Hewlett-packard Development Company, L.p.

Eric C Scoredos

Wan-Yen Hsu

David Lin

John R Diamant

Nobuhisa Takahashi

Hrishikesh Talgery

An embodiment of the invention provides an apparatus and method for automatic detection of a vulnerability exploit. The apparatus and method are configured to post a security vulnerability warning indicating a vulnerability of software; provide an exploit detector; and use the exploit detector to detect an attempted exploit that targets the vulnerability.

Automatic detection of vulnerability exploits

Method and apparatus for enabling continuous validation of a data structure by acquiring a first read lock for the data structure and processing the data structure under the first read lock. When the first read lock is relinquished and subsequently reacquired, the method provides for determining if a write lock was granted prior to reacquiring the first read lock. The data structure is further processed when a write lock was not granted and is revalidated when a write lock was granted.

Method and apparatus for validation of continuous access to a data structure

A database operable in a multithreaded environment has a database update code. Each thread accessing the database obtains lock prior to walking the database. Any thread that alters database structure, such as by adding or deleting a record of the database, writes the database update code. Before releasing lock, the thread copies the database update code and a current record pointer into memory locations private to the thread. When a thread requires a second access to a record of the database, it obtains lock. The thread then compares its copy of the update code to the database update code, if they are different the thread must re-walk the database to locate the record since database structure has changed since the thread first accessed the database. If the thread's copy of the update code matches the database update code, database structure has not changed since a prior access of the thread to the database; in this case the record may be accessed through the thread's copy of the record pointer with no walk required. In a particular embodiment, the database is accessed through a hash table and contains firewall connection and filter rule information.

Method and program product for reducing database walk frequency while repetitively accessing a firewall connection and rule database

A method for controlling connections from an IP entity to a server. Initially, a limit count, representing a number of concurrently allowable connections between the IP entity and the server, is determined. When an incoming IP packet is received, the packet is processed to determine the source and destination IP addresses for the packet. An entry is then created in a limit table for the IP entity, if no entry for that IP entity exists in the table. A determination is made as to whether a pending connection should be allowed for the packet, by referring to the limit count and the entry in the limit table. The connection is allowed, and the limit count for the entry is incremented, if the attempted connection would not exceed the limit count for the IP entity; otherwise, the packet is blocked if the attempted connection would exceed the limit count for the IP entity.

System for controlling client-server connection requests

A rule-based selection, storage and access method and system for processing packets from network traffic. First, packet intercepted from network traffic are selected based on at least one rule. Second, the selected packets are stored in an in-kernel storage buffer, which can be tuned to a size that is appropriate to the number packets being captured and the ability of a packet usage application (e.g., a billing program) to process the packets. Third, an access mechanism is provided to a packet usage application for accessing the stored packets. The intercepted network traffic is provided to a receiving application.

Growing community of inventors

Boulder Creek, CA, United States of America

Eric C Scoredos