Trend Micro Inc.

Jianda Li

Shuosen Robert Liu

Kong Yew Chan

Bharath Kumar Chandra Sekhar

Mark Wendell Painter

Bharath Kumar Chandrasekhar

Narasimham Kodukula

Yong Yew Chan

Pei-wei Wu

In one embodiment, an authentication protocol used in a network security service is performed over non-secure connection, such as HTTP. A router subscribing to the service may send a service request for information about a URL to a server computer providing the service. The service request may be included in a first data set posted by the router to the server computer. The first data set may be described by an HTML form and include an encrypted device authenticator used by the server computer to validate the router. The first data set may further include a server authentication code. In responding to the service request, the server computer returns the server authentication code to the router along with information about the URL. The response may be in a second data set, such as an XML document sent by the server computer to the router over an HTTP connection.

Authentication protocol for network security services

Malicious code patterns of an antivirus may be updated using public DNS (domain name system) servers. An update to the malicious code patterns may be generated and divided into several portions for inclusion in DNS records. The DNS records may be published for caching in public DNS servers. An update client in a client computer may send out DNS queries to receive contents of the DNS records, which include the portions of the update. The update client may combine the portions to update the malicious code patterns in the client computer.

Updating of malicious code patterns using public DNS servers

Content, such as confidential information of an organization, may be protected by automatically categorizing the content. The automatic categorization may be performed by calculating a sensititiy score of the content, the sensitivity score being indicative of whether or not the content is confidential. The sensitivity score may be compared to a threshold. Metadata of the content may be provided to collaborating computers outside the computer network where the content was created. The collaborating computers may compare the metadata to received content to determine if the received content discloses confidential information described by the metadata.

Origination-based content protection for computer systems

A computer-implemented method for implementing URL (Uniform Resource Locator) filtering is disclosed. The method includes receiving an access request for a webpage from a client, the access request being transmitted from a gateway device via a computer network and including at least a portion of a URL for the webpage. The method also includes ascertaining a rating for the at least the webpage. The method additionally includes providing a response to the gateway device via the computer network, the response including the rating and at least a cache hint that includes at least directory block caching for caching in a directory block of a local cache, domain block caching for caching in a domain block of the local cache, and do-not-cache for not caching in the local cache.

Cache techniques for URL rating

Methods and apparatus for rating Uniform Resource Locators (URLs) are disclosed. The method includes determining a request size pertaining to a length of the URL to be rated and for generating a rating request message containing the URL. The rating request message is a DNS (domain name system) message if the request size is less than or equal to a predefined size limitation, and the rating request message is a HTTP (hypertext transfer protocol) message if the request size is greater than the predefined size limitation.

Hybrid method and apparatus for URL filtering

In one embodiment, a router inspects at a network layer source addresses of network layer packets flowing through the router. The router compares the source addresses to addresses of computers employed by spammers, and performs a predetermined action on a particular network layer packet having a source address that belongs to a computer of a spammer. The predetermined action may involve dropping the particular network layer packet or limiting the data transfer rate of the particular network layer packet.

Growing community of inventors

San Jose, CA, United States of America

Jianda Li