Crimson Corporation

Securitymetrics, Inc.

Intel Corporation

Landesk Software, Inc.

Alan B Butt

David Arthur Eatough

Gregory Paul Olsen

Paul Byron Hillyard

Bradley R Caldwell

Jin Su

Peter E Johnson

Richard R Winterton

Mark E Howarth

Nathan K Stocks

Plinio Pimentel

David Bradford Morley

Tony Sarra

Michael D Day, Ii

Anthony Nicholas Sarra

Stephen W Belisle

Monte Sharp

Methods for identifying potentially sensitive information and protecting such potentially sensitive information include scanning systems that collect and/or disseminate such information. Without limitation, systems collect and/or disseminate personal identification numbers (e.g., personal identification numbers, tax identification numbers, etc.), such as merchant systems, bank systems, healthcare systems, and the like, that collect, use, or disseminate sensitive information may be scanned to identify sequences of data that are likely to be sensitive, and may take actions to protect such sequences of data. Scanning and protection systems are also disclosed.

Identification of potentially sensitive information in data strings

A data string that includes potentially sensitive information, such as an account number for a payment card, may be evaluated to determine whether or not any portion of the data string encodes a known identifier of sensitive information, such as a known bank identification number (BIN). A fixed number of bytes of the data string may be analyzed using a trie algorithm, in which the value of a first byte is compared with the value of a corresponding first character of the known identifier. A second byte is then compared with a set of values of corresponding second characters, which accompany the first character of the known identifier. Then the value of a third byte of the data string is compared with a set of values of corresponding third values, which accompany the first and second characters of the known identifier. The use of a trie algorithm decreases the length of the search process by several orders of magnitude.

Systems and methods employing searches for known identifiers of sensitive information to identify sensitive information in data

A computing device that is configured for synchronizing multicast data distribution is described. The computing device includes a processor and instructions stored in memory. The computing device reads a block of data and sends the block of data via multicast. It is determined whether a packet in the block of data requires a new mapped file view. This determination is based on the capacity of a current mapped file view on a target node. The computing device delays sending more data if the new mapped file view is required.

Synchronizing multicast data distribution on a computing device

A computing device configured for retransmitting lost packets for multicast is described. It includes a processor and instructions in memory. It identifies data, which it begins sending via multicast. No data is resent until all the data has been sent. The computing device requests missed packet lists and waits. It adds missed packets to a map if there are replies. It determines whether there are any missed packets and resends any missed packets. Another computing device for retransmitting lost packets for multicast is described. It includes a processor and instructions in memory. It identifies data for distribution, which it begins sending via multicast. It waits to resend any data until all of the data has been sent. A missed packet indication is requested and received. The computing device updates lists of complete and incomplete target nodes. It determines and sends a peer download instruction.

Retransmitting lost packets for multicast data distribution

A method and system for polling an administrative system for one or more managed nodes is described. The administrative system is connected to a managed node. The administrative system is polled for data to be downloaded. A node list is sent to the administrative system. A connect list is received from the administrative system. The connect list is multicast to the one or more managed nodes.

Systems and methods for increasing the scalability in a client/server environment

A data string that includes potentially sensitive information, such as an account number for a payment card, may be evaluated using a delimiter search to provide an increased level of confidence that the data string encodes the sensitive information of interest. A delimiter search may include an evaluation of the bytes adjacent to the beginning and end of the data to determine whether or not those bytes have values that correspond to the values of known delimiters. A data string that is not surrounded by known delimiters may be disregarded (i.e., considered not to comprise sensitive information of interest), while a data string that is surrounded by known delimiters may warrant further evaluation.

Systems and methods employing delimiter searches to identify sensitive information in data

Potentially sensitive information (e.g., account numbers for payment cards, etc.) may be identified from data by use of an 'interval scanning' technique, in which a string of data is evaluated in intervals. When a system employs an interval scanning technique, data is evaluated by analyzing bytes of data in periodic sequence (e.g., every thirteenth byte, etc.), while the bytes between the analyzed bytes are initially ignored. If the value of an analyzed byte corresponds to a character of interest (e.g., a decimal numeral or numeric digit (i.e., a character having a value that corresponds to a base-ten, or Arabic, number, 0, 1, 2, 3, 4, 5, 6, 7, 8, or 9), etc.), that byte is identified as a 'base byte,' from which a more focused evaluation (e.g., a byte-by-byte analysis, or sequential analysis, etc.) may then commence.

Systems and methods employing intermittent scanning techniques to identify sensitive information in data

A method and system for authenticating credentials for management of a client is disclosed. The credentials are provided to a verification application. The credentials are authenticated to an authentication application. A connection between the authentication application and a security server is established. An authenticator is invoked. Administrative rights associated with the credentials are verified. An authentication certificate indicating the administrative rights is sent to the client.

Systems and methods for authenticating credentials for management of a client

An exemplary method involves an SSL server receiving an SSL session request from an SSL client. It is determined whether the SSL client is going to use certificate-based authentication. This may involve identifying a port at which the SSL session request was received. Alternatively, this may involve identifying an IP address at which the SSL session request was received. Alternatively still, this may involve examining authentication information in the SSL session request. If the SSL client is going to use certificate-based authentication, a certificate is requested from the SSL client. If the SSL client is not going to use certificate-based authentication, the certificate is not requested from the SSL client.

Systems and methods for selectively requesting certificates during initiation of secure communication sessions

In an exemplary method, a resident agent receives multiple requests from one or more requesting processes for connections to services. The requested services are hosted by a fast service host. The resident agent establishes multiple connections to the one or more requesting processes for the requested services. The resident agent notifies a single instance of a fast service host of the multiple connections. The resident agent facilitates communication between the requested services on the fast service host and the one or more requesting processes. This may involve establishing one or more routing connections to the fast service host, and routing data between the one or more requesting processes and the requested services on the fast service host.

Systems and methods for managing requests for connections to services on a computer system

A method for quarantining a node from other nodes in a network is described. A node is scanned to obtain a health posture of the node by determining if the node is compliant with one or more requirements. A current policy in accordance with the obtained health posture of the node is obtained. A previous policy is removed. If the node is determined to be non-compliant, a key that is unique to the non-compliant node is selected. The current policy is applied.

Systems and methods for quarantining a node from other nodes in a network

A method for managing a computer over a network is disclosed. The method may be implemented by a resident agent on the network. A connection between the resident agent and a sending application may be opened. Application data may be received from the sending application by the resident agent. A header may be received from the sending application by the resident agent. Whether a data package should be sent directly to a receiving application or whether the data package should be sent through a gateway may be determined. If it is determined that the data package should be sent directly to a receiving application, the data package may be sent directly to the receiving application. If it is determined that the data package should be sent through the gateway, the data package may be sent through the gateway.

Growing community of inventors

Orem, UT, United States of America

Alan B Butt