Trend Micro Inc.

Vmware, Inc.

Bharath Kumar Chandrasekhar

Narasimham Kodukula

Sachin Shinde

Mandar Nanivadekar

Leena Shuklendu Soman

Vasantha Kumar Dhanasekar

Jeremy Hubble

Matthew Graham Baldwin

Yusong Zhang

Shirish Vijayvargiya

Jonathan James Oliver

Shuang Ji

Jianda Li

Andrew John Dancer

Kong Yew Chan

Vaibhav Mohan Rekhate

Victor Hargrave

Liang-seng Koh

A method of protecting an endpoint against a security threat, wherein the endpoint includes an OS and a separate software entity included in memory pages of the endpoint, includes the steps of: preventing the OS from scheduling any tasks on vCPUs of the endpoint by transferring control of the vCPUs from the OS to the separate software entity; while the OS is prevented from scheduling any tasks on the vCPUs, scanning, by the separate software entity, at least one of a list of processes of the endpoint and a subset of the memory pages of the endpoint, and upon receiving an identification of a malicious process, terminating, by the separate software entity, the malicious process; and after the separate software entity terminates the malicious process, allowing the OS to schedule tasks on the vCPUs by transferring control of the vCPUs from the separate software entity to the OS.

Endpoint isolation and incident response from a secure enclave

A method of protecting an endpoint against a security threat detected at the endpoint, wherein the endpoint includes, in memory pages of the endpoint, an operating system (OS), a separate software entity, and remediation code, includes the steps of: transferring control of virtual CPUs (vCPUs) of the endpoint from the OS to the separate software entity; and while the separate software entity controls the vCPUs, storing, in an interrupt dispatch table, an instruction address corresponding to an interrupt, wherein the remediation code is stored at the instruction address, and replacing a next instruction to be executed by the OS, with an interrupt instruction, wherein the interrupt is raised when the OS executes the interrupt instruction, and the remediation code is executed as a result of handling of the interrupt that is raised.

Endpoint incident response from a secure enclave through dynamic insertion of an interrupt

A method for automatically reregistering a clone virtual machine with a cloud security monitoring service is provided. The method generally includes detecting a connection between a cloud agent running in a virtual machine on a host and a hypervisor module on the host. In response to detecting the connection, the cloud agent queries the hypervisor module for one or more first identifiers of the virtual machine. The method generally includes checking a database, by the cloud agent, for one or more second identifiers stored in the database matching the one or more first identifiers received from the hypervisor module and, based on finding no second identifiers stored in the database matching the one or more first identifiers, sending a request to the cloud security monitoring service to register the virtual machine with the cloud security monitoring service.

Hypervisor assisted virtual machine clone auto-registration with cloud

The disclosure provides an approach for hypervisor-assisted security analysis. Embodiments include receiving, at a hypervisor on a host computer, events from one or more virtual computing instances (VCIs). Embodiments include analyzing, by the hypervisor, the events according to one or more rules to identify a subset of the events for additional analysis. Embodiments include compressing, by the hypervisor, the subset of the events by performing deduplication to produce a compressed subset of the events. Embodiments include transmitting, by the hypervisor, the compressed subset of the events over a network to a separate analysis component, wherein the separate analysis component performs the additional analysis.

Hypervisor-assisted security mechanism

System and method for executing scan operations on computing systems use a sparse file that represents a storage device of a computing system to scan a file stored in the storage device. The sparse file is created and mounted to a scanner appliance such that the sparse file appears to a scan engine of the scanner appliance as a local storage device. When a read request for the file stored in the storage device is issued from the scan engine that results in an implicit read request to the sparse file, the implicit read request is trapped. While the implicit read request is trapped, data of the file is retrieved from the storage device of the computing system to the scanner appliance using a communication transport. The retrieved data of the file is then scanned using the scan engine at the scanner appliance.

System and method for content scanning using sparse files

Apparatus and methods for controlling access by a browser to one or more Internet servers are disclosed. Access control is performed by ascertaining an IP address of an internet server that the user is trying to access and performing lookup of the IP address in an IP address rating database. If the lookup reveals that the IP address to be suspicious and data received from the internet server is encrypted, block the access to the internet server. Alternatively, if the lookup reveals the IP address to be suspicious, block the access to the first internet server by the browser without first performing content analysis on the data from the internet server.

Methods and apparatus for controlling internet access

Social network usage in an enterprise environment is controlled by receiving and processing dynamic postings from a social network to identify indicators of prohibited content. The indicators of prohibited content are employed to identify and block prohibited postings from entering an enterprise network.

Controlling social network usage in enterprise environments

A server computer provides centralized key management services to several computers having encrypted files or file systems. The server computer receives key requests from the computers. The server computer issues a key to a computer that passes an integrity check. The key is used to unlock an encrypted file or file system in the computer. When the computer fails another integrity check after receiving the key, indicating a change in the security posture of the computer, the server computer may revoke the key automatically or upon receipt of an instruction from a key administrator.

Methods and apparatus for controlling access to encrypted computer files

A system for protecting data stored in the cloud includes a computing device that generates a plaintext encryption key and encrypts the plaintext encryption key using a credential of a customer that uses a cloud application. The computing device encrypts plaintext data using the encryption key and forwards the encrypted data to a cloud computer system that hosts the cloud application. The plaintext data can be received from a cloud application client that runs in the computing device or from another computing device that hosts the cloud application client. The encrypted encryption key can be stored in and retrieved from a key server.

Protection of data stored in the cloud

A system for controlling access to cloud applications includes a cloud security server that receives network traffic stream from cloud application clients of a private computer network. The cloud security server examines the network traffic stream to identify a cloud application that is associated with the network traffic stream and directs the network traffic stream to one of several application handlers that is configured to process network traffic stream for the cloud application. The application handler enforces on the network traffic stream an application policy that is applicable to the cloud application.

Control of cloud application access for enterprise customers

A cloud-based email system is accessed by way of a cloud access security system. The cloud access security system allows for encryption of incoming emails and outgoing emails stored in the cloud-based email system. The cloud access security system includes a protocol proxy for providing an interface between a client computer of a user and the cloud-based email system, an encryption module for indexing and encrypting emails, and an event listener for receiving email event notifications from the cloud-based email system and replacing emails with corresponding encrypted emails. The cloud access security system may receive encryption keys from a key manager hosted by a key server, which may be part of the cloud access security system or hosted on premise in the same private computer network as client computers employed by users.

Security system for cloud-based emails

A cloud access security system provides security to data stored in the cloud. The cloud access security system maintains version service information that indicates servers that service web services calls to particular versions of a cloud application service. Upon detection of a web service call to an unknown version of the cloud application service, the cloud access security system redirects the web service call to a known good server that services web service calls that are made to a previous version of the cloud application service. The cloud access security system may employ an encryption scheme that allows for partial decryption.

Security system for data stored in the cloud

Virtual machine images in a cloud computing environment may be certified using a validator machine image. The validator machine image is configured to boot a validator virtual machine, which boots a virtual machine off a virtual machine image from among virtual machine images available in the catalog of the cloud computing environment. The validator virtual machine may scan the virtual machine for malware, including computer viruses. A virtual machine image from among the virtual machine images may be packaged to include a certifier agent that verifies the virtual machine image upon execution. Reputation of virtual machine images may be stored in a virtual machine image reputation database and made available by way of a portal.

Growing community of inventors

Sunnyvale, CA, United States of America

Bharath Kumar Chandrasekhar