Symantec Corporation

David Buches

William E Sobel

Bruce McCorkendale

David Kane

Patrick Gardner

Mark Spiegel

James J Meyer

A computer-implemented method for securely managing file-attribute information for files in a file system may comprise: 1) identifying at least one file, 2) identifying file-attribute information that identifies at least one file attribute for the file, 3) identifying volatile metadata associated with the file that contains file-attribute information, 4) determining that the file has been modified, and 5) automatically deleting the volatile metadata. Corresponding systems and computer-readable media are also disclosed.

Methods and systems for securely managing file-attribute information for files in a file system

A computer-implemented for sharing the results of computing operations among related computing systems may include: 1) identifying a need to perform a computing operation on a file, 2) identifying a unique identifier associated with the file, 3) determining, by using the unique identifier to query a shared store that is shared by a group of related computing systems, that at least one computing system within the group of related computing systems has previously performed the computing operation on an instance of the file, and then 4) retrieving the results of the computing operation from the shared store instead of performing the computing operation. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for sharing the results of computing operations among related computing systems

A data instance to be shared by multiple virtual machines is stored at a hypervisor level. A file system driver is provided to each virtual machine. Each virtual machine mounts a file system backed by the data instance, and thus has read access to the data through its mounted file system. A virtual machine is suspended. A copy of the data instance is saved as part of the stored image of the suspended virtual machine. The suspended virtual machine is subsequently restored from the stored image, and the copy of the data instance is present in the restored virtual machine. The copy of the data instance is detected at a hypervisor level, and the restored virtual machine is provided with read access to the data instance through its mounted filed system.

Hypervisor assisted single instance data access by multiple virtual machines

A new system service table is dynamically generated to allow dynamic insertion of code between the caller of a native operating system function, in user or kernel mode, and the operating system's implementation of the native operating system function. The dynamically inserted code has full access to the function parameters, such as arguments. The new system service table has encoded values that are relative to the base address of the new system service table and which include the function addresses of the native operating system functions corresponding to original system service table entries in the original system service table.

Fast system call hooking on x86-64 bit windows XP platforms

Techniques are disclosed that exploit system call mechanism to effect robust security applications. In one particular case, security software is able to effectively 'sandbox' user mode applications at the thread granularity level, by replacing the system call mechanism of the operating system with a custom mechanism that limits the rights available to a target application that is vulnerable to malicious attack. The techniques allow the security software to create service tables with varying degrees of security levels, and do not impact performance of non-targeted running processes/threads.

Growing community of inventors

Westlake Village, CA, United States of America

David Buches