Sophos Limited

James Christopher Carpenter

Steven John Braggs

Secure hashing of large files to verify file identity. In some implementations, a method includes determining a size of a particular file received by an endpoint device, and searching for a record indexed in a data structure based on the size. In response to finding the record, a sequence of multiple records is accessed in the data structure. For each record of the sequence, a particular data portion is hashed that has a location in the particular file that corresponds to a location in the record to obtain a particular hash result. In response to the particular hash result matching a corresponding previous hash result stored in the record based on an associated data portion in an associated file, the particular file is determined to be the same as the associated file, and characteristics of the particular file are determined using file information for the associated file.

Secure hashing of large data files to verify file identity

In a system and method for processing computer system events asynchronously for software security operations, a computer memory is configured for a read operation by a computer process. The computer process loads, based on a first event occurring during the read operation, at least one file in the computer memory. At least one thread of the computer process is generated. An execution of the at least one thread of the computer process is delayed based on a second event occurring after the first event. A security operation is performed on the process contemporaneously with the loading of the file in the computer memory and the blocking of the execution of the at least one thread of the computer process. The process is either un-delayed on completion of the previous security operation or other security operations performed on that process.

Growing community of inventors

Oxford, United Kingdom

James Christopher Carpenter