Aladdin Knowledge Systems Ltd.

Dany Margalit

Yanki Margalit

Oded Cohen

Shimon Gruper

Michael David Collins

Ron Darziv

Rami Kastershtien

Edna Cahanovitc

Inbal Meir

Asaf Levi

In one aspect, the present invention is directed to a method for detecting spyware activity, the method comprises the steps of: monitoring outgoing communication data sent from a user's computer; searching for predefined keywords within the communication data; indicating spyware activity in the user's computer by presence of at least one of the predefined keywords within the communication data, the keywords are selected from a group comprising: a signature of the spyware, personal information of the user, an addressee to where the communication data is sent. The method may further comprise: upon detecting a spyware activity in the user's computer, blocking communication from the computer. The method may further comprise removing the spyware. The blocking can be carried out at the user's computer, at the gateway to which the user's computer is connected, etc.

Method and system for detecting blocking and removing spyware

A method and system for indicating an executable as Trojan Horse, based on the CRC values of the routines of an executable. The method comprising a preliminary stage in which the CRC values of the routines of known Trojan Horses are gathered in a database, and a stage in which indicating an executable as Trojan Horse is carried out by the correspondence of the CRC values of the routines of said executable to the CRC values of the known Trojan Horses, as gathered in said database. The system comprising means for calculating the CRC values of routines; means for identifying the borders of the routines of an executable; a database system, for storing the CRC values of routines of known Trojan Horses; and means for determining the correspondence between two groups of CRC values, thereby enabling detection of the correspondence of an executable to at least one known Trojan Horse.

Method and system for indicating an executable as trojan horse

A method for preventing activating a malicious object passing through a checkpoint, and decreasing the overall inspection delay thereof, the method comprising the steps of: (a) at the checkpoint, creating an envelope file, being an executable file comprising: the object; code for extracting the object from the envelope file; and an indicator for indicating the integrity of the object; (b) forwarding the envelope file instead of the object toward its destination, while holding at least a part of the envelope file which comprises the indicator; (c) inspecting the object; and (d) setting the indicator on the envelope file to indicate the inspection result thereof, and releasing the rest of the envelope file.

Method for preventing activation of malicious objects

A user-computer interaction method for use by a population of flexibly connectible computer systems and a population of mobile users, the method comprising storing information characterizing each mobile user on an FCCS plug to be borne by that mobile user; and accepting the FCCS plug from the mobile user for connection to one of the flexibly connectible computer systems and employing the information characterizing the mobile user to perform at least one computer operation.

User-computer interaction method for use by a population of flexible connectable computer systems

The present invention is directed to a method for indicating the integrity of a collection of digital objects, such as a software package, an email with attachments, etc.) The method comprising the steps of: Sealing the collection of digital objects by gathering the hash values of the digital objects into a binding file and digitally signing the binding file (the binding file may further comprise information about the relations between the objects); and Indicating the integrity of a sealed collection of digital objects by validating the integrity of its binding file via its digital signature; and validating the integrity of each object by the correspondence of its hash value with the corresponding hash value stored within the validated binding file.

Method for indicating the integrity of a collection of digital objects

The present invention is directed to a method for emulating an executable code, whether it is a human-readable code (e.g., macro and script) or a compiled code (e.g. Windows executable). At the design time, one or more content attributes are defined for the variables of the code. A content attribute indicates a property with relevance to maliciousness, e.g. Windows directory, a random value, '.EXE' at the right of a string, etc. A content attribute may be implemented, for example, by a flag. Also defined at the design time, is a list of malicious states, where a malicious state comprises at least the combination of a call to a certain system function with certain content, as the calling parameter(s). When emulating an assignment instruction, the attributes of the assigned variable are set according to the assigned content. When emulating a mathematical operator, a content mathematics is also applied. When emulating a function call, the current state (i.e. the function identity and the calling content and values) is compared with the pre-defined malicious states, and if at least one malicious state corresponds, then the maliciousness of the code is determined.

Method for emulating an executable code in order to detect maliciousness

A method for indicating the integrity of the use-information of a program, comprising: providing a mechanism based on the state of a marker file (being one or more files dedicated especially for this purpose) for generating upon request an asymmetric (i.e. can be read by a user but cannot be altered by him) and unique or pseudo-unique value; instructing the mechanism to generate a value; sealing the use-information with the generated value; and indicating the integrity of the sealed data by the correspondence of the stored value with the current value returned by the mechanism. In a preferred embodiment of the invention, the information is stored in a secure manner (e.g. encrypted, digitally signed, and so forth). The invention may be implemented in any licensing model in which the use-information is important, like a Try before you Buy model, renting a program, and so forth.

Method for indicating the integrity of use-information of a computer program

A smart card&mdash;host system that operates without the intermediation of a smart card reader. The smart card&mdash;host system comprises a host, which has a USB interface, and a portable device, which provides smart card function(s). The portable device has a smart card chip for performing the smart card function(s); a USB interface for connecting the portable device with the host via USB protocol; and a microprocessor for controlling the transfer of data between the USB interface and the smart card chip, for converting data from a USB format to the format of the smart card chip and for converting data from the format of the smart card chip to a USB format.

USB key apparatus for interacting with a USB host via a USB port

User-computer interaction method for use by a population of flexibly connectable computer systems

This invention discloses a cable apparatus for use in conjunction with a computer system having a first socket disposed in the rear thereof in order to accommodate at least one cable without occupying a workspace of a user of the computer system, and a frequently disconnected peripheral unit which includes a second socket via which a peripheral unit is frequently connected to the computer system and frequently disconnected therefrom, the cable apparatus including a cable, at a first end of the cable, a third socket mating with the first socket, and at a second end of the cable, the cable includes a fourth socket mating with the second socket and a cable end adherent operative to attach the second end of the cable to a user-selected surface within the workspace.

Growing community of inventors

Ramat Gan, Israel

Dany Margalit