WO2020068182A1 - Systems and methods for computer security - Google Patents
Systems and methods for computer security Download PDFInfo
- Publication number
- WO2020068182A1 WO2020068182A1 PCT/US2019/034039 US2019034039W WO2020068182A1 WO 2020068182 A1 WO2020068182 A1 WO 2020068182A1 US 2019034039 W US2019034039 W US 2019034039W WO 2020068182 A1 WO2020068182 A1 WO 2020068182A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- program
- sources
- privileged
- computing system
- disallowing
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 62
- 230000004048 modification Effects 0.000 claims description 10
- 238000012986 modification Methods 0.000 claims description 10
- 238000004891 communication Methods 0.000 claims description 7
- 230000008520 organization Effects 0.000 claims description 3
- 238000009434 installation Methods 0.000 claims 1
- 230000008569 process Effects 0.000 abstract description 28
- 238000013515 script Methods 0.000 abstract description 6
- 230000007246 mechanism Effects 0.000 abstract description 2
- 238000010586 diagram Methods 0.000 description 12
- 230000006870 function Effects 0.000 description 7
- 239000008186 active pharmaceutical agent Substances 0.000 description 6
- FFBHFFJDDLITSX-UHFFFAOYSA-N benzyl N-[2-hydroxy-4-(3-oxomorpholin-4-yl)phenyl]carbamate Chemical compound OC1=C(NC(=O)OCC2=CC=CC=C2)C=CC(=C1)N1CCOCC1=O FFBHFFJDDLITSX-UHFFFAOYSA-N 0.000 description 6
- 230000005540 biological transmission Effects 0.000 description 2
- 230000000977 initiatory effect Effects 0.000 description 2
- 244000035744 Hura crepitans Species 0.000 description 1
- 241000700605 Viruses Species 0.000 description 1
- 230000002730 additional effect Effects 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 238000004590 computer program Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- ZXQYGBMAQZUVMI-GCMPRSNUSA-N gamma-cyhalothrin Chemical compound CC1(C)[C@@H](\C=C(/Cl)C(F)(F)F)[C@H]1C(=O)O[C@H](C#N)C1=CC=CC(OC=2C=CC=CC=2)=C1 ZXQYGBMAQZUVMI-GCMPRSNUSA-N 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 230000000644 propagated effect Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 230000001360 synchronised effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
- G06F21/12—Protecting executable software
- G06F21/121—Restricting unauthorised execution of programs
- G06F21/128—Restricting unauthorised execution of programs involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/577—Assessing vulnerabilities and evaluating computer system security
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6281—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database at program execution time, where the protection is within the operating system
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45587—Isolation or security of virtual machine instances
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45591—Monitoring or debugging support
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45595—Network integration; Enabling network access in virtual machine instances
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45504—Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators
Definitions
- the present disclosure relates to methods, techniques, and systems for computer security, and more particularly suppressing, controlling, or restricting execution of malicious software.
- hackers and other malicious parties are increasingly attempting to penetrate computing systems operated by home users, corporations, or governments.
- hackers attempt to install and run malicious software on a target computing system.
- the malicious software e.g., viruses, Trojan horses, worms, etc.
- the malicious software can be used by the hackerto damage, control, gain access, or otherwise compromise the computing system.
- Figures 1 A-1 G are flow diagrams that illustrate processes performed by example embodiments.
- Figure 2 is a block diagram of an example computing system or device for implementing a computer security module according to an example embodiment.
- Embodiments described herein provide enhanced computer- and network-based methods, devices, and systems for computer security, and more particularly suppressing, controlling, or restricting execution of malicious software.
- Some embodiments provide a computer security module (“CSM”) that is configured to control (e.g., suppress, restrict, monitor) the execution of malicious software on a computing system.
- CSM computer security module
- the core function of the CSM is to determine whether or not to allow a program (e.g., native executable, script, etc.) to execute. This decision is based at least in part on the source of the program, specifically whether the program is provided by one of a set of privileged (or“safe”) source.
- a privileged program source may be any module, mechanism, or process that can provide executable instructions, such as directory or folder (e.g., on a local disk or network-accessible store), a computing device (e.g., server computer), another program (e.g. , a Web server), or the like.
- a privileged source is a privileged folder or directory.
- a privileged folder is a folder that has been identified as storing programs that are eligible to be executed on the computer system.
- the privileged set of folders may contain one or more of: operating system folders (e.g., /bin, /sbin, /system32, etc.); application folders (e.g., /Program Files, /usr/bin); startup or services folders; third-party app folders; folders for the organization (e.g., corporation) that owns or administers the computer to install their own authorized programs; or the like.
- a privileged source is a privileged computer or process.
- a privileged computer can be identified by one or more identifiers, such as a machine name, IP address, domain name, process name, process identifier, process/program signature (e.g., a hash of the program instructions), or the like.
- Privileged sources can be managed by way of a“white list” or similar data structure.
- the white list includes multiple identifiers of privileged sources.
- the identifiers may be or include directory names (system32), directory paths (e.g., /usr/bin), I P addresses, domain names, machine names, or the like.
- URLs may be used to identify privileged sources.
- a privileged source may be identified or determined based on other or additional properties. For example, some embodiments may consider a source privileged if communication with that source is occurring at a specified time of day (e.g.
- Some embodiments may generally base the determination of whether a source is privileged on whether there are one or more allowed or allowable properties of the communication with the source. Additional information regarding determining the allowability of network communication can be found in U.S. Patent No. 10,084,791 , entitled“Evaluating a Questionable Network Communication,” issued September 25, 2018, the content of which is incorporated herein by reference.
- the CSM may be implemented in various ways.
- the CSM may be implemented as code that exists in one or more locations within the operating system, including the loader, scheduler, memory manager, or the like.
- the loader may check the location of every program as it is loaded into memory. If the location is not in the set of privileged folders, the loader terminates the execution.
- the scheduler may check, before switching to a next program on the ready queue, whether the program was loaded from one of the privileged folders. If not, the scheduler terminates the program.
- the memory manager can check, when asked to create a new virtual address space (e.g., page tables, etc.), whether the requesting program was loaded from one of the privileged folders.
- Script interpreters may also be employed to control the execution of potentially malicious programs.
- script interpreters e.g., for shell scripts, VBScript, Perl, Python, etc.
- privileged folders be“locked down.”
- the privileged folders are write protected for ordinary users, so that only users having the proper administrative privileges can install programs in those folders.
- other measures may be taken to restrict the ability of malicious parties from installing programs, such as secure boot, locked BIOS, and the like.
- Figures 1A-1 G are flow diagrams of example security processes performed by example embodiments.
- the process may be implemented as computer instructions executing on a computing system.
- these instructions may reside in one or more portions of the operating system, including the loader, scheduler, memory manager, and the like.
- the instructions may also or instead be present in programs that execute“outside” of the operating system, such as shell command interpreters, scripting language interpreters, virtual machines (e.g., Java Virtual Machine, C# VM), orthe like.
- Figure 1 A is a flow diagram of example logicfor computer security. The illustrated logic in this and the following flow diagrams may be performed by, for example, the module 100 described with respect to Figure 2, below.
- Figure 1A illustrates a process 1A00 that includes the following block(s).
- Block 1 A01 includes receiving and storing indications of one or more privileged sources that are each designated as providing programs that are allowed to be executed on a computing system.
- a source may be a directory or folder on a local or remote file system.
- a source may also or instead be a computer (e.g., a server) that is identified by an IP address, domain name, machine name, URL, or the like.
- the process will read or access a“white list” of“safe” sources from a write protected document stored in the file system. In the white list, each source is designated as being a source of programs that are eligible for execution.
- Block 1A02 includes receiving an indication of a program.
- the indication of the program may be received before or during the initiating of the program, such as prior to or during the loading process.
- the indication of the program will include or can be used to determine the location of the program, specifically the identity of the directory from which the program is being loaded.
- the indication may be or include a URL, IP address, domain name, or other identifier of the remote source.
- Block 1A03 includes determining whether or not the program is provided by one of the one or more privileged sources.
- the program is looked up in the white list of privileged sources. This may be accomplished via a dictionary lookup, hash table, orthe like. This operation can include looking up the program name, remote program source (e.g., domain name, IP address), or the like.
- Block 1A04 includes disallowing execution of the program, when the program is not provided by any of the privileged sources. Disallowing execution of the program may accomplished in various ways, such as by terminating the loading process, raising an exception (so that the program will be terminated by the operating system), refusing to create a virtual memory space, the scheduler refusing to run or switch to the process, or the like.
- Figure 1 B is a flow diagram of example logic illustrating an extension of process
- Figure 1 B illustrates a process 1 B00 that includes the process 1A00, and which further includes the following block(s).
- Block 1 B01 includes when the indicated program is provided by a network- accessible source, determining whether the network-accessible source is one of the one or more privileged sources.
- a Web browser or other module that fetches the program from a remote source will check whether the remote source is identified in the white list. This can include checking if the IP address, domain name, machine name, or other identifier of the remote source is present in the white list.
- Block 1 B02 includes when the network-accessible source is not one of the one or more privileged sources, disallowing execution of the program. For example, if the source identifier is not present in the white list, then the Web browser or similar module will refuse to load or execute the program. Note that this approach may require the use of a Web browser that has been modified to perform these checks. Users are not able to execute arbitrary remote code because they cannot manually download and execute such code (because only code in designated directories can run), and because they are also not allowed to install an insecure Web browser in any of the designated privileged directories.
- Figure 1 C is a flow diagram of example logic illustrating an extension of process
- Figure 1 C illustrates a process 1 C00 that includes the process 1A00, and which further includes the following block(s).
- Block 1 C01 includes disallowing modification one or more directories that are identified by the one or more sources as providers of programs that are allowed to be executed by the computing system.
- the computing system For safe sources that are directories, operating systems permissions can be employed to restrict modification of such directories (e.g., by adding or removing programs) by non-privileged users.
- Figure 1 D is a flow diagram of example logic illustrating an extension of process
- Figure 1 D illustrates a process 1 D00 that includes the process 1A00, wherein the disallowing execution of the program includes the following block(s).
- Block 1 D01 includes terminating the program, suspending the program, and/or raising an exception.
- Figure 1 E is a flow diagram of example logic illustrating an extension of process
- Figure 1 E illustrates a process 1 E00 that includes the process 1A00, wherein the disallowing execution of the program includes the following block(s).
- Block 1 E01 includes executing the program in an alternative execution environment.
- the program may instead be allowed to execute, but will be placed within an alternative execution environment, such as a sandbox or isolated virtual machine.
- the program can be monitored to better understand the behavior and properties of potentially malicious code.
- Figure 1 F is a flow diagram of example logic illustrating an extension of process
- Figure 1 F illustrates a process 1 F00 that includes the process 1A00, and which further includes the following block(s).
- Block 1 F01 includes receiving the indications of the one or more sources from a file. Some embodiments store the list of privileged sources in a file that is write protected from non-administrative users.
- Block 1 F02 includes disallowing modification of the file by non-privileged users.
- Figure 1 G is a flow diagram of example logic for computer security.
- Figure 1 G illustrates a process 1 G00 that includes the following block(s).
- Block 1 G01 includes receiving and storing indications of one or more directories that are each designated as containing programs that are allowed to be executed on a computing system.
- the process will read a list of files from a write protected document stored in the file system.
- Block 1 G02 includes receiving an indication of a program.
- the indication of the program may be received before or during the initiating of the program, such as prior to or during the loading process.
- the indication of the program will include or can be used to determine the location of the program, specifically the identity of the directory from which the program is being loaded.
- Block 1 G03 includes determining whether or not the program is located within one of the one or more directories. The location of the program is looked up in the list of privileged folders. This may be accomplished via a dictionary lookup, hash table, or the like.
- Block 1 G04 includes disallowing execution of the program, when the program is not located within any of the one or more directories. Disallowing execution of the program may accomplished in various ways, such as by terminating the loading process, raising an exception (so that the program will be terminated by the operating system), refusing to create a virtual memory space, the scheduler refusing to run or switch to the process, or the like.
- Figure 2 is a block diagram of an example computing system or device for implementing a computer security module according to an example embodiment.
- Figure 2 shows a computing system 10 that executes a module 100 that implements at least some of the techniques described herein.
- computing system 10 comprises a computer memory
- memory (“memory”) 1 1 , a display 12, one or more Central Processing Units (“CPU”) 13, Input/Output devices 14 (e.g., keyboard, mouse, CRT or LCD display, and the like), other computer-readable media 15, and a network connection 16.
- the module 100 is shown residing in memory 1 1 . In other embodiments, some portion of the contents, some or all of the components of the module 100 may be stored on and/or transmitted over the other computer-readable media 15.
- the module 100 preferably executes on one or more CPUs 13 and performs the techniques described herein.
- code or programs 30 e.g., an administrative interface, a Web server, and the like
- data repositories such as data repository 20
- code or programs 30 also reside in the memory 1 1 , and preferably execute on one or more CPUs 13.
- one or more of the components in Figure 7 may not be present in any specific implementation. For example, some embodiments may not provide other computer readable media 15 or a display 12.
- the module 100 is shown executing in the memory 1 1 of the device 100. Also included in the memory 1 1 are a user interface manager41 and an application program interface (“API”) 42.
- the user interface manager 41 and the API 42 are drawn in dashed lines to indicate that in other embodiments, functions performed by one or more of these components may be performed externally to the module 100.
- the Ul manager41 provides a view and a controller that facilitate user interaction with the module 100 and its various components.
- the Ul manager41 may provide interactive access to the module 100, such that users or administrators can interact with the module 100.
- access to the functionality of the Ul manager 41 may be provided via a Web server, possibly executing as one of the other programs 30.
- a user operating a Web browser executing on the user computing system 60 can interact with the module 100 via the Ul manager 41.
- the API 42 provides programmatic access to one or more functions of the module 100.
- the API 42 may provide a programmatic interface to one or more functions of the module 100 that may be invoked by one of the other programs 30 or some other module.
- the API 42 facilitates the development of third- party software, such as user interfaces, plug-ins, adapters (e.g., for integrating functions of the module 100 into Web applications), and the like.
- the module 100 may interact using network connection 16 via a network 99 with other devices/systems including computing systems 60, 62, and 64.
- the network 99 may be any combination of media (e.g., twisted pair, coaxial, fiber optic, radio frequency), hardware (e.g., routers, switches, repeaters, transceivers), and protocols (e.g., TCP/IP, UDP, Ethernet, Wi-Fi, WiMAX) that facilitate communication between remotely situated humans and/or devices.
- media e.g., twisted pair, coaxial, fiber optic, radio frequency
- hardware e.g., routers, switches, repeaters, transceivers
- protocols e.g., TCP/IP, UDP, Ethernet, Wi-Fi, WiMAX
- one or more general purpose or special purpose computing systems/devices may be used to implement and/or execute the module 100.
- the techniques themselves or the operations (taken alone or in combination) required to implement the techniques are conventional or well known.
- the techniques are not conventional at least because they address and improve an existing technology, such as by improving the operation, integration, or efficiency of one or more computing systems.
- components/modules of the module 100 are implemented using software programming techniques.
- the module 100 may be implemented as a“native” executable running on the CPU 13, along with one or more static or dynamic libraries.
- the module 100 may be implemented as instructions processed by a virtual machine that executes as one of the other programs 30.
- the various components may be implemented using more monolithic programming techniques, for example, as an executable running on a single CPU computer system, or alternatively decomposed using a variety of structuring techniques, including but not limited to, multiprogramming, multithreading, client-server, or peer-to- peer, running on one or more computer systems each having one or more CPUs.
- Some embodiments may execute concurrently and asynchronously, and communicate using message passing, remote procedure call, or other distributed computing paradigms. Equivalent synchronous embodiments are also supported.
- other functions could be implemented and/or performed by each component/module, and in different orders, and by different components/modules, yet still achieve the described functions.
- programming interfaces to the data stored as part of the module 100 can be available by language-specific APIs; libraries for accessing files, databases, or other data repositories; through representational languages such as XML; or through Web servers, FTP servers, or other types of servers providing access to stored data.
- the data store 20 may be implemented as one or more database systems, file systems, or any other technique for storing such information, or any combination of the above, including implementations using distributed computing techniques.
- the components of the module 100 may be implemented or provided in other manners, such as at least partially in firmware and/or hardware, including, but not limited to one or more application-specific integrated circuits (“ASICs”), standard integrated circuits, controllers executing appropriate instructions, and including microcontrollers and/or embedded controllers, field-programmable gate arrays (“FPGAs”), complex programmable logic devices (“CPLDs”), and the like.
- ASICs application-specific integrated circuits
- FPGAs field-programmable gate arrays
- CPLDs complex programmable logic devices
- system components and/or data structures may also be stored as contents (e.g., as executable or other machine- readable software instructions or structured data) on a computer-readable medium (e.g., as a hard disk; a memory; a computer network or cellular wireless network or other data transmission medium; or a portable media article to be read by an appropriate drive or via an appropriate connection, such as a DVD orflash memory device) so as to enable or configure the computer-readable medium and/or one or more associated computing systems or devices to execute or otherwise use or provide the contents to perform at least some of the described techniques.
- a computer-readable medium e.g., as a hard disk; a memory; a computer network or cellular wireless network or other data transmission medium; or a portable media article to be read by an appropriate drive or via an appropriate connection, such as a DVD orflash memory device
- Some or all of the components and/or data structures may be stored on tangible, non-transitory storage mediums.
- system components and data structures may also be stored as data signals (e.g., by being encoded as part of a carrier wave or included as part of an analog or digital propagated signal) on a variety of computer-readable transmission mediums, which are then transmitted, including across wireless-based and wired/cable-based mediums, and may take a variety of forms (e.g., as part of a single or multiplexed analog signal, or as multiple discrete digital packets orframes).
- Such computer program products may also take other forms in other embodiments. Accordingly, embodiments of this disclosure may be practiced with other computer system configurations.
Landscapes
- Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Databases & Information Systems (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Multimedia (AREA)
- Technology Law (AREA)
- Computing Systems (AREA)
- Storage Device Security (AREA)
- Stored Programmes (AREA)
Abstract
Computer security techniques are described. One example determines whether to allow a program (e.g., native executable, script, etc.) to execute. This decision is based at least in part on the source of the program, such as whether the program is provided by a privileged source. A privileged program source may be any module, mechanism, or process that can provide executable instructions, such as directory or folder (e.g., on a local disk or network-accessible store), a computing device (e.g., server computer), another program (e.g., a Web server), or the like.
Description
SYSTEMS AND METHODS FOR COMPUTER SECURITY
CROSS-REFERENCE TO RELATED APPLICATIONS
[0001] This application claims priority from U.S. Patent Application No. 16/393,930, filed
April 24, 2019; which claims priority from U.S. Provisional Patent Application No. 62/739,094, filed September 28, 2018, the contents of which applications is incorporated herein by reference in its entirety.
TECHNICAL FIELD
[0002] The present disclosure relates to methods, techniques, and systems for computer security, and more particularly suppressing, controlling, or restricting execution of malicious software.
BACKGROUND
[0003] Hackers and other malicious parties are increasingly attempting to penetrate computing systems operated by home users, corporations, or governments. In many cases, hackers attempt to install and run malicious software on a target computing system. The malicious software (e.g., viruses, Trojan horses, worms, etc.) can be used by the hackerto damage, control, gain access, or otherwise compromise the computing system.
BRIEF DESCRIPTION OF THE DRAWINGS
[0004] Figures 1 A-1 G are flow diagrams that illustrate processes performed by example embodiments.
[0005] Figure 2 is a block diagram of an example computing system or device for implementing a computer security module according to an example embodiment.
DETAILED DESCRIPTION
[0006] Embodiments described herein provide enhanced computer- and network-based methods, devices, and systems for computer security, and more particularly suppressing, controlling, or restricting execution of malicious software. Some
embodiments provide a computer security module (“CSM”) that is configured to control (e.g., suppress, restrict, monitor) the execution of malicious software on a computing system.
[0007] The core function of the CSM is to determine whether or not to allow a program (e.g., native executable, script, etc.) to execute. This decision is based at least in part on the source of the program, specifically whether the program is provided by one of a set of privileged (or“safe”) source. A privileged program source may be any module, mechanism, or process that can provide executable instructions, such as directory or folder (e.g., on a local disk or network-accessible store), a computing device (e.g., server computer), another program (e.g. , a Web server), or the like.
[0008] In some cases, a privileged source is a privileged folder or directory. A privileged folder is a folder that has been identified as storing programs that are eligible to be executed on the computer system. The privileged set of folders may contain one or more of: operating system folders (e.g., /bin, /sbin, /system32, etc.); application folders (e.g., /Program Files, /usr/bin); startup or services folders; third-party app folders; folders for the organization (e.g., corporation) that owns or administers the computer to install their own authorized programs; or the like.
[0009] In some cases, a privileged source is a privileged computer or process. A privileged computer can be identified by one or more identifiers, such as a machine name, IP address, domain name, process name, process identifier, process/program signature (e.g., a hash of the program instructions), or the like.
[0010] Privileged sources can be managed by way of a“white list” or similar data structure. The white list includes multiple identifiers of privileged sources. The identifiers may be or include directory names (system32), directory paths (e.g., /usr/bin), I P addresses, domain names, machine names, or the like. In some cases, URLs may be used to identify privileged sources. A privileged source may be identified or determined based on other or additional properties. For example, some embodiments may consider a source privileged if communication with that source is occurring at a specified time of day (e.g. , within a time range), if the source is located in a specified geographic region, if the source address is associated with a particular organization (e.g., via a WHOIS lookup), or the like. Some embodiments may generally base the
determination of whether a source is privileged on whether there are one or more allowed or allowable properties of the communication with the source. Additional information regarding determining the allowability of network communication can be found in U.S. Patent No. 10,084,791 , entitled“Evaluating a Questionable Network Communication,” issued September 25, 2018, the content of which is incorporated herein by reference.
[001 1] The CSM may be implemented in various ways. The CSM may be implemented as code that exists in one or more locations within the operating system, including the loader, scheduler, memory manager, or the like. For example, the loader may check the location of every program as it is loaded into memory. If the location is not in the set of privileged folders, the loader terminates the execution. As another example, the scheduler may check, before switching to a next program on the ready queue, whether the program was loaded from one of the privileged folders. If not, the scheduler terminates the program. Similarly, the memory manager can check, when asked to create a new virtual address space (e.g., page tables, etc.), whether the requesting program was loaded from one of the privileged folders.
[0012] Script interpreters may also be employed to control the execution of potentially malicious programs. In some embodiments, script interpreters (e.g., for shell scripts, VBScript, Perl, Python, etc.) will refuse to execute/interpret a given script if it is not being loaded from one of the privileged folders.
[0013] The described techniques of course require that the privileged folders be“locked down.” In other words, the privileged folders are write protected for ordinary users, so that only users having the proper administrative privileges can install programs in those folders. In addition, other measures may be taken to restrict the ability of malicious parties from installing programs, such as secure boot, locked BIOS, and the like.
[0014] Figures 1A-1 G are flow diagrams of example security processes performed by example embodiments. The process may be implemented as computer instructions executing on a computing system. As noted above, these instructions may reside in one or more portions of the operating system, including the loader, scheduler, memory manager, and the like. The instructions may also or instead be present in programs that
execute“outside” of the operating system, such as shell command interpreters, scripting language interpreters, virtual machines (e.g., Java Virtual Machine, C# VM), orthe like.
[0015] Figure 1 A is a flow diagram of example logicfor computer security. The illustrated logic in this and the following flow diagrams may be performed by, for example, the module 100 described with respect to Figure 2, below. Figure 1A illustrates a process 1A00 that includes the following block(s).
[0016] Block 1 A01 includes receiving and storing indications of one or more privileged sources that are each designated as providing programs that are allowed to be executed on a computing system. A source may be a directory or folder on a local or remote file system. A source may also or instead be a computer (e.g., a server) that is identified by an IP address, domain name, machine name, URL, or the like. In some embodiments, the process will read or access a“white list” of“safe” sources from a write protected document stored in the file system. In the white list, each source is designated as being a source of programs that are eligible for execution.
[0017] Block 1A02 includes receiving an indication of a program. The indication of the program may be received before or during the initiating of the program, such as prior to or during the loading process. The indication of the program will include or can be used to determine the location of the program, specifically the identity of the directory from which the program is being loaded. In the case of programs obtained from remote sources (e.g., JavaScript code received by a Web browser), the indication may be or include a URL, IP address, domain name, or other identifier of the remote source.
[0018] Block 1A03 includes determining whether or not the program is provided by one of the one or more privileged sources. The program is looked up in the white list of privileged sources. This may be accomplished via a dictionary lookup, hash table, orthe like. This operation can include looking up the program name, remote program source (e.g., domain name, IP address), or the like.
[0019] Block 1A04 includes disallowing execution of the program, when the program is not provided by any of the privileged sources. Disallowing execution of the program may accomplished in various ways, such as by terminating the loading process, raising an exception (so that the program will be terminated by the operating system), refusing to
create a virtual memory space, the scheduler refusing to run or switch to the process, or the like.
[0020] Figure 1 B is a flow diagram of example logic illustrating an extension of process
1A00 of Figure 1A. Figure 1 B illustrates a process 1 B00 that includes the process 1A00, and which further includes the following block(s).
[0021] Block 1 B01 includes when the indicated program is provided by a network- accessible source, determining whether the network-accessible source is one of the one or more privileged sources. In typical embodiments, a Web browser or other module that fetches the program from a remote source will check whether the remote source is identified in the white list. This can include checking if the IP address, domain name, machine name, or other identifier of the remote source is present in the white list.
[0022] Block 1 B02 includes when the network-accessible source is not one of the one or more privileged sources, disallowing execution of the program. For example, if the source identifier is not present in the white list, then the Web browser or similar module will refuse to load or execute the program. Note that this approach may require the use of a Web browser that has been modified to perform these checks. Users are not able to execute arbitrary remote code because they cannot manually download and execute such code (because only code in designated directories can run), and because they are also not allowed to install an insecure Web browser in any of the designated privileged directories.
[0023] Figure 1 C is a flow diagram of example logic illustrating an extension of process
1A00 of Figure 1A. Figure 1 C illustrates a process 1 C00 that includes the process 1A00, and which further includes the following block(s).
[0024] Block 1 C01 includes disallowing modification one or more directories that are identified by the one or more sources as providers of programs that are allowed to be executed by the computing system. For safe sources that are directories, operating systems permissions can be employed to restrict modification of such directories (e.g., by adding or removing programs) by non-privileged users.
[0025] Figure 1 D is a flow diagram of example logic illustrating an extension of process
1A00 of Figure 1A. Figure 1 D illustrates a process 1 D00 that includes the process 1A00, wherein the disallowing execution of the program includes the following block(s).
[0026] Block 1 D01 includes terminating the program, suspending the program, and/or raising an exception.
[0027] Figure 1 E is a flow diagram of example logic illustrating an extension of process
1A00 of Figure 1A. Figure 1 E illustrates a process 1 E00 that includes the process 1A00, wherein the disallowing execution of the program includes the following block(s).
[0028] Block 1 E01 includes executing the program in an alternative execution environment. In some embodiments, the program may instead be allowed to execute, but will be placed within an alternative execution environment, such as a sandbox or isolated virtual machine. In such embodiments, the program can be monitored to better understand the behavior and properties of potentially malicious code.
[0029] Figure 1 F is a flow diagram of example logic illustrating an extension of process
1A00 of Figure 1A. Figure 1 F illustrates a process 1 F00 that includes the process 1A00, and which further includes the following block(s).
[0030] Block 1 F01 includes receiving the indications of the one or more sources from a file. Some embodiments store the list of privileged sources in a file that is write protected from non-administrative users.
[0031] Block 1 F02 includes disallowing modification of the file by non-privileged users.
Only administrative users may modify the file that identifies the privileged execution sources.
[0032] Figure 1 G is a flow diagram of example logic for computer security. Figure 1 G illustrates a process 1 G00 that includes the following block(s).
[0033] Block 1 G01 includes receiving and storing indications of one or more directories that are each designated as containing programs that are allowed to be executed on a computing system. In some embodiments, the process will read a list of files from a write protected document stored in the file system.
[0034] Block 1 G02 includes receiving an indication of a program. The indication of the program may be received before or during the initiating of the program, such as prior to or during the loading process. The indication of the program will include or can be used to determine the location of the program, specifically the identity of the directory from which the program is being loaded.
[0035] Block 1 G03 includes determining whether or not the program is located within one of the one or more directories. The location of the program is looked up in the list of privileged folders. This may be accomplished via a dictionary lookup, hash table, or the like.
[0036] Block 1 G04 includes disallowing execution of the program, when the program is not located within any of the one or more directories. Disallowing execution of the program may accomplished in various ways, such as by terminating the loading process, raising an exception (so that the program will be terminated by the operating system), refusing to create a virtual memory space, the scheduler refusing to run or switch to the process, or the like.
[0037]
[0038] Figure 2 is a block diagram of an example computing system or device for implementing a computer security module according to an example embodiment. In particular, Figure 2 shows a computing system 10 that executes a module 100 that implements at least some of the techniques described herein.
[0039] In the embodiment shown, computing system 10 comprises a computer memory
(“memory”) 1 1 , a display 12, one or more Central Processing Units (“CPU”) 13, Input/Output devices 14 (e.g., keyboard, mouse, CRT or LCD display, and the like), other computer-readable media 15, and a network connection 16. The module 100 is shown residing in memory 1 1 . In other embodiments, some portion of the contents, some or all of the components of the module 100 may be stored on and/or transmitted over the other computer-readable media 15. The module 100 preferably executes on one or more CPUs 13 and performs the techniques described herein. Other code or programs 30 (e.g., an administrative interface, a Web server, and the like) and potentially other data repositories, such as data repository 20, also reside in the memory 1 1 , and preferably execute on one or more CPUs 13. Of note, one or more of the components in Figure 7 may not be present in any specific implementation. For example, some embodiments may not provide other computer readable media 15 or a display 12.
[0040] The module 100 is shown executing in the memory 1 1 of the device 100. Also included in the memory 1 1 are a user interface manager41 and an application program
interface (“API”) 42. The user interface manager 41 and the API 42 are drawn in dashed lines to indicate that in other embodiments, functions performed by one or more of these components may be performed externally to the module 100.
[0041] The Ul manager41 provides a view and a controller that facilitate user interaction with the module 100 and its various components. For example, the Ul manager41 may provide interactive access to the module 100, such that users or administrators can interact with the module 100. In some embodiments, access to the functionality of the Ul manager 41 may be provided via a Web server, possibly executing as one of the other programs 30. In such embodiments, a user operating a Web browser executing on the user computing system 60 can interact with the module 100 via the Ul manager 41.
[0042] The API 42 provides programmatic access to one or more functions of the module 100. For example, the API 42 may provide a programmatic interface to one or more functions of the module 100 that may be invoked by one of the other programs 30 or some other module. In this manner, the API 42 facilitates the development of third- party software, such as user interfaces, plug-ins, adapters (e.g., for integrating functions of the module 100 into Web applications), and the like.
[0043] The module 100 may interact using network connection 16 via a network 99 with other devices/systems including computing systems 60, 62, and 64. The network 99 may be any combination of media (e.g., twisted pair, coaxial, fiber optic, radio frequency), hardware (e.g., routers, switches, repeaters, transceivers), and protocols (e.g., TCP/IP, UDP, Ethernet, Wi-Fi, WiMAX) that facilitate communication between remotely situated humans and/or devices.
[0044] Note that one or more general purpose or special purpose computing systems/devices may be used to implement and/or execute the module 100. However, just because it is possible to implement the module 100 on a general purpose computing system does not mean that the techniques themselves or the operations (taken alone or in combination) required to implement the techniques are conventional or well known. The techniques are not conventional at least because they address and improve an existing technology, such as by improving the operation, integration, or efficiency of one or more computing systems.
[0045] In an example embodiment, components/modules of the module 100 are implemented using software programming techniques. For example, the module 100 may be implemented as a“native” executable running on the CPU 13, along with one or more static or dynamic libraries. In other embodiments, the module 100 may be implemented as instructions processed by a virtual machine that executes as one of the other programs 30.
[0046] The various components may be implemented using more monolithic programming techniques, for example, as an executable running on a single CPU computer system, or alternatively decomposed using a variety of structuring techniques, including but not limited to, multiprogramming, multithreading, client-server, or peer-to- peer, running on one or more computer systems each having one or more CPUs. Some embodiments may execute concurrently and asynchronously, and communicate using message passing, remote procedure call, or other distributed computing paradigms. Equivalent synchronous embodiments are also supported. Also, other functions could be implemented and/or performed by each component/module, and in different orders, and by different components/modules, yet still achieve the described functions.
[0047] In addition, programming interfaces to the data stored as part of the module 100, such as in the data store 20, can be available by language-specific APIs; libraries for accessing files, databases, or other data repositories; through representational languages such as XML; or through Web servers, FTP servers, or other types of servers providing access to stored data. The data store 20 may be implemented as one or more database systems, file systems, or any other technique for storing such information, or any combination of the above, including implementations using distributed computing techniques.
[0048] Furthermore, in some embodiments, some or all of the components of the module 100 may be implemented or provided in other manners, such as at least partially in firmware and/or hardware, including, but not limited to one or more application-specific integrated circuits (“ASICs”), standard integrated circuits, controllers executing appropriate instructions, and including microcontrollers and/or embedded controllers, field-programmable gate arrays (“FPGAs”), complex programmable logic devices (“CPLDs”), and the like. Some or all of the system components and/or data
structures may also be stored as contents (e.g., as executable or other machine- readable software instructions or structured data) on a computer-readable medium (e.g., as a hard disk; a memory; a computer network or cellular wireless network or other data transmission medium; or a portable media article to be read by an appropriate drive or via an appropriate connection, such as a DVD orflash memory device) so as to enable or configure the computer-readable medium and/or one or more associated computing systems or devices to execute or otherwise use or provide the contents to perform at least some of the described techniques. Some or all of the components and/or data structures may be stored on tangible, non-transitory storage mediums. Some or all of the system components and data structures may also be stored as data signals (e.g., by being encoded as part of a carrier wave or included as part of an analog or digital propagated signal) on a variety of computer-readable transmission mediums, which are then transmitted, including across wireless-based and wired/cable-based mediums, and may take a variety of forms (e.g., as part of a single or multiplexed analog signal, or as multiple discrete digital packets orframes). Such computer program products may also take other forms in other embodiments. Accordingly, embodiments of this disclosure may be practiced with other computer system configurations.
[0049] While embodiments of the invention have been illustrated and described, as noted above, many changes can be made without departing from the spirit and scope of the invention. Accordingly, the scope of the invention is not limited by the above disclosure.
Claims
1. A method for computer security, the method comprising:
receiving and storing indications of one or more privileged sources that are each designated as providing programs that are allowed to be executed on a computing system;
receiving an indication of a program;
determining whether or not the program is provided by one of the one or more privileged sources; and
disallowing execution of the program, when the program is not provided by any of the privileged sources.
2. The method of claim 1 , further comprising:
when the indicated program is provided by a network-accessible source, determining whether the network-accessible source is one of the one or more privileged sources; and
when the network-accessible source is not one of the one or more privileged sources, disallowing execution of the program.
3. The method of claim 1 , further comprising: disallowing modification one or more directories that are identified by the one or more sources as providers of programs that are allowed to be executed by the computing system.
4. The method of claim 1 , wherein the disallowing execution of the program includes: terminating the program, suspending the program, and/or raising an exception.
5. The method of claim 1 , wherein the disallowing execution of the program includes: executing the program in an alternative execution environment.
6. The method of claim 1 , further comprising:
receiving the indications of the one or more sources from a file; and
disallowing modification of the file by non-privileged users.
7. The method of claim 1 , further comprising:
receiving the indication of the program in a Web browser, wherein the program is JavaScript code; and
determining whether the program is provided by a server that is one or more of the privileged sources.
8. The method of claim 1 , wherein the determining whether or not the program is provided by one of the one or more privileged sources includes looking up an identifier of the source in a white list.
9. The method of claim 1 , further comprising: disallowing installation of programs on the computing system.
10. The method of claim 1 , further comprising:
when the indicated program is provided by a network-accessible source, determining whether the network-accessible source is one of the one or more privileged sources;
when the network-accessible source is not one of the one or more privileged sources, disallowing execution of the program;
disallowing modification one or more directories that are identified by the one or more sources as providers of programs that are allowed to be executed by the computing system;
receiving the indications of the one or more sources from a file;
disallowing modification of the file by non-privileged users; and
executing the program in an alternative execution environment that is a virtual machine executed by the computing system
1 1. A non-transitory computer-readable medium including contents that are configured, when executed, to cause a computing system to perform a method for computer security, the method comprising:
receiving and storing indications of one or more privileged sources that are each designated as providing programs that are allowed to be executed on a computing system;
receiving an indication of a program;
determining whether or not the program is provided by one of the one or more privileged sources; and
disallowing execution of the program, when the program is not provided by any of the privileged sources.
12. The computer-readable medium of claim 1 1 , wherein the method further comprises:
when the indicated program is provided by a network-accessible source, determining whether the network-accessible source is one of the one or more privileged sources;
when the network-accessible source is not one of the one or more privileged sources, disallowing execution of the program;
disallowing modification one or more directories that are identified by the one or more sources as providers of programs that are allowed to be executed by the computing system;
receiving the indications of the one or more sources from a file; and
disallowing modification of the file by non-privileged users.
13. The computer-readable medium of claim 1 1 , wherein the disallowing execution of the program includes: terminating the program, suspending the program, and/or raising an exception.
14. The computer-readable medium of claim 1 1 , wherein the disallowing execution of the program includes: executing the program in an alternative execution environment that is a virtual machine executed by the computing system.
15. A computing system for computer security, the computing system comprising: a processor;
a memory;
a module that is stored in the memory and that is configured, when executed by the processor, to perform a method comprising:
receiving and storing indications of one or more privileged sources that are each designated as providing programs that are allowed to be executed on a computing system;
receiving an indication of a program;
determining whether or not the program is provided by one of the one or more privileged sources; and
disallowing execution of the program, when the program is not provided by any of the privileged sources.
16. The computing system of claim 15, further comprising a virtual machine executing on the computing system, and wherein the method further comprises: when the indicated program is provided by a network-accessible source, determining whether the network-accessible source is one of the one or more privileged sources;
when the network-accessible source is not one of the one or more privileged sources, disallowing execution of the program; and
disallowing modification one or more directories that are identified by the one or more sources as providers of programs that are allowed to be executed by the computing system;
disallowing execution of the program includes by executing the program in an alternative execution environment that is the virtual machine.
17. The computing system of claim 15, further comprising a Web browser that is configured to:
receive the indication of the program in a Web browser, wherein the program is JavaScript code; and
determine whether the program is provided by a server that is one or more of the privileged sources.
18. The computing system of claim 17, wherein the Web browser is configured to determine whether or not the program is provided by one of the one or more privileged sources by looking up an identifier of the source in a white list.
19. The computing system of claim 18, wherein the Web browser is further configured to determine whether or not the program is provided by one of the one or more privileged sources based on one or more properties associated with a communication with the source, including one or more of a geographic location of the source, a time of communication, and an organization associated with the source.
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2021515633A JP7248219B2 (en) | 2018-09-28 | 2019-05-24 | System and method for computer security |
EP19867056.4A EP3857416A4 (en) | 2018-09-28 | 2019-05-24 | Systems and methods for computer security |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201862739094P | 2018-09-28 | 2018-09-28 | |
US62/739,094 | 2018-09-28 | ||
US16/393,930 US11188622B2 (en) | 2018-09-28 | 2019-04-24 | Systems and methods for computer security |
US16/393,930 | 2019-04-24 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2020068182A1 true WO2020068182A1 (en) | 2020-04-02 |
Family
ID=69947591
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2019/034039 WO2020068182A1 (en) | 2018-09-28 | 2019-05-24 | Systems and methods for computer security |
Country Status (4)
Country | Link |
---|---|
US (1) | US11188622B2 (en) |
EP (1) | EP3857416A4 (en) |
JP (1) | JP7248219B2 (en) |
WO (1) | WO2020068182A1 (en) |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20060230452A1 (en) * | 2004-10-29 | 2006-10-12 | Microsoft Corporation | Tagging obtained content for white and black listing |
US20070050377A1 (en) * | 2005-08-29 | 2007-03-01 | Manish Srivastava | Method or apparatus for locking shared data |
US20130287208A1 (en) | 2012-04-30 | 2013-10-31 | General Electric Company | Systems and methods for controlling file execution for industrial control systems |
WO2016178816A1 (en) | 2015-05-01 | 2016-11-10 | Lookout, Inc. | Determining source of side-loaded software |
US9648032B2 (en) | 2015-09-30 | 2017-05-09 | AO Kaspersky Lab | System and method for blocking execution of scripts |
WO2017112641A1 (en) * | 2015-12-23 | 2017-06-29 | ThinAir Labs, Inc. | Dynamic management of protected file access |
Family Cites Families (162)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6167520A (en) * | 1996-11-08 | 2000-12-26 | Finjan Software, Inc. | System and method for protecting a client during runtime from hostile downloadables |
US6016553A (en) | 1997-09-05 | 2000-01-18 | Wild File, Inc. | Method, software and apparatus for saving, using and recovering data |
US6185678B1 (en) | 1997-10-02 | 2001-02-06 | Trustees Of The University Of Pennsylvania | Secure and reliable bootstrap architecture |
US6502135B1 (en) | 1998-10-30 | 2002-12-31 | Science Applications International Corporation | Agile network protocol for secure communications with assured system availability |
US6898636B1 (en) | 1999-02-04 | 2005-05-24 | Intralinks, Inc. | Methods and systems for interchanging documents between a sender computer, a server and a receiver computer |
US6687226B1 (en) | 1999-04-01 | 2004-02-03 | Telefonaktiebolaget Lm Ericsson (Publ) | Base station subsystem and method for handling an increase in traffic volume that overloads a terrestrial link in an internet protocol network |
US6888834B1 (en) | 1999-09-10 | 2005-05-03 | Keyon Communications Llc | System and method for providing wireless internet services |
US6654796B1 (en) | 1999-10-07 | 2003-11-25 | Cisco Technology, Inc. | System for managing cluster of network switches using IP address for commander switch and redirecting a managing request via forwarding an HTTP connection to an expansion switch |
US20020049883A1 (en) | 1999-11-29 | 2002-04-25 | Eric Schneider | System and method for restoring a computer system after a failure |
US7013482B1 (en) | 2000-07-07 | 2006-03-14 | 802 Systems Llc | Methods for packet filtering including packet invalidation if packet validity determination not timely made |
US7111163B1 (en) | 2000-07-10 | 2006-09-19 | Alterwan, Inc. | Wide area network using internet with quality of service |
US7089592B2 (en) | 2001-03-15 | 2006-08-08 | Brighterion, Inc. | Systems and methods for dynamic detection and prevention of electronic fraud |
US20020188704A1 (en) | 2001-06-12 | 2002-12-12 | Stephen Gold | Upgrade of licensed capacity on computer entity |
US7310821B2 (en) | 2001-08-27 | 2007-12-18 | Dphi Acquisitions, Inc. | Host certification method and system |
US7672903B2 (en) | 2001-08-27 | 2010-03-02 | Dphi Acquisitions, Inc. | Revocation method and apparatus for secure content |
US20030084349A1 (en) | 2001-10-12 | 2003-05-01 | Oliver Friedrichs | Early warning system for network attacks |
US7142651B2 (en) | 2001-11-29 | 2006-11-28 | Ectel Ltd. | Fraud detection in a distributed telecommunications networks |
DE60139883D1 (en) | 2001-11-29 | 2009-10-22 | Stonesoft Oy | Custom firewall |
US7174566B2 (en) | 2002-02-01 | 2007-02-06 | Intel Corporation | Integrated network intrusion detection |
US20030149887A1 (en) | 2002-02-01 | 2003-08-07 | Satyendra Yadav | Application-specific network intrusion detection |
US20030188190A1 (en) | 2002-03-26 | 2003-10-02 | Aaron Jeffrey A. | System and method of intrusion detection employing broad-scope monitoring |
WO2003090052A2 (en) | 2002-04-18 | 2003-10-30 | Advanced Micro Devices Inc. | A computer system including a secure execution mode - capable cpu and a security services processor connected via a secure communication path |
US7778606B2 (en) | 2002-05-17 | 2010-08-17 | Network Security Technologies, Inc. | Method and system for wireless intrusion detection |
US7965842B2 (en) | 2002-06-28 | 2011-06-21 | Wavelink Corporation | System and method for detecting unauthorized wireless access points |
US7315890B2 (en) | 2002-10-02 | 2008-01-01 | Lockheed Martin Corporation | System and method for managing access to active devices operably connected to a data network |
US7540028B2 (en) | 2002-10-25 | 2009-05-26 | Intel Corporation | Dynamic network security apparatus and methods or network processors |
US7346770B2 (en) | 2002-10-31 | 2008-03-18 | Microsoft Corporation | Method and apparatus for traversing a translation device with a security protocol |
US7461404B2 (en) | 2002-11-04 | 2008-12-02 | Mazu Networks, Inc. | Detection of unauthorized access in a network |
US7363656B2 (en) | 2002-11-04 | 2008-04-22 | Mazu Networks, Inc. | Event detection/anomaly correlation heuristics |
US7624110B2 (en) | 2002-12-13 | 2009-11-24 | Symantec Corporation | Method, system, and computer program product for security within a global computer network |
US20040123141A1 (en) | 2002-12-18 | 2004-06-24 | Satyendra Yadav | Multi-tier intrusion detection system |
WO2004075512A1 (en) | 2003-02-18 | 2004-09-02 | Nortel Networks Limited | Discovery of an application server in an ip network |
US20040162992A1 (en) | 2003-02-19 | 2004-08-19 | Sami Vikash Krishna | Internet privacy protection device |
JP4354201B2 (en) | 2003-03-18 | 2009-10-28 | 富士通株式会社 | Unauthorized access countermeasure system and unauthorized access countermeasure processing program |
US7653698B2 (en) | 2003-05-29 | 2010-01-26 | Sonicwall, Inc. | Identifying e-mail messages from allowed senders |
US7278156B2 (en) | 2003-06-04 | 2007-10-02 | International Business Machines Corporation | System and method for enforcing security service level agreements |
US7490237B1 (en) | 2003-06-27 | 2009-02-10 | Microsoft Corporation | Systems and methods for caching in authentication systems |
US7409202B2 (en) | 2003-08-12 | 2008-08-05 | Nextel Communications Inc. | Communications restrictions for mobile group communication devices |
US20050060566A1 (en) | 2003-09-16 | 2005-03-17 | Chebolu Anil Kumar | Online user-access reports with authorization features |
US7461257B2 (en) | 2003-09-22 | 2008-12-02 | Proofpoint, Inc. | System for detecting spoofed hyperlinks |
US7725936B2 (en) | 2003-10-31 | 2010-05-25 | International Business Machines Corporation | Host-based network intrusion detection systems |
US7222158B2 (en) | 2003-12-31 | 2007-05-22 | Aol Llc | Third party provided transactional white-listing for filtering electronic communications |
US20050172229A1 (en) * | 2004-01-29 | 2005-08-04 | Arcot Systems, Inc. | Browser user-interface security application |
US7536723B1 (en) | 2004-02-11 | 2009-05-19 | Airtight Networks, Inc. | Automated method and system for monitoring local area computer networks for unauthorized wireless access |
WO2005082101A2 (en) | 2004-02-26 | 2005-09-09 | Truefire, Inc. | Systems and methods for producing, managing, delivering, retrieving, and/or tracking permission based communications |
GB2412189B (en) | 2004-03-16 | 2007-04-04 | Netcraft Ltd | Security component for use with an internet browser application and method and apparatus associated therewith |
US7457823B2 (en) | 2004-05-02 | 2008-11-25 | Markmonitor Inc. | Methods and systems for analyzing data related to possible online fraud |
US7870200B2 (en) | 2004-05-29 | 2011-01-11 | Ironport Systems, Inc. | Monitoring the flow of messages received at a server |
US7606821B2 (en) | 2004-06-30 | 2009-10-20 | Ebay Inc. | Method and system for preventing fraudulent activities |
EP1779216A1 (en) | 2004-08-20 | 2007-05-02 | Rhoderick John Kennedy Pugh | Server authentication |
US7930413B2 (en) | 2004-09-03 | 2011-04-19 | Wizard Tower Techno Services Ltd. | System and method for controlling access to a network resource |
WO2006031684A2 (en) | 2004-09-13 | 2006-03-23 | Network Solutions, Llc | Domain bar |
GB0420548D0 (en) | 2004-09-15 | 2004-10-20 | Streamshield Networks Ltd | Network-based security platform |
US20060069782A1 (en) | 2004-09-16 | 2006-03-30 | Michael Manning | Method and apparatus for location-based white lists in a telecommunications network |
US8996603B2 (en) | 2004-09-16 | 2015-03-31 | Cisco Technology, Inc. | Method and apparatus for user domain based white lists |
US7502923B2 (en) | 2004-09-16 | 2009-03-10 | Nokia Corporation | Systems and methods for secured domain name system use based on pre-existing trust |
US7826602B1 (en) | 2004-10-22 | 2010-11-02 | Juniper Networks, Inc. | Enabling incoming VoIP calls behind a network firewall |
US20150213131A1 (en) | 2004-10-29 | 2015-07-30 | Go Daddy Operating Company, LLC | Domain name searching with reputation rating |
US20060123478A1 (en) | 2004-12-02 | 2006-06-08 | Microsoft Corporation | Phishing detection, prevention, and notification |
US7634810B2 (en) | 2004-12-02 | 2009-12-15 | Microsoft Corporation | Phishing detection, prevention, and notification |
US7519818B2 (en) | 2004-12-09 | 2009-04-14 | Microsoft Corporation | Method and system for processing a communication based on trust that the communication is not unwanted as assigned by a sending domain |
US20070022479A1 (en) | 2005-07-21 | 2007-01-25 | Somsubhra Sikdar | Network interface and firewall device |
US7602731B2 (en) | 2004-12-22 | 2009-10-13 | Intruguard Devices, Inc. | System and method for integrated header, state, rate and content anomaly prevention with policy enforcement |
US7626940B2 (en) | 2004-12-22 | 2009-12-01 | Intruguard Devices, Inc. | System and method for integrated header, state, rate and content anomaly prevention for domain name service |
US7979889B2 (en) | 2005-01-07 | 2011-07-12 | Cisco Technology, Inc. | Methods and apparatus providing security to computer systems and networks |
US20060230039A1 (en) | 2005-01-25 | 2006-10-12 | Markmonitor, Inc. | Online identity tracking |
US20060190993A1 (en) | 2005-02-08 | 2006-08-24 | Finisar Corporation | Intrusion detection in networks |
WO2006090392A2 (en) | 2005-02-24 | 2006-08-31 | Rsa Security Inc. | System and method for detecting and mitigating dns spoofing trojans |
EP1866789B8 (en) | 2005-02-28 | 2020-04-15 | McAfee, LLC | Mobile data security system and methods |
CA2600373A1 (en) | 2005-03-02 | 2006-09-08 | Mark Shull | Trust evaluation systems and methods |
US7548539B2 (en) | 2005-03-08 | 2009-06-16 | Audiocodes, Inc. | Method and apparatus for Voice-over-IP call recording |
JP2006277063A (en) * | 2005-03-28 | 2006-10-12 | Mitsubishi Electric Corp | Hacking defence device and hacking defence program |
US7725930B2 (en) | 2005-03-30 | 2010-05-25 | Microsoft Corporation | Validating the origin of web content |
US7681234B2 (en) | 2005-06-30 | 2010-03-16 | Microsoft Corporation | Preventing phishing attacks |
WO2007016641A2 (en) | 2005-08-02 | 2007-02-08 | Comhouse Wireless, Lp | Methods of remotely identifying, suppressing and/or disabling wireless devices of interest |
US9015090B2 (en) * | 2005-09-06 | 2015-04-21 | Daniel Chien | Evaluating a questionable network communication |
US8621604B2 (en) * | 2005-09-06 | 2013-12-31 | Daniel Chien | Evaluating a questionable network communication |
US9674145B2 (en) * | 2005-09-06 | 2017-06-06 | Daniel Chien | Evaluating a questionable network communication |
US9912677B2 (en) * | 2005-09-06 | 2018-03-06 | Daniel Chien | Evaluating a questionable network communication |
US20070083670A1 (en) | 2005-10-11 | 2007-04-12 | International Business Machines Corporation | Method and system for protecting an internet user from fraudulent ip addresses on a dns server |
US7832009B2 (en) | 2005-12-28 | 2010-11-09 | Foundry Networks, Llc | Techniques for preventing attacks on computer systems and networks |
US20070174429A1 (en) | 2006-01-24 | 2007-07-26 | Citrix Systems, Inc. | Methods and servers for establishing a connection between a client system and a virtual machine hosting a requested computing environment |
US7751339B2 (en) | 2006-05-19 | 2010-07-06 | Cisco Technology, Inc. | Method and apparatus for simply configuring a subscriber appliance for performing a service controlled by a separate service provider |
GB2442023B (en) | 2006-09-13 | 2011-03-02 | Advanced Risc Mach Ltd | Memory access security management |
CA2577030A1 (en) | 2007-01-31 | 2008-07-31 | Unlimi-Tech Software Inc. | Improved data transfer method, system and protocol |
US8505091B2 (en) | 2007-04-30 | 2013-08-06 | Hewlett-Packard Development Company, L.P. | Method of protecting against denial-of-service attacks |
JP4395178B2 (en) * | 2007-05-29 | 2010-01-06 | インターナショナル・ビジネス・マシーンズ・コーポレーション | Content processing system, method and program |
US8341723B2 (en) * | 2007-06-28 | 2012-12-25 | Microsoft Corporation | Filtering kernel-mode network communications |
US9900347B2 (en) | 2007-09-14 | 2018-02-20 | Telefonaktiebolaget Lm Ericsson (Publ) | Handling trust in an IP multimedia subsystem communication network |
US8855103B2 (en) | 2008-01-17 | 2014-10-07 | Blackberry Limited | Personal network access control system and method |
US8950007B1 (en) | 2008-04-07 | 2015-02-03 | Lumension Security, Inc. | Policy-based whitelisting with system change management based on trust framework |
US8893242B2 (en) | 2008-04-29 | 2014-11-18 | Ebay Inc. | System and method for pool-based identity generation and use for service access |
US8763082B2 (en) | 2008-05-13 | 2014-06-24 | At&T Mobility Ii Llc | Interactive client management of an access control list |
US8255994B2 (en) | 2008-08-20 | 2012-08-28 | Sprint Communications Company L.P. | Detection and suppression of short message service denial of service attacks |
US9781148B2 (en) * | 2008-10-21 | 2017-10-03 | Lookout, Inc. | Methods and systems for sharing risk responses between collections of mobile communications devices |
US9256728B2 (en) | 2008-11-26 | 2016-02-09 | Nokia Technologies Oy | Method, apparatus, and computer program product for managing software versions |
US9106426B2 (en) | 2008-11-26 | 2015-08-11 | Red Hat, Inc. | Username based authentication and key generation |
US8423631B1 (en) | 2009-02-13 | 2013-04-16 | Aerohive Networks, Inc. | Intelligent sorting for N-way secure split tunnel |
US8127124B2 (en) | 2009-03-19 | 2012-02-28 | Hewlett-Packard Development Company, L.P. | Remote configuration of computing platforms |
US8959353B2 (en) | 2009-03-31 | 2015-02-17 | Topaz Systems, Inc. | Distributed system for multi-function secure verifiable signer authentication |
US20100325424A1 (en) | 2009-06-19 | 2010-12-23 | Etchegoyen Craig S | System and Method for Secured Communications |
JP2011039716A (en) * | 2009-08-10 | 2011-02-24 | Hitachi Solutions Ltd | Information storage medium and information system |
US8161552B1 (en) | 2009-09-23 | 2012-04-17 | Trend Micro, Inc. | White list creation in behavior monitoring system |
US8813186B2 (en) | 2009-09-30 | 2014-08-19 | Amazon Technologies, Inc. | Modular device authentication framework |
US8751808B2 (en) | 2009-11-12 | 2014-06-10 | Roy Gelbard | Method and system for sharing trusted contact information |
US8752047B2 (en) * | 2010-05-28 | 2014-06-10 | Bromium, Inc. | Automated management of virtual machines to process untrusted data based on client policy information |
US8925101B2 (en) * | 2010-07-28 | 2014-12-30 | Mcafee, Inc. | System and method for local protection against malicious software |
US8326370B2 (en) | 2010-09-23 | 2012-12-04 | Research In Motion Limited | System and method for rotating a user interface for a mobile device |
US8869264B2 (en) | 2010-10-01 | 2014-10-21 | International Business Machines Corporation | Attesting a component of a system during a boot process |
US9058607B2 (en) | 2010-12-16 | 2015-06-16 | Verizon Patent And Licensing Inc. | Using network security information to detection transaction fraud |
US8863256B1 (en) * | 2011-01-14 | 2014-10-14 | Cisco Technology, Inc. | System and method for enabling secure transactions using flexible identity management in a vehicular environment |
US9047441B2 (en) * | 2011-05-24 | 2015-06-02 | Palo Alto Networks, Inc. | Malware analysis system |
US9015455B2 (en) | 2011-07-07 | 2015-04-21 | Intel Corporation | Processsor integral technologies for BIOS flash attack protection and notification |
US8990356B2 (en) | 2011-10-03 | 2015-03-24 | Verisign, Inc. | Adaptive name resolution |
US9971896B2 (en) * | 2011-12-30 | 2018-05-15 | International Business Machines Corporation | Targeted security testing |
US20140157355A1 (en) * | 2012-01-06 | 2014-06-05 | Optio Labs, LLC | Systems and methods for enhancing mobile device security with a processor trusted zone |
US9585012B2 (en) | 2012-05-14 | 2017-02-28 | Futurewei Technologies, Inc. | System and method for establishing a secure connection in communications systems |
US9497623B2 (en) | 2012-05-25 | 2016-11-15 | Nokia Technologies Oy | Method and apparatus for guest access sharing |
US20130346628A1 (en) | 2012-06-21 | 2013-12-26 | Rodney S. Canion | Dynamically assigned mac addresses for devices in a computing system |
US20130347111A1 (en) * | 2012-06-25 | 2013-12-26 | Zimperium | System and method for detection and prevention of host intrusions and malicious payloads |
US8874717B2 (en) | 2012-06-29 | 2014-10-28 | Microsoft Corporation | Techniques to discover services recursively in a distributed environment |
US8788839B1 (en) | 2012-10-10 | 2014-07-22 | Google Inc. | Securely replacing boot loaders |
CN103813330A (en) | 2012-11-15 | 2014-05-21 | 中兴通讯股份有限公司 | Communication terminal and system and authority management method |
US9374369B2 (en) | 2012-12-28 | 2016-06-21 | Lookout, Inc. | Multi-factor authentication and comprehensive login system for client-server networks |
EP2959378A1 (en) | 2013-02-22 | 2015-12-30 | Marvell World Trade Ltd. | Patching boot code of read-only memory |
US9892284B2 (en) | 2013-03-11 | 2018-02-13 | Lantiq Beteiligungs-GmbH & Co. KG | Trusted execution thread in an embedded multithreaded system |
US20140258465A1 (en) | 2013-03-11 | 2014-09-11 | Cisco Technology, Inc. | Identification of originating ip address and client port connection to a web server via a proxy server |
US20140313975A1 (en) | 2013-04-19 | 2014-10-23 | Cubic Corporation | White listing for binding in ad-hoc mesh networks |
US9838425B2 (en) | 2013-04-25 | 2017-12-05 | A10 Networks, Inc. | Systems and methods for network access control |
US9411978B2 (en) | 2013-07-11 | 2016-08-09 | Open Text S.A. | System and method for access control using network verification |
US9172721B2 (en) | 2013-07-16 | 2015-10-27 | Fortinet, Inc. | Scalable inline behavioral DDOS attack mitigation |
US9059989B2 (en) | 2013-07-18 | 2015-06-16 | Vmware, Inc. | Hash synchronization for preventing unauthorized server access using stolen passwords |
JP2016532381A (en) * | 2013-08-14 | 2016-10-13 | ダニエル チエン | Evaluation of suspicious network communication |
US10084791B2 (en) | 2013-08-14 | 2018-09-25 | Daniel Chien | Evaluating a questionable network communication |
US9311475B2 (en) * | 2013-08-30 | 2016-04-12 | Vmware, Inc. | Trusted execution of binaries and modules |
US9736131B2 (en) | 2013-09-24 | 2017-08-15 | Cellco Partnership | Secure login for subscriber devices |
US9154459B2 (en) | 2013-09-25 | 2015-10-06 | Malwarebytes Corporation | Access control manager |
CN103607714A (en) | 2013-11-18 | 2014-02-26 | 宽兆科技(深圳)有限公司 | Wireless router and rapid access control method and connection authenticating method of wireless router |
US9614869B2 (en) | 2013-11-23 | 2017-04-04 | Universidade da Coruña—OTRI | System and server for detecting web page changes |
US10104081B2 (en) * | 2013-12-19 | 2018-10-16 | Google Llc | Privileged static hosted web applications |
US9154460B1 (en) | 2014-02-12 | 2015-10-06 | Sonus Networks, Inc. | Methods and apparatus for denial of service resistant policing of packets |
CN104951316B (en) | 2014-03-25 | 2018-09-21 | 华为技术有限公司 | A kind of credible startup method and apparatus of kernel |
US9413783B1 (en) | 2014-06-02 | 2016-08-09 | Amazon Technologies, Inc. | Network interface with on-board packet processing |
US9693296B2 (en) | 2014-07-17 | 2017-06-27 | Xiaomi Inc. | Network connection method and apparatus |
US9654458B1 (en) | 2014-09-23 | 2017-05-16 | Amazon Technologies, Inc. | Unauthorized device detection in a heterogeneous network |
CN105635084B (en) | 2014-11-17 | 2018-12-14 | 华为技术有限公司 | Terminal authentication apparatus and method |
WO2016079620A1 (en) | 2014-11-18 | 2016-05-26 | Vanhawks Inc. | Network-enabled bicycles, bicycles interconnected into a mesh network, electronic devices for bicycles and related methods |
CN105682093A (en) | 2014-11-20 | 2016-06-15 | 中兴通讯股份有限公司 | Wireless network access method and access device, and client |
US20170364685A1 (en) | 2014-11-20 | 2017-12-21 | Interdigital Patent Holdings. Inc. | Providing security to computing systems |
US10122760B2 (en) | 2015-04-30 | 2018-11-06 | Drawbridge Networks, Inc. | Computer network security system |
US10015178B2 (en) | 2015-07-28 | 2018-07-03 | Sap Se | Real-time contextual monitoring intrusion detection and prevention |
US10135792B2 (en) | 2015-08-25 | 2018-11-20 | Anchorfree Inc. | Secure communications with internet-enabled devices |
US20170118210A1 (en) | 2015-10-23 | 2017-04-27 | Comcast Cable Communications, Llc | Method Of Using Wireless Communications To Make A Determination |
US9825911B1 (en) | 2015-11-18 | 2017-11-21 | Amazon Technologies, Inc. | Security policy check based on communication establishment handshake packet |
US10171463B1 (en) | 2015-12-21 | 2019-01-01 | Amazon Technologies, Inc. | Secure transport layer authentication of network traffic |
US10652748B2 (en) * | 2016-04-23 | 2020-05-12 | Metacert, Inc. | Method, system and application programmable interface within a mobile device for indicating a confidence level of the integrity of sources of information |
US20180020002A1 (en) | 2016-07-13 | 2018-01-18 | Frederick J Duca | System and method for filtering internet traffic and optimizing same |
KR101883156B1 (en) | 2016-08-10 | 2018-07-30 | 삼성에스디에스 주식회사 | System and method for authentication, user terminal, authentication server and service server for executing the same |
US10200410B2 (en) | 2016-09-30 | 2019-02-05 | Intel Corporation | Networked peer device round-robin security controller |
EP3840333A1 (en) | 2016-09-30 | 2021-06-23 | Palo Alto Networks, Inc. | Multifactor authentication as a network service |
US10594732B2 (en) | 2016-11-08 | 2020-03-17 | Ca, Inc. | Selective traffic blockage |
JP2018124893A (en) * | 2017-02-03 | 2018-08-09 | 株式会社日立ソリューションズ | Computer system and file access controlling method |
-
2019
- 2019-04-24 US US16/393,930 patent/US11188622B2/en active Active
- 2019-05-24 JP JP2021515633A patent/JP7248219B2/en active Active
- 2019-05-24 EP EP19867056.4A patent/EP3857416A4/en active Pending
- 2019-05-24 WO PCT/US2019/034039 patent/WO2020068182A1/en unknown
Patent Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20060230452A1 (en) * | 2004-10-29 | 2006-10-12 | Microsoft Corporation | Tagging obtained content for white and black listing |
US20070050377A1 (en) * | 2005-08-29 | 2007-03-01 | Manish Srivastava | Method or apparatus for locking shared data |
US20130287208A1 (en) | 2012-04-30 | 2013-10-31 | General Electric Company | Systems and methods for controlling file execution for industrial control systems |
WO2016178816A1 (en) | 2015-05-01 | 2016-11-10 | Lookout, Inc. | Determining source of side-loaded software |
US20180189478A1 (en) * | 2015-05-01 | 2018-07-05 | Lookout, Inc. | Determining source of side-loaded software using an administrator server |
US9648032B2 (en) | 2015-09-30 | 2017-05-09 | AO Kaspersky Lab | System and method for blocking execution of scripts |
WO2017112641A1 (en) * | 2015-12-23 | 2017-06-29 | ThinAir Labs, Inc. | Dynamic management of protected file access |
Non-Patent Citations (1)
Title |
---|
See also references of EP3857416A4 |
Also Published As
Publication number | Publication date |
---|---|
US11188622B2 (en) | 2021-11-30 |
EP3857416A4 (en) | 2022-06-08 |
JP7248219B2 (en) | 2023-03-29 |
JP2022501727A (en) | 2022-01-06 |
US20200104468A1 (en) | 2020-04-02 |
EP3857416A1 (en) | 2021-08-04 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP3430556B1 (en) | System and method for process hollowing detection | |
US10664592B2 (en) | Method and system to securely run applications using containers | |
US8844036B2 (en) | Method and system for application-based policy monitoring and enforcement on a mobile device | |
US7757291B2 (en) | Malware containment by application encapsulation | |
US8161563B2 (en) | Running internet applications with low rights | |
US9684785B2 (en) | Providing multiple isolated execution environments for securely accessing untrusted content | |
US8037290B1 (en) | Preboot security data update | |
US10102371B2 (en) | Computer device and method for isolating untrusted content on a clipboard | |
US10325116B2 (en) | Dynamic privilege management in a computer system | |
GB2519608A (en) | Computer device and method for isolating untrusted content | |
JP2005327239A (en) | Security-related programming interface | |
US20190347420A1 (en) | Method and system for installing and running untrusted applications | |
US10242182B2 (en) | Computer security system and method | |
US11677754B2 (en) | Access control systems and methods | |
US20230164115A1 (en) | Api-based ad blocking and traffic management | |
US11188622B2 (en) | Systems and methods for computer security | |
US20230198997A1 (en) | Access control systems and methods | |
RU2606883C2 (en) | System and method of opening files created by vulnerable applications | |
EP1722312A2 (en) | Malware containment by application encapsulation | |
Griffiths et al. | Fireguard-A secure browser with reduced forensic footprint | |
WO2024030887A1 (en) | Application launcher with integrated api-based ad blocking and traffic management |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 19867056 Country of ref document: EP Kind code of ref document: A1 |
|
ENP | Entry into the national phase |
Ref document number: 2021515633 Country of ref document: JP Kind code of ref document: A |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
ENP | Entry into the national phase |
Ref document number: 2019867056 Country of ref document: EP Effective date: 20210428 |