KR20060041165A - Pervasive, user-centric network security enabled by dynamic datagram switch and an on-demand authentication and encryption scheme through mobile intelligent data carriers - Google Patents

Abstract

Methods and systems are provided for improving access control, administrative monitoring, reliability, as well as flexibility of data transmission and remote application sharing over a network. Secure, stable network connections and efficient network transactions among multiple users are supported by an open and distributed client-server architecture. A datagram schema is adapted to enable dynamic datagram switching in support of a multitude of applications and network services. Mobile intelligent data carriers are provided that allow for the implementation of an authentication and encryption scheme. The intelligent data carriers are adapted to target deliver applications to authorized users, thereby achieving access control to not only data but also applications. The authentication and encryption scheme in one embodiment is based on physical or performance biometrics. The methods and systems of this disclosure may be advantageously deployed in an enterprise network environment to support a wide spectrum of business, research, and administrative operations.

Description

Pervasive, USER-CENTRIC NETWORK SECURITY ENABLED BY DYNAMIC DATAGRAM SWITCH AND AN ON-DEMAND AUTHENTICATION AND ENCRYPTION SCHEME THROUGH MOBILE INTELLIGENT DATA CARRIERS}

Background

Field of Embodiments

The present invention relates generally to digital network communications. Specifically, the present invention relates to the provision of remote application services and secure data transmission in public or private network settings. More specifically, methods and integrated systems are provided for improved access control, management monitoring, data transmission over a network and reliability and integration of remote application sharing. The disclosed methods and systems use a datagram schema that enables dynamic data switching in network transactions where multiple applications and network services are supported. Removable intelligent data carriers are provided in various embodiments that enable the implementation of an authentication and encryption scheme. Pervasive, user-centric network security enabled by the disclosed methods and systems, IT infrastructure and various online commerce for financial and banking environments, national security and military information technology (IT) systems, healthcare networks, legal and other professional advisory services It may be conveniently disposed in a transaction system or the like. Systems and methods in accordance with the present invention may be implemented in combination with biometrics and other suitable authentication means.

Description of the related field

The digital revolution of internationalization is changing human life in an unprecedented way. The growth and evolution of the Internet is accelerating the expansion of existing businesses, facilitating the emergence of businesses between new countries. In the current international economy, the viability of a business or research institution depends heavily on the efficiency of processing and managing information. Data transmission and management are playing an increasingly important role in various industries. Engineers and business people have faced important attempts at institutional security network systems that enable reliable and efficient data transmission, effective access control, and remote sharing and management of applications between distributed computers served to multiple users.

Various network configurations have been used for standardized IT infrastructure. For example, Ethernet, token ring, and client-server architectures have been widely adopted. Related techniques for data encryption and compression are similarly known and have been used to facilitate secure data transmission. Existing network systems often suffer from intercepts of data transactions and loss of network connectivity. In general, it is difficult to recover a lost connection. It is more difficult to accurately reestablish the parameters of the lost connection to ensure the integrity of the reconnection. Data may be lost and data transmission needs to be restarted. If the starting level of information allowing recovery can not be tracked and collected, the loss may be permanent. This lack of stability greatly threatens the reliability of data transmission and thus presents a fatal problem for distributed data processing and management. There is a significant cost in dealing with this failure. As is evident in the difficulties faced by the online electronics business in recent times, this problem can hinder the entire industry.

The problem of unstable—and therefore unreliable—network communication is the lack of comprehensive, robust, user-friendly, and cost-effective network security solutions for secure information distribution and application management in distributed business IT environments. Deepened by Private businesses and public agencies often suffer significant financial losses from security breaches. In addition, a lot of money is wasted on inefficient IT security solutions because of unintegrated information and application management.

The disadvantages of current network security solutions are obvious. Primarily, four aspects are significant: First, there is a lack of integrated systems that protect the entire network without significantly limiting business growth. To perform different security functions, organizations are forced to use multiple products from different vendors. Each of these products addresses only the individual aspects of the overall network security needs. For example, a firewall does not encrypt data being transmitted over the internet; Intrusion Detection System (IDS) does not verify and guarantee that the person opening the virtual private network (VPN) by entering an authenticated login name and password is actually the intended user; VPNs do not help IT monitor user rights and access policies. Thus, existing systems or methods do not protect every aspect of the network alone. Relying on multiple security products from competing sellers creates incompatibilities. In addition, maintaining variable peripheral security devices and software packages is very complex and overly expensive. In general, these patchwork solutions are not effective in protecting standardized IT frameworks.

Second, the existing focus is on protecting devices and data. This system-centric approach cannot protect the access points of individual users of the device. This inherent problem of the current approach becomes more pronounced as the number of devices and user mobility increases—the world is inevitable because it is transitioning to pervasive computing.

To assess the shortcomings inherent in system-centric systems, various scenarios of cybercrime can be considered. Cybercrime is often expressed as an intruder's attempt to disguise that identity, either by impersonating another person or hiding a trace on a route. Since the techniques used to establish and verify the identity of a user are at least partially error-prone, these attempts succeed too often. For example, most passwords are easy to break; Passwords are often stored on devices that are obvious or easily compromised. Existing infrastructure support digital certificates and public / private keys can also be abused. Thus, existing methods of identifying the users of network devices and protecting the devices for these users-and thus system-centric-represent inherent security barriers. Unless effective measures are taken to accurately identify the identity of a user attempting to access a protected network, a high level of security will remain an illusion. Thus, for better network security, a major paradigm shift from device and data protection to user protection is justified. A user-centric approach to establishing and validating user identities to enable mobile access and event-based user-centric security is desirable.

Third, traditional IT security solutions are too complex for the end user. The average user is expected to perform a complex security process, which often leads to errors and security failures in a business IT environment. For example, a VPN is not easy to install, operate or maintain. Encrypted emails include excessive work, with very few users. Even choosing and remembering a good password can be very annoying for many. Relying on non-IT professionals for complex security processes is ineffective. The average user may want to find a way to bypass the security process or ignore them completely. In addition, maintaining and operating a flood of software patches exhausts the resources of many IT departments and causes them to exceed capacity. Thus, there is a need for an effective security solution that is user friendly and sufficient with minimal operation and management.

Finally, as in other areas, there is a certain inertia in the IT security industry. Changes and new methodologies are somewhat resisted. Traditional approaches are widespread and dominate network security solutions on both the provider and consumer sides. Obsession with existing technologies and ad hoc approaches to improvements and transformations are really hampering the development of innovative solutions.

For the reasons mentioned above, there is a need for a new network security paradigm that delivers the desired reliability, efficiency, and user friendliness. The kind of security solutions that can meet the needs of distributed IT frameworks and support pervasive computing and information processing must cope with existing errors.

Experienced network engineers or users familiar with business IT networks will recognize the importance of better IT security solutions. For this purpose, it would be useful to briefly review the history of standardized computing and IT networks.

The first computer was the mainframe. This complex monolithic device required a protected environment to function properly. These devices could only be operated by skilled technicians with very specific knowledge. Access to these devices was limited, and these devices provided limited connectivity with other devices. As a result, they were easily protected.

The advent of personal computers (PCs), the evolution of network technologies, and especially the recent explosive growth of the Internet, have changed the way people use computers and relate to them. The size of the computer device has decreased; The devices have become easily mobile and can be operated by ordinary individuals with the help of a friendly user interface. Computers are connected to create a computer network that enables sharing of information and applications. The Internet has driven network connectivity to its climax-global connectivity that can be aggregates. In addition to desktop and laptop PCs, personal digital assistants (PDAs), table PCs, and mobile phones have become commonplace among people who want network access from outside of homes and offices.

Rapid advances in technology and growing business demands have provided an unprecedented attempt in the global IT sector. The ever-increasing amount of data-accessible from vast devices-needs to be protected. This protection must also be carried out against the background of an "always-on" connection. In addition, regulatory initiation is prominent in many countries dealing with privacy and information ownership over the Internet. Clearly, there is a need for a technically robust and comprehensive business-wise network security solution, particularly in view of the inevitable next phase of the IT evolution represented by pervasive computing. All analog devices are being replaced by digital devices and will be replaced. Televisions, telephones, CDs and DVDs, digital cameras, video cameras, and computer game platforms—all if not yet—will support Internet access. As network data access becomes available anytime, anywhere, the need to protect private unified data and sensitive private information is growing, and the difficulty of meeting these needs is increasing accordingly.

In summary, reflecting the evolution of organized IT infrastructures and current deficiencies in secure network communications, those skilled in the art will appreciate the need for systems and methods for improving the security, stability, efficiency, and fluidity of network data transmission, and It will recognize the need for a new network paradigm for secure and reliable enterprise-wide information management and application sharing.

Summary of Various Embodiments

It is therefore an object of the present invention to provide a system and method for improving the reliability, fluidity and efficiency of secure data transmission, and application sharing over a network. More specifically, the methods and systems disclosed herein enable open client-server architectures that support secure and flexible network connections, and reliable and efficient network transactions among multiple users. These IT network platforms deliver pervasive security, i.e. the security required for a variety of networked devices, and are more user-centric, i.e., more user-protected than the devices the user uses to connect to the network. Pervasive and user-centric security may be implemented anytime, anywhere, using any network device, in accordance with one embodiment of the systems and methods disclosed herein.

In one embodiment, a datagram schema is provided, which allows for the implementation of dynamic datagram switching supporting multiple applications and network services. In another embodiment, a mobile intelligent data carrier is provided to implement an authentication and encryption scheme for user authentication. Pervasive, user-centric network security in accordance with the present invention is used in enterprise IT environments, including, for example, government, military, and factories where distributed computer networks are used, as well as in the financial services, insurance, consulting, healthcare and pharmaceutical industries. It may be conveniently arranged in. According to various embodiments, such an IT security platform may facilitate a wide range of business operations, particularly including warehousing, sales, customer service, marketing and advertising, teleconferencing, remote sharing of various applications. The systems and methods of the present invention may be implemented in combination with biometrics and another suitable authentication methodology in certain embodiments.

Thus, the present invention provides a distributed network security platform over existing patchwork solutions. As the network dynamically scales resources to global users connecting through various arrays of devices or application interfaces, a holistic approach is provided and organizations can provide a single solution to protect the entire network. The network security platform of the present invention focuses on the protection of a user rather than the various network host devices used by the user. This user-centric approach provides unprecedented simplicity and flexibility, and gives network systems improved user friendliness. Enhanced security is easy for the user. However, the user's activity may be effectively monitored as needed. The IT department has complete control over all user access.

In accordance with the present invention, in one embodiment, a secure network connection system is provided between one or more users and one or more network servers. The system comprises: (i) a memory for storing data, (ii) one input-output device for inputting and outputting data, and (iii) one for processing data stored in the memory. An intelligent data carrier comprising a processor, coupled to the host computer device, capable of transmitting data on the network via the input-output device, and configured to establish a network identity for the user via authentication and encryption schemes; And a dynamic datagram switch for dynamically allocating and swapping datagrams for multiple applications serviced to one or more users.

According to one embodiment, the intelligent data carrier is mobile. According to another embodiment, the intelligent data carrier is implemented with one of a USB key, compact flash, smart media, compact disk, DVD, PDA, Firewire device and token device.

According to yet another embodiment, an authentication and encryption scheme includes: (a) forwarding a request from an intelligent data carrier to a network server where the intelligent data carrier is authenticated; (b) the network server providing a plurality of authentication methods to the intelligent data carrier; (c) the intelligent data carrier selecting one from the plurality of authentication methods through the event; (d) based on the selected method, the network server sending a request for authentication data from the intelligent data carrier to the intelligent data carrier; (e) the network server converting authentication data received from the intelligent data carrier into one or more data authentication objects, each data authentication object being a data vector object that can be analyzed using one or more classifiers; (f) the network server analyzing the data authentication object according to one or more classifiers to determine an authentication result; And (g) the network server transmitting a result indicating the successful authentication attempt or the failed authentication attempt to the intelligent data carrier.

According to another embodiment, the event of step (c) is a mouse click, a touch on the screen, a keystroke, speech, or biometric measurement.

According to another embodiment, the requirement of step (e) comprises at least one of pseudo random and true random codes. Pseudo random codes are generated based on a mathematically precomputed list. Pure random code is generated by sampling and processing entropy sources outside the system.

According to another embodiment, randomization is performed with one or more random generators and one or more independent seeds.

According to another embodiment, the analysis of step (f) is based on one or more analysis rules. In yet another embodiment, the one or more analysis rules comprise classification according to one or more classifiers of step (e).

According to another embodiment, the classification is speaker verification and the data object vector comprises two classes, a target speaker and a surname. Each class is characterized by a probability density function, and the decision of step (f) is a matter of binary decision.

According to yet another embodiment, the determination of step (f) comprises calculating at least one of a sum, an advantage and a probability from one or more data vector objects based on the one or more classifiers of step (e). In another embodiment, the sum is one of the highest and random sums calculated from one or more data vector objects.

According to another embodiment, the one or more classifiers of step (e) comprise a super classifier derived from two or more data vector objects.

According to another embodiment, the super classifier is based on physical biometrics, including at least one of voice recognition, fingerprint, handprint, blood type, DNA test, retinal or iris scan, and face recognition. According to another embodiment, the super classifier is based on behavioral biometrics that includes habits or patterns of personal behavior.

According to another embodiment, the authentication and encryption scheme comprises asymmetric and symmetric multi-password encryption. According to yet another embodiment, encryption uses at least one of output feedback, cipher feedback, cipher blockchain, and cipher forwarding. In another embodiment, the encryption is based on the Next Generation Encryption Standard (AES) Rijndael.

According to yet another embodiment, the authentication and encryption scheme uses secure key exchange (SKE). In one embodiment, the SKE uses a public key system. In another embodiment, the SKE uses an elliptic curve cryptosystem (ECC) private key.

In yet another embodiment, the authentication and encryption scheme is based on a logical test that verifies that the intelligent data carrier has been registered with the server, a device test for verifying physical parameters at the intelligent data carrier and host computer device, and a user based on event level data. At least one of a personal test for authenticating.

According to yet another embodiment, the plurality of applications includes at least one of a Windows-based remote terminal server application, an application on a 3270/5250 terminal emulator for the mainframe, a direct embedded application, and a multimedia application. The application includes at least one of a database application, a data analysis tool, a customer relationship management (CRM) tool, and an enterprise resource planning (ERP) package.

According to another embodiment, the dynamic datagram switch includes a datagram schema and parser. The datagram schema includes two or more datagrams belonging to one or more datagram types. The datagram is configured to carry (i) content data for network transmissions, and (ii) further information for managing and controlling network connections and to support network applications. Each datagram type has multiple functions. The parser is configured to parse one or more datagram types.

According to another embodiment, the datagram schema includes one or more major datagram types, and one or more minor datagram types within one primary datagram type.

According to yet another embodiment, the parser may parse a matrix of datagram types. According to yet another embodiment, the matrix comprises a first plurality of primary datagram types and a second plurality of secondary datagram types within the first plurality of primary datagram types.

According to yet another embodiment, the primary datagram type includes (i) a server message and a connection control datagram authenticating a user connection, (ii) a content datagram transmitting content data, (iii) point to point, point Notification datagrams for managing multipoint-to-multipoint and multipoint-to-multipoint data transmissions, (iv) Connection proxy datagrams that carry proxy data between network servers and intelligent data carriers, and (v) Instant sending messages in real time Message types, (vi) bulk content delivery datagrams carrying large amounts of data and media files, (vii) user directory datagrams to navigate network users, and (viii) remotely managed datagrams to remotely control network users. It is selected from the group containing.

According to yet another embodiment, each datagram in the datagram schema includes (A) (i) one or more primary datagram types, (ii) one or more secondary datagram types, (iii) datagram lengths, and (iv) A header field for the datagram checksum, and (B) a general layout comprising a datagram payload for carrying data in the transmission.

In yet another embodiment, the general layout includes one or more additional header fields. In another embodiment, the general layout follows the TCP header.

In yet another embodiment, the intelligent data carrier further comprises a radar connector; The radar connector interfaces with the network and is configured to monitor and control the network connection. In yet another embodiment, the network server further includes a radar connector that monitors and controls network connections. The radar connector of the network server is connected to the radar connector of the intelligent data carrier via the network. In yet another embodiment, the radar connector is further configured to detect the lost connection, initiate a contact to the network server and reestablish the connection.

According to another embodiment, the secure network connection system further comprises an injector configured to connect the existing network to the network server and to transmit data via the network server between the existing network and the intelligent data carrier, the existing network Is wireless or wired. In yet another embodiment, the injector further comprises a radar connector that interfaces with the network and monitors and controls the network connection.

In accordance with the present invention, in another embodiment, a client-server communication system is provided that includes one or more servers and one client. The server includes a dynamic datagram switch that dynamically allocates and swaps datagrams for a plurality of network applications. A client is an intelligent data carrier capable of connecting with a host computer device and sending data over an input-output device on a network. The intelligent data carrier is configured to establish network user identity through an authentication and encryption scheme for secure data transmission between the server and the client.

According to yet another embodiment, the client-server communication system further comprises an injector configured to connect the existing network to the server and to transmit data between the existing network and the client via the server. Existing networks are wired or wireless.

According to yet another embodiment, each of the server, client and injector comprises a radar connector. The radar interface interfaces with the network and is configured to monitor and control the network connection. The radar connector of the client is connected to the radar connector of the server via the network, and the radar connector of the injector is connected to the radar connector of the server via the network.

According to yet another embodiment, the server of the client-server communication system further comprises an encrypted virtual file system for storing dedicated data for the client.

According to the invention, in another embodiment, at least (i) one memory for storing data, (ii) one input-output device for inputting and outputting data, and (iii) processing data stored in the memory An intelligent data carrier is provided that includes one processor. An intelligent data carrier can be connected to a host computer device to transmit data on a network via an input-output device. Data transmission is via dynamic switch datagrams. The intelligent data carrier is configured to establish a network user identity through an authentication and encryption scheme for secure network data transmission.

In accordance with the present invention, in another embodiment, a method for secure network communication is provided. The method comprises the steps of: sending an intelligent data carrier to a network user, which is connected to a host computer device on the network, which can transmit data on the network via an IO device and establish a network identity for the network user via authentication and encryption schemes. ; And providing a server on the network with a dynamic datagram switch for dynamic allocation and swapping of datagrams in support of multiple applications. In various embodiments, the method combines with a data vector object to perform authentication, encryption, and randomization. In particular embodiments, super classifiers are used that have physical and behavioral biometric measurements in particular.

In accordance with the present invention, in another embodiment, a method of delivering one or more applications to a user is provided. The method sends an intelligent data carrier to a user connected to a network on which the network server is deployed and configured to dock over a network to a host computer device that communicates with the network server, the network server sending the intelligent data carrier via a dynamic switch datagram. Communicating with; The server authenticating the user through an authentication and encryption scheme; And authorizing the user to access one or more applications upon successful authentication.

According to yet another embodiment, one or more applications are preloaded on an intelligent data carrier or installed on a network server or host computer device. In yet another embodiment, the host computer device is connected to the network via wired or wireless means. The host computer device may be a desktop or laptop computer, a personal digital assistant (PDA), a mobile phone, a digital TV, an audio or video player, a computer game console, a digital camera, a camera phone, and a network capable home appliance.

According to yet another embodiment, the one or more applications may be a Windows-based remote terminal server application, an application on a 3270/5250 terminal emulator for the mainframe, a directly embedded application, and a multimedia application. Directly embedded applications include one or more of database applications, data analysis tools, customer relationship management (CRM) tools, and enterprise resource planning (ERP) packages.

Brief description of the drawings

1 illustrates the interaction between a client, a server, and an injector in accordance with one embodiment of the present invention.

2 illustrates an object vector super classifier in accordance with another embodiment of the present invention.

3 illustrates a datagram parser that includes various components, modules, and associated processes, in accordance with another embodiment of the present invention.

4 is a general layout of a datagram according to another embodiment of the invention.

5 illustrates an intelligent data carrier, various modules, and a process implemented according to another embodiment of the present invention.

6 illustrates a client including various components, modules, and associated processes, in accordance with another embodiment of the present invention.

7 illustrates a server including various components, modules, and processes associated therewith, in accordance with another embodiment of the present invention.

8 illustrates an injector including various components, modules and processes associated therewith, in accordance with another embodiment of the present invention.

Detailed Description of Various Embodiments

Brief description of related terms

The following terms: network, client, server, data, data vector object (also known as data object vector, object vector), classifier, decision making, decision analysis, object based decision analysis (also called object analysis), random numbers Random number generator, seed, randomization, probability, probability density function, authentication, private key, public key, elliptic curve cryptography (ECC), ECC signature, parser, packet, header, TCP, UDP, Firewall, Universal Serial Bus (USB), Apple Serial Bus (ASB), Serial Port, Parallel Port, Token, Firewire, and other related terms throughout the specification of the present invention are known in the art, i. , Computer Science, Information Technology (IT), Physics, Statistics, Artificial Intelligence, Digital Networks, Network Communications, Internet Technology, Decryption, Encryption & Decryption, Compression & Decompression, Classification Theory, Predictive Modeling, Decision Making, Speech Expression, and to be understood consistently with the normal meaning in the established biometric method.

The following terms: Secure Key Exchange (SKE), Advance Encryption Standard (AES), Public Key Infrastructure (PKI), Encrypted Virtual Files Systems (EVFS) ), Virtual Private Network (VPN), Intrusion Detection System (IDS; Intrusion Detection System), DMZ, Personal Digital Assistant (PDA), USB Key, USB Token, USB Dongle, Parallel Port Dongle, Serial Port Dongle, Firewire Device, Token Device, Smart Card, Smart Media, Compact Flash, Smart Digital Media, DVD, Compact Disc, Multiprotocol Label Switching Standard (MPLS), Lightweight Directory Access Protocol (LDAP) Directory Access Protocol (EDI), Internet Relay Chat (IRC), Cyclic Redundancy Checksum (CRC), Terminal Identifier (TID; Terminal Identifier), and other related terms across the entire context of the present invention are to be consistently understood and the IT industry, electronic or online commerce, and the specific network security and common sense is established in certain related areas.

As used herein, a network refers to any group of network capable devices that are interconnected through a medium (such as optical fiber) that is configured to transmit digital and / or analog data remotely. The network may be a public network, such as the Internet, or a private network, such as a corporate intranet system. A network capable device, also referred to as a network connected device, connected device or device, may be a computer, digital mobile phone, PDA, digital camera, digital audio-video communicator, or any other device that may connect to the network via wired or wireless means. The network connection device may be a client or server as referred to herein. In one embodiment, the connecting device may be a host computer for a mobile client, such as an intelligent data carrier. See the following description of the client as an intelligent data carrier. In a particular embodiment, the network may include one or more such clients and one or more such servers. In another embodiment, the network also includes one or more injectors described in the detailed description herein below.

As used herein, a virtual private network (VPN) applies security procedures and tunneling to achieve privacy in network transactions while sharing public network infrastructure, such as the Internet. Tunneling refers to the transmission of data over a public network of protected data—property for a business or secret for an individual. The routing node in the public network does not recognize that the transmission is part of a private network. Typically, tunneling is achieved by encapsulating private network data and protocol information in a public network transmission unit so that the private network protocol information appears in the public network as data. Tunneling can send data on behalf of a private network using the Internet. Various tunneling protocols have been developed, some of which include point-to-point tunneling protocols (PPTP) developed by Microsoft and many other companies; Generic routing encapsulation (GRE) developed by Cisco systems; And Layer to Tunneling Protocol (L2TP). Tunneling, and the use of VPNs, do not replace encryption in ensuring secure data transmission. Encryption may be connected to a VPN and used within the VPN.

As used herein, biometrics refers to personal features-physical or behavioral-used to establish a user identity to authenticate a user and to properly authenticate or deny access to a protected institutional network or protected information source. Say. Physical biometrics include speech recognition (ie, speaker identification), fingerprints, handprints, blood types, DNA tests, retina or iris scans, and facial recognition. Behavioral biometrics include habits or patterns of personal behavior.

Data used herein refers to any information that can be transmitted over a network. Data is used interchangeably with the term digital information or the information in various embodiments. Content data refers to any data specified for transmission over a network by a user. For example, in a financial institution or bank, customer account information consists of one type of content data that may be transmitted between one or more clients and servers used or manipulated by various authentication account managers and system administrators. The account payment information may be one type of content data in the case of an EDI transaction. Another example of another kind of content data is inventory information for raw materials or finished products at a manufacturing facility; Such data is often sent between clients and servers throughout this facility for access by manufacturing engineers and business planning personnel. Multimedia data, such as audio and video files, is another form of content data. Transaction data, also referred to herein as connection data, means any information that indicates the status of a network connection between a client and a server and the data transmission between them. This information includes information about the user authentication status and the authentication method.

Data compression and encryption herein may be implemented according to conventional industry practice. Various specifications and algorithms for compression / decompression and encryption / decryption are known in the art, and various related products are publicly or commercially available; It may be used in methods and systems in accordance with various embodiments herein.

As used herein, a user interface refers to any computer application or program that can interact with a user. The user interface may be a graphical user interface (GUI) such as a browser. Examples of such browsers include Microsoft Internet Explorer ^™ and Netscape Navigator ^™ . Also, the user interface may be a simple command line interface in another embodiment. The user interface may also include plug-in tools that extend existing applications and support interaction with standard desktop applications such as Microsoft Office, ERP systems, and the like. In addition, the user interface in any embodiment may be any point of an information input device such as a keypad, PDA, microphone, or any other type of biometric input unit.

Radar connector as used herein refers to a module configured to monitor and control network connections. The radar connector may be included or connected to a client, server or injector in accordance with various embodiments. In a particular embodiment the radar connector of the client is further configured to detect the failed connection and initiate a contact to the server to reestablish the connection. The radar connector first attempts to connect to the port; It then continuously monitors the network connection and attempts to reestablish the connection by calling the server if a connection failure is detected. On the server side, the radar connector may remain active at all times to monitor the connection status with various clients.

Pervasive computing as used herein refers to the increased and widespread use of networked computers or other digital devices in people's business and home offices. Digital and web-enabled electronics and appliances (e.g., mobile phones, digital TVs, PDAs, Global Positioning System (GPS), camera phones, and network microwaves, refrigerators, washing machines, dryers, dishwashers, etc.) and broadband Internet Universalization of connectivity represents an era of pervasive computing.

Pervasive security as used in various embodiments refers to a network security platform that delivers the required security using one or more network hosts or access devices. User-centric security in accordance with the present description refers to protecting one or more users instead of one or more computer host devices used by a user to access a network server. Pervasive and user-centric security may be implemented in one embodiment using any of the network devices and methods herein and anytime, anywhere.

A datagram is defined as "a self-contained and independent data entity that carries sufficient information routed from a source to a destination computer without relying on a pre-exchange and delivery network between the source and destination computer." See November 2001, Whatis.Com, QUE, Technical Encyclopedia. Datagrams and packets can be used as interchangeable IDs.

The term "intelligent data carrier" (IDC) is used interchangeably with the term "client" in various embodiments herein. An intelligent data carrier comprises at least (i) one memory configured to store data, (ii) one input-output device configured to input and output data, and (iii) data stored in the aforementioned memory. It has one processor configured. The intelligent data carrier can connect with a host computer device and send data through an IO device on the network. In addition, the intelligent data carrier is configured to establish the network identity of the network user through an authentication and encryption scheme, in accordance with certain embodiments herein. In one embodiment, the intelligent data carrier is mobile. The intelligent data carrier may be implemented as or on a USB key, Firewire device, smart card, compact disc, DVD, smart media, compact flash, PDA, smart digital media, or token device. The token device may be a software dongle, such as a serial port dongle or a parallel port dongle, any one-time password generation device or system access device. Another digital media reader may be implemented as an intelligent data carrier in accordance with the present disclosure. It can connect to various host computer devices through various ports or drives in different ways. An intelligent data carrier holds all the data and functions on behalf of the user, for the establishment of a secure network connection and for the launching of the required application, once the user is properly authenticated by the server. See the following detailed description of the client as an intelligent data carrier.

Client-Server-Injector Network Communication System

A client-server communication system is provided in one embodiment of the present disclosure that includes one or more clients and one or more servers. Each client is an intelligent data carrier capable of supporting authentication and encryption schemes for secure access to network servers. See the following detailed description of the client as an intelligent data carrier. The system authenticates and protects each user directly through intelligent data carriers, enabling user-centric security. No matter what kind of connection device or local host computer is used, the user may dock an intelligent data carrier to the host and launch an authentication session to connect to the target server. Thus, an important aspect of access safeguards lies in the individual user being transmitted on the intelligent data carrier, not the connecting device or the local host machine. The intelligent data carrier may be mobile; This mobility enhances the pervasiveness in the security solution imparted by the system. This is the required security of using any connected device or local host machine.

In yet another embodiment, an injector is included in the client-server communication system. Client-server-injector systems enable convenient integration with existing network infrastructures and facilitate overall security of data transmission and application sharing. See the following detailed description of the injector connecting to the server and client. One or more clients, one or more servers, and one or more injectors may be equipped in such network communication systems. Each injector links and communicates with one or more servers. Each server connects and services one or more clients. Multiple servers in the system may communicate with each other in managing the data flow of the entire network.

1 schematically illustrates a connection between an injector 105, a client 103 and a pair of peer servers 101 in accordance with one embodiment. Each server, client and injector has a radar connector 107 that interfaces with the network. The radar connector 107 continuously monitors the state of the network connection. If a connection failure is detected, the radar connector 107 on the client side makes one or more attempts to reestablish the connection by calling the server. Since the client has recorded the parameters of the connection status for the most recent connection-thus, remember-the failed connection may be quickly restored to the desired accuracy. As a result, the integrity of the data transmission may be protected and the failure rate may be reduced.

In addition to the radar connector 107, any other modules and processes are common between the client 103, the injector 105 and the two peer servers 101 shown in FIG. 1. Approval manager 109 assigns and manages user approvals. The service facilitator 111 ensures that a particular application or service is provided to the requested user. The datagram parser engine 113 is included in each client 103, server 101 and injector 105, as shown in FIG. 1. The parser engine 113 may include a dynamic datagram switch and parser of the system. 7 and 8, dynamic datagram switches 701, 801 and frame parsers 703, 803 are included in server 101 and injector 105, respectively. Thus, service parser 601 and service frame 603 are included in client 103 as shown in FIG. The datagrams 701, 801 work with the radar connector 107 on both the client side and the server side to process multiple instances of the datagram transmission. The dynamic datagram switches 701 and 801 will now be described in detail. Cryptographic engine 115 processes encryption and decryption of data transactions over the network. In the client 103, server 101, and injector 105 systems, the crypto engine 115 is one level behind the radar connector 107 that interfaces with the network. The parsing engine 113 and the service facilitator 111, implemented in both the server 101 and the injector 105, enable the overall system to support various types of data transmissions as well as multiple network services and applications. These modules and processes, and yet other modules and processes, are described in separate sections for the client 103, server 101, and injector 105 below.

Client as an intelligent data carrier

A client is any computer or device capable of connecting to a server computer or device via a wired or wireless network. The client may also be computer software or firmware that invokes and connects to the server. The client is an intelligent data carrier (IDC) according to one embodiment. The client or IDC may be implemented by running software, firmware or flash memory on a host computer device linked to a network. The user interface is provided by the host computer device or IDC in one embodiment and allows the user to monitor network transactions and control data transmission once the user connects to the network server via IDC. For example, the user interface may provide a login form for the user to log on to the network. This form may accept different formats of input such as text, objects or graphs. The user interface also allows the user to send commands to control network transactions and data transmission.

The intelligent data carrier may be mobile according to one embodiment of the present disclosure. In various embodiments, the intelligent data carrier may be a USB key, compact flash, smart media, compact disc, DVD, PDA, firewire device, token device such as serial port dongle or parallel port dongle, or other digital, analog device or media reader. Or on such a device.

According to one embodiment, an intelligent data carrier comprises three main components: a memory configured to store digital information, an input-output (IO) device configured to input and output digital information, and a digital information stored in the memory. Have a processor configured. The IDC may connect to a computer host device disposed in the network and transmit data on the network via the IO device.

The memory of the IDC may take the form of any computer readable media such as CD, floppy disk, DVD, erasable programmable read-only memory (EPROM), and flash memory (compact flash, smart media, USB key, etc.). .

IDC's IO devices can be configured with any IO connection or port, including, for example, a mouse port, keyboard port, serial port (USB port or ASB port), parallel port, infrared port, and firmware connection (IEEE 1394). It can be connected to the host computer device through. The IO connection may be wired or wireless according to various embodiments. For example, in one embodiment, a short range wireless connection may be established between the IDC and the host device according to the Bluetooth specification. See www.bluetooth.org. In another embodiment, 802.11b-g and infrared communication are used. The IO device, in another embodiment, includes a transceiver configured to transmit and receive voice or image data. IDC therefore supports VoIP applications.

The IDC processor has an integrated circuit (IC) in one embodiment. In yet another embodiment, the IC is an application specific integrated circuit (ASIC). The IC supports the execution of applications available from remote servers or applications installed on the host computer device as well as applications preloaded on IDC. In yet another embodiment, the processor of IDC does not include an IC; It relies on the IC of the host computer device and is configured to process information loaded into the IDC memory and information stored in the IDC memory from an application installed on the host computer device. See the following detailed description of application delivery.

The intelligent data carrier according to the present specification is configured to establish a network identity for a user through an authentication and encryption scheme. The intelligent data carrier provides itself to the server by determining the server location and initiating the authentication process. See the following description of authentication and password. In the secure network system herein, each user may be sent to IDC that allows the user to access a network server and to access data and applications. Using IDC, the user can connect, terminate, and reconnect to the intended server as needed. The connection may be from any network host device at any time, according to one embodiment. Host computer devices include desktop or laptop computers, personal digital assistants (PDAs), mobile phones, digital TVs, audio or video players, computer game consoles, digital cameras, camera phones, and networked refrigerators, microwaves, washers, dryers, and tableware. It may also be a network capable home appliance such as a washer. In some embodiments, the IDC may be embedded directly in the host device to provide application sharing or secure data exchange over the network. Network access is private and secure for each user. See the following description of the encrypted virtual file system. Thus, IDC imparts great mobility and enhanced user-centric security to network communications.

The application may be delivered to the intended user via IDC in a secure and controlled manner. In one embodiment, any authorized application may be preloaded in an IDC sent to an authenticated user, and the authenticated user may be registered with the server. A user may run an application from IDC upon proper authentication by the server, regardless of which local host the IDC is docked to. That is, for example, a user may insert a USB key IDC into a computer-connected to the Internet-in one location, and launch an application from the USB key IDC once it is successfully connected to the server-also located on the Internet. have. The user may exit the application and save the file on a server or USB key IDC. The file is stored in an encrypted virtual file system (EVFS) connected to a network server. See the following description of EVFS. In another location, the user may use a different computer host device to launch the application from the USB key IDC and continue working on the same file—according to proper authentication by the server. Thus, this secure, mobile, user-centric connectivity between IDC and network servers provides a paradigm for managing and controlling data access and application delivery.

Intelligent data carriers may be used to deliver standalone applications or operating systems according to one embodiment. The user may be sent to IDC with a read-only and copy protected application and / or operating system. A user may use IDC to boot a host system that does not have an operating system or storage device, and access an access server-based application or preloaded application on IDC.

Intelligent data carriers may be used to deliver application media content according to another embodiment. For example, an IDC that includes an application that is copy-protected and read-only, as well as a unique serial number, may be provided to the user to allow initial installation of the application. Once installed, IDC may request a system name, MAC number, processor serial number, or other static system based information to generate a copy protection code, which may be stored in IDC in the form of encrypted code hidden from the user. This code may ensure that the application is only installed on the original host device.

Intelligent data carriers are suitable for media specific distribution according to another embodiment. Each user may be sent to an IDC operating with one or more specific decoders that authorize access to a particular digital media source, such as a DVD, CD, or MP3 data file. The server may track access and use of specific data files via IDC.

Accordingly, the application delivery paradigm according to the present specification may include special database applications, data analysis tools, and IT tools including various customer relationship management (CRM), enterprise resource planning (ERP) packets, and the like. And commercial software packets as well as proprietary data content. Controlled and targeted delivery combined with strict authentication and encryption, as well as centralized data and file management, make this paradigm a real competitor to traditional software licensing approaches such as enterprise and floating licenses. In this capability, IDC enables digital rights management (DRM) for proprietary data, applications and services.

Referring to FIG. 5, an intelligent data carrier implements multiple modules and processes in accordance with one embodiment of the present disclosure. For example, application boot loader 501 allows system integrators (SIs) and OEM manufacturers to generate custom boot calls for applications installed on host computer devices or for applications stored in IDC. The application boot loader 501 is part of the processor of the IDC according to the present embodiment. This can also be called a config file, a SYS file, or an executable to boot an application.

The memory of the IDC may be partitioned into user data storage 503, application data storage 505 and management config partition 507, for example by an SI or an OEM, according to one embodiment. The user data storage area 503 is capable of recording and reading. Application data storage 505 is only readable. The management config pane 507 is read only and copy protected. The partitioning information is stored in the IDC in a manner not of the user's point of view or in a way that the user cannot directly access.

Additional modules are included, including an on device authentication client module 509 for user authentication, a radar connector 511 for monitoring and control of network connections, an encryption module 513, and the like. Authentication client 509 may use various user authentication means, including object method 515, password system 517, another rights policy 519, and the like. Hereinafter, authentication and encryption will be described in detail.

6 provides another example of a client, according to one embodiment of the present disclosure. Various modules and components are shown as included in the process. For example, depending on the connection with the server, the client supports different types of transmissions, including messaging 605, streaming 607, and another custom communication 609. In the network server of one embodiment, a datagram parser (service parser 601) corresponding to the datagram switches 701 and 703 is used. See the following description of a server with a dynamic datagram switch. Secure key exchange 611 and encryption 613 are implemented in the client. See the following description of authentication and encryption. Randomization is used in combination with authentication and encryption schemes. See the following description of randomization in the creation and analysis of data objects. Radar connector 615 is also included as part of the client linking the client to the server. Radar connector 615 monitors the connection between the client and the server. The connection may be through a public network, such as the Internet. Connections can also be established within private, operator networks, especially networks that include distributed calculations.

Server with Dynamic Datagram Switch

The server may be any computer deployed on a public-for example, Internet-or private-e.g., institutional environment-network that can connect to the client, authenticate the client, and provide data and application access to the client, or It may be a digital device. The network may be wired, or may be wireless in part or in whole. The server defines the approval or rights of various clients or users in the system. The grant may be compiled and transmitted based on the physical user identity-eg, depending on the biometric measurement result-and the geographic location-eg, local host name, local time, or any other detectable parameter. . If the client is successfully authenticated, the server allows a connection from the client and allows access to data or applications belonging to or authorized by the user. The data file resides in the EVFS which provides each user with secure and private access. See the following description of EVFS. In another embodiment, as described above, once a connection is established, the server may deliver the application to the authenticated user.

As shown in FIG. 7, the server according to one embodiment includes a series of modules and components, some of which are similar to the modules and components included in the client shown in FIG. 6. For example, SKE 705 and encryption 707 are implemented in a server. Randomization is also used in combination with authentication and encryption schemes. As noted above, EVFS 709 is linked to the server, providing each client with a private file system for data access and storage. The EVFS 709 is linked to the server via the EVFS interface 711. See detailed description below. The radar connector 713 is also included as part of the server and interfaces with the radar connector 615 on the client side. Network connections between servers and clients with radar connectors on each side enable effective monitoring and control of network connections. Further, according to another embodiment of the present specification, the radar connector detects a connection failure and reestablishes a connection if necessary. Various applications or services are supported, including, for example, messaging 715, streaming 717, and custom communications 719.

Data transmission between the client and server is performed by dynamic datagrams based on the datagram scheme in accordance with certain embodiments. See example 1 below. All data intended for delivery through the server-content data or transaction data-is formatted as a datagram. Each datagram is carried in a TCP packet according to one embodiment. In another embodiment, other network protocols such as UDP, HTTP, and HTTPS may be used. Multiple datagram types are defined in the datagram scheme according to one embodiment. The primary datagram type may have multiple sub or subtypes. In another embodiment, the secondary datagram type may further include lower level datagram subtypes. A series of methods and functions may be defined for each datagram type or subtype. Each datagram type or subtype supports one or more specific applications and may carry one or more specific kinds of data. Various types may be different and require specific privileges and / or approvals.

The datagram is processed at the server by the dynamic datagram switch 701. The dynamic datagram switch can generate, assign, process and swap datagrams in real time. Datagram allocation and deallocation are performed dynamically. In one embodiment, the same memory space is used when one datagram is allocated while the other datagram is deallocated. Memory pointers are used for multiple datagrams. When a datagram is in service, the pointer points to the allocated memory. The use of memory pointers provides a high level of efficiency and speed when using multiple network applications and supporting the transmission of network data in service to one or more users. In a particular embodiment, a switch of datagrams may be implemented within a network connection through one port; In another embodiment, a switch of datagrams may be implemented in connection with multiple ports.

The dynamic datagram switch 701 includes a datagram parser engine 113 according to one embodiment. The parser engine 113 also includes a parser 703 that filters datagrams based on the major and minor types. For example, data is first read from a socket and attached to an in-queue for that socket. The parser engine 113 then checks to see if the socket has a complete datagram in the queue. If you don't have a complete datagram, the parser engine goes to sleep and waits for the next packet to reach the socket. With a complete datagram, the parser engine removes the complete datagram from the in-queue of the socket, sends it to the decryption and parsing unit for decryption and parsing.

The parser engine 113 then asks whether the datagram passed the decryption and verification. If it does not pass, the parser engine checks to see if the datagram indicates a signal of a change or injection. If a change or injection is detected, the datagram may be discarded and the user sending the datagram may be disconnected. If the datagram has been successfully decrypted and verified, the parser engine 113 attempts to determine the intended recipient of that datagram. If the datagram is intended for another connection server, the datagram is forwarded to peer parser engine 113 on that peer server. If the datagram is intended for the local server, it is passed to the local parser 703.

The parser 703 then checks whether the sender has the authority to send that particular type of datagram. In one embodiment, this is done using an object classifier. See the description of authentication and encryption and Example 2 below. If the sender does not have the authority to send a particular type of datagram, the datagram is discarded and a log file is created. If the sender has authority for that datagram type, the parser further checks to see if the sender has the authority to send a particular datagram and whether the receiver has the authority to receive the datagram. If you do not have permission and the negative permission is permanent, the datagram is discarded and a log file is created. If you do not have the rights but the negative rights are temporary, the datagram may be stored for subsequent retrieval and processing. If the sender has the authority to send the datagram and the receiver has the authority to receive the datagram, the parser continues to determine the datagram type.

3 illustrates a related process for datagram type determination 301 and datagram parsing implemented in a parser 703 according to one embodiment. Each datagram type corresponds to an instant messaging engine 303, broadcast engine 305, connection proxy engine 307, user authentication engine 309, user management engine 311, user directory engine 313, or the like. Has a processing engine. Once the datagram type is determined, the datagram is supplied to and processed by the designated engine for the corresponding datagram type.

Peering engine 315 refers to another connection server, a peer parsing engine residing on the peer server. User logon and logoff are broadcast to all peers (317). User access to each peer server may be integrated and managed according to intent. For example, if a user is authenticated by a peer server granting a higher level of access privileges and is connected to that peer server, the existing connection the user has to the server may be released. The authorization engine 319 connected with the user management engine 311 manages and records the privileges for all users. In another embodiment that provides additional functionality as needed, it may include another module or process that includes, for example, the VPN tunneling engine 321.

In one embodiment, the server dynamically processes the matrix of datagram types. The matrix includes a first predetermined number (eg, 256) of primary datagram types, each of which has a second predetermined number (eg, 256) of secondary datagram types. In yet another embodiment, the parser 703 may parse a datagram type matrix having three or more dimensions or layers. Thus, parsing may be implemented based on datagram type, field and layer.

Depending on the general layout of the datagram, the proper function or method may be executed for each datagram if the datagram is properly parsed. 4 provides a general layout of a datagram according to one embodiment. The datagram layout includes header fields such as primary datagram type 403, sub datagram type or subtype 405, datagram length 407, and datagram checksum 409 and payload field 401. . Payload 401 carries the content data in the transmission. Additional header field 411 may be included for another datagram type.

In one embodiment, referring to Example 1 below, the primary datagram type includes: a server message and a connection control datagram capable of authenticating and controlling a user connection; A content datagram capable of managing content data transmission; Broadcast datagrams capable of real-time management of point-to-multipoint and multipoint-to-multipoint transmissions; And a connection proxy datagram capable of transmitting proxy data between the network server and the intelligent data carrier.

The server message and access control datagram may include: an authentication request datagram capable of initiating an authentication request; An authentication response datagram capable of sending a response upon authentication request; And a sub or sub datagram type such as an authentication result datagram that can transmit the result of the authentication session.

The content datagram includes: canonical content datagram capable of transmitting content data; A remote logging datagram capable of communicating with a network server and establishing a login session; And a remote data set datagram capable of transmitting data from the remote connection; A content approval request datagram that can request verification of the transmitted content data; And a sub or sub datagram type such as a content acknowledgment response datagram that can respond to the verification request of the transmitted content data.

The connection proxy datagram may comprise: proxy data from an intelligent data carrier to a server capable of delivering proxy data to a network server; And sub or sub datagram types such as proxy data from a server capable of delivering proxy data from a network server to an intelligent data carrier. Another example of a primary datagram type is the instant message type. This includes secondary datagram types such as file transmission type, audio-video transmission type, instant mail message type and remote data set type.

Injector connecting to server and client

In yet another embodiment, the secure network system herein includes an injector configured to connect a server to an existing network infrastructure. The injector may be software or firmware that provides network connectivity. The injector transforms the physical connection data into logical network resources. This allows for easy integration with existing networks and reduces the need to modify existing IT infrastructure.

Referring to FIG. 8, the injector in one embodiment includes modules and processes similar to the injector at a client (FIG. 6) or a server (FIG. 7). For example, SKE 805 and encryption 807 are implemented in the injector. In addition, randomization is used in combination with authentication and encryption schemes. Like the server, the injector is linked to the EVFS 809 to provide the user with a virtual private file system for data access to the existing network. The EVFS 809 is linked to the injector via the virtual file system (VFS) interface 811. Like the client and server, the injector supports different types of communication, including, for example, messaging 813, streaming 815, and another custom communication 817.

The injector also uses a dynamic datagram switch 801 and has a datagram or frame parser 803. Datagram switch 801 and frame parser 803 correspond to datagram switch 701 and datagram parser 703 at a network server. The radar connector 819 is also included as part of the injector to interface with the radar connector 713 on the server side. Radar connector 819 monitors and controls network connections between the injector and the server. Also, according to another embodiment, the radar connector 819 may detect a connection failure and reestablish the connection as needed.

Authentication and encryption

In various embodiments of the present disclosure, a secure network system may use various authentication and encryption means, including, for example, an encrypted or unencrypted ASCII string, a single classification model, and a super classification model. Symmetric and asymmetric multipassword encryption may be used. Encryption may change over time by output feedback, cipher feedback, cipher block chaining, cipher forwarding, or any other way of transforming ciphers and / or keys in a way that the cipher and decryption engine can all predict or reproduce. have. In a particular embodiment, secure key exchange (SKE) may be used. SKE involves generating a pair of random keys that are used only once and then discarded. According to SKE, no key is stored on any device or system except for a public-private key pair that is owned and controlled by a server. SKE is different from public key infrastructure (PKI), which requires a public key storage system to serve multiple users. Omission of the intervening public key storage system-the common goal of network hackers-allows for enhanced network security.

The SKE module of the secure network system according to a particular embodiment uses a variety of public key systems, including commercial (COTS) systems. In one embodiment, Next Generation Encryption Standard (AES) Fenderel is used. See, November 2001, Federal Information, Processing Standards Publication 197, Announcing the Advanced Encryption Standard (available at csrc.nist.gov/publications/fips/fips197/fips-197.pdf). In addition, the website, csrc.nist.gov/CryptoToolkit/aes/; csrc.nist.gov/CryptoToolkit/aes/rijindael/; And csrc.nist.gov/CryptoToolkit/aes/rijindael/rijindael-ip.pdf. In another embodiment, a 163 bit elliptic curve cryptography (ECC) key may be used. ECC techniques are known. See, eg, March 1999, Tatsuaki Okamoto et al., PSEC: Provably Secure Elliptic Curve Encryption Scheme (proposed in P1363a) (grouper.ieee.org/groups/1363/P1363a/contributions/psec.pdf). See also the websites, world.std.com/~dpj/elliptic.html and csrc.nist.gov/cryptval/dss/fr000215.html.

In another embodiment, various encryption methods may be used on a random basis and in combination. For example, another cipher includes: Gost, Cast128, Cast256, Blowfish, IDEA, Mars, Misty 1, RC2, RC4, RC5, FROG, SAFER, SAFER-K40, SAFER-SK40, SAFER-K64, SAFER-SK64, SAFER-K128, SAFER-SK128, TEA, TEAN, Skipjack, SCOP, Q128, 3Way, Shark, Square, Single DES, Double DES, Triple DES, Double DES16, Triple DES16, Triple DES24, DESX, NewDES, Diamond II, Diamond II Lite and Sapphire II. Other hashes include: MD2, SH4, SHA-2, RipeMD128, RipeMD160, RipeMD256, RipeMD320, Haval (128, 160, 192, 224 and 256 bits) with Rounds, Snefru, Square, Tiger, and Sapphire II (128, 160). , 192, 224, 256, 288 and 320 bits).

Authentication in one embodiment is based on event level data. Authentication events include mouse clicks, keystrokes, touch on screen, speech, or selection of biometric measurements. Event level data includes data generated before and after the event and data generated at the event. The event window may be specified at the time of recording or measuring the event. That is, for example, an acoustic sample may be selected within a time limit. Such data may be used to compile the super classifier according to one embodiment.

The use of super classifiers includes three aspects: classification (see appendix 1 below), analysis (see appendix 2 below), and judgment (see appendix 3 below). The function of the super classifier is the feature extraction of the input vector data. The input vector data may be binary or non-binary. See, for example, Appendix 3. In one embodiment, an object vector based super classifier is used. See example 2 below. Randomization applies to the superclassifier-based object analysis described in the next section.

Authentication is performed whenever a client or IDC attempts to connect to a network server. According to one embodiment, the authentication and encryption scheme is available with IDC. The authentication and encryption scheme includes a series of steps. In a first step, the user sends a request via client or IDC to request authentication. Thus, the initiation of the authentication session is from the client or IDC. In step two, the server sends a list of available authentication methods to IDC, and the user sends one from the list via an event-for example, a mouse click, a touch on the screen, a voice, a keystroke, or any other suitable notification event. Select. Input from a digitizer, such as a camera or biometric device, constitutes another example of a suitable notification event. In step 3, based on the selected authentication scheme, the server sends a request for authentication data to the IDC. The request may be a pure random or pseudo random password, in accordance with various embodiments. Pseudo random passwords are generated based on a mathematically precomputed list, and pure random passwords are generated by sampling and processing entropy sources outside the system. In a fifth step, the server converts authentication data received from IDC into one or more data objects or object vectors. In step 6, the server uses one or more classifiers or super classifiers to perform object analysis on the data object. Super classifiers based on biometric measurements may be used. Finally, a decision based on analysis results or classifiers is sent from the server to the IDC to confirm proper authentication of the user to allow the IDC to connect to the server or declare that the authentication attempt from the IDC has failed.

According to yet another embodiment, three state authentication or three authentication tests: logic tests for client-server matching, device tests for IDC, and personal tests for users may be implemented. Randomization may be used in conjunction with one or more of the three tests, with or without a data object classifier.

Logical testing for client server matching is a test that allows an IDC or client to find the correct server. This involves a number of steps. First, when the server is installed or started, a public / private ECC key pair is generated on the server that is used only for verification purposes. When IDC is configured or created, the server public key PK1 is provided to any client or IDC of such server so that the IDC is printed with the "general code" of the server and "registered" with the designated server. Then, when IDC is assigned to the user and attempts to connect to the server remotely over the network, the server's randomizer generates a large amount of random data streams, creating a new ECC (PK2) public / private key pair for the connection session. Used as a seed in the creation of. This public key is then represented as a pre-generated server private key for verification purposes only. The server then sends both the signature for the IDC and the newly generated public ECC key. Upon receipt of this information, the IDC uses the "verify only" public key and is printed by the key to verify the signature of the public ECC key. If the signature does not match "print", the server is not a valid server and IDC is disconnected. If the signature matches, the IDC generates a new ECC (PK3) public / private key pair for the session and sends that public key as part of the client identity and facility (CIF, see Example 1 above). The CIF is in turn encrypted using the server's public key PK2.

Device testing for IDC focuses on IDC's physical parameters for verification. For example, when deploying client software on a carrier device, i.e. when the carrier or storage device becomes an IDC, the IDC is registered with the server and certain of those parameters are stored on the server, such as inside a server database. . When IDC generates a CIF packet, it stores any information on the CIF that may be collected on the host computer device or network attached device to which the IDC is docked and stores the entire CIF packet with the public key PK1 that was validated in the previous logical test. Encrypt and send the encrypted CIF to the server. After decryption, the server may verify whether the data in the CIF matches a parameter previously registered with the server and whether the IDC is connected from a known or regular network host. If the verification fails, the server terminates the session and disconnects IDC.

Personal testing of users focuses on authentication of specific users. This test may be implemented with or without a classifier or super classifier. Classifiers that do not use super classifiers may include multiple steps. For example, following a successful SKE, an authentication request datagram is sent to IDC to include a list of authentication methods, and an attempt to be authenticated if one of these methods is challenge-response based authentication. The IDC then chooses one of the authentication methods. You may or may not be prompted for a two-way login. If IDC has enough information for authentication, automatic login is provided. Following authentication, IDC sends an authentication object to the server, which is implemented in another datagram type that contains validation data that should be examined by the server. The analysis of the authentication data object changes based on the authentication method used.

On the other hand, the user test using the super classifier may proceed as follows. Super classifiers are implemented based on various types of datagram types and datagrams on the server. Upon successful SKE, the authentication request datagram is sent from the super classifier to IDC, and the authentication request datagram includes an attempt to be authenticated by the IDC if one of the authentication methods and the list of authentication methods is challenge-response based authentication. do. The IDC then similarly chooses an authentication method. For authentication, the server sends a request to the IDC for execution of the event level task. The request is made with the super classifier based on the input from the randomizer. IDC does the work, and the resulting event level data is wrapped in an authentication data object. In one embodiment, this data object includes a randomly generated individual identifier for a particular network switched session to minimize the possibility of threatening the session. The authentication object is then returned from IDC and resolved by the server's "certifier" based on the super classifier. Data object analysis may vary depending on the specific authentication method used.

Randomization in the Creation and Analysis of Data Vector Objects

Randomization techniques are known in the field of theoretical mathematics and applied mathematics. This often applies to decision making processes where there is no obvious common denominator. The use of randomization is facilitated by the huge computational power available today. Randomization typically involves the use of seeds. The random number generator generates a pool of random numbers based on the supply of one or more seeds. Depending on the characteristics of the seed, randomization may be classified as pseudo random or pure random. Most random number generators are pseudo random number generators. This is based on a mathematically precomputed, negotiable list. In contrast, pure random numbers are often generated by sampling and processing a source of entropy outside an associated computer system or network. To break a pure randomizer, one must identify the source of entropy and how the entropy generated the seed.

Randomization also applies in computer or network security. The application of randomization in existing data security is usually static. For example, the random number may be generated by the client, server or another computer device and sequentially moved onto the computer by the user. If the number matches a number in the random number "frame" allowed by the system specific random number generator, the user will be granted access. This is similar to a public key infrastructure (PKI) in which two privately generated keys are matched and verified at a shared verification point. One problem with this paradigm is that shared verification points may be threatened relatively easily. A random number generator that includes a frame of numbers based on a given seed (or any desired output combination, such as alphanumeric), is present at the system shared verification point. The random number generator appears to generate infinite random numbers, but the total number of random numbers generated is predetermined when the generator is generated (seed). In other words, it is only the order in which random numbers are generated that are random. This randomization is static. Each random number is theoretically predicted.

Randomization according to certain embodiments herein is applied in a non-static manner. Randomization is implemented in data objects through one or more classifiers or super classifiers. See example 2 below. Pure random number generators are seeded to provide random numbers for analysis of data vector objects. The data object is used for a specific test for authentication as described above.

In various embodiments, multiple individual private keys are generated based on pure random values. Since the data object converts the number to a data image or value based on entropy outside the computer at the event level, these keys do not contain any information based on the initial server verification key. Thus, the keys are outside the environment of the randomizer or random number generator and become non-static. Since the key itself is used for randomization-based object transformation, it is possible to match and recognize two unknown keys (private keys). In another embodiment, three or more private keys may be similarly generated and used. In addition, any number of private keys may be generated by the object in the classifier to make the number of private keys unknown.

In this embodiment, randomization is implemented such that (i) the user or client faces an authentication attempt based on a pure random number generator, and (ii) the object analysis to be performed is selected and the selected analysis is performed.

A typical preprogrammed random number generator is of the form:

May have

For example, W.H., published by the University of Cambridge. See Numerical Recipes, such as Press. Whether a simple linear joint generator is used or an improved generator is used, multiple random number generators may be used to prevent the calculation of the seed, for example, from observing the multiple random numbers generated in the sequence-thus the combination of Cause problems. In certain embodiments, the least significant digits in the sequence are truncated to minimize the possibility of leaving any hints. Also in this embodiment, in addition to the seed, generator specific constants a, c and m are provided according to the above formula. A table with many possible values for the constants a and m may be generated. If a constant is chosen using some noise input, this approach will lead to a more robust randomizer. In yet another embodiment, multiple preselected random number generators may be used in combination with N independent seeds. The simple sum is the following expression:

It may also be used as.

An example of a useful algorithm for combining two linear joint generators with a coupling period of about 2.3 × 10 ¹⁸ is ran2, described in Numerical Recipes. This algorithm may be modified using two independent seeds. It may be further modified using 3 or N generators. In one embodiment, one or more seeds are obtained using an amorphous source that is not easily accessible by an intruder. The non-deterministic source may be external to the randomizer, or may be external to that network system, such as, for example, an external device, the occurrence of an external event, a third party, and a bit derived from a recent record of the computer.

If one particular classifier is used in the analysis of object-based vectors, the predictability is relatively high, allowing an attacker to resolve the classifier and seed. In certain embodiments, the totality of classifiers, ie multiple classifiers or super classifiers, may be used to achieve lower predictability. The dimension of the feature vector may be reduced because the non-class deterministic is discarded. See appendix 1 and 2 below.

In summary, randomization according to the present specification improves protection for data access. The data object is based on a specific value known only to the user at the event level, such as in one embodiment a biometric measurement. Focusing on the user rather than on the device represents user-centric security in accordance with the present specification. In pure randomization, data objects transformed at the event level and analyzed at the super classifier provide a better foundation for establishing and validating user identities.

Encryption Virtual File System (EVFS)

According to various embodiments, EVFS is a virtual file system per user (or per user group), also per client, also referred to as a file repository. It is a server-based file system or file and data storage facility and allows users of network systems to store files or data from their local host or client carriers. EVFS may be useful, for example, when there is insufficient storage capacity on the local host. Examples of the use and implementation of EVFS are publicly available. Website, www.microsoft.com/technet/treeview/default.asp?url=/TechNet/prodtechnol/windows2000serv/deploy/confeat/nt5efs.asp; www.serverwatch.com/tutorials/article.php/2106831; And www.freebsddiary.org/encrypted-fs.php.

According to one embodiment of the present disclosure, the server of the secure network system is connected to the EVFS 709 via the EVFS interface 711, as shown in FIG. 7. EVFS 709 includes a user directory 721, a file database 723 for each user, and a file storage 725. The user directory contains relevant information for all users, including passwords, login parameters, biometric profiles, physical or geographic location, online and offline status, and public ECC keys used in cryptographic files stored in EVFS. A user is an individual who has connected to a network server via a client or IDC and has used or is using a particular application supported by the network. The application may be delivered to and executed by IDC in accordance with one embodiment of the present disclosure. The application may also run a host computer or device to which the IDC or client is connected. Alternatively, the application may run remotely on the server instead of on the client.

The server accesses the user directory 721 using the directory interface 727-which resides on the server. File storage 725 is digital media that stores files of interest to the user and any other data. It may be any kind of computer memory. This is the physical location where files or data created and modified from user applications are stored; User applications run on IDCs, host computers or remote servers. File storage 725 may be optimized for quick and convenient access.

File database 723 per user includes user file information such as source file name, data and time, and an encrypted representation of an encryption key used for file encryption. All files stored in the EVFS 709 are assigned a pure random name and a pure random encryption key; Files are mixed with each other in storage 725. Data access is private and secure for each user. Each individual user may only find or search for files or data that the user has ownership or permission to access. The level of access the user has for each file or record is controlled by the server. That is, in certain embodiments, the user may only be authorized to read and edit the file, and may not be authorized to move or copy the file from the server-IDC if the application is running from an intelligent data carrier. As such, each user has a virtual private database—that is, a database per user 723—connected to the server.

The secure network system 709 disclosed herein provides enhanced protection for data and applications belonging to each user. In the case of a physical threat, for example, if IDC is lost or stolen, the data stored in EVFS 709 excludes properly authenticated users who are owners of the file with access to a private ECC encryption key that can open the file. No one can read or admit it to anyone.

Thus, provision of EVFS 709 enhances the user-centric aspect of a secure network system according to various embodiments. Along with encryption, authentication, and other features described throughout this specification, EVFS 709 enables secure delivery and standalone operation of applications via IDC.

The following examples further illustrate various embodiments, and the disclosed embodiments are illustrative and not restrictive.

Example 1 Example of Datagram, and Specification of Primary and Sub (Sub) Datagram Types

Example of datagram

Instant message type

Instant message

Remote logging

Remote data-set

Remote command execution

Send file

Audio-Video Communication

EDI Transaction

Broadcast type

Non real-time point-to-multipoint transmission

Stock ticker

Non real-time multipoint-to-multipoint transmission

Channel based chat (IRC style)

Real time point-to-point transmission

User to User Chat

Audio-Video Conferencing (Audio or Voice Telephony)

Real-time point-to-multipoint transmission (broadcast)

Audio video broadcast

Real-time multipoint-to-multipoint transmission

Audio video conferencing

User directory type

Lookup

update

Server queue type

Offline save

Server swapping area

Content filter control

Filter status

Filter statistics

Filter Update (Add / Remove Rule)

Filter settings

Reset filter

Forced Datagram Field

The beginning of each datagram may be laid out as follows:

Byte type resident content

1 Client Datagram Main Type

1 Client datagram subtype (subtype)

8 Server Datagram received from server (timestamp)

4 Server datagram sender (sender's client-ID)

1 Client Signature / CRC Type

n Client signature / checksum field

(E.g., ECC signature, MD4, MD5, SHA, SHA1, etc.)

An additional header field may be attached to the above-described field according to the type of datagram. Typically additional header fields reside on the client and may be verified by the server.

Signature / CRC Type:

The length of the type CRC field

0: No checksum 0 bytes (ignored)

1: ECC signature 87 bytes

2: 20 bytes of SHA

3: SHA1 20 bytes

4: MD4

5: MD5 16 bytes

6:

7:

8: CRC32

Additional headers are attached in various datagrams. The header may reside in the client and be verified by the server.

Symmetric cipher type

Part of the SKE (Security Key Exchange) is compromised. Symmetric cryptography may be supported by both client and server, and may be selected based on grant and cipher type priority.

Type name

1 Rijndael

2 Blowfish

3 RC6

4 Twofish

Security key exchange

In a particular embodiment, the SKE is used to implement random one-time (discarded) cryptographic keys so that symmetric cryptographic keys are stored on the client and not put in threat.

When the SKE is executed, another information or data is exchanged on the network. This information or data may embody enhanced privileges or restrictions on the user.

SKE Process Overview

1. Client connects to server

2. Server sends SPK datagram to client

3. The client verifies the server signature and returns a CIF datagram.

4. The server verifies the client data and returns a SKP datagram.

5. Client sends Receipt

6. The server sends a record

SPK datagram

Server Public Key (SPK) datagrams are used to send the server public key for a session to the client. The server may present a key with a private key from a pre-shared public / private ECC key generated during server installation to protect against invading hacking.

Byte size Description

Length of server's public key for 2 sessions (hexadecimal)

Server public key for n sessions

n signature

CIF datagram

The Client Identity and Capability (CIF) datagram encodes data about the client (IDC), including information about the host on which IDC runs, and the public key that the client wants to use for the session.

The data is encoded in CSV format.

Field description

Client public key for session 1

2 Spatially separated list of cipher methods and supported key lengths

3 Spatially separated list of hash methods

4 client device type (may be encoded as binary data)

5 client identifier (may be encoded as binary data)

6 Symmetric encryption key for client-> server stream

7 IV for Symmetric Password

The password and key length are formatted as follows.

<Password method>-<key length> <password method>-<key length>

Client data type refers to the description of an IDC hardware environment (such as a PNP device-ID for a Windows-based host). On the host to which the IDC is connected, for example, the host processor serial number, firmware revision serial number of the motherboard (motherboard BIOS), authentication data from different hardware tokens (biometric input devices, smart card readers, flash readers), And any information including the MAC of the network interface through which the host communicates with the server and the like.

The entire CIF datagram is encrypted using the server public key. The exchanged value (EV) is sent along the encrypted package. The transmitted encrypted datagram may be read as follows:

The first and second octets are of length (in hexadecimal) EV

n Octet follows EV

n Octet follows encrypted CIF data

SKP datagram

Server key package (SKP) datagrams maintain information about ciphers, bit lengths, and keys, but cannot be extended for other purposes.

The server does not need to display information from SKP datagrams. The SKP is encrypted with the client's public key, which in turn is sent to the server and encrypted with the server's public key. This datagram is encoded in CSV format.

Field description

1 SKP datagram type

SKP type 0

This is a regular SKP datagram. This maintains information on the client about the cipher, key length and cipher mode, for upstream and downstream.

Field description

2 Password selected for server-> client stream

3 Bit length for server-> client stream

4 Cipher Mode (ECB, CBC, CFB, OFB)-> Client Streams for Server

5 Password selected for client-> server stream

6 Bit Length for Client-> Server Stream

7 Cipher Mode (ECB, CBC, CFB, OFB)-> Server Stream for Client

Symmetric Cryptographic Key-> Client Streams for Server 8

Symmetric IV-> Streams for 9 Servers

SKP Type 1

Instructs IDC to retrieve "client identity" updates (or additional identities) from a particular server.

Field description

2 IP address of the server holding the additional identity

3 Port on which the server is listening

Optional "client identity" granted to server during 4 SKE

SKP type 8

Notify IDC that it is not allowed to connect to the system from its current location. Upon successful transmission of a Type 8 SKP datagram, the server automatically releases the connection.

Field description

2 Message to the user (optional)

SKP Type 9

Ask IDC to try to search for firmware updates.

Field description

2 IP address of the server holding the firmware update

3 Port on which the server is listening

Optional "client identity" granted to server during 4 SKE

SKP Type 10

When reported as missing or lost, IDC instructs the user to request to return the IDC device.

Field description

2 Message to display to user

SKP Type 11

Instructs IDC to try to "destroy itself"

Field description

2 way (bitfield)

3 cookies (optional)

SKP type 11 method

Bit description

0 unlink drive

1 wipe

2 added "cookies"

SKP datagrams are encrypted with the client's public key. The exchange value EV is transmitted along with the encrypted package. The transmitted encrypted datagram may be read as follows:

The first and second octets are of length (in hexadecimal) EV

n Octet follows EV

n Octet follows encrypted SPK data

CR datagram

Client Receive (CR) datagrams are SHA-1 hashes of entire (unencrypted) SKP datagrams, encrypted by symmetric ciphers, bit lengths, and methods provided by the server.

SR datagram

The server record (SR) datagram tests the cipher stream from the server to the client, and returns the same hash as a list.

Main type 0: server messages and access control

The datagram type is used by the server to send messages, error notifications, and server-client specific information about the network connection.

Subtype 1: Authentication Request

Upon connection to the server, the server may send type 0, 1 datagrams that require the client to identify the client itself. This datagram informs the connected client of the authentication scheme required to be authenticated by the server.

Subtype 2: Authentication Response

This datagram is used by the client to verify the user.

Multiple authentication methods may be used in combination with subtypes of datagrams as illustrated in the following list:

0 username and password

1 Username and password + x.509 client certificate signature (see www.webopedia.com/TERM/X/X_509.html for example)

2 Username and Password + ECC Signature

3 password

4 Password + X.509 Client Certificate Signing

5 Password + ECC Signature

6 one-time password (S-Key, predetermined ordered list of passwords)

7 one-time password + x.509 client certificate signature

8 one-time password + ECC signature

9 Voice Key

10 voice keys + x.509 client certificate signature

11 Voice Keys + ECC Signature

12 Biometric Hash

13 Biometric Hash + x.509 Certificate Signature

14 Biometric Hash + ECC Signature

15 x.509 Client Authentication (Signature)

16 ECC Signature

17 Content Delivery ID (TID)

18 One-time password sent by alternative carrier

19 auth-token

The specific authentication method used determines the number of additional data fields of this datagram. The following is an example of various fields when a particular method is used:

Method 0

Byte size Description

The length of the username field

n username

The length of one password field

n password

Method 1

Byte size Description

The length of the username field

n username

The length of one password field

n password

x.509 signature for username and password fields

Method 2

Byte size Description

The length of the username field

n username

The length of one password field

n password

n ECC signatures for username and password fields

Method 8

Byte size Description

The length of one password field

n one-time password

n ECC client certificate signature

Method 11

Byte size Description

1 ECC signature length

n ECC signature for voice key data

n Voice Key Data

Method 12

Byte size Description

biometric hash

Method 14

Byte size Description

1 ECC signature length

ECC signature for biometric hash

biometric hash

Method 16

Byte size Description

n ECC signature for attempt

Subtype 3: Authentication Result

After the authentication request has been processed, the client will receive 0,3 datagrams carrying the authentication result. This datagram has certain static fields:

Byte size Description

1 1 = Approve, 0 = Reject

For successful authentication, additional fields may be included:

Byte size Description

1 User Profile Sent

4 If profile is sent, indicates the length of the profile field

n mime-encoded user profiles

Subtype 4: General Error

If the server encounters any error during the client session, this type of datagram catches the error. The fields included are:

Byte size Description

n error message

Subtype 5: Invalid Datagram

If the datagram passed through the server is considered invalid for some reason, this type of datagram includes the reason in the payload.

Byte size Description

n Error description

Subtype 6: Improper Allow

The datagram indicates that network access is denied.

Byte size Description

1 week type

1 type

n error message

Subtype 7: Keep-Alive

These datagrams are sent to each other by the server and / or client at predetermined intervals to keep the TCP connection open. This is useful when the system is running through various proxy-firewalls (eg, FW-1) or when running through a dial-up connection (eg, dial-up routers).

This type of datagram is also useful for the server to request that the client return a keep-alive datagram to detect whether the client is alive.

Byte size Description

0,1 0 = No answer required; 1 = response request

Primary Type 1: Content Datagram

Subtype 1: Canonical Content Datagram

This datagram contains the actual content data to be transmitted.

Byte size content

4 Last Receive-ID

mime-encoded log-data

Subtype 2: remote logging

According to a particular embodiment, this datagram includes a log-entry from a connecting device with an installed "log-aggregator" client, which is directed to a logging server that may be a client to another network.

Byte size content

8 Final Receive-ID

n mime-encoded data

Subtype 3: remote data-aggregator

This datagram represents a query to the client from the server's "remote data aggregator" engine to obtain data from the client establishing the connection.

Byte size content

8 Final Receive-ID

1 datagram type (query or answer)

n mime-encoded data

Subtype 4: Content Approval Request

This datagram is used to request approval of transmitted content data, such as closing records, expense reports, and electronic financial transaction approvals.

Byte size content

8 Final Receive-ID

n Mim-encoded and XML formatted content for approval

Subtype 5: Content Approval Response

This datagram is used in response to a content approval request (subtype 4).

Byte size content

8 Final Receive-ID

1 Approve or Reject

Length of the signature field

n ECC signature for the data field of a "Type 8" packet

Main type 2: broadcast datagram

This type of datagram is used in a variety of conferencing and broadcast applications. Non-real-time point-to-multipoint transmission: real-time point-to-point transmission (eg, user-to-user chat, audio video conferencing); Real-time point-to-multipoint transmission (eg, stock tickers, audio video broadcasts); Multiple subtypes may be implemented that include real-time multipoint to multipoint transmissions (eg, audio video conferencing).

Main type 3: Connection proxy

Connection proxy datagrams are used to carry raw connection data and send the same from the built-in application on the client to the network server.

Typically a proxy connection is requested on the control channel, i.e., the first connection to the server, and is established when a new connection to the server is initiated upon a successfully processed request. Thereafter, the "proxy connection-ID" is also given, which is used for authentication purposes. In yet another embodiment, the proxy connection may be established directly on the control channel. This supports data transmission over a single connection. This reduces the load on the server and client when the proxy connection carries very little data, such as when a terminal server or telnet connection is used.

Connection type

Different types of connection protocols may be used.

0: TCP

1: UDP

Subtype 1: Proxy Data from Client

This datagram carries the actual data for the proxy connection coming from the client end. One user may have more than one proxy connection open at the same time. A Connection ID (CID) field is included to identify each connection.

Byte size Description

2 proxy connection ID

n data

Subtype 2: Proxy Data to Client

This is the connection data input back from the proxy connection to the client (the owner of the connection). Since only the proxy connection sends and receives connection data to the owner of the connection, no fields other than the actual data are included. In order for the client to identify which remote connection (ie, server) responds, the CID is included in the sender field of the datagram.

Byte size Description

N data

Type Sender Description

0: connect to server remote socket

1: Disconnect the server remote socket

2: Disconnects the client remote socket but maintains the proxy connection (CID).

3: terminate client proxy socket connection (complete termination)

4: terminate the server proxy socket (complete shutdown)

Week Type 4: Mass Content Delivery

This datagram is designed to transfer large amounts of content data such as audio, video media and data files.

Subtype 0: Resume for Transfer

If the sender requests a record from the final receiver, the final receiver may transmit a 4,0 type datagram with a record for the transmission.

The returned return contains the CRC field and the content of the transport-ID.

Byte size Description

Length of 1 CRC field

n Checksum for transferred content

n transport-id

Subtype 1: Content Delivery Request

Used by clients to request the delivery of bulk content. Upon receiving the client's request, the server returns a transport-ID (TID) to use for the client, so that the client can open an additional connection to the server to deliver the content. As such, the control connection will not be interrupted for long periods of transmission.

Byte size Description

4 Byte size of content to be transferred

2 Total number of chunks to be sent

4 final recipient-ID

Subtype 2: Content Delivery Response

Byte size Description

1 0 = transmit rejected, 1 = transmit acknowledged

n If the transfer is approved, this field is provided when the client opens another connection to transfer the file and will contain the transfer ID (TID) to be granted to the server.

Subtype 3: Content Delivery Segment

Byte size Description

2 segments

n segment chunk

Subtype 4: Resend Request

This is generally used to re-request a segment of content if the transmitted content fails to pass the checksum check. It may also be used to recover from loss of the transport connection.

Byte size Description

2 Chunks to be Resent

n TID

Primary type 5: user directory

This type of datagram is used to search for users, user groups, or update information in the user directory.

In the query, the search field is treated as a mask. If the underlying database infrastructure supports it, the search is performed with a search mask treated as a regular expression.

MySQL can also be implemented to provide a default database-based system with regular expression search. Thus, the system configuration supports all searches using regular expressions.

Subtype 1: User Online

This datagram is used to notify the system when the user is connected to the network.

Byte size Description

4 User ID of the user

Subtype 2: User Offline

This datagram is used to notify the system when the user disconnects from the network.

Byte size Description

4 User ID of the user

Subtype 3: User Search Request

This is used by connected clients to search for users within the entire user directory based on specific data masks. This type of search returns a type 5,10 datagram.

Byte size Description

n Mask for navigation

Subtype 4: individual user navigation

Similar to subtype 3, but returns a more accurate match for the user. This type of search returns a type 5,10 datagram.

Byte size Description

4 User ID

8 Last login

1 online

n Display designation

Week type 6: remote management

This datagram enables an administrator or privileged user of a network system to remotely control another connecting client, to run an application on the connected client, and to push updates.

Subtype 1: Running a Remote Console Application

The 6,1 datagram runs the specified application, maintains open operations on the application, and the process-id of the application is returned to the initiator upon successful execution. This process-id must be used in all subsequent commands or control datagrams for the process.

Byte size Description

8 Target User-ID

n Full path and name of the application to be run

Subtype 2: result of remote execution

Upon successful execution of the 6,1 datagram, it is sent back to the initiator of the 6,1 datagram.

Byte size Description

8 Receive User-ID

2 process-ID

Subtype 3: terminated remote process

When the remote process initiated by the 6,1 datagram terminates, the 6,3 datagram is sent from the application to the exit code.

Byte size Description

8 Receive User-ID

2 process-ID

2 application exit code

Subtype 10: Remote Tool Request

Retrieve information from a remote device, including information on a list of running processes, logged-in user (s), data storage, etc. to simplify retrieval of data from the remote client or to perform basic control over the remote device. A basic set of tools is available.

Byte size Description

8 Target User-ID

1 tool identifier

n Optional parameters (if a particular tool is needed)

Tool identifier

0 process list

1 list of running processes, including hidden processes

2 Process (PID given as parameters) Kill

3 Service List

4 Stop service (service name as parameter)

5 Start service (service name as parameter)

6 Restart service (service name as parameter)

7 List of local storage devices, including volume label, size, block size, space used, and file system type.

Subtype 11: Remote Tool Response

Include CSV format responses according to the requested tool.

Byte size Description

8 Receive User-ID

n CSV data output from remote tool

Subtype 20: Application Transfer Request

Used to initiate the transfer of an application or an application update.

Byte size Description

1 transmission type

Incoming User-ID

1 option (bitfield)

4 Size of content

n File path and name target (optional, default to client's root)

Optional bitfield

Bit description

1 autorun (also covers auto update, auto expand, etc.)

2 User Prompt (Before Run / Update)

3 Return after transfer

Transmission type

1 File transfer (during update, existing file is required to be presented)

2 client firmware transfer (replaces current one)

3 Transfer of client ISO codes (replaces current ones, ISO codes include CD ROM data formats such as, for example, ISO 9660 and another data standard for the International Organization for Standardization www.iso.org)

4 Transfer the compressed archive (to extend from the target position)

Subtype 21: Application Transfer Response

Used to signal acknowledgment or rejection

Byte size Description

1 Approve / Reject

8 transfer-ID (attach only if transfer is approved)

Subtype 22: Application Delivery Content Part

This datagram holds the actual data for transmission.

Four octet 'content portion' fields will allow up to 256 ^ 4 portions in a single transmission, and will provide images and archives over 4 gigabytes in size for the application's delivery (e.g. 1K data each) Using a datagram to keep it).

The 'transmit part' field starts at 1 and increments by 1 for every part transmitted, and transmits 6,22 datagrams with a 'transmit part' of zero (zero) to signal the end of the transmission.

Byte size Description

8 Transport-ID

4 transmission parts

n data content

Subtype 23: Transfer List

Checksum of the transferred application

Byte size Description

1 CRC-type

n Checksum for transferred application

Week type 7: Real time multimedia transmission

This type of datagram is used to support client-to-client transmission of multimedia content.

Subtype 1: Request to Send

Used to request an acknowledgment to begin transmission.

Byte size Description

4 Receive User ID

2 Media content type

Minimum bandwidth required for 4 Kbit / s

Media content type

Type Description

1 5 KHz, 8 bit, 1 channel audio

2 8 KHz, 8 bit, 1 channel audio

3 11 KHz, 8 bit, 1 channel audio

4 11 KHz, 8 bit, 2 channel audio

5 22 KHz, 16 bit, 2 channel audio

6 44 KHz, 16 bit, 2 channel audio

Subtype 2: Transmission Response

Byte size Description

4 Receive User ID

1 Approved (1) or Rejected (0)

4 content stream ID (sent by receiving the client, and should only exist if the request is approved)

Subtype 3: Media Stream Packets

This datagram carries the individual packets that make up the transmission.

Byte size Description

4 Receive User ID (0 for use of recipient list)

4 Content Stream ID

n stream packets (content data)

Subtype 4: End Transmission

It may be sent by both the sender or the receiver to indicate the end of the transmission (if sent by the sending source) or the abandonment of the transmission (if sent by the receiver).

Byte size Description

4 Receive User ID (zero for use of recipient list)

4 Content Stream ID

Subtype 5: Recipient List Management

If you are doing one-to-many transmissions, such as lectures, conference calls (VoIPs), you may rely on this datagram to manage the distribution of data for the entire list of recipients.

Byte size Description

1 action

n data

Action Definition:

Action description

0 Delete recipient list (if set)

1 Add user (s) to the list (spatially separated list of user IDs as data)

2 Remove user (s) from list (spatially separated list of user IDs as data)

Subtype 6: Transmit Switch Request

This datagram allows the client to send a "end of transmission" notification to another user.

Byte size Description

4 Receiver ID

2 Media content type

Minimum bandwidth required for 4 Kbit / S

Example 2: Object Vector Based Super Classifier and Biometric Measurement

Referring to FIG. 2, an object vector super classifier (also referred to as multiple classifier) is shown. One or more data object vectors are used for event level authentication. The classification decision is made based on the highest or random sum calculated from the data vector objects comprising the object vectors 1, 2 and 3 of FIG. Here, each object vector is connected to one or more classifiers from classifiers 1 through N. In other words, feature extraction is done from multiple object vectors and collectively transformed into a series of classifiers that make up a super classifier. Event specific transformations provide a relatively simple distribution that characterizes event based characteristics.

An example of user authentication using a super classifier includes biometrics. In one embodiment of the present invention, the super classifier is used in combination with physical biometric measurements, including voice recognition, fingerprints, handprints, blood types, DNA tests, retinal or iris scans, face recognition, and the like. In another embodiment, the super classifier is used in conjunction with behavioral biometric measurements that include habits or patterns of personal behavior.

The selection and execution of event based authentication sessions, and object analysis based on such user specific events, increases the likelihood of identifying or driving the binary structure of object decision analysis. Since the binary structure is added to the super classifier, the authentication session may be evaluated at a high probability rate.

The descriptions, the specific examples, and the data representing the exemplary embodiments are given by way of example and are not intended to limit the various embodiments of the invention. All references cited herein are specific and incorporated by reference in their entirety. Various modifications and variations in the present invention will be apparent to those skilled in the art from the description and data contained herein and are therefore considered to be part of various embodiments of the present invention.

Appendix 1: Object Classification in Speaker Verification

Classification and probability density estimation

Speaker verification, like any other data object vector, is a classification problem involving two classes: target speakers I (the user of the object) and impersonators ( -I ) (the intruder of the object). In this case, a set of measurements from the recording of the speaker's voice is needed for classification. These measures are D-dimensional vectors,

It can be represented conveniently.

Each speaker is a probability density function that measures the likelihood of the observations,

It is characterized by. This probability density is

수식: 1.1

Formula: 1.1

수식: 1.2

Formula: 1.2

수식: 1.3

Formula: 1.3

가 주어졌을 때, 주장된 화자 I 의 사후확률 (posteriori probability) 이 중요하다.Where P (I) and P (-I) are the priori probabilities of the target speaker's attempts and impersonator attempts, respectively. For speaker verification, observations

Is given, the posterior probability of the alleged speaker I is important.

The posterior probability can be calculated by Bayes' rules.

수식: 1.4

Formula: 1.4

Since I and -I are mutually exclusive, the following equations can be obtained.

수식: 1.5

Formula: 1.5

가 주어졌을때 아이덴티티 주장이 맞을 확률과 어떤 다른 화자 (I 가 아닌) 가 말하고 있을 확률의 합은 1 이다. 분류 목적을 위해 사후확률

을 사용하는 것은 매력적인 것으로, 다음의 룰에 의해 아이덴티티 주장이 승인되거나 거부된다.That is, observations

Given is the sum of the probability that the identity claim is correct and the probability that any other speaker (not I) is speaking is 1. Post-probability for classification purposes

It is attractive to use. The identity assertion is either approved or rejected by the following rules.

1 Probability density for two classes, I and -I.

Density overlaps in the following areas,

수식: 1.6

Formula: 1.6

This makes the Bayesian error rate greater than zero. The classifier using this decision rule is called a Bayes classifier. The error rate of the Bayes classifier is

수식: 1.7

Formula: 1.7

Formula: 1.8

수식: 1.9

Formula: 1.9

Is the same as where

수식: 1.10

Formula: 1.10

수식: 1.11

Formula: 1.11

to be.

Indeed, probability functions

및

And

Is unknown and can only be estimated. Thus, the error rate in any actual determination method is limited to having an error rate above the Bayes error rate on average.

Priority probability & risk minimization

The average error is the target speaker's rejection (TA error):

수식: 1.12

Formula: 1.12

And impersonator's approval (IR error):

수식: 1.13

Formula: 1.13

It consists of two terms.

Using post-probability to classify samples is essentially the same as classifying according to maximum Lyclihood. However, the overall error rate depends on the relative number of attempts by the impersonator and the target speaker. If the impostor attempts are much higher than the target frequency speaker attempts, total absolute error, so more and more dependent on the E _-I E _I, although a higher probability of class I, are likely to be classified as a class to which the sample -I high. In other words, E _-I is minimized by sacrificing E _I. A method of optimally balancing these error rates is to fix the prior probability to reflect the relative number of impersonator / target speaker attempts (object attempts).

Assigning prior probabilities is the only way to balance TA and IR errors. In general, the two types of errors may have different results, and therefore, it may be desirable to obtain a balance that reflects the cost of misclassification. In this case, P (I) and P (-I) are

수식: 1.14

Formula: 1.14

수식: 1.15

Formula: 1.15

Is replaced by

는 -I 샘플을 I 로 분류하는 경우의 비용이다. 여기서의 분류는 사후확률이 아닌 리스크에 따른다.here,

Is the cost when classifying -I samples as I. The classification here is based on risk, not ex post probability.

수식: 1.16

Formula: 1.16

Similar to Equation 1.6, the following decision rule is obtained.

수식: 1.17

Formula: 1.17

More practical approach to balancing TA and IR errors problem is to decide a priori to an appropriate error rate for the _I or E _-I E is determined by using the crystal plane ^1, then, it (and, P (I) And by expansion of P (−I) ). Regardless of which method you choose, the class lyclihood

And

The actual problem of estimating remains the same.

Probability estimation

One approach to implementing decision rules is to individually determine probability densities and

And

Estimates in a test environment

Instead, use Bayes' rules to convert to probabilities that can be used.

However, this solution is more extensive than required because the verification (by the utterance conversion being binary data objects) depends only on the Lyclihood ratio, which is

Is given by

In terms of LR (~ x), the decision function 2.6 is

수식: 1.18

Formula: 1.18

Becomes

The Bayesian decision plane between class I and class -I is

It is characterized by.

가 결정 평면의 어느 측에 위치하는지만 알면된다. 도 2.1 에 주어진 예에서, 이 평면은 가능한 가장 단순한 것으로서, 단일 포인트 x = t 이고, 여기서 t 는 결정 임계값이다.For classification purposes, test samples

Know only which side of the crystal plane is located. In the example given in Figure 2.1, this plane is the simplest possible, with a single point x = t, where t is the decision threshold.

A distinction is made between parametric and non-parametric classifications. The difference lies in the assumptions made about the class distribution. Parametric classification assumes that the samples to be classified belong to a narrowly defined family of probability density functions, while non-parametric classification only makes a weak estimate of the prior distributions. Thus, non-parametric classification is more general, whereas parametric classifiers are easier to construct because they have lower degrees of freedom.

Parametric Classification

As an example of parametric classification, classes (j = 1, 2) are normal probability densities

Formula: 1.19

It can be assumed that it is characterized by.

in this case,

Is given by

수식: 1.20

Formula: 1.20

수식: 1.21

Formula: 1.21

This is a quadratic function. In addition, if we assume that two distributions share the same covariance matrix S1 = S2 = S

수식: 1.22

Formula: 1.22

Is simplified.

2 The two classes were Bayes classifiers using quadratic decision planes.

Left: Classes have similar averages.

Right: Classes have different averages.

In the right example, the Bayesian crystal plane can be approximated well with a linear function, where

수식: 1.23

Formula: 1.23

수식: 1.24

Formula: 1.24

to be.

This is a linear function. In identification analysis, Equation 1.22 is known as a Fisher linear identification function. As we have seen, this identification function is optimal for normally distributed classes characterized by the same covariance matrices, but its usefulness goes beyond this. It is a robust function (although not optimal) that can produce good results when class distributions have a "spherical cloud" shape. In fact, even though Equation 1.21-and not Equation 1.22-is known as the optimal identification function, Equation 1.22 may give better results (Raudys and Pikelis 1980). The problem with using Equation 1.21 stems from a limited set of samples and is difficult to obtain good estimates for S1 and S2. In particular, this is true in high dimensional space.

Linear classifier preferentially first-order moments (means)

Is less sensitive to estimation errors, and these moments are easier to estimate than S1 and S2 (secondary moments). If necessary, the linear classifier may be further simplified, assuming that S is diagonal or even equal to the identity matrix.

Yes

2 shows two examples of first-order density functions for two normally distributed classes. In both examples, the variances

Bayes crystal planes are quadratic because they differ from each other.

Average, in case 1

이고,

ego,

In case 2

to be.

Assuming the same priors, the decision rule can be determined using Equation 1.21.

수식: 1.25

Formula: 1.25

수식: 1.26

Formula: 1.26

Therefore, the decision rule

to be.

The error rate is

to be.

In the linear case we saw in 1.22,

수식: 1.27

Formula: 1.27

수식: 1.28

Formula: 1.28

Therefore, the following decision rule can be obtained.

이다. 여기서의 2 차 분류자는 선형 분류자에 비해 훨씬 우수하다. 케이스 2 에서, 대응하는 결정 룰은, 2 차 분류자에 대해,In this case, the error rate is

to be. The secondary classifier here is much better than the linear classifier. In Case 2, the corresponding decision rule is, for the secondary classifier,

Become,

For the linear classifier,

Becomes Average error rates are 0.007% and 0.03%, respectively, which are very small values for both decision rules. However, the second decision rule is relatively much more accurate. This is not because it is 2 difference,

A linear decision rule, such as, has a small error rate as a second decision rule. Thus, the difference in performance here is due to the assumptions about prior distributions.

Linear vs Nonlinear Crystal Planes

식 1.29

Equation 1.29

에서 선형인 것으로 미리 가정하는 것은 분류자의 설계를 단순화시킨다. 1.29 에 대한 해를 더 큰 세트 (보통 이것은 선형 해를 특별한 경우로서 포함함) 로부터 얻을 수 있게 하므로, 비선형 분류자들은 더욱 강력하다. 그러나, 선형성은

를 참조하지만, 벡터

는 분류자에 제공되기 이전에 "선처리" 될 수도 있기 때문에, 선형 결정 평면들을 가정하는 것에 관하여는 아무런 제한이 없다. 예를 들어, 주어진 2D 문제Sun for

Assuming in advance that is linear in simplifies the design of the classifier. Nonlinear classifiers are more powerful because they allow the solution for 1.29 to be obtained from a larger set (usually this includes linear solutions as a special case). However, linearity

See, but vector

Since may be " preprocessed " before being provided to the classifier, there is no limitation as to the assumption of linear decision planes. For example, given 2D problem

The optimal decision plane at

Assume that it has the form of.

Rather than about x ₁ and x ₂ ,

When classification is performed with respect to, the linear classifier can implement this decision plane, where

수식: 1.30

Formula: 1.30

to be.

That is, the 2D quadratic decision function can be implemented by a linear function in 5D space.

Non-parametric classification

3 shows a practical example of how the distribution of the class (the speaker or the object) of the speaker recognition system or the object recognition engine may be.

Here, the assumption that observations from a given speaker are obtained from a normal distribution is reasonable.

The Fisher identification function is suitable for identification between any two speakers (and in this case compared to an object containing any given data source), but clearly unsuitable for identification between one target speaker and the rest of the speakers in the crowd. It is a model (in 2D) (the line that separates one independent speaker from most other speakers in the crowd cannot be drawn). In fact, the impersonator class is too complex to model with any simple parametric distribution. This is a common situation in many pattern classification problems. There are many techniques for non-parametric classification and probability density estimation.

FIG. 3 is a probability distribution of 2D samples obtained from a set of 10 different samples

Non-parametric probability density estimation

Given a training set of samples for which class membership is known, non-parametric probability density estimation is a matter of constructing a PDF that approximates the actual PDF characterizing the classes without assuming anything about what exists.

Histogram rule

의 라이클리후드는 그것이 속하는 볼륨 v(

) 을 확인하고, 이 볼륨에 위치하는 트레이닝 샘플들의 상대적인 개수를 계산함으로써 계산될 수 있다.The simplest approach to non-parametric density estimation is to divide the feature space by volumes v of size h ^D , where h is the lateral length of the D-dimensional hypercube. After that, given test sample

Lai Hinckley hood volume belongs to v (

) And calculate the relative number of training samples located in this volume.

수식: 1.31

Formula: 1.31

는

가 속하는 볼륨

에 위치하는 샘플들의 개수이고, N 은 트레이닝 세트의 전체 샘플 개수이다. 1.1.2 k-최인접 이웃 (Nearest Neighbour).here,

Is

Volume to which it belongs

Is the number of samples located at and N is the total number of samples in the training set. 1.1.2 k-Nearest Neighbor.

The nearest neighbor PDF estimation eliminates the problem of selecting the parameter h by varying the sizes of the different volumes so that a fixed number of training samples (k) are placed in each of the volumes. The result is called a Voroni partition (tessellation) in the feature space. An example (k = 1) is given in FIG. 4.

However, like the histogram rule, the probability density estimate is discontinuous,

Two adjacent samples on different sides of the cell boundary have different Lyclihoods, despite the fact that the spacing between them may be small (Rule arbitrarily). Also, because some cells may have infinite volume, that is, this means that the samples located in these cells have an estimated Lyclihood 0, and the Voroni partition has a boundary problem.

Fig. 4 Vorony partition of feature space resulting from 1-nearest neighbors

Kernel functions

를 계산하는 것이다 (Hand 1982).Another generalization of histogram rules is the sum of kernel functions.

(Hand 1982).

수식: 1.32

Formula: 1.32

의 형상이

의 특징을 결정한다. 예를 들어, 균일 커널Kernel

Shape of

Determine the characteristics of the. For example, a uniform kernel

수식: 1.33

Formula: 1.33

가 연속 함수인 경우,

도 연속적이다. 주로 가우시안 커널을 선택한다.Essentially results in histogram rules, while

If is a continuous function,

Is also continuous. Mainly choose a Gaussian kernel.

수식: 1.34

Formula: 1.34

가 PDF 를 근사하기 때문에,

Since approximates a PDF,

수식: 1.35

Formula: 1.35

수식: 1.36

Formula: 1.36

가 PDF 임을 의미하기 때문이다.It is convenient to require, and this is automatically

Is because it is a PDF.

[Fig. 5] Lycli Hood

Lycli Hood

5: Kernel estimation of the density function corresponding to FIG. 3. In general, kernel functions are placed unevenly in the feature space. Thus, as opposed to simple histogram rules, some regions of the feature space are not "modeled" at all, and in other regions multiple kernel functions-complex density functions-may overlap to model density.

For example, to approximate the density function shown in FIG. 3, it is reasonable to use 10 kernels whose centers respectively correspond to the centers of the circular regions in which samples of a particular speaker are located. In this case, h must reasonably correspond to the standard deviation of the given speaker data. An example of this is shown in Figure 1.5, where Gaussian kernels were used.

Non-parametric classification

The purpose of estimating the PDFs is to be able to calculate the posterior probabilities that can be used in decision rule 1.6. However, it is possible to implement 1.6 directly without this intermediate step. The way to do this is, basically, to partition the feature space into regions, and label each region according to which class samples (obviously) belong to it.

It is not difficult to see how the k-nearest neighbor rule can be used for classification, simply labeling each Voroni cell according to which class the majority of k samples of the cell belong to. As a result the crystal planes will be partially linear.

Fig. 6 The perceptron (right) forms a hyperplane and sorts the samples according to which side of the hyperplane the samples are located.

Classifiers may also be based on kernel functions. In this case, the requirements for kernel functions K () are less restrictive, because the restrictions of PDF need not be satisfied. The Radial Basis Function (RBF) network is an example of a classifier based on kernel functions.

Maximize Basis Function Radius

For RBF networks, basis functions,

수식: 1.59

Formula: 1.59

By taking into account the diameter of a structure can be imposed on the basis functions, the smaller the h, the more "spiked" the basis function. The spiked basis function is only sensitive to very small areas of the feature space and may be important during training. The wide basis function (large h) covers a large volume of feature space, and the larger h, the more like the simple bias the basis function is always active. Thus, a network trained to have a large diameter can be better generalized, and the diameter should be extended to the point where it does not significantly degrade classification performance in the training set.

Classifier total

The fact that the training algorithms used to estimate the parameters cannot determine the global minimum value of the optimization condition and can only determine the local minimum value is problematic in many models, especially in neural networks, which have only limited complexity. . For this reason, it may be useful to train multiple classifiers on the same data and use these networks to create new "super" classifiers. Combinations of different networks cannot be done easily in the parameter domain, but networks representing different local minimums can model different parts of the problem, and a classifier defined by the average output of individual classifiers is generally superior to any individual classifiers. The individual mean square error rates of N classifiers (Equation 1.40)

The expected value of the squared mean error rate of the classifier total is given by the following equation, assuming that the networks make the error independent (Perrone and Cooper 1994).

수식: 1.60

Formula: 1.60

Thus, unless the errors are correlated (uncorrelated), the performance of the classifier aggregate can be improved by adding more networks, and the squared mean error rate is cut in half each time the number of networks is doubled.

For Perceptron type models, networks representing different local minimums can be generated simply by initializing the weights differently (Hansen and Salamon 1990; Battiti and Colla 1994). In Benediktsson et al. (1997), individual networks (perceptrons) are trained on transformed data using different data transforms. Ji and Ma (1997) proposed algorithms specialized for selecting and combining weak classifiers (perceptrons).

Speaker Verification

Speaker verification and object handling in a randomized environment is a pattern identification problem and is conceptually very simple because only two classes (patterns), namely target speakers or objects and impersonators, need to be distinguished. However, it is not easy to classify two classes in the feature space. Class distributions must be actually modeled using complex and non-parametric techniques. Neural networks are attractive classifiers for this kind of problem, and their identification training approach makes it possible to focus modeling on the area of the feature space that identifies the speaker or object.

However, a problem with many training or object learning algorithms is that they cannot guarantee optimal values of modeling parameters. In this case, structural risk minimization techniques can be used to impose restrictions on modeling to improve generalization capabilities. Another approach to the parametric problem-the next best thing-is to use gross techniques, in which the gross of simple lane classifiers can be combined to form a more powerful and robust new classifier. The aggregation method is attractive because the error rate of the classifier aggregate is in principle proportional to the inverse of the number of aggregate members.

Appendix 2: Object Analysis Illustrated by RBF-based Phoneme Modeling

This example shows a classifier architecture that can be applied to speaker verification at the event level, but should be seen as an example of a method that can be used for any given object data type. The classifier-the RBF network-cannot self identify the events it operates on and relies on a feature extraction process to do this. 1.1 schematically illustrates a classifier architecture. Hidden Markov Models are used to segment the speech signal. The Hidden Markov phonological model models phonological segments as a mix of normal distributions, where the mean and variance of this blend varies in state transitions, at discrete points in time. These discrete changes should ideally be continuous, but this is difficult to model.

After phonological segments are identified, new feature extraction is performed (section 1.1), where each individual phonological segments are represented again by a single vector of features. Here, the feature vector representing the entire phonological observation is a phonological vector,

I will say.

Once phonological vectors are extracted, the signal no longer contains time information, and the fact that the phonological vectors are measured sequentially over a period of time is inappropriate and does not contain information about the speaker identity. ¹ also, the binary form of the voice print, and "create" in the (pure) random utterance model, which makes the binary object entirely unique. What this actually means is that the vector model is a random vector n ⁿ .

Here, the basic feature is represented by the filter bank energy, so that negative vectors need to be normalized to remove the signal gain (section 1.2). To this end, speaker probability,

These are converted 1, before finally passed as input to the RBF network to compute

Should go through.

Frame selection

Phonological durations are a function of phonological context, overall speech tempo, and other factors, and phonological durations are very variable. For a static modeling approach it is necessary to represent the phonemes by a fixed number of features. This can be done using Markov segmentation, where each phoneme is segmented into a number of sub-segments corresponding to different emitting Markov states of the phoneme model. Possible representations are as follows:

1. Compute a new "variable" frame segmentation (and speech parameterization), where the new frame length is adjusted to be an integer ratio of the entire phonetic segment. Arithmically this is relatively expensive, but the advantage is that the entire phonetic segment is used.

2. Select a fixed number N of existing frames as the representative of phonetic segments. Several frame selection methods can be considered.

a. Linear Selection: Select linearly spaced N frames from phonetic segments.

b. Sub-segment selection: Select one frame from each sub-phonic segment. In order to promote uniformity of representation, the selection must be performed consistently, for example by always selecting center frames in each sub-phonic segment modeled by separate HMM states.

c. Maximum Riclid Hood Selection: Select a frame from each sub-phonic segment with the highest riclihood.

After the appropriate frames are identified, the corresponding feature vectors are "concatenated" to form one long vector.

The selection schemes 2A and 2B are quite similar, and here we refer to the frame selection scheme since variations in the frame selection scheme in relation to the aggregate methods (see section 2.7) can be used to generate "different" phonological models for the same phonology. It was chosen to use 2B. The selection scheme 2B can be easily modified by, for example, selecting the rightmost or leftmost frames in each subsegment instead of the center frame.

Normalization

The problem with filter bank representation of speech signals is that the signal gain is not well controlled. Signal gain depends on the speaker's speaking level, distance from the microphone, and the angle between the mouth and microphone and recording tools. This effectively means that absolute gain cannot be used for speaker identification and must be normalized. As is common with respect to speech processing, log filter bank representation is used.

[Figure 7] RBF Network

This means that the logarithm of the energy output from each filter bank is used. Energy outputs below 1 are discarded, most of them represent noise, and because of the singular behavior ² of the logarithmic function, It is best not to model these energies.

In the log energy domain, the gain factor is additive bias,

수식: 1

Formula: 1

Becomes

Here, taking log () of a vector means that the log () function is applied to all elements of the vector. Also, addition (multiplication) of scalars and vectors means that the scaler is added (multiplication) to all elements of the vector. The phonological vectors are assumed to have norm 1 because the scale is not appropriate.

수식: 2

Formula: 2

After scaling, he

수식: 3

Formula: 3

Becomes

Therefore, bastard

Calculate

Subtract the log norm from the filter banks

수식: 4

Formula: 4

The gain can be eliminated by doing so.

To make the data more even, vector

Is normalized to have norm 1 here.

If an independent gain factor is associated with each filter bank channel, this results in bias vectors added to the feature vectors. This type of gain cannot be eliminated by looking at one particular feature vector, but can instead be compensated by estimating the average energy output during one vocalization.

Indeed, bias removal is a useful heuristic, but since the estimated bias depends on the phonetic content of the vocalization (Zhao 1994), this is actually a trivial problem. This heuristic is not used here.

RBF Training:

Normalized phoneme vectors are phonemes

And before being input into a speaker dependent RBF network, the RBF network

function

수식: 5

Formula: 5

Is used to calculate

Where S is the activation function scale,

수식: 6

Formula: 6

Where D is the dimension of the input vectors. Basis Function Scales Ci and Variances

silver

수식: 7

Formula: 7

Defined by the network, the optimal Bayesian discriminant function

Ensure to approximate it.

Many techniques have been used for these (Press et al. 1995; Bishop 1995). In this case, the simplest approach here is to use gradient descent because the slope calculations are easy, and because of the size of the network, the training algorithm converges very quickly, resulting in conjugate slope or quasi-Newton. No methods are required. Gradient reduction is an iterative technique, where the parameters of the iteration t are updated according to

수식: 8

Formula: 8

수식: 9

Formula: 9

수식: 10

Formula: 10

수식: 11

Formula: 11

수식: 12

Formula: 12

here,

수식: 13

Formula: 13

ego,

수식: 14

Formula: 14

수식: 15

Formula: 15

수식: 16

Formula: 16

수식: 17

Formula: 17

수식: 18

Formula: 18

And

to be.

Here, the slopes are shown to be calculated as the summation for the entire training samples. To speed up the training process, this requirement is usually relaxed so subsets or even individual samples are used as the basis for calculating the slope and updating the parameters. This is reasonable if the training data is "periodic" ¹ .

The forms of the slope equations are relatively easy to understand. Gradient equations have some common terms and some specific terms.

The common term that all the slopes contain is the error term,

This is zero if the samples are not misclassified. Thus, if the samples are sorted correctly, the parameters are not updated. In the case of misclassification, the error term is positive if the target output is negative and the error term is negative if the target output is positive. A class dependent weight may be given in the error term to emphasize one class error rate over other error rates. For example, the target speaker patterns may be weighted higher because the training set contains relatively fewer target speaker patterns, so the classifier may "over learn" these patterns compared to the richly impersonated speaker patterns. "I tend to.

The second term that appears in every slope

to be.

This term

, I.e., if the parameters are misclassified with a large margin, they have the effect of preventing parameter changes.

(Note 1: Here, there are two or more periods, so that the target speaker pattern and the impersonator speaker pattern must appear in each period. More generally, each update corresponds to individual phonetic observations-e.g. different phonetic contexts. -Period- may be increased to be based on a set of-which, if this is not done, learning may tend to be "abnormal", and the network is biased with the most recently shown training token, and among the recently learned information Forget some-forget it.)

The third term shared by all the slopes is the basis function output,

, Which is a value between 0 and 1. Thus, the sample

this

If is not located in the hyper elliptical region where it is active, the parameters associated with a given base function are not updated.

Weights

를 나타낸다.The weights are updated so that for misclassified samples, the weight increases if the target output is positive and decreases vice versa. In the final classifier, base functions with positive weights represent class I, and base functions with negative weights are class

Indicates.

Average

Target class,

,

,

The base functions representing ε are moved closer to the misclassified sample, and the base functions representing the opposite class are farther away. The step size is the individual basis functions,

Depends on how to "activate" the radius of the basis functions,

, Spacing with misclassified points and the normal magnitude of the classification error.

Basis Function Scale

The width of the basis functions

에 의해 제어된다.

Controlled by

For the base functions that represent the target class,

Is reduced to include the sample inside the sphere of influence of the basis functions (the width is increased). For base functions that represent opposite classes,

Is increased to exclude the sample from the effect sphere of these basis functions (width is reduced).

Updating variances has the same effect as widening the base functions for base functions representing the target class and reducing the width of the base functions representing the opposite class.

Dispersion

Dispersions,

,

,

Represents the relative variance of the individual feature elements. The variances do not necessarily correspond to the statistical variances of the individual elements, but to the importance of the features. Feature elements with small importance for classification may have a relatively small impact on the activation of the basis function by receiving a large "variance".

Activation function scale

The scale of the activation function S increases for samples of the correct side of the hyper plane implemented by the perceptron and decreases for samples of the incorrect side. However, the classification of the samples is not improved or changed by updating S. Thus, the learning algorithm does not change the value of S for the purpose of minimizing the error rate. However, the activation function scale may be adjusted sequentially to improve the RBF model as a probability estimator.

reset

Iterative training algorithms require an initial estimation of network parameters. The parameters of the RBF network are much easier to interpret than the weights of the MLP and therefore do not necessarily need to be initialized with random values. In particular, a clustering algorithm can be used to calculate suitable basis functions representing the target speaker and the cohort speakers, respectively. The weights corresponding to the target speaker basis functions are

수식: 19

Formula: 19

Can be initialized to, where

Is the number of training samples located in the i th target speaker cluster. Similarly, the weights corresponding to the group speaker basis functions are

수식: 20

Formula: 20

Can be initialized to

Bias weights

(거부) 이어야 한다. Must be initialized to a value less than 0, and if the network is provided with a phonological vector that does not activate any basis functions,

Should be (deny).

The convergence of the training algorithm depends critically on the initialization of the basis functions, but is actually strong in weight initialization. Thus, the weights may simply be initialized to random values (in the range [-1; 1]).

Post probability

RBF networks are trained to minimize the root mean square error rate of the training set (Equation 1.9). Minimization of this error condition allows the RBF network to approximate the optimal (baize) identification function given by

수식: 21

Formula: 21

This important fact has been demonstrated by several authors (Ruck et al. 1990; Richard and Lippmann 1991; Gish 1990a; Ney 1991).

가 최적 구별 함수를 근사하지만, 이론상, 이 함수를 정확하게 구현할 수 있는지 여부는 의문이다. 출력에 나타나는 RBF 네트워크의 스쿼싱 (squashing) 함수 tanh() 는 R^D 로부터 [-1;1] 로의 매핑들의 구현 가능한 수를 제한한다. 예를 들어,

Approximates an optimal discriminating function, but in theory it is questionable whether it can be implemented correctly. The squashing function tanh () of the RBF network appearing in the output limits the number of possible implementations of the mappings from R ^D to [-1; 1]. E.g,

가 이 타입인 경우, 이론상으로도, 계산될 수 없다.A generic function such as, even though it has a finite number of basis functions, cannot be implemented by the above RBF network.

If is of this type, theoretically, it cannot be calculated.

는 매우 유동적이다. 사실, Stone-Weierstrass 정리를 응용하여, 이함수는 R^D 로부터 임의의 R¹ 으로의 어떠한 매핑도 잘 근사할 수 있음을 나타낼 수 있다 (Hornik 1989, Cotter 1990). tanh(x) 는 [0;1] 범위의 임의의 값을 취할 수 있는 단조함수이기 때문에, 다음 함수를 근사할 수 있다.However, the underlying function

Is very fluid. In fact, by applying the Stone-Weierstrass theorem, this function can indicate that any mapping from R ^D to any R ¹ can be approximated well (Hornik 1989, Cotter 1990). Since tanh (x) is a monotonic function that can take any value in the range [0; 1], the following function can be approximated.

수식: 22

Formula: 22

However, choosing tanh (x) as the activation function is not arbitrary. For example, in a two-class classification problem, two classes to be identified are Gaussian probability distributions.

수식: 23

Formula: 23

수식: 24

Formula: 24

Consider the case characterized by.

According to Bayes' rule, the posterior probability of class I is given by

수식: 25

Formula: 25

here,

수식: 26

Formula: 26

to be.

RBF network identification function

수식: 27

Formula: 27

If we approximate, we get the following equation (using 2.5),

수식: 28

Formula: 28

수식: 29

Formula: 29

This is exactly what we want,

here

수식: 30

Formula: 30

to be.

Activation function scaling

As probability estimation, Equations 33 and 34 are somewhat incomplete. If a steep activation function (large activation function scale S) is used, the output is essentially a binary variable. The activation function scale (S) is, first of all, ideally an independent test set,

수식: 31

Formula: 31

는 From the empirical activation function, where

Is

수식: 32

Formula: 32

들은 독립적인 테스트 세트의 음운 벡터들이다. 이제,

를 만족하는

값이 식별되고 (즉,

),Is a step function, where

Are phonological vectors of independent test sets. now,

To satisfy

The value is identified (i.e.

),

수식: 33

Formula: 33

The activation function scale is adjusted so that

this is

수식: 34

Formula: 34

Is performed by selecting, where

수식: 35

Formula: 35

to be.

Another potentially more accurate approach is to simply substitute tahh () with an empirical activation function (Eq. 36).

Another potentially more accurate approach is to simply substitute tahh () with an empirical activation function (Eq. 36).

Bias adjustment

을 목표 화자 샘플들 및 그룹 화자 샘플들에 대해 다르게 스케일링함으로써, 또는, 목표/그룹 패턴들에 상이한 주파수를 제공함으로써, 또는 가중치/직경 패널티를 이용해서 모델들을 제약하는 방식에 의해 제어될 수 있다. 그러나, 이들 수단들은 꽤 투박하고, 더욱 정확한 접근방법은 RBF 모델들의 바이어스

를 조정하는 것이다. 이것은 목표 화자

가 주어지고, 사칭자 화자들

이 주어졌을때

의 평균 및 분산을 추정함으로서 행해질 수 있다. 이들 2 개의 변수의 가우시안 분포를 가정하면, 바이어스는 Training an RBF network from a limited training set is difficult. In general, the problem is the target speaker portion, not the impersonator portion of the training set. Of course, this makes it difficult to train the speaker model, but especially makes it difficult to adjust the model to achieve the desired balance between TA and IR errors. The balance can be somewhat controlled by various training parameters, for example an error term

Can be controlled by differently scaling the target speaker samples and the group speaker samples, or by providing different frequencies to the target / group patterns, or by constraining the models using weight / diameter penalty. However, these measures are quite crude, and a more accurate approach is to bias the RBF models.

To adjust. This is the target speaker

Given, impersonator speakers

Given this

It can be done by estimating the mean and the variance of. Assuming a Gaussian distribution of these two variables, the bias is

로 감소됨으로써,

Is reduced to

수식: 36

Formula: 36

Becomes

This solution can be found by determining the roots of

수식: 37

Formula: 37

Here, the following abbreviations were used.

수식: 38

Formula: 38

수식: 39

Formula: 39

수식: 40

Formula: 40

와

사이의 것이다.For B = 1 this is the same formula as in Equation 1.26 (example of object classification). The year we are interested in

Wow

It is between.

Another way-if Gaussian estimation is poor-is to use the empirical activation function (Equation x.36). If a different error balance B is required, the bias can be adjusted according to the following equation.

수식: 41

Formula: 41

수식: 42

Formula: 42

수식: 43

Formula: 43

를 판정하고, 바이어스로부터 감산한다.Thus, in order to adjust the odds ratio to have a balance B,

Is determined and subtracted from the bias.

The same error rate is approximated for B = 1, the number of TA errors at the cost of IR errors for B <1 is minimized, and IR errors at the cost of TA errors for B> 1.

8 shows class condition empirical distribution functions, for a set of speaker models,

And

And heuristic activation function

Indicates. This figure shows both functions for training data and test data.

Figure 8 empirical distribution function

For the training data, 1622 and 6488 local target speaker and impersonated speaker decisions were used, respectively. For test data, 394 and 1576 local decisions were used, respectively.

[Figure 9] Empirical Distribution Functions after Bias Compensation

에 대해, 경험적 활성화 함수는 근사적으로 0 이지만, 테스트 데이터 (화자 모델들은 "오버트레이닝" 되었다) 에 대해서는 그렇지 않다. 도 9 는 도 8 의 함수들과 동일하지만 바이어스 보상된 후를 나타낸다.About training data,

For empirical activation, the empirical activation function is approximately zero, but not for the test data (the speaker models are "overtrained"). 9 is the same as the functions of FIG. 8 but after bias compensated.

In summary, a phonological-based speaker model has been described. This model uses the HMMs as "feature extractors" that represent phonological observations as fixed vectors of the feature elements spectrum, and this part of the model is speaker independent. Phonological vectors are transformed and finally delivered as input to a phonological independent RBF network, trained to estimate speaker probability from the phonological vectors. Speaker probabilities may be used directly to generate a (local) speaker identification decision or may be combined with other speaker probabilities estimated from other phonological observations to produce a more robust decision. The input vector (phonology) is only mentioned to illustrate what the object is based on, i. Thus, any other type of biometric vectors can be used in the training filters.

Appendix 3: Object-Based Decision Making Illustrated by Speaker Verification

Object Verification-or Speaker Verification in this case is a binary decision problem, and consequently results in verifying the identity claim by calculating the score and determining whether the score is greater than or less than a given threshold t.

수식: 1

Formula: 1

When calculating this score, i. E. Object value, each phonetic segment of the speech signal contributes (even when the phonemes are not explicitly modeled). In conventional text-independent speaker verification algorithms, the contribution to the overall score of different phonologies (e.g. vocal lyclie hood) is unknown, and the overall score is the specific frequency at which phonologies are represented during each phonological segment duration in the test utterance. Depends on

It is evident that this is not optimal because local scores contributed by individual phonological segments represent the speaker identity and different phonologies are not considered to represent the same information about the speaker, e.g. While the information is greatly highlighted, on the other hand, two rear-bottom collections, for example, represent highly correlated information about the speaker.

The algorithm disclosed herein first has two parts in which phonological segments are identified and the speaker identity is modeled independently for each phonological segment. The result of this is a number of local scores, each for a different phoneme of speech, which must be combined to generate a global identification decision or a class of object data.

Combination of Scores

RBF networks are trained to approximate the following discriminant function,

수식: 2

Formula: 2

here,

Is a phonological observation.

수식: 3

Formula: 3

Because of this, we can get

수식: 4

Formula: 4

수식: 5

Formula: 5

These equations can be used to implement decision rules for single phonological observations. If several independent phonological observations are possible, more robust decisions can be made by combining local scores into one global score. The two fundamentally different approaches are aggregate and probability combinations.

Gross combination

One approach to combining local identification scores is to simply "average" the local scores,

수식: 6

Formula: 6

here,

Is the number of different phonemes in the alphabet,

의 관측의 개수이며,Rhyme

The number of observations in,

는 음운

의 j 번째 관측 (음운 벡터) 이다. 관측의 개수가 증가할수록 스코어가 [-1;1] 범위의 값으로 수렴하는 것이 이 스코어링 룰의 특징이고, 그 크기는 관측의 개수로부터 직접적으로 영향받지 않는다.

Rhyme

Is the j th observation (phonological vector). It is a feature of this scoring rule that the score converges to a value in the range [-1; 1] as the number of observations increases, and its magnitude is not directly affected by the number of observations.

Probability combination

이 만들어지면, 분류의 신뢰가 높아질 것으로 기대된다. 이것은 An alternative to aggregate combinations is to use the fact that networks calculate ex post probability. Some independent observations,

Once this is made, confidence in the classification is expected to increase. this is

수식: 8

Formula: 8

Because of this, it can be expressed by defining an intersection ratio as in the following equation.

수식: 7

Formula: 7

In addition, the following formula holds.

수식: 9

Formula: 9

수식: 10

Formula: 10

Therefore, another method of scoring uses the following formula.

수식: 11

Formula: 11

Indeed, as more phonological observations are added, it is characteristic of this scoring rule to converge to -1 or +1.

에 대해, 화자 확률은, 예를 들어,

로 추정된다. 수식 11 (확률 조합) 이 사용된 경우, 관측

이 "랜덤" 노이즈에 의해 영향받았기 때문에 확률이 1.0 이 아니라 단지 0.7 인 것으로 가정하고, 반면에, 수식 1.6 (총체 조합) 이 사용된 경우, 사칭자 군중의 특정 부분이

와 유사한 음운 벡터들을 생성할 수 있는 것으로 가정한다.The main difference between Equations 6 and 11 is the assumption about the independence of observations. Given phonological vector

For, the speaker probability is, for example,

Is estimated. If Equation 11 (combination of probability) is used, observation

Since it is influenced by this "random" noise, it is assumed that the probability is only 0.7, not 1.0, whereas, if Equation 1.6 (total combination) is used, certain parts of the impersonator crowd

Assume that we can produce phonological vectors similar to

If the same impersonal speakers can basically produce the same phonological vectors as the target speaker, the noise is "averaged" (induced), while more observations (of the same event) cannot be expected to improve the probability estimates. This difference is important.

However, the problem with both Equations 1.6 and 1.11 is that the overall score depends on the most frequent phonemes. This is inappropriate in that different phonologies can be regarded as information of speakers of different origin (Olsen 1997b; Olsen 1996b).

In practice, however, since "pathological" sentences that depend on a particular class of phonologies do not occur often, good results can be obtained using Equations 1.6 and 1.11. No rational sentence will typically have a wide selection of phonologies represented, but there should still be no chance of how to weight the evidence provided by each phonological observation.

Commit machines

Each phonological model can be considered a speaker identification expert given a particular type of information, i. Since individual experts are assumed to model different "aspects" of the speaker, it is reasonable to limit the effect each expert can have on a global score. One approach to this is to use Equation 1.6 or 1.11 to combine scores from the same expert into phonological level local scores. A local binary decision-an exact probability known empirically-can be made for each phonology shown in the test vocalization.

수식: 12

Formula: 12

Following this approach, the simplest way to combine local decisions into global decisions is to make a "most likely" vote.

수식: 13

Formula: 13

Figure 1: Probability of the community machine making an accurate decision as a function of the number of community members

는 테스트 발성에 나타난 상이한 음운들의 개수이다. 이 타입의 글로벌 분류자는 커미티 머신이라고 불린다 (Nilsson 1965; Mazurov 등 1987).here,

Is the number of different phonemes shown in the test utterance. This type of global classifier is called a community machine (Nilsson 1965; Mazurov et al. 1987).

If the individual decisions are independent and the probability P that the decisions are correct is the same, then the probability that the community machine makes the correct decision is given by

수식: 14

Formula: 14

은 도 1 에 나타나 있다. 짝수 N 에 대해, 비기는 것 (tie)

은, 에러 확률은 실제 50 % 에 불과하지만 에러로 카운트되기 때문에, 그래프는 "리플" 된다. 에러들이 상호관련되어 있지 않는 한 커미티 머신의 성능은 더 많은 구성원을 추가함으로써 개선될 수 있다. P > 0.5 인 경우, 커미티 머신은 커미티 개별 멤버들 보다 언제나 더 우수하다. Where N is the number of community members. Probability function

Is shown in FIG. 1. For even N, tie (tie)

The error probability is only 50% actual but counts as an error, so the graph is "rippled". Unless the errors are correlated, the performance of the community machine can be improved by adding more members. If P> 0.5, the commit machine is always superior to the commit individual members.

This is not the case even if the individual classifiers have different classification accuracy, but the model in that case is quite robust. For example, suppose that three classifiers of accuracy P1, P2 and P3 are combined.

수식: 15

Formula: 15

수식: 16

Formula: 16

, The commit machine is at least as accurate as the individual classifiers (let's say P1).

For example, if P2 = P3 = 0.9, if it is assumed to be more accurate than the combination of P1, P2 and P3 alone, then P1 must have a higher accuracy than 0.99.

Expert weighting

Votes from different experts are not equally important, and different phonological dependent speaker models have different accuracy. Thus, by weighting individual votes differently, the basic voting scheme can be improved. The "static" approach to this is to simply weight each vote by the expected value of equal accuracy rate, A _EER = 1-EER.

수식: 17

Formula: 17

The corresponding "dynamic" weighting method is to weight each vote by the differential speaker probability calculated by the classifier.

수식: 18

Formula: 18

가 다소 미완성이라도, 여기서의 이점은 가중치가 실제 음운 관측들에 의존한다는 것이다.Probability estimation

Although somewhat incomplete, the advantage here is that the weight depends on actual phonological observations.

Expert Grouping

Phonemes can be divided into different groups, for example, nasal, rubbing, rupturing, vowel, etc. For example, intuitively, two experts who specialize in two nonphonic phonologies will correlate in the voting domain, while two experts who each specialize in different phonologies, eg, nonphonic and rubbing phonology, Will represent less. Thus, it is reasonable to divide the experts into groups representing different phonological classes. Thus, the speaker identification score, D _{C; L} , can be calculated for each phonological group (C),

수식: 19

Formula: 19

Here, #C represents the number of phonemes of group C. Equation 19 defines a new set of experts. The global identification decision can be made by combining votes from group experts, not from "phonological" experts as before. In principle, this decision method can be extended to include several layers of experts, where the experts of the lowest layer represent different individual phonologies, and the higher levels of experts represent broader sound classes (noise, vowels, friction sounds). Etc.).

Modeling of Expert Votes

An attractive way to combine N expert votes is to train the network (RBF or MLP) to empirically learn the best combining method (Wolpert 1992). This method allows both the accuracy of individual experts and the correlation between different expert votes to be considered directly. Following this approach, everything that occurs up to the point where expert votes should be combined is considered essentially feature extraction, where the feature vectors are decision vectors.

수식: 20

Formula: 20

However, there are two problems with this approach.

The first problem is that a "super" network that combines local expert votes cannot be trained on decision vectors that are simply generated by evaluating local experts for the data they are trained on. Tend to become, and their-training data votes-are too "optimistic." Thus, additional training data must be provided, or the super network must be speaker independent.

A second problem is that local expert votes represent different phonologies, and the voice make of different test vocals can vary widely, which trains a network that optimally combines voting resulting from specific test vocals. Makes things impossible

Given a limited number of training utterances, of course, it is possible to simulate even more decision vectors by combining relevant expert decisions extracted from different training utterances. However, there are still many phonological combinations that can occur. For example, assuming any given utterance, exactly 15 different phonologies may appear out of the 30 possible ones. therefore,

Up to three different voting combinations may have to be considered. This calculation ignores the fact that the votes may be based on one or more phonological observations—and thus more reliable—and in fact the number of different phonologies may be more or less than fifteen.

A possible solution to this dilemma is to create a superspeaker for a particular speech, i.e. until it decides which text will occur immediately, or, more conveniently, until a phonetic segmentation is calculated for the actual speech speech. Put off training. The super classifier in this case may be a simple perceptron, so training is not a serious computational problem. 2 shows an example of this.

Alternatively, the Fischer linear discriminant function can be used to learn individual expert weights-to avoid repeated perceptron training algorithms.

In summary, this example examines how local speaker probabilities can be estimated from individual phonetic observations (which are essentially objects that can be combined to produce global speaker verification decisions). Successful collusion schemes should take into account that certain phonologies may have more information than the rest of the phonologies, while on the other hand, different phonologies may provide some more noticeable information about the speaker. do.

The main difficulty in deciding how to weight local decisions is that the total number of different phonological combinations that can occur in the test utterance—unless the following texts given to the speakers—are very limited. Therefore, these weights cannot be easily calculated in advance.

[FIG. 2] Super Classifier

The classifier takes as input the differential speaker probabilities from the individual phonological models and combines them into a global score.

Claims (160)

A secure network connectivity system between one or more users and one or more network servers, (I) one memory for storing data, (ii) one input-output device for inputting and outputting data, and (iii) for processing data stored in the memory, sent to one user One or more intelligent data carriers having one processor, capable of connecting to a host computer device to transmit data on the network via the input-output device, and for establishing a network identity for a user through authentication and encryption schemes; And And a dynamic datagram switch for dynamic allocation and swapping of datagrams for multiple applications serviced to one or more users. The method of claim 1, And the intelligent data carrier is mobile. The method of claim 1, Wherein the intelligent data carrier is implemented as one of a USB key, compact flash, smart media, compact disc, DVD, PDA, Firewire device, and token device. The method of claim 1, The authentication and encryption method is: (a) forwarding a request from the intelligent data carrier to a network server where the intelligent data carrier is authenticated; (b) the network server providing a plurality of authentication methods to the intelligent data carrier; (c) the intelligent data carrier selecting one of the plurality of authentication methods through an event; (d) based on the selected method, the network server sending a request for authentication data from the intelligent data carrier to the intelligent data carrier; (e) the network server converting the authentication data received from the intelligent data carrier into one or more data authentication objects, each of the data authentication objects being a data vector object that can be analyzed using one or more classifiers, Converting; (f) according to the one or more classifiers, the network server analyzing the data authentication object to determine an authentication result; And (g) the network server sending the result to the intelligent data carrier to indicate a successful or failed authentication attempt. The method of claim 4, wherein The event in step (c) comprises one or more of mouse clicks, touch on the screen, keystrokes, speech, and biometric measurements. The method of claim 4, wherein The request in step (d) comprises at least one of a pseudo random and a true random code, The pseudo random code is generated based on a mathematically precomputed list, and the pure random code is generated by sampling and processing a source of entropy outside of the system. The method of claim 6, Wherein the randomization is performed with one or more random generators and one or more independent seeds. The method of claim 4, wherein The analysis of step (f) is performed based on one or more analysis rules. The method of claim 4, wherein The one or more analysis rules comprise a classification according to one or more classifiers of step (e). The method of claim 9, The classification comprises speaker verification, the data object vector comprises two classes, namely target speaker and impersonator, each of the classes is characterized by a probability density function, and the determination of step (f) is 2 Secure network connectivity system that is a verdict problem. The method of claim 4, wherein The determining of step (f) includes calculating one or more of sum, advantage, and probability from the one or more data vector objects based on the one or more classifiers of step (e). Connectivity system. The method of claim 12, The sum is one of the highest sum and the random sum calculated from the one or more data vector objects. The method of claim 4, wherein And the at least one classifier of step (e) comprises a super classifier derived from at least two of the data vector objects. The method of claim 13, The super classifier is based on physical biometrics, including one or more of voice recognition, fingerprint, handprint, blood type, DNA test, retinal or iris scan, and facial recognition. The method of claim 13, The super classifier is based on behavioral biometrics that include habits or patterns of personal behavior. The method of claim 1, The authentication and encryption scheme includes symmetric and asymmetric multi-password encryption. The method of claim 16, And the encryption uses one or more of output feedback, cipher feedback, cipher forwarding, and cipher block chain. The method of claim 17, The encryption is based on Next Generation Encryption Standard (AES) Rijndael. The method of claim 1, The authentication and encryption scheme implements secure key exchange (SKE). The method of claim 19, And the SKE uses a public key system. The method of claim 19, And the SKE uses an elliptic curve cryptosystem (ECC) private key. The method of claim 1, The authentication and encryption scheme is based on a logical test to verify that the intelligent data carrier has been registered with the server, a device test to verify physical parameters at the intelligent data carrier and the host computer device, and event level data. And at least one of a personal test to authenticate the user. The method of claim 1, The plurality of applications include at least one of a window-based remote terminal server application, an application on a 3270/5250 terminal emulator for a mainframe, a directly embedded application, and a multimedia application, The directly embedded application includes at least one of a database application, a data analysis tool, a customer relationship management (CRM) tool, and an enterprise resource planning (ERP) package. The method of claim 1, The dynamic datagram switch includes a datagram schema and a parser, the datagram schema includes two or more datagrams belonging to one or more datagram types, The datagram carries (i) content data for network transmission and (ii) further information for managing and controlling network connections and for supporting network applications, each of the datagram types comprising a plurality of functions. And the parser is configured to parse one or more of the datagram types. The method of claim 24, The datagram schema includes one or more major datagram types and one or more minor datagram types within the one primary datagram type. The method of claim 25, The parser is configured to parse a matrix of datagram types, Wherein the matrix comprises a first plurality of primary datagram types and a second plurality of secondary datagram types in each of the first plurality of primary datagram types. The method of claim 26, The main datagram type is (i) server messages and access control datagrams for authenticating and controlling user connections; (ii) content datagrams for transmitting content data; and (iii) point-to-point, point-to-multipoint and multipoint-to-multipoint data. Broadcast datagrams for managing transmission, (iv) connection proxy datagrams for transferring proxy data between the network server and the intelligent data carrier, (v) instant message types for transmitting messages in real time, (vi A group comprising large content delivery datagrams for delivering very large data and media files, (vii) user directory datagrams for navigating network users, and (viii) remote management datagrams for remote control of network users. Secure network connectivity system selected from. The method of claim 27, The server message and access control datagram may include a sub datagram type: (i) an authentication request datagram for initiating an authentication request, (ii) an authentication response datagram for sending a response in the authentication request, and (iii) And at least one of an authentication result datagram for transmitting the result of the authentication session. The method of claim 28, The content datagram may be a secondary datagram type: (i) a regular content datagram for transmitting the content data, (ii) a remote logging datagram for communicating with the network server and establishing a login session, and (iii) And at least one of a remote data set datagram for transmitting data from the remote connection. The method of claim 29, The content datagram may be a sub datagram type: (iv) a content approval request datagram for requesting verification of transmitted content data, and (v) a content approval response datagram for responding to a request for verification of transmitted content data. Further comprising at least one of the. The method of claim 27, The access proxy datagram may be a sub datagram type: (i) proxy data from the intelligent data carrier to a server for transferring proxy data to the network server, and (ii) the network server to the intelligent data carrier. Secure network connectivity system comprising one or more of proxy data from a server for forwarding proxy data. The method of claim 27, The instant message type includes at least one of a secondary datagram type: (i) file transmission type, (ii) audio-video transmission type, (iii) instant mail message type, and (iv) remote data set type. Secure network connectivity system. The method of claim 24, Each datagram in the datagram schema is: (A) (i) one or more primary datagram types, (ii) one or more secondary datagram types, (iii) datagram length, and (iv) header fields for datagram checksums, and (B) A secure network connectivity system having a general layout that includes a datagram payload that carries data in the transmission. The method of claim 33, wherein And the general layout includes one or more additional header fields. The method of claim 33, wherein The general layout follows the TCP header. The method of claim 1, The intelligent data carrier further comprises a radar connector, And the radar connector is configured to interface with the network and to monitor and control the network connection. The method of claim 36, The network server further comprises a radar connector configured to monitor and control network connectivity, the radar connector of the network server being connected to a radar connector of the intelligent data carrier via a network. The method of claim 37, The radar connector is further configured to detect a failed connection and initiate a contact to a network server to reestablish the connection. The method of claim 1, An injector configured to connect an existing network to the network server and to transmit data between the existing network and the intelligent data carrier via the network server, And the existing network is wired or wireless. The method of claim 39, The injector further comprises a radar connector that interfaces with the network and is configured to monitor and control the network connection. At least one server having a dynamic datagram switch for dynamic allocation and swapping datagrams for multiple network applications; And With one or more clients, The client, At least (i) one memory for storing data, (ii) one input-output device for inputting and outputting data, and (iii) one processor for processing data stored in the memory; Is an intelligent data carrier, The intelligent data carrier can connect with a host computer device to transmit data on the network via the input-output device and establish a network user identity through an authentication and encryption scheme for secure data transmission between the server and the client. And a client-server communication system. 42. The method of claim 41 wherein And said intelligent data carrier is mobile. The method of claim 42, The intelligent data carrier is implemented as one of a USB key, compact flash, smart media, compact disc, DVD, PDA, Firewire device, and token device. 42. The method of claim 41 wherein The dynamic datagram switch includes a datagram schema and a parser, the datagram schema comprising two or more datagrams belonging to one or more datagram types, wherein the datagram comprises (i) content data for network transmission and (ii) is configured to carry further information for managing and controlling network connections and supporting network applications, each of the datagram types comprising a plurality of functions, and wherein the parser is configured to parse one or more of the datagram types , Client-server communication system. The method of claim 44, Wherein the datagram schema includes one or more primary datagram types and one or more secondary datagram types within the one primary datagram type. The method of claim 45, The parser is configured to parse a matrix of datagram types, the matrix including a first plurality of primary datagram types and a second plurality of secondary datagram types within each of the first plurality of primary datagram types; Client-server communication system. The method of claim 46, Each of the datagrams in the datagram schema is: (A) (i) one or more primary datagram types, (ii) one or more secondary datagram types, (iii) datagram length, and (iv) header fields for datagram checksums, and (B) A client-server communication system having a general layout that includes a datagram payload that carries data in a transmission. 42. The method of claim 41 wherein The authentication and encryption method is: (a) forwarding a request from the intelligent data carrier to the server where the client is authenticated; (b) the network server providing a plurality of authentication methods to the intelligent data carrier; (c) the intelligent data carrier selecting one of the plurality of authentication methods through an event; (d) based on the selected method, the server sending a request for authentication data from the intelligent data carrier to the intelligent data carrier; (e) the server converting the authentication data received from the intelligent data carrier into one or more data authentication objects, each of the data authentication objects being a data vector object that can be analyzed using one or more classifiers. Converting; (f) according to the one or more classifiers, the server analyzing the data authentication object to determine an authentication result; And (g) the server sending the result to the intelligent data carrier to indicate a successful or failed authentication attempt. 49. The method of claim 48 wherein The event in step (c) comprises one or more of a mouse click, a touch on the screen, a keystroke, a voice, and a biometric measurement result. The method of claim 49, The request in step (d) comprises at least one of a pseudo random and a pure random code, The pseudo random code is generated based on a mathematically precomputed list, and the pure random code is generated by sampling and processing a source of entropy outside of the system. 51. The method of claim 50, Wherein the randomization is performed with one or more random generators and one or more independent seeds. 49. The method of claim 48 wherein The analysis of step (f) is performed based on one or more analysis rules. The method of claim 49, The one or more analysis rules comprise a classification according to one or more classifiers of step (e). The method of claim 53 wherein The classification comprises speaker verification, the data object vector comprises two classes, namely target speaker and impersonator, each of the classes is characterized by a probability density function, and the determination of step (f) is 2 Client-server communication system that is a true decision problem. 49. The method of claim 48 wherein Determining of step (f) comprises calculating one or more of sum, advantage, and probability from the one or more data vector objects based on one or more classifiers of step (e). Server communication system. The method of claim 56, wherein The sum is one of a highest sum and a random sum calculated from the one or more data vector objects. 49. The method of claim 48 wherein And the at least one classifier of step (e) comprises a super classifier derived from at least two of said data vector objects. The method of claim 57, The super classifier is based on physical biometrics including one or more of voice recognition, fingerprint, handprint, blood type, DNA test, retinal or iris scan, and face recognition. The method of claim 57, The super classifier is based on behavioral biometrics that include habits or patterns of personal behavior. 42. The method of claim 41 wherein The authentication and encryption scheme includes symmetric and asymmetric multi-password encryption. 42. The method of claim 41 wherein And the encryption uses one or more of output feedback, cryptographic feedback, cryptographic forwarding, and cryptographic blockchain. 62. The method of claim 61, And the encryption is based on the Next Generation Encryption Standard (AES) Fendhalel. 42. The method of claim 41 wherein The authentication and encryption scheme implements secure key exchange (SKE). The method of claim 63, wherein And the SKE uses a public key system. The method of claim 63, wherein And the SKE uses an elliptic curve cryptosystem (ECC) private key. 66. The method of claim 65, The authentication and encryption scheme is based on a logical test to verify that the intelligent data carrier has been registered with the server, a device test to verify physical parameters at the intelligent data carrier and the host computer device, and event level data. At least one of a personal test for authenticating a user. 42. The method of claim 41 wherein An injector configured to connect an existing network to the server and to transmit data between the existing network and the client through the server, The existing network is wired or wireless. The method of claim 67 wherein The server, client and injector each have a radar connector, The radar connector is configured to interface with the network and to monitor and control a network connection, the radar connector of the client is connected to the radar connector of the server via the network, and the radar connector of the injector is connected to the radar connector of the server via the network. Connected to the client-server communication system. The method of claim 68, wherein The client's radar connector is further configured to detect a failed connection and initiate a contact to the server to reestablish the connection. 42. The method of claim 41 wherein The server further comprises an encrypted virtual file system for storing dedicated data for the client. Intelligent with at least (i) one memory for storing data, (ii) one input-output device for inputting and outputting data, and (iii) one processor for processing data stored in the memory As a data carrier, The intelligent data carrier can connect to a host computer device on a network and transmit data on the network via the input-output device, The data transmission is via a dynamic switching datagram, The intelligent data carrier is configured to establish a network user identity through an authentication and encryption scheme for secure network data transmission. The method of claim 71 wherein The authentication and encryption method is: (a) forwarding a request from the intelligent data carrier to a network server to which the intelligent data carrier is authenticated; (b) the server providing a plurality of authentication methods to the intelligent data carrier; (c) the intelligent data carrier selecting one of the plurality of authentication methods through an event; (d) based on the selected method, the server sending a request for authentication data from the intelligent data carrier to the intelligent data carrier; (e) the network server converting the authentication data received from the intelligent data carrier into one or more data authentication objects, each of the data authentication objects being a data vector object that can be analyzed using one or more classifiers, Converting; (f) according to the one or more classifiers, the server analyzing the data authentication object to determine an authentication result; And (g) the server sending the result to the intelligent data carrier to indicate a successful or failed authentication attempt. The method of claim 72, The event in step (c) comprises one or more of mouse clicks, touch on the screen, keystrokes, speech, and biometric measurements. The method of claim 72, The request in step (d) comprises at least one of a pseudo random and a pure random code, Wherein the pseudo random code is generated based on a mathematically precomputed list, wherein the pure random code is generated by sampling and processing a source of entropy outside of the system. The method of claim 74, wherein The randomization is performed with one or more random generators and one or more independent seeds. The method of claim 72, The analysis of step (f) is performed based on one or more analysis rules. 77. The method of claim 76, The one or more analysis rules comprise a classification according to one or more classifiers of step (e). 78. The method of claim 77 wherein The classification comprises speaker verification, the data object vector comprises two classes, namely target speaker and impersonator, each of the classes is characterized by a probability density function, and the determination of step (f) is 2 Intelligent data carrier, a true verdict problem. The method of claim 72, The determining of step (f) comprises calculating one or more of sum, advantage, and probability from the one or more data vector objects based on the one or more classifiers of step (e). carrier. 80. The method of claim 79 wherein The sum is one of a highest sum and a random sum calculated from the one or more data vector objects. The method of claim 72, And the at least one classifier of step (e) comprises a super classifier derived from at least two of the data vector objects. 82. The method of claim 81 wherein The super classifier is based on physical biometrics including one or more of voice recognition, fingerprint, handprint, blood type, DNA test, retinal or iris scan, and face recognition. 82. The method of claim 81 wherein The super classifier is based on behavioral biometrics that include habits or patterns of personal behavior. The method of claim 71 wherein The authentication and encryption scheme includes symmetric and asymmetric multi-password encryption. 87. The method of claim 84, The encryption uses one or more of output feedback, cipher feedback, cipher forwarding, and cipher blockchain. 86. The method of claim 85, The encryption is based on the Next Generation Encryption Standard (AES) Fendael, intelligent data carrier. The method of claim 71 wherein The authentication and encryption scheme implements secure key exchange (SKE). 88. The method of claim 87, The SKE utilizes a public key system. 88. The method of claim 87, The SKE uses an elliptic curve cryptosystem (ECC) private key. The method of claim 71 wherein The authentication and encryption scheme is based on a logical test to verify that the intelligent data carrier has been registered with the server, a device test to verify physical parameters at the intelligent data carrier and the host computer device, and event level data. And at least one of a personal test to authenticate a user. The method of claim 71 wherein The intelligent data carrier is mobile. 92. The method of claim 91 wherein The intelligent data carrier is implemented as one of a USB key, compact flash, smart media, compact disc, DVD, PDA, Firewire device and token device. The method of claim 71 wherein The dynamic switching datagram belongs to one or more datagram types and is configured to carry (i) content data for network transmission and (ii) manage and control network connections and further information to support network applications, Each of the datagram types comprises a plurality of functions. 94. The method of claim 93, The datagram type comprises one or more primary datagram types and one or more secondary datagram types within the primary datagram type. 95. The method of claim 94, The datagram matches the general layout, The general layout is: (A) one or more primary datagram types, (ii) one or more secondary datagram types, (iii) datagram lengths, and (iv) header fields for datagram checksums, and (B) An intelligent data carrier comprising a datagram payload that carries data in a transmission. Transmitting an intelligent data carrier to a network user, the intelligent data carrier comprising: (i) one memory for storing data, (ii) one input-output device for inputting and outputting data, and ( iii) a processor for processing data stored in the memory, and can connect with a host computer device on a network to transfer data over the network via the input-output device, and authenticate the network user through an authentication and encryption scheme. Transmitting, configured to establish a network identity for the; And Providing a dynamic datagram switch to a server on the network for dynamic allocation and swapping of datagrams in support of multiple applications. 97. The method of claim 96, And the intelligent data carrier is mobile. 97. The method of claim 97, Wherein the intelligent data carrier is implemented as one of a USB key, a compact flash, smart media, a compact disc, a DVD, a PDA, a FireWire device, and a token device. 97. The method of claim 96, The dynamic datagram switch includes a datagram schema and a parser, the datagram schema includes two or more datagrams belonging to one or more datagram types, and the datagram includes (i) content data for network transmission and ( ii) manage and control network connections and carry further information for supporting network applications, wherein the datagram type includes a plurality of functions and the parser is configured to parse one or more of the datagram types Method for network communication. The method of claim 99, wherein And the datagram schema comprises one or more primary datagram types, and one or more secondary datagram types within the primary datagram type. 101. The method of claim 100, The parser is configured to parse a matrix of datagram types, the matrix including a first plurality of primary datagram types and a second plurality of secondary datagram types within each of the first plurality of primary datagram types. , Method for secure network communication. The method of claim 99, wherein Each of the datagrams in the datagram schema is: (A) (i) one or more primary datagram types, (ii) one or more secondary datagram types, (iii) datagram length, and (iv) header fields for datagram checksums, and (B) A method for secure network communication, having a generic layout comprising a datagram payload that carries data in a transmission. 97. The method of claim 96, The authentication and encryption method is: (a) forwarding a request from the intelligent data carrier to the server where the intelligent data carrier is authenticated; (b) the server providing a plurality of authentication methods to the intelligent data carrier; (c) the intelligent data carrier selecting one of the plurality of authentication methods through an event; (d) based on the selected method, the server sending a request for authentication data from the intelligent data carrier to the intelligent data carrier; (e) the network server converting the authentication data received from the intelligent data carrier into one or more data authentication objects, each of the data authentication objects being a data vector object that can be analyzed using one or more classifiers, Converting; (f) according to the one or more classifiers, the server analyzing the data authentication object to determine an authentication result; And (g) the server sending the result to the intelligent data carrier to indicate a successful or failed authentication attempt. 103. The method of claim 103, The event in step (c) comprises one or more of a mouse click, a touch on the screen, a keystroke, a voice, and a biometric measurement result. 103. The method of claim 103, The request in step (d) comprises at least one of a pseudo random and a pure random code, Wherein the pseudo random code is generated based on a mathematically precomputed list, wherein the pure random code is generated by sampling and processing a source of entropy outside of the system. 105. The method of claim 104, Wherein the randomization is performed with one or more random generators and one or more independent seeds. 103. The method of claim 103, The analysis of step (f) is performed based on one or more analysis rules. 108. The method of claim 107 wherein Wherein the one or more analysis rules comprise a classification according to one or more classifiers of step (e). 109. The method of claim 108, The classification comprises speaker verification, the data object vector comprises two classes, namely target speaker and impersonator, each of the classes is characterized by a probability density function, and the determination of step (f) is 2 A method for secure network communication, which is a true decision problem. 103. The method of claim 103, The determining of step (f) includes calculating one or more of sum, advantage, and probability from the one or more data vector objects based on the one or more classifiers of step (e). Method for communication. 113. The method of claim 110, Wherein the sum is one of a highest sum and a random sum calculated from the one or more data vector objects. 103. The method of claim 103, And the at least one classifier of step (e) comprises a super classifier derived from at least two of said data vector objects. 112. The method of claim 112, Wherein the super classifier is based on physical biometrics including one or more of voice recognition, fingerprint, handprint, blood type, DNA test, retinal or iris scan, and facial recognition. 112. The method of claim 112, And the super classifier is based on behavioral biometrics that includes habits or patterns of personal behavior. 97. The method of claim 96, Wherein the authentication and encryption scheme comprises symmetrical and asymmetrical multi-password encryption. 116. The method of claim 115, And the encryption uses one or more of output feedback, cryptographic feedback, cryptographic forwarding, and cryptographic blockchain. 117. The method of claim 116 wherein And wherein the encryption is based on the Next Generation Encryption Standard (AES) Fendael. 97. The method of claim 96, Wherein the authentication and encryption scheme implements secure key exchange (SKE). 119. The method of claim 118 wherein And the SKE uses a public key system. 119. The method of claim 118 wherein And the SKE uses an elliptic curve cryptosystem (ECC) private key. 97. The method of claim 96, The authentication and encryption scheme is based on a logical test to verify that the intelligent data carrier has been registered with the server, a device test to verify physical parameters at the intelligent data carrier and the host computer device, and event level data. At least one of a personal test for authenticating a user. 97. The method of claim 96, Providing a first radar connector to the intelligent data carrier, and providing a second radar connector to the server, And the first radar connector is configured to be connected to the second radar connector via a network, and the first and second radar connector are configured to monitor and control a network connection. 123. The method of claim 122 wherein And the first radar connector is further configured to detect a connection failure and initiate a contact to the second radar connector to reestablish a connection. 97. The method of claim 96, Providing an encrypted virtual file system for storing dedicated data for a client in the server. 97. The method of claim 96, And wherein the dynamic datagram switch performs datagram allocation and swapping in real time. 97. The method of claim 96, And wherein the dynamic datagram switch performs datagram allocation and swapping based on memory pointers of two or more datagrams. A method for delivering one or more applications to a user as a goal. Transmitting an intelligent data carrier to a user, wherein the network server is arranged and configured to dock over a network and onto a host computer device connected to the network in communication with the network server, the network server via the dynamic switching datagram. In communication with an intelligent data carrier, wherein the intelligent data carrier comprises at least (i) one memory for storing data, (ii) one input-output device for inputting and outputting data, and (iii) the memory The transmitting step comprising a processor for processing stored data; Authenticating, by the server, a user through an authentication and encryption scheme; And Authorizing user access to the one or more applications upon successful authentication. 127. The method of claim 127, wherein Wherein the one or more applications are preloaded on the intelligent data carrier or installed on the network server or host computer device. 131. The method of claim 128, And said host computer device is connected to a network via wireless or wired means. 131. The method of claim 128, The host computer device includes at least one of a desktop or laptop computer, a personal digital assistant (PDA), a mobile phone, a digital TV, an audio or video player, a computer game console, a digital camera, a camera phone, and a network capable home appliance. How the application delivers its goals. 131. The method of claim 130, The network capable home appliance is one of a network capable refrigerator, microwave oven, washing machine, dryer and dishwasher. 127. The method of claim 127, wherein The one or more applications include at least one of a Windows-based remote terminal server application, an application on a 3270/5250 terminal emulator for the mainframe, directly embedded applications and multimedia applications, The directly embedded application includes at least one of a database application, a data analysis tool, a customer relationship management (CRM) tool, and an enterprise resource planning (ERP) package. 127. The method of claim 127, wherein The intelligent data carrier is mobile. 127. The method of claim 127, wherein The intelligent data carrier is implemented as one of a USB key, compact flash, smart media, compact disc, DVD, PDA, Firewire device, and token device. 127. The method of claim 127, wherein The dynamic switching datagram belongs to one or more datagram types and is configured to carry (i) content data for network transmission and (ii) manage and control network connections and further information to support network applications, And the datagram type comprises a plurality of functions. 136. The method of claim 135, wherein Wherein the datagram type comprises one or more primary datagram types, and one or more secondary datagram types within the primary datagram type. 136. The method of claim 136, The datagram is: (A) (i) one or more primary datagram types, (ii) one or more secondary datagram types, (iii) datagram length, and (iv) header fields for datagram checksums, and (B) The target delivery method of the application, which corresponds to the general layout including the datagram payload carrying data in the transmission. 127. The method of claim 127, wherein The authentication and encryption method is: (a) forwarding a request from the intelligent data carrier to the server where the intelligent data carrier is authenticated; (b) the server providing a plurality of authentication methods to the intelligent data carrier; (c) the intelligent data carrier selecting one of the plurality of authentication methods through an event; (d) based on the selected method, the server sending a request for authentication data from the intelligent data carrier to the intelligent data carrier; (e) the network server converting the authentication data received from the intelligent data carrier into one or more data authentication objects, each of the data authentication objects being a data vector object that can be analyzed using one or more classifiers, Converting; (f) according to the one or more classifiers, the server analyzing the data authentication object to determine an authentication result; And (g) the server sending the result to the intelligent data carrier to indicate a successful or failed authentication attempt. 138. The method of claim 138 wherein The event in step (c) comprises one or more of a mouse click, a touch on the screen, a keystroke, a voice, and a biometric measurement result. 138. The method of claim 138 wherein The request in step (d) comprises at least one of a pseudo random and a pure random code, The pseudo random code is generated based on a mathematically precomputed list, and the pure random code is generated by sampling and processing a source of entropy outside of the system. 141. The method of claim 140, Wherein the randomization is performed with one or more random generators and one or more independent seeds. 138. The method of claim 138 wherein Wherein the analysis of step (f) is performed based on one or more analysis rules. 143. The method of claim 142 wherein Wherein said at least one analysis rule comprises a classification according to at least one classifier of step (e). 143. The method of claim 143, wherein The classification comprises speaker verification, the data object vector comprises two classes, namely target speaker and impersonator, each of the classes is characterized by a probability density function, and the determination of step (f) is 2 The application's goal delivery method, which is a true decision problem. 138. The method of claim 138 wherein Determining the step (f) includes calculating one or more of sum, advantage, and probability from the one or more data vector objects based on the one or more classifiers of step (e). Goal delivery method. 145. The method of claim 145, And the sum is one of a highest sum and a random sum calculated from the one or more data vector objects. 138. The method of claim 138 wherein At least one classifier of step (e) comprises a super classifier derived from at least two of said data vector objects. The method of claim 147, wherein The super classifier is based on physical biometrics, including one or more of voice recognition, fingerprint, handprint, blood type, DNA test, retinal or iris scan, and facial recognition. The method of claim 147, wherein The super classifier is based on behavioral biometrics that include habits or patterns of personal behavior. 127. The method of claim 127, wherein The authentication and encryption scheme includes symmetric and asymmetric multi-password encryption. 161. The method of claim 150, And said encryption uses one or more of output feedback, cryptographic feedback, cryptographic forwarding, and cryptographic blockchain. 151. The method of claim 151, And said encryption is based on the Next Generation Encryption Standard (AES) Fendael. 127. The method of claim 127, wherein The authentication and encryption scheme implements secure key exchange (SKE). The method of claim 153, wherein And said SKE utilizes a public key system. The method of claim 153, wherein The SKE uses an elliptic curve cryptosystem (ECC) private key. 127. The method of claim 127, wherein The authentication and encryption scheme is based on a logical test to verify that the intelligent data carrier has been registered with the server, a device test to verify physical parameters at the intelligent data carrier and the host computer device, and event level data. And at least one of a personal test to authenticate the user. 127. The method of claim 127, wherein Providing a first radar connector to the intelligent data carrier, and providing a second radar connector in the server; Wherein the first radar connector is configured to be connected to the second radar connector via a network, and the first and second radar connectors are configured to monitor and control a network connection. 158. The method of claim 157, And the first radar connector is further configured to detect a connection failure and initiate a contact to the second radar connector to reestablish the connection. 127. The method of claim 127, wherein Providing an encrypted virtual file system for storing dedicated data for the intelligent data carrier in the server. 127. The method of claim 127, wherein And the datagram is dynamically switched based on a memory pointer.

Images