Hewlett-packard Development Company, L.P.

Hewlett Packard Enterprise Development LP

Netsuite Inc.

University of California

Hewlett-packard Company

Micro Focus Lcc

Fortify Software, Inc.

Entit Software LLC

Brian V Chess

Sean Patrick Fay

Arthur Do

Roger Thornton

Evan M Goldberg

Philip Edward Hamer

William Ellery Bailey

David B Lavo

Iftach Ragoler

F Joel Ferguson

Ayee Kannan Goundan

Russell Andrew Spitler

Tracy Larabee

Matias Madou

Prajakta Subbash Jagdale

Prajakta Subbash Jagdate

Toshinari Kureha

Koorosh Nouri

A non-transitory processor-readable medium stores code that represents instructions that, when executed at a processor, cause the processor to access an attack description; intercept a data set from an application via an application programming interface (API), where the intercepted data set is based on an attack data set and where the attack data set is used to test for a security vulnerability in the application; correlate, using a Hamming distance, the intercepted data set with the attack description using a correlation type identifier; and report the security vulnerability for the application in response to the intercepted data set based at least in part on a result of the correlation.

Application security testing

The present disclosure provides a system that includes a server hosting an application under test (AUT), an observer configured to monitor instructions executed by the AUT, and a computing device communicatively coupled to the AUT and the observer through a common communication channel. The computing device may be configured to send an application request to the AUT, wherein the application request is configured to expose a potential vulnerability of the AUT. The computing device may receive an application response from the AUT in accordance with the AUT's programming. The computing device may send a service request to the observer, and receive a service response from the observer that contains information corresponding to the instructions executed by the AUT due to the application request, information about the AUT, or information about a server hosting the AUT.

A method is disclosed for migrating a client domain involving identifying a user account entry in a client domain's password table, where the entry includes a user identifier and a first hashed password value, where the first hashed password value is derived from hashing a user password with a client domain hash algorithm. The first hashed password value is re-hashed using a multi-tenant system hash algorithm to obtain a second hashed password value. Another user account entry is created and stored in a multi-tenant system password table along with the second hashed password value and metadata from which the client domain hash algorithm can be determined.

System and method for importing heterogeneous hashed passwords

A computer readable medium includes executable instructions to analyze program instructions for security vulnerabilities. The executable instructions convert diverse program instruction formats to a common format. A system model is derived from the common format. A static analysis is performed on the system model to identify security vulnerabilities. Security vulnerabilities are then reported.

Apparatus and method for developing secure software

In one implementation, a tag is associated with a tainted value of an application and an output context of the application that is associated with output from the application that includes the tainted value is determined. A taint processing is a applied to the tainted value in response to the output of the tainted value, the taint processing is compatible with the output context.

Context-sensitive taint processing for application security

A taint processing applied to a tainted value of an application is identified and an output context of the application associated with output of the tainted value is determined. It is determined whether the taint processing is effective in mitigating a security vulnerability caused by the tainted value for the output context.

Context-sensitive taint analysis

A computer readable storage medium includes executable instructions to identify a memory operation in target source code. A set of constraints associated with the memory operation are developed. The constraints are converted into a Boolean expression. The Boolean expression is processed with a Boolean satisfiability engine to determine whether the memory operation is potentially unsafe.

Apparatus and method for analyzing source code using memory operation evaluation and boolean satisfiability

A computer readable storage medium includes executable instructions to perform a static analysis of a set of target code to identify a first set of security issues. A dynamic analysis of the target code is executed to identify a second set of security issues. The first set of security issues and the second set of security issues are compared and common security issues are reported.

Apparatus and method for performing dynamic security testing using static analysis data

A computer readable storage medium has executable instructions to perform an automated analysis of program instructions. The automated analysis includes at least two analyses selected from an automated analysis of injection vulnerabilities, an automated analysis of potential repetitive attacks, an automated analysis of sensitive information, and an automated analysis of specific HTTP attributes. Protective instructions are inserted into the program instructions. The protective instructions are utilized to detect and respond to attacks during execution of the program instructions.

Apparatus and method for analyzing and supplementing a program to provide security

A computer readable storage medium includes executable instructions to identify a path in target source code. Constraints associated with the path are extracted. The constraints are converted to a Boolean expression. The Boolean expression is processed with a Boolean satisfiability engine to identify either a feasible path or an infeasible path. A feasible path is statically analyzed, while an infeasible path is not statically analyzed.

Apparatus and method for analyzing source code using path analysis and Boolean satisfiability

The present invention relates to Internet based and web applications and the need to reduce page latency and bandwidth usage. The invention can achieve these goals by making use of the cache built in to standard web browsers. In one embodiment, the invention provides that a web application user will use their browser to request a page from the application web server, which responds with a small page that includes a script. The script appends a previously established cookie value to the URL originally requested and the browser then re-requests the URL with the appended cookie value. (The server computes the cookie value based on the last modified time of the data used to generate the page.) If the most recent version of the page is in the browser cache, the browser gets a cache hit, which means the page is retrieved from browser cache rather than from the server, rapidly displaying the page to the user. If, on the other hand, there is only an older version of the page in the browser cache, there is a cache miss (because the rewritten URL will not match any URL in the cache) and the browser will send the request to the server to retrieve the most recent version of the page.

Methods and systems of client-side caching of pages with changing content

A computer readable medium includes executable instructions to analyze program instructions for security vulnerabilities. The executable instructions perform a security audit of program instructions. Based upon the security audit, sensors are inserted into the program instructions. The program instructions are executable and the sensors generate a stream of security events. The stream of security events is monitored and security performance results are reported.

Growing community of inventors

Palo Alto, CA, United States of America

Brian V Chess