Other

Jayant Shukla

Abhay Kanhere

Vamsi Ambati

Chaitanya Pemmaraju

Kiran Thirumalai

In one aspect, a method for defining a group-based policy for access to computing resources by an application/container or a group of application/container, includes the step of with a credential server: specifying a computing resource; specifying a group name and a strong cryptographic identity associated with the group name. The method includes the step of specifying a policy for an application/container belonging to a specific group to access the set of resources belonging to another group. The method includes the step of with a handler process: reading a list of subnets for which authentication is to be enforced. The method includes the step of processing an initiate authentication request with an initiator of a new network connection or initiating a new authentication request with the initiator of the network connection. Upon successful authentication, extracting the group identity of the remote application, checking the group security policy for permitting access, and based on the rule permitting or denying access.

Identity-based segmentation of applications and containers in a dynamic environment

In one aspect, a method for preventing attacks on a web application server by monitoring and validating the API calls executed by the dynamic language code of web application is provided. The method includes the step of scanning the computer system for web applications and the location of dynamic language code or script files used by the web applications. The method includes the step of parsing all script files to identify API calls, the location of API calls, and arguments used in the API calls and storing them as rules.

Runtime detection of injection attacks on web applications via static and dynamic analysis

In another aspect, method useful for monitoring of an API/system call implemented by an application for generating disassembly of an executable binary of the application, includes the steps of scanning a computer system for an executable application. The method includes the step of scanning the computer system for a running process associated with the executable binary. The method includes the step of initiating an application programming interface (API) call monitoring method that associates an observed API/system call with the executable binary. The method includes the step of reporting a set of collected events to a local server.

Methods and systems of disassembling executable code

In one aspect, a computer-implemented method for monitoring and validating execution of an executable binary code, includes the step of, prior to beginning execution of the executable binary code, disassembling the executable binary code, listing all of application programming interfaces (API) or function calls in the executable binary code, generating a validation table for a type of each of the APIs or each of the function calls, a location of each of the APIs or each of the function calls, and a return address of each of the APIs or each of the function calls in the executable binary code, and listing in the validation table the type of each of the APIs or each of the function calls.

System and method for exploiting attack detection by validating application stack at runtime

In one aspect, a method useful for preventing exploitation of a vulnerability in an interpreted code by monitoring and validating an execution of the interpreted code in a script file by an application server, includes the step of generating a mapping for an incoming network connection to a specified script file to be executed by an application server. The computerized method includes the step of inserting a hook for monitoring an application programming interface (API) call or a privileged instruction executed by the application server. The computerized method includes the step of inserting a validation code configured to validate the API call or the privileged instruction executed by the interpreted code in a script.

Deterministic method for detecting and blocking of exploits on interpreted code

The disclosed invention is a new method and apparatus for the management of application/container process identity for authentication and enforcing group-based security policies. Identities and security policies are managed in the cloud. Strong cryptographic identities or digital certificates are provided to each application/container or group of applications/containers. Applications/containers use these digital certificates to mutually authenticate each other before providing access to their resources.

Cloud-based identity management and authentication system for containers and applications

The disclosed invention is a new method and apparatus for detecting and removing virus from a computing device based on a web or network service. Virus is detected by transmitting the attributes and behavior of application modules on a computing device to another computing device via a web service, where it is analyzed. After the item has been classified, that information is sent back to the computing device along with the instructions on how the remove the virus. Along with the instructions on virus remediation a clean copy of the file or a network location of the clean copy can be sent.

Fixing computer files infected by virus and other malware

The disclosed invention is a new cryptographic method which is fast and ideally suited for secure, high volume data communication and storage. The data is encrypted at the source using a private key and then transmitted to a destination over a secure or insecure channel. The destination can either be a local storage device or a non-local station. At the destination the data is decrypted using the same private key. The disclosed invention is a new method and apparatus for data encryption. The mathematical robustness and simplicity of this method brings a great improvement in security and speed as compared to previous block ciphers. The data block length or the key length can also be changed very easily and such changes do not require any significant redesigns in the components of the cipher. This is a significant advantage over previous block ciphers, where extensive modifications are needed if the key or the data block length is to be altered, if this is even feasible.

Growing community of inventors

Sierra Madre, CA, United States of America

Jayant Shukla