage profiles of the devices with respect to a predetermined time slot to the assigned aggregation node device; at the aggregation node device, generating aggregated data as a function of the received local power cost functions and/or power usage profiles; transmitting the aggregated data to a central processing device; at the central processing device, optimizing a global cost function for allocating power to the devices as a function of the aggregated data.

Method and system for allocating energy

A method for compressing a sequence of records, each record comprising a sequence of fields, comprises steps of buffering a record in a line of a matrix, reordering the lines of the matrix according to locality sensitive hash values of the buffered records such that records with similar contents in corresponding fields are placed in proximity, and consolidating fields in columns of the matrix into a block of codes. In this, consolidating yields codes of one of a first type comprising a sequence of individual fields and a second type comprising a sequence of fields with at least one repetition. The second type of code comprises a presence field indicating repeated fields and an iteration field indicating a number of respective repetitions. Decompression of the records from the block codes compressed above is also described.

Stream compression and decompression

A method for digitally signing a document, a secure device, and a computer program product for implementing the method. The method employs a secure device which is protected against malicious software or malware and is adapted to establish a secure connection to a recipient via a host. The method includes: connecting to a terminal; accessing the contents of a document received by the secure device; instructing at the secure device to communicate the accessed contents to an output device other than the terminal such that the contents can be verified by a user; ascertaining at the secure device a command received to digitally sign the document; executing at the secure device the ascertained command; and instructing to send a digitally signed document to a recipient over a connection established via the host connected to a telecommunication network.

Method, secure device, system and computer program product for digitally signing a document

A mechanism is provided for secure PIN management of a user trusted device. A user trusted device detects a memory card coupled to the user trusted device. The user trusted device receives user input of an external PIN (ext_PIN). The user trusted device identifies a key (K) associated with the external PIN, wherein the key is stored in the persistent memory. The user trusted device computes a card PIN (card_PIN) using a function (f) and the key as stored on the persistent memory, wherein the card PIN is computed using the following equation: card_PIN=f(K, ext_PIN). The user trusted device unlocks the memory card using the card PIN, thereby forming an unlocked memory card.

Secure PIN management of a user trusted device

Methods and apparatus are provided for alternative routing of a connection between a source node and a destination node in a PNNI hierarchical network. The alternative routing method comprises responding to a failed connection between said nodes due to a sole-access element of the network structure as seen by the source node, where a said sole-access element is an element which provides sole access to the destination node in said network structure, by: selecting at least one non-sole-access element of the route used by the failed connection in said network structure; identifying an alternative route for the connection in said network structure which does not utilize the at least one selected element; and using the alternative route for establishment of the connection between said nodes.

Alternative routing in PNNI hierarchical networks

A multiprotocol transport network (MPTN) gateway provides transparent interconnection of two or more SPTNs running different transport layer protocols to form an integrated heterogeneous MPTN. The MPTN gateway of the present invention has no dependencies on the particular transport protocols running on the SPTNs being interconnected as it utilizes a common transport provider (a Gateway Services Protocol Boundary (GSPB)) between the SPTN transport protocols and the gateway components. The MPTN gateway supports connections between end systems across multiple intermediate networks. The MPTN gateway provides automatic routing based on dynamic participation in the routing protocols of the interconnected SPTNs so that any number of gateways may be interconnected and in any topology desired. As the MPTN gateway has a general architecture and acquires routing information automatically, it supports not only other MPTN nodes and gateways but also non-MPTN nodes and gateways.

General transport layer gateway for heterogeneous networks

A system for interconnecting widely separated local area networks (LANs) by means of a wide area network (WAN) utilizes network level facilities to establish a connection through the wide area network and to create connection table entries at the WAN access point which allow subsequent data frames to be transmitted through the wide area network without such network level operations. More particularly, the various LANs are combined into search groups, represented by address prefixes, to which LAN-initiated connection requests can be broadcast and which can respond so as to establish the data path connections. This system has the connection flexibility of a prior art router and, at the same time, the low overhead of a prior art bridge.

Methods and apparatus for interconnecting local area networks with wide

A Transport Layer Protocol Boundary (TLPB) architecture is described which will permit an application program to run over a non-native transport protocol without first generating a protocol compensation package tailored to the transport protocols assumed by the program's application programming interface and by the available transport provider. All transport functions required by the program are converted to standardized or TLPB representations. When a connection between the first application program and a second remote application is requested, the individual required TLPB transport functions are compared to corresponding functions supported by the transport provider. Compensations are invoked only where there is a mismatch. The node on which the remote application program runs is informed of the compensations so that necessary de-compensation operations can be performed before the data is delivered to the remote application program.

Compensation for mismatched transport protocols in a data communications

Growing community of inventors

Rueschlikon, Switzerland

Harold D Dykeman