1460896936-aa3cb116-4437-4030-b8f5-3a72d34626bb

1. A system for controlling access to electronic resources, the system comprising:
a first computer system for processing requests for system resources, the first computer system comprising:
a network interface for receiving digital certificates from other systems and for receiving requests to access electronic resources;
a memory for storing electronic resources and one or more certificates relating thereto; and
a trust management engine for processing digital certificates and requests for electronic resources, and for making access control decisions by performing least fixpoint computations using said digital certificates.
2. A system as in claim 1, further comprising:
a second computer system for making a request for system resources from the first computer system;
a third computer system for generating a first digital certificate, the first digital certificate authorizing, at least in part, the second computer system to access a predefined system resource;
3. A system as in claim 2, further comprising:
a fourth computer system, the fourth computer system being operable to generate a second digital certificate, the second digital certificate authorizing, at least in part, the third computer system to authorize, at least in part, the user of the second computer system to access the predefined system resource.
4. A system as in claim 3, in which the third computer system is operable to send the first digital certificate to the second computer system, the second computer system is operable to send the first digital certificate to the first computer system in connection with said request, and the fourth computer system is operable to send the second digital certificate to the first computer system.
5. A system as in claim 4, in which the first computer system further comprises a public key associated with the fourth computer system, the public key corresponding to a private key used to sign the second digital certificate.
6. A system as in claim 1, in which at least some of the digital certificates comprise SPKI certificates.
7. A system as in claim 1, in which at least some of the digital certificates comprise Keynote certificates.
8. A method for performing trust management computations, the method including:
collecting a group of certificates, each certificate including at least one authorization;
expressing authorizations using a structure that satisfies certain predefined properties;
expressing each certificate as a function, wherein each function possesses one or more properties sufficient to ensure that a set of authorizations will have a fixpoint;
computing a fixpoint of the authorizations, or an approximation thereof;
making a trust management decision using the result of said computing step.
9. A method as in 8, in which the structure comprises a lattice.
10. A method as in claim 8, in which the structure is chosen such that it provides an ordering for authorizations, a way to combine authorizations, and a way to express certificates as monotone functions.
11. A method as in claim 9, in which the one or more properties sufficient to ensure that a set of authorizations will have a fixpoint includes the property that each function is monotone.
12. A system for controlling access to electronic content or processing resources, the system comprising:
means for receiving a request from a requesting principal to access a piece of electronic content or a processing resource;
means for collecting a set of one or more certificates relating to the request, the requesting principal, or the electronic content or processing resource;
means for identifying a root principal from whom authorization is needed in order to grant the request;
means for performing at least a portion of a least fixpoint computation over said certificates to determine whether the root principal has authorized access to the piece of electronic content or processing resource by the requesting principal; and
means for granting access to the electronic content or processing resource if the least fixpoint computation indicates that the root principal has authorized said access.

The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.

1. A semiconductor imaging device having a plurality of pixels arranged in a matrix-like pattern, each of said pixels comprising:
a first photoelectric conversion unit, a second photoelectric conversion unit, a third photoelectric conversion unit and a fourth photoelectric conversion unit for converting received light into signal charge;
a signal voltage conversion unit for converting said signal charge into voltage;
a first transistor for controlling said signal charge to be transferred from said first photoelectric conversion unit, said second photoelectric conversion unit, said third photoelectric conversion unit and said fourth photoelectric conversion unit to said signal voltage conversion unit;
a signal voltage read-out unit having:
a second transistor for regulating voltage of said signal voltage conversion unit into a second reset voltage,
a third transistor for outputting signal voltage according to said voltage of said signal voltage conversion unit, and
a fourth transistor for selecting a row to which said pixel belongs;

a first wiring layer having a transfer wiring connected to the gate electrode of said first transistor, a reset wiring connected to the gate electrode of said second transistor, and a selection wiring connected to the gate electrode of said fourth transistor, each of which extending along the row direction; and
a second wiring layer formed on the top surface of said first wiring layer comprising: a first reset voltage wiring electrically connected to the drain electrode of said third transistor to provide a first reset voltage; a connection wiring connected to the gate electrode of said third transistor as well as to said signal voltage conversion unit; and a signal wiring electrically connected to the source electrode of said fourth transistor, respectively disposed in alignment in this order, each of which extending in alignment along the column direction,
wherein
said first photoelectric conversion unit, said second photoelectric conversion unit, said third photoelectric conversion unit and said fourth photoelectric conversion unit aligned along the column direction share said signal voltage reading unit, with the elements disposed in the order of: said first photoelectric conversion unit, said signal voltage conversion unit and two of said first transistors, said second photoelectric conversion unit, said third transistor and said fourth transistor, said third photoelectric conversion unit, said signal voltage conversion unit and two of said first transistors, said fourth photoelectric conversion unit and said second transistor,
the clearance between said first reset voltage wiring and said connection wiring is larger than the clearance between said connection wiring and said signal wiring in said second wiring layer,
said connection wiring is partially overlapping as seen from the top view with said second photoelectric conversion unit, said third photoelectric conversion unit and said fourth photoelectric conversion unit, as well as with said transfer wirings, whereas said connection wiring is not overlapping as seen from the top view with said first photoelectric conversion unit, and
said signal wiring has a protrusion toward said photoelectric conversion unit so as to be partially overlapping with said first photoelectric conversion unit as seen from the top view.
2. The semiconductor imaging device according to claim 1, wherein
said first wiring layer further comprises a second reset voltage wiring which is connected to the drain electrode of said second transistor extending along the row direction to provide a second reset voltage, and
said second reset voltage is larger than said first reset voltage, with said first reset voltage wiring and said second reset voltage wiring being disconnected.
3. The semiconductor imaging device according to claim 1, wherein
said first wiring layer further comprises a second reset voltage wiring which is connected to the drain electrode of said second transistor extending along the row direction to provide a second reset voltage, and
said first reset voltage wiring and said second reset voltage wiring are connected.
4. A semiconductor imaging device having a plurality of pixels arranged in a matrix-like pattern, each of said pixels comprising:
a first photoelectric conversion unit, a second photoelectric conversion unit, a third photoelectric conversion unit and a fourth photoelectric conversion unit for converting received light into signal charge;
a signal voltage conversion unit for converting said signal charge into voltage;
a first transistor for controlling said signal charge to be transferred from said first photoelectric conversion unit, said second photoelectric conversion unit, said third photoelectric conversion unit and said fourth photoelectric conversion unit to said signal voltage conversion unit;
a signal voltage read-out unit having:
a second transistor for regulating voltage of said signal voltage conversion unit into a second reset voltage,
a third transistor for outputting signal voltage according to said voltage of said signal voltage conversion unit, and
a fourth transistor for selecting a row to which said pixel belongs;