Check Point Software Technologies Ltd.

Starfish Software, Inc.

Borland International, Inc.

Gregor Paul Freund

Philippe Richard Kahn

Sonia Lee

Keith Allan Haycock

Conrad Hermann

Conrad Kamaha'o Herrmann

A computing environment with methods for monitoring access to an open network such as the Internet, is described. The system includes one or more client computers, each operating applications (e.g., Netscape Navigator or Microsoft Internet Explorer) requiring access to an open network, such as a WAN or the Internet, and a router or other equipment that serves a routing function (e.g., a cable modem) for the client computers. A centralized security enforcement module on the router maintains access rules for the client computers and verifies the existence and proper operation of a client-based security module on each client computer. The router-side security module periodically sends out a router challenge via Internet broadcast to the local computers on the network. If the client-side security module is installed and properly operating, the client-side security module responds to the router challenge. The responses received by the router-side security module are maintained in a table. Each time the router receives a request from a client computer to connect to the Internet, the router-side security module reviews the table and analyzes whether or not the computer requesting a connection to the Internet properly responded to the most recent router challenge. If it determines that the computer has properly responded to the router challenge, then it permits the computer to connect to the Internet. If a computer has not properly responded or if a computer has not answered the router challenge, then the computer is not allowed to connect to the Internet as requested.

System providing internet access management with router-based policy enforcement

A security system with methodology for interprocess communication control is described. In one embodiment, a method for controlling interprocess communication is provided that includes steps of: defining rules indicating which system services a given application can invoke; trapping an attempt by a particular application to invoke a particular system service; identifying the particular application that is attempting to invoke the particular system service; and based on identity of the particular application and on the rules indicating which system services a given application can invoke, blocking the attempt when the rules indicate that the particular application cannot invoke the particular system service.

Security system with methodology for interprocess communication control

A security system with methodology providing verified secured individual end points is described. In one embodiment, for example, a method of the present invention is described for controlling access to a particular application, the method comprises steps of: defining firewall rules specifying filtering conditions for incoming network traffic, the firewall rules including an application attribute that allows individual rules to be associated with specific applications, the firewall rules also including extended attributes that allow specification of additional conditions that a given end point is required to meet; intercepting incoming network traffic destined for a particular application for which a particular application-specific firewall rule has been created; examining the extended attributes for the particular application-specific firewall rule, for determining what additional conditions the given end point must comply with in order to communicate with the particular application; if the given end point complies with the additional conditions, allowing the end point to communicate with the particular application; and otherwise blocking the end point to prevent communication with the particular application.

Security system with methodology providing verified secured individual end points

System and methodology for intrusion detection and prevention is described. In one embodiment, for example, a method is described for detecting and preventing network intrusion, the method comprises steps of: defining intrusion descriptions specifying exploits that may be attempted by malicious network traffic, the intrusion descriptions indicating specific applications that may be targeted by individual exploits; for a particular application participating in network communication, deriving a subset of the intrusion descriptions specifically applicable to that particular application; using the subset of the intrusion descriptions specifically applicable to that application, monitoring network traffic destined for the particular application for detecting an attempted network intrusion; and if a network intrusion is detected, blocking network traffic destined for the particular application determined to comprise an exploit.

System and methodology for intrusion detection and prevention

A system and methodology for protecting new computers by applying a preconfigured security update policy is described. In one embodiment, for example, a method is described for controlling connections to a computer upon its initial deployment, the method comprises steps of: upon initial deployment of the computer, applying a preconfigured security policy that establishes a restricted zone of preapproved hosts that the computer may connect to upon its initial deployment; receiving a request for a connection from the computer to a particular host; based on the preconfigured security policy, determining whether the particular host is within the restricted zone of preapproved hosts; and blocking the connection if the particular host is not within the restricted zone of preapproved hosts.

System and methodology for protecting new computers by applying a preconfigured security update policy

A system and methodology for providing community-based security policies is described. In one embodiment in a system comprising a plurality of devices connected to a network, a security module is provided for establishing security settings for regulating network access at these devices. Information is collected from at least some the devices about the security settings established on such devices and consensus security settings are generated based upon the collected information. In response to a request for network access at a particular device, determining whether or not to permit network access is based, at least in part, upon the consensus security settings.

System and methodology for providing community-based security policies

A system providing methodologies for automatically detecting when a computing device is plugged into a new network is described. The system includes methods for detecting a connection to a new network by receiving notice of, and evaluating, changes to an existing network configuration. The system profiles and generates an identity for the new network. This includes collecting information about the network to uniquely identify it and generating a unique identifier for the network. Once a network has been profiled, a user may decide whether or not to include it as part of a trusted zone. Alternatively, this decision may be guided by policy established by a system administrator or user. The system automatically reconfigures a firewall to include or exclude the network from the trusted zone based upon this decision. The profile of each network is stored so that the next time the device is connected to the same network it remembers the network and applies the same security settings previously adopted. The stored profile also facilitates the detection of changes to the network configuration or the connection to a new network.

System methodology for automatic local network discovery and firewall reconfiguration for mobile computing devices

Information Management System and methods providing an improved user interface (UI) are described. In particular, the present invention provides a specialized region of the user interface which comprises a world or 'landscape' which is a core representation or view of the user's own data. To render the landscape with representations of the data most important to the user, the system, at runtime, actually examines the underlying data which has been stored by the user. The system then dynamically alters the user interface at runtime to include representations of information which is important to the user. In operation, the system presents an interface comprising a background bitmap and further comprises diverse objects which are 'plugged into' the background. Each object which is plugged in is typically a completely separate object which represents particular user data which is of interest to a currently logged-on user. Multiple background bitmaps or landscapes are provided so that a user may select a preferred representation of his or her 'world' (e.g., family), including selecting completely different landscape environments (e.g., office). The system automatically adapts the objects placed on the landscape for the particular background setting which the user has chosen. Based on the user's actual data, the system regenerates the appropriate objects which are plugged into the landscape for representing the user's own data.

Information management system with user data-based user interface

System and methods are described for efficient storage and processing of non-uniform data records. An exemplary embodiment includes a Databank system having a Database Engine, a Database Engine API (Application Program Interface), a Databank Engine, a Databank Engine Class Interface, and a Databank (storage). The Databank storage itself comprises a Descriptor Table (Form Definition) and a Data Repository. The Descriptor Table comprises a plurality of field descriptors for characterizing user information stored in the Databank. The Data Repository, on the other hand, stores the actual data from the non-uniform data records. It comprises 'static' fields and a 'dynamic' field. The static fields store core fields necessary for characterizing each data record (irrespective of what type of information a given data record stores). User data are stored in a structured, pre-defined manner using logical fields (or 'subfields') of the dynamic field. The system correctly interprets the dynamic contents based on the information stored in the descriptors. Methods are described for storing and retrieving information from the Databank in a manner which is transparent to clients, thus allowing the Databank subsystem to easily replace existing storage subsystems.

Databank system with methods for efficiently storing non uniforms data

Databank system with methods for efficiently storing non-uniform data

A data access system of the present invention includes an interface (client), a data engine having a common application programming interface layer, and data drivers. Through the drivers, the data engine (responding to client requests) accesses foreign data objects, which may include information tables, files, and other data objects of a foreign format. In this manner, the system provides a virtual interface between a client (e.g., database manager) and individual foreign data objects (e.g., database files). Regardless of the format of the individual database files, all files can be shared without the need to make copies.

Growing community of inventors

San Francisco, CA, United States of America

Gregor Paul Freund